slopbrick 0.41.0 → 0.42.0

package/dist/index.cjs

@@ -36,7 +36,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.41.0";
+    VERSION = "0.42.0";
   }
 });
 
@@ -46884,11 +46884,11 @@ var init_pool = __esm({
         for (let i = 0; i < this.threadCount; i++) {
           spawnWorker();
         }
-        return new Promise((resolve42) => {
+        return new Promise((resolve43) => {
           const check = setInterval(() => {
             if (resolved) {
               clearInterval(check);
-              resolve42(results);
+              resolve43(results);
             }
           }, 10);
         });
@@ -46905,23 +46905,16 @@ var init_registry = __esm({
     init_builtins();
     RuleRegistry = class {
       rules = /* @__PURE__ */ new Map();
-      register(ruleOrId, factory) {
-        if (typeof ruleOrId === "string") {
-          if (!factory) {
-            throw new Error("Factory is required when registering by id");
-          }
-          const rule = {
-            id: ruleOrId,
-            category: factory.category,
-            severity: factory.severity,
-            aiSpecific: factory.aiSpecific,
-            create: factory.create,
-            analyze: factory.analyze
-          };
-          this.rules.set(ruleOrId, rule);
-        } else {
-          this.rules.set(ruleOrId.id, ruleOrId);
-        }
+      /**
+       * Register a rule. The 2-arg overload `register(id, factory)` was
+       * deleted in v0.42.0 (architecture review F6): no callers used it,
+       * every `Rule` carries its own `id`, and the per-id registration
+       * was ergonomically redundant with the 1-arg form (`register(rule)`).
+       * External consumers that needed `register-by-id` semantics can
+       * construct a `Rule` directly and pass it in.
+       */
+      register(rule) {
+        this.rules.set(rule.id, rule);
       }
       loadBuiltins(onlyRuleId) {
         for (const rule of builtinRules) {
@@ -46950,6 +46943,15 @@ var init_registry = __esm({
       all() {
         return Array.from(this.rules.values());
       }
+      /** v0.42.0 (§3b.5): look up a registered rule by id.
+       *  Returns undefined if not registered. */
+      get(id) {
+        return this.rules.get(id);
+      }
+      /** v0.42.0 (§3b.5): check whether a rule id is registered. */
+      has(id) {
+        return this.rules.has(id);
+      }
       createContexts(config, filePath, cwd, hotspotIssues = []) {
         const context = {
           config,
@@ -50601,6 +50603,10 @@ var init_signal_strength2 = __esm({
 });
 
 // src/engine/worker.ts
+var worker_exports = {};
+__export(worker_exports, {
+  scanFile: () => scanFile
+});
 function buildParserCacheConfig(cwd) {
   const envVal = process.env.SLOP_AUDIT_CACHE;
   const enabled = envVal === "1" || envVal === "true";
@@ -50677,6 +50683,36 @@ async function scanFile(filePath, config, registry, cwd = process.cwd()) {
     const issues = applyRuleOverrides(rawIssues, config.rules);
     const triggeredRuleIds = Array.from(new Set(issues.map((i) => i.ruleId)));
     const compScore = compositeScore(triggeredRuleIds, loadSignalStrength());
+    const fireSet = new Set(triggeredRuleIds);
+    const factsWithFireSet = Object.assign(facts, {
+      compositeFireSet: fireSet
+    });
+    for (const { rule } of rules) {
+      if (!rule.id.startsWith("composite/")) continue;
+      try {
+        const compositeIssues = rule.analyze(
+          rule.create({
+            config,
+            filePath,
+            cwd,
+            framework: config.framework,
+            uiLibraries: config.uiLibraries,
+            hasTailwind: config.hasTailwind,
+            supportsRsc: config.supportsRsc,
+            hotspotIssues: []
+          }),
+          factsWithFireSet
+        );
+        if (compositeIssues.length > 0) {
+          issues.push(...compositeIssues);
+          for (const ci of compositeIssues) fireSet.add(ci.ruleId);
+        }
+      } catch (err) {
+        if (process.env.SLOP_AUDIT_DEBUG === "1") {
+          console.error(`[worker] composite ${rule.id} threw: ${err.message}`);
+        }
+      }
+    }
     const gapValues = collectGapValues(facts);
     const styleSources = collectStyleSources(facts);
     const elementTags = facts.v2.jsx.elements.map((e) => e.tag);
@@ -54542,29 +54578,29 @@ function renderStructureMarkdown(inventory, constitution) {
   return lines.join("\n");
 }
 async function writeStructureMarkdown(workspaceDir, md) {
-  await new Promise((resolve42, reject) => {
+  await new Promise((resolve43, reject) => {
     try {
       const path = (0, import_node_path23.join)(workspaceDir, STRUCTURE_MD_FILE);
       (0, import_node_fs21.mkdirSync)((0, import_node_path23.dirname)(path), { recursive: true });
       (0, import_node_fs21.writeFileSync)(path, md, "utf-8");
-      resolve42();
+      resolve43();
     } catch (err) {
       reject(err instanceof Error ? err : new Error(String(err)));
     }
   });
 }
 async function readStructureMarkdown(workspaceDir) {
-  return new Promise((resolve42) => {
+  return new Promise((resolve43) => {
     try {
       const path = (0, import_node_path23.join)(workspaceDir, STRUCTURE_MD_FILE);
       if (!(0, import_node_fs21.existsSync)(path)) {
-        resolve42(null);
+        resolve43(null);
         return;
       }
       const content = (0, import_node_fs21.readFileSync)(path, "utf-8");
-      resolve42(content);
+      resolve43(content);
     } catch {
-      resolve42(null);
+      resolve43(null);
     }
   });
 }
@@ -54614,6 +54650,388 @@ var init_structure_md = __esm({
   }
 });
 
