slopbrick 0.41.0 → 0.42.0

package/dist/index.js

@@ -19,7 +19,7 @@ var VERSION;
 var init_header = __esm({
   "src/types/_header.ts"() {
     "use strict";
-    VERSION = "0.41.0";
+    VERSION = "0.42.0";
   }
 });
 
@@ -46862,11 +46862,11 @@ var init_pool = __esm({
         for (let i = 0; i < this.threadCount; i++) {
           spawnWorker();
         }
-        return new Promise((resolve42) => {
+        return new Promise((resolve43) => {
           const check = setInterval(() => {
             if (resolved) {
               clearInterval(check);
-              resolve42(results);
+              resolve43(results);
             }
           }, 10);
         });
@@ -46883,23 +46883,16 @@ var init_registry = __esm({
     init_builtins();
     RuleRegistry = class {
       rules = /* @__PURE__ */ new Map();
-      register(ruleOrId, factory) {
-        if (typeof ruleOrId === "string") {
-          if (!factory) {
-            throw new Error("Factory is required when registering by id");
-          }
-          const rule = {
-            id: ruleOrId,
-            category: factory.category,
-            severity: factory.severity,
-            aiSpecific: factory.aiSpecific,
-            create: factory.create,
-            analyze: factory.analyze
-          };
-          this.rules.set(ruleOrId, rule);
-        } else {
-          this.rules.set(ruleOrId.id, ruleOrId);
-        }
+      /**
+       * Register a rule. The 2-arg overload `register(id, factory)` was
+       * deleted in v0.42.0 (architecture review F6): no callers used it,
+       * every `Rule` carries its own `id`, and the per-id registration
+       * was ergonomically redundant with the 1-arg form (`register(rule)`).
+       * External consumers that needed `register-by-id` semantics can
+       * construct a `Rule` directly and pass it in.
+       */
+      register(rule) {
+        this.rules.set(rule.id, rule);
       }
       loadBuiltins(onlyRuleId) {
         for (const rule of builtinRules) {
@@ -46928,6 +46921,15 @@ var init_registry = __esm({
       all() {
         return Array.from(this.rules.values());
       }
+      /** v0.42.0 (§3b.5): look up a registered rule by id.
+       *  Returns undefined if not registered. */
+      get(id) {
+        return this.rules.get(id);
+      }
+      /** v0.42.0 (§3b.5): check whether a rule id is registered. */
+      has(id) {
+        return this.rules.has(id);
+      }
       createContexts(config, filePath, cwd, hotspotIssues = []) {
         const context = {
           config,
@@ -50579,6 +50581,10 @@ var init_signal_strength2 = __esm({
 });
 
 // src/engine/worker.ts
+var worker_exports = {};
+__export(worker_exports, {
+  scanFile: () => scanFile
+});
 import { isMainThread, parentPort, workerData } from "worker_threads";
 import { extname as extname5 } from "path";
 import { join as join14, relative as relative5, sep as sep2 } from "path";
@@ -50659,6 +50665,36 @@ async function scanFile(filePath, config, registry, cwd = process.cwd()) {
     const issues = applyRuleOverrides(rawIssues, config.rules);
     const triggeredRuleIds = Array.from(new Set(issues.map((i) => i.ruleId)));
     const compScore = compositeScore(triggeredRuleIds, loadSignalStrength());
+    const fireSet = new Set(triggeredRuleIds);
+    const factsWithFireSet = Object.assign(facts, {
+      compositeFireSet: fireSet
+    });
+    for (const { rule } of rules) {
+      if (!rule.id.startsWith("composite/")) continue;
+      try {
+        const compositeIssues = rule.analyze(
+          rule.create({
+            config,
+            filePath,
+            cwd,
+            framework: config.framework,
+            uiLibraries: config.uiLibraries,
+            hasTailwind: config.hasTailwind,
+            supportsRsc: config.supportsRsc,
+            hotspotIssues: []
+          }),
+          factsWithFireSet
+        );
+        if (compositeIssues.length > 0) {
+          issues.push(...compositeIssues);
+          for (const ci of compositeIssues) fireSet.add(ci.ruleId);
+        }
+      } catch (err) {
+        if (process.env.SLOP_AUDIT_DEBUG === "1") {
+          console.error(`[worker] composite ${rule.id} threw: ${err.message}`);
+        }
+      }
+    }
     const gapValues = collectGapValues(facts);
     const styleSources = collectStyleSources(facts);
     const elementTags = facts.v2.jsx.elements.map((e) => e.tag);
@@ -54529,29 +54565,29 @@ function renderStructureMarkdown(inventory, constitution) {
   return lines.join("\n");
 }
 async function writeStructureMarkdown(workspaceDir, md) {
-  await new Promise((resolve42, reject) => {
+  await new Promise((resolve43, reject) => {
     try {
       const path = join18(workspaceDir, STRUCTURE_MD_FILE);
       mkdirSync6(dirname12(path), { recursive: true });
       writeFileSync6(path, md, "utf-8");
-      resolve42();
+      resolve43();
     } catch (err) {
       reject(err instanceof Error ? err : new Error(String(err)));
     }
   });
 }
 async function readStructureMarkdown(workspaceDir) {
-  return new Promise((resolve42) => {
+  return new Promise((resolve43) => {
     try {
       const path = join18(workspaceDir, STRUCTURE_MD_FILE);
       if (!existsSync16(path)) {
-        resolve42(null);
+        resolve43(null);
         return;
       }
       const content = readFileSync20(path, "utf-8");
-      resolve42(content);
+      resolve43(content);
     } catch {
-      resolve42(null);
+      resolve43(null);
     }
   });
 }
@@ -54599,9 +54635,391 @@ var init_structure_md = __esm({
   }
 });
 
