squadrant 0.26.3 → 0.27.1

package/dist/squadrantd.js

@@ -273,6 +273,7 @@ var init_effort = __esm({
 });
 
 // packages/shared/dist/knowledge.js
+import path4 from "path";
 function validateRuleFrontmatter(fm) {
   if (!isObj(fm))
     return ["frontmatter must be an object"];
@@ -340,19 +341,58 @@ function validateSourceEntry(e) {
     p.push("sensitivity must be 'local-only' when set");
   return p;
 }
+function kbConfigs(cfg) {
+  const out = { ...cfg.knowledge };
+  for (const [kb, c] of Object.entries(cfg.knowledgeBases ?? {}))
+    out[kb] = { ...out[kb], ...c };
+  return out;
+}
+function kbPath(cfg, kb) {
+  return resolveHome(kbConfigs(cfg)[kb]?.path ?? `${DEFAULT_KB_ROOT}/${kb}`);
+}
+function homeKb(cfg, project) {
+  const pc = cfg.projects[project];
+  if (pc?.knowledgeHome?.startsWith("kb:"))
+    return pc.knowledgeHome.slice(3);
+  if (pc?.knowledgeHome)
+    return void 0;
+  return pc?.group ? cfg.groups?.[pc.group]?.kb : void 0;
+}
 function subscribedKbs(cfg, project) {
-  return cfg.projects[project]?.knowledge ?? [];
+  const pc = cfg.projects[project];
+  const group = pc?.group ? cfg.groups?.[pc.group]?.kb : void 0;
+  return [...new Set([group, homeKb(cfg, project), ...pc?.knowledge ?? []].filter((k) => !!k))];
 }
-var RULE_MODALITIES, RULE_STATUSES, SOURCE_PRIORITIES, RULE_APPROVERS, RULE_ID_RE, isObj, isStrArr;
+function projectRulesHome(cfg, project) {
+  const pc = cfg.projects[project];
+  if (pc?.knowledgeHome === "repo:docs")
+    return path4.join(resolveHome(pc.path), "docs", "rules");
+  const kb = homeKb(cfg, project);
+  return kb ? path4.join(kbPath(cfg, kb), "projects", project, "rules") : void 0;
+}
+function resolveKbConfig(cfg, kb) {
+  const explicit = kbConfigs(cfg)[kb] ?? {};
+  const firstSubscriber = Object.keys(cfg.projects).find((p) => subscribedKbs(cfg, p).includes(kb));
+  return {
+    homeProject: explicit.homeProject ?? firstSubscriber,
+    domainCap: explicit.domainCap ?? DEFAULT_DOMAIN_CAP
+  };
+}
+var RULE_MODALITIES, RULE_STATUSES, SOURCE_PRIORITIES, RULE_APPROVERS, RULE_ID_RE, KB_NAME_RE, DEFAULT_DOMAIN_CAP, DEFAULT_RECONCILE, isObj, isStrArr, DEFAULT_KB_ROOT;
 var init_knowledge = __esm({
   "packages/shared/dist/knowledge.js"() {
+    init_config();
     RULE_MODALITIES = ["must", "must-not", "should", "may"];
     RULE_STATUSES = ["proposed", "active", "stale", "retired"];
     SOURCE_PRIORITIES = ["company", "project", "agent"];
     RULE_APPROVERS = ["auto", "reviewer-agent", "human"];
     RULE_ID_RE = /^[a-z0-9]+(?:[.-][a-z0-9]+)*$/;
+    KB_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+    DEFAULT_DOMAIN_CAP = 150;
+    DEFAULT_RECONCILE = { incrementalAfterDays: 7, fullEveryDays: 30, autoApproveConfidence: 0.8 };
     isObj = (v2) => typeof v2 === "object" && v2 !== null && !Array.isArray(v2);
     isStrArr = (v2) => Array.isArray(v2) && v2.every((x) => typeof x === "string");
+    DEFAULT_KB_ROOT = "~/squadrant/kb";
   }
 });
 
@@ -423,22 +463,22 @@ function defaultCmuxConfigPath() {
   return join(homedir(), ".config", "cmux", "cmux.json");
 }
 function ensureSocketAutomation(opts = {}) {
-  const path29 = opts.path ?? defaultCmuxConfigPath();
-  if (!existsSync(path29)) {
-    mkdirSync(dirname(path29), { recursive: true });
-    writeFileSync(path29, MINIMAL_TEMPLATE);
-    return { path: path29, changed: true, alreadySet: false };
+  const path42 = opts.path ?? defaultCmuxConfigPath();
+  if (!existsSync(path42)) {
+    mkdirSync(dirname(path42), { recursive: true });
+    writeFileSync(path42, MINIMAL_TEMPLATE);
+    return { path: path42, changed: true, alreadySet: false };
   }
-  const text = readFileSync(path29, "utf-8");
+  const text = readFileSync(path42, "utf-8");
   const current = parse(text)?.automation?.socketControlMode;
   if (current === AUTOMATION_MODE) {
-    return { path: path29, changed: false, alreadySet: true };
+    return { path: path42, changed: false, alreadySet: true };
   }
   const edits = modify(text, [...SOCKET_CONTROL_MODE_PATH], AUTOMATION_MODE, {
     formattingOptions: { insertSpaces: true, tabSize: 2 }
   });
-  writeFileSync(path29, applyEdits(text, edits));
-  return { path: path29, changed: true, alreadySet: false };
+  writeFileSync(path42, applyEdits(text, edits));
+  return { path: path42, changed: true, alreadySet: false };
 }
 var SOCKET_CONTROL_MODE_PATH, AUTOMATION_MODE, MINIMAL_TEMPLATE;
 var init_cmux_config = __esm({
@@ -588,9 +628,9 @@ import { join as join4 } from "path";
 function defaultStatePath() {
   return join4(homedir3(), ".config", "squadrant", "state", "cmux-autoconfig.json");
 }
-function readState(path29) {
+function readState(path42) {
   try {
-    return JSON.parse(readConfigFileSync(path29));
+    return JSON.parse(readConfigFileSync(path42));
   } catch {
     return {};
   }
@@ -663,13 +703,13 @@ var init_config_version = __esm({
 
 // packages/shared/dist/lib/update-check.js
 import fs2 from "fs";
-import path4 from "path";
+import path5 from "path";
 import os3 from "os";
 import https from "https";
 var UPDATE_CHECK_STATE_PATH, CHECK_INTERVAL_MS, FAILURE_RETRY_MS;
 var init_update_check = __esm({
   "packages/shared/dist/lib/update-check.js"() {
-    UPDATE_CHECK_STATE_PATH = path4.join(os3.homedir(), ".config", "squadrant", "update-check.json");
+    UPDATE_CHECK_STATE_PATH = path5.join(os3.homedir(), ".config", "squadrant", "update-check.json");
     CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
     FAILURE_RETRY_MS = 60 * 60 * 1e3;
   }
@@ -678,9 +718,9 @@ var init_update_check = __esm({
 // packages/shared/dist/lib/git-worktree.js
 import { execFileSync as execFileSync2 } from "child_process";
 import fs3 from "fs";
-import path5 from "path";
+import path6 from "path";
 function worktreePath(repoRoot, worktreeDir, project, name) {
-  return path5.resolve(repoRoot, worktreeDir, `${project}-${name}`);
+  return path6.resolve(repoRoot, worktreeDir, `${project}-${name}`);
 }
 function crewBranch(name) {
   return `crew/${name}`;
@@ -689,9 +729,9 @@ function ensureSpotlightExcluded(repoRoot, worktreeDir) {
   if (process.platform !== "darwin")
     return;
   try {
-    const dir = path5.resolve(repoRoot, worktreeDir);
+    const dir = path6.resolve(repoRoot, worktreeDir);
     fs3.mkdirSync(dir, { recursive: true });
-    const marker = path5.join(dir, ".metadata_never_index");
+    const marker = path6.join(dir, ".metadata_never_index");
     if (!fs3.existsSync(marker))
       fs3.writeFileSync(marker, "");
   } catch {
@@ -755,15 +795,15 @@ function addWorktree(spec) {
   return wt;
 }
 function installWorktreeDependencies(wt) {
-  if (!fs3.existsSync(path5.join(wt, "package.json")))
+  if (!fs3.existsSync(path6.join(wt, "package.json")))
     return;
-  if (fs3.existsSync(path5.join(wt, "pnpm-lock.yaml"))) {
+  if (fs3.existsSync(path6.join(wt, "pnpm-lock.yaml"))) {
     execFileSync2("pnpm", ["-C", wt, "install", "--frozen-lockfile"], { stdio: "pipe" });
-  } else if (fs3.existsSync(path5.join(wt, "yarn.lock"))) {
+  } else if (fs3.existsSync(path6.join(wt, "yarn.lock"))) {
     execFileSync2("yarn", ["install", "--frozen-lockfile"], { cwd: wt, stdio: "pipe" });
-  } else if (fs3.existsSync(path5.join(wt, "package-lock.json"))) {
+  } else if (fs3.existsSync(path6.join(wt, "package-lock.json"))) {
     execFileSync2("npm", ["ci"], { cwd: wt, stdio: "pipe" });
-  } else if (fs3.existsSync(path5.join(wt, "bun.lockb"))) {
+  } else if (fs3.existsSync(path6.join(wt, "bun.lockb"))) {
     execFileSync2("bun", ["install", "--frozen-lockfile"], { cwd: wt, stdio: "pipe" });
   } else {
     process.stderr.write(`worktree ${wt}: package.json present but no lockfile \u2014 dependencies not installed; local typechecks/tests may resolve against the main checkout instead of this worktree.
@@ -782,7 +822,7 @@ function worktreeDirtyFiles(wtPath) {
 }
 function removeGeneratedWorktreeFiles(wtPath) {
   for (const [, file] of worktreeStatus(wtPath).filter(isGeneratedUntracked)) {
-    fs3.rmSync(path5.join(wtPath, file), { force: true });
+    fs3.rmSync(path6.join(wtPath, file), { force: true });
   }
 }
 function removeWorktree(repoRoot, wtPath, opts) {
@@ -806,7 +846,7 @@ var init_resolve_text_input = __esm({
 
 // packages/shared/dist/lib/runtime-sync.js
 import fs5 from "fs";
-import path6 from "path";
+import path7 from "path";
 var init_runtime_sync = __esm({
   "packages/shared/dist/lib/runtime-sync.js"() {
   }
@@ -849,7 +889,7 @@ var init_tool_compat = __esm({
 