+// src/snippet/data.ts
+var CATEGORY_DIRECTIVES, RULE_HINTS;
+var init_data = __esm({
+  "src/snippet/data.ts"() {
+    "use strict";
+    CATEGORY_DIRECTIVES = {
+      visual: 'Avoid the saturated "vibe purple" Tailwind palette (violet-400-700, indigo-400-700). Prefer emerald, sky, amber, rose for accents. Never use arbitrary color values like bg-[#7c3aed] when a token exists.',
+      logic: "Never use explicit `any`. Use `unknown` and narrow. Always add an AbortSignal to fetches. Handle errors with try/catch, never swallow with empty catch. Use `as const` instead of `as Type` casts.",
+      wcag: 'All form inputs must have an accessible label (visible <label>, aria-label, or aria-labelledby). Decorative images must have empty alt="". Buttons must be <button>, never <div onClick>. Touch targets must be \u2265 24\xD724 CSS px.',
+      security: 'Never store tokens in localStorage or sessionStorage \u2014 use httpOnly Secure SameSite cookies. Never put secrets in NEXT_PUBLIC_* / REACT_APP_* / VITE_* env vars. Validate e.origin in postMessage handlers. Never dangerouslySetInnerHTML with user input. Never use target="_blank" without rel="noopener".',
+      perf: "Always use AbortController with fetch. Use image width/height attributes to prevent CLS. Use <Suspense> around async client components. Don't load all images eagerly.",
+      typo: `Never leave TODO / placeholder / "change me" copy in shipped code. Use real i18n strings or the project's content map.`,
+      layout: "Don't stack badge-above-h1 hero patterns. Don't build 3-stat banner rows without explicit user request. Don't use emoji inside nav items (use SVG icons). Use the project's spacing scale (4px or 8px grid), never arbitrary values like p-[13px].",
+      component: "Don't build components > 200 lines. Extract shared subcomponents. Avoid circular prop drilling \u2014 use context.",
+      arch: "For Astro: server-render everything by default; only opt-in to client islands when you need interactivity. Don't put secrets in client-side code.",
+      test: "Use domain-specific fixture data, assert on value shapes not just truthiness, and consolidate repeated setup into helpers. Avoid `expect(x).toBeDefined()` placeholders and textbook fixtures like 'John Doe' or 'test@test.com'."
+    };
+    RULE_HINTS = {
+      // v0.38.0 hygiene: 37 v10-DORMANT rule hints were removed. Every
+      // remaining key matches a rule in src/rules/builtins.ts. No orphans.
+      // (v0.16.0 previously moved 35 out-of-scope orphan hints to
+      //   docs/research/backlog-rule-hints.md
+      // for future implementers to paste back when the corresponding rules ship.)
+      "security/hardcoded-secret": "Never inline API keys, JWT secrets, or database passwords in source. Load them from env vars and never commit a .env file. Assume any published secret is compromised and rotate it.",
+      "security/exposed-env-var": "NEVER prefix a secret with NEXT_PUBLIC_, VITE_, REACT_APP_, EXPO_PUBLIC_, GATSBY_, or PUBLIC_ \u2014 those vars are inlined into every browser build.",
+      "security/dangerous-cors": "Don't set Access-Control-Allow-Origin: * on production endpoints. Restrict to an explicit allowlist; never combine wildcard origin with credentials: true.",
+      "security/missing-auth-check": "Every server route handler must perform an authentication + authorization check at the top. Reachability of an endpoint by any user (authenticated or not) is a vulnerability, not a feature.",
+      "security/unsafe-html-render": "Sanitize any non-literal value passed to dangerouslySetInnerHTML with DOMPurify. Better: avoid the prop entirely and let React escape via children.",
+      "security/fail-open-auth": "Don't gate auth bypasses on NODE_ENV. Replace dev-env checks with an explicit AUTH_BYPASS flag that's never set in production.",
+      "security/sql-construction": 'Never build SQL with string concatenation or template-literal interpolation. Use parameterized queries: pg client.query("... WHERE id = $1", [id]) or your ORM query builder.',
+      "security/public-admin-route": "Routes under /admin, /internal, /debug, /staff, /manage, /private need an explicit role check on top of standard auth \u2014 auth alone is not enough for privileged paths.",
+      "visual/arbitrary-escape": "Never use bracket-notation values like text-[13px] or bg-[#7c3aed]. Use design tokens instead.",
+      "visual/spacing-scale-violation": "Use spacing scale tokens (p-2, gap-4, etc.) instead of arbitrary values like p-[13px] or gap-[1.75rem].",
+      "visual/radius-scale-violation": "Use radius scale tokens (rounded-md, rounded-lg, etc.) instead of arbitrary values like rounded-[7px].",
+      // v0.16.0 — in-scope orphans kept here (corresponding rule ships in v0.16.0).
+      "typo/placeholder-text": 'Never leave "TODO", "placeholder", "change me", "your text here" in shipped UI.',
+      "logic/key-prop-missing": "Always provide a stable `key` prop when rendering lists.",
+      "logic/boundary-violation": "Don't import data-layer / DB code into UI components. Server-side only.",
+      "wcag/missing-alt": 'Every <img> needs alt text. Decorative: alt="". Informative: describe the image.',
+      "security/localstorage-token": "Never store JWT / access token / refresh token in localStorage or sessionStorage. Issue as httpOnly cookie.",
+      "security/eval": "Never use eval() or new Function(). These are RCE vectors if the input is ever attacker-controlled.",
+      "security/target-blank-no-noopener": 'Always add rel="noopener" (or rel="noreferrer") to target="_blank" links.',
+      "component/giant-component": "Don't build components > 200 lines. Extract shared subcomponents.",
+      "component/multiple-components-per-file": "One component per file. Move subcomponents into their own files so the Context Window stays small and boundary tests are easy.",
+      "component/shadcn-prop-mismatch": "Select shadcn variants via the `variant` prop, not long `className` overrides. See the component registry for available variants.",
+      "context/import-path-mismatch": "Use only the canonical import paths declared in brick.config.json (e.g. @/components/ui/, @/lib/).",
+      "layout/gap-monopoly": "Mix gap-2 / gap-4 / gap-6 / gap-12 deliberately. Don't repeat the same gap value across the whole project.",
+      "layout/math-element-uniformity": "Human files have lopsided interactive counts (1 button + 12 inputs). AI tends to balance them. Build forms with many inputs and few buttons.",
+      "layout/math-grid-uniformity": "Vary grid-cols-N (grid-cols-2, grid-cols-3, grid-cols-4, grid-cols-6) across sections instead of repeating grid-cols-3.",
+      "layout/spacing-grid": "Use the configured spacing scale (4px or 8px grid). Avoid arbitrary values like p-[13px] that aren't on the scale.",
+      "logic/ghost-defensive": "Use optional chaining (?.) or early returns instead of deep && guards. If a defensive chain runs 3+ levels deep, refactor.",
+      "logic/heaps-deviation": "Inspect for LLM-style vocabulary patterns: this file's vocabulary grows faster (high Heaps \u03BB) or slower (low \u03BB) than typical source code. Verify authorship if unexpected. (v0.12.0 \u2014 Christ et al. EMNLP Findings 2025.)",
+      "logic/ks-distribution-shift": "Inspect the shifted features. KS detects both AI anomalies and production-rot anomalies (it is symmetric); combine with Heaps/Zipf for AI-specific signal. (v0.12.0 \u2014 arXiv:2510.15996, Oct 2025.)",
+      "logic/zipf-slope-anomaly": "Inspect for LLM-style frequency distribution: this file's identifier usage is more peaked or flatter than typical human code. (v0.12.0 \u2014 Christ et al. EMNLP Findings 2025.)",
+      "logic/math-any-density": "Replace `: any` with proper types. Start with the parameter/return types of the most-used functions.",
+      "logic/math-console-log-storm": "Replace debug logs with a proper debugger or logger.debug(). Remove all console.log before shipping.",
+      "logic/math-gini-class-usage": "Spread usage across more class tokens instead of repeating the same handful (p-4, p-8, rounded-lg, etc.).",
+      "logic/math-variable-name-entropy": "Use domain-specific identifier names (reservations, invoices, customers) instead of generic data/items/value.",
+      "logic/optimistic-no-rollback": "In optimistic updates, revert state in the catch block: `setX(prev => prev)`. Never leave stale UI on error.",
+      "logic/reactive-hook-soup": "Coordinate state via a single derived value (useMemo) or a state machine. Avoid chained useEffects that sync local state.",
+      "logic/zombie-state": "Remove unused useState or wire it into the component. Don't leave declared-but-never-read state bindings.",
+      "dead/unused-import": "Remove the import or use the symbol somewhere. Unused imports are the most common AI-iteration signature \u2014 the model added it for a feature, then rewrote the function without cleaning up.",
+      "dead/unused-local": "Remove the declaration or use the variable. AI-iteration signature: the model declared a binding for a feature, then rewrote the function without cleaning up.",
+      "dead/unused-parameter": "Remove the parameter (and update every call site) or use it in the function body. AI-iteration signature: the model added a parameter for a feature, then rewrote the function without removing parameters the new code does not need.",
+      "dead/dead-branch": "Replace the literal boolean with a real condition, or remove the dead branch. AI-iteration signature: a feature flag toggled to a constant, or a wrapper from a previous refactor that was never cleaned up.",
+      "dead/unreachable": "Remove this statement \u2014 code after a return/throw/break/continue is unreachable. AI-iteration signature: the model added an early return for a new error path, then forgot the rest of the function body was still sitting below it.",
+      "perf/cls-image": "Add width/height attributes or an aspect-ratio utility to prevent layout shift.",
+      "perf/css-bloat": "Extract to a CSS variable (`--surface-card`) or a component prop when a class string repeats 5+ times.",
+      "typo/math-button-label-uniformity": 'Mix button lengths deliberately \u2014 pair a short "Save" with a longer "Mark as complete" \u2014 instead of repeating the same template.',
+      "visual/inline-style-dominance": "Replace inline `style={{...}}` with className utilities (e.g. Tailwind `p-4 m-2 gap-3`) or a CSS module class.",
+      "visual/math-default-font": "Import a distinctive font (next/font/google, @font-face, or a CSS variable) instead of relying on the framework default.",
+      "visual/math-font-entropy": "Use a wider range of text sizes (text-xs, text-sm, text-lg, text-xl, text-2xl, text-3xl) for a more deliberate type scale.",
+      "visual/math-rounded-entropy": "Use a wider range of border-radius values (sm, md, 2xl, 3xl) instead of repeating the same lg/xl/full pattern.",
+      "visual/math-spacing-entropy": "Mix more spacing values from the design scale (e.g. 3, 5, 7, 10, 14, 20, 28) instead of repeating the same 4/8 pattern.",
+      "visual/naturalness-anomaly": "Use domain-specific identifier names so the identifier stream reflects the actual problem domain. Hindle 2012 \xA74.3: LLM-generated code reuses a narrow band of training-data identifiers, dropping distinct-token ratio below 30%.",
+      "visual/math-color-cluster": "Use at least 3 distinct hue families (e.g. blue + amber + green) instead of clustering every color in the violet/fuchsia band.",
+      "wcag/focus-appearance": "Add a focus-visible:ring-* class, or remove outline-none. Keyboard users need a visible focus indicator.",
+      "wcag/focus-obscured": "Ensure focused elements are not hidden behind fixed or sticky wrappers.",
+      "test/weak-assertion": "Assert on a specific value or shape: `expect(x).toEqual(expectedValue)`. Avoid `.toBeDefined()` / `.toBeTruthy()` placeholders and tautological `expect(x).toBe(x)`.",
+      "test/duplicate-setup": "Extract shared `beforeEach` / `setupServer` blocks into a single helper (e.g. `renderWithProviders`) so each describe block calls it instead of repeating setup.",
+      "test/fake-placeholder": "Use domain-specific fixture values (`alice@acme-corp.com`, `Order#48231`) or a factory like @faker-js/faker. Avoid textbook placeholders (`John Doe`, `test@test.com`, `id: 1`).",
+      "product/terminology-drift": "Keep the leading noun consistent across files: `PostList`, `PostDetail`, `PostCard` are one entity, not three. AI agents pick slightly different words each invocation; product copy drifts.",
+      "product/ux-pattern-fragmentation": "Keep the per-category count tight: modal \u22643, toast \u22642, button \u22644, input \u22643, card \u22643. Pick the canonical one and alias the rest. `slopbrick patterns` reports the per-category count.",
+      // v0.13.0 — AI-specific rules (peer-reviewed signals).
+      "ai/markdown-leakage": "Delete stray `\\`\\`\\`<lang>\\`\\`\\`` markers; they are Markdown fences, not valid syntax in standalone source files (Yotkova et al. SemEval-2026).",
+      "ai/comment-ratio": "AI tools either skip comments (reductive models) or over-comment (expansive models). Match the corpus mean \xB1 2\u03C3 (Rahman et al. 2024, Bisztray et al. 2025).",
+      "ai/whitespace-regularity": "Vary inter-token spacing (single spaces mostly, occasional alignment in tables). Uniform runs are an AI tell (Shi et al. DetectCodeGPT 2024).",
+      "ai/text-like-ratio": "Move natural-language explanations to README files or doc comments. Inline prose in source code is hard to maintain (Yotkova 2026).",
+      "ai/errors-near-eof": "Check whether the file was truncated by a token limit. Unbalanced delimiters near EOF suggest the model ran out of output budget (Yotkova 2026).",
+      "ai/any-density": "Replace `any` with `unknown`, `Record<string, unknown>`, or a domain type. The `: any` annotation propagates type-errors and defeats TS safety (Lee, Hassan, Hindle MSR 2026).",
+      "ai/renyi-profile": "The token distribution is mass-concentrated on a few high-frequency tokens. Verify authorship if unexpected (R\xE9nyi 1961, Moslonka 2025).",
+      "ai/segment-surprisal-cv": "The cross-entropy is suspiciously uniform across the file. Real codebases have varied registers (Binoculars, Hans 2024).",
+      "ai/compression-profile": "The file compresses unusually well and lines are highly repetitive \u2014 characteristic of AI-generated boilerplate (Cilibrasi 2005, Mahoney 1999).",
+      // v0.14.5b — 6 new AI tendency detection rules (DORMANT in v0.14.5b;
+      // reclassified post-v7 calibration in v0.14.5d)
+      "ai/tailwind-color-overuse": "If most utility classes are bg-violet-500, text-violet-600, ring-violet-400 \u2014 the project is on the AI-default palette. Audit and replace with the project's design tokens.",
+      "ai/default-react-stack": "Every new file is a Vite + React + Tailwind + Zustand + React Hook Form clone. Verify the project actually needs each piece before adding it.",
+      "ai/library-reinvention": "Re-implementing zustand, react-hook-form, or date-fns inline (custom event emitters, useState reducers, manual date math) is a sign of LLM completion-mode code. Use the libraries the project already depends on.",
+      "ai/state-default-overuse": "Wrapping every component in useState + useEffect for transient UI state is the React tutorial default. Real production code uses refs, uncontrolled inputs, or the project's state lib.",
+      "ai/fetch-default-overuse": "Calling fetch() inline in components instead of going through the project's data-fetching layer (react-query, swr, or your own client) bypasses the cache, error boundary, and abort handling.",
+      "ai/console-debug-storm": "5+ console.log calls in a single file is debug-by-print-statement, the LLM training-data default. Remove before commit; use the project's logger or a real debugger.",
+      // v0.17.0 — db/* rules (Postgres static analysis via pgsql-parser)
+      "db/sql-concat": 'Never build SQL with template-literal interpolation \u2014 `db.query(`SELECT \u2026 WHERE id = ${id}`)` is a SQL injection vector. Use parameterized queries (`db.query("\u2026 WHERE id = $1", [id])`) or your ORM query builder.',
+      // v0.17.0 — docs/* rules (markdown drift detection)
+      "docs/stale-package-reference": "Update the doc to reference an installed package, or add the package to package.json. Copy-pasted install commands from a previous project are the #1 doc-drift failure mode.",
+      "docs/stale-function-reference": "Rename the doc reference to match a current export, or add a wrapper export. Stale function callouts in tutorials cost readers 10+ minutes of debugging.",
+      "docs/broken-link": "Create the file or fix the link target. On a public docs site, broken links erode trust more than stale copy.",
+      // v0.18.9 — Rust-specific rules (tree-sitter-backed)
+      "rust/unused-pub-fn": "Remove the function or call it. Rust's compiler doesn't warn on `pub fn` references unless `#![warn(dead_code)]` is set at the crate root. AI agents leave these behind during iterative refactors.",
+      "rust/unwrap-in-production": "Replace `.unwrap()` / `.expect()` with `?` (early-return on Err), `.map_err(...)` for error conversion, or an explicit `match`. They panic in production; reserve them for `#[cfg(test)]` or `#[test]` scopes.",
+      "rust/todo-macro": "Implement the function body or remove the stub. `todo!()` / `unimplemented!()` both expand to `panic!()`, so a hit at runtime crashes the program. Move them into a `#[cfg(test)] mod tests` block to suppress.",
+      "rust/stringly-typed": 'Replace the `String` / `&str` parameter with the typed enum that already exists in the file. Stringly-typed APIs lose type information at the boundary \u2014 typos (`"Click"` vs `"click"`) only fail at runtime.',
+      // v0.19.0 — TypeScript-specific rules
+      "ts/enum-vs-as-const": "Replace `enum Foo { A, B }` with `const Foo = { A: 'A', B: 'B' } as const` (or `const Foo = ['A', 'B'] as const`). Modern TS style guides (Google, TS-eslint) prefer `as const` because enums have surprising runtime semantics.",
+      "ts/import-type-misuse": "Use `import type { X } from '...'` instead of `import { type X } from '...'`. The split form is more common in real codebases and makes the type-only intent unambiguous.",
+      "ts/never-vs-unknown": "The `never` return type means 'this function never returns'. Reserve it for functions that always throw, always loop, or always exit. For 'impossible' branches, use a concrete type (`void`, `Error`, `unknown`) and an exhaustive check.",
+      "ts/excessive-type-assertion": "More than 3 `as` assertions in one function is a strong signal that the type is wrong, not the code. Fix the type definition (or use a type guard) instead of bypassing the type system.",
+      // v0.19.0 — Go-specific rules
+      "go/struct-tag-inconsistency": 'Pick one tag style per struct. If most fields are `json:"foo"`, this field should be too. Real Go code maintains consistency within a struct (or within a package).',
+      "go/nil-slice-vs-empty": "Either declare as `var x = []int{}` or assign with `make([]int, 0)`. The nil/empty inconsistency is an AI signal \u2014 real code picks one form and sticks with it.",
+      // v0.19.0 — Duplication detector
+      "dup/identical-block": "Refactor to a shared helper. This is a Type-1 clone (byte-for-byte identical after normalization). Common in AI-generated code that copy-pastes from training data.",
+      // v0.23.0 — Type-2 near-duplicate detector (MinHash + LSH)
+      "dup/near-duplicate": "Refactor to a shared helper. Type-2 near-duplicate: same identifiers + structure, different whitespace/comments. AI-iterated code regenerates the same function with cosmetic edits. (v0.23.0 \u2014 MinHash + LSH, k=5, thr 0.7.)",
+      // v0.24.0 — Type-3 structural clone detector (two-stage MinHash)
+      "dup/structural-clone": "Refactor to a shared helper. Type-3 clone: same shape as another file after identifier canonicalization, with renames and/or added/removed statements. AI agents and copy-paste both produce this. Extract the shared part. (v0.24.0.)",
+      // v0.24.0 — Kotlin rules (DORMANT until v9 Kotlin corpus calibration)
+      // v0.29.0 — non-AI Kotlin rules (DORMANT until larger pos arm)
+      // v0.30.0 — non-AI Java rules (Option C applied to v9 Java corpus, 92k files)
+      "java/sql-string-concat": "Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{}). String concat into SQL is the canonical SQL-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT, ratio 0.59.)",
+      "java/thread-sleep-in-loop": "Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the polling anti-pattern \u2014 ties up Tomcat/Jetty/Netty threads. (v0.30.0 \u2014 DORMANT, era-confounded ratio 0.97.)",
+      // v0.35.0 — content-based detection (CoCoNUTS-inspired)
+      "java/suspicious-implementation": "Function name claims validate/encrypt/hash/sanitize but body is empty, returns null/true, or returns the input. This is a content mismatch \u2014 the function's claimed behavior doesn't match its actual behavior. OWASP A04:2021.",
+      // v0.35.1 — Raidar-inspired content-based detection
+      "java/lost-stack-trace": 'catch block throws a new exception without the original cause \u2014 stack trace is lost. Pass the original exception as the second arg to the new exception\'s constructor: `throw new XxxException("msg", e)`.',
+      // v0.24.0 — Swift rules (DORMANT until v9 Swift corpus calibration)
+      "swift/force-unwrap": "Replace with the safe form: `as?` + guard/if let, `try?`, or `guard let x = optional else { return }`. `!` crashes unconditionally in release. (v0.24.0 \u2014 DORMANT.)",
+      "swift/print-debug": "Replace with `Logger(subsystem:..., category:...).info(...)` (os.log). `print` writes to stdout with no level and no redaction. (v0.24.0 \u2014 DORMANT.)",
+      "swift/fatal-error-thrown": "Replace with `return` of a typed default (e.g. `nil`, `[]()`) or throw a typed `enum MyError: Error`. `fatalError` survives release builds. (v0.24.0 \u2014 DORMANT.)",
+      "swift/implicitly-unwrapped-optional": "Declare as `var name: Type?` and unwrap with `guard let`. IUOs exist for Obj-C bridging / IBOutlets but using them everywhere is an AI signal. (v0.24.0 \u2014 DORMANT.)",
+      "swift/strong-self-capture": "Capture with `[weak self]` (or `[unowned self]` if guaranteed non-nil): `[weak self] in self?.foo = bar`. Strong self capture creates a retain cycle. (v0.24.0 \u2014 DORMANT.)",
+      // v0.24.0 — C++ rules (DORMANT until v9 C++ corpus calibration)
+      "cpp/raw-new-delete": "Replace with `auto p = std::make_unique<T>(...)`. Smart pointers delete on scope exit, never leak on early return / exception, never double-free. (v0.24.0 \u2014 DORMANT.)",
+      "cpp/c-style-cast": "Use the named cast: `static_cast<int>(x)`, `reinterpret_cast<...>(p)`, `const_cast<...>(ref)`. C-style casts silently pick static / reinterpret / const \u2014 impossible to grep. (v0.24.0 \u2014 DORMANT.)",
+      "cpp/printf-debug": "Replace with `spdlog::info(...)`, `LOG(INFO) << ...` (glog), or `ABSL_LOG(INFO) << ...`. `printf` / `std::cout` have no levels, no redaction, no sink routing. (v0.24.0 \u2014 DORMANT.)",
+      "cpp/magic-numbers": "Replace with `constexpr int MAX = 1024;` (or `static constexpr`). Named constants live next to their value, can be searched, force the reader to mean what they say. (v0.24.0 \u2014 DORMANT.)"
+    };
+  }
+});
+
+// src/snippet/generators.ts
+function wrapWithMarkers(level, body) {
+  const head = level === 1 ? "<!-- slopbrick-managed-section -->\n" : "";
+  return `${head}${MARKER_BEGIN}
+${body}
+${MARKER_END}
+`;
+}
+function generateCursorSnippet(rules) {
+  const lines = [];
+  lines.push("# slopbrick cursor rules");
+  lines.push("");
+  lines.push("Generated by `slopbrick init --cursor`. These rules describe patterns that slopbrick");
+  lines.push("flags as AI-generated frontend slop. Avoid them when writing code in this project.");
+  lines.push("");
+  lines.push("## Category-level directives");
+  lines.push("");
+  for (const [category, directive] of Object.entries(CATEGORY_DIRECTIVES)) {
+    lines.push("- **" + category + "**: " + directive);
+  }
+  lines.push("");
+  lines.push("## Per-rule directives");
+  lines.push("");
+  const ai = aiSpecificRules(rules);
+  const byCategory = categorizeRules(ai);
+  for (const [category, list] of byCategory) {
+    lines.push("### " + category);
+    lines.push("");
+    for (const rule of list) {
+      const hint = RULE_HINTS[rule.id] ?? "Avoid patterns that fire rule `" + rule.id + "`.";
+      lines.push("- **`" + rule.id + "`** (" + rule.severity + "): " + hint);
+    }
+    lines.push("");
+  }
+  lines.push("## Verification");
+  lines.push("");
+  lines.push("After writing code, run `slopbrick scan` and check for issues in any of the categories above.");
+  lines.push("Use `slopbrick fix` for auto-fixable rules. Use `slopbrick mcp` from MCP-aware clients to query rules and scan files programmatically.");
+  lines.push("");
+  return lines.join("\n");
+}
+function generateAgentsMdSnippet(rules) {
+  return wrapWithMarkers(
+    1,
+    baseContent(
+      rules,
+      "AGENTS.md",
+      "Generated by `slopbrick init --agents-md`. Read these directives when writing or modifying code in this project. AGENTS.md is the de facto standard read by OpenAI Codex, opencode, Pi, Cline, Continue, Gemini, Claude Code (fallback), and others."
+    ) + "## How to verify\n\nAfter editing code, run `slopbrick scan`. Any issue with a category in this file is something to fix.\n"
+  );
+}
+function generateClaudeMdSnippet(rules) {
+  return wrapWithMarkers(
+    1,
+    baseContent(
+      rules,
+      "CLAUDE.md",
+      "Generated by `slopbrick init --claude-md`. Read this file at the start of every Claude Code session in this project. CLAUDE.md takes precedence over AGENTS.md for Claude Code."
+    ) + "## Verification\n\nRun `slopbrick scan` after edits. If MCP is configured (`slopbrick mcp`), use `slop_scan_file` proactively to check before reporting code as done.\n"
+  );
+}
+function generateAiderSnippet(rules) {
+  return baseContent(
+    rules,
+    "CONVENTIONS.md",
+    "Generated by `slopbrick init --aider`. Aider reads CONVENTIONS.md (not AGENTS.md) for project conventions."
+  );
+}
+function generateWindsurfSnippet(rules) {
+  return baseContent(
+    rules,
+    ".windsurfrules",
+    "Generated by `slopbrick init --windsurf`. Windsurf Cascade reads .windsurfrules at project root."
+  );
+}
+function generateClineRules(rules) {
+  return baseContent(
+    rules,
+    "AGENTS.md",
+    "Generated by `slopbrick init --cline`. Cline reads .clinerules/AGENTS.md from the project root."
+  );
+}
+function generateCursorrulesLegacySnippet(rules) {
+  return baseContent(
+    rules,
+    ".cursorrules",
+    "Generated by `slopbrick init --cursorrules`. This is the legacy Cursor rule format. Prefer `.cursor/rules/slopbrick.mdc` (use --cursor) for new projects."
+  );
+}
+function generateGeminiSnippet(rules) {
+  return baseContent(
+    rules,
+    "GEMINI.md",
+    "Generated by `slopbrick init --gemini`. Gemini CLI reads .gemini/GEMINI.md from project root."
+  );
+}
+function generateCopilotSnippet(rules) {
+  return baseContent(
+    rules,
+    "copilot-instructions.md",
+    "Generated by `slopbrick init --copilot`. GitHub Copilot reads .github/copilot-instructions.md from project root."
+  );
+}
+var MARKER_BEGIN, MARKER_END;
+var init_generators = __esm({
+  "src/snippet/generators.ts"() {
+    "use strict";
+    init_data();
+    init_render2();
+    MARKER_BEGIN = "<!-- slopbrick:begin:v3 -->";
+    MARKER_END = "<!-- slopbrick:end:v3 -->";
+  }
+});
+
+// src/snippet/render.ts
+function aiSpecificRules(rules) {
+  return rules.filter((r) => r.aiSpecific).sort((a, b) => a.id.localeCompare(b.id));
+}
+function categorizeRules(rules) {
+  const byCategory = /* @__PURE__ */ new Map();
+  for (const r of rules) {
+    const list = byCategory.get(r.category) ?? [];
+    list.push(r);
+    byCategory.set(r.category, list);
+  }
+  for (const list of byCategory.values()) {
+    list.sort((a, b) => a.id.localeCompare(b.id));
+  }
+  return byCategory;
+}
+function baseContent(rules, toolLabel, intro) {
+  const lines = [];
+  lines.push("# " + toolLabel);
+  lines.push("");
+  lines.push(intro);
+  lines.push("");
+  const ai = aiSpecificRules(rules);
+  const byCategory = categorizeRules(ai);
+  lines.push("## Category-level directives");
+  lines.push("");
+  for (const [category, directive] of Object.entries(CATEGORY_DIRECTIVES)) {
+    lines.push("- **" + category + "**: " + directive);
+  }
+  lines.push("");
+  lines.push("## Per-rule directives");
+  lines.push("");
+  for (const [category, list] of byCategory) {
+    lines.push("### " + category);
+    lines.push("");
+    for (const rule of list) {
+      const hint = RULE_HINTS[rule.id] ?? "Avoid patterns that fire rule `" + rule.id + "`.";
+      lines.push("- `" + rule.id + "` (" + rule.severity + "): " + hint);
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function safeRewrite(existing, freshBlockBody) {
+  const beginIdx = existing.indexOf(MARKER_BEGIN);
+  const endIdx = existing.indexOf(MARKER_END);
+  if (beginIdx === -1 && endIdx === -1) {
+    return { content: existing, rewritten: false, failClosed: true, mismatched: false };
+  }
+  if (beginIdx === -1 || endIdx === -1) {
+    return { content: existing, rewritten: false, failClosed: false, mismatched: true };
+  }
+  if (endIdx <= beginIdx) {
+    return { content: existing, rewritten: false, failClosed: false, mismatched: true };
+  }
+  const before = existing.slice(0, beginIdx + MARKER_BEGIN.length);
+  const after = existing.slice(endIdx);
+  const next = `${before}
+${freshBlockBody}
+${after}`;
+  return { content: next, rewritten: true, failClosed: false, mismatched: false };
+}
+var init_render2 = __esm({
+  "src/snippet/render.ts"() {
+    "use strict";
+    init_data();
+    init_generators();
+  }
+});
+
+// src/snippet/refresh.ts
+var refresh_exports = {};
+__export(refresh_exports, {
+  SNIPPET_TARGETS: () => SNIPPET_TARGETS,
+  refreshSnippets: () => refreshSnippets
+});
+function refreshSnippets(cwd, rules, targets = [...SNIPPET_TARGETS]) {
+  const result = { rewritten: [], failClosed: [], mismatched: [], absent: [] };
+  for (const filename of targets) {
+    const path = (0, import_node_path24.join)(cwd, filename);
+    if (!(0, import_node_fs22.existsSync)(path)) {
+      result.absent.push(filename);
+      continue;
+    }
+    const existing = (0, import_node_fs22.readFileSync)(path, "utf-8");
+    const agentName = filename.replace(/\.md$/i, "").toLowerCase();
+    const generator = agentName === "claude" ? generateAgentsMdSnippet : generateAgentsMdSnippet;
+    const newBlock = generator([...rules]).trim();
+    const outcome = safeRewrite(existing, newBlock);
+    if (outcome.rewritten) {
+      const tmp = `${path}.tmp`;
+      (0, import_node_fs22.writeFileSync)(tmp, outcome.content, "utf-8");
+      const fs = require("fs");
+      fs.renameSync(tmp, path);
+      result.rewritten.push(filename);
+    } else if (outcome.failClosed) {
+      result.failClosed.push(filename);
+    } else if (outcome.mismatched) {
+      result.mismatched.push(filename);
+    }
+  }
+  return result;
+}
+var import_node_fs22, import_node_path24, SNIPPET_TARGETS;
+var init_refresh = __esm({
+  "src/snippet/refresh.ts"() {
+    "use strict";
+    import_node_fs22 = require("fs");
+    import_node_path24 = require("path");
+    init_render2();
+    init_generators();
+    SNIPPET_TARGETS = [
+      "AGENTS.md",
+      "CLAUDE.md"
+    ];
+  }
+});
+
 // src/cli/report/persistRun.ts
 async function persistRun(input) {
   const {
@@ -54676,7 +55094,7 @@ async function persistRun(input) {
     const recentTopHashes = telemetryPayloads.map(
       (payload) => [...payload.files].sort((a, b) => b.score - a.score).slice(0, 10).map((file) => file.hash)
     );
-    const currentTopFiles = [...report.components].sort((a, b) => b.adjustedScore - a.adjustedScore).slice(0, 10).map((c) => ({ filePath: c.filePath, hash: hashFile((0, import_node_path24.relative)(cwd, c.filePath)) }));
+    const currentTopFiles = [...report.components].sort((a, b) => b.adjustedScore - a.adjustedScore).slice(0, 10).map((c) => ({ filePath: c.filePath, hash: hashFile((0, import_node_path25.relative)(cwd, c.filePath)) }));
     const unmatchedStringLiterals = results.flatMap((r) => r.unmatchedStringLiterals ?? []);
     const flywheelOutput = computeFlywheelOutput(
       runs,
@@ -54696,10 +55114,10 @@ async function persistRun(input) {
       report.research = state.research;
     }
     if (flywheelOutput.suggestions.length > 0) {
-      const suggestionsDir = (0, import_node_path24.join)(cwd, ".slopbrick", "flywheel");
-      if (!(0, import_node_fs22.existsSync)(suggestionsDir)) (0, import_node_fs22.mkdirSync)(suggestionsDir, { recursive: true });
-      (0, import_node_fs22.writeFileSync)(
-        (0, import_node_path24.join)(suggestionsDir, "rule-suggestions.json"),
+      const suggestionsDir = (0, import_node_path25.join)(cwd, ".slopbrick", "flywheel");
+      if (!(0, import_node_fs23.existsSync)(suggestionsDir)) (0, import_node_fs23.mkdirSync)(suggestionsDir, { recursive: true });
+      (0, import_node_fs23.writeFileSync)(
+        (0, import_node_path25.join)(suggestionsDir, "rule-suggestions.json"),
         JSON.stringify(flywheelOutput.suggestions, null, 2)
       );
     }
@@ -54744,13 +55162,28 @@ async function persistRun(input) {
     }
   }
   recordTelemetry(cwd, report, results, config, patternInventory);
+  if (input.autoRefreshSnippets) {
+    try {
+      const { refreshSnippets: refreshSnippets2 } = await Promise.resolve().then(() => (init_refresh(), refresh_exports));
+      const outcome = refreshSnippets2(cwd, registry.getRules());
+      if (outcome.rewritten.length > 0 && !options.quiet && !machineReadableStdout) {
+        logger.info(
+          `Snippet refresh: rewrote ${outcome.rewritten.length} file(s) (${outcome.rewritten.join(", ")}).`
+        );
+      }
+    } catch (err) {
+      if (options.quiet !== true && !machineReadableStdout) {
+        logger.warn(`snippet refresh failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+  }
 }
-var import_node_fs22, import_node_path24;
+var import_node_fs23, import_node_path25;
 var init_persistRun = __esm({
   "src/cli/report/persistRun.ts"() {
     "use strict";
-    import_node_fs22 = require("fs");
-    import_node_path24 = require("path");
+    import_node_fs23 = require("fs");
+    import_node_path25 = require("path");
     init_logger();
     init_cache_incremental();
     init_flywheel();
@@ -54889,7 +55322,7 @@ var init_finalizeReport = __esm({
 function buildBaselineCache(report, configHash, gitHead, cwd) {
   const scores = {};
   for (const component of report.components) {
-    scores[(0, import_node_path25.relative)(cwd, component.filePath)] = {
+    scores[(0, import_node_path26.relative)(cwd, component.filePath)] = {
       baselineScore: component.componentScore,
       componentCount: component.componentCount
     };
@@ -54904,11 +55337,11 @@ function buildBaselineCache(report, configHash, gitHead, cwd) {
     scores
   };
 }
-var import_node_path25;
+var import_node_path26;
 var init_baseline_cache = __esm({
   "src/cli/report/baseline-cache.ts"() {
     "use strict";
-    import_node_path25 = require("path");
+    import_node_path26 = require("path");
     init_types();
   }
 });
@@ -54972,24 +55405,24 @@ function buildArtifactUri(filePath, cwd) {
     return ".";
   }
   if (cwd) {
-    const absoluteFilePath = (0, import_node_path26.isAbsolute)(filePath) ? filePath : (0, import_node_path26.resolve)(cwd, filePath);
-    const rel = (0, import_node_path26.relative)(cwd, absoluteFilePath);
+    const absoluteFilePath = (0, import_node_path27.isAbsolute)(filePath) ? filePath : (0, import_node_path27.resolve)(cwd, filePath);
+    const rel = (0, import_node_path27.relative)(cwd, absoluteFilePath);
     if (rel.startsWith("..")) {
-      return (0, import_node_path26.basename)(filePath);
+      return (0, import_node_path27.basename)(filePath);
     }
     return rel;
   }
-  if ((0, import_node_path26.isAbsolute)(filePath)) {
-    return (0, import_node_path26.basename)(filePath);
+  if ((0, import_node_path27.isAbsolute)(filePath)) {
+    return (0, import_node_path27.basename)(filePath);
   }
   return filePath;
 }
 function resolveSourcePath(filePath, cwd) {
   if (!filePath) return null;
   if (cwd) {
-    return (0, import_node_path26.isAbsolute)(filePath) ? filePath : (0, import_node_path26.resolve)(cwd, filePath);
+    return (0, import_node_path27.isAbsolute)(filePath) ? filePath : (0, import_node_path27.resolve)(cwd, filePath);
   }
-  return (0, import_node_path26.isAbsolute)(filePath) ? filePath : null;
+  return (0, import_node_path27.isAbsolute)(filePath) ? filePath : null;
 }
 function severityToSarifLevel(severity) {
   switch (severity) {
@@ -55072,7 +55505,7 @@ function buildResultFromIssue(issue, cwd, fileContentCache) {
     let content = fileContentCache.get(sourcePath);
     if (content === void 0) {
       try {
-        content = (0, import_node_fs23.readFileSync)(sourcePath, "utf-8");
+        content = (0, import_node_fs24.readFileSync)(sourcePath, "utf-8");
         fileContentCache.set(sourcePath, content);
       } catch {
         fileContentCache.set(sourcePath, "");
@@ -55146,13 +55579,13 @@ function formatSarif(report, options) {
   };
   return JSON.stringify(log, null, 2);
 }
-var import_node_crypto9, import_node_fs23, import_node_path26, REPO_INFORMATION_URI, RULES_BASE_URL;
+var import_node_crypto9, import_node_fs24, import_node_path27, REPO_INFORMATION_URI, RULES_BASE_URL;
 var init_sarif = __esm({
   "src/report/sarif.ts"() {
     "use strict";
     import_node_crypto9 = require("crypto");
-    import_node_fs23 = require("fs");
-    import_node_path26 = require("path");
+    import_node_fs24 = require("fs");
+    import_node_path27 = require("path");
     REPO_INFORMATION_URI = "https://github.com/usebrick/platform";
     RULES_BASE_URL = "https://github.com/usebrick/platform/blob/main/packages/slopbrick/src/rules";
   }
@@ -56337,18 +56770,18 @@ function applyReplaceFixes(content, fixes) {
   return { content, applied, skipped, reasons };
 }
 function applyLayoutTokenFix(filePath, fixes) {
-  let content = (0, import_node_fs24.readFileSync)(filePath, "utf-8");
+  let content = (0, import_node_fs25.readFileSync)(filePath, "utf-8");
   const { content: patched, applied, skipped, reasons } = applyReplaceFixes(content, fixes);
   if (patched !== content) {
-    (0, import_node_fs24.writeFileSync)(filePath, patched);
+    (0, import_node_fs25.writeFileSync)(filePath, patched);
   }
   return { applied, skipped, reasons };
 }
-var import_node_fs24;
+var import_node_fs25;
 var init_layout_token = __esm({
   "src/fix/layout-token.ts"() {
     "use strict";
-    import_node_fs24 = require("fs");
+    import_node_fs25 = require("fs");
   }
 });
 