+// src/snippet/data.ts
+var CATEGORY_DIRECTIVES, RULE_HINTS;
+var init_data = __esm({
+  "src/snippet/data.ts"() {
+    "use strict";
+    CATEGORY_DIRECTIVES = {
+      visual: 'Avoid the saturated "vibe purple" Tailwind palette (violet-400-700, indigo-400-700). Prefer emerald, sky, amber, rose for accents. Never use arbitrary color values like bg-[#7c3aed] when a token exists.',
+      logic: "Never use explicit `any`. Use `unknown` and narrow. Always add an AbortSignal to fetches. Handle errors with try/catch, never swallow with empty catch. Use `as const` instead of `as Type` casts.",
+      wcag: 'All form inputs must have an accessible label (visible <label>, aria-label, or aria-labelledby). Decorative images must have empty alt="". Buttons must be <button>, never <div onClick>. Touch targets must be \u2265 24\xD724 CSS px.',
+      security: 'Never store tokens in localStorage or sessionStorage \u2014 use httpOnly Secure SameSite cookies. Never put secrets in NEXT_PUBLIC_* / REACT_APP_* / VITE_* env vars. Validate e.origin in postMessage handlers. Never dangerouslySetInnerHTML with user input. Never use target="_blank" without rel="noopener".',
+      perf: "Always use AbortController with fetch. Use image width/height attributes to prevent CLS. Use <Suspense> around async client components. Don't load all images eagerly.",
+      typo: `Never leave TODO / placeholder / "change me" copy in shipped code. Use real i18n strings or the project's content map.`,
+      layout: "Don't stack badge-above-h1 hero patterns. Don't build 3-stat banner rows without explicit user request. Don't use emoji inside nav items (use SVG icons). Use the project's spacing scale (4px or 8px grid), never arbitrary values like p-[13px].",
+      component: "Don't build components > 200 lines. Extract shared subcomponents. Avoid circular prop drilling \u2014 use context.",
+      arch: "For Astro: server-render everything by default; only opt-in to client islands when you need interactivity. Don't put secrets in client-side code.",
+      test: "Use domain-specific fixture data, assert on value shapes not just truthiness, and consolidate repeated setup into helpers. Avoid `expect(x).toBeDefined()` placeholders and textbook fixtures like 'John Doe' or 'test@test.com'."
+    };
+    RULE_HINTS = {
+      // v0.38.0 hygiene: 37 v10-DORMANT rule hints were removed. Every
+      // remaining key matches a rule in src/rules/builtins.ts. No orphans.
+      // (v0.16.0 previously moved 35 out-of-scope orphan hints to
+      //   docs/research/backlog-rule-hints.md
+      // for future implementers to paste back when the corresponding rules ship.)
+      "security/hardcoded-secret": "Never inline API keys, JWT secrets, or database passwords in source. Load them from env vars and never commit a .env file. Assume any published secret is compromised and rotate it.",
+      "security/exposed-env-var": "NEVER prefix a secret with NEXT_PUBLIC_, VITE_, REACT_APP_, EXPO_PUBLIC_, GATSBY_, or PUBLIC_ \u2014 those vars are inlined into every browser build.",
+      "security/dangerous-cors": "Don't set Access-Control-Allow-Origin: * on production endpoints. Restrict to an explicit allowlist; never combine wildcard origin with credentials: true.",
+      "security/missing-auth-check": "Every server route handler must perform an authentication + authorization check at the top. Reachability of an endpoint by any user (authenticated or not) is a vulnerability, not a feature.",
+      "security/unsafe-html-render": "Sanitize any non-literal value passed to dangerouslySetInnerHTML with DOMPurify. Better: avoid the prop entirely and let React escape via children.",
+      "security/fail-open-auth": "Don't gate auth bypasses on NODE_ENV. Replace dev-env checks with an explicit AUTH_BYPASS flag that's never set in production.",
+      "security/sql-construction": 'Never build SQL with string concatenation or template-literal interpolation. Use parameterized queries: pg client.query("... WHERE id = $1", [id]) or your ORM query builder.',
+      "security/public-admin-route": "Routes under /admin, /internal, /debug, /staff, /manage, /private need an explicit role check on top of standard auth \u2014 auth alone is not enough for privileged paths.",
+      "visual/arbitrary-escape": "Never use bracket-notation values like text-[13px] or bg-[#7c3aed]. Use design tokens instead.",
+      "visual/spacing-scale-violation": "Use spacing scale tokens (p-2, gap-4, etc.) instead of arbitrary values like p-[13px] or gap-[1.75rem].",
+      "visual/radius-scale-violation": "Use radius scale tokens (rounded-md, rounded-lg, etc.) instead of arbitrary values like rounded-[7px].",
+      // v0.16.0 — in-scope orphans kept here (corresponding rule ships in v0.16.0).
+      "typo/placeholder-text": 'Never leave "TODO", "placeholder", "change me", "your text here" in shipped UI.',
+      "logic/key-prop-missing": "Always provide a stable `key` prop when rendering lists.",
+      "logic/boundary-violation": "Don't import data-layer / DB code into UI components. Server-side only.",
+      "wcag/missing-alt": 'Every <img> needs alt text. Decorative: alt="". Informative: describe the image.',
+      "security/localstorage-token": "Never store JWT / access token / refresh token in localStorage or sessionStorage. Issue as httpOnly cookie.",
+      "security/eval": "Never use eval() or new Function(). These are RCE vectors if the input is ever attacker-controlled.",
+      "security/target-blank-no-noopener": 'Always add rel="noopener" (or rel="noreferrer") to target="_blank" links.',
+      "component/giant-component": "Don't build components > 200 lines. Extract shared subcomponents.",
+      "component/multiple-components-per-file": "One component per file. Move subcomponents into their own files so the Context Window stays small and boundary tests are easy.",
+      "component/shadcn-prop-mismatch": "Select shadcn variants via the `variant` prop, not long `className` overrides. See the component registry for available variants.",
+      "context/import-path-mismatch": "Use only the canonical import paths declared in brick.config.json (e.g. @/components/ui/, @/lib/).",
+      "layout/gap-monopoly": "Mix gap-2 / gap-4 / gap-6 / gap-12 deliberately. Don't repeat the same gap value across the whole project.",
+      "layout/math-element-uniformity": "Human files have lopsided interactive counts (1 button + 12 inputs). AI tends to balance them. Build forms with many inputs and few buttons.",
+      "layout/math-grid-uniformity": "Vary grid-cols-N (grid-cols-2, grid-cols-3, grid-cols-4, grid-cols-6) across sections instead of repeating grid-cols-3.",
+      "layout/spacing-grid": "Use the configured spacing scale (4px or 8px grid). Avoid arbitrary values like p-[13px] that aren't on the scale.",
+      "logic/ghost-defensive": "Use optional chaining (?.) or early returns instead of deep && guards. If a defensive chain runs 3+ levels deep, refactor.",
+      "logic/heaps-deviation": "Inspect for LLM-style vocabulary patterns: this file's vocabulary grows faster (high Heaps \u03BB) or slower (low \u03BB) than typical source code. Verify authorship if unexpected. (v0.12.0 \u2014 Christ et al. EMNLP Findings 2025.)",
+      "logic/ks-distribution-shift": "Inspect the shifted features. KS detects both AI anomalies and production-rot anomalies (it is symmetric); combine with Heaps/Zipf for AI-specific signal. (v0.12.0 \u2014 arXiv:2510.15996, Oct 2025.)",
+      "logic/zipf-slope-anomaly": "Inspect for LLM-style frequency distribution: this file's identifier usage is more peaked or flatter than typical human code. (v0.12.0 \u2014 Christ et al. EMNLP Findings 2025.)",
+      "logic/math-any-density": "Replace `: any` with proper types. Start with the parameter/return types of the most-used functions.",
+      "logic/math-console-log-storm": "Replace debug logs with a proper debugger or logger.debug(). Remove all console.log before shipping.",
+      "logic/math-gini-class-usage": "Spread usage across more class tokens instead of repeating the same handful (p-4, p-8, rounded-lg, etc.).",
+      "logic/math-variable-name-entropy": "Use domain-specific identifier names (reservations, invoices, customers) instead of generic data/items/value.",
+      "logic/optimistic-no-rollback": "In optimistic updates, revert state in the catch block: `setX(prev => prev)`. Never leave stale UI on error.",
+      "logic/reactive-hook-soup": "Coordinate state via a single derived value (useMemo) or a state machine. Avoid chained useEffects that sync local state.",
+      "logic/zombie-state": "Remove unused useState or wire it into the component. Don't leave declared-but-never-read state bindings.",
+      "dead/unused-import": "Remove the import or use the symbol somewhere. Unused imports are the most common AI-iteration signature \u2014 the model added it for a feature, then rewrote the function without cleaning up.",
+      "dead/unused-local": "Remove the declaration or use the variable. AI-iteration signature: the model declared a binding for a feature, then rewrote the function without cleaning up.",
+      "dead/unused-parameter": "Remove the parameter (and update every call site) or use it in the function body. AI-iteration signature: the model added a parameter for a feature, then rewrote the function without removing parameters the new code does not need.",
+      "dead/dead-branch": "Replace the literal boolean with a real condition, or remove the dead branch. AI-iteration signature: a feature flag toggled to a constant, or a wrapper from a previous refactor that was never cleaned up.",
+      "dead/unreachable": "Remove this statement \u2014 code after a return/throw/break/continue is unreachable. AI-iteration signature: the model added an early return for a new error path, then forgot the rest of the function body was still sitting below it.",
+      "perf/cls-image": "Add width/height attributes or an aspect-ratio utility to prevent layout shift.",
+      "perf/css-bloat": "Extract to a CSS variable (`--surface-card`) or a component prop when a class string repeats 5+ times.",
+      "typo/math-button-label-uniformity": 'Mix button lengths deliberately \u2014 pair a short "Save" with a longer "Mark as complete" \u2014 instead of repeating the same template.',
+      "visual/inline-style-dominance": "Replace inline `style={{...}}` with className utilities (e.g. Tailwind `p-4 m-2 gap-3`) or a CSS module class.",
+      "visual/math-default-font": "Import a distinctive font (next/font/google, @font-face, or a CSS variable) instead of relying on the framework default.",
+      "visual/math-font-entropy": "Use a wider range of text sizes (text-xs, text-sm, text-lg, text-xl, text-2xl, text-3xl) for a more deliberate type scale.",
+      "visual/math-rounded-entropy": "Use a wider range of border-radius values (sm, md, 2xl, 3xl) instead of repeating the same lg/xl/full pattern.",
+      "visual/math-spacing-entropy": "Mix more spacing values from the design scale (e.g. 3, 5, 7, 10, 14, 20, 28) instead of repeating the same 4/8 pattern.",
+      "visual/naturalness-anomaly": "Use domain-specific identifier names so the identifier stream reflects the actual problem domain. Hindle 2012 \xA74.3: LLM-generated code reuses a narrow band of training-data identifiers, dropping distinct-token ratio below 30%.",
+      "visual/math-color-cluster": "Use at least 3 distinct hue families (e.g. blue + amber + green) instead of clustering every color in the violet/fuchsia band.",
+      "wcag/focus-appearance": "Add a focus-visible:ring-* class, or remove outline-none. Keyboard users need a visible focus indicator.",
+      "wcag/focus-obscured": "Ensure focused elements are not hidden behind fixed or sticky wrappers.",
+      "test/weak-assertion": "Assert on a specific value or shape: `expect(x).toEqual(expectedValue)`. Avoid `.toBeDefined()` / `.toBeTruthy()` placeholders and tautological `expect(x).toBe(x)`.",
+      "test/duplicate-setup": "Extract shared `beforeEach` / `setupServer` blocks into a single helper (e.g. `renderWithProviders`) so each describe block calls it instead of repeating setup.",
+      "test/fake-placeholder": "Use domain-specific fixture values (`alice@acme-corp.com`, `Order#48231`) or a factory like @faker-js/faker. Avoid textbook placeholders (`John Doe`, `test@test.com`, `id: 1`).",
+      "product/terminology-drift": "Keep the leading noun consistent across files: `PostList`, `PostDetail`, `PostCard` are one entity, not three. AI agents pick slightly different words each invocation; product copy drifts.",
+      "product/ux-pattern-fragmentation": "Keep the per-category count tight: modal \u22643, toast \u22642, button \u22644, input \u22643, card \u22643. Pick the canonical one and alias the rest. `slopbrick patterns` reports the per-category count.",
+      // v0.13.0 — AI-specific rules (peer-reviewed signals).
+      "ai/markdown-leakage": "Delete stray `\\`\\`\\`<lang>\\`\\`\\`` markers; they are Markdown fences, not valid syntax in standalone source files (Yotkova et al. SemEval-2026).",
+      "ai/comment-ratio": "AI tools either skip comments (reductive models) or over-comment (expansive models). Match the corpus mean \xB1 2\u03C3 (Rahman et al. 2024, Bisztray et al. 2025).",
+      "ai/whitespace-regularity": "Vary inter-token spacing (single spaces mostly, occasional alignment in tables). Uniform runs are an AI tell (Shi et al. DetectCodeGPT 2024).",
+      "ai/text-like-ratio": "Move natural-language explanations to README files or doc comments. Inline prose in source code is hard to maintain (Yotkova 2026).",
+      "ai/errors-near-eof": "Check whether the file was truncated by a token limit. Unbalanced delimiters near EOF suggest the model ran out of output budget (Yotkova 2026).",
+      "ai/any-density": "Replace `any` with `unknown`, `Record<string, unknown>`, or a domain type. The `: any` annotation propagates type-errors and defeats TS safety (Lee, Hassan, Hindle MSR 2026).",
+      "ai/renyi-profile": "The token distribution is mass-concentrated on a few high-frequency tokens. Verify authorship if unexpected (R\xE9nyi 1961, Moslonka 2025).",
+      "ai/segment-surprisal-cv": "The cross-entropy is suspiciously uniform across the file. Real codebases have varied registers (Binoculars, Hans 2024).",
+      "ai/compression-profile": "The file compresses unusually well and lines are highly repetitive \u2014 characteristic of AI-generated boilerplate (Cilibrasi 2005, Mahoney 1999).",
+      // v0.14.5b — 6 new AI tendency detection rules (DORMANT in v0.14.5b;
+      // reclassified post-v7 calibration in v0.14.5d)
+      "ai/tailwind-color-overuse": "If most utility classes are bg-violet-500, text-violet-600, ring-violet-400 \u2014 the project is on the AI-default palette. Audit and replace with the project's design tokens.",
+      "ai/default-react-stack": "Every new file is a Vite + React + Tailwind + Zustand + React Hook Form clone. Verify the project actually needs each piece before adding it.",
+      "ai/library-reinvention": "Re-implementing zustand, react-hook-form, or date-fns inline (custom event emitters, useState reducers, manual date math) is a sign of LLM completion-mode code. Use the libraries the project already depends on.",
+      "ai/state-default-overuse": "Wrapping every component in useState + useEffect for transient UI state is the React tutorial default. Real production code uses refs, uncontrolled inputs, or the project's state lib.",
+      "ai/fetch-default-overuse": "Calling fetch() inline in components instead of going through the project's data-fetching layer (react-query, swr, or your own client) bypasses the cache, error boundary, and abort handling.",
+      "ai/console-debug-storm": "5+ console.log calls in a single file is debug-by-print-statement, the LLM training-data default. Remove before commit; use the project's logger or a real debugger.",
+      // v0.17.0 — db/* rules (Postgres static analysis via pgsql-parser)
+      "db/sql-concat": 'Never build SQL with template-literal interpolation \u2014 `db.query(`SELECT \u2026 WHERE id = ${id}`)` is a SQL injection vector. Use parameterized queries (`db.query("\u2026 WHERE id = $1", [id])`) or your ORM query builder.',
+      // v0.17.0 — docs/* rules (markdown drift detection)
+      "docs/stale-package-reference": "Update the doc to reference an installed package, or add the package to package.json. Copy-pasted install commands from a previous project are the #1 doc-drift failure mode.",
+      "docs/stale-function-reference": "Rename the doc reference to match a current export, or add a wrapper export. Stale function callouts in tutorials cost readers 10+ minutes of debugging.",
+      "docs/broken-link": "Create the file or fix the link target. On a public docs site, broken links erode trust more than stale copy.",
+      // v0.18.9 — Rust-specific rules (tree-sitter-backed)
+      "rust/unused-pub-fn": "Remove the function or call it. Rust's compiler doesn't warn on `pub fn` references unless `#![warn(dead_code)]` is set at the crate root. AI agents leave these behind during iterative refactors.",
+      "rust/unwrap-in-production": "Replace `.unwrap()` / `.expect()` with `?` (early-return on Err), `.map_err(...)` for error conversion, or an explicit `match`. They panic in production; reserve them for `#[cfg(test)]` or `#[test]` scopes.",
+      "rust/todo-macro": "Implement the function body or remove the stub. `todo!()` / `unimplemented!()` both expand to `panic!()`, so a hit at runtime crashes the program. Move them into a `#[cfg(test)] mod tests` block to suppress.",
+      "rust/stringly-typed": 'Replace the `String` / `&str` parameter with the typed enum that already exists in the file. Stringly-typed APIs lose type information at the boundary \u2014 typos (`"Click"` vs `"click"`) only fail at runtime.',
+      // v0.19.0 — TypeScript-specific rules
+      "ts/enum-vs-as-const": "Replace `enum Foo { A, B }` with `const Foo = { A: 'A', B: 'B' } as const` (or `const Foo = ['A', 'B'] as const`). Modern TS style guides (Google, TS-eslint) prefer `as const` because enums have surprising runtime semantics.",
+      "ts/import-type-misuse": "Use `import type { X } from '...'` instead of `import { type X } from '...'`. The split form is more common in real codebases and makes the type-only intent unambiguous.",
+      "ts/never-vs-unknown": "The `never` return type means 'this function never returns'. Reserve it for functions that always throw, always loop, or always exit. For 'impossible' branches, use a concrete type (`void`, `Error`, `unknown`) and an exhaustive check.",
+      "ts/excessive-type-assertion": "More than 3 `as` assertions in one function is a strong signal that the type is wrong, not the code. Fix the type definition (or use a type guard) instead of bypassing the type system.",
+      // v0.19.0 — Go-specific rules
+      "go/struct-tag-inconsistency": 'Pick one tag style per struct. If most fields are `json:"foo"`, this field should be too. Real Go code maintains consistency within a struct (or within a package).',
+      "go/nil-slice-vs-empty": "Either declare as `var x = []int{}` or assign with `make([]int, 0)`. The nil/empty inconsistency is an AI signal \u2014 real code picks one form and sticks with it.",
+      // v0.19.0 — Duplication detector
+      "dup/identical-block": "Refactor to a shared helper. This is a Type-1 clone (byte-for-byte identical after normalization). Common in AI-generated code that copy-pastes from training data.",
+      // v0.23.0 — Type-2 near-duplicate detector (MinHash + LSH)
+      "dup/near-duplicate": "Refactor to a shared helper. Type-2 near-duplicate: same identifiers + structure, different whitespace/comments. AI-iterated code regenerates the same function with cosmetic edits. (v0.23.0 \u2014 MinHash + LSH, k=5, thr 0.7.)",
+      // v0.24.0 — Type-3 structural clone detector (two-stage MinHash)
+      "dup/structural-clone": "Refactor to a shared helper. Type-3 clone: same shape as another file after identifier canonicalization, with renames and/or added/removed statements. AI agents and copy-paste both produce this. Extract the shared part. (v0.24.0.)",
+      // v0.24.0 — Kotlin rules (DORMANT until v9 Kotlin corpus calibration)
+      // v0.29.0 — non-AI Kotlin rules (DORMANT until larger pos arm)
+      // v0.30.0 — non-AI Java rules (Option C applied to v9 Java corpus, 92k files)
+      "java/sql-string-concat": "Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{}). String concat into SQL is the canonical SQL-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT, ratio 0.59.)",
+      "java/thread-sleep-in-loop": "Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the polling anti-pattern \u2014 ties up Tomcat/Jetty/Netty threads. (v0.30.0 \u2014 DORMANT, era-confounded ratio 0.97.)",
+      // v0.35.0 — content-based detection (CoCoNUTS-inspired)
+      "java/suspicious-implementation": "Function name claims validate/encrypt/hash/sanitize but body is empty, returns null/true, or returns the input. This is a content mismatch \u2014 the function's claimed behavior doesn't match its actual behavior. OWASP A04:2021.",
+      // v0.35.1 — Raidar-inspired content-based detection
+      "java/lost-stack-trace": 'catch block throws a new exception without the original cause \u2014 stack trace is lost. Pass the original exception as the second arg to the new exception\'s constructor: `throw new XxxException("msg", e)`.',
+      // v0.24.0 — Swift rules (DORMANT until v9 Swift corpus calibration)
+      "swift/force-unwrap": "Replace with the safe form: `as?` + guard/if let, `try?`, or `guard let x = optional else { return }`. `!` crashes unconditionally in release. (v0.24.0 \u2014 DORMANT.)",
+      "swift/print-debug": "Replace with `Logger(subsystem:..., category:...).info(...)` (os.log). `print` writes to stdout with no level and no redaction. (v0.24.0 \u2014 DORMANT.)",
+      "swift/fatal-error-thrown": "Replace with `return` of a typed default (e.g. `nil`, `[]()`) or throw a typed `enum MyError: Error`. `fatalError` survives release builds. (v0.24.0 \u2014 DORMANT.)",
+      "swift/implicitly-unwrapped-optional": "Declare as `var name: Type?` and unwrap with `guard let`. IUOs exist for Obj-C bridging / IBOutlets but using them everywhere is an AI signal. (v0.24.0 \u2014 DORMANT.)",
+      "swift/strong-self-capture": "Capture with `[weak self]` (or `[unowned self]` if guaranteed non-nil): `[weak self] in self?.foo = bar`. Strong self capture creates a retain cycle. (v0.24.0 \u2014 DORMANT.)",
+      // v0.24.0 — C++ rules (DORMANT until v9 C++ corpus calibration)
+      "cpp/raw-new-delete": "Replace with `auto p = std::make_unique<T>(...)`. Smart pointers delete on scope exit, never leak on early return / exception, never double-free. (v0.24.0 \u2014 DORMANT.)",
+      "cpp/c-style-cast": "Use the named cast: `static_cast<int>(x)`, `reinterpret_cast<...>(p)`, `const_cast<...>(ref)`. C-style casts silently pick static / reinterpret / const \u2014 impossible to grep. (v0.24.0 \u2014 DORMANT.)",
+      "cpp/printf-debug": "Replace with `spdlog::info(...)`, `LOG(INFO) << ...` (glog), or `ABSL_LOG(INFO) << ...`. `printf` / `std::cout` have no levels, no redaction, no sink routing. (v0.24.0 \u2014 DORMANT.)",
+      "cpp/magic-numbers": "Replace with `constexpr int MAX = 1024;` (or `static constexpr`). Named constants live next to their value, can be searched, force the reader to mean what they say. (v0.24.0 \u2014 DORMANT.)"
+    };
+  }
+});
+
+// src/snippet/generators.ts
+function wrapWithMarkers(level, body) {
+  const head = level === 1 ? "<!-- slopbrick-managed-section -->\n" : "";
+  return `${head}${MARKER_BEGIN}
+${body}
+${MARKER_END}
+`;
+}
+function generateCursorSnippet(rules) {
+  const lines = [];
+  lines.push("# slopbrick cursor rules");
+  lines.push("");
+  lines.push("Generated by `slopbrick init --cursor`. These rules describe patterns that slopbrick");
+  lines.push("flags as AI-generated frontend slop. Avoid them when writing code in this project.");
+  lines.push("");
+  lines.push("## Category-level directives");
+  lines.push("");
+  for (const [category, directive] of Object.entries(CATEGORY_DIRECTIVES)) {
+    lines.push("- **" + category + "**: " + directive);
+  }
+  lines.push("");
+  lines.push("## Per-rule directives");
+  lines.push("");
+  const ai = aiSpecificRules(rules);
+  const byCategory = categorizeRules(ai);
+  for (const [category, list] of byCategory) {
+    lines.push("### " + category);
+    lines.push("");
+    for (const rule of list) {
+      const hint = RULE_HINTS[rule.id] ?? "Avoid patterns that fire rule `" + rule.id + "`.";
+      lines.push("- **`" + rule.id + "`** (" + rule.severity + "): " + hint);
+    }
+    lines.push("");
+  }
+  lines.push("## Verification");
+  lines.push("");
+  lines.push("After writing code, run `slopbrick scan` and check for issues in any of the categories above.");
+  lines.push("Use `slopbrick fix` for auto-fixable rules. Use `slopbrick mcp` from MCP-aware clients to query rules and scan files programmatically.");
+  lines.push("");
+  return lines.join("\n");
+}
+function generateAgentsMdSnippet(rules) {
+  return wrapWithMarkers(
+    1,
+    baseContent(
+      rules,
+      "AGENTS.md",
+      "Generated by `slopbrick init --agents-md`. Read these directives when writing or modifying code in this project. AGENTS.md is the de facto standard read by OpenAI Codex, opencode, Pi, Cline, Continue, Gemini, Claude Code (fallback), and others."
+    ) + "## How to verify\n\nAfter editing code, run `slopbrick scan`. Any issue with a category in this file is something to fix.\n"
+  );
+}
+function generateClaudeMdSnippet(rules) {
+  return wrapWithMarkers(
+    1,
+    baseContent(
+      rules,
+      "CLAUDE.md",
+      "Generated by `slopbrick init --claude-md`. Read this file at the start of every Claude Code session in this project. CLAUDE.md takes precedence over AGENTS.md for Claude Code."
+    ) + "## Verification\n\nRun `slopbrick scan` after edits. If MCP is configured (`slopbrick mcp`), use `slop_scan_file` proactively to check before reporting code as done.\n"
+  );
+}
+function generateAiderSnippet(rules) {
+  return baseContent(
+    rules,
+    "CONVENTIONS.md",
+    "Generated by `slopbrick init --aider`. Aider reads CONVENTIONS.md (not AGENTS.md) for project conventions."
+  );
+}
+function generateWindsurfSnippet(rules) {
+  return baseContent(
+    rules,
+    ".windsurfrules",
+    "Generated by `slopbrick init --windsurf`. Windsurf Cascade reads .windsurfrules at project root."
+  );
+}
+function generateClineRules(rules) {
+  return baseContent(
+    rules,
+    "AGENTS.md",
+    "Generated by `slopbrick init --cline`. Cline reads .clinerules/AGENTS.md from the project root."
+  );
+}
+function generateCursorrulesLegacySnippet(rules) {
+  return baseContent(
+    rules,
+    ".cursorrules",
+    "Generated by `slopbrick init --cursorrules`. This is the legacy Cursor rule format. Prefer `.cursor/rules/slopbrick.mdc` (use --cursor) for new projects."
+  );
+}
+function generateGeminiSnippet(rules) {
+  return baseContent(
+    rules,
+    "GEMINI.md",
+    "Generated by `slopbrick init --gemini`. Gemini CLI reads .gemini/GEMINI.md from project root."
+  );
+}
+function generateCopilotSnippet(rules) {
+  return baseContent(
+    rules,
+    "copilot-instructions.md",
+    "Generated by `slopbrick init --copilot`. GitHub Copilot reads .github/copilot-instructions.md from project root."
+  );
+}
+var MARKER_BEGIN, MARKER_END;
+var init_generators = __esm({
+  "src/snippet/generators.ts"() {
+    "use strict";
+    init_data();
+    init_render2();
+    MARKER_BEGIN = "<!-- slopbrick:begin:v3 -->";
+    MARKER_END = "<!-- slopbrick:end:v3 -->";
+  }
+});
+
+// src/snippet/render.ts
+function aiSpecificRules(rules) {
+  return rules.filter((r) => r.aiSpecific).sort((a, b) => a.id.localeCompare(b.id));
+}
+function categorizeRules(rules) {
+  const byCategory = /* @__PURE__ */ new Map();
+  for (const r of rules) {
+    const list = byCategory.get(r.category) ?? [];
+    list.push(r);
+    byCategory.set(r.category, list);
+  }
+  for (const list of byCategory.values()) {
+    list.sort((a, b) => a.id.localeCompare(b.id));
+  }
+  return byCategory;
+}
+function baseContent(rules, toolLabel, intro) {
+  const lines = [];
+  lines.push("# " + toolLabel);
+  lines.push("");
+  lines.push(intro);
+  lines.push("");
+  const ai = aiSpecificRules(rules);
+  const byCategory = categorizeRules(ai);
+  lines.push("## Category-level directives");
+  lines.push("");
+  for (const [category, directive] of Object.entries(CATEGORY_DIRECTIVES)) {
+    lines.push("- **" + category + "**: " + directive);
+  }
+  lines.push("");
+  lines.push("## Per-rule directives");
+  lines.push("");
+  for (const [category, list] of byCategory) {
+    lines.push("### " + category);
+    lines.push("");
+    for (const rule of list) {
+      const hint = RULE_HINTS[rule.id] ?? "Avoid patterns that fire rule `" + rule.id + "`.";
+      lines.push("- `" + rule.id + "` (" + rule.severity + "): " + hint);
+    }
+    lines.push("");
+  }
+  return lines.join("\n");
+}
+function safeRewrite(existing, freshBlockBody) {
+  const beginIdx = existing.indexOf(MARKER_BEGIN);
+  const endIdx = existing.indexOf(MARKER_END);
+  if (beginIdx === -1 && endIdx === -1) {
+    return { content: existing, rewritten: false, failClosed: true, mismatched: false };
+  }
+  if (beginIdx === -1 || endIdx === -1) {
+    return { content: existing, rewritten: false, failClosed: false, mismatched: true };
+  }
+  if (endIdx <= beginIdx) {
+    return { content: existing, rewritten: false, failClosed: false, mismatched: true };
+  }
+  const before = existing.slice(0, beginIdx + MARKER_BEGIN.length);
+  const after = existing.slice(endIdx);
+  const next = `${before}
+${freshBlockBody}
+${after}`;
+  return { content: next, rewritten: true, failClosed: false, mismatched: false };
+}
+var init_render2 = __esm({
+  "src/snippet/render.ts"() {
+    "use strict";
+    init_data();
+    init_generators();
+  }
+});
+
+// src/snippet/refresh.ts
+var refresh_exports = {};
+__export(refresh_exports, {
+  SNIPPET_TARGETS: () => SNIPPET_TARGETS,
+  refreshSnippets: () => refreshSnippets
+});
+import { existsSync as existsSync17, readFileSync as readFileSync21, writeFileSync as writeFileSync7 } from "fs";
+import { join as join19 } from "path";
+function refreshSnippets(cwd, rules, targets = [...SNIPPET_TARGETS]) {
+  const result = { rewritten: [], failClosed: [], mismatched: [], absent: [] };
+  for (const filename of targets) {
+    const path = join19(cwd, filename);
+    if (!existsSync17(path)) {
+      result.absent.push(filename);
+      continue;
+    }
+    const existing = readFileSync21(path, "utf-8");
+    const agentName = filename.replace(/\.md$/i, "").toLowerCase();
+    const generator = agentName === "claude" ? generateAgentsMdSnippet : generateAgentsMdSnippet;
+    const newBlock = generator([...rules]).trim();
+    const outcome = safeRewrite(existing, newBlock);
+    if (outcome.rewritten) {
+      const tmp = `${path}.tmp`;
+      writeFileSync7(tmp, outcome.content, "utf-8");
+      const fs = __require("fs");
+      fs.renameSync(tmp, path);
+      result.rewritten.push(filename);
+    } else if (outcome.failClosed) {
+      result.failClosed.push(filename);
+    } else if (outcome.mismatched) {
+      result.mismatched.push(filename);
+    }
+  }
+  return result;
+}
+var SNIPPET_TARGETS;
+var init_refresh = __esm({
+  "src/snippet/refresh.ts"() {
+    "use strict";
+    init_render2();
+    init_generators();
+    SNIPPET_TARGETS = [
+      "AGENTS.md",
+      "CLAUDE.md"
+    ];
+  }
+});
+
 // src/cli/report/persistRun.ts
-import { existsSync as existsSync17, writeFileSync as writeFileSync7, mkdirSync as mkdirSync7 } from "fs";
-import { join as join19, relative as relative10 } from "path";
+import { existsSync as existsSync18, writeFileSync as writeFileSync8, mkdirSync as mkdirSync7 } from "fs";
+import { join as join20, relative as relative10 } from "path";
 async function persistRun(input) {
   const {
     cwd,
@@ -54683,10 +55101,10 @@ async function persistRun(input) {
       report.research = state.research;
     }
     if (flywheelOutput.suggestions.length > 0) {
-      const suggestionsDir = join19(cwd, ".slopbrick", "flywheel");
-      if (!existsSync17(suggestionsDir)) mkdirSync7(suggestionsDir, { recursive: true });
-      writeFileSync7(
-        join19(suggestionsDir, "rule-suggestions.json"),
+      const suggestionsDir = join20(cwd, ".slopbrick", "flywheel");
+      if (!existsSync18(suggestionsDir)) mkdirSync7(suggestionsDir, { recursive: true });
+      writeFileSync8(
+        join20(suggestionsDir, "rule-suggestions.json"),
         JSON.stringify(flywheelOutput.suggestions, null, 2)
       );
     }
@@ -54731,6 +55149,21 @@ async function persistRun(input) {
     }
   }
   recordTelemetry(cwd, report, results, config, patternInventory);
+  if (input.autoRefreshSnippets) {
+    try {
+      const { refreshSnippets: refreshSnippets2 } = await Promise.resolve().then(() => (init_refresh(), refresh_exports));
+      const outcome = refreshSnippets2(cwd, registry.getRules());
+      if (outcome.rewritten.length > 0 && !options.quiet && !machineReadableStdout) {
+        logger.info(
+          `Snippet refresh: rewrote ${outcome.rewritten.length} file(s) (${outcome.rewritten.join(", ")}).`
+        );
+      }
+    } catch (err) {
+      if (options.quiet !== true && !machineReadableStdout) {
+        logger.warn(`snippet refresh failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
+    }
+  }
 }
 var init_persistRun = __esm({
   "src/cli/report/persistRun.ts"() {
@@ -54951,7 +55384,7 @@ var init_json = __esm({
 
 // src/report/sarif.ts
 import { createHash as createHash11 } from "crypto";
-import { readFileSync as readFileSync21 } from "fs";
+import { readFileSync as readFileSync22 } from "fs";
 import { basename as basename3, isAbsolute as isAbsolute3, relative as relative12, resolve as resolve9 } from "path";
 function buildArtifactUri(filePath, cwd) {
   if (!filePath) {
@@ -55058,7 +55491,7 @@ function buildResultFromIssue(issue, cwd, fileContentCache) {
     let content = fileContentCache.get(sourcePath);
     if (content === void 0) {
       try {
-        content = readFileSync21(sourcePath, "utf-8");
+        content = readFileSync22(sourcePath, "utf-8");
         fileContentCache.set(sourcePath, content);
       } catch {
         fileContentCache.set(sourcePath, "");
@@ -56284,7 +56717,7 @@ var init_advice = __esm({
 });
 
 // src/fix/layout-token.ts
-import { readFileSync as readFileSync22, writeFileSync as writeFileSync8 } from "fs";
+import { readFileSync as readFileSync23, writeFileSync as writeFileSync9 } from "fs";
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -56321,10 +56754,10 @@ function applyReplaceFixes(content, fixes) {
   return { content, applied, skipped, reasons };
 }
 function applyLayoutTokenFix(filePath, fixes) {
-  let content = readFileSync22(filePath, "utf-8");
+  let content = readFileSync23(filePath, "utf-8");
   const { content: patched, applied, skipped, reasons } = applyReplaceFixes(content, fixes);
   if (patched !== content) {
-    writeFileSync8(filePath, patched);
+    writeFileSync9(filePath, patched);
   }
   return { applied, skipped, reasons };
 }
@@ -56335,7 +56768,7 @@ var init_layout_token = __esm({
 });
 
 // src/report/unified-diff.ts
-import { existsSync as existsSync18, readFileSync as readFileSync23 } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync24 } from "fs";
 import { relative as relative13 } from "path";
 function collectAllFixes(issue) {
   return [...issue.fix ? [issue.fix] : [], ...issue.fixes ?? []];
@@ -56412,8 +56845,8 @@ function formatUnifiedDiff(report, cwd) {
   const parts = [];
   let hasHunk = false;
   for (const [filePath, fixes] of byFile) {
-    if (!existsSync18(filePath)) continue;
-    const original = readFileSync23(filePath, "utf-8");
+    if (!existsSync19(filePath)) continue;
+    const original = readFileSync24(filePath, "utf-8");
     const patched = applyFixesToString(original, fixes);
     if (patched === original) continue;
     if (!hasHunk) {
@@ -56519,7 +56952,7 @@ var init_heatmap = __esm({
 
 // src/cli/report/renderOutput.ts
 import { resolve as resolve10 } from "path";
-import { writeFileSync as writeFileSync9 } from "fs";
+import { writeFileSync as writeFileSync10 } from "fs";
 function renderOutput(report, options, cwd) {
   if (options.format && !VALID_FORMATS.has(options.format)) {
     process.stderr.write(
@@ -56553,7 +56986,7 @@ function renderOutput(report, options, cwd) {
   if (options.html) {
     const html = formatHtml(report);
     if (typeof options.html === "string") {
-      writeFileSync9(resolve10(options.html), html);
+      writeFileSync10(resolve10(options.html), html);
       if (!options.quiet) {
         logger.info(`Wrote HTML report to ${options.html}`);
       }
@@ -56565,7 +56998,7 @@ function renderOutput(report, options, cwd) {
   if (options.json) {
     const json = formatJson(report);
     if (typeof options.json === "string") {
-      writeFileSync9(resolve10(options.json), json);
+      writeFileSync10(resolve10(options.json), json);
       if (!options.quiet) {
         logger.info(`Wrote JSON report to ${options.json}`);
       }
@@ -56796,7 +57229,7 @@ var init_watch = __esm({
 });
 