 // packages/shared/dist/lib/canonical-source.js
 import fs6 from "fs";
-import path7 from "path";
+import path8 from "path";
 var init_canonical_source = __esm({
   "packages/shared/dist/lib/canonical-source.js"() {
   }
@@ -858,7 +898,7 @@ var init_canonical_source = __esm({
 // packages/shared/dist/lib/daily-logs.js
 import { execSync } from "child_process";
 import fs7 from "fs";
-import path8 from "path";
+import path9 from "path";
 import matter from "gray-matter";
 var init_daily_logs = __esm({
   "packages/shared/dist/lib/daily-logs.js"() {
@@ -941,47 +981,47 @@ function stampAttempt(rec, patch, now) {
 function isStickyAttention(state) {
   return state === "blocked" || state === "review";
 }
-function nextPendingTool(current, ev, now) {
-  if (ev.note === "agent.hook.PreToolUse")
-    return { name: ev.tool ?? "tool", since: now };
-  if (ev.note === "posttooluse" || ev.note === "agent.hook.PostToolUse" || ev.note === "agent.hook.UserPromptSubmit") {
+function nextPendingTool(current, ev2, now) {
+  if (ev2.note === "agent.hook.PreToolUse")
+    return { name: ev2.tool ?? "tool", since: now };
+  if (ev2.note === "posttooluse" || ev2.note === "agent.hook.PostToolUse" || ev2.note === "agent.hook.UserPromptSubmit") {
     return void 0;
   }
   return current;
 }
-function nextPendingMonitor(current, ev, now) {
-  if (ev.note === "agent.hook.PreToolUse" && ev.tool === "Monitor")
+function nextPendingMonitor(current, ev2, now) {
+  if (ev2.note === "agent.hook.PreToolUse" && ev2.tool === "Monitor")
     return { since: now };
   return current;
 }
-function reduce(rec, ev, now) {
-  if (ev.type === "task.reopened") {
-    return { ...rec, state: "working", question: void 0, error: void 0, lastHeartbeat: now, lastEvent: ev.type, workingStretchStartedAt: now };
+function reduce(rec, ev2, now) {
+  if (ev2.type === "task.reopened") {
+    return { ...rec, state: "working", question: void 0, error: void 0, lastHeartbeat: now, lastEvent: ev2.type, workingStretchStartedAt: now };
   }
-  if (ev.type === "crew.takeover.started") {
+  if (ev2.type === "crew.takeover.started") {
     if (rec.operatorHold)
-      return { ...rec, lastHeartbeat: now, lastEvent: ev.type };
+      return { ...rec, lastHeartbeat: now, lastEvent: ev2.type };
     return {
       ...rec,
-      operatorHold: { since: now, ...ev.note !== void 0 ? { note: ev.note } : {} },
+      operatorHold: { since: now, ...ev2.note !== void 0 ? { note: ev2.note } : {} },
       lastHeartbeat: now,
-      lastEvent: ev.type
+      lastEvent: ev2.type
     };
   }
-  if (ev.type === "crew.takeover.ended") {
+  if (ev2.type === "crew.takeover.ended") {
     const { operatorHold: _dropped, ...rest } = rec;
-    return { ...rest, lastHeartbeat: now, lastEvent: ev.type };
+    return { ...rest, lastHeartbeat: now, lastEvent: ev2.type };
   }
   if (TERMINAL_STATES.has(rec.state))
     return rec;
-  const base = { ...rec, lastHeartbeat: now, lastEvent: ev.type };
-  switch (ev.type) {
+  const base = { ...rec, lastHeartbeat: now, lastEvent: ev2.type };
+  switch (ev2.type) {
     case "task.started":
       return {
-        ...stampAttempt(base, { pid: ev.pid }, now),
+        ...stampAttempt(base, { pid: ev2.pid }, now),
         state: "working",
-        pid: ev.pid ?? rec.pid,
-        sessionId: ev.sessionId ?? rec.sessionId,
+        pid: ev2.pid ?? rec.pid,
+        sessionId: ev2.sessionId ?? rec.sessionId,
         question: void 0,
         // resuming after a blocked→reply clears the question
         pendingTool: void 0,
@@ -991,10 +1031,10 @@ function reduce(rec, ev, now) {
         workingStretchStartedAt: now
       };
     case "task.progress": {
-      const pendingTool = nextPendingTool(rec.pendingTool, ev, now);
-      const pendingMonitor = nextPendingMonitor(rec.pendingMonitor, ev, now);
+      const pendingTool = nextPendingTool(rec.pendingTool, ev2, now);
+      const pendingMonitor = nextPendingMonitor(rec.pendingMonitor, ev2, now);
       if (isStickyAttention(rec.state))
-        return { ...rec, lastHeartbeat: now, lastEvent: ev.type, pendingTool, pendingMonitor };
+        return { ...rec, lastHeartbeat: now, lastEvent: ev2.type, pendingTool, pendingMonitor };
       const b = { ...base, pendingTool, pendingMonitor };
       if (rec.state === "awaiting-input" || rec.state === "stalled")
         return { ...stampAttempt(b, {}, now), state: "working" };
@@ -1002,29 +1042,29 @@ function reduce(rec, ev, now) {
     }
     case "heartbeat":
       if (isStickyAttention(rec.state))
-        return { ...rec, lastHeartbeat: now, lastEvent: ev.type };
+        return { ...rec, lastHeartbeat: now, lastEvent: ev2.type };
       if (rec.state === "awaiting-input")
         return { ...base, state: "working" };
       return base;
     case "task.blocked":
       if (rec.state === "blocked")
-        return { ...rec, lastHeartbeat: now, lastEvent: ev.type };
-      return { ...base, state: "blocked", question: ev.question, pendingTool: void 0, pendingMonitor: void 0 };
+        return { ...rec, lastHeartbeat: now, lastEvent: ev2.type };
+      return { ...base, state: "blocked", question: ev2.question, pendingTool: void 0, pendingMonitor: void 0 };
     case "task.review":
-      return { ...base, state: "review", reviewNote: ev.message, pendingTool: void 0, pendingMonitor: void 0 };
+      return { ...base, state: "review", reviewNote: ev2.message, pendingTool: void 0, pendingMonitor: void 0 };
     case "task.done":
-      if (rec.state === "review" && ev.source !== "approve") {
-        return { ...rec, lastHeartbeat: now, lastEvent: ev.type };
+      if (rec.state === "review" && ev2.source !== "approve") {
+        return { ...rec, lastHeartbeat: now, lastEvent: ev2.type };
       }
-      return { ...base, state: "done", resultRef: ev.resultRef, parseWarning: ev.parseWarning };
+      return { ...base, state: "done", resultRef: ev2.resultRef, parseWarning: ev2.parseWarning };
     case "task.failed":
-      return { ...base, state: "failed", error: ev.error, exitCode: ev.exitCode };
+      return { ...base, state: "failed", error: ev2.error, exitCode: ev2.exitCode };
     case "task.cancelled":
       return { ...base, state: "cancelled" };
     case "task.session.ended":
       return { ...base, state: "cancelled" };
     case "task.session":
-      return stampAttempt(base, { resumeRef: ev.resumeRef }, now);
+      return stampAttempt(base, { resumeRef: ev2.resumeRef }, now);
     case "task.turn.started":
       return { ...stampAttempt(base, {}, now), state: "working", pendingTool: void 0, pendingMonitor: void 0 };
     case "task.turn.failed":
@@ -1034,7 +1074,7 @@ function reduce(rec, ev, now) {
     // only the notify message (reduce.ts formatMessage) differs.
     case "task.turn.completed":
       if (isStickyAttention(rec.state))
-        return { ...rec, lastHeartbeat: now, lastEvent: ev.type };
+        return { ...rec, lastHeartbeat: now, lastEvent: ev2.type };
       if (rec.pendingTool || rec.pendingMonitor)
         return stampAttempt(base, {}, now);
       return { ...stampAttempt(base, {}, now), state: "awaiting-input", pendingTool: void 0, pendingMonitor: void 0 };
@@ -1043,14 +1083,14 @@ function reduce(rec, ev, now) {
     // heartbeat-only
     case "task.input.requested":
     case "task.approval.requested":
-      return { ...stampAttempt(base, {}, now), state: "blocked", question: ev.question, pendingTool: void 0, pendingMonitor: void 0 };
+      return { ...stampAttempt(base, {}, now), state: "blocked", question: ev2.question, pendingTool: void 0, pendingMonitor: void 0 };
     case "task.reattached":
       return stampAttempt(base, {}, now);
     case "task.first-turn.confirmed":
       if (rec.firstTurnConfirmedAt) {
         return { ...rec, lastEvent: "task.progress" };
       }
-      return { ...rec, firstTurnConfirmedAt: now, lastEvent: ev.type };
+      return { ...rec, firstTurnConfirmedAt: now, lastEvent: ev2.type };
     case "task.stalled":
     case "task.idle":
     case "task.quiet":
@@ -2537,10 +2577,10 @@ function detectForeignInstall(parsed, thisEntry, registeredEntryExists) {
     isUpgrade: isVersionUpgrade(parsed.daemonEntry, thisEntry)
   };
 }
-function sanitizePathForPlist(path29) {
+function sanitizePathForPlist(path42) {
   const seen = /* @__PURE__ */ new Set();
   const stable = [];
-  for (const p of path29.split(":")) {
+  for (const p of path42.split(":")) {
     if (!p)
       continue;
     if (p.includes("/.claude/plugins/"))
@@ -3639,7 +3679,7 @@ function coalesceBacklog(entries, opts) {
   }
   return decisions;
 }
-function decide(entry, later, opts) {
+function decide(entry, later2, opts) {
   if (entry.kind === "captain.message") {
     if (entry.payload?.source !== "daemon" || !entry.message)
       return { action: "deliver", entry };
@@ -3648,10 +3688,10 @@ function decide(entry, later, opts) {
     const prefix = stalePrefix(Date.parse(entry.ts), opts.now);
     return { action: "deliver", entry: prefix ? { ...entry, message: `${prefix}${entry.message}` } : entry };
   }
-  if (later) {
+  if (later2) {
     if (TRANSIENT_KINDS.has(entry.kind))
       return { action: "skip", entry, reason: "superseded" };
-    if (entry.kind === "task.review" && (later.has("task.review") || Object.keys(TERMINAL_EVENT_STATE).some((k) => later.has(k)))) {
+    if (entry.kind === "task.review" && (later2.has("task.review") || Object.keys(TERMINAL_EVENT_STATE).some((k) => later2.has(k)))) {
       return { action: "skip", entry, reason: "superseded" };
     }
   }
@@ -4297,11 +4337,11 @@ var init_auto_gate = __esm({
 // packages/core/dist/first-turn-spill.js
 import fs9 from "fs";
 import os4 from "os";
-import path9 from "path";
+import path10 from "path";
 function spillOversizedFirstTurn(text, id) {
   if (Buffer.byteLength(text, "utf8") <= FIRST_TURN_INLINE_MAX_BYTES)
     return text;
-  const spillFile = path9.join(os4.tmpdir(), `squadrant-task-${id}.md`);
+  const spillFile = path10.join(os4.tmpdir(), `squadrant-task-${id}.md`);
   fs9.writeFileSync(spillFile, text, "utf8");
   return `Full task is at ${spillFile} \u2014 cat it and follow it exactly.`;
 }
@@ -4411,7 +4451,7 @@ var init_crew_lifecycle = __esm({
 // packages/core/dist/crew-spawn.js
 import fs10 from "fs";
 import os5 from "os";
-import path10 from "path";
+import path11 from "path";
 import { randomUUID as randomUUID3 } from "crypto";
 function ensureSocksDir(dir = CC_SOCKS_DIR) {
   fs10.mkdirSync(dir, { recursive: true, mode: 448 });
@@ -4549,9 +4589,9 @@ async function runCrewSpawn(input, config, deps) {
   }) : proj.path;
   let firstTurnTask = input.task;
   if (input.taskFile && input.taskFile !== "-" && !input.shared) {
-    const absTaskFile = path10.resolve(input.taskFile);
-    const basename = path10.basename(absTaskFile);
-    fs10.copyFileSync(absTaskFile, path10.join(spawnCwd, basename));
+    const absTaskFile = path11.resolve(input.taskFile);
+    const basename = path11.basename(absTaskFile);
+    fs10.copyFileSync(absTaskFile, path11.join(spawnCwd, basename));
     firstTurnTask = `Read ./${basename} to get your task brief, then execute it.`;
   }
   const agentName = requestedAgent;
@@ -4565,7 +4605,7 @@ async function runCrewSpawn(input, config, deps) {
   assertBackendUsable({ backend, agent: agent.name, router: config.defaults.router });
   deps.onBackendResolved?.({ backend });
   if (agentName === "codex") {
-    const codexRoleFile = path10.join(TEMPLATES_DIR, `crew.${agent.templateSuffix}.md`);
+    const codexRoleFile = path11.join(TEMPLATES_DIR, `crew.${agent.templateSuffix}.md`);
     const roleInstructions = fs10.existsSync(codexRoleFile) ? fs10.readFileSync(codexRoleFile, "utf8") : void 0;
     return runCodexInteractiveSpawn({
       project: input.project,
@@ -4582,7 +4622,7 @@ async function runCrewSpawn(input, config, deps) {
       sendCodexFirstTurn: deps.sendCodexFirstTurn
     });
   }
-  const promptFile = path10.join(TEMPLATES_DIR, `crew.${agent.templateSuffix}.md`);
+  const promptFile = path11.join(TEMPLATES_DIR, `crew.${agent.templateSuffix}.md`);
   const interactive = agent.name === "claude" || agent.name === "opencode";
   const crewRole = config.defaults.roles?.crew;
   const configModel = crewRole && crewRole.agent === agent.name ? crewRole.model : void 0;
@@ -4608,7 +4648,7 @@ async function runCrewSpawn(input, config, deps) {
       }
     }
     ensureSocksDir();
-    const messagingSocketPath = path10.join(CC_SOCKS_DIR, `squadrant-${randomUUID3()}.sock`);
+    const messagingSocketPath = path11.join(CC_SOCKS_DIR, `squadrant-${randomUUID3()}.sock`);
     const rec = await deps.dispatchCrew({
       provider: "claude",
       mode: "interactive",
@@ -4821,7 +4861,7 @@ async function runCrewSend(project, name, message, runtime, workspaceId, deps, o
     }
   } catch {
   }
-  const deliver = deps.sendToPane ?? ((pane, msg) => runtime.sendToPane(pane, msg).then(() => ({ delivered: true })));
+  const deliver2 = deps.sendToPane ?? ((pane, msg) => runtime.sendToPane(pane, msg).then(() => ({ delivered: true })));
   const agent = task?.provider;
   const channel = agent ? deps.controlChannels?.find((c) => c.agent === agent) : void 0;
   const mode = channel && agent && deps.controlChannelMode ? deps.controlChannelMode(agent) : "off";
@@ -4851,7 +4891,7 @@ async function runCrewSend(project, name, message, runtime, workspaceId, deps, o
       channelLog(`crew send ${name}: threw, falling back to pane \u2014 ${e.message}`);
       probe = { status: "gone" };
     }
-    const { delivered: paneOk, blockedByModal: paneModal } = await deliver(crew, message);
+    const { delivered: paneOk, blockedByModal: paneModal } = await deliver2(crew, message);
     const channelWouldSay = probe.status === "reachable" ? "deliverable" : probe.status;
     if (paneOk !== (probe.status === "reachable")) {
       channelLog(`crew send ${name}: DISAGREEMENT \u2014 pane=${paneOk ? "delivered" : "not delivered"}, channel=${channelWouldSay}`);
@@ -4865,7 +4905,7 @@ async function runCrewSend(project, name, message, runtime, workspaceId, deps, o
     }
     return { reopened };
   }
-  const { delivered, blockedByModal } = await deliver(crew, message);
+  const { delivered, blockedByModal } = await deliver2(crew, message);
   if (blockedByModal) {
     throw new Error(blockedByModalMessage());
   }
@@ -4886,7 +4926,7 @@ function buildRecoveryHint(sessId, provider, worktreeCwd) {
     return "";
   if (provider === "claude") {
     const escaped = worktreeCwd.replace(/[^a-zA-Z0-9]/g, "-");
-    const transcriptPath = path10.join(os5.homedir(), ".claude", "projects", escaped, `${sessId}.jsonl`);
+    const transcriptPath = path11.join(os5.homedir(), ".claude", "projects", escaped, `${sessId}.jsonl`);
     return `
 transcript: ${transcriptPath}
 resume:     claude --resume ${sessId}   (run from the worktree path above)
@@ -4995,8 +5035,8 @@ var init_crew_spawn = __esm({
     init_crew_protocol();
     init_crew_lifecycle();
     CC_SOCKS_DIR = "/tmp/cc-socks";
-    TEMPLATES_DIR = path10.join(os5.homedir(), ".config", "squadrant", "templates");
-    STATE_ROOT = path10.join(os5.homedir(), ".config", "squadrant", "state");
+    TEMPLATES_DIR = path11.join(os5.homedir(), ".config", "squadrant", "templates");
+    STATE_ROOT = path11.join(os5.homedir(), ".config", "squadrant", "state");
     FIRST_TURN_HOOK_CONFIRM_GRACE_MS = 15e3;
     FIRST_TURN_HOOK_CONFIRM_MAX_MS = 18e4;
     FIRST_TURN_HOOK_POLL_INTERVAL_MS = 2e3;
@@ -5080,11 +5120,11 @@ var init_captain_record = __esm({
 // packages/core/dist/opencode-session.js
 import { execFileSync as execFileSync4 } from "child_process";
 async function listSessions(port, fetchImpl = fetch, timeoutMs = 5e3) {
-  for (const path29 of ["/session", "/api/session"]) {
+  for (const path42 of ["/session", "/api/session"]) {
     const ac = new AbortController();
     const t = setTimeout(() => ac.abort(), timeoutMs);
     try {
-      const res = await fetchImpl(`http://127.0.0.1:${port}${path29}`, { signal: ac.signal });
+      const res = await fetchImpl(`http://127.0.0.1:${port}${path42}`, { signal: ac.signal });
       if (!res.ok)
         continue;
       const rows = await res.json();
@@ -5777,10 +5817,10 @@ function distBuiltAt() {
     return 0;
   }
 }
-function gatherLogStats(path29, now, windowMs) {
+function gatherLogStats(path42, now, windowMs) {
   let sizeBytes = 0;
   try {
-    sizeBytes = statSync3(path29).size;
+    sizeBytes = statSync3(path42).size;
   } catch {
     return { errorCount: 0, sizeBytes: 0, windowMs };
   }
@@ -5791,7 +5831,7 @@ function gatherLogStats(path29, now, windowMs) {
   const len = sizeBytes - start;
   let text = "";
   try {
-    const fd = openSync2(path29, "r");
+    const fd = openSync2(path42, "r");
     try {
       const buf = Buffer.alloc(len);
       readSync(fd, buf, 0, len, start);
@@ -6122,6 +6162,7 @@ function startDaemon(ctx, opts, pkgVersion) {
         const projects = new Set(entries.filter((e) => e.endsWith(".log")).map((e) => e.slice(0, -".log".length)));
         for (const project of projects)
           await rotateIfNeeded({ stateRoot, project, ...mboxCfg });
+        await opts.knowledgeTick?.();
       } catch (e) {
         log(`rotation timer error: ${e.message}`);
       } finally {
@@ -6199,7 +6240,7 @@ var init_start = __esm({
 // packages/core/dist/session-freshness.js
 import crypto from "crypto";
 import fs11 from "fs";
-import path11 from "path";
+import path12 from "path";
 function loadSessions(sessionsPath) {
   try {
     return JSON.parse(readConfigFileSync(sessionsPath));
@@ -6212,17 +6253,17 @@ function saveSessions(sessionsPath, sessions) {
 }
 function computeTemplateHash(role, templatesDir) {
   const hash = crypto.createHash("sha256");
-  const roleFile = path11.join(templatesDir, `${role}.claude.md`);
-  const legacyRoleFile = path11.join(templatesDir, `${role}.CLAUDE.md`);
+  const roleFile = path12.join(templatesDir, `${role}.claude.md`);
+  const legacyRoleFile = path12.join(templatesDir, `${role}.CLAUDE.md`);
   if (fs11.existsSync(roleFile)) {
     hash.update(fs11.readFileSync(roleFile, "utf-8"));
   } else if (fs11.existsSync(legacyRoleFile)) {
     hash.update(fs11.readFileSync(legacyRoleFile, "utf-8"));
   }
-  const pluginSkillsDir = path11.join(templatesDir, "..", "plugin", "skills");
+  const pluginSkillsDir = path12.join(templatesDir, "..", "plugin", "skills");
   if (fs11.existsSync(pluginSkillsDir)) {
     for (const skill of fs11.readdirSync(pluginSkillsDir).sort()) {
-      const skillFile = path11.join(pluginSkillsDir, skill, "SKILL.md");
+      const skillFile = path12.join(pluginSkillsDir, skill, "SKILL.md");
       if (fs11.existsSync(skillFile)) {
         hash.update(fs11.readFileSync(skillFile, "utf-8"));
       }
@@ -6529,32 +6570,32 @@ var init_ensure_captain = __esm({
 function topicName(project) {
   return project;
 }
-function formatLifecycle(project, ev) {
-  switch (ev.type) {
+function formatLifecycle(project, ev2) {
+  switch (ev2.type) {
     case "task.done":
-      return `\u2705 [${project}] CREW DONE \xB7 ${ev.id}` + (ev.message ? `
-${ev.message}` : "");
+      return `\u2705 [${project}] CREW DONE \xB7 ${ev2.id}` + (ev2.message ? `
+${ev2.message}` : "");
     case "task.blocked":
-      return `\u{1F6A7} [${project}] CREW BLOCKED \xB7 ${ev.id}
-${ev.question}`;
+      return `\u{1F6A7} [${project}] CREW BLOCKED \xB7 ${ev2.id}
+${ev2.question}`;
     case "task.review":
-      return `\u{1F440} [${project}] CREW REVIEW \xB7 ${ev.id}` + (ev.message ? `
-${ev.message}` : "");
+      return `\u{1F440} [${project}] CREW REVIEW \xB7 ${ev2.id}` + (ev2.message ? `
+${ev2.message}` : "");
     case "task.idle":
-      return `\u{1F4A4} [${project}] CREW IDLE \xB7 ${ev.id}`;
+      return `\u{1F4A4} [${project}] CREW IDLE \xB7 ${ev2.id}`;
     case "task.failed":
-      return `\u274C [${project}] CREW FAILED \xB7 ${ev.id}
-${ev.error}`;
+      return `\u274C [${project}] CREW FAILED \xB7 ${ev2.id}
+${ev2.error}`;
     case "task.approval.requested":
-      return `\u{1F510} [${project}] APPROVAL NEEDED \xB7 ${ev.id}
-${ev.question}`;
+      return `\u{1F510} [${project}] APPROVAL NEEDED \xB7 ${ev2.id}
+${ev2.question}`;
     case "task.input.requested":
-      return `\u2753 [${project}] INPUT NEEDED \xB7 ${ev.id}
-${ev.question}`;
+      return `\u2753 [${project}] INPUT NEEDED \xB7 ${ev2.id}
+${ev2.question}`;
     case "task.timeout":
-      return `\u23F1\uFE0F [${project}] CREW TIMEOUT \xB7 ${ev.id}`;
+      return `\u23F1\uFE0F [${project}] CREW TIMEOUT \xB7 ${ev2.id}`;
     default:
-      return `\u2139\uFE0F [${project}] ${ev.type} \xB7 ${ev.id}`;
+      return `\u2139\uFE0F [${project}] ${ev2.type} \xB7 ${ev2.id}`;
   }
 }
 function formatInbound(text) {
@@ -6608,9 +6649,9 @@ var init_format = __esm({
 });
 
 // packages/core/dist/telegram/state.js
-import path12 from "path";
+import path13 from "path";
 function statePath(stateRoot) {
-  return path12.join(stateRoot, "telegram-state.json");
+  return path13.join(stateRoot, "telegram-state.json");
 }
 function topicKey(project, scope = "project") {
   return `${project}::${scope}`;
@@ -7104,7 +7145,7 @@ var init_tiers = __esm({
 // packages/core/dist/telegram/bridge.js
 import fs12 from "fs";
 import os6 from "os";
-import path13 from "path";
+import path14 from "path";
 import crypto2 from "crypto";
 function formatInboundReceipt(project, outcome) {
   if (!outcome)
@@ -7123,7 +7164,7 @@ function formatInboundReceipt(project, outcome) {
 }
 function telegramPollLockPath(token) {
   const hash = crypto2.createHash("sha256").update(token).digest("hex").slice(0, 16);
-  return path13.join(os6.tmpdir(), `squadrant-telegram-poll-${hash}.lock`);
+  return path14.join(os6.tmpdir(), `squadrant-telegram-poll-${hash}.lock`);
 }
 function pidAlive(pid) {
   try {
@@ -7227,7 +7268,7 @@ function notifyToggle(text) {
 function createTelegramBridge(opts) {
   const { cfg, stateRoot, client, appendCaptainMessage: appendCaptainMessage2, log, ensureCaptainAlive, runCommand, sendReply } = opts;
   const lifecycle = opts.lifecycle;
-  const configRoot = opts.configRoot ?? path13.join(os6.homedir(), ".config", "squadrant");
+  const configRoot = opts.configRoot ?? path14.join(os6.homedir(), ".config", "squadrant");
   const pollMs = cfg.pollMs ?? 1e3;
   const schedule = opts.schedule ?? defaultSchedule2;
   const lockToken = cfg.botToken ?? process.env.TELEGRAM_BOT_TOKEN;
@@ -7249,16 +7290,16 @@ function createTelegramBridge(opts) {
     const { topicId } = await runTelegramLink({ project, cfg, client, stateRoot });
     await client.sendMessage(cfg.supergroupId, topicId, text);
   }
-  async function deliverOutbound(project, ev) {
+  async function deliverOutbound(project, ev2) {
     const resolved = resolveNotify(cfg.notify, loadProjectOverride(project, configRoot));
     const live = loadState(stateRoot).notify[project];
     const active = live ?? resolved.active;
     if (!active)
       return;
-    if (!tierIncludes(resolved.crew, ev.type))
+    if (!tierIncludes(resolved.crew, ev2.type))
       return;
-    let text = formatLifecycle(project, ev);
-    if ((ev.type === "task.done" || ev.type === "task.failed") && opts.usageFor) {
+    let text = formatLifecycle(project, ev2);
+    if ((ev2.type === "task.done" || ev2.type === "task.failed") && opts.usageFor) {
       const usage2 = opts.usageFor(project);
       if (usage2 && usage2.requests > 0)
         text += `
@@ -7368,14 +7409,14 @@ ${formatUsageLine(usage2)}`;
   }
   function currentEffort() {
     try {
-      return loadConfig(path13.join(configRoot, "config.json")).defaults.effort ?? "balance";
+      return loadConfig(path14.join(configRoot, "config.json")).defaults.effort ?? "balance";
     } catch {
       return "balance";
     }
   }
   function projectNames() {
     try {
-      return Object.keys(loadConfig(path13.join(configRoot, "config.json")).projects);
+      return Object.keys(loadConfig(path14.join(configRoot, "config.json")).projects);
     } catch {
       return [];
     }
@@ -7677,8 +7718,8 @@ ${formatUsageLine(usage2)}`;
       releasePollLock?.();
       releasePollLock = null;
     },
-    pushLifecycle(project, ev) {
-      void deliverOutbound(project, ev).catch((e) => {
+    pushLifecycle(project, ev2) {
+      void deliverOutbound(project, ev2).catch((e) => {
         log(`telegram outbound failed project=${project}: ${e.message}`);
       });
     },
@@ -8036,8 +8077,8 @@ var init_stream = __esm({
 // packages/core/dist/router/shim.js
 import { createServer as createServer3 } from "http";
 import { Readable } from "stream";
-function joinUrl(base, path29) {
-  return base.replace(/\/+$/, "") + path29;
+function joinUrl(base, path42) {
+  return base.replace(/\/+$/, "") + path42;
 }
 async function readBody(req) {
   const chunks = [];
@@ -8213,8 +8254,8 @@ function createRouterShim(opts) {
     writeJson(res, 200, { input_tokens: Math.max(1, Math.ceil(text.length / 4)) });
   }
   function handler(req, res) {
-    const path29 = pathnameOf(req.url);
-    if (req.method === "POST" && path29 === "/v1/messages") {
+    const path42 = pathnameOf(req.url);
+    if (req.method === "POST" && path42 === "/v1/messages") {
       void handleMessages(req, res).catch((err) => {
         log(`router internal error: ${err instanceof Error ? err.message : String(err)}`);
         if (!res.headersSent) {
@@ -8226,18 +8267,18 @@ function createRouterShim(opts) {
       });
       return;
     }
-    if (req.method === "POST" && path29 === "/v1/messages/count_tokens") {
+    if (req.method === "POST" && path42 === "/v1/messages/count_tokens") {
       void handleCountTokens(req, res).catch(() => {
         if (!res.headersSent)
           writeJson(res, 502, anthropicError(502, "api_error", "router internal error").body);
       });
       return;
     }
-    if (req.method === "GET" && path29 === "/v1/models") {
+    if (req.method === "GET" && path42 === "/v1/models") {
       writeJson(res, 200, modelsList([...advertisedModels]));
       return;
     }
-    if (req.method === "GET" && path29 === "/healthz") {
+    if (req.method === "GET" && path42 === "/healthz") {
       writeJson(res, 200, { ready: server?.listening === true, upstreamReachable, lastError });
       return;
     }
@@ -8506,11 +8547,11 @@ async function probeCaptainChannel(project, opts = {}) {
   }
 }
 async function httpReachable(port, fetchImpl, timeoutMs) {
-  for (const path29 of ["/session", "/api/session"]) {
+  for (const path42 of ["/session", "/api/session"]) {
     const ac = new AbortController();
     const t = setTimeout(() => ac.abort(), timeoutMs);
     try {
-      const res = await fetchImpl(`http://127.0.0.1:${port}${path29}`, { signal: ac.signal });
+      const res = await fetchImpl(`http://127.0.0.1:${port}${path42}`, { signal: ac.signal });
       if (res.ok)
         return true;
     } catch {
@@ -9281,8 +9322,8 @@ function createEventsSource(opts) {
         for (const v2 of checkFact(traceFor(taskId), fact, opts.check ?? {})) {
           opts.onViolation(v2);
         }
-        for (const ev of toControlEvent(fact))
-          opts.emit(ev);
+        for (const ev2 of toControlEvent(fact))
+          opts.emit(ev2);
       }
     }
   };
@@ -9349,31 +9390,294 @@ var init_peer_first_turn = __esm({
 });
 
 // packages/core/dist/knowledge/paths.js
-import path14 from "path";
-function kbDir(hubVault, kb) {
-  return path14.join(hubVault, "knowledge", kb);
+import path15 from "path";
+function kbDir(cfg, kb) {
+  return kbPath(cfg, kb);
 }
-function kbRulesDir(hubVault, kb) {
-  return path14.join(kbDir(hubVault, kb), "rules");
+function kbRulesDir(cfg, kb) {
+  return path15.join(kbDir(cfg, kb), "shared", "rules");
 }
-function projectRulesDir(spokeVault) {
-  return path14.join(spokeVault, "knowledge", "rules");
+function legacyKbDir(hubVault, kb) {
+  return path15.join(hubVault, "knowledge", kb);
 }
 var PROPOSED_DIR;
 var init_paths = __esm({
   "packages/core/dist/knowledge/paths.js"() {
+    init_dist();
     PROPOSED_DIR = "_proposed";
   }
 });
 