@@ -56428,8 +56861,8 @@ function formatUnifiedDiff(report, cwd) {
   const parts = [];
   let hasHunk = false;
   for (const [filePath, fixes] of byFile) {
-    if (!(0, import_node_fs25.existsSync)(filePath)) continue;
-    const original = (0, import_node_fs25.readFileSync)(filePath, "utf-8");
+    if (!(0, import_node_fs26.existsSync)(filePath)) continue;
+    const original = (0, import_node_fs26.readFileSync)(filePath, "utf-8");
     const patched = applyFixesToString(original, fixes);
     if (patched === original) continue;
     if (!hasHunk) {
@@ -56438,7 +56871,7 @@ function formatUnifiedDiff(report, cwd) {
       parts.push("");
       hasHunk = true;
     }
-    const rel = (0, import_node_path27.relative)(cwd, filePath);
+    const rel = (0, import_node_path28.relative)(cwd, filePath);
     parts.push(`--- a/${rel}`);
     parts.push(`+++ b/${rel}`);
     parts.push(...formatHunk(original, patched));
@@ -56449,12 +56882,12 @@ function formatUnifiedDiff(report, cwd) {
   }
   return parts.join("\n");
 }
-var import_node_fs25, import_node_path27;
+var import_node_fs26, import_node_path28;
 var init_unified_diff = __esm({
   "src/report/unified-diff.ts"() {
     "use strict";
-    import_node_fs25 = require("fs");
-    import_node_path27 = require("path");
+    import_node_fs26 = require("fs");
+    import_node_path28 = require("path");
     init_layout_token();
   }
 });
@@ -56480,7 +56913,7 @@ async function buildHeatmap(report, cwd, helpers = { getFileEditCount, getFileLa
   const reference = new Date(report.generatedAt);
   const entries = await Promise.all(
     report.components.map(async (component) => {
-      const relPath = (0, import_node_path28.relative)(cwd, component.filePath) || component.filePath;
+      const relPath = (0, import_node_path29.relative)(cwd, component.filePath) || component.filePath;
       const [edits, lastModified] = await Promise.all([
         helpers.getFileEditCount(cwd, relPath, RECENCY_DAYS),
         helpers.getFileLastModifiedDate(cwd, relPath)
@@ -56525,11 +56958,11 @@ function formatHeatmap(entries, options = {}) {
   );
   return [header, ...rows].join("\n");
 }
-var import_node_path28, RECENCY_DAYS, MAX_EDITS;
+var import_node_path29, RECENCY_DAYS, MAX_EDITS;
 var init_heatmap = __esm({
   "src/report/heatmap.ts"() {
     "use strict";
-    import_node_path28 = require("path");
+    import_node_path29 = require("path");
     init_git();
     RECENCY_DAYS = 30;
     MAX_EDITS = 10;
@@ -56570,7 +57003,7 @@ function renderOutput(report, options, cwd) {
   if (options.html) {
     const html = formatHtml(report);
     if (typeof options.html === "string") {
-      (0, import_node_fs26.writeFileSync)((0, import_node_path29.resolve)(options.html), html);
+      (0, import_node_fs27.writeFileSync)((0, import_node_path30.resolve)(options.html), html);
       if (!options.quiet) {
         logger.info(`Wrote HTML report to ${options.html}`);
       }
@@ -56582,7 +57015,7 @@ function renderOutput(report, options, cwd) {
   if (options.json) {
     const json = formatJson(report);
     if (typeof options.json === "string") {
-      (0, import_node_fs26.writeFileSync)((0, import_node_path29.resolve)(options.json), json);
+      (0, import_node_fs27.writeFileSync)((0, import_node_path30.resolve)(options.json), json);
       if (!options.quiet) {
         logger.info(`Wrote JSON report to ${options.json}`);
       }
@@ -56596,7 +57029,7 @@ function renderOutput(report, options, cwd) {
     return;
   }
   if (options.format === "sarif") {
-    const cwdSarif = (0, import_node_path29.resolve)(options.workspace ?? process.cwd());
+    const cwdSarif = (0, import_node_path30.resolve)(options.workspace ?? process.cwd());
     logger.info(formatSarif(report, { cwd: cwdSarif }));
     return;
   }
@@ -56617,12 +57050,12 @@ async function outputScanResults(report, options, cwd) {
   }
   renderOutput(report, options, cwd);
 }
-var import_node_path29, import_node_fs26, VALID_FORMATS;
+var import_node_path30, import_node_fs27, VALID_FORMATS;
 var init_renderOutput = __esm({
   "src/cli/report/renderOutput.ts"() {
     "use strict";
-    import_node_path29 = require("path");
-    import_node_fs26 = require("fs");
+    import_node_path30 = require("path");
+    import_node_fs27 = require("fs");
     init_logger();
     init_json();
     init_pretty();
@@ -56647,7 +57080,7 @@ async function watchProject(options, cwd, paths) {
   let currentBaseline;
   function getBaselineMtime() {
     try {
-      return (0, import_node_fs27.statSync)(baselinePath(cwd)).mtimeMs;
+      return (0, import_node_fs28.statSync)(baselinePath(cwd)).mtimeMs;
     } catch {
       return void 0;
     }
@@ -56755,12 +57188,12 @@ async function watchProject(options, cwd, paths) {
   await doScan(false);
   if (closed) return;
   const currentFiles = new Set(issueGroupsMap.keys());
-  watcher = (0, import_node_fs27.watch)(
+  watcher = (0, import_node_fs28.watch)(
     cwd,
     { recursive: true },
     (_eventType, filename) => {
       if (closed || !filename) return;
-      const changedPath = (0, import_node_path30.resolve)(cwd, filename.toString());
+      const changedPath = (0, import_node_path31.resolve)(cwd, filename.toString());
       if (debounceTimer) clearTimeout(debounceTimer);
       debounceTimer = setTimeout(() => {
         debounceTimer = void 0;
@@ -56795,12 +57228,12 @@ async function watchProject(options, cwd, paths) {
     }
   );
 }
-var import_node_fs27, import_node_path30;
+var import_node_fs28, import_node_path31;
 var init_watch = __esm({
   "src/cli/watch.ts"() {
     "use strict";
-    import_node_fs27 = require("fs");
-    import_node_path30 = require("path");
+    import_node_fs28 = require("fs");
+    import_node_path31 = require("path");
     init_metrics();
     init_worker();
     init_threshold();
@@ -56820,11 +57253,11 @@ async function runScan(options, explicitPaths) {
   setLoggerQuiet(!!options.quiet);
   const startTime = Date.now();
   const scanId = (0, import_node_crypto10.randomUUID)();
-  const cwd = (0, import_node_path31.resolve)(options.workspace ?? process.cwd());
-  if (!(0, import_node_fs28.existsSync)(cwd)) {
+  const cwd = (0, import_node_path32.resolve)(options.workspace ?? process.cwd());
+  if (!(0, import_node_fs29.existsSync)(cwd)) {
     throw new Error(`Workspace not found: ${cwd}`);
   }
-  const cwdStat = (0, import_node_fs28.statSync)(cwd);
+  const cwdStat = (0, import_node_fs29.statSync)(cwd);
   if (!cwdStat.isDirectory()) {
     throw new Error(`Workspace is not a directory: ${cwd}`);
   }
@@ -56851,7 +57284,7 @@ async function runScan(options, explicitPaths) {
     process.env.SLOP_AUDIT_CACHE = "1";
   }
   if (options.tokens) {
-    const tokenResult = readDtcgTokensFile((0, import_node_path31.resolve)(cwd, options.tokens));
+    const tokenResult = readDtcgTokensFile((0, import_node_path32.resolve)(cwd, options.tokens));
     if (tokenResult.ok) {
       const extra = tokensToAllowlist(tokenResult.tree);
       config.arbitraryValueAllowlist = [...config.arbitraryValueAllowlist, ...extra];
@@ -56863,14 +57296,14 @@ async function runScan(options, explicitPaths) {
   if (explicitPaths && explicitPaths.length > 0) {
     const { globby: globby4 } = await import("globby");
     const { minimatch: minimatch4 } = await import("minimatch");
-    const resolved = explicitPaths.map((p) => (0, import_node_path31.resolve)(cwd, p));
+    const resolved = explicitPaths.map((p) => (0, import_node_path32.resolve)(cwd, p));
     const expanded = [];
     for (const p of resolved) {
-      if ((0, import_node_fs28.existsSync)(p) && (0, import_node_fs28.statSync)(p).isDirectory()) {
+      if ((0, import_node_fs29.existsSync)(p) && (0, import_node_fs29.statSync)(p).isDirectory()) {
         const found = await globby4(`${p}/**/*`, { absolute: true, onlyFiles: true });
         for (const f of found) {
-          if (!ALL_SOURCE_EXTENSIONS.has((0, import_node_path31.extname)(f).toLowerCase())) continue;
-          const rel = (0, import_node_path31.relative)(cwd, f).split(import_node_path31.sep).join("/");
+          if (!ALL_SOURCE_EXTENSIONS.has((0, import_node_path32.extname)(f).toLowerCase())) continue;
+          const rel = (0, import_node_path32.relative)(cwd, f).split(import_node_path32.sep).join("/");
           if (config.include.length > 0 && !config.include.some((pattern) => minimatch4(rel, pattern))) {
             continue;
           }
@@ -57020,7 +57453,7 @@ async function runScan(options, explicitPaths) {
     const scannedPaths = new Set(results.map((result) => result.filePath));
     for (const [filePath, cached] of Object.entries(baseline.scores)) {
       if (scannedPaths.has(filePath)) continue;
-      if (!(0, import_node_fs28.existsSync)(filePath)) continue;
+      if (!(0, import_node_fs29.existsSync)(filePath)) continue;
       scores.push({
         filePath,
         rawScore: 0,
@@ -57059,7 +57492,12 @@ async function runScan(options, explicitPaths) {
   const { report, noIncreaseFailure } = await finalizeReport({
     cwd,
     config,
-    options,
+    options: {
+      ...options,
+      // v0.42.0 (§3a.4): forward the opt-in flag through to
+      // `persistRun`, which calls `refreshSnippets` post-scan.
+      autoRefreshSnippets: Boolean(options.autoRefreshSnippets) || Boolean(config.autoRefreshSnippets)
+    },
     results,
     aggregated,
     allIssues,
@@ -57098,12 +57536,12 @@ async function scanProject(options) {
   const { report } = await runScan({ ...options, workspace: options.cwd });
   return report;
 }
-var import_node_fs28, import_node_path31, import_node_crypto10;
+var import_node_fs29, import_node_path32, import_node_crypto10;
 var init_scan2 = __esm({
   "src/cli/scan.ts"() {
     "use strict";
-    import_node_fs28 = require("fs");
-    import_node_path31 = require("path");
+    import_node_fs29 = require("fs");
+    import_node_path32 = require("path");
     import_node_crypto10 = require("crypto");
     init_render();
     init_threshold();
@@ -57131,6 +57569,50 @@ var init_scan2 = __esm({
   }
 });
 
+// src/rules/composite-seed.ts
+var composite_seed_exports = {};
+__export(composite_seed_exports, {
+  HAND_CURATED_SEED: () => HAND_CURATED_SEED,
+  maybeAppendSeed: () => maybeAppendSeed
+});
+function maybeAppendSeed(entries) {
+  if (entries.length === 0) {
+    return [...HAND_CURATED_SEED];
+  }
+  return entries;
+}
+var HAND_CURATED_SEED;
+var init_composite_seed = __esm({
+  "src/rules/composite-seed.ts"() {
+    "use strict";
+    HAND_CURATED_SEED = [
+      {
+        id: "composite/ai-fingerprint-cluster",
+        ruleIds: ["ai/compression-profile", "ai/comment-ratio", "ai/segment-surprisal-cv"],
+        minMatch: 2,
+        severity: "medium",
+        defaultOff: true,
+        description: "Composite rule: at least 2 of {ai/compression-profile+ai/comment-ratio+...} fire on the same file. Hand-curated seed from the v0.42.0 brief; superseded by `slopbrick composite discover` once empirical clusters dominate the ledger.",
+        calibration: {
+          recall: 0,
+          FP: 0,
+          precision: 0,
+          F1: 0,
+          nFiles: 0
+        },
+        provenance: {
+          seed: "hand-curated-by-brief",
+          discoveredAt: "2026-07-05T00:00:00.000Z",
+          nFiles: 0,
+          members: 3,
+          npmi: 0,
+          fisherP: 1
+        }
+      }
+    ];
+  }
+});
+
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
@@ -57217,7 +57699,7 @@ init_config2();
 init_dist2();
 
 // src/cli/program.ts
-var import_node_path72 = require("path");
+var import_node_path75 = require("path");
 var import_commander3 = require("commander");
 
 // src/cli/options.ts
@@ -57260,8 +57742,8 @@ init_scan2();
 init_scan2();
 
 // src/cli/init.ts
-var import_node_fs30 = require("fs");
-var import_node_path33 = require("path");
+var import_node_fs31 = require("fs");
+var import_node_path34 = require("path");
 var import_node_readline = require("readline");
 init_config2();
 init_discover();
@@ -57270,8 +57752,8 @@ init_cache();
 init_logger();
 
 // src/rules/registry-loader.ts
-var import_node_fs29 = require("fs");
-var import_node_path32 = require("path");
+var import_node_fs30 = require("fs");
+var import_node_path33 = require("path");
 
 // src/data/shadcn-registry.json
 var shadcn_registry_default = {
@@ -57405,12 +57887,12 @@ var shadcn_registry_default = {
 var REGISTRY_URL = "https://ui.shadcn.com/registry.json";
 var BUNDLED_REGISTRY_VERSION = shadcn_registry_default.version;
 function cachePath2(cwd) {
-  return (0, import_node_path32.join)(cwd, ".slopbrick", "cache", "registry-snapshot.json");
+  return (0, import_node_path33.join)(cwd, ".slopbrick", "cache", "registry-snapshot.json");
 }
 function ensureCacheDir(cwd) {
-  const dir = (0, import_node_path32.dirname)(cachePath2(cwd));
-  if (!(0, import_node_fs29.existsSync)(dir)) {
-    (0, import_node_fs29.mkdirSync)(dir, { recursive: true });
+  const dir = (0, import_node_path33.dirname)(cachePath2(cwd));
+  if (!(0, import_node_fs30.existsSync)(dir)) {
+    (0, import_node_fs30.mkdirSync)(dir, { recursive: true });
   }
 }
 function isValidSnapshot(value) {
@@ -57422,9 +57904,9 @@ function isValidSnapshot(value) {
 }
 function isRegistryFresh(cwd) {
   const cached = cachePath2(cwd);
-  if (!(0, import_node_fs29.existsSync)(cached)) return false;
+  if (!(0, import_node_fs30.existsSync)(cached)) return false;
   try {
-    const parsed = JSON.parse((0, import_node_fs29.readFileSync)(cached, "utf8"));
+    const parsed = JSON.parse((0, import_node_fs30.readFileSync)(cached, "utf8"));
     if (!isValidSnapshot(parsed)) return false;
     return parsed.version === BUNDLED_REGISTRY_VERSION;
   } catch {
@@ -57435,7 +57917,7 @@ async function refreshRegistrySnapshot(cwd, _url = REGISTRY_URL, _timeoutMs = 5e
   try {
     const cacheFile = cachePath2(cwd);
     ensureCacheDir(cwd);
-    (0, import_node_fs29.writeFileSync)(cacheFile, JSON.stringify(shadcn_registry_default, null, 2), "utf-8");
+    (0, import_node_fs30.writeFileSync)(cacheFile, JSON.stringify(shadcn_registry_default, null, 2), "utf-8");
   } catch {
   }
   return {
@@ -57447,7 +57929,7 @@ async function refreshRegistrySnapshot(cwd, _url = REGISTRY_URL, _timeoutMs = 5e
 }
 function copyBundledSnapshotToCache(cwd) {
   ensureCacheDir(cwd);
-  (0, import_node_fs29.writeFileSync)(cachePath2(cwd), JSON.stringify(shadcn_registry_default, null, 2));
+  (0, import_node_fs30.writeFileSync)(cachePath2(cwd), JSON.stringify(shadcn_registry_default, null, 2));
 }
 
 // src/cli/init.ts
@@ -57476,17 +57958,17 @@ var UI_LIBRARY_OPTIONS = ["shadcn/ui", "mui", "chakra", "radix", "tamagui", "nat
 var STRICTNESS_OPTIONS = ["strict", "balanced", "permissive"];
 var STRUCTURE_OPTIONS = ["feature-based", "layer-based", "flat", "monorepo", "other"];
 function promptText(rl, question, detected) {
-  return new Promise((resolve42) => {
+  return new Promise((resolve43) => {
     const lines = [
       `? ${question} (detected: ${detected || "none"}) \u2014 npm package name, or Enter to skip:`
     ];
     rl.question(lines.join("\n") + "\n", (answer) => {
       const trimmed = answer.trim();
       if (trimmed === "") {
-        resolve42(void 0);
+        resolve43(void 0);
         return;
       }
-      resolve42(trimmed);
+      resolve43(trimmed);
     });
   });
 }
@@ -57494,7 +57976,7 @@ function promptSingleSelect(rl, question, options, defaultValue) {
   const defaultIndex = options.indexOf(defaultValue);
   const safeDefaultIndex = defaultIndex >= 0 ? defaultIndex : 0;
   const safeDefaultValue = options[safeDefaultIndex];
-  return new Promise((resolve42) => {
+  return new Promise((resolve43) => {
     function ask() {
       const lines = [
         `? ${question} (detected: ${safeDefaultValue}):`,
@@ -57504,7 +57986,7 @@ function promptSingleSelect(rl, question, options, defaultValue) {
       rl.question(lines.join("\n") + "\n", (answer) => {
         const trimmed = answer.trim();
         if (trimmed === "") {
-          resolve42(safeDefaultValue);
+          resolve43(safeDefaultValue);
           return;
         }
         const num = parseInt(trimmed, 10);
@@ -57513,7 +57995,7 @@ function promptSingleSelect(rl, question, options, defaultValue) {
           ask();
           return;
         }
-        resolve42(options[num - 1]);
+        resolve43(options[num - 1]);
       });
     }
     ask();
@@ -57523,7 +58005,7 @@ function promptMultiSelect(rl, question, options, defaultValue) {
   const defaultIndices = defaultValue.map((v) => options.indexOf(v)).filter((i) => i >= 0);
   const defaultDisplay = defaultValue.length > 0 ? defaultValue.join(", ") : "none";
   const defaultNumbers = defaultIndices.length > 0 ? defaultIndices.map((i) => i + 2).join(",") : "1";
-  return new Promise((resolve42) => {
+  return new Promise((resolve43) => {
     function ask() {
       const lines = [
         `? ${question} (detected: ${defaultDisplay}):`,
@@ -57534,7 +58016,7 @@ function promptMultiSelect(rl, question, options, defaultValue) {
       rl.question(lines.join("\n") + "\n", (answer) => {
         const trimmed = answer.trim();
         if (trimmed === "") {
-          resolve42(defaultValue.length > 0 ? defaultValue : []);
+          resolve43(defaultValue.length > 0 ? defaultValue : []);
           return;
         }
         const numbers = trimmed.split(",").map((s) => parseInt(s.trim(), 10)).filter((n) => !Number.isNaN(n));
@@ -57544,11 +58026,11 @@ function promptMultiSelect(rl, question, options, defaultValue) {
           return;
         }
         if (numbers.includes(1)) {
-          resolve42([]);
+          resolve43([]);
           return;
         }
         const selected = [...new Set(numbers.map((n) => options[n - 2]).filter((v) => v !== void 0))];
-        resolve42(selected);
+        resolve43(selected);
       });
     }
     ask();
@@ -57636,11 +58118,11 @@ async function runDoctor(cwd) {
   }
   try {
     const { parseFile: tryParse } = await Promise.resolve().then(() => (init_dist2(), dist_exports2));
-    const testFile = (0, import_node_path33.join)(cwd, ".slopbrick", ".doctor-test.ts");
-    (0, import_node_fs30.mkdirSync)((0, import_node_path33.dirname)(testFile), { recursive: true });
-    (0, import_node_fs30.writeFileSync)(testFile, "export const x = 1;\n");
+    const testFile = (0, import_node_path34.join)(cwd, ".slopbrick", ".doctor-test.ts");
+    (0, import_node_fs31.mkdirSync)((0, import_node_path34.dirname)(testFile), { recursive: true });
+    (0, import_node_fs31.writeFileSync)(testFile, "export const x = 1;\n");
     await tryParse(testFile);
-    (0, import_node_fs30.rmSync)(testFile, { force: true });
+    (0, import_node_fs31.rmSync)(testFile, { force: true });
     ok("Parser is working.");
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -57729,7 +58211,7 @@ async function runDoctor(cwd) {
 }
 
 // src/cli/commands/badge.ts
-var import_node_path34 = require("path");
+var import_node_path35 = require("path");
 init_render();
 init_logger();
 init_scan2();
@@ -57738,7 +58220,7 @@ function registerBadge(program) {
     "print a shields.io slop-index badge. Reads .slopbrick/health.json if present (no re-scan); falls back to a fresh scan."
   ).action(async (_cmdOptions, command) => {
     const options = command.optsWithGlobals();
-    const cwd = (0, import_node_path34.resolve)(options.workspace ?? process.cwd());
+    const cwd = (0, import_node_path35.resolve)(options.workspace ?? process.cwd());
     const { loadHealth: loadHealth2 } = await Promise.resolve().then(() => (init_dist(), dist_exports));
     const health = loadHealth2(cwd);
     if (health) {
@@ -57755,7 +58237,7 @@ function registerBadge(program) {
 }
 
 // src/cli/commands/suggest.ts
-var import_node_path35 = require("path");
+var import_node_path36 = require("path");
 init_advice();
 init_unified_diff();
 init_logger();
@@ -57764,7 +58246,7 @@ function registerSuggest(program) {
   program.command("suggest").description("print remediation advice").action(async (_cmdOptions, command) => {
     const options = command.optsWithGlobals();
     const { report } = await runScan(options);
-    const cwd = (0, import_node_path35.resolve)(options.workspace ?? process.cwd());
+    const cwd = (0, import_node_path36.resolve)(options.workspace ?? process.cwd());
     logger.info(formatAdvice(report));
     const diff = formatUnifiedDiff(report, cwd);
     if (diff) logger.info(diff);
@@ -57772,6 +58254,470 @@ function registerSuggest(program) {
   });
 }
 