 // src/cli/scan.ts
-import { existsSync as existsSync19, statSync as statSync7 } from "fs";
+import { existsSync as existsSync20, statSync as statSync7 } from "fs";
 import { resolve as resolve12, relative as relative15, extname as extname7, sep as sep3 } from "path";
 import { randomUUID } from "crypto";
 async function runScan(options, explicitPaths) {
@@ -56804,7 +57237,7 @@ async function runScan(options, explicitPaths) {
   const startTime = Date.now();
   const scanId = randomUUID();
   const cwd = resolve12(options.workspace ?? process.cwd());
-  if (!existsSync19(cwd)) {
+  if (!existsSync20(cwd)) {
     throw new Error(`Workspace not found: ${cwd}`);
   }
   const cwdStat = statSync7(cwd);
@@ -56849,7 +57282,7 @@ async function runScan(options, explicitPaths) {
     const resolved = explicitPaths.map((p) => resolve12(cwd, p));
     const expanded = [];
     for (const p of resolved) {
-      if (existsSync19(p) && statSync7(p).isDirectory()) {
+      if (existsSync20(p) && statSync7(p).isDirectory()) {
         const found = await globby4(`${p}/**/*`, { absolute: true, onlyFiles: true });
         for (const f of found) {
           if (!ALL_SOURCE_EXTENSIONS.has(extname7(f).toLowerCase())) continue;
@@ -57003,7 +57436,7 @@ async function runScan(options, explicitPaths) {
     const scannedPaths = new Set(results.map((result) => result.filePath));
     for (const [filePath, cached] of Object.entries(baseline.scores)) {
       if (scannedPaths.has(filePath)) continue;
-      if (!existsSync19(filePath)) continue;
+      if (!existsSync20(filePath)) continue;
       scores.push({
         filePath,
         rawScore: 0,
@@ -57042,7 +57475,12 @@ async function runScan(options, explicitPaths) {
   const { report, noIncreaseFailure } = await finalizeReport({
     cwd,
     config,
-    options,
+    options: {
+      ...options,
+      // v0.42.0 (§3a.4): forward the opt-in flag through to
+      // `persistRun`, which calls `refreshSnippets` post-scan.
+      autoRefreshSnippets: Boolean(options.autoRefreshSnippets) || Boolean(config.autoRefreshSnippets)
+    },
     results,
     aggregated,
     allIssues,
@@ -57110,13 +57548,57 @@ var init_scan2 = __esm({
   }
 });
 
+// src/rules/composite-seed.ts
+var composite_seed_exports = {};
+__export(composite_seed_exports, {
+  HAND_CURATED_SEED: () => HAND_CURATED_SEED,
+  maybeAppendSeed: () => maybeAppendSeed
+});
+function maybeAppendSeed(entries) {
+  if (entries.length === 0) {
+    return [...HAND_CURATED_SEED];
+  }
+  return entries;
+}
+var HAND_CURATED_SEED;
+var init_composite_seed = __esm({
+  "src/rules/composite-seed.ts"() {
+    "use strict";
+    HAND_CURATED_SEED = [
+      {
+        id: "composite/ai-fingerprint-cluster",
+        ruleIds: ["ai/compression-profile", "ai/comment-ratio", "ai/segment-surprisal-cv"],
+        minMatch: 2,
+        severity: "medium",
+        defaultOff: true,
+        description: "Composite rule: at least 2 of {ai/compression-profile+ai/comment-ratio+...} fire on the same file. Hand-curated seed from the v0.42.0 brief; superseded by `slopbrick composite discover` once empirical clusters dominate the ledger.",
+        calibration: {
+          recall: 0,
+          FP: 0,
+          precision: 0,
+          F1: 0,
+          nFiles: 0
+        },
+        provenance: {
+          seed: "hand-curated-by-brief",
+          discoveredAt: "2026-07-05T00:00:00.000Z",
+          nFiles: 0,
+          members: 3,
+          npmi: 0,
+          fisherP: 1
+        }
+      }
+    ];
+  }
+});
+
 // src/index.ts
 init_types();
 init_config2();
 init_dist2();
 
 // src/cli/program.ts
-import { resolve as resolve41 } from "path";
+import { resolve as resolve42 } from "path";
 import { Command } from "commander";
 
 // src/cli/options.ts
@@ -57164,13 +57646,13 @@ init_discover();
 init_git();
 init_cache();
 init_logger();
-import { writeFileSync as writeFileSync11, mkdirSync as mkdirSync9, rmSync as rmSync2 } from "fs";
-import { join as join21, dirname as dirname14 } from "path";
+import { writeFileSync as writeFileSync12, mkdirSync as mkdirSync9, rmSync as rmSync2 } from "fs";
+import { join as join23, dirname as dirname14 } from "path";
 import { createInterface } from "readline";
 
 // src/rules/registry-loader.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync8, readFileSync as readFileSync24, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname13, join as join20 } from "path";
+import { existsSync as existsSync21, mkdirSync as mkdirSync8, readFileSync as readFileSync25, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname13, join as join21 } from "path";
 
 // src/data/shadcn-registry.json
 var shadcn_registry_default = {
@@ -57304,11 +57786,11 @@ var shadcn_registry_default = {
 var REGISTRY_URL = "https://ui.shadcn.com/registry.json";
 var BUNDLED_REGISTRY_VERSION = shadcn_registry_default.version;
 function cachePath2(cwd) {
-  return join20(cwd, ".slopbrick", "cache", "registry-snapshot.json");
+  return join21(cwd, ".slopbrick", "cache", "registry-snapshot.json");
 }
 function ensureCacheDir(cwd) {
   const dir = dirname13(cachePath2(cwd));
-  if (!existsSync20(dir)) {
+  if (!existsSync21(dir)) {
     mkdirSync8(dir, { recursive: true });
   }
 }
@@ -57321,9 +57803,9 @@ function isValidSnapshot(value) {
 }
 function isRegistryFresh(cwd) {
   const cached = cachePath2(cwd);
-  if (!existsSync20(cached)) return false;
+  if (!existsSync21(cached)) return false;
   try {
-    const parsed = JSON.parse(readFileSync24(cached, "utf8"));
+    const parsed = JSON.parse(readFileSync25(cached, "utf8"));
     if (!isValidSnapshot(parsed)) return false;
     return parsed.version === BUNDLED_REGISTRY_VERSION;
   } catch {
@@ -57334,7 +57816,7 @@ async function refreshRegistrySnapshot(cwd, _url = REGISTRY_URL, _timeoutMs = 5e
   try {
     const cacheFile = cachePath2(cwd);
     ensureCacheDir(cwd);
-    writeFileSync10(cacheFile, JSON.stringify(shadcn_registry_default, null, 2), "utf-8");
+    writeFileSync11(cacheFile, JSON.stringify(shadcn_registry_default, null, 2), "utf-8");
   } catch {
   }
   return {
@@ -57346,7 +57828,7 @@ async function refreshRegistrySnapshot(cwd, _url = REGISTRY_URL, _timeoutMs = 5e
 }
 function copyBundledSnapshotToCache(cwd) {
   ensureCacheDir(cwd);
-  writeFileSync10(cachePath2(cwd), JSON.stringify(shadcn_registry_default, null, 2));
+  writeFileSync11(cachePath2(cwd), JSON.stringify(shadcn_registry_default, null, 2));
 }
 
 // src/cli/init.ts
@@ -57375,17 +57857,17 @@ var UI_LIBRARY_OPTIONS = ["shadcn/ui", "mui", "chakra", "radix", "tamagui", "nat
 var STRICTNESS_OPTIONS = ["strict", "balanced", "permissive"];
 var STRUCTURE_OPTIONS = ["feature-based", "layer-based", "flat", "monorepo", "other"];
 function promptText(rl, question, detected) {
-  return new Promise((resolve42) => {
+  return new Promise((resolve43) => {
     const lines = [
       `? ${question} (detected: ${detected || "none"}) \u2014 npm package name, or Enter to skip:`
     ];
     rl.question(lines.join("\n") + "\n", (answer) => {
       const trimmed = answer.trim();
       if (trimmed === "") {
-        resolve42(void 0);
+        resolve43(void 0);
         return;
       }
-      resolve42(trimmed);
+      resolve43(trimmed);
     });
   });
 }
@@ -57393,7 +57875,7 @@ function promptSingleSelect(rl, question, options, defaultValue) {
   const defaultIndex = options.indexOf(defaultValue);
   const safeDefaultIndex = defaultIndex >= 0 ? defaultIndex : 0;
   const safeDefaultValue = options[safeDefaultIndex];
-  return new Promise((resolve42) => {
+  return new Promise((resolve43) => {
     function ask() {
       const lines = [
         `? ${question} (detected: ${safeDefaultValue}):`,
@@ -57403,7 +57885,7 @@ function promptSingleSelect(rl, question, options, defaultValue) {
       rl.question(lines.join("\n") + "\n", (answer) => {
         const trimmed = answer.trim();
         if (trimmed === "") {
-          resolve42(safeDefaultValue);
+          resolve43(safeDefaultValue);
           return;
         }
         const num = parseInt(trimmed, 10);
@@ -57412,7 +57894,7 @@ function promptSingleSelect(rl, question, options, defaultValue) {
           ask();
           return;
         }
-        resolve42(options[num - 1]);
+        resolve43(options[num - 1]);
       });
     }
     ask();
@@ -57422,7 +57904,7 @@ function promptMultiSelect(rl, question, options, defaultValue) {
   const defaultIndices = defaultValue.map((v) => options.indexOf(v)).filter((i) => i >= 0);
   const defaultDisplay = defaultValue.length > 0 ? defaultValue.join(", ") : "none";
   const defaultNumbers = defaultIndices.length > 0 ? defaultIndices.map((i) => i + 2).join(",") : "1";
-  return new Promise((resolve42) => {
+  return new Promise((resolve43) => {
     function ask() {
       const lines = [
         `? ${question} (detected: ${defaultDisplay}):`,
@@ -57433,7 +57915,7 @@ function promptMultiSelect(rl, question, options, defaultValue) {
       rl.question(lines.join("\n") + "\n", (answer) => {
         const trimmed = answer.trim();
         if (trimmed === "") {
-          resolve42(defaultValue.length > 0 ? defaultValue : []);
+          resolve43(defaultValue.length > 0 ? defaultValue : []);
           return;
         }
         const numbers = trimmed.split(",").map((s) => parseInt(s.trim(), 10)).filter((n) => !Number.isNaN(n));
@@ -57443,11 +57925,11 @@ function promptMultiSelect(rl, question, options, defaultValue) {
           return;
         }
         if (numbers.includes(1)) {
-          resolve42([]);
+          resolve43([]);
           return;
         }
         const selected = [...new Set(numbers.map((n) => options[n - 2]).filter((v) => v !== void 0))];
-        resolve42(selected);
+        resolve43(selected);
       });
     }
     ask();
@@ -57535,9 +58017,9 @@ async function runDoctor(cwd) {
   }
   try {
     const { parseFile: tryParse } = await Promise.resolve().then(() => (init_dist2(), dist_exports2));
-    const testFile = join21(cwd, ".slopbrick", ".doctor-test.ts");
+    const testFile = join23(cwd, ".slopbrick", ".doctor-test.ts");
     mkdirSync9(dirname14(testFile), { recursive: true });
-    writeFileSync11(testFile, "export const x = 1;\n");
+    writeFileSync12(testFile, "export const x = 1;\n");
     await tryParse(testFile);
     rmSync2(testFile, { force: true });
     ok("Parser is working.");
@@ -57671,6 +58153,470 @@ function registerSuggest(program) {
   });
 }
 