-// packages/core/dist/knowledge/store.js
+// packages/core/dist/knowledge/ingest.js
+import crypto3 from "crypto";
 import fs15 from "fs";
 import os7 from "os";
-import path15 from "path";
+import path16 from "path";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+function refFor(kbRoot, file) {
+  const rel = path16.relative(kbRoot, file);
+  if (rel && !rel.startsWith("..") && !path16.isAbsolute(rel))
+    return rel.split(path16.sep).join("/");
+  const home = os7.homedir();
+  return file.startsWith(home + path16.sep) ? `~/${path16.relative(home, file).split(path16.sep).join("/")}` : file;
+}
+function readState2(kbRoot, ref) {
+  try {
+    return JSON.parse(fs15.readFileSync(stampFile(kbRoot, ref), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeState(kbRoot, st) {
+  fs15.mkdirSync(path16.join(kbRoot, CONVERTED_DIR), { recursive: true });
+  fs15.writeFileSync(stampFile(kbRoot, st.ref), JSON.stringify(st) + "\n");
+}
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        re += glob[i + 2] === "/" ? "(?:.*/)?" : ".*";
+        i += glob[i + 2] === "/" ? 2 : 1;
+      } else
+        re += "[^/]*";
+    } else if (c === "?")
+      re += "[^/]";
+    else
+      re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${re}$`);
+}
+function walkFiles(dir, out = []) {
+  if (!fs15.existsSync(dir))
+    return out;
+  for (const ent of fs15.readdirSync(dir, { withFileTypes: true })) {
+    if (ent.name === ".git" || ent.name === CONVERTED_DIR || ent.name === "node_modules")
+      continue;
+    const full = path16.join(dir, ent.name);
+    if (ent.isDirectory())
+      walkFiles(full, out);
+    else if (ent.isFile())
+      out.push(full);
+  }
+  return out;
+}
+function expandSource(kbRoot, entry) {
+  const abs = path16.resolve(kbRoot, expandHome(entry.path));
+  if (!/[*?]/.test(entry.path))
+    return fs15.existsSync(abs) && fs15.statSync(abs).isFile() ? [abs] : [];
+  const base = abs.split(/[*?]/)[0];
+  const root = base.endsWith(path16.sep) ? base : path16.dirname(base);
+  const re = globToRegExp(abs.split(path16.sep).join("/"));
+  return walkFiles(root).filter((f) => re.test(f.split(path16.sep).join("/"))).sort();
+}
+function detectChange(kbRoot, file) {
+  const ref = refFor(kbRoot, file);
+  const st = fs15.statSync(file);
+  const prior = readState2(kbRoot, ref);
+  if (prior && prior.size === st.size && prior.mtimeMs === st.mtimeMs) {
+    return { ref, changed: false, stamp: { sha: prior.sha, size: st.size, mtimeMs: st.mtimeMs }, prior };
+  }
+  const sha = sha256(file);
+  return { ref, changed: !prior || prior.sha !== sha, stamp: { sha, size: st.size, mtimeMs: st.mtimeMs }, prior };
+}
+function splitSections(text) {
+  const cuts = [];
+  const re = /^#{1,6}[ \t]+(.+)$/gm;
+  for (let m = re.exec(text); m; m = re.exec(text))
+    cuts.push({ at: m.index, heading: m[1].trim() });
+  if (!cuts.length || cuts[0].at > 0)
+    cuts.unshift({ at: 0 });
+  const spans = [];
+  cuts.forEach((c, i) => {
+    const end = i + 1 < cuts.length ? cuts[i + 1].at : text.length;
+    let start = c.at;
+    while (end - start > SECTION_TARGET_CHARS * 1.5) {
+      const brk = text.indexOf("\n\n", start + SECTION_TARGET_CHARS);
+      if (brk < 0 || brk >= end)
+        break;
+      spans.push({ index: 0, start, end: brk, heading: c.heading });
+      start = brk + 2;
+    }
+    if (text.slice(start, end).trim())
+      spans.push({ index: 0, start, end, heading: c.heading });
+  });
+  return spans.map((s, i) => ({ ...s, index: i }));
+}
+async function planIngest(kbRoot, opts) {
+  const converter = opts.converter ?? markitdownConverter;
+  const cap = opts.maxSectionsPerPass ?? DEFAULT_MAX_SECTIONS_PER_PASS;
+  const plan = { sources: [], skipped: [], failed: [], carriedSections: 0, sectionCount: 0, estimatedTokens: 0, existing: opts.existing ?? [] };
+  let budget = cap;
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of opts.sources) {
+    for (const file of expandSource(kbRoot, entry)) {
+      const { ref, changed, stamp, prior } = detectChange(kbRoot, file);
+      if (seen.has(ref))
+        continue;
+      seen.add(ref);
+      const pending = !!prior && prior.cursor < prior.sections;
+      if (!changed && !pending)
+        continue;
+      if (entry.sensitivity === "local-only" && !opts.localModel) {
+        plan.skipped.push({ ref, reason: "sensitivity: local-only and no local model available" });
+        continue;
+      }
+      if (budget <= 0) {
+        plan.carriedSections += changed ? 1 : prior.sections - prior.cursor;
+        continue;
+      }
+      let text;
+      const conv = convertedFile(kbRoot, ref);
+      try {
+        if (!changed && fs15.existsSync(conv))
+          text = fs15.readFileSync(conv, "utf8");
+        else {
+          text = PASS_THROUGH.has(path16.extname(file).toLowerCase()) ? fs15.readFileSync(file, "utf8") : await converter(file);
+          if (!opts.dryRun) {
+            fs15.mkdirSync(path16.dirname(conv), { recursive: true });
+            fs15.writeFileSync(conv, text);
+          }
+        }
+      } catch (e) {
+        plan.failed.push({ ref, error: e.message.split("\n")[0] });
+        continue;
+      }
+      const all = splitSections(text);
+      const from = changed ? 0 : prior.cursor;
+      const take = all.slice(from, from + budget);
+      budget -= take.length;
+      plan.carriedSections += all.length - from - take.length;
+      plan.sectionCount += take.length;
+      plan.estimatedTokens += Math.ceil(take.reduce((n, s) => n + (s.end - s.start), 0) / CHARS_PER_TOKEN);
+      plan.sources.push({
+        ref,
+        file,
+        converted: conv,
+        sha: stamp.sha,
+        priority: entry.priority,
+        domain: entry.domain,
+        sensitivity: entry.sensitivity,
+        sections: take,
+        totalSections: all.length
+      });
+      if (!opts.dryRun)
+        writeState(kbRoot, { ref, ...stamp, sections: all.length, cursor: from + take.length, priority: entry.priority });
+    }
+  }
+  return plan;
+}
+var execFileAsync, CONVERTED_DIR, DEFAULT_MAX_SECTIONS_PER_PASS, CHARS_PER_TOKEN, PASS_THROUGH, SECTION_TARGET_CHARS, markitdownConverter, expandHome, fileForRef, cacheKey, convertedFile, stampFile, sha256;
+var init_ingest = __esm({
+  "packages/core/dist/knowledge/ingest.js"() {
+    execFileAsync = promisify2(execFile2);
+    CONVERTED_DIR = ".converted";
+    DEFAULT_MAX_SECTIONS_PER_PASS = 40;
+    CHARS_PER_TOKEN = 4;
+    PASS_THROUGH = /* @__PURE__ */ new Set([".md", ".markdown", ".txt"]);
+    SECTION_TARGET_CHARS = 4e3;
+    markitdownConverter = async (file) => {
+      const { stdout } = await execFileAsync("markitdown", [file], { maxBuffer: 64 * 1024 * 1024 });
+      return stdout;
+    };
+    expandHome = (p) => p === "~" || p.startsWith("~/") ? path16.join(os7.homedir(), p.slice(1)) : p;
+    fileForRef = (kbRoot, ref) => path16.resolve(kbRoot, expandHome(ref));
+    cacheKey = (ref) => `${ref.replace(/[^A-Za-z0-9._-]+/g, "_")}.${crypto3.createHash("sha1").update(ref).digest("hex").slice(0, 6)}`;
+    convertedFile = (kbRoot, ref) => path16.join(kbRoot, CONVERTED_DIR, `${cacheKey(ref)}.md`);
+    stampFile = (kbRoot, ref) => path16.join(kbRoot, CONVERTED_DIR, `${cacheKey(ref)}.sha`);
+    sha256 = (file) => crypto3.createHash("sha256").update(fs15.readFileSync(file)).digest("hex");
+  }
+});
+
+// packages/core/dist/knowledge/verify.js
+function normalizeWithMap(src, keepBreakHyphen = false) {
+  const out = [];
+  const map2 = [];
+  const push = (s, at) => {
+    for (const ch of s) {
+      out.push(ch);
+      map2.push(at);
+    }
+  };
+  let i = 0;
+  while (i < src.length) {
+    const ch = src[i];
+    if (ch === "-" && /^-[ \t]*\r?\n[ \t]*[a-z]/.test(src.slice(i, i + 40)) && i > 0 && /[A-Za-z]/.test(src[i - 1])) {
+      if (keepBreakHyphen)
+        push("-", i);
+      i++;
+      while (/\s/.test(src[i]))
+        i++;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      const start = i;
+      while (i < src.length && /\s/.test(src[i]))
+        i++;
+      if (out.length && out[out.length - 1] !== " ")
+        push(" ", start);
+      continue;
+    }
+    if (MARKUP.has(ch)) {
+      i++;
+      continue;
+    }
+    if (LIGATURES[ch])
+      push(LIGATURES[ch], i);
+    else if (QUOTES[ch])
+      push(QUOTES[ch], i);
+    else if (DASHES.has(ch))
+      push("-", i);
+    else
+      push(ch, i);
+    i++;
+  }
+  while (out.length && out[out.length - 1] === " ") {
+    out.pop();
+    map2.pop();
+  }
+  return { text: out.join(""), map: map2 };
+}
+function findQuote(source, quote) {
+  const needle = normalizeText(quote);
+  if (!needle)
+    return null;
+  const views = typeof source === "string" ? normalizedViews(source) : source;
+  for (const hay of views) {
+    const at = hay.text.indexOf(needle);
+    if (at >= 0)
+      return [hay.map[at], hay.map[at + needle.length - 1] + 1];
+  }
+  return null;
+}
+var LIGATURES, QUOTES, DASHES, MARKUP, normalizeText, normalizedViews, DOCLING_DROP_THRESHOLD, needsDocling, spansOverlap;
+var init_verify = __esm({
+  "packages/core/dist/knowledge/verify.js"() {
+    LIGATURES = { "\uFB01": "fi", "\uFB02": "fl", "\uFB00": "ff", "\uFB03": "ffi", "\uFB04": "ffl", "\uFB05": "st", "\uFB06": "st" };
+    QUOTES = { "\u2018": "'", "\u2019": "'", "\u201A": "'", "\u201B": "'", "\u201C": '"', "\u201D": '"', "\u201E": '"', "\u201F": '"' };
+    DASHES = /* @__PURE__ */ new Set(["\u2010", "\u2011", "\u2012", "\u2013", "\u2014", "\u2015", "\u2212"]);
+    MARKUP = /* @__PURE__ */ new Set(["*", "_", "`", "\\"]);
+    normalizeText = (s) => normalizeWithMap(s).text;
+    normalizedViews = (src) => [normalizeWithMap(src), normalizeWithMap(src, true)];
+    DOCLING_DROP_THRESHOLD = 0.2;
+    needsDocling = (dropped, total) => total > 0 && dropped / total > DOCLING_DROP_THRESHOLD;
+    spansOverlap = (a, b) => a[0] < b[1] && b[0] < a[1];
+  }
+});
+
+// packages/core/dist/knowledge/store.js
+import fs16 from "fs";
+import os8 from "os";
+import path17 from "path";
 import matter2 from "gray-matter";
 function duplicateIdProblem(id, ignored, used) {
   return `duplicate id ${id}: ${ignored} is ignored, ${used} is used (live files win over _proposed, then path order). Fix: rename the id in one file, or delete or move one of them.`;
 }
+function isPendingProposalDup(e, rulesDir) {
+  return e.problems.every((p) => p.startsWith("duplicate id")) && path17.relative(rulesDir, e.file).split(path17.sep).includes(PROPOSED_DIR);
+}
 function splitStatement(body) {
   const first = body.trim().split(/\n\s*\n/)[0] ?? "";
   return first.replace(/\s+/g, " ").trim();
@@ -9381,8 +9685,8 @@ function splitStatement(body) {
 function listMarkdown(dir, includeProposed) {
   const out = [];
   const walk = (d) => {
-    for (const ent of fs15.readdirSync(d, { withFileTypes: true })) {
-      const full = path15.join(d, ent.name);
+    for (const ent of fs16.readdirSync(d, { withFileTypes: true })) {
+      const full = path17.join(d, ent.name);
       if (ent.isDirectory()) {
         if (ent.name === PROPOSED_DIR && !includeProposed)
           continue;
@@ -9393,11 +9697,11 @@ function listMarkdown(dir, includeProposed) {
     }
   };
   walk(dir);
-  const isProposed = (f) => path15.relative(dir, f).split(path15.sep).includes(PROPOSED_DIR);
+  const isProposed = (f) => path17.relative(dir, f).split(path17.sep).includes(PROPOSED_DIR);
   return out.sort((a, b) => Number(isProposed(a)) - Number(isProposed(b)) || (a < b ? -1 : a > b ? 1 : 0));
 }
 function loadRulesDir(dir, layer, opts = {}) {
-  if (!fs15.existsSync(dir))
+  if (!fs16.existsSync(dir))
     return { rules: [], errors: [] };
   const rules = [];
   const errors = [];
@@ -9405,7 +9709,7 @@ function loadRulesDir(dir, layer, opts = {}) {
   for (const file of listMarkdown(dir, opts.includeProposed ?? false)) {
     let parsed;
     try {
-      parsed = matter2(fs15.readFileSync(file, "utf8"), NO_JS_FRONTMATTER);
+      parsed = matter2(fs16.readFileSync(file, "utf8"), NO_JS_FRONTMATTER);
     } catch (e) {
       errors.push({ file, problems: [`frontmatter parse error: ${e.message}`] });
       continue;
@@ -9429,22 +9733,23 @@ function loadRulesDir(dir, layer, opts = {}) {
 function resolveSourceRef(ref, kbRoot, sources) {
   const bases = /* @__PURE__ */ new Set([kbRoot]);
   for (const s of sources) {
-    let d = path15.resolve(kbRoot, expandHome(s.path.split(/[*?[{]/)[0]));
-    for (let i = 0; i < 6 && d !== path15.dirname(d); i++) {
-      d = path15.dirname(d);
+    let d = path17.resolve(kbRoot, expandHome2(s.path.split(/[*?[{]/)[0]));
+    for (let i = 0; i < 6 && d !== path17.dirname(d); i++) {
+      d = path17.dirname(d);
       bases.add(d);
     }
   }
-  const cands = [path15.resolve(kbRoot, expandHome(ref)), ...[...bases].map((b) => path15.join(b, ref))];
-  return cands.find((c) => fs15.existsSync(c) && fs15.statSync(c).isFile());
+  const cands = [path17.resolve(kbRoot, expandHome2(ref)), ...[...bases].map((b) => path17.join(b, ref))];
+  return cands.find((c) => fs16.existsSync(c) && fs16.statSync(c).isFile());
 }
 function validateKb(opts) {
   const { rules, errors } = loadRulesDir(opts.rulesDir, "kb", { includeProposed: true });
   const checks = [];
-  const dups = errors.filter((e) => e.problems.some((p) => p.startsWith("duplicate id")));
-  const invalid = errors.filter((e) => !dups.includes(e));
-  const proposed = rules.filter((r) => path15.relative(opts.rulesDir, r.file).split(path15.sep).includes(PROPOSED_DIR)).length;
-  checks.push({ level: "ok", message: `${rules.length + errors.length} rule files read (${rules.length - proposed} live, ${proposed} proposed parsed OK)` });
+  const dups = errors.filter((e) => e.problems.some((p) => p.startsWith("duplicate id")) && !isPendingProposalDup(e, opts.rulesDir));
+  const pendingDups = errors.filter((e) => isPendingProposalDup(e, opts.rulesDir)).length;
+  const invalid = errors.filter((e) => !dups.includes(e) && !isPendingProposalDup(e, opts.rulesDir));
+  const proposed = rules.filter((r) => path17.relative(opts.rulesDir, r.file).split(path17.sep).includes(PROPOSED_DIR)).length;
+  checks.push({ level: "ok", message: `${rules.length + errors.length} rule files read (${rules.length - proposed} live, ${proposed + pendingDups} proposed parsed OK)` });
   if (invalid.length)
     for (const e of invalid)
       checks.push({ level: "fail", message: `invalid ${e.file}: ${e.problems.join("; ")}` });
@@ -9456,7 +9761,7 @@ function validateKb(opts) {
   else
     checks.push({ level: "ok", message: "no duplicate ids" });
   const cache = /* @__PURE__ */ new Map();
-  let verified = 0, unresolved = 0;
+  let verified = 0, unresolved = 0, notIngested = 0;
   for (const r of rules) {
     r.sources.forEach((src, i) => {
       const file = resolveSourceRef(src.ref, opts.kbRoot, opts.sources);
@@ -9464,16 +9769,28 @@ function validateKb(opts) {
         unresolved++;
         return;
       }
-      if (!cache.has(file))
-        cache.set(file, fs15.readFileSync(file, "utf8"));
-      if (cache.get(file).includes(src.quote))
+      const key = `${src.ref}\0${file}`;
+      if (!cache.has(key)) {
+        const conv = readState2(opts.kbRoot, src.ref) ? convertedFile(opts.kbRoot, src.ref) : null;
+        const cached = !!conv && fs16.existsSync(conv);
+        cache.set(key, {
+          hay: normalizedViews(fs16.readFileSync(cached ? conv : file, "utf8")),
+          convertible: !cached && !PASS_THROUGH.has(path17.extname(file).toLowerCase())
+        });
+      }
+      const { hay, convertible } = cache.get(key);
+      if (findQuote(hay, src.quote))
         verified++;
+      else if (convertible)
+        notIngested++;
       else
         checks.push({ level: "fail", message: `quote not found in ${file}: ${r.id} sources[${i}] (${r.file})` });
     });
   }
   if (!checks.some((c) => c.message.startsWith("quote not found")))
     checks.push({ level: "ok", message: `${verified} source quotes found in their source files` });
+  if (notIngested)
+    checks.push({ level: "skip", message: `${notIngested} source refs need conversion but have no .converted cache, quote not checked (run \`squadrant knowledge ingest <kb>\`)` });
   if (unresolved)
     checks.push({ level: "skip", message: `${unresolved} source refs not resolvable on this machine, quote not checked` });
   if (opts.domains) {
@@ -9484,24 +9801,26 @@ function validateKb(opts) {
   }
   return { checks, ok: !checks.some((c) => c.level === "fail") };
 }
-var NO_JS_FRONTMATTER, expandHome;
+var NO_JS_FRONTMATTER, expandHome2;
 var init_store2 = __esm({
   "packages/core/dist/knowledge/store.js"() {
     init_dist();
+    init_ingest();
     init_paths();
+    init_verify();
     NO_JS_FRONTMATTER = {
       engines: { javascript: { parse: () => {
         throw new Error("only YAML front matter is allowed");
       } } }
     };
-    expandHome = (p) => p === "~" || p.startsWith("~/") ? path15.join(os7.homedir(), p.slice(1)) : p;
+    expandHome2 = (p) => p === "~" || p.startsWith("~/") ? path17.join(os8.homedir(), p.slice(1)) : p;
   }
 });
 
 // packages/core/dist/knowledge/layers.js
-import fs16 from "fs";
+import fs17 from "fs";
 function loadKbRules(cfg, kb, opts = {}) {
-  return loadRulesDir(kbRulesDir(resolveHome(cfg.hubVault), kb), `kb:${kb}`, opts);
+  return loadRulesDir(kbRulesDir(cfg, kb), `kb:${kb}`, opts);
 }
 function resolveProjectRules(cfg, project, opts = {}) {
   const pc = cfg.projects[project];
@@ -9511,7 +9830,7 @@ function resolveProjectRules(cfg, project, opts = {}) {
   const errors = [];
   const warnings = [];
   for (const kb of subscribedKbs(cfg, project)) {
-    if (!fs16.existsSync(kbDir(resolveHome(cfg.hubVault), kb))) {
+    if (!fs17.existsSync(kbDir(cfg, kb))) {
       warnings.push(`knowledge base '${kb}' not found (run: squadrant knowledge init ${kb})`);
       continue;
     }
@@ -9526,10 +9845,13 @@ function resolveProjectRules(cfg, project, opts = {}) {
       byId.set(r.id, r);
     }
   }
-  const proj = loadRulesDir(projectRulesDir(resolveHome(pc.spokeVault)), `project:${project}`, opts);
-  errors.push(...proj.errors);
-  for (const r of proj.rules)
-    byId.set(r.id, r);
+  const projDir = projectRulesHome(cfg, project);
+  if (projDir) {
+    const proj = loadRulesDir(projDir, `project:${project}`, opts);
+    errors.push(...proj.errors);
+    for (const r of proj.rules)
+      byId.set(r.id, r);
+  }
   for (const id of pc.rulesDisabled ?? []) {
     if (!byId.delete(id))
       warnings.push(`rulesDisabled: unknown rule id '${id}'`);
@@ -9546,8 +9868,8 @@ var init_layers = __esm({
 });
 
 // packages/core/dist/knowledge/index-file.js
-import fs17 from "fs";
-import path16 from "path";
+import fs18 from "fs";
+import path18 from "path";
 function compileIndex(kb, rules, now = /* @__PURE__ */ new Date()) {
   return {
     kb,
@@ -9555,19 +9877,19 @@ function compileIndex(kb, rules, now = /* @__PURE__ */ new Date()) {
     rules: rules.map(({ id, domain, modality, status, statement, triggers, anchors, file }) => ({ id, domain, modality, status, statement, triggers, anchors, file }))
   };
 }
-function writeIndex(hubVault, kb, index) {
-  const file = path16.join(kbDir(hubVault, kb), "index.json");
+function writeIndex(kbRoot, index) {
+  const file = path18.join(kbRoot, "index.json");
   const tmp = `${file}.tmp-${process.pid}`;
-  fs17.writeFileSync(tmp, JSON.stringify(index, null, 2) + "\n");
-  fs17.renameSync(tmp, file);
+  fs18.writeFileSync(tmp, JSON.stringify(index, null, 2) + "\n");
+  fs18.renameSync(tmp, file);
   return file;
 }
-function readIndex(hubVault, kb) {
-  const file = path16.join(kbDir(hubVault, kb), "index.json");
-  if (!fs17.existsSync(file))
+function readIndex(kbRoot, kb) {
+  const file = path18.join(kbRoot, "index.json");
+  if (!fs18.existsSync(file))
     return { index: null, problem: `index.json missing for kb '${kb}'` };
   try {
-    const index = JSON.parse(fs17.readFileSync(file, "utf8"));
+    const index = JSON.parse(fs18.readFileSync(file, "utf8"));
     if (!Array.isArray(index.rules))
       return { index: null, problem: `index.json corrupt for kb '${kb}' (no rules array)` };
     return { index };
@@ -9577,14 +9899,13 @@ function readIndex(hubVault, kb) {
 }
 var init_index_file = __esm({
   "packages/core/dist/knowledge/index-file.js"() {
-    init_paths();
   }
 });
 