+// src/cli/commands/composite.ts
+var import_node_path38 = require("path");
+init_logger();
+init_telemetry();
+
+// src/engine/cluster.ts
+var import_node_crypto11 = require("crypto");
+var DEFAULT_CLUSTER_PARAMS = {
+  minSupport: 0.05,
+  // 5% of files
+  minNPMI: 0.3,
+  // Cohen's-Landis-and-Koch "fair" agreement
+  fisherAlpha: 0.01,
+  // Bonferroni-style floor for many-pair tests
+  minClusterSize: 2
+};
+function adaptiveMinSupport(fileCount) {
+  if (fileCount <= 0) return DEFAULT_CLUSTER_PARAMS.minSupport;
+  return Math.max(DEFAULT_CLUSTER_PARAMS.minSupport, 5 / fileCount);
+}
+function computeRuleSupport(fireMatrix) {
+  const support = /* @__PURE__ */ new Map();
+  for (const ruleIds of fireMatrix.values()) {
+    for (const ruleId of ruleIds) {
+      support.set(ruleId, (support.get(ruleId) ?? 0) + 1);
+    }
+  }
+  return support;
+}
+function prefilterBySupport(support, totalFiles, minSupport) {
+  const kept = /* @__PURE__ */ new Set();
+  const minCount = Math.max(1, Math.ceil(minSupport * totalFiles));
+  for (const [ruleId, count] of support) {
+    if (count >= minCount) kept.add(ruleId);
+  }
+  return kept;
+}
+function buildContingency(rA, rB, totalFiles) {
+  let aAndB = 0;
+  let aOnly = 0;
+  let bOnly = 0;
+  for (const file of rA) {
+    if (rB.has(file)) aAndB++;
+    else aOnly++;
+  }
+  for (const file of rB) {
+    if (!rA.has(file)) bOnly++;
+  }
+  return {
+    aAndB,
+    aOnly,
+    bOnly,
+    neither: Math.max(0, totalFiles - aAndB - aOnly - bOnly)
+  };
+}
+function fisherExactTwoSided(c) {
+  const N = c.aAndB + c.aOnly + c.bOnly + c.neither;
+  const K1 = c.aAndB + c.aOnly;
+  const K2 = c.aAndB + c.bOnly;
+  const n = K1;
+  const kObs = c.aAndB;
+  const logPmf = (k) => {
+    if (k < Math.max(0, K1 + K2 - N) || k > Math.min(K1, K2)) return -Infinity;
+    return lnChoose(K2, k) + lnChoose(N - K2, K1 - k) - lnChoose(N, K1);
+  };
+  const pObs = Math.exp(logPmf(kObs));
+  const kMin = Math.max(0, K1 + K2 - N);
+  const kMax = Math.min(K1, K2);
+  let p = 0;
+  for (let k = kMin; k <= kMax; k++) {
+    const pk = Math.exp(logPmf(k));
+    if (pk <= pObs + 1e-12) {
+      p += pk;
+    }
+  }
+  return Math.min(1, p);
+}
+function lnChoose(n, k) {
+  if (k < 0 || k > n) return -Infinity;
+  if (k === 0 || k === n) return 0;
+  k = Math.min(k, n - k);
+  let s = 0;
+  for (let i = 1; i <= k; i++) {
+    s += Math.log((n - k + i) / i);
+  }
+  return s;
+}
+function npmi(c, total) {
+  if (total === 0 || c.aAndB === 0) return -1;
+  const pXY = c.aAndB / total;
+  const pX = (c.aAndB + c.aOnly) / total;
+  const pY = (c.aAndB + c.bOnly) / total;
+  if (pX === 0 || pY === 0 || pXY === 0) return -1;
+  const pmi = Math.log2(pXY / (pX * pY));
+  const norm = -Math.log2(pXY);
+  return norm === 0 ? 1 : pmi / norm;
+}
+function computeEdges(fireMatrix, rules, total, params) {
+  const ruleToFiles = /* @__PURE__ */ new Map();
+  for (const ruleId of rules) ruleToFiles.set(ruleId, /* @__PURE__ */ new Set());
+  for (const [file, fired] of fireMatrix) {
+    for (const ruleId of fired) {
+      if (rules.has(ruleId)) ruleToFiles.get(ruleId).add(file);
+    }
+  }
+  const ruleList = Array.from(rules).sort();
+  const edges = [];
+  for (let i = 0; i < ruleList.length; i++) {
+    for (let j = i + 1; j < ruleList.length; j++) {
+      const a = ruleList[i];
+      const b = ruleList[j];
+      const rA = ruleToFiles.get(a);
+      const rB = ruleToFiles.get(b);
+      const c = buildContingency(rA, rB, total);
+      const n = npmi(c, total);
+      if (n < params.minNPMI) continue;
+      const p = fisherExactTwoSided(c);
+      if (p > params.fisherAlpha) continue;
+      edges.push({ ruleIds: [a, b], weight: n, fisherP: p });
+    }
+  }
+  return edges;
+}
+function singleLinkageCluster(edges, minClusterSize) {
+  const parent = /* @__PURE__ */ new Map();
+  const find = (x) => {
+    if (!parent.has(x)) {
+      parent.set(x, x);
+      return x;
+    }
+    if (parent.get(x) === x) return x;
+    const root = find(parent.get(x));
+    parent.set(x, root);
+    return root;
+  };
+  const union = (a, b) => {
+    const ra = find(a);
+    const rb = find(b);
+    if (ra !== rb) parent.set(ra, rb);
+  };
+  for (const e of edges) {
+    union(e.ruleIds[0], e.ruleIds[1]);
+  }
+  const groups = /* @__PURE__ */ new Map();
+  for (const k of parent.keys()) {
+    const root = find(k);
+    if (!groups.has(root)) groups.set(root, []);
+    groups.get(root).push(k);
+  }
+  const clusters = [];
+  for (const members of groups.values()) {
+    if (members.length < minClusterSize) continue;
+    members.sort();
+    clusters.push(members);
+  }
+  clusters.sort((a, b) => b.length - a.length || a[0].localeCompare(b[0]));
+  return clusters;
+}
+function filesForComposite(fireMatrix, members, minMatch) {
+  const fired = /* @__PURE__ */ new Set();
+  for (const [file, ids] of fireMatrix) {
+    let n = 0;
+    for (const m of members) if (ids.has(m)) n++;
+    if (n >= minMatch) fired.add(file);
+  }
+  return fired;
+}
+var DEFAULT_CALIBRATION = {
+  // 1.5× is the documented floor.
+  recallFpRatio: 1.5,
+  // 0.05 absolute FP — the same `min` value most rules get via the
+  // v0.18.x calibration contract.
+  minFpFloor: 0.05
+};
+function calibrateCluster(cluster2, edges, fireMatrix, positiveFiles, totalFiles, thresholds = DEFAULT_CALIBRATION) {
+  if (cluster2.length < 2) return null;
+  const clusterSet = new Set(cluster2);
+  const clusterEdges = edges.filter(
+    (e) => clusterSet.has(e.ruleIds[0]) && clusterSet.has(e.ruleIds[1])
+  );
+  if (clusterEdges.length === 0) return null;
+  const strongest = clusterEdges.reduce((a, b) => b.weight > a.weight ? b : a);
+  let best = null;
+  for (let k = 1; k <= cluster2.length; k++) {
+    const firedFiles = filesForComposite(fireMatrix, cluster2, k);
+    const nFiles = firedFiles.size;
+    if (nFiles === 0) continue;
+    let recall = 0;
+    let fp = 0;
+    let precision = 0;
+    let canCalibrate = false;
+    if (positiveFiles && positiveFiles.size > 0) {
+      let tp = 0;
+      let fpc = 0;
+      for (const file of firedFiles) {
+        if (positiveFiles.has(file)) tp++;
+        else fpc++;
+      }
+      const totalPos = positiveFiles.size;
+      const totalNeg = Math.max(1, totalFiles - totalPos);
+      recall = totalPos > 0 ? tp / totalPos : 0;
+      fp = fpc / totalNeg;
+      precision = tp + fpc > 0 ? tp / (tp + fpc) : 0;
+      canCalibrate = true;
+    }
+    const F1 = precision + recall > 0 ? 2 * precision * recall / (precision + recall) : 0;
+    if (canCalibrate) {
+      if (recall / Math.max(fp, 1e-9) < thresholds.recallFpRatio) continue;
+      if (fp < thresholds.minFpFloor && recall < 0.5) continue;
+    }
+    if (best === null || F1 > best.F1 + 1e-9 || Math.abs(F1 - best.F1) < 1e-9 && k > best.minMatch) {
+      best = {
+        minMatch: k,
+        npmi: strongest.weight,
+        fisherP: strongest.fisherP,
+        recall,
+        FP: fp,
+        precision,
+        F1,
+        nFiles
+      };
+    }
+  }
+  return best;
+}
+function compositeId(members) {
+  const sorted = [...members].sort();
+  return "composite/" + (0, import_node_crypto11.createHash)("sha1").update(sorted.join("\n")).digest("hex").slice(0, 12);
+}
+function worstSeverity(members, memberSeverities) {
+  let worst = "low";
+  const order = { low: 0, medium: 1, high: 2 };
+  for (const m of members) {
+    const s = memberSeverities?.get(m);
+    if (s && order[s] > order[worst]) worst = s;
+  }
+  return worst;
+}
+function describeComposite(members, minMatch) {
+  const clusterPart = members.length <= 4 ? members.join("+") : `${members.slice(0, 3).join("+")}+${members.length - 3} more`;
+  return `Composite rule: at least ${minMatch} of {${clusterPart}} fire on the same file.`;
+}
+function runClusterer(input) {
+  const total = input.fireMatrix.size;
+  const minSupport = input.params?.minSupport ?? adaptiveMinSupport(total);
+  const params = {
+    minSupport,
+    minNPMI: input.params?.minNPMI ?? DEFAULT_CLUSTER_PARAMS.minNPMI,
+    fisherAlpha: input.params?.fisherAlpha ?? DEFAULT_CLUSTER_PARAMS.fisherAlpha,
+    minClusterSize: input.params?.minClusterSize ?? DEFAULT_CLUSTER_PARAMS.minClusterSize
+  };
+  const support = computeRuleSupport(input.fireMatrix);
+  const rulesKept = prefilterBySupport(support, total, params.minSupport);
+  const edges = computeEdges(input.fireMatrix, rulesKept, total, params);
+  const clusters = singleLinkageCluster(edges, params.minClusterSize);
+  const entries = [];
+  const clusterMaxNPMI = /* @__PURE__ */ new Map();
+  for (const cluster2 of clusters) {
+    const cal = calibrateCluster(
+      cluster2,
+      edges,
+      input.fireMatrix,
+      input.positiveFiles,
+      total
+    );
+    if (!cal) continue;
+    const id = compositeId(cluster2);
+    const severity = worstSeverity(cluster2, input.memberSeverities);
+    entries.push({
+      id,
+      ruleIds: [...cluster2].sort(),
+      minMatch: cal.minMatch,
+      severity,
+      defaultOff: true,
+      description: describeComposite(cluster2, cal.minMatch),
+      calibration: {
+        recall: round3(cal.recall),
+        FP: round3(cal.FP),
+        precision: round3(cal.precision),
+        F1: round3(cal.F1),
+        nFiles: cal.nFiles
+      },
+      provenance: {
+        seed: "auto-cluster",
+        discoveredAt: input.now ?? (/* @__PURE__ */ new Date()).toISOString(),
+        nFiles: total,
+        members: cluster2.length,
+        npmi: round3(cal.npmi),
+        fisherP: round3(cal.fisherP)
+      }
+    });
+    clusterMaxNPMI.set(id, cal.npmi);
+  }
+  entries.sort((a, b) => b.calibration.F1 - a.calibration.F1 || a.id.localeCompare(b.id));
+  return { entries, supportCounts: support, clusterMaxNPMI, filesScanned: total, params };
+}
+function round3(n) {
+  return Math.round(n * 1e3) / 1e3;
+}
+
+// src/rules/composite-loader.ts
+var import_node_fs32 = require("fs");
+var import_node_path37 = require("path");
+var COMPOSITES_FILE = "composites.json";
+function compositesPath(cwd) {
+  return (0, import_node_path37.join)(cwd, COMPOSITES_FILE);
+}
+function readComposites(cwd) {
+  const path = compositesPath(cwd);
+  if (!(0, import_node_fs32.existsSync)(path)) return [];
+  try {
+    const raw = JSON.parse((0, import_node_fs32.readFileSync)(path, "utf-8"));
+    if (!Array.isArray(raw)) return [];
+    return raw.filter(isCompositeRuleEntry);
+  } catch {
+    return [];
+  }
+}
+function isCompositeRuleEntry(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  return typeof v.id === "string" && Array.isArray(v.ruleIds) && typeof v.minMatch === "number";
+}
+function writeComposites(cwd, entries) {
+  const path = compositesPath(cwd);
+  (0, import_node_fs32.mkdirSync)((0, import_node_path37.dirname)(path), { recursive: true });
+  const tmp = `${path}.tmp`;
+  (0, import_node_fs32.writeFileSync)(tmp, JSON.stringify(entries, null, 2), "utf-8");
+  const fs = require("fs");
+  fs.renameSync(tmp, path);
+}
+
+// src/cli/commands/composite.ts
+function registerComposite(program) {
+  const cmd = program.command("composite").description(
+    "discover and enable composite rules (Sprint 3, \xA73b). Run `slopbrick composite discover` to scan scans.jsonl, audit the candidates, then `slopbrick composite enable <id>` to opt a specific composite into slopbrick.config.mjs."
+  );
+  cmd.command("discover").description(
+    "run the empirical composite clusterer on .slopbrick/flywheel/scans.jsonl; writes composites.json"
+  ).action(async (_cmdOptions, command) => {
+    const options = command.optsWithGlobals();
+    const cwd = (0, import_node_path38.resolve)(options.workspace ?? process.cwd());
+    const payloads = readTelemetry(cwd);
+    if (payloads.length === 0) {
+      logger.error(
+        "`composite discover` needs at least 2 scans in .slopbrick/flywheel/scans.jsonl. Run `slopbrick scan` a few times first."
+      );
+      process.exit(1);
+    }
+    const fireMatrix = /* @__PURE__ */ new Map();
+    for (const payload of payloads) {
+      for (const f of payload.files) {
+        const set = fireMatrix.get(f.hash) ?? /* @__PURE__ */ new Set();
+        for (const id of f.ruleIds) set.add(id);
+        if (set.size > 0) fireMatrix.set(f.hash, set);
+      }
+    }
+    const out = runClusterer({
+      fireMatrix,
+      // No labeled positive set; let the clusterer surface for audit.
+      positiveFiles: void 0,
+      now: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    const finalEntries = out.entries.length === 0 ? [...(await Promise.resolve().then(() => (init_composite_seed(), composite_seed_exports))).HAND_CURATED_SEED] : out.entries;
+    writeComposites(cwd, finalEntries);
+    if (out.entries.length === 0) {
+      logger.info("Composite discovery: no clusters passed the empirical gate.");
+      logger.info(
+        "  (Try lowering --min-support, or run more scans to densify the ledger.)"
+      );
+      return;
+    }
+    logger.info(
+      `Composite discovery: ${out.entries.length} candidate(s) written to composites.json`
+    );
+    const lines = [];
+    for (const e of out.entries) {
+      lines.push("");
+      lines.push(
+        `  ${e.id}  minMatch=${e.minMatch}  F1=${e.calibration.F1}  (${e.ruleIds.length} members)`
+      );
+      lines.push(`    ${describeComposite(e.ruleIds, e.minMatch)}`);
+      lines.push(
+        `    provenance: ${e.provenance.seed} npmi=${e.provenance.npmi} fisherP=${e.provenance.fisherP}`
+      );
+    }
+    logger.info(lines.join("\n"));
+    logger.info(
+      "\nNext step: review each entry. Opt in with `slopbrick composite enable <id>`; opt out by removing the entry."
+    );
+  });
+  cmd.command("enable <id>").description(
+    "opt a specific composite into slopbrick.config.mjs#compositeRules (one composite per call)"
+  ).action(async (id, _cmdOptions, command) => {
+    const options = command.optsWithGlobals();
+    const cwd = (0, import_node_path38.resolve)(options.workspace ?? process.cwd());
+    const composites = readComposites(cwd);
+    const target = composites.find((c) => c.id === id);
+    if (!target) {
+      logger.error(
+        `Composite "${id}" not found in composites.json. Run \`slopbrick composite discover\` first to populate the ledger.`
+      );
+      process.exit(1);
+    }
+    const cfgPath = (0, import_node_path38.resolve)(cwd, "slopbrick.config.mjs");
+    const fs = require("fs");
+    if (!fs.existsSync(cfgPath)) {
+      logger.error(`No slopbrick.config.mjs found at ${cfgPath}.`);
+      process.exit(1);
+    }
+    const src = fs.readFileSync(cfgPath, "utf-8");
+    const compositeSnippet = JSON.stringify(
+      {
+        id: target.id,
+        category: "ai",
+        severity: target.severity,
+        aiSpecific: true,
+        description: target.description,
+        defaultOff: true,
+        ruleIds: target.ruleIds,
+        minMatch: target.minMatch,
+        create: "() => ({})",
+        analyze: "() => []"
+      },
+      null,
+      2
+    );
+    if (src.includes(`id: '${target.id}'`) || src.includes(`id: "${target.id}"`)) {
+      logger.info(`Composite "${id}" is already enabled in slopbrick.config.mjs (idempotent).`);
+      return;
+    }
+    const updated = src.replace(
+      /(export default\s*{[\s\S]*?)(}\s*;?\s*)$/,
+      (_match, head, tail) => `${head}  compositeRules: [
+${compositeSnippet}
+  ],
+${tail}`
+    );
+    fs.writeFileSync(cfgPath, updated, "utf-8");
+    logger.info(`Composite "${id}" enabled.`);
+    logger.info("Next scan will apply it; rerun `slopbrick scan` to see the effect.");
+  });
+  cmd.command("list").description("list composites currently registered (composites.json + config-declared)").action(async (_cmdOptions, command) => {
+    const options = command.optsWithGlobals();
+    const cwd = (0, import_node_path38.resolve)(options.workspace ?? process.cwd());
+    const composites = readComposites(cwd);
+    if (composites.length === 0) {
+      logger.info("No composites registered. Run `slopbrick composite discover` first.");
+      return;
+    }
+    const lines = ["Registered composites:"];
+    for (const e of composites) {
+      lines.push(
+        `
+  ${e.id}
+    ${describeComposite(e.ruleIds, e.minMatch)}
+    members=[${e.ruleIds.join(", ")}]  minMatch=${e.minMatch}
+    F1=${e.calibration.F1}  recall=${e.calibration.recall}  FP=${e.calibration.FP}`
+      );
+    }
+    logger.info(lines.join("\n"));
+  });
+}
+
 // src/cli/explain.ts
 var RULES_BASE_URL2 = "https://github.com/usebrick/platform/blob/main/packages/slopbrick/src/rules";
 function ruleIdToFilename2(ruleId) {
@@ -57821,152 +58767,7 @@ function formatExplain(result) {
 // src/cli/commands/explain.ts
 init_logger();
 init_builtins();
-
-// src/snippet/data.ts
-var CATEGORY_DIRECTIVES = {
-  visual: 'Avoid the saturated "vibe purple" Tailwind palette (violet-400-700, indigo-400-700). Prefer emerald, sky, amber, rose for accents. Never use arbitrary color values like bg-[#7c3aed] when a token exists.',
-  logic: "Never use explicit `any`. Use `unknown` and narrow. Always add an AbortSignal to fetches. Handle errors with try/catch, never swallow with empty catch. Use `as const` instead of `as Type` casts.",
-  wcag: 'All form inputs must have an accessible label (visible <label>, aria-label, or aria-labelledby). Decorative images must have empty alt="". Buttons must be <button>, never <div onClick>. Touch targets must be \u2265 24\xD724 CSS px.',
-  security: 'Never store tokens in localStorage or sessionStorage \u2014 use httpOnly Secure SameSite cookies. Never put secrets in NEXT_PUBLIC_* / REACT_APP_* / VITE_* env vars. Validate e.origin in postMessage handlers. Never dangerouslySetInnerHTML with user input. Never use target="_blank" without rel="noopener".',
-  perf: "Always use AbortController with fetch. Use image width/height attributes to prevent CLS. Use <Suspense> around async client components. Don't load all images eagerly.",
-  typo: `Never leave TODO / placeholder / "change me" copy in shipped code. Use real i18n strings or the project's content map.`,
-  layout: "Don't stack badge-above-h1 hero patterns. Don't build 3-stat banner rows without explicit user request. Don't use emoji inside nav items (use SVG icons). Use the project's spacing scale (4px or 8px grid), never arbitrary values like p-[13px].",
-  component: "Don't build components > 200 lines. Extract shared subcomponents. Avoid circular prop drilling \u2014 use context.",
-  arch: "For Astro: server-render everything by default; only opt-in to client islands when you need interactivity. Don't put secrets in client-side code.",
-  test: "Use domain-specific fixture data, assert on value shapes not just truthiness, and consolidate repeated setup into helpers. Avoid `expect(x).toBeDefined()` placeholders and textbook fixtures like 'John Doe' or 'test@test.com'."
-};
-var RULE_HINTS = {
-  // v0.38.0 hygiene: 37 v10-DORMANT rule hints were removed. Every
-  // remaining key matches a rule in src/rules/builtins.ts. No orphans.
-  // (v0.16.0 previously moved 35 out-of-scope orphan hints to
-  //   docs/research/backlog-rule-hints.md
-  // for future implementers to paste back when the corresponding rules ship.)
-  "security/hardcoded-secret": "Never inline API keys, JWT secrets, or database passwords in source. Load them from env vars and never commit a .env file. Assume any published secret is compromised and rotate it.",
-  "security/exposed-env-var": "NEVER prefix a secret with NEXT_PUBLIC_, VITE_, REACT_APP_, EXPO_PUBLIC_, GATSBY_, or PUBLIC_ \u2014 those vars are inlined into every browser build.",
-  "security/dangerous-cors": "Don't set Access-Control-Allow-Origin: * on production endpoints. Restrict to an explicit allowlist; never combine wildcard origin with credentials: true.",
-  "security/missing-auth-check": "Every server route handler must perform an authentication + authorization check at the top. Reachability of an endpoint by any user (authenticated or not) is a vulnerability, not a feature.",
-  "security/unsafe-html-render": "Sanitize any non-literal value passed to dangerouslySetInnerHTML with DOMPurify. Better: avoid the prop entirely and let React escape via children.",
-  "security/fail-open-auth": "Don't gate auth bypasses on NODE_ENV. Replace dev-env checks with an explicit AUTH_BYPASS flag that's never set in production.",
-  "security/sql-construction": 'Never build SQL with string concatenation or template-literal interpolation. Use parameterized queries: pg client.query("... WHERE id = $1", [id]) or your ORM query builder.',
-  "security/public-admin-route": "Routes under /admin, /internal, /debug, /staff, /manage, /private need an explicit role check on top of standard auth \u2014 auth alone is not enough for privileged paths.",
-  "visual/arbitrary-escape": "Never use bracket-notation values like text-[13px] or bg-[#7c3aed]. Use design tokens instead.",
-  "visual/spacing-scale-violation": "Use spacing scale tokens (p-2, gap-4, etc.) instead of arbitrary values like p-[13px] or gap-[1.75rem].",
-  "visual/radius-scale-violation": "Use radius scale tokens (rounded-md, rounded-lg, etc.) instead of arbitrary values like rounded-[7px].",
-  // v0.16.0 — in-scope orphans kept here (corresponding rule ships in v0.16.0).
-  "typo/placeholder-text": 'Never leave "TODO", "placeholder", "change me", "your text here" in shipped UI.',
-  "logic/key-prop-missing": "Always provide a stable `key` prop when rendering lists.",
-  "logic/boundary-violation": "Don't import data-layer / DB code into UI components. Server-side only.",
-  "wcag/missing-alt": 'Every <img> needs alt text. Decorative: alt="". Informative: describe the image.',
-  "security/localstorage-token": "Never store JWT / access token / refresh token in localStorage or sessionStorage. Issue as httpOnly cookie.",
-  "security/eval": "Never use eval() or new Function(). These are RCE vectors if the input is ever attacker-controlled.",
-  "security/target-blank-no-noopener": 'Always add rel="noopener" (or rel="noreferrer") to target="_blank" links.',
-  "component/giant-component": "Don't build components > 200 lines. Extract shared subcomponents.",
-  "component/multiple-components-per-file": "One component per file. Move subcomponents into their own files so the Context Window stays small and boundary tests are easy.",
-  "component/shadcn-prop-mismatch": "Select shadcn variants via the `variant` prop, not long `className` overrides. See the component registry for available variants.",
-  "context/import-path-mismatch": "Use only the canonical import paths declared in brick.config.json (e.g. @/components/ui/, @/lib/).",
-  "layout/gap-monopoly": "Mix gap-2 / gap-4 / gap-6 / gap-12 deliberately. Don't repeat the same gap value across the whole project.",
-  "layout/math-element-uniformity": "Human files have lopsided interactive counts (1 button + 12 inputs). AI tends to balance them. Build forms with many inputs and few buttons.",
-  "layout/math-grid-uniformity": "Vary grid-cols-N (grid-cols-2, grid-cols-3, grid-cols-4, grid-cols-6) across sections instead of repeating grid-cols-3.",
-  "layout/spacing-grid": "Use the configured spacing scale (4px or 8px grid). Avoid arbitrary values like p-[13px] that aren't on the scale.",
-  "logic/ghost-defensive": "Use optional chaining (?.) or early returns instead of deep && guards. If a defensive chain runs 3+ levels deep, refactor.",
-  "logic/heaps-deviation": "Inspect for LLM-style vocabulary patterns: this file's vocabulary grows faster (high Heaps \u03BB) or slower (low \u03BB) than typical source code. Verify authorship if unexpected. (v0.12.0 \u2014 Christ et al. EMNLP Findings 2025.)",
-  "logic/ks-distribution-shift": "Inspect the shifted features. KS detects both AI anomalies and production-rot anomalies (it is symmetric); combine with Heaps/Zipf for AI-specific signal. (v0.12.0 \u2014 arXiv:2510.15996, Oct 2025.)",
-  "logic/zipf-slope-anomaly": "Inspect for LLM-style frequency distribution: this file's identifier usage is more peaked or flatter than typical human code. (v0.12.0 \u2014 Christ et al. EMNLP Findings 2025.)",
-  "logic/math-any-density": "Replace `: any` with proper types. Start with the parameter/return types of the most-used functions.",
-  "logic/math-console-log-storm": "Replace debug logs with a proper debugger or logger.debug(). Remove all console.log before shipping.",
-  "logic/math-gini-class-usage": "Spread usage across more class tokens instead of repeating the same handful (p-4, p-8, rounded-lg, etc.).",
-  "logic/math-variable-name-entropy": "Use domain-specific identifier names (reservations, invoices, customers) instead of generic data/items/value.",
-  "logic/optimistic-no-rollback": "In optimistic updates, revert state in the catch block: `setX(prev => prev)`. Never leave stale UI on error.",
-  "logic/reactive-hook-soup": "Coordinate state via a single derived value (useMemo) or a state machine. Avoid chained useEffects that sync local state.",
-  "logic/zombie-state": "Remove unused useState or wire it into the component. Don't leave declared-but-never-read state bindings.",
-  "dead/unused-import": "Remove the import or use the symbol somewhere. Unused imports are the most common AI-iteration signature \u2014 the model added it for a feature, then rewrote the function without cleaning up.",
-  "dead/unused-local": "Remove the declaration or use the variable. AI-iteration signature: the model declared a binding for a feature, then rewrote the function without cleaning up.",
-  "dead/unused-parameter": "Remove the parameter (and update every call site) or use it in the function body. AI-iteration signature: the model added a parameter for a feature, then rewrote the function without removing parameters the new code does not need.",
-  "dead/dead-branch": "Replace the literal boolean with a real condition, or remove the dead branch. AI-iteration signature: a feature flag toggled to a constant, or a wrapper from a previous refactor that was never cleaned up.",
-  "dead/unreachable": "Remove this statement \u2014 code after a return/throw/break/continue is unreachable. AI-iteration signature: the model added an early return for a new error path, then forgot the rest of the function body was still sitting below it.",
-  "perf/cls-image": "Add width/height attributes or an aspect-ratio utility to prevent layout shift.",
-  "perf/css-bloat": "Extract to a CSS variable (`--surface-card`) or a component prop when a class string repeats 5+ times.",
-  "typo/math-button-label-uniformity": 'Mix button lengths deliberately \u2014 pair a short "Save" with a longer "Mark as complete" \u2014 instead of repeating the same template.',
-  "visual/inline-style-dominance": "Replace inline `style={{...}}` with className utilities (e.g. Tailwind `p-4 m-2 gap-3`) or a CSS module class.",
-  "visual/math-default-font": "Import a distinctive font (next/font/google, @font-face, or a CSS variable) instead of relying on the framework default.",
-  "visual/math-font-entropy": "Use a wider range of text sizes (text-xs, text-sm, text-lg, text-xl, text-2xl, text-3xl) for a more deliberate type scale.",
-  "visual/math-rounded-entropy": "Use a wider range of border-radius values (sm, md, 2xl, 3xl) instead of repeating the same lg/xl/full pattern.",
-  "visual/math-spacing-entropy": "Mix more spacing values from the design scale (e.g. 3, 5, 7, 10, 14, 20, 28) instead of repeating the same 4/8 pattern.",
-  "visual/naturalness-anomaly": "Use domain-specific identifier names so the identifier stream reflects the actual problem domain. Hindle 2012 \xA74.3: LLM-generated code reuses a narrow band of training-data identifiers, dropping distinct-token ratio below 30%.",
-  "visual/math-color-cluster": "Use at least 3 distinct hue families (e.g. blue + amber + green) instead of clustering every color in the violet/fuchsia band.",
-  "wcag/focus-appearance": "Add a focus-visible:ring-* class, or remove outline-none. Keyboard users need a visible focus indicator.",
-  "wcag/focus-obscured": "Ensure focused elements are not hidden behind fixed or sticky wrappers.",
-  "test/weak-assertion": "Assert on a specific value or shape: `expect(x).toEqual(expectedValue)`. Avoid `.toBeDefined()` / `.toBeTruthy()` placeholders and tautological `expect(x).toBe(x)`.",
-  "test/duplicate-setup": "Extract shared `beforeEach` / `setupServer` blocks into a single helper (e.g. `renderWithProviders`) so each describe block calls it instead of repeating setup.",
-  "test/fake-placeholder": "Use domain-specific fixture values (`alice@acme-corp.com`, `Order#48231`) or a factory like @faker-js/faker. Avoid textbook placeholders (`John Doe`, `test@test.com`, `id: 1`).",
-  "product/terminology-drift": "Keep the leading noun consistent across files: `PostList`, `PostDetail`, `PostCard` are one entity, not three. AI agents pick slightly different words each invocation; product copy drifts.",
-  "product/ux-pattern-fragmentation": "Keep the per-category count tight: modal \u22643, toast \u22642, button \u22644, input \u22643, card \u22643. Pick the canonical one and alias the rest. `slopbrick patterns` reports the per-category count.",
-  // v0.13.0 — AI-specific rules (peer-reviewed signals).
-  "ai/markdown-leakage": "Delete stray `\\`\\`\\`<lang>\\`\\`\\`` markers; they are Markdown fences, not valid syntax in standalone source files (Yotkova et al. SemEval-2026).",
-  "ai/comment-ratio": "AI tools either skip comments (reductive models) or over-comment (expansive models). Match the corpus mean \xB1 2\u03C3 (Rahman et al. 2024, Bisztray et al. 2025).",
-  "ai/whitespace-regularity": "Vary inter-token spacing (single spaces mostly, occasional alignment in tables). Uniform runs are an AI tell (Shi et al. DetectCodeGPT 2024).",
-  "ai/text-like-ratio": "Move natural-language explanations to README files or doc comments. Inline prose in source code is hard to maintain (Yotkova 2026).",
-  "ai/errors-near-eof": "Check whether the file was truncated by a token limit. Unbalanced delimiters near EOF suggest the model ran out of output budget (Yotkova 2026).",
-  "ai/any-density": "Replace `any` with `unknown`, `Record<string, unknown>`, or a domain type. The `: any` annotation propagates type-errors and defeats TS safety (Lee, Hassan, Hindle MSR 2026).",
-  "ai/renyi-profile": "The token distribution is mass-concentrated on a few high-frequency tokens. Verify authorship if unexpected (R\xE9nyi 1961, Moslonka 2025).",
-  "ai/segment-surprisal-cv": "The cross-entropy is suspiciously uniform across the file. Real codebases have varied registers (Binoculars, Hans 2024).",
-  "ai/compression-profile": "The file compresses unusually well and lines are highly repetitive \u2014 characteristic of AI-generated boilerplate (Cilibrasi 2005, Mahoney 1999).",
-  // v0.14.5b — 6 new AI tendency detection rules (DORMANT in v0.14.5b;
-  // reclassified post-v7 calibration in v0.14.5d)
-  "ai/tailwind-color-overuse": "If most utility classes are bg-violet-500, text-violet-600, ring-violet-400 \u2014 the project is on the AI-default palette. Audit and replace with the project's design tokens.",
-  "ai/default-react-stack": "Every new file is a Vite + React + Tailwind + Zustand + React Hook Form clone. Verify the project actually needs each piece before adding it.",
-  "ai/library-reinvention": "Re-implementing zustand, react-hook-form, or date-fns inline (custom event emitters, useState reducers, manual date math) is a sign of LLM completion-mode code. Use the libraries the project already depends on.",
-  "ai/state-default-overuse": "Wrapping every component in useState + useEffect for transient UI state is the React tutorial default. Real production code uses refs, uncontrolled inputs, or the project's state lib.",
-  "ai/fetch-default-overuse": "Calling fetch() inline in components instead of going through the project's data-fetching layer (react-query, swr, or your own client) bypasses the cache, error boundary, and abort handling.",
-  "ai/console-debug-storm": "5+ console.log calls in a single file is debug-by-print-statement, the LLM training-data default. Remove before commit; use the project's logger or a real debugger.",
-  // v0.17.0 — db/* rules (Postgres static analysis via pgsql-parser)
-  "db/sql-concat": 'Never build SQL with template-literal interpolation \u2014 `db.query(`SELECT \u2026 WHERE id = ${id}`)` is a SQL injection vector. Use parameterized queries (`db.query("\u2026 WHERE id = $1", [id])`) or your ORM query builder.',
-  // v0.17.0 — docs/* rules (markdown drift detection)
-  "docs/stale-package-reference": "Update the doc to reference an installed package, or add the package to package.json. Copy-pasted install commands from a previous project are the #1 doc-drift failure mode.",
-  "docs/stale-function-reference": "Rename the doc reference to match a current export, or add a wrapper export. Stale function callouts in tutorials cost readers 10+ minutes of debugging.",
-  "docs/broken-link": "Create the file or fix the link target. On a public docs site, broken links erode trust more than stale copy.",
-  // v0.18.9 — Rust-specific rules (tree-sitter-backed)
-  "rust/unused-pub-fn": "Remove the function or call it. Rust's compiler doesn't warn on `pub fn` references unless `#![warn(dead_code)]` is set at the crate root. AI agents leave these behind during iterative refactors.",
-  "rust/unwrap-in-production": "Replace `.unwrap()` / `.expect()` with `?` (early-return on Err), `.map_err(...)` for error conversion, or an explicit `match`. They panic in production; reserve them for `#[cfg(test)]` or `#[test]` scopes.",
-  "rust/todo-macro": "Implement the function body or remove the stub. `todo!()` / `unimplemented!()` both expand to `panic!()`, so a hit at runtime crashes the program. Move them into a `#[cfg(test)] mod tests` block to suppress.",
-  "rust/stringly-typed": 'Replace the `String` / `&str` parameter with the typed enum that already exists in the file. Stringly-typed APIs lose type information at the boundary \u2014 typos (`"Click"` vs `"click"`) only fail at runtime.',
-  // v0.19.0 — TypeScript-specific rules
-  "ts/enum-vs-as-const": "Replace `enum Foo { A, B }` with `const Foo = { A: 'A', B: 'B' } as const` (or `const Foo = ['A', 'B'] as const`). Modern TS style guides (Google, TS-eslint) prefer `as const` because enums have surprising runtime semantics.",
-  "ts/import-type-misuse": "Use `import type { X } from '...'` instead of `import { type X } from '...'`. The split form is more common in real codebases and makes the type-only intent unambiguous.",
-  "ts/never-vs-unknown": "The `never` return type means 'this function never returns'. Reserve it for functions that always throw, always loop, or always exit. For 'impossible' branches, use a concrete type (`void`, `Error`, `unknown`) and an exhaustive check.",
-  "ts/excessive-type-assertion": "More than 3 `as` assertions in one function is a strong signal that the type is wrong, not the code. Fix the type definition (or use a type guard) instead of bypassing the type system.",
-  // v0.19.0 — Go-specific rules
-  "go/struct-tag-inconsistency": 'Pick one tag style per struct. If most fields are `json:"foo"`, this field should be too. Real Go code maintains consistency within a struct (or within a package).',
-  "go/nil-slice-vs-empty": "Either declare as `var x = []int{}` or assign with `make([]int, 0)`. The nil/empty inconsistency is an AI signal \u2014 real code picks one form and sticks with it.",
-  // v0.19.0 — Duplication detector
-  "dup/identical-block": "Refactor to a shared helper. This is a Type-1 clone (byte-for-byte identical after normalization). Common in AI-generated code that copy-pastes from training data.",
-  // v0.23.0 — Type-2 near-duplicate detector (MinHash + LSH)
-  "dup/near-duplicate": "Refactor to a shared helper. Type-2 near-duplicate: same identifiers + structure, different whitespace/comments. AI-iterated code regenerates the same function with cosmetic edits. (v0.23.0 \u2014 MinHash + LSH, k=5, thr 0.7.)",
-  // v0.24.0 — Type-3 structural clone detector (two-stage MinHash)
-  "dup/structural-clone": "Refactor to a shared helper. Type-3 clone: same shape as another file after identifier canonicalization, with renames and/or added/removed statements. AI agents and copy-paste both produce this. Extract the shared part. (v0.24.0.)",
-  // v0.24.0 — Kotlin rules (DORMANT until v9 Kotlin corpus calibration)
-  // v0.29.0 — non-AI Kotlin rules (DORMANT until larger pos arm)
-  // v0.30.0 — non-AI Java rules (Option C applied to v9 Java corpus, 92k files)
-  "java/sql-string-concat": "Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{}). String concat into SQL is the canonical SQL-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT, ratio 0.59.)",
-  "java/thread-sleep-in-loop": "Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the polling anti-pattern \u2014 ties up Tomcat/Jetty/Netty threads. (v0.30.0 \u2014 DORMANT, era-confounded ratio 0.97.)",
-  // v0.35.0 — content-based detection (CoCoNUTS-inspired)
-  "java/suspicious-implementation": "Function name claims validate/encrypt/hash/sanitize but body is empty, returns null/true, or returns the input. This is a content mismatch \u2014 the function's claimed behavior doesn't match its actual behavior. OWASP A04:2021.",
-  // v0.35.1 — Raidar-inspired content-based detection
-  "java/lost-stack-trace": 'catch block throws a new exception without the original cause \u2014 stack trace is lost. Pass the original exception as the second arg to the new exception\'s constructor: `throw new XxxException("msg", e)`.',
-  // v0.24.0 — Swift rules (DORMANT until v9 Swift corpus calibration)
-  "swift/force-unwrap": "Replace with the safe form: `as?` + guard/if let, `try?`, or `guard let x = optional else { return }`. `!` crashes unconditionally in release. (v0.24.0 \u2014 DORMANT.)",
-  "swift/print-debug": "Replace with `Logger(subsystem:..., category:...).info(...)` (os.log). `print` writes to stdout with no level and no redaction. (v0.24.0 \u2014 DORMANT.)",
-  "swift/fatal-error-thrown": "Replace with `return` of a typed default (e.g. `nil`, `[]()`) or throw a typed `enum MyError: Error`. `fatalError` survives release builds. (v0.24.0 \u2014 DORMANT.)",
-  "swift/implicitly-unwrapped-optional": "Declare as `var name: Type?` and unwrap with `guard let`. IUOs exist for Obj-C bridging / IBOutlets but using them everywhere is an AI signal. (v0.24.0 \u2014 DORMANT.)",
-  "swift/strong-self-capture": "Capture with `[weak self]` (or `[unowned self]` if guaranteed non-nil): `[weak self] in self?.foo = bar`. Strong self capture creates a retain cycle. (v0.24.0 \u2014 DORMANT.)",
-  // v0.24.0 — C++ rules (DORMANT until v9 C++ corpus calibration)
-  "cpp/raw-new-delete": "Replace with `auto p = std::make_unique<T>(...)`. Smart pointers delete on scope exit, never leak on early return / exception, never double-free. (v0.24.0 \u2014 DORMANT.)",
-  "cpp/c-style-cast": "Use the named cast: `static_cast<int>(x)`, `reinterpret_cast<...>(p)`, `const_cast<...>(ref)`. C-style casts silently pick static / reinterpret / const \u2014 impossible to grep. (v0.24.0 \u2014 DORMANT.)",
-  "cpp/printf-debug": "Replace with `spdlog::info(...)`, `LOG(INFO) << ...` (glog), or `ABSL_LOG(INFO) << ...`. `printf` / `std::cout` have no levels, no redaction, no sink routing. (v0.24.0 \u2014 DORMANT.)",
-  "cpp/magic-numbers": "Replace with `constexpr int MAX = 1024;` (or `static constexpr`). Named constants live next to their value, can be searched, force the reader to mean what they say. (v0.24.0 \u2014 DORMANT.)"
-};
-
-// src/cli/commands/explain.ts
+init_data();
 function registerExplain(program) {
   program.command("explain <ruleId>").description("Print rationale, pattern, and remediation for a single rule").action((ruleId) => {
     const result = explainRule(ruleId, builtinRules, RULE_HINTS);
@@ -57976,7 +58777,7 @@ function registerExplain(program) {
 }
 