+// src/cli/commands/composite.ts
+init_logger();
+init_telemetry();
+import { resolve as resolve15 } from "path";
+
+// src/engine/cluster.ts
+import { createHash as createHash12 } from "crypto";
+var DEFAULT_CLUSTER_PARAMS = {
+  minSupport: 0.05,
+  // 5% of files
+  minNPMI: 0.3,
+  // Cohen's-Landis-and-Koch "fair" agreement
+  fisherAlpha: 0.01,
+  // Bonferroni-style floor for many-pair tests
+  minClusterSize: 2
+};
+function adaptiveMinSupport(fileCount) {
+  if (fileCount <= 0) return DEFAULT_CLUSTER_PARAMS.minSupport;
+  return Math.max(DEFAULT_CLUSTER_PARAMS.minSupport, 5 / fileCount);
+}
+function computeRuleSupport(fireMatrix) {
+  const support = /* @__PURE__ */ new Map();
+  for (const ruleIds of fireMatrix.values()) {
+    for (const ruleId of ruleIds) {
+      support.set(ruleId, (support.get(ruleId) ?? 0) + 1);
+    }
+  }
+  return support;
+}
+function prefilterBySupport(support, totalFiles, minSupport) {
+  const kept = /* @__PURE__ */ new Set();
+  const minCount = Math.max(1, Math.ceil(minSupport * totalFiles));
+  for (const [ruleId, count] of support) {
+    if (count >= minCount) kept.add(ruleId);
+  }
+  return kept;
+}
+function buildContingency(rA, rB, totalFiles) {
+  let aAndB = 0;
+  let aOnly = 0;
+  let bOnly = 0;
+  for (const file of rA) {
+    if (rB.has(file)) aAndB++;
+    else aOnly++;
+  }
+  for (const file of rB) {
+    if (!rA.has(file)) bOnly++;
+  }
+  return {
+    aAndB,
+    aOnly,
+    bOnly,
+    neither: Math.max(0, totalFiles - aAndB - aOnly - bOnly)
+  };
+}
+function fisherExactTwoSided(c) {
+  const N = c.aAndB + c.aOnly + c.bOnly + c.neither;
+  const K1 = c.aAndB + c.aOnly;
+  const K2 = c.aAndB + c.bOnly;
+  const n = K1;
+  const kObs = c.aAndB;
+  const logPmf = (k) => {
+    if (k < Math.max(0, K1 + K2 - N) || k > Math.min(K1, K2)) return -Infinity;
+    return lnChoose(K2, k) + lnChoose(N - K2, K1 - k) - lnChoose(N, K1);
+  };
+  const pObs = Math.exp(logPmf(kObs));
+  const kMin = Math.max(0, K1 + K2 - N);
+  const kMax = Math.min(K1, K2);
+  let p = 0;
+  for (let k = kMin; k <= kMax; k++) {
+    const pk = Math.exp(logPmf(k));
+    if (pk <= pObs + 1e-12) {
+      p += pk;
+    }
+  }
+  return Math.min(1, p);
+}
+function lnChoose(n, k) {
+  if (k < 0 || k > n) return -Infinity;
+  if (k === 0 || k === n) return 0;
+  k = Math.min(k, n - k);
+  let s = 0;
+  for (let i = 1; i <= k; i++) {
+    s += Math.log((n - k + i) / i);
+  }
+  return s;
+}
+function npmi(c, total) {
+  if (total === 0 || c.aAndB === 0) return -1;
+  const pXY = c.aAndB / total;
+  const pX = (c.aAndB + c.aOnly) / total;
+  const pY = (c.aAndB + c.bOnly) / total;
+  if (pX === 0 || pY === 0 || pXY === 0) return -1;
+  const pmi = Math.log2(pXY / (pX * pY));
+  const norm = -Math.log2(pXY);
+  return norm === 0 ? 1 : pmi / norm;
+}
+function computeEdges(fireMatrix, rules, total, params) {
+  const ruleToFiles = /* @__PURE__ */ new Map();
+  for (const ruleId of rules) ruleToFiles.set(ruleId, /* @__PURE__ */ new Set());
+  for (const [file, fired] of fireMatrix) {
+    for (const ruleId of fired) {
+      if (rules.has(ruleId)) ruleToFiles.get(ruleId).add(file);
+    }
+  }
+  const ruleList = Array.from(rules).sort();
+  const edges = [];
+  for (let i = 0; i < ruleList.length; i++) {
+    for (let j = i + 1; j < ruleList.length; j++) {
+      const a = ruleList[i];
+      const b = ruleList[j];
+      const rA = ruleToFiles.get(a);
+      const rB = ruleToFiles.get(b);
+      const c = buildContingency(rA, rB, total);
+      const n = npmi(c, total);
+      if (n < params.minNPMI) continue;
+      const p = fisherExactTwoSided(c);
+      if (p > params.fisherAlpha) continue;
+      edges.push({ ruleIds: [a, b], weight: n, fisherP: p });
+    }
+  }
+  return edges;
+}
+function singleLinkageCluster(edges, minClusterSize) {
+  const parent = /* @__PURE__ */ new Map();
+  const find = (x) => {
+    if (!parent.has(x)) {
+      parent.set(x, x);
+      return x;
+    }
+    if (parent.get(x) === x) return x;
+    const root = find(parent.get(x));
+    parent.set(x, root);
+    return root;
+  };
+  const union = (a, b) => {
+    const ra = find(a);
+    const rb = find(b);
+    if (ra !== rb) parent.set(ra, rb);
+  };
+  for (const e of edges) {
+    union(e.ruleIds[0], e.ruleIds[1]);
+  }
+  const groups = /* @__PURE__ */ new Map();
+  for (const k of parent.keys()) {
+    const root = find(k);
+    if (!groups.has(root)) groups.set(root, []);
+    groups.get(root).push(k);
+  }
+  const clusters = [];
+  for (const members of groups.values()) {
+    if (members.length < minClusterSize) continue;
+    members.sort();
+    clusters.push(members);
+  }
+  clusters.sort((a, b) => b.length - a.length || a[0].localeCompare(b[0]));
+  return clusters;
+}
+function filesForComposite(fireMatrix, members, minMatch) {
+  const fired = /* @__PURE__ */ new Set();
+  for (const [file, ids] of fireMatrix) {
+    let n = 0;
+    for (const m of members) if (ids.has(m)) n++;
+    if (n >= minMatch) fired.add(file);
+  }
+  return fired;
+}
+var DEFAULT_CALIBRATION = {
+  // 1.5× is the documented floor.
+  recallFpRatio: 1.5,
+  // 0.05 absolute FP — the same `min` value most rules get via the
+  // v0.18.x calibration contract.
+  minFpFloor: 0.05
+};
+function calibrateCluster(cluster2, edges, fireMatrix, positiveFiles, totalFiles, thresholds = DEFAULT_CALIBRATION) {
+  if (cluster2.length < 2) return null;
+  const clusterSet = new Set(cluster2);
+  const clusterEdges = edges.filter(
+    (e) => clusterSet.has(e.ruleIds[0]) && clusterSet.has(e.ruleIds[1])
+  );
+  if (clusterEdges.length === 0) return null;
+  const strongest = clusterEdges.reduce((a, b) => b.weight > a.weight ? b : a);
+  let best = null;
+  for (let k = 1; k <= cluster2.length; k++) {
+    const firedFiles = filesForComposite(fireMatrix, cluster2, k);
+    const nFiles = firedFiles.size;
+    if (nFiles === 0) continue;
+    let recall = 0;
+    let fp = 0;
+    let precision = 0;
+    let canCalibrate = false;
+    if (positiveFiles && positiveFiles.size > 0) {
+      let tp = 0;
+      let fpc = 0;
+      for (const file of firedFiles) {
+        if (positiveFiles.has(file)) tp++;
+        else fpc++;
+      }
+      const totalPos = positiveFiles.size;
+      const totalNeg = Math.max(1, totalFiles - totalPos);
+      recall = totalPos > 0 ? tp / totalPos : 0;
+      fp = fpc / totalNeg;
+      precision = tp + fpc > 0 ? tp / (tp + fpc) : 0;
+      canCalibrate = true;
+    }
+    const F1 = precision + recall > 0 ? 2 * precision * recall / (precision + recall) : 0;
+    if (canCalibrate) {
+      if (recall / Math.max(fp, 1e-9) < thresholds.recallFpRatio) continue;
+      if (fp < thresholds.minFpFloor && recall < 0.5) continue;
+    }
+    if (best === null || F1 > best.F1 + 1e-9 || Math.abs(F1 - best.F1) < 1e-9 && k > best.minMatch) {
+      best = {
+        minMatch: k,
+        npmi: strongest.weight,
+        fisherP: strongest.fisherP,
+        recall,
+        FP: fp,
+        precision,
+        F1,
+        nFiles
+      };
+    }
+  }
+  return best;
+}
+function compositeId(members) {
+  const sorted = [...members].sort();
+  return "composite/" + createHash12("sha1").update(sorted.join("\n")).digest("hex").slice(0, 12);
+}
+function worstSeverity(members, memberSeverities) {
+  let worst = "low";
+  const order = { low: 0, medium: 1, high: 2 };
+  for (const m of members) {
+    const s = memberSeverities?.get(m);
+    if (s && order[s] > order[worst]) worst = s;
+  }
+  return worst;
+}
+function describeComposite(members, minMatch) {
+  const clusterPart = members.length <= 4 ? members.join("+") : `${members.slice(0, 3).join("+")}+${members.length - 3} more`;
+  return `Composite rule: at least ${minMatch} of {${clusterPart}} fire on the same file.`;
+}
+function runClusterer(input) {
+  const total = input.fireMatrix.size;
+  const minSupport = input.params?.minSupport ?? adaptiveMinSupport(total);
+  const params = {
+    minSupport,
+    minNPMI: input.params?.minNPMI ?? DEFAULT_CLUSTER_PARAMS.minNPMI,
+    fisherAlpha: input.params?.fisherAlpha ?? DEFAULT_CLUSTER_PARAMS.fisherAlpha,
+    minClusterSize: input.params?.minClusterSize ?? DEFAULT_CLUSTER_PARAMS.minClusterSize
+  };
+  const support = computeRuleSupport(input.fireMatrix);
+  const rulesKept = prefilterBySupport(support, total, params.minSupport);
+  const edges = computeEdges(input.fireMatrix, rulesKept, total, params);
+  const clusters = singleLinkageCluster(edges, params.minClusterSize);
+  const entries = [];
+  const clusterMaxNPMI = /* @__PURE__ */ new Map();
+  for (const cluster2 of clusters) {
+    const cal = calibrateCluster(
+      cluster2,
+      edges,
+      input.fireMatrix,
+      input.positiveFiles,
+      total
+    );
+    if (!cal) continue;
+    const id = compositeId(cluster2);
+    const severity = worstSeverity(cluster2, input.memberSeverities);
+    entries.push({
+      id,
+      ruleIds: [...cluster2].sort(),
+      minMatch: cal.minMatch,
+      severity,
+      defaultOff: true,
+      description: describeComposite(cluster2, cal.minMatch),
+      calibration: {
+        recall: round3(cal.recall),
+        FP: round3(cal.FP),
+        precision: round3(cal.precision),
+        F1: round3(cal.F1),
+        nFiles: cal.nFiles
+      },
+      provenance: {
+        seed: "auto-cluster",
+        discoveredAt: input.now ?? (/* @__PURE__ */ new Date()).toISOString(),
+        nFiles: total,
+        members: cluster2.length,
+        npmi: round3(cal.npmi),
+        fisherP: round3(cal.fisherP)
+      }
+    });
+    clusterMaxNPMI.set(id, cal.npmi);
+  }
+  entries.sort((a, b) => b.calibration.F1 - a.calibration.F1 || a.id.localeCompare(b.id));
+  return { entries, supportCounts: support, clusterMaxNPMI, filesScanned: total, params };
+}
+function round3(n) {
+  return Math.round(n * 1e3) / 1e3;
+}
+
+// src/rules/composite-loader.ts
+import { existsSync as existsSync23, readFileSync as readFileSync27, mkdirSync as mkdirSync10, writeFileSync as writeFileSync13 } from "fs";
+import { dirname as dirname15, join as join24 } from "path";
+var COMPOSITES_FILE = "composites.json";
+function compositesPath(cwd) {
+  return join24(cwd, COMPOSITES_FILE);
+}
+function readComposites(cwd) {
+  const path = compositesPath(cwd);
+  if (!existsSync23(path)) return [];
+  try {
+    const raw = JSON.parse(readFileSync27(path, "utf-8"));
+    if (!Array.isArray(raw)) return [];
+    return raw.filter(isCompositeRuleEntry);
+  } catch {
+    return [];
+  }
+}
+function isCompositeRuleEntry(value) {
+  if (!value || typeof value !== "object") return false;
+  const v = value;
+  return typeof v.id === "string" && Array.isArray(v.ruleIds) && typeof v.minMatch === "number";
+}
+function writeComposites(cwd, entries) {
+  const path = compositesPath(cwd);
+  mkdirSync10(dirname15(path), { recursive: true });
+  const tmp = `${path}.tmp`;
+  writeFileSync13(tmp, JSON.stringify(entries, null, 2), "utf-8");
+  const fs = __require("fs");
+  fs.renameSync(tmp, path);
+}
+
+// src/cli/commands/composite.ts
+function registerComposite(program) {
+  const cmd = program.command("composite").description(
+    "discover and enable composite rules (Sprint 3, \xA73b). Run `slopbrick composite discover` to scan scans.jsonl, audit the candidates, then `slopbrick composite enable <id>` to opt a specific composite into slopbrick.config.mjs."
+  );
+  cmd.command("discover").description(
+    "run the empirical composite clusterer on .slopbrick/flywheel/scans.jsonl; writes composites.json"
+  ).action(async (_cmdOptions, command) => {
+    const options = command.optsWithGlobals();
+    const cwd = resolve15(options.workspace ?? process.cwd());
+    const payloads = readTelemetry(cwd);
+    if (payloads.length === 0) {
+      logger.error(
+        "`composite discover` needs at least 2 scans in .slopbrick/flywheel/scans.jsonl. Run `slopbrick scan` a few times first."
+      );
+      process.exit(1);
+    }
+    const fireMatrix = /* @__PURE__ */ new Map();
+    for (const payload of payloads) {
+      for (const f of payload.files) {
+        const set = fireMatrix.get(f.hash) ?? /* @__PURE__ */ new Set();
+        for (const id of f.ruleIds) set.add(id);
+        if (set.size > 0) fireMatrix.set(f.hash, set);
+      }
+    }
+    const out = runClusterer({
+      fireMatrix,
+      // No labeled positive set; let the clusterer surface for audit.
+      positiveFiles: void 0,
+      now: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    const finalEntries = out.entries.length === 0 ? [...(await Promise.resolve().then(() => (init_composite_seed(), composite_seed_exports))).HAND_CURATED_SEED] : out.entries;
+    writeComposites(cwd, finalEntries);
+    if (out.entries.length === 0) {
+      logger.info("Composite discovery: no clusters passed the empirical gate.");
+      logger.info(
+        "  (Try lowering --min-support, or run more scans to densify the ledger.)"
+      );
+      return;
+    }
+    logger.info(
+      `Composite discovery: ${out.entries.length} candidate(s) written to composites.json`
+    );
+    const lines = [];
+    for (const e of out.entries) {
+      lines.push("");
+      lines.push(
+        `  ${e.id}  minMatch=${e.minMatch}  F1=${e.calibration.F1}  (${e.ruleIds.length} members)`
+      );
+      lines.push(`    ${describeComposite(e.ruleIds, e.minMatch)}`);
+      lines.push(
+        `    provenance: ${e.provenance.seed} npmi=${e.provenance.npmi} fisherP=${e.provenance.fisherP}`
+      );
+    }
+    logger.info(lines.join("\n"));
+    logger.info(
+      "\nNext step: review each entry. Opt in with `slopbrick composite enable <id>`; opt out by removing the entry."
+    );
+  });
+  cmd.command("enable <id>").description(
+    "opt a specific composite into slopbrick.config.mjs#compositeRules (one composite per call)"
+  ).action(async (id, _cmdOptions, command) => {
+    const options = command.optsWithGlobals();
+    const cwd = resolve15(options.workspace ?? process.cwd());
+    const composites = readComposites(cwd);
+    const target = composites.find((c) => c.id === id);
+    if (!target) {
+      logger.error(
+        `Composite "${id}" not found in composites.json. Run \`slopbrick composite discover\` first to populate the ledger.`
+      );
+      process.exit(1);
+    }
+    const cfgPath = resolve15(cwd, "slopbrick.config.mjs");
+    const fs = __require("fs");
+    if (!fs.existsSync(cfgPath)) {
+      logger.error(`No slopbrick.config.mjs found at ${cfgPath}.`);
+      process.exit(1);
+    }
+    const src = fs.readFileSync(cfgPath, "utf-8");
+    const compositeSnippet = JSON.stringify(
+      {
+        id: target.id,
+        category: "ai",
+        severity: target.severity,
+        aiSpecific: true,
+        description: target.description,
+        defaultOff: true,
+        ruleIds: target.ruleIds,
+        minMatch: target.minMatch,
+        create: "() => ({})",
+        analyze: "() => []"
+      },
+      null,
+      2
+    );
+    if (src.includes(`id: '${target.id}'`) || src.includes(`id: "${target.id}"`)) {
+      logger.info(`Composite "${id}" is already enabled in slopbrick.config.mjs (idempotent).`);
+      return;
+    }
+    const updated = src.replace(
+      /(export default\s*{[\s\S]*?)(}\s*;?\s*)$/,
+      (_match, head, tail) => `${head}  compositeRules: [
+${compositeSnippet}
+  ],
+${tail}`
+    );
+    fs.writeFileSync(cfgPath, updated, "utf-8");
+    logger.info(`Composite "${id}" enabled.`);
+    logger.info("Next scan will apply it; rerun `slopbrick scan` to see the effect.");
+  });
+  cmd.command("list").description("list composites currently registered (composites.json + config-declared)").action(async (_cmdOptions, command) => {
+    const options = command.optsWithGlobals();
+    const cwd = resolve15(options.workspace ?? process.cwd());
+    const composites = readComposites(cwd);
+    if (composites.length === 0) {
+      logger.info("No composites registered. Run `slopbrick composite discover` first.");
+      return;
+    }
+    const lines = ["Registered composites:"];
+    for (const e of composites) {
+      lines.push(
+        `
+  ${e.id}
+    ${describeComposite(e.ruleIds, e.minMatch)}
+    members=[${e.ruleIds.join(", ")}]  minMatch=${e.minMatch}
+    F1=${e.calibration.F1}  recall=${e.calibration.recall}  FP=${e.calibration.FP}`
+      );
+    }
+    logger.info(lines.join("\n"));
+  });
+}
+
 // src/cli/explain.ts
 var RULES_BASE_URL2 = "https://github.com/usebrick/platform/blob/main/packages/slopbrick/src/rules";
 function ruleIdToFilename2(ruleId) {
@@ -57720,152 +58666,7 @@ function formatExplain(result) {
 // src/cli/commands/explain.ts
 init_logger();
 init_builtins();
-
-// src/snippet/data.ts
-var CATEGORY_DIRECTIVES = {
-  visual: 'Avoid the saturated "vibe purple" Tailwind palette (violet-400-700, indigo-400-700). Prefer emerald, sky, amber, rose for accents. Never use arbitrary color values like bg-[#7c3aed] when a token exists.',
-  logic: "Never use explicit `any`. Use `unknown` and narrow. Always add an AbortSignal to fetches. Handle errors with try/catch, never swallow with empty catch. Use `as const` instead of `as Type` casts.",
-  wcag: 'All form inputs must have an accessible label (visible <label>, aria-label, or aria-labelledby). Decorative images must have empty alt="". Buttons must be <button>, never <div onClick>. Touch targets must be \u2265 24\xD724 CSS px.',
-  security: 'Never store tokens in localStorage or sessionStorage \u2014 use httpOnly Secure SameSite cookies. Never put secrets in NEXT_PUBLIC_* / REACT_APP_* / VITE_* env vars. Validate e.origin in postMessage handlers. Never dangerouslySetInnerHTML with user input. Never use target="_blank" without rel="noopener".',
-  perf: "Always use AbortController with fetch. Use image width/height attributes to prevent CLS. Use <Suspense> around async client components. Don't load all images eagerly.",
-  typo: `Never leave TODO / placeholder / "change me" copy in shipped code. Use real i18n strings or the project's content map.`,
-  layout: "Don't stack badge-above-h1 hero patterns. Don't build 3-stat banner rows without explicit user request. Don't use emoji inside nav items (use SVG icons). Use the project's spacing scale (4px or 8px grid), never arbitrary values like p-[13px].",
-  component: "Don't build components > 200 lines. Extract shared subcomponents. Avoid circular prop drilling \u2014 use context.",
-  arch: "For Astro: server-render everything by default; only opt-in to client islands when you need interactivity. Don't put secrets in client-side code.",
-  test: "Use domain-specific fixture data, assert on value shapes not just truthiness, and consolidate repeated setup into helpers. Avoid `expect(x).toBeDefined()` placeholders and textbook fixtures like 'John Doe' or 'test@test.com'."
-};
-var RULE_HINTS = {
-  // v0.38.0 hygiene: 37 v10-DORMANT rule hints were removed. Every
-  // remaining key matches a rule in src/rules/builtins.ts. No orphans.
-  // (v0.16.0 previously moved 35 out-of-scope orphan hints to
-  //   docs/research/backlog-rule-hints.md
-  // for future implementers to paste back when the corresponding rules ship.)
-  "security/hardcoded-secret": "Never inline API keys, JWT secrets, or database passwords in source. Load them from env vars and never commit a .env file. Assume any published secret is compromised and rotate it.",
-  "security/exposed-env-var": "NEVER prefix a secret with NEXT_PUBLIC_, VITE_, REACT_APP_, EXPO_PUBLIC_, GATSBY_, or PUBLIC_ \u2014 those vars are inlined into every browser build.",
-  "security/dangerous-cors": "Don't set Access-Control-Allow-Origin: * on production endpoints. Restrict to an explicit allowlist; never combine wildcard origin with credentials: true.",
-  "security/missing-auth-check": "Every server route handler must perform an authentication + authorization check at the top. Reachability of an endpoint by any user (authenticated or not) is a vulnerability, not a feature.",
-  "security/unsafe-html-render": "Sanitize any non-literal value passed to dangerouslySetInnerHTML with DOMPurify. Better: avoid the prop entirely and let React escape via children.",
-  "security/fail-open-auth": "Don't gate auth bypasses on NODE_ENV. Replace dev-env checks with an explicit AUTH_BYPASS flag that's never set in production.",
-  "security/sql-construction": 'Never build SQL with string concatenation or template-literal interpolation. Use parameterized queries: pg client.query("... WHERE id = $1", [id]) or your ORM query builder.',
-  "security/public-admin-route": "Routes under /admin, /internal, /debug, /staff, /manage, /private need an explicit role check on top of standard auth \u2014 auth alone is not enough for privileged paths.",
-  "visual/arbitrary-escape": "Never use bracket-notation values like text-[13px] or bg-[#7c3aed]. Use design tokens instead.",
-  "visual/spacing-scale-violation": "Use spacing scale tokens (p-2, gap-4, etc.) instead of arbitrary values like p-[13px] or gap-[1.75rem].",
-  "visual/radius-scale-violation": "Use radius scale tokens (rounded-md, rounded-lg, etc.) instead of arbitrary values like rounded-[7px].",
-  // v0.16.0 — in-scope orphans kept here (corresponding rule ships in v0.16.0).
-  "typo/placeholder-text": 'Never leave "TODO", "placeholder", "change me", "your text here" in shipped UI.',
-  "logic/key-prop-missing": "Always provide a stable `key` prop when rendering lists.",
-  "logic/boundary-violation": "Don't import data-layer / DB code into UI components. Server-side only.",
-  "wcag/missing-alt": 'Every <img> needs alt text. Decorative: alt="". Informative: describe the image.',
-  "security/localstorage-token": "Never store JWT / access token / refresh token in localStorage or sessionStorage. Issue as httpOnly cookie.",
-  "security/eval": "Never use eval() or new Function(). These are RCE vectors if the input is ever attacker-controlled.",
-  "security/target-blank-no-noopener": 'Always add rel="noopener" (or rel="noreferrer") to target="_blank" links.',
-  "component/giant-component": "Don't build components > 200 lines. Extract shared subcomponents.",
-  "component/multiple-components-per-file": "One component per file. Move subcomponents into their own files so the Context Window stays small and boundary tests are easy.",
-  "component/shadcn-prop-mismatch": "Select shadcn variants via the `variant` prop, not long `className` overrides. See the component registry for available variants.",
-  "context/import-path-mismatch": "Use only the canonical import paths declared in brick.config.json (e.g. @/components/ui/, @/lib/).",
-  "layout/gap-monopoly": "Mix gap-2 / gap-4 / gap-6 / gap-12 deliberately. Don't repeat the same gap value across the whole project.",
-  "layout/math-element-uniformity": "Human files have lopsided interactive counts (1 button + 12 inputs). AI tends to balance them. Build forms with many inputs and few buttons.",
-  "layout/math-grid-uniformity": "Vary grid-cols-N (grid-cols-2, grid-cols-3, grid-cols-4, grid-cols-6) across sections instead of repeating grid-cols-3.",
-  "layout/spacing-grid": "Use the configured spacing scale (4px or 8px grid). Avoid arbitrary values like p-[13px] that aren't on the scale.",
-  "logic/ghost-defensive": "Use optional chaining (?.) or early returns instead of deep && guards. If a defensive chain runs 3+ levels deep, refactor.",
-  "logic/heaps-deviation": "Inspect for LLM-style vocabulary patterns: this file's vocabulary grows faster (high Heaps \u03BB) or slower (low \u03BB) than typical source code. Verify authorship if unexpected. (v0.12.0 \u2014 Christ et al. EMNLP Findings 2025.)",
-  "logic/ks-distribution-shift": "Inspect the shifted features. KS detects both AI anomalies and production-rot anomalies (it is symmetric); combine with Heaps/Zipf for AI-specific signal. (v0.12.0 \u2014 arXiv:2510.15996, Oct 2025.)",
-  "logic/zipf-slope-anomaly": "Inspect for LLM-style frequency distribution: this file's identifier usage is more peaked or flatter than typical human code. (v0.12.0 \u2014 Christ et al. EMNLP Findings 2025.)",
-  "logic/math-any-density": "Replace `: any` with proper types. Start with the parameter/return types of the most-used functions.",
-  "logic/math-console-log-storm": "Replace debug logs with a proper debugger or logger.debug(). Remove all console.log before shipping.",
-  "logic/math-gini-class-usage": "Spread usage across more class tokens instead of repeating the same handful (p-4, p-8, rounded-lg, etc.).",
-  "logic/math-variable-name-entropy": "Use domain-specific identifier names (reservations, invoices, customers) instead of generic data/items/value.",
-  "logic/optimistic-no-rollback": "In optimistic updates, revert state in the catch block: `setX(prev => prev)`. Never leave stale UI on error.",
-  "logic/reactive-hook-soup": "Coordinate state via a single derived value (useMemo) or a state machine. Avoid chained useEffects that sync local state.",
-  "logic/zombie-state": "Remove unused useState or wire it into the component. Don't leave declared-but-never-read state bindings.",
-  "dead/unused-import": "Remove the import or use the symbol somewhere. Unused imports are the most common AI-iteration signature \u2014 the model added it for a feature, then rewrote the function without cleaning up.",
-  "dead/unused-local": "Remove the declaration or use the variable. AI-iteration signature: the model declared a binding for a feature, then rewrote the function without cleaning up.",
-  "dead/unused-parameter": "Remove the parameter (and update every call site) or use it in the function body. AI-iteration signature: the model added a parameter for a feature, then rewrote the function without removing parameters the new code does not need.",
-  "dead/dead-branch": "Replace the literal boolean with a real condition, or remove the dead branch. AI-iteration signature: a feature flag toggled to a constant, or a wrapper from a previous refactor that was never cleaned up.",
-  "dead/unreachable": "Remove this statement \u2014 code after a return/throw/break/continue is unreachable. AI-iteration signature: the model added an early return for a new error path, then forgot the rest of the function body was still sitting below it.",
-  "perf/cls-image": "Add width/height attributes or an aspect-ratio utility to prevent layout shift.",
-  "perf/css-bloat": "Extract to a CSS variable (`--surface-card`) or a component prop when a class string repeats 5+ times.",
-  "typo/math-button-label-uniformity": 'Mix button lengths deliberately \u2014 pair a short "Save" with a longer "Mark as complete" \u2014 instead of repeating the same template.',
-  "visual/inline-style-dominance": "Replace inline `style={{...}}` with className utilities (e.g. Tailwind `p-4 m-2 gap-3`) or a CSS module class.",
-  "visual/math-default-font": "Import a distinctive font (next/font/google, @font-face, or a CSS variable) instead of relying on the framework default.",
-  "visual/math-font-entropy": "Use a wider range of text sizes (text-xs, text-sm, text-lg, text-xl, text-2xl, text-3xl) for a more deliberate type scale.",
-  "visual/math-rounded-entropy": "Use a wider range of border-radius values (sm, md, 2xl, 3xl) instead of repeating the same lg/xl/full pattern.",
-  "visual/math-spacing-entropy": "Mix more spacing values from the design scale (e.g. 3, 5, 7, 10, 14, 20, 28) instead of repeating the same 4/8 pattern.",
-  "visual/naturalness-anomaly": "Use domain-specific identifier names so the identifier stream reflects the actual problem domain. Hindle 2012 \xA74.3: LLM-generated code reuses a narrow band of training-data identifiers, dropping distinct-token ratio below 30%.",
-  "visual/math-color-cluster": "Use at least 3 distinct hue families (e.g. blue + amber + green) instead of clustering every color in the violet/fuchsia band.",
-  "wcag/focus-appearance": "Add a focus-visible:ring-* class, or remove outline-none. Keyboard users need a visible focus indicator.",
-  "wcag/focus-obscured": "Ensure focused elements are not hidden behind fixed or sticky wrappers.",
-  "test/weak-assertion": "Assert on a specific value or shape: `expect(x).toEqual(expectedValue)`. Avoid `.toBeDefined()` / `.toBeTruthy()` placeholders and tautological `expect(x).toBe(x)`.",
-  "test/duplicate-setup": "Extract shared `beforeEach` / `setupServer` blocks into a single helper (e.g. `renderWithProviders`) so each describe block calls it instead of repeating setup.",
-  "test/fake-placeholder": "Use domain-specific fixture values (`alice@acme-corp.com`, `Order#48231`) or a factory like @faker-js/faker. Avoid textbook placeholders (`John Doe`, `test@test.com`, `id: 1`).",
-  "product/terminology-drift": "Keep the leading noun consistent across files: `PostList`, `PostDetail`, `PostCard` are one entity, not three. AI agents pick slightly different words each invocation; product copy drifts.",
-  "product/ux-pattern-fragmentation": "Keep the per-category count tight: modal \u22643, toast \u22642, button \u22644, input \u22643, card \u22643. Pick the canonical one and alias the rest. `slopbrick patterns` reports the per-category count.",
-  // v0.13.0 — AI-specific rules (peer-reviewed signals).
-  "ai/markdown-leakage": "Delete stray `\\`\\`\\`<lang>\\`\\`\\`` markers; they are Markdown fences, not valid syntax in standalone source files (Yotkova et al. SemEval-2026).",
-  "ai/comment-ratio": "AI tools either skip comments (reductive models) or over-comment (expansive models). Match the corpus mean \xB1 2\u03C3 (Rahman et al. 2024, Bisztray et al. 2025).",
-  "ai/whitespace-regularity": "Vary inter-token spacing (single spaces mostly, occasional alignment in tables). Uniform runs are an AI tell (Shi et al. DetectCodeGPT 2024).",
-  "ai/text-like-ratio": "Move natural-language explanations to README files or doc comments. Inline prose in source code is hard to maintain (Yotkova 2026).",
-  "ai/errors-near-eof": "Check whether the file was truncated by a token limit. Unbalanced delimiters near EOF suggest the model ran out of output budget (Yotkova 2026).",
-  "ai/any-density": "Replace `any` with `unknown`, `Record<string, unknown>`, or a domain type. The `: any` annotation propagates type-errors and defeats TS safety (Lee, Hassan, Hindle MSR 2026).",
-  "ai/renyi-profile": "The token distribution is mass-concentrated on a few high-frequency tokens. Verify authorship if unexpected (R\xE9nyi 1961, Moslonka 2025).",
-  "ai/segment-surprisal-cv": "The cross-entropy is suspiciously uniform across the file. Real codebases have varied registers (Binoculars, Hans 2024).",
-  "ai/compression-profile": "The file compresses unusually well and lines are highly repetitive \u2014 characteristic of AI-generated boilerplate (Cilibrasi 2005, Mahoney 1999).",
-  // v0.14.5b — 6 new AI tendency detection rules (DORMANT in v0.14.5b;
-  // reclassified post-v7 calibration in v0.14.5d)
-  "ai/tailwind-color-overuse": "If most utility classes are bg-violet-500, text-violet-600, ring-violet-400 \u2014 the project is on the AI-default palette. Audit and replace with the project's design tokens.",
-  "ai/default-react-stack": "Every new file is a Vite + React + Tailwind + Zustand + React Hook Form clone. Verify the project actually needs each piece before adding it.",
-  "ai/library-reinvention": "Re-implementing zustand, react-hook-form, or date-fns inline (custom event emitters, useState reducers, manual date math) is a sign of LLM completion-mode code. Use the libraries the project already depends on.",
-  "ai/state-default-overuse": "Wrapping every component in useState + useEffect for transient UI state is the React tutorial default. Real production code uses refs, uncontrolled inputs, or the project's state lib.",
-  "ai/fetch-default-overuse": "Calling fetch() inline in components instead of going through the project's data-fetching layer (react-query, swr, or your own client) bypasses the cache, error boundary, and abort handling.",
-  "ai/console-debug-storm": "5+ console.log calls in a single file is debug-by-print-statement, the LLM training-data default. Remove before commit; use the project's logger or a real debugger.",
-  // v0.17.0 — db/* rules (Postgres static analysis via pgsql-parser)
-  "db/sql-concat": 'Never build SQL with template-literal interpolation \u2014 `db.query(`SELECT \u2026 WHERE id = ${id}`)` is a SQL injection vector. Use parameterized queries (`db.query("\u2026 WHERE id = $1", [id])`) or your ORM query builder.',
-  // v0.17.0 — docs/* rules (markdown drift detection)
-  "docs/stale-package-reference": "Update the doc to reference an installed package, or add the package to package.json. Copy-pasted install commands from a previous project are the #1 doc-drift failure mode.",
-  "docs/stale-function-reference": "Rename the doc reference to match a current export, or add a wrapper export. Stale function callouts in tutorials cost readers 10+ minutes of debugging.",
-  "docs/broken-link": "Create the file or fix the link target. On a public docs site, broken links erode trust more than stale copy.",
-  // v0.18.9 — Rust-specific rules (tree-sitter-backed)
-  "rust/unused-pub-fn": "Remove the function or call it. Rust's compiler doesn't warn on `pub fn` references unless `#![warn(dead_code)]` is set at the crate root. AI agents leave these behind during iterative refactors.",
-  "rust/unwrap-in-production": "Replace `.unwrap()` / `.expect()` with `?` (early-return on Err), `.map_err(...)` for error conversion, or an explicit `match`. They panic in production; reserve them for `#[cfg(test)]` or `#[test]` scopes.",
-  "rust/todo-macro": "Implement the function body or remove the stub. `todo!()` / `unimplemented!()` both expand to `panic!()`, so a hit at runtime crashes the program. Move them into a `#[cfg(test)] mod tests` block to suppress.",
-  "rust/stringly-typed": 'Replace the `String` / `&str` parameter with the typed enum that already exists in the file. Stringly-typed APIs lose type information at the boundary \u2014 typos (`"Click"` vs `"click"`) only fail at runtime.',
-  // v0.19.0 — TypeScript-specific rules
-  "ts/enum-vs-as-const": "Replace `enum Foo { A, B }` with `const Foo = { A: 'A', B: 'B' } as const` (or `const Foo = ['A', 'B'] as const`). Modern TS style guides (Google, TS-eslint) prefer `as const` because enums have surprising runtime semantics.",
-  "ts/import-type-misuse": "Use `import type { X } from '...'` instead of `import { type X } from '...'`. The split form is more common in real codebases and makes the type-only intent unambiguous.",
-  "ts/never-vs-unknown": "The `never` return type means 'this function never returns'. Reserve it for functions that always throw, always loop, or always exit. For 'impossible' branches, use a concrete type (`void`, `Error`, `unknown`) and an exhaustive check.",
-  "ts/excessive-type-assertion": "More than 3 `as` assertions in one function is a strong signal that the type is wrong, not the code. Fix the type definition (or use a type guard) instead of bypassing the type system.",
-  // v0.19.0 — Go-specific rules
-  "go/struct-tag-inconsistency": 'Pick one tag style per struct. If most fields are `json:"foo"`, this field should be too. Real Go code maintains consistency within a struct (or within a package).',
-  "go/nil-slice-vs-empty": "Either declare as `var x = []int{}` or assign with `make([]int, 0)`. The nil/empty inconsistency is an AI signal \u2014 real code picks one form and sticks with it.",
-  // v0.19.0 — Duplication detector
-  "dup/identical-block": "Refactor to a shared helper. This is a Type-1 clone (byte-for-byte identical after normalization). Common in AI-generated code that copy-pastes from training data.",
-  // v0.23.0 — Type-2 near-duplicate detector (MinHash + LSH)
-  "dup/near-duplicate": "Refactor to a shared helper. Type-2 near-duplicate: same identifiers + structure, different whitespace/comments. AI-iterated code regenerates the same function with cosmetic edits. (v0.23.0 \u2014 MinHash + LSH, k=5, thr 0.7.)",
-  // v0.24.0 — Type-3 structural clone detector (two-stage MinHash)
-  "dup/structural-clone": "Refactor to a shared helper. Type-3 clone: same shape as another file after identifier canonicalization, with renames and/or added/removed statements. AI agents and copy-paste both produce this. Extract the shared part. (v0.24.0.)",
-  // v0.24.0 — Kotlin rules (DORMANT until v9 Kotlin corpus calibration)
-  // v0.29.0 — non-AI Kotlin rules (DORMANT until larger pos arm)
-  // v0.30.0 — non-AI Java rules (Option C applied to v9 Java corpus, 92k files)
-  "java/sql-string-concat": "Use a PreparedStatement (JDBC), setParameter (jOOQ), or an ORM (Hibernate, MyBatis with #{}). String concat into SQL is the canonical SQL-injection pattern. OWASP A03:2021. (v0.30.0 \u2014 DORMANT, ratio 0.59.)",
-  "java/thread-sleep-in-loop": "Use ScheduledExecutorService for periodic work, or BlockingQueue.take() for event-driven work. Thread.sleep in a loop is the polling anti-pattern \u2014 ties up Tomcat/Jetty/Netty threads. (v0.30.0 \u2014 DORMANT, era-confounded ratio 0.97.)",
-  // v0.35.0 — content-based detection (CoCoNUTS-inspired)
-  "java/suspicious-implementation": "Function name claims validate/encrypt/hash/sanitize but body is empty, returns null/true, or returns the input. This is a content mismatch \u2014 the function's claimed behavior doesn't match its actual behavior. OWASP A04:2021.",
-  // v0.35.1 — Raidar-inspired content-based detection
-  "java/lost-stack-trace": 'catch block throws a new exception without the original cause \u2014 stack trace is lost. Pass the original exception as the second arg to the new exception\'s constructor: `throw new XxxException("msg", e)`.',
-  // v0.24.0 — Swift rules (DORMANT until v9 Swift corpus calibration)
-  "swift/force-unwrap": "Replace with the safe form: `as?` + guard/if let, `try?`, or `guard let x = optional else { return }`. `!` crashes unconditionally in release. (v0.24.0 \u2014 DORMANT.)",
-  "swift/print-debug": "Replace with `Logger(subsystem:..., category:...).info(...)` (os.log). `print` writes to stdout with no level and no redaction. (v0.24.0 \u2014 DORMANT.)",
-  "swift/fatal-error-thrown": "Replace with `return` of a typed default (e.g. `nil`, `[]()`) or throw a typed `enum MyError: Error`. `fatalError` survives release builds. (v0.24.0 \u2014 DORMANT.)",
-  "swift/implicitly-unwrapped-optional": "Declare as `var name: Type?` and unwrap with `guard let`. IUOs exist for Obj-C bridging / IBOutlets but using them everywhere is an AI signal. (v0.24.0 \u2014 DORMANT.)",
-  "swift/strong-self-capture": "Capture with `[weak self]` (or `[unowned self]` if guaranteed non-nil): `[weak self] in self?.foo = bar`. Strong self capture creates a retain cycle. (v0.24.0 \u2014 DORMANT.)",
-  // v0.24.0 — C++ rules (DORMANT until v9 C++ corpus calibration)
-  "cpp/raw-new-delete": "Replace with `auto p = std::make_unique<T>(...)`. Smart pointers delete on scope exit, never leak on early return / exception, never double-free. (v0.24.0 \u2014 DORMANT.)",
-  "cpp/c-style-cast": "Use the named cast: `static_cast<int>(x)`, `reinterpret_cast<...>(p)`, `const_cast<...>(ref)`. C-style casts silently pick static / reinterpret / const \u2014 impossible to grep. (v0.24.0 \u2014 DORMANT.)",
-  "cpp/printf-debug": "Replace with `spdlog::info(...)`, `LOG(INFO) << ...` (glog), or `ABSL_LOG(INFO) << ...`. `printf` / `std::cout` have no levels, no redaction, no sink routing. (v0.24.0 \u2014 DORMANT.)",
-  "cpp/magic-numbers": "Replace with `constexpr int MAX = 1024;` (or `static constexpr`). Named constants live next to their value, can be searched, force the reader to mean what they say. (v0.24.0 \u2014 DORMANT.)"
-};
-
-// src/cli/commands/explain.ts
+init_data();
 function registerExplain(program) {
   program.command("explain <ruleId>").description("Print rationale, pattern, and remediation for a single rule").action((ruleId) => {
     const result = explainRule(ruleId, builtinRules, RULE_HINTS);
@@ -57875,7 +58676,7 @@ function registerExplain(program) {
 }
 