 // packages/core/dist/knowledge/search.js
 function searchRules(rules, query, opts = {}) {
-  const terms = [...new Set(query.toLowerCase().split(/\s+/).filter(Boolean))];
-  if (terms.length === 0)
+  const terms2 = [...new Set(query.toLowerCase().split(/\s+/).filter(Boolean))];
+  if (terms2.length === 0)
     return [];
   const statuses = opts.statuses ?? DEFAULT_SEARCH_STATUSES;
   const hits = [];
@@ -9600,7 +9921,7 @@ function searchRules(rules, query, opts = {}) {
     let score = 0;
     let matched = 0;
     let curated = false;
-    for (const t of terms) {
+    for (const t of terms2) {
       let s = 0;
       if (id.includes(t))
         s += 3;
@@ -9624,8 +9945,8 @@ function searchRules(rules, query, opts = {}) {
     if (score > 0)
       hits.push({ rule, score, matched, curated });
   }
-  const strong = terms.length >= 2 ? hits.filter((h) => h.matched >= 2 || h.curated) : hits;
-  const out = strong.length ? strong : hits;
+  const strong2 = terms2.length >= 2 ? hits.filter((h) => h.matched >= 2 || h.curated) : hits;
+  const out = strong2.length ? strong2 : hits;
   return out.sort((a, b) => b.score - a.score || a.rule.id.localeCompare(b.rule.id));
 }
 var DEFAULT_SEARCH_STATUSES, lower, rationaleOf;
@@ -12663,15 +12984,15 @@ var init_js_yaml = __esm({
 });
 
 // packages/core/dist/knowledge/sources.js
-import fs18 from "fs";
-import path17 from "path";
-function loadSources(hubVault, kb) {
-  const file = path17.join(kbDir(hubVault, kb), "sources.yaml");
-  if (!fs18.existsSync(file))
+import fs19 from "fs";
+import path19 from "path";
+function loadSources(kbRoot) {
+  const file = path19.join(kbRoot, "sources.yaml");
+  if (!fs19.existsSync(file))
     return { sources: [], errors: [] };
   let data;
   try {
-    data = yaml.load(fs18.readFileSync(file, "utf8"));
+    data = yaml.load(fs19.readFileSync(file, "utf8"));
   } catch (e) {
     return { sources: [], errors: [`YAML parse error: ${e.message.split("\n")[0]}`] };
   }
@@ -12695,7 +13016,6 @@ var init_sources = __esm({
   "packages/core/dist/knowledge/sources.js"() {
     init_js_yaml();
     init_dist();
-    init_paths();
     SOURCES_TEMPLATE = `# Trusted sources for this knowledge base (spec \xA73). Only these can produce rules.
 # priority: company > project > agent (decides conflicts).
 # sensitivity: local-only  \u2192 never sent to a hosted model (D12).
@@ -12710,9 +13030,113 @@ var init_sources = __esm({
   }
 });
 
+// packages/core/dist/knowledge/match.js
+import path20 from "path";
+function globMatches(glob, relPath) {
+  const g = glob.replace(/^\.\//, "");
+  if (globToRegExp(g).test(relPath))
+    return true;
+  return !g.includes("/") && globToRegExp(g).test(path20.posix.basename(relPath));
+}
+function repoRelativePaths(file, cwd, projectRoot) {
+  const out = /* @__PURE__ */ new Set();
+  const add = (base) => {
+    const rel = path20.relative(base, file).split(path20.sep).join("/");
+    if (!rel || rel.startsWith("..") || path20.isAbsolute(rel))
+      return;
+    out.add(rel);
+    const wt = /^\.worktrees\/[^/]+\/(.+)$/.exec(rel);
+    if (wt)
+      out.add(wt[1]);
+  };
+  if (path20.isAbsolute(file)) {
+    add(cwd);
+    add(projectRoot);
+  } else
+    out.add(file.replace(/^\.\//, ""));
+  return [...out];
+}
+function matchPaths(rules, project, relPaths) {
+  const hits = [];
+  for (const rule of rules) {
+    if (rule.status !== "active")
+      continue;
+    if (rule.triggers?.globs?.some((g) => relPaths.some((p) => globMatches(g, p))))
+      hits.push({ rule, via: "glob" });
+    else if (rule.anchors?.[project]?.paths?.some((a) => relPaths.includes(a)))
+      hits.push({ rule, via: "anchor" });
+  }
+  return hits;
+}
+function matchSymbols(rules, project, text) {
+  const idents = new Set(text.match(/[A-Za-z_$][\w$]{2,}/g) ?? []);
+  return rules.filter((r) => r.status === "active" && r.anchors?.[project]?.symbols?.some((s) => idents.has(s))).map((rule) => ({ rule, via: "anchor" }));
+}
+function mentionedPaths(text) {
+  const found = text.match(/[\w@.\-/]*[\w-]\.[A-Za-z]{1,5}\b|[\w.-]+\/[\w./-]+/g) ?? [];
+  return [...new Set(found.map((f) => f.replace(/^\.\//, "")))].slice(0, 20);
+}
+function applyBudget(items, lineLen, maxRules = INJECT_MAX_RULES, maxChars = INJECT_MAX_CHARS) {
+  const shown = [];
+  let chars = 0;
+  for (const it of items) {
+    const n = lineLen(it.rule);
+    if (shown.length >= maxRules || shown.length > 0 && chars + n > maxChars)
+      break;
+    shown.push(it);
+    chars += n;
+  }
+  return { shown, overflow: items.slice(shown.length) };
+}
+var INJECT_MAX_RULES, INJECT_MAX_CHARS;
+var init_match = __esm({
+  "packages/core/dist/knowledge/match.js"() {
+    init_ingest();
+    INJECT_MAX_RULES = 5;
+    INJECT_MAX_CHARS = 3200;
+  }
+});
+
+// packages/core/dist/knowledge/audit.js
+import fs20 from "fs";
+import os9 from "os";
+import path21 from "path";
+function appendAudit(events, sink = {}) {
+  if (!events.length)
+    return;
+  try {
+    const ts = (sink.now?.() ?? /* @__PURE__ */ new Date()).toISOString();
+    const dir = sink.dir ?? defaultAuditDir();
+    const file = path21.join(dir, `${ts.slice(0, 7)}.${sink.machineId ?? auditMachineId()}.jsonl`);
+    fs20.mkdirSync(dir, { recursive: true });
+    const fd = fs20.openSync(file, "a");
+    try {
+      for (const e of events) {
+        const q = e.query === void 0 ? {} : { query: e.query.slice(0, AUDIT_QUERY_CHARS) };
+        fs20.writeSync(fd, JSON.stringify({ ts, ...e, ...q }) + "\n");
+      }
+    } finally {
+      fs20.closeSync(fd);
+    }
+  } catch (err) {
+    console.error(`squadrant audit: log write failed: ${err.message}`);
+  }
+}
+function ruleAuditScope(rule) {
+  return rule.layer.startsWith("kb:") ? { kb: rule.layer.slice(3), level: "group" } : { kb: "", level: "project" };
+}
+var AUDIT_QUERY_CHARS, defaultAuditDir, auditMachineId;
+var init_audit = __esm({
+  "packages/core/dist/knowledge/audit.js"() {
+    AUDIT_QUERY_CHARS = 200;
+    defaultAuditDir = () => process.env.SQUADRANT_AUDIT_DIR || path21.join(os9.homedir(), ".local", "state", "squadrant", "audit");
+    auditMachineId = () => os9.hostname().replace(/[^A-Za-z0-9_-]/g, "_") || "host";
+  }
+});
+
 // packages/core/dist/knowledge/inject.js
-import fs19 from "fs";
-import path18 from "path";
+import fs21 from "fs";
+import path22 from "path";
 function sessionOrder(a, b) {
   const proj = (r) => r.layer.startsWith("project:") ? 0 : 1;
   const mod = (r) => r.modality === "must-not" ? 0 : 1;
@@ -12720,7 +13144,7 @@ function sessionOrder(a, b) {
 }
 function formatSessionContext(kbs, rules, cap = SESSION_RULE_CAP) {
   const hard = rules.filter((r) => r.status === "active" && (r.modality === "must" || r.modality === "must-not")).sort(sessionOrder);
-  const shown = hard.slice(0, cap);
+  const shown = applyBudget(hard.map((rule) => ({ rule })), (r) => line(r).length, cap, INJECT_MAX_CHARS).shown.map((x) => x.rule);
   const lines = [
     `<squadrant-project-rules kb="${kbs.join(",")}">`,
     `Rules KB: ${kbs.join(", ")}. ${DATA_NOTE}`,
@@ -12729,16 +13153,17 @@ function formatSessionContext(kbs, rules, cap = SESSION_RULE_CAP) {
   if (hard.length > shown.length)
     lines.push(`+${hard.length - shown.length} more: squadrant rules list --brief`);
   lines.push("Look up rules for a task with `squadrant rules search <terms>` / `squadrant rules show <id>` (rules-ops skill).");
+  lines.push(CITE_NOTE);
   lines.push("</squadrant-project-rules>");
-  return { text: lines.join("\n"), ids: shown.map((r) => r.id) };
+  return { text: lines.join("\n"), ids: shown.map((r) => r.id), hiddenIds: hard.slice(shown.length).map((r) => r.id) };
 }
 function cleanPromptQuery(prompt) {
   const text = prompt.replace(/```[\s\S]*?(```|$)/g, " ").split("\n").filter((l) => l.length <= MAX_LINE_CHARS).join("\n").slice(0, MAX_PROMPT_CHARS).toLowerCase().replace(/https?:\/\/\S+/g, " ");
-  const terms = [];
+  const terms2 = [];
   const add = (t) => {
-    if (t.length < 3 && !SHORT_TERMS.has(t) || /^\d+$/.test(t) || STOPWORDS.has(t) || terms.includes(t))
+    if (t.length < 3 && !SHORT_TERMS.has(t) || /^\d+$/.test(t) || STOPWORDS.has(t) || terms2.includes(t))
       return;
-    terms.push(t);
+    terms2.push(t);
   };
   for (const raw of text.split(/[^a-z0-9._-]+/)) {
     const t = raw.replace(/^[._-]+|[._-]+$/g, "");
@@ -12748,12 +13173,12 @@ function cleanPromptQuery(prompt) {
     const parts = t.split(/[._-]+/);
     if (parts.length > 1 && parts.every((x) => x.length >= 3 && !PREFIXES.has(x)))
       parts.forEach(add);
-    if (terms.length >= MAX_TERMS)
+    if (terms2.length >= MAX_TERMS)
       break;
   }
-  return terms.slice(0, MAX_TERMS).join(" ");
+  return terms2.slice(0, MAX_TERMS).join(" ");
 }
-function wholeWordTerms(rule, terms) {
+function wholeWordTerms(rule, terms2) {
   const text = [
     rule.id,
     ...rule.triggers?.keywords ?? [],
@@ -12761,18 +13186,18 @@ function wholeWordTerms(rule, terms) {
     rule.triggers?.when ?? "",
     rule.statement
   ].join("\n").toLowerCase();
-  return terms.filter((t) => {
+  return terms2.filter((t) => {
     const base = t.length > 4 ? t.replace(/(es|s)$/, "") : t;
     return new RegExp(`(^|[^a-z0-9])(?:${escapeRe(t)}|${escapeRe(base)}(?:s|es)?)($|[^a-z0-9])`).test(text);
   });
 }
 function selectPromptHits(hits, query, seen, opts = {}) {
   const minScore = opts.minScore ?? PROMPT_MIN_SCORE;
-  const terms = query.split(" ").filter(Boolean);
+  const terms2 = query.split(" ").filter(Boolean);
   return hits.filter((h) => {
     if (seen.has(h.rule.id))
       return false;
-    const n = wholeWordTerms(h.rule, terms).length;
+    const n = wholeWordTerms(h.rule, terms2).length;
     return n >= 2 && h.score >= minScore || n === 1 && h.score >= PROMPT_SINGLE_TERM_MIN_SCORE;
   }).slice(0, opts.cap ?? PROMPT_RULE_CAP);
 }
@@ -12785,25 +13210,56 @@ function promptText(prompt) {
   if (!m)
     return prompt;
   try {
-    return fs19.readFileSync(m[1], "utf8").slice(0, MAX_PROMPT_CHARS * 2);
+    return fs21.readFileSync(m[1], "utf8").slice(0, MAX_PROMPT_CHARS * 2);
   } catch {
     return prompt;
   }
 }
-function formatPromptContext(hits) {
+function formatPromptContext(hits, match = "prompt", overflowIds = []) {
   return [
-    '<squadrant-project-rules match="prompt">',
-    `Rules that may apply to this prompt. ${DATA_NOTE}`,
+    `<squadrant-project-rules match="${match}">`,
+    `Rules that may apply to this ${match === "read" ? "file" : "prompt"}. ${DATA_NOTE}`,
     ...hits.map((h) => line(h.rule)),
+    ...overflowIds.length ? [`+${overflowIds.length} more: squadrant rules show ${overflowIds.join(" ")}`] : [],
+    CITE_NOTE,
     "</squadrant-project-rules>"
   ].join("\n");
 }
+function readTargetPath(payload) {
+  const q = typeof payload === "object" && payload !== null ? payload : {};
+  const tool = typeof q.tool_name === "string" ? q.tool_name.toLowerCase() : "";
+  const input = typeof q.tool_input === "object" && q.tool_input !== null ? q.tool_input : {};
+  if (READ_TOOLS.has(tool)) {
+    for (const k of ["file_path", "absolute_path", "filePath", "path"]) {
+      if (typeof input[k] === "string" && input[k])
+        return input[k];
+    }
+    return null;
+  }
+  const cmd = SHELL_TOOLS.has(tool) ? input.command ?? input.cmd : void 0;
+  const text = Array.isArray(cmd) ? cmd.filter((x) => typeof x === "string").join(" ") : cmd;
+  if (typeof text !== "string" || SHELL_META.test(text))
+    return null;
+  const words = text.trim().split(/\s+/);
+  if (words.length < 2 || !/^(cat|head|tail|nl|bat|sed)$/.test(words[0]))
+    return null;
+  const last = words[words.length - 1].replace(/^["']|["']$/g, "");
+  return last && !last.startsWith("-") ? last : null;
+}
+function rulesFallbackPointer(kbs) {
+  return [
+    "## Project rules (squadrant)",
+    "",
+    `This project subscribes to the rules KB: ${kbs.join(", ")}. ${DATA_NOTE}`,
+    "Before changing code, look up the rules that apply with `squadrant rules search <terms>`, then `squadrant rules show <id>`."
+  ].join("\n");
+}
 function injectStateDir(stateRoot) {
-  return path18.join(stateRoot, "rules-inject");
+  return path22.join(stateRoot, "rules-inject");
 }
 function readSeenRules(stateRoot, sessionId) {
   try {
-    const ids = JSON.parse(fs19.readFileSync(sessionFile(stateRoot, sessionId), "utf8"));
+    const ids = JSON.parse(fs21.readFileSync(sessionFile(stateRoot, sessionId), "utf8"));
     return new Set(Array.isArray(ids) ? ids.filter((x) => typeof x === "string") : []);
   } catch {
     return /* @__PURE__ */ new Set();
@@ -12815,22 +13271,22 @@ function recordSeenRules(stateRoot, sessionId, ids) {
   const seen = readSeenRules(stateRoot, sessionId);
   for (const id of ids)
     seen.add(id);
-  fs19.mkdirSync(injectStateDir(stateRoot), { recursive: true });
-  fs19.writeFileSync(sessionFile(stateRoot, sessionId), JSON.stringify([...seen]));
+  fs21.mkdirSync(injectStateDir(stateRoot), { recursive: true });
+  fs21.writeFileSync(sessionFile(stateRoot, sessionId), JSON.stringify([...seen]));
 }
 function pruneSeenRules(stateRoot, now = Date.now()) {
   const dir = injectStateDir(stateRoot);
   let names;
   try {
-    names = fs19.readdirSync(dir);
+    names = fs21.readdirSync(dir);
   } catch {
     return;
   }
   for (const n of names) {
-    const f = path18.join(dir, n);
+    const f = path22.join(dir, n);
     try {
-      if (now - fs19.statSync(f).mtimeMs > SEEN_TTL_MS)
-        fs19.unlinkSync(f);
+      if (now - fs21.statSync(f).mtimeMs > SEEN_TTL_MS)
+        fs21.unlinkSync(f);
     } catch {
     }
   }
@@ -12858,13 +13314,27 @@ function resolveInjectProject(cfg, cwd, env, project) {
   let bestLen = -1;
   for (const [name, pc] of Object.entries(cfg.projects)) {
     const root = resolveHome(pc.path);
-    if ((cwd === root || cwd.startsWith(root + path18.sep)) && root.length > bestLen) {
+    if ((cwd === root || cwd.startsWith(root + path22.sep)) && root.length > bestLen) {
       best = name;
       bestLen = root.length;
     }
   }
   return best;
 }
+function audit(i, project, session, trigger, items) {
+  appendAudit(items.map(({ rule, event, score }) => ({
+    ...ruleAuditScope(rule),
+    project,
+    domain: "rules",
+    itemId: rule.id,
+    event,
+    trigger,
+    ...score === void 0 ? {} : { score },
+    chars: line(rule).length,
+    agent: i.agent ?? "claude",
+    ...session ? { session } : {}
+  })), i.audit);
+}
 function computeRulesInjection(i) {
   if (i.env.SQUADRANT_RULES_INJECT === "0")
     return null;
@@ -12878,32 +13348,60 @@ function computeRulesInjection(i) {
     return null;
   const sessionId = typeof p.session_id === "string" && p.session_id ? p.session_id : null;
   if (i.event === "session-start") {
-    const { text, ids } = formatSessionContext(kbs, resolveProjectRules(i.cfg, project).rules);
+    const rules2 = resolveProjectRules(i.cfg, project).rules;
+    const { text: text2, ids, hiddenIds } = formatSessionContext(kbs, rules2);
+    const byId = new Map(rules2.map((r) => [r.id, r]));
+    audit(i, project, sessionId, "session", [
+      ...ids.map((id) => ({ id, event: "item.surfaced" })),
+      ...hiddenIds.map((id) => ({ id, event: "item.suppressed" }))
+    ].map((e) => ({ rule: byId.get(e.id), event: e.event, score: void 0 })));
     if (sessionId) {
       pruneSeenRules(i.stateRoot);
       recordSeenRules(i.stateRoot, sessionId, ids);
     }
-    return text;
+    return text2;
+  }
+  const rules = resolveProjectRules(i.cfg, project).rules;
+  const seen = sessionId ? readSeenRules(i.stateRoot, sessionId) : /* @__PURE__ */ new Set();
+  if (i.event === "post-read") {
+    const file = readTargetPath(p);
+    if (!file)
+      return null;
+    const rels = repoRelativePaths(file, cwd, resolveHome(i.cfg.projects[project].path));
+    const hits = matchPaths(rules, project, rels).map((h) => ({ rule: h.rule, score: h.via === "glob" ? 100 : 90, matched: 1, curated: true }));
+    return deliver(i, project, sessionId, "tool", "read", hits, seen, []);
   }
   if (typeof p.prompt !== "string" || isSystemPrompt(p.prompt))
     return null;
-  const query = cleanPromptQuery(promptText(p.prompt));
-  if (!query)
-    return null;
-  const seen = sessionId ? readSeenRules(i.stateRoot, sessionId) : /* @__PURE__ */ new Set();
-  const picked = selectPromptHits(searchRules(resolveProjectRules(i.cfg, project).rules, query), query, seen);
-  if (!picked.length)
+  const text = promptText(p.prompt);
+  const query = cleanPromptQuery(text);
+  const structural = [...matchPaths(rules, project, mentionedPaths(text)), ...matchSymbols(rules, project, text)].map((h) => ({ rule: h.rule, score: 100, matched: 1, curated: true }));
+  const lexical = query ? searchRules(rules, query) : [];
+  const picked = selectPromptHits(lexical, query, seen);
+  const all = [...new Map([...structural, ...picked].map((h) => [h.rule.id, h])).values()];
+  return deliver(i, project, sessionId, "prompt", "prompt", all, seen, lexical.filter((h) => !picked.includes(h)));
+}
+function deliver(i, project, sessionId, trigger, match, candidates, seen, belowBar) {
+  const fresh = candidates.filter((h) => !seen.has(h.rule.id));
+  const { shown, overflow } = applyBudget(fresh, (r) => line(r).length);
+  audit(i, project, sessionId, trigger, [
+    ...shown.map((h) => ({ rule: h.rule, event: "item.surfaced", score: h.score })),
+    ...[...overflow, ...belowBar].slice(0, MAX_SUPPRESSED_LOGGED).map((h) => ({ rule: h.rule, event: "item.suppressed", score: h.score }))
+  ]);
+  if (!shown.length)
     return null;
   if (sessionId)
-    recordSeenRules(i.stateRoot, sessionId, picked.map((h) => h.rule.id));
-  return formatPromptContext(picked);
+    recordSeenRules(i.stateRoot, sessionId, shown.map((h) => h.rule.id));
+  return formatPromptContext(shown, match, overflow.map((h) => h.rule.id));
 }
-var SESSION_RULE_CAP, PROMPT_RULE_CAP, PROMPT_MIN_SCORE, PROMPT_SINGLE_TERM_MIN_SCORE, INJECT_BUDGET_MS, MAX_PROMPT_CHARS, MAX_LINE_CHARS, MAX_TERMS, SHORT_TERMS, PREFIXES, SEEN_TTL_MS, STOPWORDS, DATA_NOTE, line, escapeRe, BRIEF_POINTER_RE, sessionFile;
+var SESSION_RULE_CAP, PROMPT_RULE_CAP, PROMPT_MIN_SCORE, PROMPT_SINGLE_TERM_MIN_SCORE, INJECT_BUDGET_MS, MAX_PROMPT_CHARS, MAX_LINE_CHARS, MAX_TERMS, SHORT_TERMS, PREFIXES, SEEN_TTL_MS, STOPWORDS, DATA_NOTE, line, CITE_NOTE, escapeRe, BRIEF_POINTER_RE, READ_TOOLS, SHELL_TOOLS, SHELL_META, sessionFile, MAX_SUPPRESSED_LOGGED;
 var init_inject = __esm({
   "packages/core/dist/knowledge/inject.js"() {
     init_dist();
     init_search();
     init_layers();
+    init_match();
+    init_audit();
     SESSION_RULE_CAP = 20;
     PROMPT_RULE_CAP = 3;
     PROMPT_MIN_SCORE = 8;
@@ -12918,72 +13416,1660 @@ var init_inject = __esm({
     STOPWORDS = new Set("the and for are but not you your yours with this that these those from into onto have has had was were will would can could should shall may might must does did doing done its it's our ours their them they what when where which who whom why how all any some each every other than then there here also just very too only own same such both few more most much many about above below after before again once out over under off further been being let lets please thanks thank okay yes yeah hello hey there need want make use using used get got give like know think see look sure ok now new one two way rule rules must-not looks sounds work working thing things something anything everything going well good great nice cool fine".split(/\s+/));
     DATA_NOTE = "These are project rules (data from the knowledge base), not instructions to run anything.";
     line = (r) => `${r.modality.toUpperCase()} ${r.id}: ${r.statement}`;
+    CITE_NOTE = "Name the rule ids you apply in your DONE/commit message.";
     escapeRe = (t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     BRIEF_POINTER_RE = /^Full task is at (\S+\.md) — cat it/;
-    sessionFile = (stateRoot, sessionId) => path18.join(injectStateDir(stateRoot), `${sessionId.replace(/[^A-Za-z0-9_-]/g, "_")}.json`);
+    READ_TOOLS = /* @__PURE__ */ new Set(["read", "read_file", "readfile", "view"]);
+    SHELL_TOOLS = /* @__PURE__ */ new Set(["bash", "shell", "run_shell_command", "local_shell", "exec_command"]);
+    SHELL_META = /[|;&<>$`()]/;
+    sessionFile = (stateRoot, sessionId) => path22.join(injectStateDir(stateRoot), `${sessionId.replace(/[^A-Za-z0-9_-]/g, "_")}.json`);
+    MAX_SUPPRESSED_LOGGED = 10;
   }
 });
 