 // src/cli/commands/calibration.ts
-var import_node_path36 = require("path");
+var import_node_path39 = require("path");
 var import_node_url = require("url");
 
 // src/rules/signal-strength.json
@@ -61569,7 +62370,7 @@ var signal_strength_default2 = {
 };
 
 // src/cli/commands/calibration.ts
-var __dirname = (0, import_node_path36.dirname)((0, import_node_url.fileURLToPath)(__importMetaUrl));
+var __dirname = (0, import_node_path39.dirname)((0, import_node_url.fileURLToPath)(__importMetaUrl));
 function loadData() {
   return signal_strength_default2;
 }
@@ -61690,13 +62491,13 @@ function registerCalibration(program) {
 }
 
 // src/cli/commands/install.ts
-var import_node_path38 = require("path");
+var import_node_path41 = require("path");
 init_logger();
 init_git();
 
 // src/cli/installer.ts
-var import_node_fs31 = require("fs");
-var import_node_path37 = require("path");
+var import_node_fs33 = require("fs");
+var import_node_path40 = require("path");
 var BEGIN_SENTINEL = "# slopbrick-hook-begin";
 var END_SENTINEL = "# slopbrick-hook-end";
 var SENTINEL_BLOCK = `${BEGIN_SENTINEL}
@@ -61704,14 +62505,14 @@ npx slopbrick --staged
 ${END_SENTINEL}
 `;
 function hookPath(gitRoot) {
-  const huskyDir = (0, import_node_path37.join)(gitRoot, ".husky");
-  if ((0, import_node_fs31.existsSync)(huskyDir)) {
-    return (0, import_node_path37.join)(huskyDir, "pre-commit");
+  const huskyDir = (0, import_node_path40.join)(gitRoot, ".husky");
+  if ((0, import_node_fs33.existsSync)(huskyDir)) {
+    return (0, import_node_path40.join)(huskyDir, "pre-commit");
   }
-  return (0, import_node_path37.join)(gitRoot, ".git", "hooks", "pre-commit");
+  return (0, import_node_path40.join)(gitRoot, ".git", "hooks", "pre-commit");
 }
 function readHookContent(path) {
-  return (0, import_node_fs31.readFileSync)(path, "utf8");
+  return (0, import_node_fs33.readFileSync)(path, "utf8");
 }
 function sentinelsPresent(content) {
   const lines = content.split(/\r?\n/);
@@ -61733,7 +62534,7 @@ function replaceSentinelBlock(content) {
 }
 function installHook(gitRoot) {
   const path = hookPath(gitRoot);
-  if ((0, import_node_fs31.existsSync)(path)) {
+  if ((0, import_node_fs33.existsSync)(path)) {
     const content = readHookContent(path);
     const { begin, end } = sentinelsPresent(content);
     if (begin && end) {
@@ -61745,9 +62546,9 @@ function installHook(gitRoot) {
           exitCode: 0
         };
       }
-      (0, import_node_fs31.writeFileSync)(path, replaced.endsWith("\n") ? replaced : `${replaced}
+      (0, import_node_fs33.writeFileSync)(path, replaced.endsWith("\n") ? replaced : `${replaced}
 `);
-      (0, import_node_fs31.chmodSync)(path, 493);
+      (0, import_node_fs33.chmodSync)(path, 493);
       return {
         ok: true,
         message: "Replaced pre-commit hook block",
@@ -61765,17 +62566,17 @@ function installHook(gitRoot) {
     }
     const normalized = content.length > 0 && !content.endsWith("\n") ? `${content}
 ` : content;
-    (0, import_node_fs31.writeFileSync)(path, `${normalized}${SENTINEL_BLOCK}`);
-    (0, import_node_fs31.chmodSync)(path, 493);
+    (0, import_node_fs33.writeFileSync)(path, `${normalized}${SENTINEL_BLOCK}`);
+    (0, import_node_fs33.chmodSync)(path, 493);
     return {
       ok: true,
       message: "Installed pre-commit hook",
       exitCode: 0
     };
   }
-  (0, import_node_fs31.mkdirSync)((0, import_node_path37.dirname)(path), { recursive: true });
-  (0, import_node_fs31.writeFileSync)(path, SENTINEL_BLOCK, { mode: 493 });
-  (0, import_node_fs31.chmodSync)(path, 493);
+  (0, import_node_fs33.mkdirSync)((0, import_node_path40.dirname)(path), { recursive: true });
+  (0, import_node_fs33.writeFileSync)(path, SENTINEL_BLOCK, { mode: 493 });
+  (0, import_node_fs33.chmodSync)(path, 493);
   return {
     ok: true,
     message: "Installed pre-commit hook",
@@ -61784,7 +62585,7 @@ function installHook(gitRoot) {
 }
 function uninstallHook(gitRoot) {
   const path = hookPath(gitRoot);
-  if (!(0, import_node_fs31.existsSync)(path)) {
+  if (!(0, import_node_fs33.existsSync)(path)) {
     return {
       ok: true,
       message: "Hook not installed",
@@ -61820,7 +62621,7 @@ function uninstallHook(gitRoot) {
   }
   const remaining = [...lines.slice(0, start), ...lines.slice(end + 1)];
   const result = remaining.join("\n");
-  (0, import_node_fs31.writeFileSync)(path, result.endsWith("\n") ? result : `${result}
+  (0, import_node_fs33.writeFileSync)(path, result.endsWith("\n") ? result : `${result}
 `);
   return {
     ok: true,
@@ -61833,7 +62634,7 @@ function uninstallHook(gitRoot) {
 function registerInstall(program) {
   program.command("install").description("install the git pre-commit hook").action(async (_cmdOptions, command) => {
     const options = command.optsWithGlobals();
-    const cwd = (0, import_node_path38.resolve)(options.workspace ?? process.cwd());
+    const cwd = (0, import_node_path41.resolve)(options.workspace ?? process.cwd());
     const root = getGitRoot(cwd);
     if (!root) {
       logger.error("Not a Git repository. Run `git init` first, or remove --staged from your command.");
@@ -61848,13 +62649,13 @@ function registerInstall(program) {
 }
 
 // src/cli/commands/uninstall.ts
-var import_node_path39 = require("path");
+var import_node_path42 = require("path");
 init_logger();
 init_git();
 function registerUninstall(program) {
   program.command("uninstall").description("uninstall the git pre-commit hook").action(async (_cmdOptions, command) => {
     const options = command.optsWithGlobals();
-    const cwd = (0, import_node_path39.resolve)(options.workspace ?? process.cwd());
+    const cwd = (0, import_node_path42.resolve)(options.workspace ?? process.cwd());
     const root = getGitRoot(cwd);
     if (!root) {
       logger.error("Not a Git repository. Run `git init` first, or remove --staged from your command.");
@@ -61877,8 +62678,8 @@ init_config2();
 init_header();
 
 // src/mcp/tools.ts
-var import_node_fs32 = require("fs");
-var import_node_path40 = require("path");
+var import_node_fs34 = require("fs");
+var import_node_path43 = require("path");
 init_worker();
 init_patterns();
 init_architecture_score();
@@ -62124,10 +62925,10 @@ async function runSuggest(args, ctx, options = {}) {
 function runCheckConstitution(args, ctx) {
   const path = args.path;
   if (!path) return toolError("Missing required argument: path");
-  const absPath = (0, import_node_path40.resolve)(ctx.cwd, path);
+  const absPath = (0, import_node_path43.resolve)(ctx.cwd, path);
   let source;
   try {
-    source = (0, import_node_fs32.readFileSync)(absPath, "utf-8");
+    source = (0, import_node_fs34.readFileSync)(absPath, "utf-8");
   } catch (err) {
     return toolError(
       `Cannot read file ${absPath}: ${err instanceof Error ? err.message : String(err)}`
@@ -62310,7 +63111,7 @@ function errorResponse(id, code, message, data2) {
   return { jsonrpc: "2.0", id, error: { code, message, ...data2 !== void 0 ? { data: data2 } : {} } };
 }
 async function runMcpServer(input, output, cwd) {
-  return new Promise((resolve42) => {
+  return new Promise((resolve43) => {
     let buffer = "";
     input.setEncoding("utf-8");
     input.on("data", (chunk) => {
@@ -62348,8 +63149,8 @@ async function runMcpServer(input, output, cwd) {
         nlIdx = buffer.indexOf("\n");
       }
     });
-    input.on("end", () => resolve42());
-    input.on("close", () => resolve42());
+    input.on("end", () => resolve43());
+    input.on("close", () => resolve43());
   });
 }
 
@@ -62372,7 +63173,7 @@ function registerDoctor(program) {
 }
 
 // src/cli/commands/watch.ts
-var import_node_path41 = require("path");
+var import_node_path44 = require("path");
 init_watch();
 function registerWatch(program, scanAction) {
   program.command("watch").description("re-run scan on every file change. Flags new violations as you write. The LockBrick prevention loop entry.").action(async (_cmdOptions, command) => {
@@ -62381,19 +63182,19 @@ function registerWatch(program, scanAction) {
       ...rawGlobals,
       noIncrease: rawGlobals.increase === false
     };
-    const cwd = (0, import_node_path41.resolve)(options.workspace ?? process.cwd());
+    const cwd = (0, import_node_path44.resolve)(options.workspace ?? process.cwd());
     await scanAction([], options, command);
     await watchProject(options, cwd, []);
   });
 }
 