 // src/cli/commands/calibration.ts
-import { dirname as dirname15 } from "path";
+import { dirname as dirname16 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/rules/signal-strength.json
@@ -61468,7 +62269,7 @@ var signal_strength_default2 = {
 };
 
 // src/cli/commands/calibration.ts
-var __dirname = dirname15(fileURLToPath2(import.meta.url));
+var __dirname = dirname16(fileURLToPath2(import.meta.url));
 function loadData() {
   return signal_strength_default2;
 }
@@ -61591,17 +62392,17 @@ function registerCalibration(program) {
 // src/cli/commands/install.ts
 init_logger();
 init_git();
-import { resolve as resolve15 } from "path";
+import { resolve as resolve16 } from "path";
 
 // src/cli/installer.ts
 import {
   chmodSync,
-  existsSync as existsSync22,
-  mkdirSync as mkdirSync10,
-  readFileSync as readFileSync26,
-  writeFileSync as writeFileSync12
+  existsSync as existsSync24,
+  mkdirSync as mkdirSync11,
+  readFileSync as readFileSync28,
+  writeFileSync as writeFileSync14
 } from "fs";
-import { dirname as dirname16, join as join24 } from "path";
+import { dirname as dirname17, join as join26 } from "path";
 var BEGIN_SENTINEL = "# slopbrick-hook-begin";
 var END_SENTINEL = "# slopbrick-hook-end";
 var SENTINEL_BLOCK = `${BEGIN_SENTINEL}
@@ -61609,14 +62410,14 @@ npx slopbrick --staged
 ${END_SENTINEL}
 `;
 function hookPath(gitRoot) {
-  const huskyDir = join24(gitRoot, ".husky");
-  if (existsSync22(huskyDir)) {
-    return join24(huskyDir, "pre-commit");
+  const huskyDir = join26(gitRoot, ".husky");
+  if (existsSync24(huskyDir)) {
+    return join26(huskyDir, "pre-commit");
   }
-  return join24(gitRoot, ".git", "hooks", "pre-commit");
+  return join26(gitRoot, ".git", "hooks", "pre-commit");
 }
 function readHookContent(path) {
-  return readFileSync26(path, "utf8");
+  return readFileSync28(path, "utf8");
 }
 function sentinelsPresent(content) {
   const lines = content.split(/\r?\n/);
@@ -61638,7 +62439,7 @@ function replaceSentinelBlock(content) {
 }
 function installHook(gitRoot) {
   const path = hookPath(gitRoot);
-  if (existsSync22(path)) {
+  if (existsSync24(path)) {
     const content = readHookContent(path);
     const { begin, end } = sentinelsPresent(content);
     if (begin && end) {
@@ -61650,7 +62451,7 @@ function installHook(gitRoot) {
           exitCode: 0
         };
       }
-      writeFileSync12(path, replaced.endsWith("\n") ? replaced : `${replaced}
+      writeFileSync14(path, replaced.endsWith("\n") ? replaced : `${replaced}
 `);
       chmodSync(path, 493);
       return {
@@ -61670,7 +62471,7 @@ function installHook(gitRoot) {
     }
     const normalized = content.length > 0 && !content.endsWith("\n") ? `${content}
 ` : content;
-    writeFileSync12(path, `${normalized}${SENTINEL_BLOCK}`);
+    writeFileSync14(path, `${normalized}${SENTINEL_BLOCK}`);
     chmodSync(path, 493);
     return {
       ok: true,
@@ -61678,8 +62479,8 @@ function installHook(gitRoot) {
       exitCode: 0
     };
   }
-  mkdirSync10(dirname16(path), { recursive: true });
-  writeFileSync12(path, SENTINEL_BLOCK, { mode: 493 });
+  mkdirSync11(dirname17(path), { recursive: true });
+  writeFileSync14(path, SENTINEL_BLOCK, { mode: 493 });
   chmodSync(path, 493);
   return {
     ok: true,
@@ -61689,7 +62490,7 @@ function installHook(gitRoot) {
 }
 function uninstallHook(gitRoot) {
   const path = hookPath(gitRoot);
-  if (!existsSync22(path)) {
+  if (!existsSync24(path)) {
     return {
       ok: true,
       message: "Hook not installed",
@@ -61725,7 +62526,7 @@ function uninstallHook(gitRoot) {
   }
   const remaining = [...lines.slice(0, start), ...lines.slice(end + 1)];
   const result = remaining.join("\n");
-  writeFileSync12(path, result.endsWith("\n") ? result : `${result}
+  writeFileSync14(path, result.endsWith("\n") ? result : `${result}
 `);
   return {
     ok: true,
@@ -61738,7 +62539,7 @@ function uninstallHook(gitRoot) {
 function registerInstall(program) {
   program.command("install").description("install the git pre-commit hook").action(async (_cmdOptions, command) => {
     const options = command.optsWithGlobals();
-    const cwd = resolve15(options.workspace ?? process.cwd());
+    const cwd = resolve16(options.workspace ?? process.cwd());
     const root = getGitRoot(cwd);
     if (!root) {
       logger.error("Not a Git repository. Run `git init` first, or remove --staged from your command.");
@@ -61755,11 +62556,11 @@ function registerInstall(program) {
 // src/cli/commands/uninstall.ts
 init_logger();
 init_git();
-import { resolve as resolve16 } from "path";
+import { resolve as resolve17 } from "path";
 function registerUninstall(program) {
   program.command("uninstall").description("uninstall the git pre-commit hook").action(async (_cmdOptions, command) => {
     const options = command.optsWithGlobals();
-    const cwd = resolve16(options.workspace ?? process.cwd());
+    const cwd = resolve17(options.workspace ?? process.cwd());
     const root = getGitRoot(cwd);
     if (!root) {
       logger.error("Not a Git repository. Run `git init` first, or remove --staged from your command.");
@@ -61787,8 +62588,8 @@ init_patterns();
 init_architecture_score();
 init_business_logic();
 init_structure_md();
-import { readFileSync as readFileSync27 } from "fs";
-import { resolve as resolve17 } from "path";
+import { readFileSync as readFileSync29 } from "fs";
+import { resolve as resolve18 } from "path";
 var TOOL_DEFINITIONS = [
   {
     name: "slop_scan_file",
@@ -62029,10 +62830,10 @@ async function runSuggest(args, ctx, options = {}) {
 function runCheckConstitution(args, ctx) {
   const path = args.path;
   if (!path) return toolError("Missing required argument: path");
-  const absPath = resolve17(ctx.cwd, path);
+  const absPath = resolve18(ctx.cwd, path);
   let source;
   try {
-    source = readFileSync27(absPath, "utf-8");
+    source = readFileSync29(absPath, "utf-8");
   } catch (err) {
     return toolError(
       `Cannot read file ${absPath}: ${err instanceof Error ? err.message : String(err)}`
@@ -62215,7 +63016,7 @@ function errorResponse(id, code, message, data2) {
   return { jsonrpc: "2.0", id, error: { code, message, ...data2 !== void 0 ? { data: data2 } : {} } };
 }
 async function runMcpServer(input, output, cwd) {
-  return new Promise((resolve42) => {
+  return new Promise((resolve43) => {
     let buffer = "";
     input.setEncoding("utf-8");
     input.on("data", (chunk) => {
@@ -62253,8 +63054,8 @@ async function runMcpServer(input, output, cwd) {
         nlIdx = buffer.indexOf("\n");
       }
     });
-    input.on("end", () => resolve42());
-    input.on("close", () => resolve42());
+    input.on("end", () => resolve43());
+    input.on("close", () => resolve43());
   });
 }
 
@@ -62278,7 +63079,7 @@ function registerDoctor(program) {
 
 // src/cli/commands/watch.ts
 init_watch();
-import { resolve as resolve18 } from "path";
+import { resolve as resolve19 } from "path";
 function registerWatch(program, scanAction) {
   program.command("watch").description("re-run scan on every file change. Flags new violations as you write. The LockBrick prevention loop entry.").action(async (_cmdOptions, command) => {
     const rawGlobals = command.optsWithGlobals();
@@ -62286,7 +63087,7 @@ function registerWatch(program, scanAction) {
       ...rawGlobals,
       noIncrease: rawGlobals.increase === false
     };
-    const cwd = resolve18(options.workspace ?? process.cwd());
+    const cwd = resolve19(options.workspace ?? process.cwd());
     await scanAction([], options, command);
     await watchProject(options, cwd, []);
   });
@@ -62294,11 +63095,11 @@ function registerWatch(program, scanAction) {
 
 // src/cli/commands/lock.ts
 init_logger();
-import { resolve as resolve19 } from "path";
+import { resolve as resolve20 } from "path";
 function registerLock(program) {
   program.command("lock").description("install a Git pre-commit hook that runs `slopbrick scan --staged` on every commit. The LockBrick prevention loop: block AI-introduced slop from ever reaching the repo.").option("--uninstall", "remove the pre-commit hook instead of installing it").option("--husky", "force-install under .husky/pre-commit (Husky v9). Default auto-detects via .husky/ dir.").option("--workspace <path>", "workspace directory", process.cwd()).action(
     (cmdOptions) => {
-      const cwd = resolve19(cmdOptions.workspace ?? process.cwd());
+      const cwd = resolve20(cmdOptions.workspace ?? process.cwd());
       if (cmdOptions.uninstall) {
         const result2 = uninstallHook(cwd);
         logger.info(result2.message);
@@ -62321,7 +63122,7 @@ function registerLock(program) {
 // src/cli/commands/ci.ts
 init_logger();
 init_dist();
-import { resolve as resolve20 } from "path";
+import { resolve as resolve21 } from "path";
 function registerCi(program, scanAction) {
   program.command("ci").description("CI gate: run a scan and exit 1 on constitution violations, threshold breach, or new issues since the last run. Use this in GitHub Actions / GitLab CI.").option("--max-slop <n>", "exit 1 if slopIndex exceeds this number", parseCount).option("--max-new-issues <n>", "exit 1 if new issues (vs .slop-audit-cache.json) exceed this number", parseCount).option("--strict-constitution", "exit 1 on any constitution violation").option("--format <pretty|json>", "output format", "json").action(
     async (cmdOptions, command) => {
@@ -62334,7 +63135,7 @@ function registerCi(program, scanAction) {
         // scan only changed files
         format: cmdOptions.format ?? "json"
       };
-      const cwd = resolve20(options.workspace ?? process.cwd());
+      const cwd = resolve21(options.workspace ?? process.cwd());
       await scanAction([], options, command);
       const health = loadHealth(cwd);
       if (!health) {
@@ -62363,11 +63164,11 @@ function registerCi(program, scanAction) {
 