-// packages/core/dist/knowledge/index.js
-var init_knowledge2 = __esm({
-  "packages/core/dist/knowledge/index.js"() {
+// packages/core/dist/knowledge/migrate.js
+import fs22 from "fs";
+import path23 from "path";
+import { execFileSync as execFileSync6 } from "child_process";
+function findLegacyKbs(cfg) {
+  const root = legacyRoot(cfg);
+  if (!fs22.existsSync(root))
+    return [];
+  return fs22.readdirSync(root, { withFileTypes: true }).filter((e) => e.isDirectory() && KB_NAME_RE.test(e.name)).map((e) => e.name).sort();
+}
+function ensureGitRepo(dir) {
+  if (fs22.existsSync(path23.join(dir, ".git")))
+    return false;
+  try {
+    execFileSync6("git", ["init", "-q", dir], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function ensureKbGitignore(dir) {
+  const file = path23.join(dir, ".gitignore");
+  if (fs22.existsSync(file))
+    return false;
+  fs22.writeFileSync(file, KB_GITIGNORE);
+  return true;
+}
+function findLegacyOverlays(cfg) {
+  return Object.keys(cfg.projects).filter((p) => fs22.existsSync(legacyOverlay(cfg, p))).sort();
+}
+function moveLegacyOverlays(cfg, opts = {}) {
+  return findLegacyOverlays(cfg).map((project) => {
+    const from = legacyOverlay(cfg, project);
+    const to = projectRulesHome(cfg, project);
+    const kb = `overlay:${project}`;
+    if (!to)
+      return { kb, from, to: "", action: "skipped", note: "no group KB or knowledgeHome for this project; set one, then re-run" };
+    if (fs22.existsSync(to))
+      return { kb, from, to, action: "skipped", note: "target already exists; nothing moved" };
+    if (opts.dryRun)
+      return { kb, from, to, action: "would-move" };
+    fs22.mkdirSync(path23.dirname(to), { recursive: true });
+    try {
+      fs22.renameSync(from, to);
+      return { kb, from, to, action: "moved" };
+    } catch (e) {
+      if (e.code !== "EXDEV")
+        throw e;
+      fs22.cpSync(from, to, { recursive: true });
+      return { kb, from, to, action: "copied", note: "cross-device: original left in place, delete it yourself once verified" };
+    }
+  });
+}
+function moveLegacyKbs(cfg, opts = {}) {
+  const hub = resolveHome(cfg.hubVault);
+  return findLegacyKbs(cfg).map((kb) => {
+    const from = legacyKbDir(hub, kb);
+    const to = kbDir(cfg, kb);
+    if (fs22.existsSync(to))
+      return { kb, from, to, action: "skipped", note: "target already exists; nothing moved" };
+    if (opts.dryRun)
+      return { kb, from, to, action: "would-move" };
+    fs22.mkdirSync(path23.dirname(to), { recursive: true });
+    let action = "moved";
+    try {
+      fs22.renameSync(from, to);
+    } catch (e) {
+      if (e.code !== "EXDEV")
+        throw e;
+      fs22.cpSync(from, to, { recursive: true });
+      action = "copied";
+    }
+    const notes = [];
+    const oldRules = path23.join(to, "rules"), newRules = path23.join(to, "shared", "rules");
+    if (fs22.existsSync(oldRules) && !fs22.existsSync(newRules)) {
+      fs22.mkdirSync(path23.dirname(newRules), { recursive: true });
+      fs22.renameSync(oldRules, newRules);
+      notes.push("rules/ -> shared/rules/");
+    }
+    if (ensureGitRepo(to))
+      notes.push("git init");
+    if (ensureKbGitignore(to))
+      notes.push("wrote .gitignore (raw/, .converted/)");
+    if (fs22.existsSync(path23.join(to, "index.json")))
+      notes.push(`index.json holds old paths: run squadrant knowledge reindex ${kb}`);
+    if (action === "copied")
+      notes.push("cross-device: original left in place, delete it yourself once verified");
+    return { kb, from, to, action, ...notes.length ? { note: notes.join("; ") } : {} };
+  });
+}
+var legacyRoot, KB_GITIGNORE, legacyOverlay;
+var init_migrate = __esm({
+  "packages/core/dist/knowledge/migrate.js"() {
+    init_dist();
     init_paths();
-    init_store2();
-    init_layers();
-    init_index_file();
-    init_search();
-    init_sources();
-    init_inject();
+    legacyRoot = (cfg) => path23.join(resolveHome(cfg.hubVault), "knowledge");
+    KB_GITIGNORE = "# squadrant KB defaults: source documents stay local\nraw/\n.converted/\n";
+    legacyOverlay = (cfg, project) => path23.join(resolveHome(cfg.projects[project].spokeVault), "knowledge", "rules");
   }
 });
 