 // src/cli/commands/lock.ts
-var import_node_path42 = require("path");
+var import_node_path45 = require("path");
 init_logger();
 function registerLock(program) {
   program.command("lock").description("install a Git pre-commit hook that runs `slopbrick scan --staged` on every commit. The LockBrick prevention loop: block AI-introduced slop from ever reaching the repo.").option("--uninstall", "remove the pre-commit hook instead of installing it").option("--husky", "force-install under .husky/pre-commit (Husky v9). Default auto-detects via .husky/ dir.").option("--workspace <path>", "workspace directory", process.cwd()).action(
     (cmdOptions) => {
-      const cwd = (0, import_node_path42.resolve)(cmdOptions.workspace ?? process.cwd());
+      const cwd = (0, import_node_path45.resolve)(cmdOptions.workspace ?? process.cwd());
       if (cmdOptions.uninstall) {
         const result2 = uninstallHook(cwd);
         logger.info(result2.message);
@@ -62414,7 +63215,7 @@ function registerLock(program) {
 }
 
 // src/cli/commands/ci.ts
-var import_node_path43 = require("path");
+var import_node_path46 = require("path");
 init_logger();
 init_dist();
 function registerCi(program, scanAction) {
@@ -62429,7 +63230,7 @@ function registerCi(program, scanAction) {
         // scan only changed files
         format: cmdOptions.format ?? "json"
       };
-      const cwd = (0, import_node_path43.resolve)(options.workspace ?? process.cwd());
+      const cwd = (0, import_node_path46.resolve)(options.workspace ?? process.cwd());
       await scanAction([], options, command);
       const health = loadHealth(cwd);
       if (!health) {
@@ -62457,12 +63258,12 @@ function registerCi(program, scanAction) {
 }
 
 // src/cli/commands/memory.ts
-var import_node_path44 = require("path");
+var import_node_path47 = require("path");
 init_logger();
 function registerMemory(program) {
   program.command("memory").description("show or regenerate .slopbrick/structure.md (the agent-readable repository summary) without re-scanning").option("--show", "print the current .slopbrick/structure.md to stdout (default if no flag is passed)").option("--regenerate", "re-render structure.md from the existing inventory.json + constitution.json (no scan)").option("--workspace <path>", "workspace directory", process.cwd()).action(
     async (cmdOptions) => {
-      const cwd = (0, import_node_path44.resolve)(cmdOptions.workspace ?? process.cwd());
+      const cwd = (0, import_node_path47.resolve)(cmdOptions.workspace ?? process.cwd());
       const { renderStructureMarkdown: renderStructureMarkdown2, readStructureMarkdown: readStructureMarkdown2, writeStructureMarkdown: writeStructureMarkdown2 } = await Promise.resolve().then(() => (init_structure_md(), structure_md_exports));
       const { loadInventory: loadInventory2, loadConstitution: loadConstitution2, inventoryPath: invPath, constitutionPath: conPath } = await Promise.resolve().then(() => (init_dist(), dist_exports));
       if (cmdOptions.regenerate) {
@@ -62492,49 +63293,49 @@ function registerMemory(program) {
 }
 
 // src/cli/commands/migrate.ts
-var import_node_path46 = require("path");
+var import_node_path49 = require("path");
 init_logger();
 
 // src/cli/migrate.ts
-var import_node_fs33 = require("fs");
-var import_node_path45 = require("path");
+var import_node_fs35 = require("fs");
+var import_node_path48 = require("path");
 init_logger();
 function planMigration(workspaceDir) {
   const moves = [];
   const rewrites = [];
   const gitignoreEdits = [];
-  const oldDir = (0, import_node_path45.join)(workspaceDir, ".slop-audit");
-  const newDir = (0, import_node_path45.join)(workspaceDir, ".slopbrick");
-  if ((0, import_node_fs33.existsSync)(oldDir)) {
+  const oldDir = (0, import_node_path48.join)(workspaceDir, ".slop-audit");
+  const newDir = (0, import_node_path48.join)(workspaceDir, ".slopbrick");
+  if ((0, import_node_fs35.existsSync)(oldDir)) {
     moves.push({ from: oldDir, to: newDir, kind: "dir" });
     rewrites.push({
-      path: (0, import_node_path45.join)(newDir, "inventory.json"),
+      path: (0, import_node_path48.join)(newDir, "inventory.json"),
       field: "version",
       from: '"1"',
       to: '"2"'
     });
     rewrites.push({
-      path: (0, import_node_path45.join)(newDir, "constitution.json"),
+      path: (0, import_node_path48.join)(newDir, "constitution.json"),
       field: "version",
       from: '"1"',
       to: '"2"'
     });
   }
-  const oldCache = (0, import_node_path45.join)(workspaceDir, ".slop-audit-cache.json");
-  const newCache = (0, import_node_path45.join)(workspaceDir, ".slopbrick-cache.json");
-  if ((0, import_node_fs33.existsSync)(oldCache)) {
+  const oldCache = (0, import_node_path48.join)(workspaceDir, ".slop-audit-cache.json");
+  const newCache = (0, import_node_path48.join)(workspaceDir, ".slopbrick-cache.json");
+  if ((0, import_node_fs35.existsSync)(oldCache)) {
     moves.push({ from: oldCache, to: newCache, kind: "file" });
   }
   for (const ext of ["mjs", "cjs", "js"]) {
-    const oldCfg = (0, import_node_path45.join)(workspaceDir, `slop-audit.config.${ext}`);
-    const newCfg = (0, import_node_path45.join)(workspaceDir, `slopbrick.config.${ext}`);
-    if ((0, import_node_fs33.existsSync)(oldCfg)) {
+    const oldCfg = (0, import_node_path48.join)(workspaceDir, `slop-audit.config.${ext}`);
+    const newCfg = (0, import_node_path48.join)(workspaceDir, `slopbrick.config.${ext}`);
+    if ((0, import_node_fs35.existsSync)(oldCfg)) {
       moves.push({ from: oldCfg, to: newCfg, kind: "config" });
     }
   }
-  const gi = (0, import_node_path45.join)(workspaceDir, ".gitignore");
-  if ((0, import_node_fs33.existsSync)(gi)) {
-    const content = (0, import_node_fs33.readFileSync)(gi, "utf-8");
+  const gi = (0, import_node_path48.join)(workspaceDir, ".gitignore");
+  if ((0, import_node_fs35.existsSync)(gi)) {
+    const content = (0, import_node_fs35.readFileSync)(gi, "utf-8");
     if (content.includes(".slop-audit/")) {
       gitignoreEdits.push({
         path: gi,
@@ -62553,28 +63354,28 @@ function planMigration(workspaceDir) {
   return { moves, rewrites, gitignoreEdits };
 }
 function isAlreadyMigrated(workspaceDir) {
-  return (0, import_node_fs33.existsSync)((0, import_node_path45.join)(workspaceDir, ".slopbrick")) && !(0, import_node_fs33.existsSync)((0, import_node_path45.join)(workspaceDir, ".slop-audit"));
+  return (0, import_node_fs35.existsSync)((0, import_node_path48.join)(workspaceDir, ".slopbrick")) && !(0, import_node_fs35.existsSync)((0, import_node_path48.join)(workspaceDir, ".slop-audit"));
 }
 function applyMigration(plan, options = {}) {
   if (options.dryRun) return;
   for (const m of plan.moves) {
-    (0, import_node_fs33.renameSync)(m.from, m.to);
+    (0, import_node_fs35.renameSync)(m.from, m.to);
   }
   for (const r of plan.rewrites) {
-    if (!(0, import_node_fs33.existsSync)(r.path)) continue;
-    const content = (0, import_node_fs33.readFileSync)(r.path, "utf-8");
+    if (!(0, import_node_fs35.existsSync)(r.path)) continue;
+    const content = (0, import_node_fs35.readFileSync)(r.path, "utf-8");
     const next = content.replace(`"version": ${r.from}`, `"version": ${r.to}`);
-    (0, import_node_fs33.writeFileSync)(r.path, next);
+    (0, import_node_fs35.writeFileSync)(r.path, next);
   }
   for (const g of plan.gitignoreEdits) {
-    const content = (0, import_node_fs33.readFileSync)(g.path, "utf-8");
+    const content = (0, import_node_fs35.readFileSync)(g.path, "utf-8");
     const next = content.replaceAll(g.from, g.to);
-    (0, import_node_fs33.writeFileSync)(g.path, next);
+    (0, import_node_fs35.writeFileSync)(g.path, next);
   }
 }
 function runMigrate(options) {
   const { workspace, dryRun = false, force = false } = options;
-  if (!(0, import_node_fs33.existsSync)(workspace)) {
+  if (!(0, import_node_fs35.existsSync)(workspace)) {
     return {
       ok: false,
       alreadyMigrated: false,
@@ -62584,9 +63385,9 @@ function runMigrate(options) {
     };
   }
   const alreadyMigrated = isAlreadyMigrated(workspace);
-  const newDir = (0, import_node_path45.join)(workspace, ".slopbrick");
-  const oldDir = (0, import_node_path45.join)(workspace, ".slop-audit");
-  if ((0, import_node_fs33.existsSync)(newDir) && (0, import_node_fs33.existsSync)(oldDir) && !force) {
+  const newDir = (0, import_node_path48.join)(workspace, ".slopbrick");
+  const oldDir = (0, import_node_path48.join)(workspace, ".slop-audit");
+  if ((0, import_node_fs35.existsSync)(newDir) && (0, import_node_fs35.existsSync)(oldDir) && !force) {
     return {
       ok: false,
       alreadyMigrated: false,
@@ -62662,7 +63463,7 @@ function registerMigrate(program) {
     (cmdOptions, command) => {
       const globals = command.optsWithGlobals();
       const format = (cmdOptions.format ?? globals.format) === "json" ? "json" : "pretty";
-      const cwd = (0, import_node_path46.resolve)(cmdOptions.workspace ?? process.cwd());
+      const cwd = (0, import_node_path49.resolve)(cmdOptions.workspace ?? process.cwd());
       const result = runMigrate({
         workspace: cwd,
         dryRun: cmdOptions.dryRun,
@@ -62766,19 +63567,19 @@ function registerRules(program) {
 }
 
 // src/cli/commands/validate-config.ts
-var import_node_fs34 = require("fs");
-var import_node_path47 = require("path");
+var import_node_fs36 = require("fs");
+var import_node_path50 = require("path");
 init_logger();
 init_validation();
 function registerValidateConfig(program) {
   program.command("validate-config [path]").description("Statically validate a slopbrick.config.mjs without scanning").action(async (configPath) => {
-    const path = configPath ? (0, import_node_path47.resolve)(configPath) : (0, import_node_path47.resolve)(process.cwd(), "slopbrick.config.mjs");
-    if (!(0, import_node_fs34.existsSync)(path)) {
+    const path = configPath ? (0, import_node_path50.resolve)(configPath) : (0, import_node_path50.resolve)(process.cwd(), "slopbrick.config.mjs");
+    if (!(0, import_node_fs36.existsSync)(path)) {
       logger.error(`Error: config file not found: ${path}`);
       process.exit(2);
     }
     try {
-      const mod = (0, import_node_path47.extname)(path) === ".cjs" ? require(path) : await import(path);
+      const mod = (0, import_node_path50.extname)(path) === ".cjs" ? require(path) : await import(path);
       const userConfig = mod.default ?? mod;
       const result = validateConfig(userConfig);
       if (result.errors.length === 0) {
@@ -62998,8 +63799,8 @@ ${formatMarkdown(result.report)}`);
 }
 
 // src/cli/commands/calibrate.ts
-var import_node_fs37 = require("fs");
-var import_node_path51 = require("path");
+var import_node_fs39 = require("fs");
+var import_node_path54 = require("path");
 init_logger();
 
 // src/research/providers/openai.ts
@@ -63055,8 +63856,8 @@ function createProvider(config) {
 }
 
 // src/research/generator.ts
-var import_node_fs35 = require("fs");
-var import_node_path48 = require("path");
+var import_node_fs37 = require("fs");
+var import_node_path51 = require("path");
 
 // src/research/prompts.ts
 var DEFAULT_PROMPT_TEMPLATES = [
@@ -63119,14 +63920,14 @@ async function generateSamples(options) {
   }
   const samples = [];
   const ext = extForFramework(framework);
-  const dir = (0, import_node_path48.join)(outputDir, framework, componentType);
-  (0, import_node_fs35.mkdirSync)(dir, { recursive: true });
+  const dir = (0, import_node_path51.join)(outputDir, framework, componentType);
+  (0, import_node_fs37.mkdirSync)(dir, { recursive: true });
   for (let i = 1; i <= count; i += 1) {
     const raw = await provider.generateSample(renderPrompt(template), { temperature });
     const code = extractCodeFromMarkdown(raw);
     const fileName = `sample-${i}${ext}`;
-    const filePath = (0, import_node_path48.join)(dir, fileName);
-    (0, import_node_fs35.writeFileSync)(filePath, code, "utf8");
+    const filePath = (0, import_node_path51.join)(dir, fileName);
+    (0, import_node_fs37.writeFileSync)(filePath, code, "utf8");
     const sample = {
       filePath,
       framework,
@@ -63137,8 +63938,8 @@ async function generateSamples(options) {
     };
     samples.push(sample);
   }
-  const metadataPath = (0, import_node_path48.join)(dir, "metadata.json");
-  (0, import_node_fs35.writeFileSync)(metadataPath, JSON.stringify(samples, null, 2), "utf8");
+  const metadataPath = (0, import_node_path51.join)(dir, "metadata.json");
+  (0, import_node_fs37.writeFileSync)(metadataPath, JSON.stringify(samples, null, 2), "utf8");
   return samples;
 }
 
@@ -63344,46 +64145,46 @@ function slugify(value) {
 
 // src/research/calibrator.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs36 = require("fs");
-var import_node_path50 = require("path");
+var import_node_fs38 = require("fs");
+var import_node_path53 = require("path");
 
 // src/corpus-paths.ts
-var import_node_path49 = require("path");
+var import_node_path52 = require("path");
 var CORPUS_ROOT = process.env["SLOPBRICK_CORPUS_DIR"] ?? "/Users/cheng/corpus-expansion";
-var POSITIVE_DIR = (0, import_node_path49.join)(CORPUS_ROOT, "positive");
-var NEGATIVE_DIR = (0, import_node_path49.join)(CORPUS_ROOT, "negative");
-var FILELISTS_DIR = (0, import_node_path49.join)(CORPUS_ROOT, "filelists");
+var POSITIVE_DIR = (0, import_node_path52.join)(CORPUS_ROOT, "positive");
+var NEGATIVE_DIR = (0, import_node_path52.join)(CORPUS_ROOT, "negative");
+var FILELISTS_DIR = (0, import_node_path52.join)(CORPUS_ROOT, "filelists");
 
 // src/research/calibrator.ts
 var DEFAULT_POSITIVE = POSITIVE_DIR;
 var DEFAULT_NEGATIVE = NEGATIVE_DIR;
 function buildFileList(dir, extensions) {
-  const tmpList = (0, import_node_path50.join)("/tmp", `cal-build-${Date.now()}-${Math.random().toString(36).slice(2)}.txt`);
+  const tmpList = (0, import_node_path53.join)("/tmp", `cal-build-${Date.now()}-${Math.random().toString(36).slice(2)}.txt`);
   const expr = extensions.map((e) => `-name '*.${e}'`).join(" -o ");
   (0, import_node_child_process2.execFileSync)("bash", ["-c", `find ${dir} -maxdepth 8 -type f \\( ${expr} \\) -print0 | xargs -0 realpath > ${tmpList}`]);
-  const out = (0, import_node_fs36.readFileSync)(tmpList, "utf8");
+  const out = (0, import_node_fs38.readFileSync)(tmpList, "utf8");
   (0, import_node_child_process2.execFileSync)("rm", ["-f", tmpList]);
   return out.trim().split("\n").filter(Boolean);
 }
 function runScan2(fileListPath) {
-  const files = (0, import_node_fs36.readFileSync)(fileListPath, "utf8").trim().split("\n").filter(Boolean);
+  const files = (0, import_node_fs38.readFileSync)(fileListPath, "utf8").trim().split("\n").filter(Boolean);
   const CHUNK = 600;
   const ruleFires = /* @__PURE__ */ new Map();
   const uniqueFilesPerRule = /* @__PURE__ */ new Map();
   let fileCount = 0;
-  const tmpOut = (0, import_node_path50.join)("/tmp", `calibrate-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+  const tmpOut = (0, import_node_path53.join)("/tmp", `calibrate-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
   for (let i = 0; i < files.length; i += CHUNK) {
     const chunk = files.slice(i, i + CHUNK);
     try {
       (0, import_node_child_process2.execFileSync)(
         "node",
-        [(0, import_node_path50.join)(process.cwd(), "bin", "slopbrick.js"), "scan", ...chunk, "--json", tmpOut, "--no-telemetry", "--quiet"],
+        [(0, import_node_path53.join)(process.cwd(), "bin", "slopbrick.js"), "scan", ...chunk, "--json", tmpOut, "--no-telemetry", "--quiet"],
         { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
       );
     } catch {
     }
-    if (!(0, import_node_fs36.existsSync)(tmpOut)) continue;
-    const report = JSON.parse((0, import_node_fs36.readFileSync)(tmpOut, "utf8"));
+    if (!(0, import_node_fs38.existsSync)(tmpOut)) continue;
+    const report = JSON.parse((0, import_node_fs38.readFileSync)(tmpOut, "utf8"));
     fileCount += report.fileCount;
     for (const issue of report.issues) {
       ruleFires.set(issue.ruleId, (ruleFires.get(issue.ruleId) ?? 0) + 1);
@@ -63411,16 +64212,16 @@ function classify(posFiles, negFiles) {
 async function calibrate(cwd, options = {}) {
   const positiveDir = options.positiveDir ?? DEFAULT_POSITIVE;
   const negativeDir = options.negativeDir ?? DEFAULT_NEGATIVE;
-  if (!(0, import_node_fs36.existsSync)(positiveDir)) throw new Error(`Positive corpus not found: ${positiveDir}`);
-  if (!(0, import_node_fs36.existsSync)(negativeDir)) throw new Error(`Negative corpus not found: ${negativeDir}`);
+  if (!(0, import_node_fs38.existsSync)(positiveDir)) throw new Error(`Positive corpus not found: ${positiveDir}`);
+  if (!(0, import_node_fs38.existsSync)(negativeDir)) throw new Error(`Negative corpus not found: ${negativeDir}`);
   const positiveFiles = buildFileList(positiveDir, ["tsx", "ts", "jsx", "js"]);
   const negativeFiles = buildFileList(negativeDir, ["tsx", "ts"]);
   const posSample = options.positiveLimit ? positiveFiles.slice(0, options.positiveLimit) : positiveFiles;
   const negSample = options.negativeLimit ? negativeFiles.slice(0, options.negativeLimit) : negativeFiles;
-  const posListPath = (0, import_node_path50.join)("/tmp", `cal-pos-${Date.now()}.txt`);
-  const negListPath = (0, import_node_path50.join)("/tmp", `cal-neg-${Date.now()}.txt`);
-  (0, import_node_fs36.writeFileSync)(posListPath, posSample.join("\n"));
-  (0, import_node_fs36.writeFileSync)(negListPath, negSample.join("\n"));
+  const posListPath = (0, import_node_path53.join)("/tmp", `cal-pos-${Date.now()}.txt`);
+  const negListPath = (0, import_node_path53.join)("/tmp", `cal-neg-${Date.now()}.txt`);
+  (0, import_node_fs38.writeFileSync)(posListPath, posSample.join("\n"));
+  (0, import_node_fs38.writeFileSync)(negListPath, negSample.join("\n"));
   const builtins = await Promise.resolve().then(() => (init_builtins(), builtins_exports));
   const builtinRules2 = builtins.builtinRules ?? [];
   const metaById = /* @__PURE__ */ new Map();
@@ -63534,9 +64335,9 @@ function registerCalibrate(program) {
         positiveLimit: cmdOptions.positiveLimit,
         negativeLimit: cmdOptions.negativeLimit
       });
-      const outputPath = cmdOptions.output ? (0, import_node_path51.resolve)(cwd, cmdOptions.output) : (0, import_node_path51.resolve)(cwd, "corpus", "calibration-empirical.md");
-      (0, import_node_fs37.mkdirSync)((0, import_node_path51.dirname)(outputPath), { recursive: true });
-      (0, import_node_fs37.writeFileSync)(outputPath, reportToMarkdown(report), "utf8");
+      const outputPath = cmdOptions.output ? (0, import_node_path54.resolve)(cwd, cmdOptions.output) : (0, import_node_path54.resolve)(cwd, "corpus", "calibration-empirical.md");
+      (0, import_node_fs39.mkdirSync)((0, import_node_path54.dirname)(outputPath), { recursive: true });
+      (0, import_node_fs39.writeFileSync)(outputPath, reportToMarkdown(report), "utf8");
       logger.info(
         "Calibrated " + report.rules.length + " rules across " + report.positiveFileCount + " positive + " + report.negativeFileCount + " negative files."
       );
@@ -63673,13 +64474,13 @@ function registerTrend(program) {
 }
 
 // src/cli/commands/drift.ts
-var import_node_path53 = require("path");
+var import_node_path56 = require("path");
 init_logger();
 init_scan2();
 
 // src/cli/drift.ts
-var import_node_fs38 = require("fs");
-var import_node_path52 = require("path");
+var import_node_fs40 = require("fs");
+var import_node_path55 = require("path");
 init_discover();
 init_patterns();
 init_telemetry();
@@ -63693,7 +64494,7 @@ async function runDrift(cwd, config, options = {}) {
   for (const absPath of limited) {
     let source;
     try {
-      source = (0, import_node_fs38.readFileSync)(absPath, "utf-8");
+      source = (0, import_node_fs40.readFileSync)(absPath, "utf-8");
     } catch {
       continue;
     }
@@ -63704,7 +64505,7 @@ async function runDrift(cwd, config, options = {}) {
       byCategory[v.category] = (byCategory[v.category] ?? 0) + 1;
       byFile.push({
         file: absPath,
-        relPath: (0, import_node_path52.relative)(cwd, absPath),
+        relPath: (0, import_node_path55.relative)(cwd, absPath),
         category: v.category,
         import: v.import,
         declared: v.declared,
@@ -63980,7 +64781,7 @@ function registerDrift(program) {
       const options = command.optsWithGlobals();
       const rawFormat = options.format ?? cmdOptions.format ?? "pretty";
       const format = rawFormat === "json" || rawFormat === "pretty" ? rawFormat : "pretty";
-      const cwd = (0, import_node_path53.resolve)(options.workspace ?? process.cwd());
+      const cwd = (0, import_node_path56.resolve)(options.workspace ?? process.cwd());
       if (cmdOptions.temporalSince !== void 0) {
         const temporalSince = cmdOptions.temporalSince.trim();
         if (temporalSince.length === 0) {
@@ -64006,13 +64807,13 @@ function registerDrift(program) {
 }
 
 // src/cli/commands/pr.ts
-var import_node_path55 = require("path");
+var import_node_path58 = require("path");
 init_logger();
 init_scan2();
 