 // src/cli/commands/memory.ts
 init_logger();
-import { resolve as resolve21 } from "path";
+import { resolve as resolve22 } from "path";
 function registerMemory(program) {
   program.command("memory").description("show or regenerate .slopbrick/structure.md (the agent-readable repository summary) without re-scanning").option("--show", "print the current .slopbrick/structure.md to stdout (default if no flag is passed)").option("--regenerate", "re-render structure.md from the existing inventory.json + constitution.json (no scan)").option("--workspace <path>", "workspace directory", process.cwd()).action(
     async (cmdOptions) => {
-      const cwd = resolve21(cmdOptions.workspace ?? process.cwd());
+      const cwd = resolve22(cmdOptions.workspace ?? process.cwd());
       const { renderStructureMarkdown: renderStructureMarkdown2, readStructureMarkdown: readStructureMarkdown2, writeStructureMarkdown: writeStructureMarkdown2 } = await Promise.resolve().then(() => (init_structure_md(), structure_md_exports));
       const { loadInventory: loadInventory2, loadConstitution: loadConstitution2, inventoryPath: invPath, constitutionPath: conPath } = await Promise.resolve().then(() => (init_dist(), dist_exports));
       if (cmdOptions.regenerate) {
@@ -62398,48 +63199,48 @@ function registerMemory(program) {
 
 // src/cli/commands/migrate.ts
 init_logger();
-import { resolve as resolve22 } from "path";
+import { resolve as resolve23 } from "path";
 
 // src/cli/migrate.ts
 init_logger();
-import { existsSync as existsSync23, readFileSync as readFileSync28, renameSync as renameSync4, writeFileSync as writeFileSync13 } from "fs";
-import { join as join25 } from "path";
+import { existsSync as existsSync25, readFileSync as readFileSync30, renameSync as renameSync4, writeFileSync as writeFileSync15 } from "fs";
+import { join as join27 } from "path";
 function planMigration(workspaceDir) {
   const moves = [];
   const rewrites = [];
   const gitignoreEdits = [];
-  const oldDir = join25(workspaceDir, ".slop-audit");
-  const newDir = join25(workspaceDir, ".slopbrick");
-  if (existsSync23(oldDir)) {
+  const oldDir = join27(workspaceDir, ".slop-audit");
+  const newDir = join27(workspaceDir, ".slopbrick");
+  if (existsSync25(oldDir)) {
     moves.push({ from: oldDir, to: newDir, kind: "dir" });
     rewrites.push({
-      path: join25(newDir, "inventory.json"),
+      path: join27(newDir, "inventory.json"),
       field: "version",
       from: '"1"',
       to: '"2"'
     });
     rewrites.push({
-      path: join25(newDir, "constitution.json"),
+      path: join27(newDir, "constitution.json"),
       field: "version",
       from: '"1"',
       to: '"2"'
     });
   }
-  const oldCache = join25(workspaceDir, ".slop-audit-cache.json");
-  const newCache = join25(workspaceDir, ".slopbrick-cache.json");
-  if (existsSync23(oldCache)) {
+  const oldCache = join27(workspaceDir, ".slop-audit-cache.json");
+  const newCache = join27(workspaceDir, ".slopbrick-cache.json");
+  if (existsSync25(oldCache)) {
     moves.push({ from: oldCache, to: newCache, kind: "file" });
   }
   for (const ext of ["mjs", "cjs", "js"]) {
-    const oldCfg = join25(workspaceDir, `slop-audit.config.${ext}`);
-    const newCfg = join25(workspaceDir, `slopbrick.config.${ext}`);
-    if (existsSync23(oldCfg)) {
+    const oldCfg = join27(workspaceDir, `slop-audit.config.${ext}`);
+    const newCfg = join27(workspaceDir, `slopbrick.config.${ext}`);
+    if (existsSync25(oldCfg)) {
       moves.push({ from: oldCfg, to: newCfg, kind: "config" });
     }
   }
-  const gi = join25(workspaceDir, ".gitignore");
-  if (existsSync23(gi)) {
-    const content = readFileSync28(gi, "utf-8");
+  const gi = join27(workspaceDir, ".gitignore");
+  if (existsSync25(gi)) {
+    const content = readFileSync30(gi, "utf-8");
     if (content.includes(".slop-audit/")) {
       gitignoreEdits.push({
         path: gi,
@@ -62458,7 +63259,7 @@ function planMigration(workspaceDir) {
   return { moves, rewrites, gitignoreEdits };
 }
 function isAlreadyMigrated(workspaceDir) {
-  return existsSync23(join25(workspaceDir, ".slopbrick")) && !existsSync23(join25(workspaceDir, ".slop-audit"));
+  return existsSync25(join27(workspaceDir, ".slopbrick")) && !existsSync25(join27(workspaceDir, ".slop-audit"));
 }
 function applyMigration(plan, options = {}) {
   if (options.dryRun) return;
@@ -62466,20 +63267,20 @@ function applyMigration(plan, options = {}) {
     renameSync4(m.from, m.to);
   }
   for (const r of plan.rewrites) {
-    if (!existsSync23(r.path)) continue;
-    const content = readFileSync28(r.path, "utf-8");
+    if (!existsSync25(r.path)) continue;
+    const content = readFileSync30(r.path, "utf-8");
     const next = content.replace(`"version": ${r.from}`, `"version": ${r.to}`);
-    writeFileSync13(r.path, next);
+    writeFileSync15(r.path, next);
   }
   for (const g of plan.gitignoreEdits) {
-    const content = readFileSync28(g.path, "utf-8");
+    const content = readFileSync30(g.path, "utf-8");
     const next = content.replaceAll(g.from, g.to);
-    writeFileSync13(g.path, next);
+    writeFileSync15(g.path, next);
   }
 }
 function runMigrate(options) {
   const { workspace, dryRun = false, force = false } = options;
-  if (!existsSync23(workspace)) {
+  if (!existsSync25(workspace)) {
     return {
       ok: false,
       alreadyMigrated: false,
@@ -62489,9 +63290,9 @@ function runMigrate(options) {
     };
   }
   const alreadyMigrated = isAlreadyMigrated(workspace);
-  const newDir = join25(workspace, ".slopbrick");
-  const oldDir = join25(workspace, ".slop-audit");
-  if (existsSync23(newDir) && existsSync23(oldDir) && !force) {
+  const newDir = join27(workspace, ".slopbrick");
+  const oldDir = join27(workspace, ".slop-audit");
+  if (existsSync25(newDir) && existsSync25(oldDir) && !force) {
     return {
       ok: false,
       alreadyMigrated: false,
@@ -62567,7 +63368,7 @@ function registerMigrate(program) {
     (cmdOptions, command) => {
       const globals = command.optsWithGlobals();
       const format = (cmdOptions.format ?? globals.format) === "json" ? "json" : "pretty";
-      const cwd = resolve22(cmdOptions.workspace ?? process.cwd());
+      const cwd = resolve23(cmdOptions.workspace ?? process.cwd());
       const result = runMigrate({
         workspace: cwd,
         dryRun: cmdOptions.dryRun,
@@ -62673,12 +63474,12 @@ function registerRules(program) {
 // src/cli/commands/validate-config.ts
 init_logger();
 init_validation();
-import { existsSync as existsSync24 } from "fs";
-import { extname as extname8, resolve as resolve23 } from "path";
+import { existsSync as existsSync26 } from "fs";
+import { extname as extname8, resolve as resolve24 } from "path";
 function registerValidateConfig(program) {
   program.command("validate-config [path]").description("Statically validate a slopbrick.config.mjs without scanning").action(async (configPath) => {
-    const path = configPath ? resolve23(configPath) : resolve23(process.cwd(), "slopbrick.config.mjs");
-    if (!existsSync24(path)) {
+    const path = configPath ? resolve24(configPath) : resolve24(process.cwd(), "slopbrick.config.mjs");
+    if (!existsSync26(path)) {
       logger.error(`Error: config file not found: ${path}`);
       process.exit(2);
     }
@@ -62904,8 +63705,8 @@ ${formatMarkdown(result.report)}`);
 
 // src/cli/commands/calibrate.ts
 init_logger();
-import { mkdirSync as mkdirSync13, writeFileSync as writeFileSync16 } from "fs";
-import { dirname as dirname18, resolve as resolve25 } from "path";
+import { mkdirSync as mkdirSync14, writeFileSync as writeFileSync18 } from "fs";
+import { dirname as dirname19, resolve as resolve26 } from "path";
 
 // src/research/providers/openai.ts
 var OpenAiProvider = class {
@@ -62960,8 +63761,8 @@ function createProvider(config) {
 }
 
 // src/research/generator.ts
-import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync14 } from "fs";
-import { join as join26 } from "path";
+import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync16 } from "fs";
+import { join as join28 } from "path";
 
 // src/research/prompts.ts
 var DEFAULT_PROMPT_TEMPLATES = [
@@ -63024,14 +63825,14 @@ async function generateSamples(options) {
   }
   const samples = [];
   const ext = extForFramework(framework);
-  const dir = join26(outputDir, framework, componentType);
-  mkdirSync11(dir, { recursive: true });
+  const dir = join28(outputDir, framework, componentType);
+  mkdirSync12(dir, { recursive: true });
   for (let i = 1; i <= count; i += 1) {
     const raw = await provider.generateSample(renderPrompt(template), { temperature });
     const code = extractCodeFromMarkdown(raw);
     const fileName = `sample-${i}${ext}`;
-    const filePath = join26(dir, fileName);
-    writeFileSync14(filePath, code, "utf8");
+    const filePath = join28(dir, fileName);
+    writeFileSync16(filePath, code, "utf8");
     const sample = {
       filePath,
       framework,
@@ -63042,8 +63843,8 @@ async function generateSamples(options) {
     };
     samples.push(sample);
   }
-  const metadataPath = join26(dir, "metadata.json");
-  writeFileSync14(metadataPath, JSON.stringify(samples, null, 2), "utf8");
+  const metadataPath = join28(dir, "metadata.json");
+  writeFileSync16(metadataPath, JSON.stringify(samples, null, 2), "utf8");
   return samples;
 }
 
@@ -63249,46 +64050,46 @@ function slugify(value) {
 
 // src/research/calibrator.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync25, readFileSync as readFileSync29, writeFileSync as writeFileSync15, mkdirSync as mkdirSync12 } from "fs";
-import { join as join28, resolve as resolve24 } from "path";
+import { existsSync as existsSync27, readFileSync as readFileSync31, writeFileSync as writeFileSync17, mkdirSync as mkdirSync13 } from "fs";
+import { join as join30, resolve as resolve25 } from "path";
 
 // src/corpus-paths.ts
-import { join as join27 } from "path";
+import { join as join29 } from "path";
 var CORPUS_ROOT = process.env["SLOPBRICK_CORPUS_DIR"] ?? "/Users/cheng/corpus-expansion";
-var POSITIVE_DIR = join27(CORPUS_ROOT, "positive");
-var NEGATIVE_DIR = join27(CORPUS_ROOT, "negative");
-var FILELISTS_DIR = join27(CORPUS_ROOT, "filelists");
+var POSITIVE_DIR = join29(CORPUS_ROOT, "positive");
+var NEGATIVE_DIR = join29(CORPUS_ROOT, "negative");
+var FILELISTS_DIR = join29(CORPUS_ROOT, "filelists");
 
 // src/research/calibrator.ts
 var DEFAULT_POSITIVE = POSITIVE_DIR;
 var DEFAULT_NEGATIVE = NEGATIVE_DIR;
 function buildFileList(dir, extensions) {
-  const tmpList = join28("/tmp", `cal-build-${Date.now()}-${Math.random().toString(36).slice(2)}.txt`);
+  const tmpList = join30("/tmp", `cal-build-${Date.now()}-${Math.random().toString(36).slice(2)}.txt`);
   const expr = extensions.map((e) => `-name '*.${e}'`).join(" -o ");
   execFileSync2("bash", ["-c", `find ${dir} -maxdepth 8 -type f \\( ${expr} \\) -print0 | xargs -0 realpath > ${tmpList}`]);
-  const out = readFileSync29(tmpList, "utf8");
+  const out = readFileSync31(tmpList, "utf8");
   execFileSync2("rm", ["-f", tmpList]);
   return out.trim().split("\n").filter(Boolean);
 }
 function runScan2(fileListPath) {
-  const files = readFileSync29(fileListPath, "utf8").trim().split("\n").filter(Boolean);
+  const files = readFileSync31(fileListPath, "utf8").trim().split("\n").filter(Boolean);
   const CHUNK = 600;
   const ruleFires = /* @__PURE__ */ new Map();
   const uniqueFilesPerRule = /* @__PURE__ */ new Map();
   let fileCount = 0;
-  const tmpOut = join28("/tmp", `calibrate-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
+  const tmpOut = join30("/tmp", `calibrate-${Date.now()}-${Math.random().toString(36).slice(2)}.json`);
   for (let i = 0; i < files.length; i += CHUNK) {
     const chunk = files.slice(i, i + CHUNK);
     try {
       execFileSync2(
         "node",
-        [join28(process.cwd(), "bin", "slopbrick.js"), "scan", ...chunk, "--json", tmpOut, "--no-telemetry", "--quiet"],
+        [join30(process.cwd(), "bin", "slopbrick.js"), "scan", ...chunk, "--json", tmpOut, "--no-telemetry", "--quiet"],
         { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }
       );
     } catch {
     }
-    if (!existsSync25(tmpOut)) continue;
-    const report = JSON.parse(readFileSync29(tmpOut, "utf8"));
+    if (!existsSync27(tmpOut)) continue;
+    const report = JSON.parse(readFileSync31(tmpOut, "utf8"));
     fileCount += report.fileCount;
     for (const issue of report.issues) {
       ruleFires.set(issue.ruleId, (ruleFires.get(issue.ruleId) ?? 0) + 1);
@@ -63316,16 +64117,16 @@ function classify(posFiles, negFiles) {
 async function calibrate(cwd, options = {}) {
   const positiveDir = options.positiveDir ?? DEFAULT_POSITIVE;
   const negativeDir = options.negativeDir ?? DEFAULT_NEGATIVE;
-  if (!existsSync25(positiveDir)) throw new Error(`Positive corpus not found: ${positiveDir}`);
-  if (!existsSync25(negativeDir)) throw new Error(`Negative corpus not found: ${negativeDir}`);
+  if (!existsSync27(positiveDir)) throw new Error(`Positive corpus not found: ${positiveDir}`);
+  if (!existsSync27(negativeDir)) throw new Error(`Negative corpus not found: ${negativeDir}`);
   const positiveFiles = buildFileList(positiveDir, ["tsx", "ts", "jsx", "js"]);
   const negativeFiles = buildFileList(negativeDir, ["tsx", "ts"]);
   const posSample = options.positiveLimit ? positiveFiles.slice(0, options.positiveLimit) : positiveFiles;
   const negSample = options.negativeLimit ? negativeFiles.slice(0, options.negativeLimit) : negativeFiles;
-  const posListPath = join28("/tmp", `cal-pos-${Date.now()}.txt`);
-  const negListPath = join28("/tmp", `cal-neg-${Date.now()}.txt`);
-  writeFileSync15(posListPath, posSample.join("\n"));
-  writeFileSync15(negListPath, negSample.join("\n"));
+  const posListPath = join30("/tmp", `cal-pos-${Date.now()}.txt`);
+  const negListPath = join30("/tmp", `cal-neg-${Date.now()}.txt`);
+  writeFileSync17(posListPath, posSample.join("\n"));
+  writeFileSync17(negListPath, negSample.join("\n"));
   const builtins = await Promise.resolve().then(() => (init_builtins(), builtins_exports));
   const builtinRules2 = builtins.builtinRules ?? [];
   const metaById = /* @__PURE__ */ new Map();
@@ -63439,9 +64240,9 @@ function registerCalibrate(program) {
         positiveLimit: cmdOptions.positiveLimit,
         negativeLimit: cmdOptions.negativeLimit
       });
-      const outputPath = cmdOptions.output ? resolve25(cwd, cmdOptions.output) : resolve25(cwd, "corpus", "calibration-empirical.md");
-      mkdirSync13(dirname18(outputPath), { recursive: true });
-      writeFileSync16(outputPath, reportToMarkdown(report), "utf8");
+      const outputPath = cmdOptions.output ? resolve26(cwd, cmdOptions.output) : resolve26(cwd, "corpus", "calibration-empirical.md");
+      mkdirSync14(dirname19(outputPath), { recursive: true });
+      writeFileSync18(outputPath, reportToMarkdown(report), "utf8");
       logger.info(
         "Calibrated " + report.rules.length + " rules across " + report.positiveFileCount + " positive + " + report.negativeFileCount + " negative files."
       );
@@ -63580,13 +64381,13 @@ function registerTrend(program) {
 // src/cli/commands/drift.ts
 init_logger();
 init_scan2();
-import { resolve as resolve26 } from "path";
+import { resolve as resolve27 } from "path";
 
 // src/cli/drift.ts
 init_discover();
 init_patterns();
 init_telemetry();
-import { readFileSync as readFileSync30 } from "fs";
+import { readFileSync as readFileSync32 } from "fs";
 import { basename as basename4, relative as relative16 } from "path";
 async function runDrift(cwd, config, options = {}) {
   const maxFiles = options.maxFiles ?? 1e3;
@@ -63598,7 +64399,7 @@ async function runDrift(cwd, config, options = {}) {
   for (const absPath of limited) {
     let source;
     try {
-      source = readFileSync30(absPath, "utf-8");
+      source = readFileSync32(absPath, "utf-8");
     } catch {
       continue;
     }
@@ -63885,7 +64686,7 @@ function registerDrift(program) {
       const options = command.optsWithGlobals();
       const rawFormat = options.format ?? cmdOptions.format ?? "pretty";
       const format = rawFormat === "json" || rawFormat === "pretty" ? rawFormat : "pretty";
-      const cwd = resolve26(options.workspace ?? process.cwd());
+      const cwd = resolve27(options.workspace ?? process.cwd());
       if (cmdOptions.temporalSince !== void 0) {
         const temporalSince = cmdOptions.temporalSince.trim();
         if (temporalSince.length === 0) {
@@ -63913,7 +64714,7 @@ function registerDrift(program) {
 // src/cli/commands/pr.ts
 init_logger();
 init_scan2();
-import { resolve as resolve28 } from "path";
+import { resolve as resolve29 } from "path";
 
 // src/cli/pr.ts
 init_git();
@@ -63921,8 +64722,8 @@ init_worker();
 init_metrics();
 init_patterns();
 init_discover();
-import { readFileSync as readFileSync31 } from "fs";
-import { extname as extname9, relative as relative17, resolve as resolve27 } from "path";
+import { readFileSync as readFileSync33 } from "fs";
+import { extname as extname9, relative as relative17, resolve as resolve28 } from "path";
 import { execFile as execFileCb } from "child_process";
 import { promisify as promisify2 } from "util";
 import { minimatch as minimatch3 } from "minimatch";
@@ -63963,7 +64764,7 @@ async function discoverPrFiles(cwd, config, base, head, maxFiles) {
   if (gitFiles.length === 0) return [];
   const sourceFiles = [];
   for (const relOrAbs of gitFiles) {
-    const abs = resolve27(cwd, relOrAbs);
+    const abs = resolve28(cwd, relOrAbs);
     const ext = extname9(abs).toLowerCase();
     if (!PR_EXTENSIONS.has(ext)) continue;
     const rel = relative17(cwd, abs).split("\\").join("/");
@@ -63994,7 +64795,7 @@ async function runPrScan(cwd, config, options = {}) {
   for (const absPath of candidates) {
     let source;
     try {
-      source = readFileSync31(absPath, "utf-8");
+      source = readFileSync33(absPath, "utf-8");
     } catch {
       continue;
     }
@@ -64169,20 +64970,135 @@ function formatPrMarkdown(result) {
 function prExitCode(result) {
   return result.totalScore > result.threshold ? 1 : 0;
 }
+function parseUnifiedDiffPaths(diff) {
+  const paths = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const line of diff.split(/\r?\n/)) {
+    const m = /^\+\+\+\s+(?:b\/)?(\S.*)$/.exec(line);
+    if (!m) continue;
+    const path = m[1];
+    if (path === "/dev/null" || path === "dev/null") continue;
+    if (seen.has(path)) continue;
+    seen.add(path);
+    paths.push(path);
+  }
+  return paths;
+}
+async function runPrScanFromDiffFile(cwd, config, diffPath, options = {}) {
+  const threshold = options.threshold ?? config.prScoreThreshold ?? 20;
+  const maxFiles = options.maxFiles ?? 500;
+  const { existsSync: existsSync32, readFileSync: readFileSync42 } = await import("fs");
+  const { isAbsolute: isAbsolute4, resolve: resolvePath } = await import("path");
+  if (!existsSync32(diffPath)) {
+    throw new Error(`Diff file not found: ${diffPath}`);
+  }
+  const diffAbs = isAbsolute4(diffPath) ? diffPath : resolvePath(cwd, diffPath);
+  const diff = readFileSync42(diffAbs, "utf-8");
+  const changedPaths = parseUnifiedDiffPaths(diff);
+  if (changedPaths.length === 0) {
+    return emptyPrResult(threshold);
+  }
+  return scoreChangedPaths(cwd, config, changedPaths, maxFiles, threshold);
+}
+async function scoreChangedPaths(cwd, config, paths, maxFiles, threshold) {
+  const { existsSync: existsSync32, statSync: statSync8 } = await import("fs");
+  const { resolve: resolvePath } = await import("path");
+  const { readFile: readFile4 } = await import("fs/promises");
+  const { scanFile: scanFile2 } = await Promise.resolve().then(() => (init_worker(), worker_exports));
+  const limited = paths.slice(0, maxFiles);
+  const files = [];
+  let totalScore = 0;
+  const byCategory = {};
+  const bySeverity = { low: 0, medium: 0, high: 0 };
+  let constitutionViolations = 0;
+  for (const rel of limited) {
+    const abs = resolvePath(cwd, rel);
+    if (!existsSync32(abs) || !statSync8(abs).isFile()) continue;
+    let source;
+    try {
+      source = await readFile4(abs, "utf-8");
+    } catch {
+      continue;
+    }
+    let result;
+    try {
+      result = await scanFile2(abs, config, void 0, cwd);
+    } catch {
+      continue;
+    }
+    if (result.parseError) continue;
+    const issues = result.issues;
+    let slopPoints = 0;
+    const issueEntries = [];
+    for (const issue of issues) {
+      slopPoints += SEVERITY_WEIGHTS[issue.severity] ?? 0;
+      byCategory[issue.category] = (byCategory[issue.category] ?? 0) + 1;
+      bySeverity[issue.severity] = (bySeverity[issue.severity] ?? 0) + 1;
+      issueEntries.push({
+        ruleId: issue.ruleId,
+        severity: issue.severity,
+        line: issue.line,
+        category: issue.category,
+        message: issue.message
+      });
+    }
+    totalScore += slopPoints;
+    files.push({
+      file: abs,
+      relPath: rel,
+      score: slopPoints,
+      issueCount: issueEntries.length,
+      constitutionViolationCount: 0,
+      slopPoints,
+      issues: issueEntries,
+      constitutionViolations: []
+    });
+  }
+  return {
+    base: "diff",
+    head: "diff",
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    passed: totalScore <= threshold,
+    threshold,
+    totalScore,
+    filesChanged: files.length,
+    byCategory,
+    bySeverity,
+    files
+  };
+}
+function emptyPrResult(threshold) {
+  return {
+    base: "diff",
+    head: "diff",
+    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    passed: true,
+    threshold,
+    totalScore: 0,
+    filesChanged: 0,
+    byCategory: {},
+    bySeverity: { low: 0, medium: 0, high: 0 },
+    files: []
+  };
+}
 