-// packages/core/dist/index.js
-var dist_exports = {};
-__export(dist_exports, {
-  AGENT_BINS: () => AGENT_BINS,
-  ANTHROPIC_ONLY_REQUEST_FIELDS: () => ANTHROPIC_ONLY_REQUEST_FIELDS,
-  BOT_COMMANDS: () => BOT_COMMANDS,
-  CAPTAIN_RECEIVED_ACK: () => CAPTAIN_RECEIVED_ACK,
-  CC_SOCKS_DIR: () => CC_SOCKS_DIR,
-  CMUX_PRESERVE_CLAUDE_AUTH_ENV: () => CMUX_PRESERVE_CLAUDE_AUTH_ENV,
-  CONFLICT_409_SELF_HEAL_MS: () => CONFLICT_409_SELF_HEAL_MS,
-  CREW_GONE_MS: () => CREW_GONE_MS,
-  CREW_STALE_MS: () => CREW_STALE_MS,
-  CaptainDelivery: () => CaptainDelivery,
-  DEFAULT_BLOCKED_RENUDGE_MS: () => DEFAULT_BLOCKED_RENUDGE_MS,
-  DEFAULT_FIRST_TURN_RESEND_COOLDOWN_MS: () => DEFAULT_FIRST_TURN_RESEND_COOLDOWN_MS,
-  DEFAULT_FIRST_TURN_UNDELIVERED_BUDGET_MS: () => DEFAULT_FIRST_TURN_UNDELIVERED_BUDGET_MS,
-  DEFAULT_GATE_DENY_RULES: () => DEFAULT_GATE_DENY_RULES,
-  DEFAULT_GATE_TOOLS: () => DEFAULT_GATE_TOOLS,
-  DEFAULT_SEARCH_STATUSES: () => DEFAULT_SEARCH_STATUSES,
-  DEFAULT_TASK_TIMEOUT_MS: () => DEFAULT_TASK_TIMEOUT_MS,
-  DeferDelivery: () => DeferDelivery,
-  FIRST_TURN_INLINE_MAX_BYTES: () => FIRST_TURN_INLINE_MAX_BYTES,
-  FactLog: () => FactLog,
-  GROUP_DISPATCH_WARMUP_POLL_MS: () => GROUP_DISPATCH_WARMUP_POLL_MS,
-  GROUP_DISPATCH_WARMUP_TIMEOUT_MS: () => GROUP_DISPATCH_WARMUP_TIMEOUT_MS,
-  GateDecisionCache: () => GateDecisionCache,
-  IDLE_DEBOUNCE_MS: () => IDLE_DEBOUNCE_MS,
-  INJECT_BUDGET_MS: () => INJECT_BUDGET_MS,
-  LABEL: () => LABEL,
-  LivenessRegistry: () => LivenessRegistry,
-  MONITOR_STALL_BUDGET_MS: () => MONITOR_STALL_BUDGET_MS,
-  OPERATOR_INITIATED_COMMANDS: () => OPERATOR_INITIATED_COMMANDS,
-  PANE_IDLE_AFTER_MS: () => PANE_IDLE_AFTER_MS,
-  PROBE_QUIET_MS: () => PROBE_QUIET_MS,
-  PROMPT_MIN_SCORE: () => PROMPT_MIN_SCORE,
-  PROMPT_RULE_CAP: () => PROMPT_RULE_CAP,
-  PROMPT_SINGLE_TERM_MIN_SCORE: () => PROMPT_SINGLE_TERM_MIN_SCORE,
-  PROPOSED_DIR: () => PROPOSED_DIR,
-  PROTOCOL_VERSION: () => PROTOCOL_VERSION,
-  READ_ONLY_CREW_SUBCOMMANDS: () => READ_ONLY_CREW_SUBCOMMANDS,
-  READ_ONLY_TOP_LEVEL_COMMANDS: () => READ_ONLY_TOP_LEVEL_COMMANDS,
-  ROUTER_READY_ATTEMPTS: () => ROUTER_READY_ATTEMPTS,
-  ROUTER_READY_DELAY_MS: () => ROUTER_READY_DELAY_MS,
-  SERVER_TOOL_TYPE_RE: () => SERVER_TOOL_TYPE_RE,
-  SESSION_RULE_CAP: () => SESSION_RULE_CAP,
-  SIDE_SESSION_ENV: () => SIDE_SESSION_ENV,
-  SOURCES_TEMPLATE: () => SOURCES_TEMPLATE,
+// packages/core/dist/knowledge/anchor.js
+import fs23 from "fs";
+import path24 from "path";
+function* repoFiles(root) {
+  let count = 0;
+  const stack = [root];
+  while (stack.length) {
+    const dir = stack.pop();
+    let ents;
+    try {
+      ents = fs23.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name < b.name ? 1 : -1);
+    } catch {
+      continue;
+    }
+    for (const ent of ents) {
+      if (ent.isDirectory()) {
+        if (!SKIP_DIRS.has(ent.name))
+          stack.push(path24.join(dir, ent.name));
+      } else if (ent.isFile() && CODE_EXT.has(path24.extname(ent.name))) {
+        if (++count > MAX_FILES)
+          return;
+        yield path24.join(dir, ent.name);
+      }
+    }
+  }
+}
+function computeAnchor(repoRoot, triggers) {
+  const terms2 = anchorTerms(triggers);
+  if (!terms2.length || !fs23.existsSync(repoRoot))
+    return null;
+  const hits = [];
+  for (const file of repoFiles(repoRoot)) {
+    let text;
+    try {
+      if (fs23.statSync(file).size > MAX_FILE_BYTES)
+        continue;
+      text = fs23.readFileSync(file, "utf8");
+    } catch {
+      continue;
+    }
+    const hay = `${path24.relative(repoRoot, file)}
+${text}`.toLowerCase();
+    const score = terms2.filter((t) => hay.includes(t)).length;
+    if (!score)
+      continue;
+    const symbols2 = [...text.matchAll(SYMBOL_RE)].map((m) => m[1]).filter((s) => terms2.some((t) => s.toLowerCase().includes(t)));
+    hits.push({ rel: path24.relative(repoRoot, file).split(path24.sep).join("/"), score, symbols: symbols2 });
+  }
+  if (!hits.length)
+    return null;
+  hits.sort((a, b) => b.score - a.score || (a.rel < b.rel ? -1 : 1));
+  const top = hits.slice(0, MAX_PATHS);
+  const symbols = [...new Set(top.flatMap((h) => h.symbols))].sort().slice(0, MAX_SYMBOLS);
+  return { paths: top.map((h) => h.rel).sort(), ...symbols.length ? { symbols } : {} };
+}
+var SKIP_DIRS, CODE_EXT, MAX_FILES, MAX_FILE_BYTES, MAX_PATHS, MAX_SYMBOLS, SYMBOL_RE, anchorTerms;
+var init_anchor = __esm({
+  "packages/core/dist/knowledge/anchor.js"() {
+    SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "build", "coverage", ".next", ".worktrees", ".planning", ".converted"]);
+    CODE_EXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs", ".py", ".go", ".rs", ".java", ".kt", ".swift", ".rb", ".php", ".cs", ".sol", ".sql", ".md"]);
+    MAX_FILES = 5e3;
+    MAX_FILE_BYTES = 256 * 1024;
+    MAX_PATHS = 5;
+    MAX_SYMBOLS = 10;
+    SYMBOL_RE = /\b(?:function|class|interface|type|const|let|var|enum|def|fn|struct)\s+([A-Za-z_]\w*)/g;
+    anchorTerms = (t) => [...new Set([...t?.keywords ?? [], ...t?.expanded ?? []].map((s) => s.toLowerCase().trim()).filter((s) => s.length >= 3))].sort();
+  }
+});
+
+// packages/core/dist/knowledge/extract.js
+import fs24 from "fs";
+import path25 from "path";
+import matter3 from "gray-matter";
+function serialize(fm, body) {
+  return matter3.stringify(body.trim() + "\n", clean(fm));
+}
+function validateCandidate(c) {
+  const p = [];
+  if (typeof c.source !== "string" || !c.source)
+    p.push("source must be a non-empty string");
+  if (typeof c.id !== "string" || !RULE_ID_RE.test(c.id))
+    p.push(`id must match ${RULE_ID_RE}`);
+  if (typeof c.domain !== "string" || !/^[a-z][a-z0-9-]*$/.test(c.domain))
+    p.push("domain must be a lowercase slug");
+  if (!RULE_MODALITIES.includes(c.modality))
+    p.push(`modality must be one of ${RULE_MODALITIES.join("|")}`);
+  if (typeof c.statement !== "string" || !c.statement.trim())
+    p.push("statement must be non-empty");
+  if (typeof c.quote !== "string" || !c.quote.trim())
+    p.push("quote must be non-empty");
+  const t = c.triggers;
+  if (t !== void 0) {
+    for (const k of ["globs", "keywords", "expanded"]) {
+      const v2 = t[k];
+      if (v2 !== void 0 && !(Array.isArray(v2) && v2.every((x) => typeof x === "string")))
+        p.push(`triggers.${k} must be a string array`);
+    }
+    for (const g of t.globs ?? []) {
+      if (typeof g === "string" && /^\s*$/.test(g))
+        p.push("triggers.globs entries must be non-empty");
+    }
+  }
+  return p;
+}
+function upsertSource(fm, src) {
+  const i = fm.sources.findIndex((s) => s.ref === src.ref);
+  if (i < 0) {
+    fm.sources.push(src);
+    return true;
+  }
+  if (JSON.stringify(fm.sources[i]) === JSON.stringify(src))
+    return false;
+  fm.sources[i] = src;
+  return true;
+}
+function applyCandidates(input, opts) {
+  const { kb, kbRoot, rulesDir } = opts;
+  const res = { created: [], merged: [], proposed: [], superseded: [], stale: [], rejected: [], doclingFlags: [], idOverrides: [] };
+  const events = [];
+  const ev2 = (event, itemId, domain, extra = {}) => events.push({ kb, level: "group", project: "", domain, itemId, event, ...extra });
+  const loaded = loadRulesDir(rulesDir, `kb:${kb}`);
+  const work = /* @__PURE__ */ new Map();
+  for (const r of loaded.rules) {
+    const { statement: _s, body, file, layer: _l, ...fm } = r;
+    work.set(r.id, { fm, body, file, dirty: false, isNew: false });
+  }
+  const norm = /* @__PURE__ */ new Map();
+  const totals = /* @__PURE__ */ new Map();
+  const touched = /* @__PURE__ */ new Set();
+  const complete = new Set(input.complete ?? []);
+  for (const cand of input.candidates) {
+    const problems = validateCandidate(cand);
+    if (problems.length) {
+      res.rejected.push({ id: String(cand.id), source: String(cand.source), reason: `invalid: ${problems.join("; ")}` });
+      continue;
+    }
+    const st = readState2(kbRoot, cand.source);
+    const convFile = st ? convertedFile(kbRoot, cand.source) : null;
+    if (!st || !fs24.existsSync(convFile)) {
+      res.rejected.push({ id: cand.id, source: cand.source, reason: "unknown source (not ingested)" });
+      continue;
+    }
+    let hay = norm.get(cand.source);
+    if (!hay) {
+      hay = normalizedViews(fs24.readFileSync(convFile, "utf8"));
+      norm.set(cand.source, hay);
+    }
+    const tot = totals.get(cand.source) ?? { total: 0, dropped: 0 };
+    tot.total++;
+    totals.set(cand.source, tot);
+    const offset = findQuote(hay, cand.quote);
+    if (!offset) {
+      tot.dropped++;
+      res.rejected.push({ id: cand.id, source: cand.source, reason: "ungrounded" });
+      ev2("item.rejected", cand.id, cand.domain, { reason: "ungrounded" });
+      continue;
+    }
+    let id = cand.id;
+    for (const [wid, w] of work) {
+      const span = (s) => s.sha === st.sha ? s.offset : findQuote(hay, s.quote) ?? s.offset;
+      if (w.fm.sources.some((s) => s.ref === cand.source && s.offset && ((o) => !!o && spansOverlap(o, offset))(span(s)))) {
+        id = wid;
+        break;
+      }
+    }
+    if (id !== cand.id)
+      res.idOverrides.push({ from: cand.id, to: id });
+    touched.add(id);
+    const src = { ref: cand.source, sha: st.sha, ...cand.loc ? { loc: cand.loc } : {}, offset, quote: cand.quote.trim() };
+    const target = work.get(id);
+    const contradicted = (cand.contradicts ?? []).filter((x) => work.has(x) && x !== id);
+    const bodyOf = () => cand.statement.trim() + (cand.rationale?.trim() ? `
+
+${cand.rationale.trim()}` : "");
+    if (target && contradicted.length === 0 && sameMeaning(target, cand)) {
+      let changed = upsertSource(target.fm, src);
+      if (target.fm.status === "stale") {
+        target.fm.status = "active";
+        changed = true;
+      }
+      if (changed) {
+        target.dirty = true;
+        res.merged.push(id);
+      }
+      continue;
+    }
+    if (!target && contradicted.length === 0) {
+      const fm2 = {
+        id,
+        domain: cand.domain,
+        modality: cand.modality,
+        status: "active",
+        ...cand.triggers ? { triggers: cand.triggers } : {},
+        sources: [src],
+        approvedBy: "auto",
+        justification: "",
+        supersedes: [],
+        conflictsWith: []
+      };
+      work.set(id, { fm: fm2, body: bodyOf(), file: path25.join(rulesDir, cand.domain, `${id}.md`), dirty: true, isNew: true });
+      res.created.push(id);
+      ev2("item.applied", id, cand.domain);
+      continue;
+    }
+    const fm = {
+      id,
+      domain: target?.fm.domain ?? cand.domain,
+      modality: cand.modality,
+      status: "proposed",
+      ...cand.triggers ?? target?.fm.triggers ? { triggers: cand.triggers ?? target?.fm.triggers } : {},
+      sources: [src],
+      approvedBy: "reviewer-agent",
+      justification: "",
+      supersedes: [],
+      conflictsWith: contradicted
+    };
+    const dir = path25.join(rulesDir, PROPOSED_DIR);
+    const file = path25.join(dir, `${id}@${st.sha.slice(0, SHA_LEN)}.md`);
+    const text = serialize(fm, bodyOf());
+    if (fs24.existsSync(file) && fs24.readFileSync(file, "utf8") === text)
+      continue;
+    fs24.mkdirSync(dir, { recursive: true });
+    for (const other of fs24.readdirSync(dir)) {
+      if (!other.startsWith(`${id}@`) || !other.endsWith(".md") || path25.join(dir, other) === file)
+        continue;
+      const old = matter3(fs24.readFileSync(path25.join(dir, other), "utf8"));
+      if (!old.data.sources?.some((s) => s.ref === cand.source))
+        continue;
+      fs24.writeFileSync(path25.join(dir, other.replace(/\.md$/, ".superseded")), matter3.stringify(old.content, { ...old.data, supersededBy: path25.basename(file) }));
+      fs24.rmSync(path25.join(dir, other));
+      res.superseded.push(other.replace(/\.md$/, ""));
+      ev2("item.superseded", id, fm.domain);
+    }
+    fs24.writeFileSync(file, text);
+    res.proposed.push(`${id}@${st.sha.slice(0, SHA_LEN)}`);
+    ev2("item.proposed", id, fm.domain);
+  }
+  for (const [id, w] of work) {
+    if (touched.has(id) || w.fm.status !== "active" || w.isNew)
+      continue;
+    if (w.fm.sources.length && w.fm.sources.every((s) => complete.has(s.ref))) {
+      w.fm.status = "stale";
+      w.dirty = true;
+      res.stale.push(id);
+    }
+  }
+  for (const w of work.values()) {
+    if (!w.dirty || !opts.projects?.length)
+      continue;
+    const anchors = { ...w.fm.anchors ?? {} };
+    for (const p of opts.projects) {
+      const a = computeAnchor(p.root, w.fm.triggers);
+      if (a)
+        anchors[p.name] = a;
+    }
+    if (Object.keys(anchors).length)
+      w.fm.anchors = anchors;
+  }
+  for (const w of work.values()) {
+    if (!w.dirty)
+      continue;
+    fs24.mkdirSync(path25.dirname(w.file), { recursive: true });
+    const text = serialize(w.fm, w.body);
+    if (!fs24.existsSync(w.file) || fs24.readFileSync(w.file, "utf8") !== text)
+      fs24.writeFileSync(w.file, text);
+  }
+  for (const [ref, t] of totals)
+    if (needsDocling(t.dropped, t.total))
+      res.doclingFlags.push({ ref, ...t });
+  const live = loadRulesDir(rulesDir, `kb:${kb}`).rules;
+  writeIndex(kbRoot, compileIndex(kb, live, opts.now?.()));
+  appendAudit(events, opts.audit);
+  return res;
+}
+var SHA_LEN, clean, sameMeaning;
+var init_extract = __esm({
+  "packages/core/dist/knowledge/extract.js"() {
+    init_dist();
+    init_audit();
+    init_anchor();
+    init_index_file();
+    init_ingest();
+    init_paths();
+    init_store2();
+    init_verify();
+    SHA_LEN = 12;
+    clean = (v2) => JSON.parse(JSON.stringify(v2));
+    sameMeaning = (existing, c) => {
+      if (existing.fm.modality !== c.modality)
+        return false;
+      if (normalizeText(existing.body.trim().split(/\n\s*\n/)[0] ?? "") === normalizeText(c.statement))
+        return true;
+      return c.meaning === "same";
+    };
+  }
+});
+
+// packages/core/dist/knowledge/schedule.js
+import fs25 from "fs";
+import path26 from "path";
+function readSchedule(stateRoot) {
+  try {
+    return JSON.parse(fs25.readFileSync(scheduleFile(stateRoot), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeSchedule(stateRoot, s) {
+  fs25.mkdirSync(stateRoot, { recursive: true });
+  const tmp = `${scheduleFile(stateRoot)}.${process.pid}.tmp`;
+  fs25.writeFileSync(tmp, JSON.stringify(s, null, 2) + "\n");
+  fs25.renameSync(tmp, scheduleFile(stateRoot));
+}
+function snapshotSources(kbRoot, sources) {
+  const out = {};
+  for (const e of sources)
+    for (const f of expandSource(kbRoot, e)) {
+      const d = detectChange(kbRoot, f);
+      out[d.ref] = d.stamp.sha;
+    }
+  return out;
+}
+function changedRefs(kbRoot, sources) {
+  const out = [];
+  for (const e of sources) {
+    for (const f of expandSource(kbRoot, e)) {
+      const d = detectChange(kbRoot, f);
+      const st = readState2(kbRoot, d.ref);
+      if (d.changed || st && st.cursor < st.sections)
+        out.push(d.ref);
+    }
+  }
+  return out;
+}
+function duePass(entry, o) {
+  const now = o.now.getTime();
+  if (o.empty && !entry.lastFullAt)
+    return "full";
+  const fullBase = entry.lastFullAt ?? entry.createdAt;
+  if (fullBase && now >= Date.parse(fullBase) + o.rc.fullEveryDays * DAY_MS)
+    return "full";
+  if (entry.firstChangeAt && entry.incrementalDueAt && now >= Date.parse(entry.incrementalDueAt))
+    return "incremental";
+  return null;
+}
+function acquirePass(entry, pass, now, snapshot, log) {
+  if (entry.running) {
+    if (now.getTime() - Date.parse(entry.running.startedAt) <= RUNNING_STALE_MS)
+      return false;
+    log?.(`knowledge: clearing stale ${entry.running.pass} pass started ${entry.running.startedAt}`);
+  }
+  entry.running = { pass, startedAt: now.toISOString(), sourceSnapshot: snapshot };
+  return true;
+}
+function requestText(kb, pass) {
+  const absorbed = pass === "full" ? " (absorbs any pending incremental pass)" : "";
+  return `KB ${kb}: ${pass} reconcile due${absorbed}. Spawn a crew with the knowledge-review skill: it extracts changed sources, reviews proposals, then runs \`squadrant knowledge reconcile ${kb}${pass === "full" ? " --full" : ""} --finish\`.`;
+}
+async function requestPass(kb, pass, d, opts = {}) {
+  const now = d.now?.() ?? /* @__PURE__ */ new Date();
+  const home = resolveKbConfig(d.cfg, kb).homeProject;
+  if (!home)
+    return { kb, pass, requested: false, reason: "no homeProject configured" };
+  const schedule = readSchedule(d.stateRoot);
+  const entry = schedule[kb] ??= { createdAt: now.toISOString() };
+  const root = kbDir(d.cfg, kb);
+  if (opts.dryRun) {
+    const busy = entry.running && now.getTime() - Date.parse(entry.running.startedAt) <= RUNNING_STALE_MS;
+    return { kb, pass, requested: false, reason: busy ? `a ${entry.running.pass} pass is already running` : `dry run: would enqueue to ${home}` };
+  }
+  const snapshot = snapshotSources(root, loadSources(root).sources);
+  if (!acquirePass(entry, pass, now, snapshot, d.log))
+    return { kb, pass, requested: false, reason: `a ${entry.running.pass} pass is already running` };
+  writeSchedule(d.stateRoot, schedule);
+  try {
+    await d.enqueue(home, requestText(kb, pass));
+  } catch (e) {
+    delete entry.running;
+    writeSchedule(d.stateRoot, schedule);
+    throw e;
+  }
+  return { kb, pass, requested: true };
+}
+async function tickKnowledgeSchedule(d) {
+  const out = [];
+  const now = d.now?.() ?? /* @__PURE__ */ new Date();
+  for (const kb of Object.keys(kbConfigs(d.cfg))) {
+    if (!resolveKbConfig(d.cfg, kb).homeProject)
+      continue;
+    try {
+      const root = kbDir(d.cfg, kb);
+      if (!fs25.existsSync(root))
+        continue;
+      const { sources } = loadSources(root);
+      if (!sources.length)
+        continue;
+      const schedule = readSchedule(d.stateRoot);
+      const entry = schedule[kb] ??= { createdAt: now.toISOString() };
+      const rc = reconcileConfig(d.cfg, kb);
+      let dirty = false;
+      if (entry.running && now.getTime() - Date.parse(entry.running.startedAt) > RUNNING_STALE_MS) {
+        d.log?.(`knowledge: ${kb} pass stale, cleared`);
+        delete entry.running;
+        dirty = true;
+      }
+      if (!entry.running && !entry.firstChangeAt && changedRefs(root, sources).length) {
+        entry.firstChangeAt = now.toISOString();
+        entry.incrementalDueAt = new Date(now.getTime() + rc.incrementalAfterDays * DAY_MS).toISOString();
+        dirty = true;
+      }
+      if (dirty)
+        writeSchedule(d.stateRoot, schedule);
+      if (entry.running)
+        continue;
+      const empty = loadKbRules(d.cfg, kb, { includeProposed: true }).rules.length === 0;
+      const pass = duePass(entry, { now, rc, empty });
+      if (pass)
+        out.push(await requestPass(kb, pass, d));
+    } catch (e) {
+      d.log?.(`knowledge schedule error (${kb}): ${e.message}`);
+    }
+  }
+  return out;
+}
+function completePass(kb, d) {
+  const now = d.now?.() ?? /* @__PURE__ */ new Date();
+  const schedule = readSchedule(d.stateRoot);
+  const entry = schedule[kb] ??= { createdAt: now.toISOString() };
+  const pass = d.pass ?? entry.running?.pass ?? "incremental";
+  const snap = entry.running?.sourceSnapshot;
+  const root = kbDir(d.cfg, kb);
+  delete entry.running;
+  if (pass === "full")
+    entry.lastFullAt = now.toISOString();
+  delete entry.firstChangeAt;
+  delete entry.incrementalDueAt;
+  if (snap) {
+    const nowSnap = snapshotSources(root, loadSources(root).sources);
+    if (Object.entries(nowSnap).some(([ref, sha]) => snap[ref] !== sha)) {
+      entry.firstChangeAt = now.toISOString();
+      entry.incrementalDueAt = new Date(now.getTime() + reconcileConfig(d.cfg, kb).incrementalAfterDays * DAY_MS).toISOString();
+    }
+  }
+  writeSchedule(d.stateRoot, schedule);
+  return pass;
+}
+var RUNNING_STALE_MS, DAY_MS, scheduleFile, reconcileConfig;
+var init_schedule = __esm({
+  "packages/core/dist/knowledge/schedule.js"() {
+    init_dist();
+    init_ingest();
+    init_layers();
+    init_paths();
+    init_sources();
+    RUNNING_STALE_MS = 6 * 60 * 60 * 1e3;
+    DAY_MS = 24 * 60 * 60 * 1e3;
+    scheduleFile = (stateRoot) => path26.join(stateRoot, "knowledge-schedule.json");
+    reconcileConfig = (cfg, kb) => ({ ...DEFAULT_RECONCILE, ...kbConfigs(cfg)[kb]?.reconcile });
+  }
+});
+
+// packages/core/dist/knowledge/review.js
+import crypto4 from "crypto";
+import { execFileSync as execFileSync7 } from "child_process";
+import fs26 from "fs";
+import path27 from "path";
+import matter4 from "gray-matter";
+function readEscalations(kbRoot) {
+  try {
+    return JSON.parse(fs26.readFileSync(escalationsFile(kbRoot), "utf8")).items;
+  } catch {
+    return [];
+  }
+}
+function writeEscalations(kbRoot, items) {
+  fs26.mkdirSync(kbRoot, { recursive: true });
+  fs26.writeFileSync(escalationsFile(kbRoot), JSON.stringify({ items }, null, 2) + "\n");
+}
+function addEscalation(kbRoot, e) {
+  const items = readEscalations(kbRoot);
+  if (items.some((x) => x.key === e.key))
+    return false;
+  writeEscalations(kbRoot, [...items, e]);
+  return true;
+}
+function appendVerdict(kbRoot, v2, now) {
+  fs26.mkdirSync(kbRoot, { recursive: true });
+  fs26.appendFileSync(verdictsFile(kbRoot), JSON.stringify({ ts: now.toISOString(), ...v2 }) + "\n");
+}
+function priorityOfRef(c, ref) {
+  if (ref.startsWith("agent:"))
+    return "agent";
+  const root = kbDir(c.cfg, c.kb);
+  for (const e of c.sources)
+    for (const f of expandSource(root, e))
+      if (refFor(root, f) === ref)
+        return e.priority;
+  return "project";
+}
+function priorityOfRule(c, r) {
+  return r.sources.map((s) => priorityOfRef(c, s.ref)).sort((a, b) => PRIORITY_RANK[b] - PRIORITY_RANK[a])[0] ?? "project";
+}
+function loadProposals(c) {
+  const dir = kbRulesDir(c.cfg, c.kb);
+  const live = loadRulesDir(dir, `kb:${c.kb}`).rules;
+  const byId = new Map(live.map((r) => [r.id, r]));
+  const proposals = [];
+  const pdirs = /* @__PURE__ */ new Set();
+  for (const f of fs26.existsSync(dir) ? walkDirs(dir) : [])
+    if (path27.basename(f) === PROPOSED_DIR)
+      pdirs.add(f);