 // src/cli/pr.ts
-var import_node_fs39 = require("fs");
-var import_node_path54 = require("path");
+var import_node_fs41 = require("fs");
+var import_node_path57 = require("path");
 var import_node_child_process3 = require("child_process");
 var import_node_util2 = require("util");
 var import_minimatch3 = require("minimatch");
@@ -64058,10 +64859,10 @@ async function discoverPrFiles(cwd, config, base, head, maxFiles) {
   if (gitFiles.length === 0) return [];
   const sourceFiles = [];
   for (const relOrAbs of gitFiles) {
-    const abs = (0, import_node_path54.resolve)(cwd, relOrAbs);
-    const ext = (0, import_node_path54.extname)(abs).toLowerCase();
+    const abs = (0, import_node_path57.resolve)(cwd, relOrAbs);
+    const ext = (0, import_node_path57.extname)(abs).toLowerCase();
     if (!PR_EXTENSIONS.has(ext)) continue;
-    const rel = (0, import_node_path54.relative)(cwd, abs).split("\\").join("/");
+    const rel = (0, import_node_path57.relative)(cwd, abs).split("\\").join("/");
     if (config.include.length > 0 && !config.include.some((pattern) => (0, import_minimatch3.minimatch)(rel, pattern))) {
       continue;
     }
@@ -64089,7 +64890,7 @@ async function runPrScan(cwd, config, options = {}) {
   for (const absPath of candidates) {
     let source;
     try {
-      source = (0, import_node_fs39.readFileSync)(absPath, "utf-8");
+      source = (0, import_node_fs41.readFileSync)(absPath, "utf-8");
     } catch {
       continue;
     }
@@ -64132,7 +64933,7 @@ async function runPrScan(cwd, config, options = {}) {
     totalScore += fileScore;
     files.push({
       file: absPath,
-      relPath: (0, import_node_path54.relative)(cwd, absPath).split("\\").join("/"),
+      relPath: (0, import_node_path57.relative)(cwd, absPath).split("\\").join("/"),
       score: fileScore,
       issueCount: issues.length,
       constitutionViolationCount: constitutionViolations.length,
@@ -64264,20 +65065,135 @@ function formatPrMarkdown(result) {
 function prExitCode(result) {
   return result.totalScore > result.threshold ? 1 : 0;
 }
+function parseUnifiedDiffPaths(diff) {
+  const paths = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const line of diff.split(/\r?\n/)) {
+    const m = /^\+\+\+\s+(?:b\/)?(\S.*)$/.exec(line);
+    if (!m) continue;
+    const path = m[1];
+    if (path === "/dev/null" || path === "dev/null") continue;
+    if (seen.has(path)) continue;
+    seen.add(path);
+    paths.push(path);
+  }
+  return paths;
+}
+async function runPrScanFromDiffFile(cwd, config, diffPath, options = {}) {
+  const threshold = options.threshold ?? config.prScoreThreshold ?? 20;
+  const maxFiles = options.maxFiles ?? 500;
+  const { existsSync: existsSync32, readFileSync: readFileSync42 } = await import("fs");
+  const { isAbsolute: isAbsolute4, resolve: resolvePath } = await import("path");
+  if (!existsSync32(diffPath)) {
+    throw new Error(`Diff file not found: ${diffPath}`);
+  }
+  const diffAbs = isAbsolute4(diffPath) ? diffPath : resolvePath(cwd, diffPath);
+  const diff = readFileSync42(diffAbs, "utf-8");
+  const changedPaths = parseUnifiedDiffPaths(diff);
+  if (changedPaths.length === 0) {
+    return emptyPrResult(threshold);
+  }
+  return scoreChangedPaths(cwd, config, changedPaths, maxFiles, threshold);
+}
+async function scoreChangedPaths(cwd, config, paths, maxFiles, threshold) {
+  const { existsSync: existsSync32, statSync: statSync8 } = await import("fs");
+  const { resolve: resolvePath } = await import("path");
+  const { readFile: readFile4 } = await import("fs/promises");
+  const { scanFile: scanFile2 } = await Promise.resolve().then(() => (init_worker(), worker_exports));
+  const limited = paths.slice(0, maxFiles);
+  const files = [];
+  let totalScore = 0;
+  const byCategory = {};
+  const bySeverity = { low: 0, medium: 0, high: 0 };
+  let constitutionViolations = 0;
+  for (const rel of limited) {
+    const abs = resolvePath(cwd, rel);
+    if (!existsSync32(abs) || !statSync8(abs).isFile()) continue;
+    let source;
+    try {
+      source = await readFile4(abs, "utf-8");
+    } catch {
+      continue;
+    }
+    let result;
+    try {
+      result = await scanFile2(abs, config, void 0, cwd);
+    } catch {
+      continue;
+    }
+    if (result.parseError) continue;
+    const issues = result.issues;
+    let slopPoints = 0;
+    const issueEntries = [];
+    for (const issue of issues) {
+      slopPoints += SEVERITY_WEIGHTS[issue.severity] ?? 0;
+      byCategory[issue.category] = (byCategory[issue.category] ?? 0) + 1;
+      bySeverity[issue.severity] = (bySeverity[issue.severity] ?? 0) + 1;
+      issueEntries.push({
+        ruleId: issue.ruleId,
+        severity: issue.severity,
+        line: issue.line,
+        category: issue.category,
+        message: issue.message
+      });
+    }
+    totalScore += slopPoints;
+    files.push({
+      file: abs,
+      relPath: rel,
+      score: slopPoints,
+      issueCount: issueEntries.length,
+      constitutionViolationCount: 0,
+      slopPoints,
+      issues: issueEntries,
+      constitutionViolations: []
+    });
+  }
+  return {
+    base: "diff",
+    head: "diff",
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    passed: totalScore <= threshold,
+    threshold,
+    totalScore,
+    filesChanged: files.length,
+    byCategory,
+    bySeverity,
+    files
+  };
+}
+function emptyPrResult(threshold) {
+  return {
+    base: "diff",
+    head: "diff",
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    passed: true,
+    threshold,
+    totalScore: 0,
+    filesChanged: 0,
+    byCategory: {},
+    bySeverity: { low: 0, medium: 0, high: 0 },
+    files: []
+  };
+}
 
 // src/cli/commands/pr.ts
 function registerPr(program) {
   program.command("pr").description(
     "Score the slop cost of the current PR. Compares --base (default: main) to --head (default: HEAD), scans only changed source files, returns a single weighted score. Exits 1 when score > --threshold (default 20)."
-  ).option("--base <ref>", "base git ref to diff from", "main").option("--head <ref>", "head git ref to diff to", "HEAD").option("--format <text|json|markdown>", "output format", "text").option("--threshold <n>", "score threshold (overrides config.prScoreThreshold)", parseThreshold).option("--max-files <n>", "cap on files scanned", parseCount, 500).action(
+  ).option("--base <ref>", "base git ref to diff from", "main").option("--head <ref>", "head git ref to diff to", "HEAD").option("--format <text|json|markdown>", "output format", "text").option("--threshold <n>", "score threshold (overrides config.prScoreThreshold)", parseThreshold).option("--max-files <n>", "cap on files scanned", parseCount, 500).option("--diff <file>", "unified-diff file (overrides --base/--head; meant for CI/Action use)").action(
     async (cmdOptions, command) => {
       try {
         const options = command.optsWithGlobals();
-        const cwd = (0, import_node_path55.resolve)(options.workspace ?? process.cwd());
+        const cwd = (0, import_node_path58.resolve)(options.workspace ?? process.cwd());
         const rawFormat = options.format ?? cmdOptions.format ?? "text";
         const format = rawFormat === "json" || rawFormat === "markdown" || rawFormat === "text" ? rawFormat : "text";
         const { config } = await runScan({ ...options, workspace: cwd });
-        const result = await runPrScan(cwd, config, {
+        const result = cmdOptions.diff ? await runPrScanFromDiffFile(cwd, config, cmdOptions.diff, {
+          format,
+          threshold: cmdOptions.threshold,
+          maxFiles: cmdOptions.maxFiles
+        }) : await runPrScan(cwd, config, {
           base: cmdOptions.base,
           head: cmdOptions.head,
           format,
@@ -64295,7 +65211,7 @@ function registerPr(program) {
 }
 
 // src/cli/commands/security.ts
-var import_node_path56 = require("path");
+var import_node_path59 = require("path");
 init_logger();
 init_scan2();
 init_ai_security_risk();
@@ -64308,7 +65224,7 @@ function registerSecurity(program) {
         const options = command.optsWithGlobals();
         const rawFormat = options.format ?? cmdOptions.format ?? "pretty";
         const format = rawFormat === "json" || rawFormat === "pretty" ? rawFormat : "pretty";
-        const cwd = (0, import_node_path56.resolve)(options.workspace ?? process.cwd());
+        const cwd = (0, import_node_path59.resolve)(options.workspace ?? process.cwd());
         const { report } = await runScan({ ...options, workspace: cwd });
         const securityIssues = report.issues.filter((i) => i.category === "security");
         const { risk, findings } = computeAiSecurityRisk(securityIssues);
@@ -64354,12 +65270,12 @@ function registerSecurity(program) {
 }
 
 // src/cli/commands/test.ts
-var import_node_path58 = require("path");
+var import_node_path61 = require("path");
 init_logger();
 init_scan2();
 
 // src/cli/test.ts
-var import_node_path57 = require("path");
+var import_node_path60 = require("path");
 init_scan2();
 init_test_quality();
 init_logger();
@@ -64430,7 +65346,7 @@ function formatTestReport(result, opts = {}) {
     const sortedFiles = [...byFile.keys()].sort();
     for (const file of sortedFiles) {
       const issues = byFile.get(file) ?? [];
-      const rel = file.startsWith((0, import_node_path57.resolve)(process.cwd())) ? file : file;
+      const rel = file.startsWith((0, import_node_path60.resolve)(process.cwd())) ? file : file;
       lines.push("");
       lines.push(`  ${rel}`);
       for (const issue of issues.slice(0, 20)) {
@@ -64459,7 +65375,7 @@ function registerTest(program) {
         const options = command.optsWithGlobals();
         const rawFormat = options.format ?? cmdOptions.format ?? "pretty";
         const format = rawFormat === "json" || rawFormat === "pretty" ? rawFormat : "pretty";
-        const cwd = (0, import_node_path58.resolve)(options.workspace ?? process.cwd());
+        const cwd = (0, import_node_path61.resolve)(options.workspace ?? process.cwd());
         const { config } = await runScan({ ...options, workspace: cwd });
         const { result } = await runTestScan(cwd, config, { strict: options.strict });
         logger.info(formatTestReport(result, { json: format === "json" }));
@@ -64473,7 +65389,7 @@ function registerTest(program) {
 }
 
 // src/cli/commands/architecture.ts
-var import_node_path59 = require("path");
+var import_node_path62 = require("path");
 init_logger();
 init_scan2();
 init_architecture_score();
@@ -64486,7 +65402,7 @@ function registerArchitecture(program) {
         const options = command.optsWithGlobals();
         const rawFormat = options.format ?? cmdOptions.format ?? "pretty";
         const format = rawFormat === "json" || rawFormat === "pretty" ? rawFormat : "pretty";
-        const cwd = (0, import_node_path59.resolve)(options.workspace ?? process.cwd());
+        const cwd = (0, import_node_path62.resolve)(options.workspace ?? process.cwd());
         const { config } = await runScan({ ...options, workspace: cwd });
         const score = await buildArchitectureScore(cwd, config, cmdOptions.maxFiles);
         const out = format === "json" ? JSON.stringify(score, null, 2) : formatArchitectureScore(score);
@@ -64501,13 +65417,13 @@ function registerArchitecture(program) {
 }
 
 // src/cli/commands/business-logic.ts
-var import_node_path61 = require("path");
+var import_node_path64 = require("path");
 init_logger();
 init_scan2();
 
 // src/cli/business-logic.ts
-var import_node_fs40 = require("fs");
-var import_node_path60 = require("path");
+var import_node_fs42 = require("fs");
+var import_node_path63 = require("path");
 init_discover();
 init_business_logic();
 async function runBusinessLogicScan(cwd, config, options = {}) {
@@ -64519,7 +65435,7 @@ async function runBusinessLogicScan(cwd, config, options = {}) {
   for (const absPath of limited) {
     let source;
     try {
-      source = (0, import_node_fs40.readFileSync)(absPath, "utf-8");
+      source = (0, import_node_fs42.readFileSync)(absPath, "utf-8");
     } catch {
       continue;
     }
@@ -64528,7 +65444,7 @@ async function runBusinessLogicScan(cwd, config, options = {}) {
     for (const issue of fileIssues) {
       issues.push({
         ...issue,
-        filePath: (0, import_node_path60.relative)(cwd, absPath) || absPath
+        filePath: (0, import_node_path63.relative)(cwd, absPath) || absPath
       });
     }
   }
@@ -64631,7 +65547,7 @@ function registerBusinessLogic(program) {
         const options = command.optsWithGlobals();
         const rawFormat = options.format ?? cmdOptions.format ?? "text";
         const format = rawFormat === "json" || rawFormat === "markdown" || rawFormat === "text" ? rawFormat : "text";
-        const cwd = (0, import_node_path61.resolve)(options.workspace ?? process.cwd());
+        const cwd = (0, import_node_path64.resolve)(options.workspace ?? process.cwd());
         const { config } = await runScan({ ...options, workspace: cwd });
         const result = await runBusinessLogicScan(cwd, config, {
           maxFiles: cmdOptions.maxFiles
@@ -64647,7 +65563,7 @@ function registerBusinessLogic(program) {
 }
 
 // src/cli/commands/maintenance-cost.ts
-var import_node_path62 = require("path");
+var import_node_path65 = require("path");
 init_logger();
 init_scan2();
 
@@ -64773,7 +65689,7 @@ function registerMaintenanceCost(program) {
         const rawFormat = options.format ?? cmdOptions.format ?? "text";
         const format = rawFormat === "json" || rawFormat === "text" ? rawFormat : "text";
         const strict = options.strict ?? cmdOptions.strict ?? false;
-        const cwd = (0, import_node_path62.resolve)(options.workspace ?? process.cwd());
+        const cwd = (0, import_node_path65.resolve)(options.workspace ?? process.cwd());
         const { config } = await runScan({ ...options, workspace: cwd });
         const result = await runMaintenanceCostScan(cwd, config, {
           maxFiles: cmdOptions.maxFiles,
@@ -64790,7 +65706,7 @@ function registerMaintenanceCost(program) {
 }
 
 // src/cli/commands/docs.ts
-var import_node_path63 = require("path");
+var import_node_path66 = require("path");
 init_logger();
 init_scan2();
 
@@ -64917,7 +65833,7 @@ function registerDocs(program) {
         const rawFormat = options.format ?? cmdOptions.format ?? "text";
         const format = rawFormat === "json" || rawFormat === "markdown" || rawFormat === "text" ? rawFormat : "text";
         const strict = options.strict ?? cmdOptions.strict ?? false;
-        const cwd = (0, import_node_path63.resolve)(options.workspace ?? process.cwd());
+        const cwd = (0, import_node_path66.resolve)(options.workspace ?? process.cwd());
         const { config } = await runScan({ ...options, workspace: cwd });
         const result = await runDocsScan(cwd, config, {
           maxDocFiles: cmdOptions.maxFiles,
@@ -64939,7 +65855,7 @@ function registerDocs(program) {
 }
 
 // src/cli/commands/db.ts
-var import_node_path64 = require("path");
+var import_node_path67 = require("path");
 init_logger();
 init_scan2();
 
@@ -65060,7 +65976,7 @@ function registerDb(program) {
         const rawFormat = options.format ?? cmdOptions.format ?? "text";
         const format = rawFormat === "json" || rawFormat === "markdown" || rawFormat === "text" ? rawFormat : "text";
         const strict = options.strict ?? cmdOptions.strict ?? false;
-        const cwd = (0, import_node_path64.resolve)(options.workspace ?? process.cwd());
+        const cwd = (0, import_node_path67.resolve)(options.workspace ?? process.cwd());
         const { config } = await runScan({ ...options, workspace: cwd });
         const result = await runDbScan(cwd, config, {
           maxFiles: cmdOptions.maxFiles,
@@ -65082,13 +65998,13 @@ function registerDb(program) {
 }
 
 // src/cli/commands/patterns.ts
-var import_node_path66 = require("path");
+var import_node_path69 = require("path");
 init_logger();
 init_scan2();
 
 // src/engine/patterns.ts
-var import_node_fs41 = require("fs");
-var import_node_path65 = require("path");
+var import_node_fs43 = require("fs");
+var import_node_path68 = require("path");
 init_patterns();
 init_discover();
 var PATTERN_CATEGORIES = [
@@ -65123,7 +66039,7 @@ var TOAST_NAME_RE = /^(?:[A-Z][a-zA-Z0-9]+)?(Toast|Notification|Snackbar|Alert|B
 var CARD_NAME_RE = /^(?:[A-Z][a-zA-Z0-9]+)?(Card|Tile|Chip|Badge)$/;
 var API_PATH_RE2 = /(?:^|\/)(?:lib\/api|services|api-client|clients)\//;
 function baseName(filePath) {
-  return (0, import_node_path65.basename)(filePath).replace(/\.(tsx|ts|jsx|js|vue|svelte|astro)$/i, "");
+  return (0, import_node_path68.basename)(filePath).replace(/\.(tsx|ts|jsx|js|vue|svelte|astro)$/i, "");
 }
 function makeStats(patterns) {
   const seen = /* @__PURE__ */ new Set();
@@ -65182,7 +66098,7 @@ function detectApiFromFiles(files, cwd) {
   const out = [];
   for (const f of files) {
     if (API_PATH_RE2.test(f)) {
-      out.push((0, import_node_path65.relative)(cwd, f).split("\\").join("/"));
+      out.push((0, import_node_path68.relative)(cwd, f).split("\\").join("/"));
     }
   }
   return out;
@@ -65192,7 +66108,7 @@ function detectFormsFromFiles(files) {
   for (const f of files) {
     let source;
     try {
-      source = (0, import_node_fs41.readFileSync)(f, "utf-8");
+      source = (0, import_node_fs43.readFileSync)(f, "utf-8");
     } catch {
       continue;
     }
@@ -65413,7 +66329,7 @@ function registerPatterns(program) {
         const options = command.optsWithGlobals();
         const rawFormat = options.format ?? cmdOptions.format ?? "text";
         const format = rawFormat === "json" || rawFormat === "markdown" || rawFormat === "text" ? rawFormat : "text";
-        const cwd = (0, import_node_path66.resolve)(options.workspace ?? process.cwd());
+        const cwd = (0, import_node_path69.resolve)(options.workspace ?? process.cwd());
         const { config } = await runScan({ ...options, workspace: cwd });
         const result = await runPatternsScan(cwd, config, {
           maxFiles: cmdOptions.maxFiles,
@@ -65430,8 +66346,8 @@ function registerPatterns(program) {
 }
 
 // src/cli/commands/research.ts
-var import_node_fs42 = require("fs");
-var import_node_path67 = require("path");
+var import_node_fs44 = require("fs");
+var import_node_path70 = require("path");
 init_logger();
 init_config2();
 function registerResearch(program) {
@@ -65448,24 +66364,24 @@ function registerResearch(program) {
       framework: cmdOptions.framework,
       componentType: cmdOptions.componentType,
       provider,
-      outputDir: (0, import_node_path67.resolve)(cmdOptions.outputDir),
+      outputDir: (0, import_node_path70.resolve)(cmdOptions.outputDir),
       temperature: cmdOptions.temperature
     });
     logger.info(`Generated ${samples.length} samples in ${cmdOptions.outputDir}`);
   });
   research.command("analyze").description("analyze generated samples and report coverage").requiredOption("--input-dir <path>", "directory with generated samples containing metadata.json").option("--output <path>", "analysis output path", ".slopbrick/flywheel/analysis.json").option("--config <path>", "slopbrick config path").option("--framework <name>", "framework multiplier to apply", "react").action(async (cmdOptions) => {
     try {
-      const metadataPath = (0, import_node_path67.resolve)(cmdOptions.inputDir, "metadata.json");
-      if (!(0, import_node_fs42.existsSync)(metadataPath)) {
+      const metadataPath = (0, import_node_path70.resolve)(cmdOptions.inputDir, "metadata.json");
+      if (!(0, import_node_fs44.existsSync)(metadataPath)) {
         logger.error(`No metadata.json found in ${cmdOptions.inputDir}`);
         process.exit(2);
       }
-      const samples = JSON.parse((0, import_node_fs42.readFileSync)(metadataPath, "utf8"));
+      const samples = JSON.parse((0, import_node_fs44.readFileSync)(metadataPath, "utf8"));
       const config = cmdOptions.config ? await loadConfig(cmdOptions.config) : { ...DEFAULT_CONFIG, framework: cmdOptions.framework };
       const analysis = await analyzeSamples(samples, config);
-      const outputPath = (0, import_node_path67.resolve)(cmdOptions.output);
-      (0, import_node_fs42.mkdirSync)((0, import_node_path67.dirname)(outputPath), { recursive: true });
-      (0, import_node_fs42.writeFileSync)(outputPath, JSON.stringify(analysis, null, 2), "utf8");
+      const outputPath = (0, import_node_path70.resolve)(cmdOptions.output);
+      (0, import_node_fs44.mkdirSync)((0, import_node_path70.dirname)(outputPath), { recursive: true });
+      (0, import_node_fs44.writeFileSync)(outputPath, JSON.stringify(analysis, null, 2), "utf8");
       logger.info(`Analyzed ${analysis.summary.total} samples; coverage: ${analysis.summary.coverage}%`);
       logger.info(`Wrote analysis to ${outputPath}`);
     } catch (error) {
@@ -65475,12 +66391,12 @@ function registerResearch(program) {
   });
   research.command("candidates").description("extract patterns from generated samples and emit candidate rules").requiredOption("--input-dir <path>", "directory with generated samples containing metadata.json").option("--output <path>", "output path", ".slopbrick/flywheel/rule-candidates.json").option("--config <path>", "slopbrick config path").option("--framework <name>", "framework multiplier to apply", "react").option("--min-frequency <n>", "minimum cluster frequency", parseCount, 2).option("--include-covered", "include samples already covered by AI-specific rules").action(async (cmdOptions) => {
     try {
-      const metadataPath = (0, import_node_path67.resolve)(cmdOptions.inputDir, "metadata.json");
-      if (!(0, import_node_fs42.existsSync)(metadataPath)) {
+      const metadataPath = (0, import_node_path70.resolve)(cmdOptions.inputDir, "metadata.json");
+      if (!(0, import_node_fs44.existsSync)(metadataPath)) {
         logger.error(`No metadata.json found in ${cmdOptions.inputDir}`);
         process.exit(2);
       }
-      const samples = JSON.parse((0, import_node_fs42.readFileSync)(metadataPath, "utf8"));
+      const samples = JSON.parse((0, import_node_fs44.readFileSync)(metadataPath, "utf8"));
       const config = cmdOptions.config ? await loadConfig(cmdOptions.config) : { ...DEFAULT_CONFIG, framework: cmdOptions.framework };
       const analysis = await analyzeSamples(samples, config);
       const extraction = extractAndCluster(analysis.samples, {
@@ -65490,8 +66406,8 @@ function registerResearch(program) {
       const candidates = clustersToCandidates(extraction.clusters, {
         minFrequency: cmdOptions.minFrequency
       });
-      const outputPath = (0, import_node_path67.resolve)(cmdOptions.output);
-      (0, import_node_fs42.mkdirSync)((0, import_node_path67.dirname)(outputPath), { recursive: true });
+      const outputPath = (0, import_node_path70.resolve)(cmdOptions.output);
+      (0, import_node_fs44.mkdirSync)((0, import_node_path70.dirname)(outputPath), { recursive: true });
       const payload = {
         generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
         sampleCount: analysis.summary.total,
@@ -65499,7 +66415,7 @@ function registerResearch(program) {
         fingerprintCount: extraction.total,
         candidates
       };
-      (0, import_node_fs42.writeFileSync)(outputPath, JSON.stringify(payload, null, 2), "utf8");
+      (0, import_node_fs44.writeFileSync)(outputPath, JSON.stringify(payload, null, 2), "utf8");
       logger.info(`Extracted ${extraction.total} fingerprints across ${analysis.summary.total} samples`);
       logger.info(`Wrote ${candidates.length} candidate rule(s) to ${outputPath}`);
     } catch (error) {
@@ -65510,8 +66426,8 @@ function registerResearch(program) {
 }
 
 // src/cli/commands/init.ts
-var import_node_fs43 = require("fs");
-var import_node_path69 = require("path");
+var import_node_fs45 = require("fs");
+var import_node_path72 = require("path");
 init_logger();
 init_builtins();
 init_scan2();
@@ -65521,145 +66437,9 @@ init_git();
 init_cache();
 