 // src/cli/commands/pr.ts
 function registerPr(program) {
   program.command("pr").description(
     "Score the slop cost of the current PR. Compares --base (default: main) to --head (default: HEAD), scans only changed source files, returns a single weighted score. Exits 1 when score > --threshold (default 20)."
-  ).option("--base <ref>", "base git ref to diff from", "main").option("--head <ref>", "head git ref to diff to", "HEAD").option("--format <text|json|markdown>", "output format", "text").option("--threshold <n>", "score threshold (overrides config.prScoreThreshold)", parseThreshold).option("--max-files <n>", "cap on files scanned", parseCount, 500).action(
+  ).option("--base <ref>", "base git ref to diff from", "main").option("--head <ref>", "head git ref to diff to", "HEAD").option("--format <text|json|markdown>", "output format", "text").option("--threshold <n>", "score threshold (overrides config.prScoreThreshold)", parseThreshold).option("--max-files <n>", "cap on files scanned", parseCount, 500).option("--diff <file>", "unified-diff file (overrides --base/--head; meant for CI/Action use)").action(
     async (cmdOptions, command) => {
       try {
         const options = command.optsWithGlobals();
-        const cwd = resolve28(options.workspace ?? process.cwd());
+        const cwd = resolve29(options.workspace ?? process.cwd());
         const rawFormat = options.format ?? cmdOptions.format ?? "text";
         const format = rawFormat === "json" || rawFormat === "markdown" || rawFormat === "text" ? rawFormat : "text";
         const { config } = await runScan({ ...options, workspace: cwd });
-        const result = await runPrScan(cwd, config, {
+        const result = cmdOptions.diff ? await runPrScanFromDiffFile(cwd, config, cmdOptions.diff, {
+          format,
+          threshold: cmdOptions.threshold,
+          maxFiles: cmdOptions.maxFiles
+        }) : await runPrScan(cwd, config, {
           base: cmdOptions.base,
           head: cmdOptions.head,
           format,
@@ -64203,7 +65119,7 @@ function registerPr(program) {
 init_logger();
 init_scan2();
 init_ai_security_risk();
-import { resolve as resolve29 } from "path";
+import { resolve as resolve30 } from "path";
 function registerSecurity(program) {
   program.command("security").description(
     "AI Security Risk \u2014 categorical severity for security findings disproportionately introduced by AI-generated code"
@@ -64213,7 +65129,7 @@ function registerSecurity(program) {
         const options = command.optsWithGlobals();
         const rawFormat = options.format ?? cmdOptions.format ?? "pretty";
         const format = rawFormat === "json" || rawFormat === "pretty" ? rawFormat : "pretty";
-        const cwd = resolve29(options.workspace ?? process.cwd());
+        const cwd = resolve30(options.workspace ?? process.cwd());
         const { report } = await runScan({ ...options, workspace: cwd });
         const securityIssues = report.issues.filter((i) => i.category === "security");
         const { risk, findings } = computeAiSecurityRisk(securityIssues);
@@ -64261,13 +65177,13 @@ function registerSecurity(program) {
 // src/cli/commands/test.ts
 init_logger();
 init_scan2();
-import { resolve as resolve31 } from "path";
+import { resolve as resolve32 } from "path";
 
 // src/cli/test.ts
 init_scan2();
 init_test_quality();
 init_logger();
-import { resolve as resolve30 } from "path";
+import { resolve as resolve31 } from "path";
 var TEST_INCLUDE_GLOBS = [
   "**/*.test.{ts,tsx,js,jsx}",
   "**/*.spec.{ts,tsx,js,jsx}",
@@ -64335,7 +65251,7 @@ function formatTestReport(result, opts = {}) {
     const sortedFiles = [...byFile.keys()].sort();
     for (const file of sortedFiles) {
       const issues = byFile.get(file) ?? [];
-      const rel = file.startsWith(resolve30(process.cwd())) ? file : file;
+      const rel = file.startsWith(resolve31(process.cwd())) ? file : file;
       lines.push("");
       lines.push(`  ${rel}`);
       for (const issue of issues.slice(0, 20)) {
@@ -64364,7 +65280,7 @@ function registerTest(program) {
         const options = command.optsWithGlobals();
         const rawFormat = options.format ?? cmdOptions.format ?? "pretty";
         const format = rawFormat === "json" || rawFormat === "pretty" ? rawFormat : "pretty";
-        const cwd = resolve31(options.workspace ?? process.cwd());
+        const cwd = resolve32(options.workspace ?? process.cwd());
         const { config } = await runScan({ ...options, workspace: cwd });
         const { result } = await runTestScan(cwd, config, { strict: options.strict });
         logger.info(formatTestReport(result, { json: format === "json" }));
@@ -64381,7 +65297,7 @@ function registerTest(program) {
 init_logger();
 init_scan2();
 init_architecture_score();
-import { resolve as resolve32 } from "path";
+import { resolve as resolve33 } from "path";
 function registerArchitecture(program) {
   program.command("architecture").description(
     "compute the Architecture Consistency Score (0-100) \u2014 one number for cross-file pattern duplication"
@@ -64391,7 +65307,7 @@ function registerArchitecture(program) {
         const options = command.optsWithGlobals();
         const rawFormat = options.format ?? cmdOptions.format ?? "pretty";
         const format = rawFormat === "json" || rawFormat === "pretty" ? rawFormat : "pretty";
-        const cwd = resolve32(options.workspace ?? process.cwd());
+        const cwd = resolve33(options.workspace ?? process.cwd());
         const { config } = await runScan({ ...options, workspace: cwd });
         const score = await buildArchitectureScore(cwd, config, cmdOptions.maxFiles);
         const out = format === "json" ? JSON.stringify(score, null, 2) : formatArchitectureScore(score);
@@ -64408,12 +65324,12 @@ function registerArchitecture(program) {
 // src/cli/commands/business-logic.ts
 init_logger();
 init_scan2();
-import { resolve as resolve33 } from "path";
+import { resolve as resolve34 } from "path";
 
 // src/cli/business-logic.ts
 init_discover();
 init_business_logic();
-import { readFileSync as readFileSync32 } from "fs";
+import { readFileSync as readFileSync34 } from "fs";
 import { relative as relative18 } from "path";
 async function runBusinessLogicScan(cwd, config, options = {}) {
   const maxFiles = options.maxFiles ?? 500;
@@ -64424,7 +65340,7 @@ async function runBusinessLogicScan(cwd, config, options = {}) {
   for (const absPath of limited) {
     let source;
     try {
-      source = readFileSync32(absPath, "utf-8");
+      source = readFileSync34(absPath, "utf-8");
     } catch {
       continue;
     }
@@ -64536,7 +65452,7 @@ function registerBusinessLogic(program) {
         const options = command.optsWithGlobals();
         const rawFormat = options.format ?? cmdOptions.format ?? "text";
         const format = rawFormat === "json" || rawFormat === "markdown" || rawFormat === "text" ? rawFormat : "text";
-        const cwd = resolve33(options.workspace ?? process.cwd());
+        const cwd = resolve34(options.workspace ?? process.cwd());
         const { config } = await runScan({ ...options, workspace: cwd });
         const result = await runBusinessLogicScan(cwd, config, {
           maxFiles: cmdOptions.maxFiles
@@ -64554,7 +65470,7 @@ function registerBusinessLogic(program) {
 // src/cli/commands/maintenance-cost.ts
 init_logger();
 init_scan2();
-import { resolve as resolve34 } from "path";
+import { resolve as resolve35 } from "path";
 
 // src/cli/maintenance-cost.ts
 init_scan2();
@@ -64678,7 +65594,7 @@ function registerMaintenanceCost(program) {
         const rawFormat = options.format ?? cmdOptions.format ?? "text";
         const format = rawFormat === "json" || rawFormat === "text" ? rawFormat : "text";
         const strict = options.strict ?? cmdOptions.strict ?? false;
-        const cwd = resolve34(options.workspace ?? process.cwd());
+        const cwd = resolve35(options.workspace ?? process.cwd());
         const { config } = await runScan({ ...options, workspace: cwd });
         const result = await runMaintenanceCostScan(cwd, config, {
           maxFiles: cmdOptions.maxFiles,
@@ -64697,7 +65613,7 @@ function registerMaintenanceCost(program) {
 // src/cli/commands/docs.ts
 init_logger();
 init_scan2();
-import { resolve as resolve35 } from "path";
+import { resolve as resolve36 } from "path";
 
 // src/cli/docs.ts
 init_scan2();
@@ -64822,7 +65738,7 @@ function registerDocs(program) {
         const rawFormat = options.format ?? cmdOptions.format ?? "text";
         const format = rawFormat === "json" || rawFormat === "markdown" || rawFormat === "text" ? rawFormat : "text";
         const strict = options.strict ?? cmdOptions.strict ?? false;
-        const cwd = resolve35(options.workspace ?? process.cwd());
+        const cwd = resolve36(options.workspace ?? process.cwd());
         const { config } = await runScan({ ...options, workspace: cwd });
         const result = await runDocsScan(cwd, config, {
           maxDocFiles: cmdOptions.maxFiles,
@@ -64846,7 +65762,7 @@ function registerDocs(program) {
 // src/cli/commands/db.ts
 init_logger();
 init_scan2();
-import { resolve as resolve36 } from "path";
+import { resolve as resolve37 } from "path";
 
 // src/cli/db.ts
 init_scan2();
@@ -64965,7 +65881,7 @@ function registerDb(program) {
         const rawFormat = options.format ?? cmdOptions.format ?? "text";
         const format = rawFormat === "json" || rawFormat === "markdown" || rawFormat === "text" ? rawFormat : "text";
         const strict = options.strict ?? cmdOptions.strict ?? false;
-        const cwd = resolve36(options.workspace ?? process.cwd());
+        const cwd = resolve37(options.workspace ?? process.cwd());
         const { config } = await runScan({ ...options, workspace: cwd });
         const result = await runDbScan(cwd, config, {
           maxFiles: cmdOptions.maxFiles,
@@ -64989,12 +65905,12 @@ function registerDb(program) {
 // src/cli/commands/patterns.ts
 init_logger();
 init_scan2();
-import { resolve as resolve37 } from "path";
+import { resolve as resolve38 } from "path";
 
 // src/engine/patterns.ts
 init_patterns();
 init_discover();
-import { readFileSync as readFileSync33 } from "fs";
+import { readFileSync as readFileSync35 } from "fs";
 import { basename as basename5, relative as relative19 } from "path";
 var PATTERN_CATEGORIES = [
   "modal",
@@ -65097,7 +66013,7 @@ function detectFormsFromFiles(files) {
   for (const f of files) {
     let source;
     try {
-      source = readFileSync33(f, "utf-8");
+      source = readFileSync35(f, "utf-8");
     } catch {
       continue;
     }
@@ -65318,7 +66234,7 @@ function registerPatterns(program) {
         const options = command.optsWithGlobals();
         const rawFormat = options.format ?? cmdOptions.format ?? "text";
         const format = rawFormat === "json" || rawFormat === "markdown" || rawFormat === "text" ? rawFormat : "text";
-        const cwd = resolve37(options.workspace ?? process.cwd());
+        const cwd = resolve38(options.workspace ?? process.cwd());
         const { config } = await runScan({ ...options, workspace: cwd });
         const result = await runPatternsScan(cwd, config, {
           maxFiles: cmdOptions.maxFiles,
@@ -65337,8 +66253,8 @@ function registerPatterns(program) {
 // src/cli/commands/research.ts
 init_logger();
 init_config2();
-import { existsSync as existsSync26, mkdirSync as mkdirSync14, readFileSync as readFileSync34, writeFileSync as writeFileSync17 } from "fs";
-import { dirname as dirname19, resolve as resolve38 } from "path";
+import { existsSync as existsSync28, mkdirSync as mkdirSync15, readFileSync as readFileSync36, writeFileSync as writeFileSync19 } from "fs";
+import { dirname as dirname20, resolve as resolve39 } from "path";
 function registerResearch(program) {
   const research = program.command("research").description("research commands for the AI UI learning loop");
   research.command("generate").description("generate synthetic UI samples").requiredOption("--count <n>", "number of samples", parseCount).requiredOption("--framework <name>", "target framework").requiredOption("--component-type <type>", "component type").requiredOption("--provider <name>", "AI provider (openai)").option("--api-key <key>", "API key for provider").option("--model <name>", "model name").option("--temperature <n>", "sampling temperature", parseFloat, 0.7).option("--output-dir <path>", "output directory", ".slopbrick/corpus/generated").action(async (cmdOptions) => {
@@ -65353,24 +66269,24 @@ function registerResearch(program) {
       framework: cmdOptions.framework,
       componentType: cmdOptions.componentType,
       provider,
-      outputDir: resolve38(cmdOptions.outputDir),
+      outputDir: resolve39(cmdOptions.outputDir),
       temperature: cmdOptions.temperature
     });
     logger.info(`Generated ${samples.length} samples in ${cmdOptions.outputDir}`);
   });
   research.command("analyze").description("analyze generated samples and report coverage").requiredOption("--input-dir <path>", "directory with generated samples containing metadata.json").option("--output <path>", "analysis output path", ".slopbrick/flywheel/analysis.json").option("--config <path>", "slopbrick config path").option("--framework <name>", "framework multiplier to apply", "react").action(async (cmdOptions) => {
     try {
-      const metadataPath = resolve38(cmdOptions.inputDir, "metadata.json");
-      if (!existsSync26(metadataPath)) {
+      const metadataPath = resolve39(cmdOptions.inputDir, "metadata.json");
+      if (!existsSync28(metadataPath)) {
         logger.error(`No metadata.json found in ${cmdOptions.inputDir}`);
         process.exit(2);
       }
-      const samples = JSON.parse(readFileSync34(metadataPath, "utf8"));
+      const samples = JSON.parse(readFileSync36(metadataPath, "utf8"));
       const config = cmdOptions.config ? await loadConfig(cmdOptions.config) : { ...DEFAULT_CONFIG, framework: cmdOptions.framework };
       const analysis = await analyzeSamples(samples, config);
-      const outputPath = resolve38(cmdOptions.output);
-      mkdirSync14(dirname19(outputPath), { recursive: true });
-      writeFileSync17(outputPath, JSON.stringify(analysis, null, 2), "utf8");
+      const outputPath = resolve39(cmdOptions.output);
+      mkdirSync15(dirname20(outputPath), { recursive: true });
+      writeFileSync19(outputPath, JSON.stringify(analysis, null, 2), "utf8");
       logger.info(`Analyzed ${analysis.summary.total} samples; coverage: ${analysis.summary.coverage}%`);
       logger.info(`Wrote analysis to ${outputPath}`);
     } catch (error) {
@@ -65380,12 +66296,12 @@ function registerResearch(program) {
   });
   research.command("candidates").description("extract patterns from generated samples and emit candidate rules").requiredOption("--input-dir <path>", "directory with generated samples containing metadata.json").option("--output <path>", "output path", ".slopbrick/flywheel/rule-candidates.json").option("--config <path>", "slopbrick config path").option("--framework <name>", "framework multiplier to apply", "react").option("--min-frequency <n>", "minimum cluster frequency", parseCount, 2).option("--include-covered", "include samples already covered by AI-specific rules").action(async (cmdOptions) => {
     try {
-      const metadataPath = resolve38(cmdOptions.inputDir, "metadata.json");
-      if (!existsSync26(metadataPath)) {
+      const metadataPath = resolve39(cmdOptions.inputDir, "metadata.json");
+      if (!existsSync28(metadataPath)) {
         logger.error(`No metadata.json found in ${cmdOptions.inputDir}`);
         process.exit(2);
       }
-      const samples = JSON.parse(readFileSync34(metadataPath, "utf8"));
+      const samples = JSON.parse(readFileSync36(metadataPath, "utf8"));
       const config = cmdOptions.config ? await loadConfig(cmdOptions.config) : { ...DEFAULT_CONFIG, framework: cmdOptions.framework };
       const analysis = await analyzeSamples(samples, config);
       const extraction = extractAndCluster(analysis.samples, {
@@ -65395,8 +66311,8 @@ function registerResearch(program) {
       const candidates = clustersToCandidates(extraction.clusters, {
         minFrequency: cmdOptions.minFrequency
       });
-      const outputPath = resolve38(cmdOptions.output);
-      mkdirSync14(dirname19(outputPath), { recursive: true });
+      const outputPath = resolve39(cmdOptions.output);
+      mkdirSync15(dirname20(outputPath), { recursive: true });
       const payload = {
         generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
         sampleCount: analysis.summary.total,
@@ -65404,7 +66320,7 @@ function registerResearch(program) {
         fingerprintCount: extraction.total,
         candidates
       };
-      writeFileSync17(outputPath, JSON.stringify(payload, null, 2), "utf8");
+      writeFileSync19(outputPath, JSON.stringify(payload, null, 2), "utf8");
       logger.info(`Extracted ${extraction.total} fingerprints across ${analysis.summary.total} samples`);
       logger.info(`Wrote ${candidates.length} candidate rule(s) to ${outputPath}`);
     } catch (error) {
@@ -65417,8 +66333,8 @@ function registerResearch(program) {
 // src/cli/commands/init.ts
 init_logger();
 init_builtins();
-import { existsSync as existsSync27, mkdirSync as mkdirSync15, readFileSync as readFileSync35, writeFileSync as writeFileSync18 } from "fs";
-import { dirname as dirname20, join as join30, resolve as resolve39 } from "path";
+import { existsSync as existsSync29, mkdirSync as mkdirSync16, readFileSync as readFileSync37, writeFileSync as writeFileSync20 } from "fs";
+import { dirname as dirname21, join as join32, resolve as resolve40 } from "path";
 init_scan2();
 init_config2();
 init_threshold();
@@ -65426,145 +66342,9 @@ init_git();
 init_cache();
 