+  for (const pd of pdirs) {
+    for (const rule of loadRulesDir(pd, `kb:${c.kb}`, { includeProposed: true }).rules) {
+      proposals.push({ key: path27.basename(rule.file).replace(/\.md$/, ""), rule, live: byId.get(rule.id) });
+    }
+  }
+  return { proposals, live };
+}
+function walkDirs(dir, out = []) {
+  for (const e of fs26.readdirSync(dir, { withFileTypes: true }))
+    if (e.isDirectory()) {
+      const f = path27.join(dir, e.name);
+      out.push(f);
+      walkDirs(f, out);
+    }
+  return out;
+}
+function reindex(c) {
+  const live = loadRulesDir(kbRulesDir(c.cfg, c.kb), `kb:${c.kb}`).rules;
+  writeIndex(kbDir(c.cfg, c.kb), compileIndex(c.kb, live, nowOf(c)));
+}
+function anchorsFor(c, fm) {
+  const anchors = { ...fm.anchors ?? {} };
+  for (const p of c.projects ?? []) {
+    const a = computeAnchor(p.root, fm.triggers);
+    if (a)
+      anchors[p.name] = a;
+  }
+  return Object.keys(anchors).length ? anchors : void 0;
+}
+function promoteProposal(c, p, by, justification, events) {
+  const dir = kbRulesDir(c.cfg, c.kb);
+  const { fm, body } = readFm(p.rule.file);
+  const retired = [];
+  for (const id of fm.conflictsWith ?? []) {
+    const other = loadRulesDir(dir, `kb:${c.kb}`).rules.find((r) => r.id === id);
+    if (!other || other.id === fm.id)
+      continue;
+    const o = readFm(other.file);
+    o.fm.status = "retired";
+    fs26.writeFileSync(other.file, fileText(o.fm, o.body));
+    retired.push(id);
+    events.push(ev(c, "item.superseded", id, o.fm.domain));
+  }
+  const next = { ...fm, status: "active", approvedBy: by, justification, supersedes: [.../* @__PURE__ */ new Set([...fm.supersedes ?? [], ...retired])], conflictsWith: [] };
+  if (p.live?.decision)
+    next.decision = p.live.decision;
+  const anchors = anchorsFor(c, { ...next, anchors: p.live?.anchors ?? fm.anchors });
+  if (anchors)
+    next.anchors = anchors;
+  const target = p.live?.file ?? path27.join(dir, next.domain, `${next.id}.md`);
+  fs26.mkdirSync(path27.dirname(target), { recursive: true });
+  fs26.writeFileSync(target, fileText(next, body));
+  fs26.rmSync(p.rule.file);
+  events.push(ev(c, "item.approved", next.id, next.domain), ev(c, "item.applied", next.id, next.domain));
+  if (p.live)
+    events.push(ev(c, "item.superseded", next.id, next.domain));
+}
+function dropProposal(c, p, events) {
+  fs26.rmSync(p.rule.file);
+  events.push(ev(c, "item.rejected", p.rule.id, p.rule.domain, { reason: "reviewer" }));
+}
+function mergeInto(c, p, targetId, live, events) {
+  const t = live.find((r) => r.id === targetId);
+  if (!t)
+    return false;
+  const tf = readFm(t.file);
+  for (const s of p.rule.sources)
+    if (!tf.fm.sources.some((x) => x.ref === s.ref))
+      tf.fm.sources.push(s);
+  fs26.writeFileSync(t.file, fileText(tf.fm, tf.body));
+  fs26.rmSync(p.rule.file);
+  events.push(ev(c, "item.superseded", p.rule.id, p.rule.domain), ev(c, "item.applied", targetId, t.domain));
+  return true;
+}
+function evaluateCodeConflict(c, rule, cc) {
+  const g = c.git ?? realGit;
+  const proj = (c.projects ?? []).find((p) => p.name === cc.project);
+  const root = proj?.root;
+  const code = root ? g.lastCommit(root, cc.files) : null;
+  const kbRoot = kbDir(c.cfg, c.kb);
+  const docDates = rule.sources.map((s) => g.docDate(fileForRef(kbRoot, s.ref))).filter((d2) => !!d2).sort();
+  const docDate = docDates[docDates.length - 1];
+  const docRev = docRevOf(rule);
+  const evidence = { docRev, codeRev: code?.rev ?? "unknown", files: cc.files, project: cc.project };
+  const doc = rule.sources.map((s) => `${s.ref} (${docDate ?? "date unknown"})`).join(", ");
+  if (!code || !docDate) {
+    return { action: "escalate", evidence, explanation: `Rule ${rule.id} ("${rule.statement}") may conflict with code in ${cc.project} (${cc.files.join(", ")}): ${cc.summary}. Dates could not be verified (doc ${doc}; code ${code?.date ?? "unknown"}), so a human must judge it.` };
+  }
+  if (Date.parse(docDate) >= Date.parse(code.date)) {
+    return { action: "flag-violation", explanation: `Code in ${cc.project} (${cc.files.join(", ")}, last commit ${code.date}) contradicts rule ${rule.id}, but the doc (${doc}) is newer: treat the code as the violation. ${cc.summary}` };
+  }
+  const d = rule.decision;
+  if (d && d.docRev === docRev && !g.changedSince(root, cc.files, d.at))
+    return { action: "skip-decided" };
+  const reopened = d ? ` An earlier decision (${d.verdict}, ${d.at}) is re-opened because ${d.docRev !== docRev ? "the doc has a new revision" : "the anchored code changed after it"}.` : "";
+  return {
+    action: "escalate",
+    evidence,
+    explanation: `Rule ${rule.id} ("${rule.statement}") from ${doc} is contradicted by newer code: ${cc.project} ${cc.files.join(", ")} (last commit ${code.date}). ${cc.summary} Keeping the doc leaves the code in violation; superseding with the code retires this rule and any code-derived replacement inherits its priority unless you say otherwise.${reopened}`
+  };
+}
+function applyDecisions(file, c) {
+  const now = nowOf(c);
+  const kbRoot = kbDir(c.cfg, c.kb);
+  const threshold = reconcileConfig(c.cfg, c.kb).autoApproveConfidence;
+  const res = { applied: [], escalated: [], violations: [], skipped: [] };
+  const events = [];
+  let { proposals, live } = loadProposals(c);
+  const escalate = (e) => {
+    addEscalation(kbRoot, { createdAt: now.toISOString(), needsYou: true, ...e });
+    res.escalated.push({ key: e.key, reasons: e.reasons });
+  };
+  const verdict = (d, outcome, extra = {}) => appendVerdict(kbRoot, { kb: c.kb, kind: "review", item: d.item, outcome, ...extra }, now);
+  for (const d of file.decisions ?? []) {
+    const conf = Number.isFinite(d.confidence) ? d.confidence : 0;
+    const stale = d.item.startsWith("stale:");
+    const prop = stale ? void 0 : proposals.find((p2) => p2.key === d.item);
+    const rule = stale ? live.find((r) => r.id === d.item.slice(6)) : prop?.rule ?? live.find((r) => r.id === d.item);
+    if (!rule) {
+      res.skipped.push({ item: d.item, reason: "no such proposal or rule" });
+      continue;
+    }
+    const reasons = [];
+    if (d.codeConflict) {
+      const target = prop?.live ?? live.find((r) => r.id === rule.id) ?? rule;
+      const v2 = evaluateCodeConflict(c, target, d.codeConflict);
+      if (v2.action === "flag-violation") {
+        escalate({ key: `violation:${target.id}`, kind: "code-violation", ruleId: target.id, reasons: ["doc newer than code"], explanation: v2.explanation, needsYou: false });
+        res.violations.push(target.id);
+      } else if (v2.action === "escalate") {
+        escalate({ key: `code-vs-doc:${target.id}`, kind: "code-vs-doc", ruleId: target.id, reasons: ["code-vs-doc"], explanation: v2.explanation, evidence: v2.evidence, confidence: conf });
+        verdict(d, "escalated", { reasons: ["code-vs-doc"], confidence: conf });
+      }
+      if (!prop && !stale)
+        continue;
+      if (v2.action === "escalate") {
+        reasons.push("code-vs-doc");
+      }
+    }
+    if (stale) {
+      if (d.decision === "reject") {
+        const f = readFm(rule.file);
+        f.fm.status = "active";
+        if (d.loc && f.fm.sources[0])
+          f.fm.sources[0].loc = d.loc;
+        if (conf >= threshold && !d.flag && !reasons.length) {
+          fs26.writeFileSync(rule.file, fileText(f.fm, f.body));
+          res.applied.push(d.item);
+          events.push(ev(c, "item.applied", rule.id, rule.domain));
+          verdict(d, "applied", { confidence: conf });
+          continue;
+        }
+        reasons.push(conf < threshold ? "low-confidence" : "reviewer-flagged");
+      } else if (d.decision === "approve") {
+        if (strong(rule.modality))
+          reasons.push("retiring must/must-not");
+        if (conf < threshold)
+          reasons.push("low-confidence");
+        if (d.flag)
+          reasons.push("reviewer-flagged");
+        if (!reasons.length) {
+          const f = readFm(rule.file);
+          f.fm.status = "retired";
+          fs26.writeFileSync(rule.file, fileText(f.fm, f.body));
+          res.applied.push(d.item);
+          events.push(ev(c, "item.archived", rule.id, rule.domain));
+          verdict(d, "applied", { confidence: conf });
+          continue;
+        }
+      } else
+        reasons.push("reviewer-flagged");
+      escalate({ key: d.item, kind: "stale-retire", ruleId: rule.id, item: d.item, reasons: [...new Set(reasons)], explanation: `Rule ${rule.id} ("${rule.statement}") lost its source support. Reviewer: ${d.justification}`, confidence: conf });
+      verdict(d, "escalated", { reasons, confidence: conf });
+      continue;
+    }
+    const p = prop;
+    if (d.decision === "escalate" || d.flag)
+      reasons.push("reviewer-flagged");
+    if (conf < threshold)
+      reasons.push("low-confidence");
+    if (d.decision === "approve") {
+      const myPri = priorityOfRule(c, p.rule);
+      const conflicted = (p.rule.conflictsWith ?? []).map((id) => live.find((r) => r.id === id)).filter((r) => !!r);
+      if (myPri === "company" && conflicted.some((r) => priorityOfRule(c, r) === "company"))
+        reasons.push("company-vs-company conflict");
+      const retired = [...conflicted, ...p.live && p.live.modality !== p.rule.modality ? [p.live] : []];
+      if (retired.some((r) => strong(r.modality)))
+        reasons.push("retiring must/must-not");
+    }
+    if (reasons.length) {
+      escalate({ key: p.key, kind: "proposal", ruleId: p.rule.id, item: p.key, reasons: [...new Set(reasons)], explanation: `Proposal ${p.key}: "${p.rule.statement}"${p.live ? ` (replaces live "${p.live.statement}")` : ""}. Reviewer (${d.decision}, ${conf}): ${d.justification}`, confidence: conf });
+      verdict(d, "escalated", { reasons: [...new Set(reasons)], confidence: conf, decision: d.decision });
+      continue;
+    }
+    if (d.decision === "approve")
+      promoteProposal(c, p, "reviewer-agent", d.justification, events);
+    else if (d.decision === "reject")
+      dropProposal(c, p, events);
+    else if (d.decision.startsWith("merge-into:")) {
+      if (!mergeInto(c, p, d.decision.slice("merge-into:".length), live, events)) {
+        res.skipped.push({ item: d.item, reason: `merge target ${d.decision.slice(11)} not found` });
+        continue;
+      }
+    } else {
+      res.skipped.push({ item: d.item, reason: `unknown decision '${d.decision}'` });
+      continue;
+    }
+    res.applied.push(d.item);
+    verdict(d, "applied", { decision: d.decision, confidence: conf, justification: d.justification });
+    ({ proposals, live } = loadProposals(c));
+  }
+  for (const pd of file.pairs ?? [])
+    applyPair(pd, c, res, threshold, events, kbRoot, now);
+  reindex(c);
+  appendAudit(events, c.audit);
+  return res;
+}
+function applyPair(pd, c, res, threshold, events, kbRoot, now) {
+  const { live } = loadProposals(c);
+  const a = live.find((r) => r.id === pd.a), b = live.find((r) => r.id === pd.b);
+  const key = `pair:${[pd.a, pd.b].sort().join("+")}`;
+  if (!a || !b) {
+    res.skipped.push({ item: key, reason: "rule not found" });
+    return;
+  }
+  const esc = (reasons2) => {
+    addEscalation(kbRoot, { key, kind: "pair", reasons: reasons2, explanation: `${a.id} ("${a.statement}") vs ${b.id} ("${b.statement}"): ${pd.relation}. ${pd.justification}`, confidence: pd.confidence, createdAt: now.toISOString(), needsYou: true });
+    res.escalated.push({ key, reasons: reasons2 });
+  };
+  appendVerdict(kbRoot, { kb: c.kb, kind: "pair", item: key, relation: pd.relation, confidence: pd.confidence }, now);
+  if (pd.relation === "unrelated" || pd.relation === "refines")
+    return;
+  if (pd.relation === "conflicts") {
+    const reasons2 = priorityOfRule(c, a) === "company" && priorityOfRule(c, b) === "company" ? ["company-vs-company conflict"] : pd.confidence < threshold ? ["low-confidence"] : [];
+    if (reasons2.length) {
+      esc(reasons2);
+      return;
+    }
+    for (const [x, y] of [[a, b], [b, a]]) {
+      const f = readFm(x.file);
+      f.fm.conflictsWith = [.../* @__PURE__ */ new Set([...f.fm.conflictsWith ?? [], y.id])];
+      fs26.writeFileSync(x.file, fileText(f.fm, f.body));
+    }
+    return;
+  }
+  const keep = pd.keep === b.id ? b : a, drop = keep === a ? b : a;
+  const reasons = [...pd.confidence < threshold ? ["low-confidence"] : [], ...strong(drop.modality) && drop.modality !== keep.modality ? ["retiring must/must-not"] : []];
+  if (reasons.length) {
+    esc(reasons);
+    return;
+  }
+  const kf = readFm(keep.file);
+  for (const s of drop.sources)
+    if (!kf.fm.sources.some((x) => x.ref === s.ref))
+      kf.fm.sources.push(s);
+  kf.fm.supersedes = [.../* @__PURE__ */ new Set([...kf.fm.supersedes ?? [], drop.id])];
+  fs26.writeFileSync(keep.file, fileText(kf.fm, kf.body));
+  const df = readFm(drop.file);
+  df.fm.status = "retired";
+  fs26.writeFileSync(drop.file, fileText(df.fm, df.body));
+  events.push(ev(c, "item.superseded", drop.id, drop.domain), ev(c, "item.applied", keep.id, keep.domain));
+  res.applied.push(key);
+}
+function resolveEscalation(c, key, r, by, reason) {
+  const now = nowOf(c);
+  const kbRoot = kbDir(c.cfg, c.kb);
+  const items = readEscalations(kbRoot);
+  const esc = items.find((e) => e.key === key);
+  if (!esc)
+    throw new Error(`No open escalation '${key}'`);
+  const events = [];
+  const { proposals, live } = loadProposals(c);
+  const done = (msg) => {
+    writeEscalations(kbRoot, items.filter((e) => e.key !== key));
+    appendVerdict(kbRoot, { kb: c.kb, kind: "operator", item: key, resolution: r, by, reason }, now);
+    reindex(c);
+    appendAudit(events, c.audit);
+    return msg;
+  };
+  if (esc.kind === "code-vs-doc") {
+    if (r.kind !== "verdict")
+      throw new Error("code-vs-doc needs --keep-doc or --supersede-with-code");
+    const rule = live.find((x) => x.id === esc.ruleId);
+    if (!rule || !esc.evidence)
+      throw new Error(`rule ${esc.ruleId} or its evidence is gone`);
+    const f = readFm(rule.file);
+    const decision = { by, at: now.toISOString(), verdict: r.verdict, docRev: esc.evidence.docRev, codeRev: esc.evidence.codeRev, files: esc.evidence.files, reason };
+    f.fm.decision = decision;
+    if (r.verdict === "supersede-with-code") {
+      f.fm.status = "retired";
+      events.push(ev(c, "item.superseded", rule.id, rule.domain));
+    }
+    fs26.writeFileSync(rule.file, fileText(f.fm, f.body));
+    return done(`${rule.id}: ${r.verdict}`);
+  }
+  if (esc.kind === "proposal") {
+    const p = proposals.find((x) => x.key === esc.item);
+    if (!p)
+      throw new Error(`proposal ${esc.item} no longer exists`);
+    if (r.kind === "approve")
+      promoteProposal(c, p, "human", reason || "approved by operator", events);
+    else if (r.kind === "reject")
+      dropProposal(c, p, events);
+    else
+      throw new Error("proposal needs approve or reject");
+    return done(`${p.key}: ${r.kind}`);
+  }
+  if (esc.kind === "stale-retire") {
+    const rule = live.find((x) => x.id === esc.ruleId);
+    if (rule) {
+      const f = readFm(rule.file);
+      f.fm.status = r.kind === "approve" ? "retired" : "active";
+      fs26.writeFileSync(rule.file, fileText(f.fm, f.body));
+      events.push(ev(c, r.kind === "approve" ? "item.archived" : "item.applied", rule.id, rule.domain));
+    }
+    return done(`${esc.ruleId}: ${r.kind === "approve" ? "retired" : "kept"}`);
+  }
+  if (esc.kind === "override-base-changed") {
+    const ov = esc.item && fs26.existsSync(esc.item) ? esc.item : void 0;
+    if (ov) {
+      if (r.kind === "reject")
+        fs26.rmSync(ov);
+      else {
+        const f = readFm(ov);
+        f.fm.overridesBase = esc.evidence?.docRev;
+        fs26.writeFileSync(ov, fileText(f.fm, f.body));
+      }
+    }
+    return done(`${esc.ruleId}: override ${r.kind === "reject" ? "dropped" : "kept"}`);
+  }
+  return done(`${key}: acknowledged`);
+}
+function proposeAgentRule(c, o) {
+  const sha = crypto4.createHash("sha256").update(`${o.statement}
+${o.evidence}`).digest("hex");
+  const slug = o.statement.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").split("-").slice(0, 6).join("-") || "proposal";
+  const id = o.id ?? `agent.${slug}`;
+  const domain = o.domain ?? "general";
+  const fm = {
+    id,
+    domain,
+    modality: o.modality ?? "should",
+    status: "proposed",
+    sources: [{ ref: `agent:${o.agent ?? "unknown"}`, sha, quote: o.evidence.trim() }],
+    approvedBy: "reviewer-agent",
+    justification: "",
+    supersedes: [],
+    conflictsWith: []
+  };
+  const dir = path27.join(kbRulesDir(c.cfg, c.kb), PROPOSED_DIR);
+  fs26.mkdirSync(dir, { recursive: true });
+  const file = path27.join(dir, `${id}@${sha.slice(0, SHA_LEN2)}.md`);
+  fs26.writeFileSync(file, fileText(fm, o.statement));
+  appendAudit([ev(c, "item.proposed", id, domain)], c.audit);
+  return file;
+}
+function buildReviewPacket(c) {
+  const { proposals, live } = loadProposals(c);
+  return {
+    kb: c.kb,
+    autoApproveConfidence: reconcileConfig(c.cfg, c.kb).autoApproveConfidence,
+    proposals: proposals.map((p) => ({
+      item: p.key,
+      id: p.rule.id,
+      domain: p.rule.domain,
+      modality: p.rule.modality,
+      statement: p.rule.statement,
+      priority: priorityOfRule(c, p.rule),
+      sources: p.rule.sources,
+      ...p.live ? { replaces: { statement: p.live.statement, modality: p.live.modality } } : {},
+      conflictsWith: (p.rule.conflictsWith ?? []).flatMap((id) => {
+        const r = live.find((x) => x.id === id);
+        return r ? [{ id, statement: r.statement, modality: r.modality, priority: priorityOfRule(c, r) }] : [];
+      })
+    })),
+    stale: live.filter((r) => r.status === "stale").map((r) => ({ item: `stale:${r.id}`, id: r.id, modality: r.modality, statement: r.statement, sources: r.sources })),
+    decided: live.filter((r) => r.decision).map((r) => ({ id: r.id, verdict: r.decision.verdict, at: r.decision.at })),
+    open: readEscalations(kbDir(c.cfg, c.kb))
+  };
+}
+var PRIORITY_RANK, SHA_LEN2, strong, escalationsFile, verdictsFile, needsYouCount, git, realGit, nowOf, fileText, readFm, ev, docRevOf;
+var init_review = __esm({
+  "packages/core/dist/knowledge/review.js"() {
+    init_audit();
+    init_anchor();
+    init_index_file();
+    init_ingest();
+    init_paths();
+    init_schedule();
+    init_store2();
+    PRIORITY_RANK = { company: 3, project: 2, agent: 1 };
+    SHA_LEN2 = 12;
+    strong = (m) => m === "must" || m === "must-not";
+    escalationsFile = (kbRoot) => path27.join(kbRoot, "escalations.json");
+    verdictsFile = (kbRoot) => path27.join(kbRoot, "verdicts.jsonl");
+    needsYouCount = (kbRoot) => readEscalations(kbRoot).filter((e) => e.needsYou).length;
+    git = (root, args) => execFileSync7("git", ["-C", root, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    realGit = {
+      lastCommit(root, files) {
+        try {
+          const [rev, date] = git(root, ["log", "-1", "--format=%H%x09%cI", "--", ...files]).split("	");
+          return rev && date ? { rev, date } : null;
+        } catch {
+          return null;
+        }
+      },
+      changedSince(root, files, since) {
+        try {
+          return git(root, ["log", "--since", since, "--format=%H", "--", ...files]) !== "";
+        } catch {
+          return false;
+        }
+      },
+      docDate(file) {
+        try {
+          const d = git(path27.dirname(file), ["log", "-1", "--format=%cI", "--", path27.basename(file)]);
+          if (d)
+            return d;
+        } catch {
+        }
+        try {
+          return fs26.statSync(file).mtime.toISOString();
+        } catch {
+          return null;
+        }
+      }
+    };
+    nowOf = (c) => c.now?.() ?? /* @__PURE__ */ new Date();
+    fileText = (fm, body) => matter4.stringify(body.trim() + "\n", JSON.parse(JSON.stringify(fm)));
+    readFm = (file) => {
+      const m = matter4(fs26.readFileSync(file, "utf8"));
+      return { fm: m.data, body: m.content };
+    };
+    ev = (c, event, itemId, domain, extra = {}) => ({ kb: c.kb, level: "group", project: "", domain, itemId, event, ...extra });
+    docRevOf = (r) => r.sources.map((s) => `${s.ref}@${s.sha.slice(0, SHA_LEN2)}`).join(",");
+  }
+});
+
+// packages/core/dist/knowledge/fullpass.js
+import crypto5 from "crypto";
+import fs27 from "fs";
+import path28 from "path";
+import matter5 from "gray-matter";
+function dedupPairs(rules) {
+  const active = rules.filter((r) => r.status === "active").sort((x, y) => x.id.localeCompare(y.id));
+  const out = [];
+  for (let i = 0; i < active.length; i++) {
+    for (let j = i + 1; j < active.length; j++) {
+      const ta = terms(active[i]), shared2 = [...terms(active[j])].filter((t) => ta.has(t));
+      const pa = new Set(Object.values(active[i].anchors ?? {}).flatMap((a) => a.paths ?? []));
+      const sharedPaths = Object.values(active[j].anchors ?? {}).flatMap((a) => a.paths ?? []).filter((p) => pa.has(p));
+      if (shared2.length >= 2 || sharedPaths.length)
+        out.push({ a: active[i].id, b: active[j].id, shared: [...shared2, ...sharedPaths] });
+    }
+  }
+  return out.slice(0, MAX_DEDUP_PAIRS);
+}
+function readAuditRecords(kb, since, dir = defaultAuditDir()) {
+  if (!fs27.existsSync(dir))
+    return [];
+  const sinceMonth = since.toISOString().slice(0, 7);
+  const out = [];
+  for (const f of fs27.readdirSync(dir).filter((n) => n.endsWith(".jsonl") && n.slice(0, 7) >= sinceMonth).sort()) {
+    for (const line2 of fs27.readFileSync(path28.join(dir, f), "utf8").split("\n")) {
+      if (!line2.trim())
+        continue;
+      try {
+        const e = JSON.parse(line2);
+        if ((kb === void 0 || e.kb === kb) && Date.parse(e.ts) >= since.getTime())
+          out.push(e);
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+function usageReview(rules, events) {
+  const surfaced = {};
+  const noise = {};
+  const violated = /* @__PURE__ */ new Set();
+  for (const e of events) {
+    if (!e.itemId)
+      continue;
+    if (e.event === "item.surfaced")