 // src/snippet/targets.ts
-var import_node_path68 = require("path");
-
-// src/snippet/render.ts
-function aiSpecificRules(rules) {
-  return rules.filter((r) => r.aiSpecific).sort((a, b) => a.id.localeCompare(b.id));
-}
-function categorizeRules(rules) {
-  const byCategory = /* @__PURE__ */ new Map();
-  for (const r of rules) {
-    const list = byCategory.get(r.category) ?? [];
-    list.push(r);
-    byCategory.set(r.category, list);
-  }
-  for (const list of byCategory.values()) {
-    list.sort((a, b) => a.id.localeCompare(b.id));
-  }
-  return byCategory;
-}
-function baseContent(rules, toolLabel, intro) {
-  const lines = [];
-  lines.push("# " + toolLabel);
-  lines.push("");
-  lines.push(intro);
-  lines.push("");
-  const ai = aiSpecificRules(rules);
-  const byCategory = categorizeRules(ai);
-  lines.push("## Category-level directives");
-  lines.push("");
-  for (const [category, directive] of Object.entries(CATEGORY_DIRECTIVES)) {
-    lines.push("- **" + category + "**: " + directive);
-  }
-  lines.push("");
-  lines.push("## Per-rule directives");
-  lines.push("");
-  for (const [category, list] of byCategory) {
-    lines.push("### " + category);
-    lines.push("");
-    for (const rule of list) {
-      const hint = RULE_HINTS[rule.id] ?? "Avoid patterns that fire rule `" + rule.id + "`.";
-      lines.push("- `" + rule.id + "` (" + rule.severity + "): " + hint);
-    }
-    lines.push("");
-  }
-  return lines.join("\n");
-}
-
-// src/snippet/generators.ts
-function generateCursorSnippet(rules) {
-  const lines = [];
-  lines.push("# slopbrick cursor rules");
-  lines.push("");
-  lines.push("Generated by `slopbrick init --cursor`. These rules describe patterns that slopbrick");
-  lines.push("flags as AI-generated frontend slop. Avoid them when writing code in this project.");
-  lines.push("");
-  lines.push("## Category-level directives");
-  lines.push("");
-  for (const [category, directive] of Object.entries(CATEGORY_DIRECTIVES)) {
-    lines.push("- **" + category + "**: " + directive);
-  }
-  lines.push("");
-  lines.push("## Per-rule directives");
-  lines.push("");
-  const ai = aiSpecificRules(rules);
-  const byCategory = categorizeRules(ai);
-  for (const [category, list] of byCategory) {
-    lines.push("### " + category);
-    lines.push("");
-    for (const rule of list) {
-      const hint = RULE_HINTS[rule.id] ?? "Avoid patterns that fire rule `" + rule.id + "`.";
-      lines.push("- **`" + rule.id + "`** (" + rule.severity + "): " + hint);
-    }
-    lines.push("");
-  }
-  lines.push("## Verification");
-  lines.push("");
-  lines.push("After writing code, run `slopbrick scan` and check for issues in any of the categories above.");
-  lines.push("Use `slopbrick fix` for auto-fixable rules. Use `slopbrick mcp` from MCP-aware clients to query rules and scan files programmatically.");
-  lines.push("");
-  return lines.join("\n");
-}
-function generateAgentsMdSnippet(rules) {
-  return baseContent(
-    rules,
-    "AGENTS.md",
-    "Generated by `slopbrick init --agents-md`. Read these directives when writing or modifying code in this project. AGENTS.md is the de facto standard read by OpenAI Codex, opencode, Pi, Cline, Continue, Gemini, Claude Code (fallback), and others."
-  ) + "## How to verify\n\nAfter editing code, run `slopbrick scan`. Any issue with a category in this file is something to fix.\n";
-}
-function generateClaudeMdSnippet(rules) {
-  return baseContent(
-    rules,
-    "CLAUDE.md",
-    "Generated by `slopbrick init --claude-md`. Read this file at the start of every Claude Code session in this project. CLAUDE.md takes precedence over AGENTS.md for Claude Code."
-  ) + "## Verification\n\nRun `slopbrick scan` after edits. If MCP is configured (`slopbrick mcp`), use `slop_scan_file` proactively to check before reporting code as done.\n";
-}
-function generateAiderSnippet(rules) {
-  return baseContent(
-    rules,
-    "CONVENTIONS.md",
-    "Generated by `slopbrick init --aider`. Aider reads CONVENTIONS.md (not AGENTS.md) for project conventions."
-  );
-}
-function generateWindsurfSnippet(rules) {
-  return baseContent(
-    rules,
-    ".windsurfrules",
-    "Generated by `slopbrick init --windsurf`. Windsurf Cascade reads .windsurfrules at project root."
-  );
-}
-function generateClineRules(rules) {
-  return baseContent(
-    rules,
-    "AGENTS.md",
-    "Generated by `slopbrick init --cline`. Cline reads .clinerules/AGENTS.md from the project root."
-  );
-}
-function generateCursorrulesLegacySnippet(rules) {
-  return baseContent(
-    rules,
-    ".cursorrules",
-    "Generated by `slopbrick init --cursorrules`. This is the legacy Cursor rule format. Prefer `.cursor/rules/slopbrick.mdc` (use --cursor) for new projects."
-  );
-}
-function generateGeminiSnippet(rules) {
-  return baseContent(
-    rules,
-    "GEMINI.md",
-    "Generated by `slopbrick init --gemini`. Gemini CLI reads .gemini/GEMINI.md from project root."
-  );
-}
-function generateCopilotSnippet(rules) {
-  return baseContent(
-    rules,
-    "copilot-instructions.md",
-    "Generated by `slopbrick init --copilot`. GitHub Copilot reads .github/copilot-instructions.md from project root."
-  );
-}
-
-// src/snippet/targets.ts
-var SNIPPET_TARGETS = [
+var import_node_path71 = require("path");
+init_generators();
+var SNIPPET_TARGETS2 = [
   {
     flag: "cursor",
     cliName: "--cursor",
@@ -65752,7 +66532,7 @@ var SNIPPET_TARGETS = [
   }
 ];
 function resolveTargetPath(target) {
-  return target.isFolder ? (0, import_node_path68.join)(target.path, target.filename) : target.path;
+  return target.isFolder ? (0, import_node_path71.join)(target.path, target.filename) : target.path;
 }
 function renderMatrix() {
   const lines = [];
@@ -65760,7 +66540,7 @@ function renderMatrix() {
   lines.push("");
   lines.push("| Flag | File | Agent |");
   lines.push("|------|------|-------|");
-  for (const t of SNIPPET_TARGETS) {
+  for (const t of SNIPPET_TARGETS2) {
     lines.push("| `" + t.cliName + "` | `" + resolveTargetPath(t) + "` | " + t.agent + " |");
   }
   return lines.join("\n");
@@ -65774,13 +66554,13 @@ function registerInit(program) {
       logger.info(renderMatrix());
       process.exit(0);
     }
-    const cwd = (0, import_node_path69.resolve)(options.workspace ?? process.cwd());
-    const configPath = (0, import_node_path69.join)(cwd, "slopbrick.config.mjs");
+    const cwd = (0, import_node_path72.resolve)(options.workspace ?? process.cwd());
+    const configPath = (0, import_node_path72.join)(cwd, "slopbrick.config.mjs");
     const detected = detectStack(cwd);
     const fallbackConfig = { ...DEFAULT_CONFIG, ...detected };
     const proposed = serializeConfig(fallbackConfig);
-    if ((0, import_node_fs43.existsSync)(configPath) && !cmdOptions.yes) {
-      const current = (0, import_node_fs43.readFileSync)(configPath, "utf8");
+    if ((0, import_node_fs45.existsSync)(configPath) && !cmdOptions.yes) {
+      const current = (0, import_node_fs45.readFileSync)(configPath, "utf8");
       logger.error(`A config file already exists at ${configPath}.`);
       logger.error("To overwrite it with defaults, run `slopbrick init --yes`.");
       logger.error("");
@@ -65801,7 +66581,7 @@ function registerInit(program) {
       config = buildInitConfig(detected, answers);
       usedWizard = true;
     }
-    (0, import_node_fs43.writeFileSync)(configPath, serializeConfig(config));
+    (0, import_node_fs45.writeFileSync)(configPath, serializeConfig(config));
     appendGitignore(cwd);
     const refresh = await refreshRegistrySnapshot(cwd);
     if (!refresh.ok) {
@@ -65825,27 +66605,27 @@ function registerInit(program) {
       }
       logger.info(refresh.message);
     }
-    const targetsToWrite = SNIPPET_TARGETS.filter((t) => {
+    const targetsToWrite = SNIPPET_TARGETS2.filter((t) => {
       if (cmdOptions.all) return true;
       const opts = cmdOptions;
       return Boolean(opts[t.flag]);
     });
     for (const target of targetsToWrite) {
-      const snippetPath = (0, import_node_path69.join)(cwd, resolveTargetPath(target));
-      (0, import_node_fs43.mkdirSync)((0, import_node_path69.dirname)(snippetPath), { recursive: true });
+      const snippetPath = (0, import_node_path72.join)(cwd, resolveTargetPath(target));
+      (0, import_node_fs45.mkdirSync)((0, import_node_path72.dirname)(snippetPath), { recursive: true });
       const generated = target.generator(builtinRules);
-      if (!target.isFolder && (0, import_node_fs43.existsSync)(snippetPath)) {
-        const existing = (0, import_node_fs43.readFileSync)(snippetPath, "utf8");
+      if (!target.isFolder && (0, import_node_fs45.existsSync)(snippetPath)) {
+        const existing = (0, import_node_fs45.readFileSync)(snippetPath, "utf8");
         if (existing.includes("<!-- slopbrick:begin -->")) {
           const updated = existing.replace(
             /<!-- slopbrick:begin -->[\s\S]*?<!-- slopbrick:end -->/,
             "<!-- slopbrick:begin -->\n" + generated + "<!-- slopbrick:end -->"
           );
-          (0, import_node_fs43.writeFileSync)(snippetPath, updated, "utf8");
+          (0, import_node_fs45.writeFileSync)(snippetPath, updated, "utf8");
           if (!options.quiet) logger.info(`Updated ${snippetPath}`);
           continue;
         }
-        (0, import_node_fs43.writeFileSync)(
+        (0, import_node_fs45.writeFileSync)(
           snippetPath,
           existing + (existing.endsWith("\n") ? "\n" : "\n\n") + generated,
           "utf8"
@@ -65853,7 +66633,7 @@ function registerInit(program) {
         if (!options.quiet) logger.info(`Wrote ${snippetPath}`);
         continue;
       }
-      (0, import_node_fs43.writeFileSync)(snippetPath, generated, "utf8");
+      (0, import_node_fs45.writeFileSync)(snippetPath, generated, "utf8");
       if (!options.quiet) logger.info(`Wrote ${snippetPath}`);
     }
     if (options.baseline) {
@@ -65871,14 +66651,14 @@ function registerInit(program) {
 }
 
 // src/cli/commands/flywheel.ts
-var import_node_fs45 = require("fs");
-var import_node_path71 = require("path");
+var import_node_fs47 = require("fs");
+var import_node_path74 = require("path");
 init_logger();
 init_telemetry();
 
 // src/report/flywheel.ts
-var import_node_fs44 = require("fs");
-var import_node_path70 = require("path");
+var import_node_fs46 = require("fs");
+var import_node_path73 = require("path");
 function average(values) {
   if (values.length === 0) return 0;
   return values.reduce((a, b) => a + b, 0) / values.length;
@@ -65968,7 +66748,7 @@ function formatFlywheel(summary, options = {}) {
 function registerFlywheel(program) {
   program.command("flywheel").description("summarize aggregated scan telemetry").option("--format <pretty|json>", "output format", "pretty").option("--export <path>", "write summary as JSON to <path>").action(async (cmdOptions, command) => {
     const options = command.optsWithGlobals();
-    const cwd = (0, import_node_path71.resolve)(options.workspace ?? process.cwd());
+    const cwd = (0, import_node_path74.resolve)(options.workspace ?? process.cwd());
     const payloads = readTelemetry(cwd);
     if (payloads.length === 0) {
       logger.info("No flywheel telemetry found. Run a scan first.");
@@ -65976,9 +66756,9 @@ function registerFlywheel(program) {
     }
     const summary = summarizeTelemetry(payloads);
     if (cmdOptions.export) {
-      const exportPath = (0, import_node_path71.resolve)(cmdOptions.export);
-      (0, import_node_fs45.mkdirSync)((0, import_node_path71.dirname)(exportPath), { recursive: true });
-      (0, import_node_fs45.writeFileSync)(exportPath, JSON.stringify(summary, null, 2), "utf-8");
+      const exportPath = (0, import_node_path74.resolve)(cmdOptions.export);
+      (0, import_node_fs47.mkdirSync)((0, import_node_path74.dirname)(exportPath), { recursive: true });
+      (0, import_node_fs47.writeFileSync)(exportPath, JSON.stringify(summary, null, 2), "utf-8");
       logger.info(`Wrote flywheel summary to ${exportPath}`);
       process.exit(0);
     }
@@ -66005,8 +66785,8 @@ init_dist2();
 init_memory_io();
 
 // src/fix/focus-ring.ts
-var import_node_fs46 = require("fs");
-var import_node_fs47 = require("fs");
+var import_node_fs48 = require("fs");
+var import_node_fs49 = require("fs");
 var ANCHOR_START = "/* @slopbrick:v1.0.0:fix:focus-ring */";
 var CSS_BLOCK = `/* @slopbrick:v1.0.0:fix:focus-ring */
 :focus-visible {
@@ -66015,15 +66795,15 @@ var CSS_BLOCK = `/* @slopbrick:v1.0.0:fix:focus-ring */
 }
 /* @slopbrick:v1.0.0:fix:focus-ring-end */`;
 function applyFocusRingFix(targetFile) {
-  if (!(0, import_node_fs46.existsSync)(targetFile)) {
+  if (!(0, import_node_fs48.existsSync)(targetFile)) {
     return { applied: false, reason: "missing-global-css-target" };
   }
-  const content = (0, import_node_fs47.readFileSync)(targetFile, "utf-8");
+  const content = (0, import_node_fs49.readFileSync)(targetFile, "utf-8");
   if (content.includes(ANCHOR_START)) {
     return { applied: false, reason: "already-present" };
   }
   const separator = content.endsWith("\n") ? "" : "\n";
-  (0, import_node_fs47.writeFileSync)(targetFile, `${content}${separator}${CSS_BLOCK}
+  (0, import_node_fs49.writeFileSync)(targetFile, `${content}${separator}${CSS_BLOCK}
 `);
   return { applied: true };
 }
@@ -66032,21 +66812,21 @@ function applyFocusRingFix(targetFile) {
 init_layout_token();
 
 // src/fix/use-client.ts
-var import_node_fs48 = require("fs");
+var import_node_fs50 = require("fs");
 function applyUseClientFix(filePath) {
-  const content = (0, import_node_fs48.readFileSync)(filePath, "utf-8");
+  const content = (0, import_node_fs50.readFileSync)(filePath, "utf-8");
   const trimmed = content.trimStart();
   if (trimmed.startsWith("'use client'") || trimmed.startsWith('"use client"')) {
     return { applied: false, reason: "already-present" };
   }
-  (0, import_node_fs48.writeFileSync)(filePath, `"use client";
+  (0, import_node_fs50.writeFileSync)(filePath, `"use client";
 
 ${content}`);
   return { applied: true };
 }
 
 // src/fix/visual-codemod.ts
-var import_node_fs49 = require("fs");
+var import_node_fs51 = require("fs");
 
 // src/fix/visual-codemods/tailwind.ts
 var ARBITRARY_ESCAPE_RE = /\b(p|m|px|py|pt|pb|pl|pr|mx|my|mt|mb|ml|mr|gap|space-[xy]|w|h|min-w|max-w|min-h|max-h|text-\w+|leading-\w+|rounded|border)-?\[(-?\d+(?:\.\d+)?)(px|rem|em|%|vh|vw)?\]/g;
@@ -66255,7 +67035,7 @@ var ALL_CODEMODS = [
   { name: "aria-attr-typo", fn: applyAriaAttrTypoCodemod }
 ];
 function applyVisualCodemods(filePath) {
-  const original = (0, import_node_fs49.readFileSync)(filePath, "utf-8");
+  const original = (0, import_node_fs51.readFileSync)(filePath, "utf-8");
   let content = original;
   const reasons = [];
   const seen = /* @__PURE__ */ new Set();
@@ -66271,7 +67051,7 @@ function applyVisualCodemods(filePath) {
     }
   }
   if (content !== original) {
-    (0, import_node_fs49.writeFileSync)(filePath, content);
+    (0, import_node_fs51.writeFileSync)(filePath, content);
   }
   return {
     filePath,
@@ -66553,12 +67333,12 @@ var http = __toESM(require("http"), 1);
 var https = __toESM(require("https"), 1);
 var import_node_url2 = require("url");
 var sendBeacon = (url, payload, timeoutMs) => {
-  return new Promise((resolve42) => {
+  return new Promise((resolve43) => {
     let parsed;
     try {
       parsed = new import_node_url2.URL(url);
     } catch {
-      resolve42();
+      resolve43();
       return;
     }
     const isHttps = parsed.protocol === "https:";
@@ -66579,7 +67359,7 @@ var sendBeacon = (url, payload, timeoutMs) => {
     const settle = () => {
       if (settled) return;
       settled = true;
-      resolve42();
+      resolve43();
     };
     let req;
     try {
@@ -66659,7 +67439,7 @@ process.on("uncaughtException", (err) => {
 });
 async function runCli({ start }) {
   try {
-    const program = new import_commander3.Command().name("slopbrick").description("Repository Coherence Scanner \u2014 surface AI-induced pattern drift, secret leaks, and design-token violations").version(VERSION).option("--framework <name>", "framework multiplier to apply").option("--include <glob>", "include pattern (repeatable)", collectGlob, []).option("--exclude <glob>", "exclude pattern (repeatable)", collectGlob, []).option("--ai-only", "only report AI-specific issues").option("--human-only", "only report human-facing issues").option("--ignore-wcag22", "ignore WCAG 2.2 related issues").option("--format <pretty|json|sarif|html>", "output format", "pretty").option("--threads <n>", "number of worker threads", parseThreads).option("--since <ref>", "only scan files changed since git ref").option("--diff <ref>", "alias for --since <ref>; also adds PR Slop Score to the report").option("--workspace <path>", "workspace/project path", process.cwd()).option("--tighten", "tighten baseline allowances").option("--fix", "apply auto-fixes").option("--dry-run", "with --fix: print what would change without writing").option("--show-fixes-diff", "print unified diff of proposed auto-fixes").option("--doctor", "run diagnostics").option("--watch", "watch files and re-run").option("--suggest", "print remediation advice").option("--why-failing", "print the top 5 rules dragging the score down").option("--brief", "terse output (verdict + headline + threshold + delta only)").option("--heatmap", "print migration ROI heatmap").option("--quiet", "suppress non-error output").option("--verbose", "enable debug logging (file paths, timings, rule-fire counts)").option("--strict", "exit 2 if any high-severity issue remains").option("--no-increase", "exit 2 if slop index increased since last run").option("--baseline", "save a baseline after this scan").option("--trend [n]", "print a sparkline of the last n runs", parseTrend).option("--json [path]", "write JSON report to path or stdout").option("--html [path]", "write HTML report to path or stdout").option("--staged", "scan only changed files (staged and unstaged)").option("--changed", "scan working-tree changes (staged + unstaged + untracked)").option("--incremental", "skip unchanged files using the persisted hash cache").option("--cache-path <path>", "path to the incremental-scan cache (default: .slopbrick-cache.json)").option("--tokens <path>", "merge tokens.json layout values into the arbitrary-value allowlist").option("--cache", "cache parsed AST results locally").option("--no-color", "suppress ANSI color codes in output").option("--security-only", "run only the security/* rules").option("--full", "show the complete report (all issues, all categories)").option("--report-usage", "opt in to a one-shot usage ping to SLOPBRICK_TELEMETRY_ENDPOINT (no PII)");
+    const program = new import_commander3.Command().name("slopbrick").description("Repository Coherence Scanner \u2014 surface AI-induced pattern drift, secret leaks, and design-token violations").version(VERSION).option("--framework <name>", "framework multiplier to apply").option("--include <glob>", "include pattern (repeatable)", collectGlob, []).option("--exclude <glob>", "exclude pattern (repeatable)", collectGlob, []).option("--ai-only", "only report AI-specific issues").option("--human-only", "only report human-facing issues").option("--ignore-wcag22", "ignore WCAG 2.2 related issues").option("--format <pretty|json|sarif|html>", "output format", "pretty").option("--threads <n>", "number of worker threads", parseThreads).option("--since <ref>", "only scan files changed since git ref").option("--diff <ref>", "alias for --since <ref>; also adds PR Slop Score to the report").option("--workspace <path>", "workspace/project path", process.cwd()).option("--tighten", "tighten baseline allowances").option("--fix", "apply auto-fixes").option("--dry-run", "with --fix: print what would change without writing").option("--show-fixes-diff", "print unified diff of proposed auto-fixes").option("--doctor", "run diagnostics").option("--watch", "watch files and re-run").option("--suggest", "print remediation advice").option("--why-failing", "print the top 5 rules dragging the score down").option("--brief", "terse output (verdict + headline + threshold + delta only)").option("--heatmap", "print migration ROI heatmap").option("--quiet", "suppress non-error output").option("--verbose", "enable debug logging (file paths, timings, rule-fire counts)").option("--strict", "exit 2 if any high-severity issue remains").option("--no-increase", "exit 2 if slop index increased since last run").option("--refresh-snippets", "rewrite the managed slopbrick block in AGENTS.md and CLAUDE.md after a scan").option("--baseline", "save a baseline after this scan").option("--trend [n]", "print a sparkline of the last n runs", parseTrend).option("--json [path]", "write JSON report to path or stdout").option("--html [path]", "write HTML report to path or stdout").option("--staged", "scan only changed files (staged and unstaged)").option("--changed", "scan working-tree changes (staged + unstaged + untracked)").option("--incremental", "skip unchanged files using the persisted hash cache").option("--cache-path <path>", "path to the incremental-scan cache (default: .slopbrick-cache.json)").option("--tokens <path>", "merge tokens.json layout values into the arbitrary-value allowlist").option("--cache", "cache parsed AST results locally").option("--no-color", "suppress ANSI color codes in output").option("--security-only", "run only the security/* rules").option("--full", "show the complete report (all issues, all categories)").option("--report-usage", "opt in to a one-shot usage ping to SLOPBRICK_TELEMETRY_ENDPOINT (no PII)");
     program.helpInformation = () => formatGroupedHelp(program);
     setExitOverride(program);
     registerInit(program);
@@ -66668,6 +67448,7 @@ async function runCli({ start }) {
     registerBadge(program);
     registerSuggest(program);
     registerExplain(program);
+    registerComposite(program);
     registerCalibration(program);
     registerFlywheel(program);
     const scanAction = async (paths, _options, command) => {
@@ -66686,7 +67467,7 @@ async function runCli({ start }) {
         logger.error("--heatmap and --suggest can't be used together. Pick one: a heatmap of severity, or text advice.");
         process.exit(2);
       }
-      const cwd = (0, import_node_path72.resolve)(options.workspace ?? process.cwd());
+      const cwd = (0, import_node_path75.resolve)(options.workspace ?? process.cwd());
       if (options.trend !== void 0) {
         const runs = await readRuns(cwd, fsMemoryIO);
         if (runs.length === 0) {
@@ -66734,7 +67515,7 @@ async function runCli({ start }) {
         });
       }
       if (options.baseline) {
-        const cwd2 = (0, import_node_path72.resolve)(options.workspace ?? process.cwd());
+        const cwd2 = (0, import_node_path75.resolve)(options.workspace ?? process.cwd());
         const configHash = hashConfig(config);
         const gitHead = await getGitHead(cwd2) ?? "unknown";
         const cache = buildBaselineCache(report, configHash, gitHead, cwd2);