 // src/snippet/targets.ts
-import { join as join29 } from "path";
-
-// src/snippet/render.ts
-function aiSpecificRules(rules) {
-  return rules.filter((r) => r.aiSpecific).sort((a, b) => a.id.localeCompare(b.id));
-}
-function categorizeRules(rules) {
-  const byCategory = /* @__PURE__ */ new Map();
-  for (const r of rules) {
-    const list = byCategory.get(r.category) ?? [];
-    list.push(r);
-    byCategory.set(r.category, list);
-  }
-  for (const list of byCategory.values()) {
-    list.sort((a, b) => a.id.localeCompare(b.id));
-  }
-  return byCategory;
-}
-function baseContent(rules, toolLabel, intro) {
-  const lines = [];
-  lines.push("# " + toolLabel);
-  lines.push("");
-  lines.push(intro);
-  lines.push("");
-  const ai = aiSpecificRules(rules);
-  const byCategory = categorizeRules(ai);
-  lines.push("## Category-level directives");
-  lines.push("");
-  for (const [category, directive] of Object.entries(CATEGORY_DIRECTIVES)) {
-    lines.push("- **" + category + "**: " + directive);
-  }
-  lines.push("");
-  lines.push("## Per-rule directives");
-  lines.push("");
-  for (const [category, list] of byCategory) {
-    lines.push("### " + category);
-    lines.push("");
-    for (const rule of list) {
-      const hint = RULE_HINTS[rule.id] ?? "Avoid patterns that fire rule `" + rule.id + "`.";
-      lines.push("- `" + rule.id + "` (" + rule.severity + "): " + hint);
-    }
-    lines.push("");
-  }
-  return lines.join("\n");
-}
-
-// src/snippet/generators.ts
-function generateCursorSnippet(rules) {
-  const lines = [];
-  lines.push("# slopbrick cursor rules");
-  lines.push("");
-  lines.push("Generated by `slopbrick init --cursor`. These rules describe patterns that slopbrick");
-  lines.push("flags as AI-generated frontend slop. Avoid them when writing code in this project.");
-  lines.push("");
-  lines.push("## Category-level directives");
-  lines.push("");
-  for (const [category, directive] of Object.entries(CATEGORY_DIRECTIVES)) {
-    lines.push("- **" + category + "**: " + directive);
-  }
-  lines.push("");
-  lines.push("## Per-rule directives");
-  lines.push("");
-  const ai = aiSpecificRules(rules);
-  const byCategory = categorizeRules(ai);
-  for (const [category, list] of byCategory) {
-    lines.push("### " + category);
-    lines.push("");
-    for (const rule of list) {
-      const hint = RULE_HINTS[rule.id] ?? "Avoid patterns that fire rule `" + rule.id + "`.";
-      lines.push("- **`" + rule.id + "`** (" + rule.severity + "): " + hint);
-    }
-    lines.push("");
-  }
-  lines.push("## Verification");
-  lines.push("");
-  lines.push("After writing code, run `slopbrick scan` and check for issues in any of the categories above.");
-  lines.push("Use `slopbrick fix` for auto-fixable rules. Use `slopbrick mcp` from MCP-aware clients to query rules and scan files programmatically.");
-  lines.push("");
-  return lines.join("\n");
-}
-function generateAgentsMdSnippet(rules) {
-  return baseContent(
-    rules,
-    "AGENTS.md",
-    "Generated by `slopbrick init --agents-md`. Read these directives when writing or modifying code in this project. AGENTS.md is the de facto standard read by OpenAI Codex, opencode, Pi, Cline, Continue, Gemini, Claude Code (fallback), and others."
-  ) + "## How to verify\n\nAfter editing code, run `slopbrick scan`. Any issue with a category in this file is something to fix.\n";
-}
-function generateClaudeMdSnippet(rules) {
-  return baseContent(
-    rules,
-    "CLAUDE.md",
-    "Generated by `slopbrick init --claude-md`. Read this file at the start of every Claude Code session in this project. CLAUDE.md takes precedence over AGENTS.md for Claude Code."
-  ) + "## Verification\n\nRun `slopbrick scan` after edits. If MCP is configured (`slopbrick mcp`), use `slop_scan_file` proactively to check before reporting code as done.\n";
-}
-function generateAiderSnippet(rules) {
-  return baseContent(
-    rules,
-    "CONVENTIONS.md",
-    "Generated by `slopbrick init --aider`. Aider reads CONVENTIONS.md (not AGENTS.md) for project conventions."
-  );
-}
-function generateWindsurfSnippet(rules) {
-  return baseContent(
-    rules,
-    ".windsurfrules",
-    "Generated by `slopbrick init --windsurf`. Windsurf Cascade reads .windsurfrules at project root."
-  );
-}
-function generateClineRules(rules) {
-  return baseContent(
-    rules,
-    "AGENTS.md",
-    "Generated by `slopbrick init --cline`. Cline reads .clinerules/AGENTS.md from the project root."
-  );
-}
-function generateCursorrulesLegacySnippet(rules) {
-  return baseContent(
-    rules,
-    ".cursorrules",
-    "Generated by `slopbrick init --cursorrules`. This is the legacy Cursor rule format. Prefer `.cursor/rules/slopbrick.mdc` (use --cursor) for new projects."
-  );
-}
-function generateGeminiSnippet(rules) {
-  return baseContent(
-    rules,
-    "GEMINI.md",
-    "Generated by `slopbrick init --gemini`. Gemini CLI reads .gemini/GEMINI.md from project root."
-  );
-}
-function generateCopilotSnippet(rules) {
-  return baseContent(
-    rules,
-    "copilot-instructions.md",
-    "Generated by `slopbrick init --copilot`. GitHub Copilot reads .github/copilot-instructions.md from project root."
-  );
-}
-
-// src/snippet/targets.ts
-var SNIPPET_TARGETS = [
+init_generators();
+import { join as join31 } from "path";
+var SNIPPET_TARGETS2 = [
   {
     flag: "cursor",
     cliName: "--cursor",
@@ -65657,7 +66437,7 @@ var SNIPPET_TARGETS = [
   }
 ];
 function resolveTargetPath(target) {
-  return target.isFolder ? join29(target.path, target.filename) : target.path;
+  return target.isFolder ? join31(target.path, target.filename) : target.path;
 }
 function renderMatrix() {
   const lines = [];
@@ -65665,7 +66445,7 @@ function renderMatrix() {
   lines.push("");
   lines.push("| Flag | File | Agent |");
   lines.push("|------|------|-------|");
-  for (const t of SNIPPET_TARGETS) {
+  for (const t of SNIPPET_TARGETS2) {
     lines.push("| `" + t.cliName + "` | `" + resolveTargetPath(t) + "` | " + t.agent + " |");
   }
   return lines.join("\n");
@@ -65679,13 +66459,13 @@ function registerInit(program) {
       logger.info(renderMatrix());
       process.exit(0);
     }
-    const cwd = resolve39(options.workspace ?? process.cwd());
-    const configPath = join30(cwd, "slopbrick.config.mjs");
+    const cwd = resolve40(options.workspace ?? process.cwd());
+    const configPath = join32(cwd, "slopbrick.config.mjs");
     const detected = detectStack(cwd);
     const fallbackConfig = { ...DEFAULT_CONFIG, ...detected };
     const proposed = serializeConfig(fallbackConfig);
-    if (existsSync27(configPath) && !cmdOptions.yes) {
-      const current = readFileSync35(configPath, "utf8");
+    if (existsSync29(configPath) && !cmdOptions.yes) {
+      const current = readFileSync37(configPath, "utf8");
       logger.error(`A config file already exists at ${configPath}.`);
       logger.error("To overwrite it with defaults, run `slopbrick init --yes`.");
       logger.error("");
@@ -65706,7 +66486,7 @@ function registerInit(program) {
       config = buildInitConfig(detected, answers);
       usedWizard = true;
     }
-    writeFileSync18(configPath, serializeConfig(config));
+    writeFileSync20(configPath, serializeConfig(config));
     appendGitignore(cwd);
     const refresh = await refreshRegistrySnapshot(cwd);
     if (!refresh.ok) {
@@ -65730,27 +66510,27 @@ function registerInit(program) {
       }
       logger.info(refresh.message);
     }
-    const targetsToWrite = SNIPPET_TARGETS.filter((t) => {
+    const targetsToWrite = SNIPPET_TARGETS2.filter((t) => {
       if (cmdOptions.all) return true;
       const opts = cmdOptions;
       return Boolean(opts[t.flag]);
     });
     for (const target of targetsToWrite) {
-      const snippetPath = join30(cwd, resolveTargetPath(target));
-      mkdirSync15(dirname20(snippetPath), { recursive: true });
+      const snippetPath = join32(cwd, resolveTargetPath(target));
+      mkdirSync16(dirname21(snippetPath), { recursive: true });
       const generated = target.generator(builtinRules);
-      if (!target.isFolder && existsSync27(snippetPath)) {
-        const existing = readFileSync35(snippetPath, "utf8");
+      if (!target.isFolder && existsSync29(snippetPath)) {
+        const existing = readFileSync37(snippetPath, "utf8");
         if (existing.includes("<!-- slopbrick:begin -->")) {
           const updated = existing.replace(
             /<!-- slopbrick:begin -->[\s\S]*?<!-- slopbrick:end -->/,
             "<!-- slopbrick:begin -->\n" + generated + "<!-- slopbrick:end -->"
           );
-          writeFileSync18(snippetPath, updated, "utf8");
+          writeFileSync20(snippetPath, updated, "utf8");
           if (!options.quiet) logger.info(`Updated ${snippetPath}`);
           continue;
         }
-        writeFileSync18(
+        writeFileSync20(
           snippetPath,
           existing + (existing.endsWith("\n") ? "\n" : "\n\n") + generated,
           "utf8"
@@ -65758,7 +66538,7 @@ function registerInit(program) {
         if (!options.quiet) logger.info(`Wrote ${snippetPath}`);
         continue;
       }
-      writeFileSync18(snippetPath, generated, "utf8");
+      writeFileSync20(snippetPath, generated, "utf8");
       if (!options.quiet) logger.info(`Wrote ${snippetPath}`);
     }
     if (options.baseline) {
@@ -65778,12 +66558,12 @@ function registerInit(program) {
 // src/cli/commands/flywheel.ts
 init_logger();
 init_telemetry();
-import { mkdirSync as mkdirSync16, writeFileSync as writeFileSync19 } from "fs";
-import { dirname as dirname21, resolve as resolve40 } from "path";
+import { mkdirSync as mkdirSync17, writeFileSync as writeFileSync21 } from "fs";
+import { dirname as dirname22, resolve as resolve41 } from "path";
 
 // src/report/flywheel.ts
-import { existsSync as existsSync28, readFileSync as readFileSync36 } from "fs";
-import { join as join31 } from "path";
+import { existsSync as existsSync30, readFileSync as readFileSync38 } from "fs";
+import { join as join33 } from "path";
 function average(values) {
   if (values.length === 0) return 0;
   return values.reduce((a, b) => a + b, 0) / values.length;
@@ -65873,7 +66653,7 @@ function formatFlywheel(summary, options = {}) {
 function registerFlywheel(program) {
   program.command("flywheel").description("summarize aggregated scan telemetry").option("--format <pretty|json>", "output format", "pretty").option("--export <path>", "write summary as JSON to <path>").action(async (cmdOptions, command) => {
     const options = command.optsWithGlobals();
-    const cwd = resolve40(options.workspace ?? process.cwd());
+    const cwd = resolve41(options.workspace ?? process.cwd());
     const payloads = readTelemetry(cwd);
     if (payloads.length === 0) {
       logger.info("No flywheel telemetry found. Run a scan first.");
@@ -65881,9 +66661,9 @@ function registerFlywheel(program) {
     }
     const summary = summarizeTelemetry(payloads);
     if (cmdOptions.export) {
-      const exportPath = resolve40(cmdOptions.export);
-      mkdirSync16(dirname21(exportPath), { recursive: true });
-      writeFileSync19(exportPath, JSON.stringify(summary, null, 2), "utf-8");
+      const exportPath = resolve41(cmdOptions.export);
+      mkdirSync17(dirname22(exportPath), { recursive: true });
+      writeFileSync21(exportPath, JSON.stringify(summary, null, 2), "utf-8");
       logger.info(`Wrote flywheel summary to ${exportPath}`);
       process.exit(0);
     }
@@ -65910,8 +66690,8 @@ init_dist2();
 init_memory_io();
 
 // src/fix/focus-ring.ts
-import { existsSync as existsSync29 } from "fs";
-import { readFileSync as readFileSync37, writeFileSync as writeFileSync20 } from "fs";
+import { existsSync as existsSync31 } from "fs";
+import { readFileSync as readFileSync39, writeFileSync as writeFileSync22 } from "fs";
 var ANCHOR_START = "/* @slopbrick:v1.0.0:fix:focus-ring */";
 var CSS_BLOCK = `/* @slopbrick:v1.0.0:fix:focus-ring */
 :focus-visible {
@@ -65920,15 +66700,15 @@ var CSS_BLOCK = `/* @slopbrick:v1.0.0:fix:focus-ring */
 }
 /* @slopbrick:v1.0.0:fix:focus-ring-end */`;
 function applyFocusRingFix(targetFile) {
-  if (!existsSync29(targetFile)) {
+  if (!existsSync31(targetFile)) {
     return { applied: false, reason: "missing-global-css-target" };
   }
-  const content = readFileSync37(targetFile, "utf-8");
+  const content = readFileSync39(targetFile, "utf-8");
   if (content.includes(ANCHOR_START)) {
     return { applied: false, reason: "already-present" };
   }
   const separator = content.endsWith("\n") ? "" : "\n";
-  writeFileSync20(targetFile, `${content}${separator}${CSS_BLOCK}
+  writeFileSync22(targetFile, `${content}${separator}${CSS_BLOCK}
 `);
   return { applied: true };
 }
@@ -65937,21 +66717,21 @@ function applyFocusRingFix(targetFile) {
 init_layout_token();
 
 // src/fix/use-client.ts
-import { readFileSync as readFileSync38, writeFileSync as writeFileSync21 } from "fs";
+import { readFileSync as readFileSync40, writeFileSync as writeFileSync23 } from "fs";
 function applyUseClientFix(filePath) {
-  const content = readFileSync38(filePath, "utf-8");
+  const content = readFileSync40(filePath, "utf-8");
   const trimmed = content.trimStart();
   if (trimmed.startsWith("'use client'") || trimmed.startsWith('"use client"')) {
     return { applied: false, reason: "already-present" };
   }
-  writeFileSync21(filePath, `"use client";
+  writeFileSync23(filePath, `"use client";
 
 ${content}`);
   return { applied: true };
 }
 
 // src/fix/visual-codemod.ts
-import { readFileSync as readFileSync39, writeFileSync as writeFileSync22 } from "fs";
+import { readFileSync as readFileSync41, writeFileSync as writeFileSync24 } from "fs";
 
 // src/fix/visual-codemods/tailwind.ts
 var ARBITRARY_ESCAPE_RE = /\b(p|m|px|py|pt|pb|pl|pr|mx|my|mt|mb|ml|mr|gap|space-[xy]|w|h|min-w|max-w|min-h|max-h|text-\w+|leading-\w+|rounded|border)-?\[(-?\d+(?:\.\d+)?)(px|rem|em|%|vh|vw)?\]/g;
@@ -66160,7 +66940,7 @@ var ALL_CODEMODS = [
   { name: "aria-attr-typo", fn: applyAriaAttrTypoCodemod }
 ];
 function applyVisualCodemods(filePath) {
-  const original = readFileSync39(filePath, "utf-8");
+  const original = readFileSync41(filePath, "utf-8");
   let content = original;
   const reasons = [];
   const seen = /* @__PURE__ */ new Set();
@@ -66176,7 +66956,7 @@ function applyVisualCodemods(filePath) {
     }
   }
   if (content !== original) {
-    writeFileSync22(filePath, content);
+    writeFileSync24(filePath, content);
   }
   return {
     filePath,
@@ -66458,12 +67238,12 @@ import * as http from "http";
 import * as https from "https";
 import { URL as URL2 } from "url";
 var sendBeacon = (url, payload, timeoutMs) => {
-  return new Promise((resolve42) => {
+  return new Promise((resolve43) => {
     let parsed;
     try {
       parsed = new URL2(url);
     } catch {
-      resolve42();
+      resolve43();
       return;
     }
     const isHttps = parsed.protocol === "https:";
@@ -66484,7 +67264,7 @@ var sendBeacon = (url, payload, timeoutMs) => {
     const settle = () => {
       if (settled) return;
       settled = true;
-      resolve42();
+      resolve43();
     };
     let req;
     try {
@@ -66564,7 +67344,7 @@ process.on("uncaughtException", (err) => {
 });
 async function runCli({ start }) {
   try {
-    const program = new Command().name("slopbrick").description("Repository Coherence Scanner \u2014 surface AI-induced pattern drift, secret leaks, and design-token violations").version(VERSION).option("--framework <name>", "framework multiplier to apply").option("--include <glob>", "include pattern (repeatable)", collectGlob, []).option("--exclude <glob>", "exclude pattern (repeatable)", collectGlob, []).option("--ai-only", "only report AI-specific issues").option("--human-only", "only report human-facing issues").option("--ignore-wcag22", "ignore WCAG 2.2 related issues").option("--format <pretty|json|sarif|html>", "output format", "pretty").option("--threads <n>", "number of worker threads", parseThreads).option("--since <ref>", "only scan files changed since git ref").option("--diff <ref>", "alias for --since <ref>; also adds PR Slop Score to the report").option("--workspace <path>", "workspace/project path", process.cwd()).option("--tighten", "tighten baseline allowances").option("--fix", "apply auto-fixes").option("--dry-run", "with --fix: print what would change without writing").option("--show-fixes-diff", "print unified diff of proposed auto-fixes").option("--doctor", "run diagnostics").option("--watch", "watch files and re-run").option("--suggest", "print remediation advice").option("--why-failing", "print the top 5 rules dragging the score down").option("--brief", "terse output (verdict + headline + threshold + delta only)").option("--heatmap", "print migration ROI heatmap").option("--quiet", "suppress non-error output").option("--verbose", "enable debug logging (file paths, timings, rule-fire counts)").option("--strict", "exit 2 if any high-severity issue remains").option("--no-increase", "exit 2 if slop index increased since last run").option("--baseline", "save a baseline after this scan").option("--trend [n]", "print a sparkline of the last n runs", parseTrend).option("--json [path]", "write JSON report to path or stdout").option("--html [path]", "write HTML report to path or stdout").option("--staged", "scan only changed files (staged and unstaged)").option("--changed", "scan working-tree changes (staged + unstaged + untracked)").option("--incremental", "skip unchanged files using the persisted hash cache").option("--cache-path <path>", "path to the incremental-scan cache (default: .slopbrick-cache.json)").option("--tokens <path>", "merge tokens.json layout values into the arbitrary-value allowlist").option("--cache", "cache parsed AST results locally").option("--no-color", "suppress ANSI color codes in output").option("--security-only", "run only the security/* rules").option("--full", "show the complete report (all issues, all categories)").option("--report-usage", "opt in to a one-shot usage ping to SLOPBRICK_TELEMETRY_ENDPOINT (no PII)");
+    const program = new Command().name("slopbrick").description("Repository Coherence Scanner \u2014 surface AI-induced pattern drift, secret leaks, and design-token violations").version(VERSION).option("--framework <name>", "framework multiplier to apply").option("--include <glob>", "include pattern (repeatable)", collectGlob, []).option("--exclude <glob>", "exclude pattern (repeatable)", collectGlob, []).option("--ai-only", "only report AI-specific issues").option("--human-only", "only report human-facing issues").option("--ignore-wcag22", "ignore WCAG 2.2 related issues").option("--format <pretty|json|sarif|html>", "output format", "pretty").option("--threads <n>", "number of worker threads", parseThreads).option("--since <ref>", "only scan files changed since git ref").option("--diff <ref>", "alias for --since <ref>; also adds PR Slop Score to the report").option("--workspace <path>", "workspace/project path", process.cwd()).option("--tighten", "tighten baseline allowances").option("--fix", "apply auto-fixes").option("--dry-run", "with --fix: print what would change without writing").option("--show-fixes-diff", "print unified diff of proposed auto-fixes").option("--doctor", "run diagnostics").option("--watch", "watch files and re-run").option("--suggest", "print remediation advice").option("--why-failing", "print the top 5 rules dragging the score down").option("--brief", "terse output (verdict + headline + threshold + delta only)").option("--heatmap", "print migration ROI heatmap").option("--quiet", "suppress non-error output").option("--verbose", "enable debug logging (file paths, timings, rule-fire counts)").option("--strict", "exit 2 if any high-severity issue remains").option("--no-increase", "exit 2 if slop index increased since last run").option("--refresh-snippets", "rewrite the managed slopbrick block in AGENTS.md and CLAUDE.md after a scan").option("--baseline", "save a baseline after this scan").option("--trend [n]", "print a sparkline of the last n runs", parseTrend).option("--json [path]", "write JSON report to path or stdout").option("--html [path]", "write HTML report to path or stdout").option("--staged", "scan only changed files (staged and unstaged)").option("--changed", "scan working-tree changes (staged + unstaged + untracked)").option("--incremental", "skip unchanged files using the persisted hash cache").option("--cache-path <path>", "path to the incremental-scan cache (default: .slopbrick-cache.json)").option("--tokens <path>", "merge tokens.json layout values into the arbitrary-value allowlist").option("--cache", "cache parsed AST results locally").option("--no-color", "suppress ANSI color codes in output").option("--security-only", "run only the security/* rules").option("--full", "show the complete report (all issues, all categories)").option("--report-usage", "opt in to a one-shot usage ping to SLOPBRICK_TELEMETRY_ENDPOINT (no PII)");
     program.helpInformation = () => formatGroupedHelp(program);
     setExitOverride(program);
     registerInit(program);
@@ -66573,6 +67353,7 @@ async function runCli({ start }) {
     registerBadge(program);
     registerSuggest(program);
     registerExplain(program);
+    registerComposite(program);
     registerCalibration(program);
     registerFlywheel(program);
     const scanAction = async (paths, _options, command) => {
@@ -66591,7 +67372,7 @@ async function runCli({ start }) {
         logger.error("--heatmap and --suggest can't be used together. Pick one: a heatmap of severity, or text advice.");
         process.exit(2);
       }
-      const cwd = resolve41(options.workspace ?? process.cwd());
+      const cwd = resolve42(options.workspace ?? process.cwd());
       if (options.trend !== void 0) {
         const runs = await readRuns(cwd, fsMemoryIO);
         if (runs.length === 0) {
@@ -66639,7 +67420,7 @@ async function runCli({ start }) {
         });
       }
       if (options.baseline) {
-        const cwd2 = resolve41(options.workspace ?? process.cwd());
+        const cwd2 = resolve42(options.workspace ?? process.cwd());
         const configHash = hashConfig(config);
         const gitHead = await getGitHead(cwd2) ?? "unknown";
         const cache = buildBaselineCache(report, configHash, gitHead, cwd2);