+      surfaced[e.itemId] = (surfaced[e.itemId] ?? 0) + 1;
+    if (e.event === "item.outcome") {
+      if (e.outcome === "noise")
+        noise[e.itemId] = (noise[e.itemId] ?? 0) + 1;
+      if (e.outcome === "violated")
+        violated.add(e.itemId);
+    }
+  }
+  const active = rules.filter((r) => r.status === "active");
+  return {
+    surfaced,
+    neverSurfaced: active.filter((r) => !surfaced[r.id]).map((r) => r.id).sort(),
+    noisy: Object.keys(noise).filter((id) => (surfaced[id] ?? 0) >= NOISY_MIN_SURFACED && noise[id] / surfaced[id] >= NOISY_RATE).sort(),
+    violated: [...violated].sort()
+  };
+}
+function domainCapExcess(rules, cap, surfaced) {
+  const byDomain = /* @__PURE__ */ new Map();
+  for (const r of rules.filter((x) => x.status === "active"))
+    byDomain.set(r.domain, [...byDomain.get(r.domain) ?? [], r]);
+  return [...byDomain].filter(([, rs]) => rs.length > cap).map(([domain, rs]) => ({
+    domain,
+    count: rs.length,
+    cap,
+    candidates: [...rs].sort((a, b) => (surfaced[a.id] ?? 0) - (surfaced[b.id] ?? 0) || a.id.localeCompare(b.id)).slice(0, rs.length - cap).map((r) => r.id)
+  }));
+}
+function checkOverrides(cfg, kb) {
+  const base = new Map(loadKbRules(cfg, kb).rules.map((r) => [r.id, r]));
+  const out = [];
+  for (const project of Object.keys(cfg.projects)) {
+    if (!subscribedKbs(cfg, project).includes(kb))
+      continue;
+    const dir = projectRulesHome(cfg, project);
+    if (!dir)
+      continue;
+    for (const o of loadRulesDir(dir, `project:${project}`).rules) {
+      const b = base.get(o.id);
+      if (!b)
+        continue;
+      const h = baseHash(b);
+      if (!o.overridesBase) {
+        const m = matter5(fs27.readFileSync(o.file, "utf8"));
+        fs27.writeFileSync(o.file, matter5.stringify(m.content, { ...m.data, overridesBase: h }));
+        continue;
+      }
+      out.push({ project, ruleId: o.id, file: o.file, baseHash: h, changed: o.overridesBase !== h });
+    }
+  }
+  return out;
+}
+function runFullChecks(cfg, kb, o) {
+  const rules = loadKbRules(cfg, kb).rules;
+  const kbRoot = kbDir(cfg, kb);
+  const usage2 = usageReview(rules, readAuditRecords(kb, new Date(o.now.getTime() - NEVER_SURFACED_DAYS * DAY_MS2), o.auditDir));
+  const caps = domainCapExcess(rules, resolveKbConfig(cfg, kb).domainCap, usage2.surfaced);
+  const overrides = checkOverrides(cfg, kb).filter((f) => f.changed);
+  const base = { createdAt: o.now.toISOString(), needsYou: true };
+  for (const c of caps) {
+    addEscalation(kbRoot, { ...base, key: `domain-cap:${c.domain}`, kind: "domain-cap", reasons: ["domain cap"], explanation: `Domain '${c.domain}' has ${c.count} active rules (cap ${c.cap}). Archive candidates (least surfaced): ${c.candidates.join(", ")}.` });
+  }
+  for (const f of overrides) {
+    addEscalation(kbRoot, { ...base, key: `override:${f.project}:${f.ruleId}`, kind: "override-base-changed", ruleId: f.ruleId, item: f.file, reasons: ["override.base-changed"], explanation: `Project ${f.project} overrides ${f.ruleId}, but the KB rule changed since the override was confirmed. Keep the override (approve) or drop it (reject).`, evidence: { docRev: f.baseHash, codeRev: "", files: [], project: f.project } });
+  }
+  return { usage: usage2, caps, overrides };
+}
+var DAY_MS2, NEVER_SURFACED_DAYS, NOISY_MIN_SURFACED, NOISY_RATE, MAX_DEDUP_PAIRS, terms, baseHash;
+var init_fullpass = __esm({
+  "packages/core/dist/knowledge/fullpass.js"() {
+    init_dist();
+    init_audit();
+    init_layers();
+    init_review();
+    init_paths();
+    init_store2();
+    DAY_MS2 = 24 * 60 * 60 * 1e3;
+    NEVER_SURFACED_DAYS = 30;
+    NOISY_MIN_SURFACED = 5;
+    NOISY_RATE = 0.5;
+    MAX_DEDUP_PAIRS = 50;
+    terms = (r) => new Set([...r.triggers?.keywords ?? [], ...r.triggers?.expanded ?? []].map((s) => s.toLowerCase()));
+    baseHash = (r) => crypto5.createHash("sha256").update(JSON.stringify([r.modality, r.statement, r.sources.map((s) => s.sha)])).digest("hex").slice(0, 12);
+  }
+});
+
+// packages/core/dist/knowledge/scores.js
+import fs28 from "fs";
+import path29 from "path";
+function tally(records, into = emptyTally()) {
+  for (const e of records) {
+    const domain = typeof e.domain === "string" && e.domain ? e.domain : "rules";
+    const d = into.domains[domain] ??= { writes: 0, reads: 0 };
+    if (WRITE_EVENTS.has(e.event ?? ""))
+      d.writes++;
+    if (READ_EVENTS.has(e.event ?? ""))
+      d.reads++;
+    if (!e.itemId)
+      continue;
+    const c = into.items[`${domain}|${e.itemId}`] ??= { ...zero(), domain, itemId: e.itemId };
+    switch (e.event) {
+      case "item.surfaced": {
+        c.surfaced++;
+        c.chars += Number(e.chars) || 0;
+        c.lastSurfaced = later(c.lastSurfaced, e.ts);
+        const agent = typeof e.agent === "string" ? e.agent : "unknown";
+        into.agents[agent] = (into.agents[agent] ?? 0) + 1;
+        const tier = typeof e.tier === "string" ? e.tier : typeof e.trigger === "string" ? e.trigger : "unknown";
+        into.tiers[tier] = (into.tiers[tier] ?? 0) + 1;
+        break;
+      }
+      case "item.suppressed":
+        c.suppressed++;
+        break;
+      case "item.searched":
+        c.searched++;
+        break;
+      case "item.shown":
+        c.shown++;
+        break;
+      case "item.cited":
+        c.cited++;
+        c.lastUsed = later(c.lastUsed, e.ts);
+        break;
+      case "item.outcome":
+        if (OUTCOMES.has(String(e.outcome)))
+          c[e.outcome]++;
+        break;
+    }
+  }
+  return into;
+}
+function parseLines(file) {
+  const out = [];
+  for (const line2 of fs28.readFileSync(file, "utf8").split("\n")) {
+    if (!line2.trim())
+      continue;
+    try {
+      out.push(JSON.parse(line2));
+    } catch {
+    }
+  }
+  return out;
+}
+function compactAudit(o) {
+  const dir = o.dir ?? defaultAuditDir();
+  if (!fs28.existsSync(dir))
+    return [];
+  const cutoffMonth = new Date(o.now.getTime() - SCORE_WINDOW_DAYS * DAY_MS3).toISOString().slice(0, 7);
+  const done = [];
+  for (const f of fs28.readdirSync(dir).sort()) {
+    const m = MONTH_FILE_RE.exec(f);
+    if (!m || m[1] >= cutoffMonth)
+      continue;
+    const [, month, machine] = m;
+    const byKb = /* @__PURE__ */ new Map();
+    for (const r of parseLines(path29.join(dir, f)))
+      byKb.set(r.kb ?? "", [...byKb.get(r.kb ?? "") ?? [], r]);
+    const statsPath = path29.join(dir, statsFileName(month, machine));
+    const prior = fs28.existsSync(statsPath) ? JSON.parse(fs28.readFileSync(statsPath, "utf8")) : null;
+    const kbs = prior?.kbs ?? {};
+    for (const [kb, recs] of byKb)
+      kbs[kb] = tally(recs, kbs[kb]);
+    fs28.writeFileSync(`${statsPath}.tmp`, JSON.stringify({ month, machine, kbs }));
+    fs28.renameSync(`${statsPath}.tmp`, statsPath);
+    fs28.unlinkSync(path29.join(dir, f));
+    done.push(month);
+  }
+  return done;
+}
+function readCompacted(kb, dir) {
+  const t = emptyTally();
+  if (!fs28.existsSync(dir))
+    return t;
+  for (const f of fs28.readdirSync(dir).filter((n) => n.endsWith(".stats.json"))) {
+    try {
+      const k = JSON.parse(fs28.readFileSync(path29.join(dir, f), "utf8")).kbs[kb];
+      if (k)
+        mergeTally(t, k);
+    } catch {
+    }
+  }
+  return t;
+}
+function mergeTally(into, from) {
+  for (const [k, c] of Object.entries(from.items)) {
+    const t = into.items[k] ??= { ...zero(), domain: c.domain, itemId: c.itemId };
+    t.lastSurfaced = later(t.lastSurfaced, c.lastSurfaced);
+    t.lastUsed = later(t.lastUsed, c.lastUsed);
+    for (const f of Object.keys(zero()))
+      if (typeof c[f] === "number")
+        t[f] += c[f];
+  }
+  for (const [k, v2] of Object.entries(from.domains)) {
+    const d = into.domains[k] ??= { writes: 0, reads: 0 };
+    d.writes += v2.writes;
+    d.reads += v2.reads;
+  }
+  for (const [k, v2] of Object.entries(from.agents))
+    into.agents[k] = (into.agents[k] ?? 0) + v2;
+  for (const [k, v2] of Object.entries(from.tiers))
+    into.tiers[k] = (into.tiers[k] ?? 0) + v2;
+}
+function computeScores(i) {
+  const since = i.now.getTime() - SCORE_WINDOW_DAYS * DAY_MS3;
+  const win = tally(i.records.filter((r) => Date.parse(r.ts) >= since));
+  const life = tally(i.records, i.compacted ? structuredClone(i.compacted) : void 0);
+  const knownActive = new Set((i.known ?? []).filter((k) => k.status === "active").map((k) => `${k.domain}|${k.id}`));
+  const keys = /* @__PURE__ */ new Set([...Object.keys(win.items), ...Object.keys(life.items), ...knownActive]);
+  const items = [...keys].sort().map((key) => {
+    const [domain, itemId] = [key.slice(0, key.indexOf("|")), key.slice(key.indexOf("|") + 1)];
+    const w = win.items[key] ?? { ...zero(), domain, itemId };
+    const l = life.items[key];
+    return {
+      domain,
+      itemId,
+      surfaced: w.surfaced,
+      suppressed: w.suppressed,
+      searched: w.searched,
+      shown: w.shown,
+      cited: w.cited,
+      followed: w.followed,
+      violated: w.violated,
+      noise: w.noise,
+      wrong: w.wrong,
+      fireRate: w.surfaced,
+      pullRate: w.shown,
+      useRate: ratio(w.cited, w.surfaced),
+      noiseRate: ratio(w.noise, w.surfaced),
+      violationRate: ratio(w.violated, w.surfaced),
+      lastSurfaced: l?.lastSurfaced,
+      lastUsed: l?.lastUsed,
+      neverFired30d: w.surfaced === 0 && (knownActive.has(key) || (l?.surfaced ?? 0) > 0),
+      lifetimeSurfaced: l?.surfaced ?? 0
+    };
+  });
+  const domainNames = /* @__PURE__ */ new Set([...Object.keys(win.domains), ...items.map((x) => x.domain)]);
+  const domains = [...domainNames].sort().map((domain) => {
+    const d = win.domains[domain] ?? { writes: 0, reads: 0 };
+    const rows = items.filter((x) => x.domain === domain);
+    const chars = Object.values(win.items).filter((x) => x.domain === domain).reduce((a, x) => a + x.chars, 0);
+    const cited = rows.reduce((a, x) => a + x.cited, 0);
+    return {
+      domain,
+      writesPerMonth: d.writes,
+      readsPerMonth: d.reads,
+      deadDomain: d.writes === 0 && d.reads === 0,
+      charsPerCitation: cited ? Math.round(chars / cited) : null,
+      surfaced: rows.reduce((a, x) => a + x.surfaced, 0),
+      cited
+    };
+  });
+  const operator = (i.verdicts ?? []).filter((v2) => v2.kind === "operator");
+  const approved = operator.filter((v2) => v2.resolution?.kind === "approve").length;
+  return {
+    kb: i.kb,
+    generatedAt: i.now.toISOString(),
+    windowDays: SCORE_WINDOW_DAYS,
+    items,
+    domains,
+    perAgentCoverage: win.agents,
+    tierContribution: win.tiers,
+    reviewerAgreement: { resolved: operator.length, approved, rate: ratio(approved, operator.length) }
+  };
+}
+function scoreKb(o) {
+  const dir = o.auditDir ?? defaultAuditDir();
+  const records = [];
+  if (fs28.existsSync(dir)) {
+    for (const f of fs28.readdirSync(dir).filter((n) => MONTH_FILE_RE.test(n)).sort()) {
+      records.push(...parseLines(path29.join(dir, f)).filter((r) => r.kb === o.kb));
+    }
+  }
+  let verdicts = [];
+  try {
+    verdicts = fs28.readFileSync(path29.join(o.kbRoot, "verdicts.jsonl"), "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l));
+  } catch {
+  }
+  return computeScores({ kb: o.kb, records, now: o.now, known: o.known, compacted: readCompacted(o.kb, dir), verdicts });
+}
+function writeScores(kbRoot, s) {
+  fs28.mkdirSync(kbRoot, { recursive: true });
+  fs28.writeFileSync(scoresFile(kbRoot), JSON.stringify(s, null, 2) + "\n");
+}
+function renderScoresSection(s) {
+  const pct = (x) => x === null ? "n/a" : `${Math.round(x * 100)}%`;
+  const used = s.items.filter((x) => x.surfaced).sort((a, b) => b.surfaced - a.surfaced || a.itemId.localeCompare(b.itemId)).slice(0, 10);
+  const never = s.items.filter((x) => x.neverFired30d).map((x) => x.itemId);
+  return [
+    "",
+    `## Scores (${s.windowDays} days)`,
+    "",
+    ...used.length ? [
+      "| Item | Surfaced | Pulled | Cited | Use | Noise | Violated |",
+      "|---|---|---|---|---|---|---|",
+      ...used.map((x) => `| ${x.itemId} | ${x.surfaced} | ${x.shown} | ${x.cited} | ${pct(x.useRate)} | ${pct(x.noiseRate)} | ${pct(x.violationRate)} |`)
+    ] : ["No items surfaced."],
+    "",
+    `- Never fired (${never.length}): ${never.slice(0, 20).join(", ") || "none"}${never.length > 20 ? ", \u2026" : ""}`,
+    `- Tier contribution: ${Object.entries(s.tierContribution).map(([k, v2]) => `${k} ${v2}`).join(", ") || "none"}`,
+    `- Per-agent coverage (surfaced): ${Object.entries(s.perAgentCoverage).map(([k, v2]) => `${k} ${v2}`).join(", ") || "none"}`,
+    `- Reviewer agreement: ${pct(s.reviewerAgreement.rate)} (${s.reviewerAgreement.approved}/${s.reviewerAgreement.resolved} operator resolutions approved)`,
+    "",
+    "| Domain | Writes/mo | Reads/mo | Chars per citation | Alarm |",
+    "|---|---|---|---|---|",
+    ...s.domains.map((d) => `| ${d.domain} | ${d.writesPerMonth} | ${d.readsPerMonth} | ${d.charsPerCitation ?? "n/a"} | ${d.deadDomain ? "DEAD (no activity 30d)" : ""} |`)
+  ];
+}
+var DAY_MS3, SCORE_WINDOW_DAYS, WRITE_EVENTS, READ_EVENTS, OUTCOMES, zero, later, emptyTally, MONTH_FILE_RE, statsFileName, ratio, scoresFile;
+var init_scores = __esm({
+  "packages/core/dist/knowledge/scores.js"() {
+    init_audit();
+    DAY_MS3 = 24 * 60 * 60 * 1e3;
+    SCORE_WINDOW_DAYS = 30;
+    WRITE_EVENTS = /* @__PURE__ */ new Set(["item.proposed", "item.approved", "item.rejected", "item.applied", "item.promoted", "item.superseded", "item.archived"]);
+    READ_EVENTS = /* @__PURE__ */ new Set(["item.surfaced", "item.shown", "item.searched"]);
+    OUTCOMES = /* @__PURE__ */ new Set(["followed", "violated", "noise", "wrong"]);
+    zero = () => ({ surfaced: 0, suppressed: 0, searched: 0, shown: 0, cited: 0, followed: 0, violated: 0, noise: 0, wrong: 0, chars: 0 });
+    later = (a, b) => a && b ? a > b ? a : b : a ?? b;
+    emptyTally = () => ({ items: {}, domains: {}, agents: {}, tiers: {} });
+    MONTH_FILE_RE = /^(\d{4}-\d{2})\.(.+)\.jsonl$/;
+    statsFileName = (month, machine) => `${month}.${machine}.stats.json`;
+    ratio = (n, d) => d ? Math.round(n / d * 1e3) / 1e3 : null;
+    scoresFile = (kbRoot) => path29.join(kbRoot, "scores.json");
+  }
+});
+
+// packages/core/dist/knowledge/report.js
+import fs29 from "fs";
+import path30 from "path";
+function renderReport(cfg, kb, o) {
+  const { rules } = loadKbRules(cfg, kb, { includeProposed: true });
+  const count = (s) => rules.filter((r) => r.status === s).length;
+  const esc = readEscalations(kbDir(cfg, kb));
+  const need = esc.filter((e) => e.needsYou);
+  const L = [
+    `# ${kb} knowledge base: reconcile report`,
+    "",
+    `${o.pass} pass, ${o.now.toISOString()}`,
+    "",
+    `Rules: ${count("active")} active, ${count("proposed")} proposed, ${count("stale")} stale, ${count("retired")} retired.`,
+    "",
+    `## Needs you (${need.length})`,
+    "",
+    ...need.length ? need.map((e) => `- **${e.key}** [${e.kind}] ${e.reasons.join(", ")}: ${e.explanation}`) : ["Nothing."],
+    "",
+    "Answer with `squadrant knowledge review " + kb + "`."
+  ];
+  const info = esc.filter((e) => !e.needsYou);
+  if (info.length)
+    L.push("", `## For information (${info.length})`, "", ...info.map((e) => `- **${e.key}**: ${e.explanation}`));
+  if (o.full) {
+    const { usage: usage2, caps } = o.full;
+    L.push("", "## Usage (30 days)", "", `- Surfaced: ${Object.values(usage2.surfaced).reduce((a, b) => a + b, 0)} times across ${Object.keys(usage2.surfaced).length} rules.`, `- Never surfaced (re-check triggers): ${usage2.neverSurfaced.join(", ") || "none"}`, `- Noisy (narrow triggers): ${usage2.noisy.join(", ") || "none"}`, `- Violation feedback (reword): ${usage2.violated.join(", ") || "none"}`, `- Domains over cap: ${caps.map((c) => `${c.domain} (${c.count}/${c.cap})`).join(", ") || "none"}`);
+  }
+  if (o.scores)
+    L.push(...renderScoresSection(o.scores));
+  return L.join("\n") + "\n";
+}
+function writeReport(cfg, kb, o) {
+  const file = path30.join(kbDir(cfg, kb), "REPORT.md");
+  fs29.writeFileSync(file, renderReport(cfg, kb, o));
+  return file;
+}
+var init_report = __esm({
+  "packages/core/dist/knowledge/report.js"() {
+    init_layers();
+    init_paths();
+    init_review();
+    init_scores();
+  }
+});
+
+// packages/core/dist/knowledge/reconcile.js
+function finishMessage(kb, needsYou) {
+  return needsYou ? `${kb} KB: ${needsYou} item${needsYou === 1 ? "" : "s"} need you (squadrant knowledge review ${kb})` : `${kb} KB: reconcile finished, nothing needs you`;
+}
+async function finishReconcile(kb, d) {
+  const now = d.now?.() ?? /* @__PURE__ */ new Date();
+  const pass = completePass(kb, { ...d, now: () => now });
+  let full;
+  if (pass === "full")
+    full = runFullChecks(d.cfg, kb, { now, auditDir: d.auditDir });
+  if (pass === "full")
+    compactAudit({ now, dir: d.auditDir });
+  const scores = scoreKb({ kb, now, auditDir: d.auditDir, kbRoot: kbDir(d.cfg, kb), known: loadKbRules(d.cfg, kb).rules.map((r) => ({ id: r.id, domain: "rules", status: r.status })) });
+  writeScores(kbDir(d.cfg, kb), scores);
+  const report = writeReport(d.cfg, kb, { pass, now, full, scores });
+  const needsYou = needsYouCount(kbDir(d.cfg, kb));
+  const home = resolveKbConfig(d.cfg, kb).homeProject;
+  if (home)
+    await d.enqueue(home, finishMessage(kb, needsYou));
+  return { pass, report, needsYou };
+}
+var init_reconcile = __esm({
+  "packages/core/dist/knowledge/reconcile.js"() {
+    init_dist();
+    init_scores();
+    init_layers();
+    init_fullpass();
+    init_paths();
+    init_report();
+    init_review();
+    init_schedule();
+  }
+});
+
+// packages/core/dist/knowledge/cite.js
+function scanAndLogCitations(i) {
+  const at = i.at ?? i.sink?.now?.() ?? /* @__PURE__ */ new Date();
+  const since = new Date(at.getTime() - (i.lookbackDays ?? CITE_LOOKBACK_DAYS) * DAY_MS4);
+  const dir = i.sink?.dir ?? defaultAuditDir();
+  const delivered = /* @__PURE__ */ new Map();
+  const already = /* @__PURE__ */ new Set();
+  for (const r of readAuditRecords(void 0, since, dir)) {
+    if (!r.itemId || r.project !== i.project)
+      continue;
+    if (r.event === "item.cited" && r.ref === i.ref)
+      already.add(r.itemId);
+    if (!(r.event === "item.surfaced" || r.event === "item.shown") || Date.parse(r.ts) > at.getTime())
+      continue;
+    if (i.session && r.session && r.session !== i.session)
+      continue;
+    delivered.set(r.itemId, r);
+  }
+  const hits = [...delivered].filter(([id]) => !already.has(id) && mentionsId(i.text, id));
+  appendAudit(hits.map(([itemId, r]) => ({
+    kb: String(r.kb ?? ""),
+    level: String(r.level ?? "project"),
+    project: i.project,
+    domain: String(r.domain ?? "rules"),
+    itemId,
+    event: "item.cited",
+    ref: i.ref,
+    ...i.agent ? { agent: i.agent } : {},
+    ...i.session ? { session: i.session } : {}
+  })), i.sink);
+  return hits.map(([id]) => id);
+}
+function readGitMessages(repo, since, run) {
+  const out = run(["-C", repo, "log", `--since=${since.toISOString()}`, "--format=%x1e%H%x1f%cI%x1f%B"]);
+  return out.split("").filter((c) => c.trim()).map((c) => {
+    const [sha, at, ...rest] = c.split("");
+    return { sha: sha.trim(), at: new Date(at), text: rest.join("") };
+  });
+}
+var DAY_MS4, CITE_LOOKBACK_DAYS, escapeRe2, mentionsId;
+var init_cite = __esm({
+  "packages/core/dist/knowledge/cite.js"() {
+    init_audit();
+    init_fullpass();
+    DAY_MS4 = 24 * 60 * 60 * 1e3;
+    CITE_LOOKBACK_DAYS = 7;
+    escapeRe2 = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    mentionsId = (text, id) => new RegExp(`(?<![\\w.-])${escapeRe2(id)}(?![\\w-])`).test(text);
+  }
+});
+
+// packages/core/dist/knowledge/index.js
+var init_knowledge2 = __esm({
+  "packages/core/dist/knowledge/index.js"() {
+    init_paths();
+    init_store2();
+    init_layers();
+    init_index_file();
+    init_search();
+    init_sources();
+    init_inject();
+    init_audit();
+    init_migrate();
+    init_verify();
+    init_ingest();
+    init_anchor();
+    init_extract();
+    init_match();
+    init_schedule();
+    init_review();
+    init_fullpass();
+    init_report();
+    init_reconcile();
+    init_scores();
+    init_cite();
+  }
+});
+
+// packages/core/dist/index.js
+var dist_exports = {};
+__export(dist_exports, {
+  AGENT_BINS: () => AGENT_BINS,
+  ANTHROPIC_ONLY_REQUEST_FIELDS: () => ANTHROPIC_ONLY_REQUEST_FIELDS,
+  AUDIT_QUERY_CHARS: () => AUDIT_QUERY_CHARS,
+  BOT_COMMANDS: () => BOT_COMMANDS,
+  CAPTAIN_RECEIVED_ACK: () => CAPTAIN_RECEIVED_ACK,
+  CC_SOCKS_DIR: () => CC_SOCKS_DIR,
+  CHARS_PER_TOKEN: () => CHARS_PER_TOKEN,
+  CITE_LOOKBACK_DAYS: () => CITE_LOOKBACK_DAYS,
+  CITE_NOTE: () => CITE_NOTE,
+  CMUX_PRESERVE_CLAUDE_AUTH_ENV: () => CMUX_PRESERVE_CLAUDE_AUTH_ENV,
+  CONFLICT_409_SELF_HEAL_MS: () => CONFLICT_409_SELF_HEAL_MS,
+  CONVERTED_DIR: () => CONVERTED_DIR,
+  CREW_GONE_MS: () => CREW_GONE_MS,
+  CREW_STALE_MS: () => CREW_STALE_MS,
+  CaptainDelivery: () => CaptainDelivery,
+  DEFAULT_BLOCKED_RENUDGE_MS: () => DEFAULT_BLOCKED_RENUDGE_MS,
+  DEFAULT_FIRST_TURN_RESEND_COOLDOWN_MS: () => DEFAULT_FIRST_TURN_RESEND_COOLDOWN_MS,
+  DEFAULT_FIRST_TURN_UNDELIVERED_BUDGET_MS: () => DEFAULT_FIRST_TURN_UNDELIVERED_BUDGET_MS,
+  DEFAULT_GATE_DENY_RULES: () => DEFAULT_GATE_DENY_RULES,
+  DEFAULT_GATE_TOOLS: () => DEFAULT_GATE_TOOLS,
+  DEFAULT_MAX_SECTIONS_PER_PASS: () => DEFAULT_MAX_SECTIONS_PER_PASS,
+  DEFAULT_SEARCH_STATUSES: () => DEFAULT_SEARCH_STATUSES,
+  DEFAULT_TASK_TIMEOUT_MS: () => DEFAULT_TASK_TIMEOUT_MS,
+  DOCLING_DROP_THRESHOLD: () => DOCLING_DROP_THRESHOLD,
+  DeferDelivery: () => DeferDelivery,
+  FIRST_TURN_INLINE_MAX_BYTES: () => FIRST_TURN_INLINE_MAX_BYTES,
+  FactLog: () => FactLog,
+  GROUP_DISPATCH_WARMUP_POLL_MS: () => GROUP_DISPATCH_WARMUP_POLL_MS,
+  GROUP_DISPATCH_WARMUP_TIMEOUT_MS: () => GROUP_DISPATCH_WARMUP_TIMEOUT_MS,
+  GateDecisionCache: () => GateDecisionCache,
+  IDLE_DEBOUNCE_MS: () => IDLE_DEBOUNCE_MS,
+  INJECT_BUDGET_MS: () => INJECT_BUDGET_MS,
+  INJECT_MAX_CHARS: () => INJECT_MAX_CHARS,
+  INJECT_MAX_RULES: () => INJECT_MAX_RULES,
+  LABEL: () => LABEL,
+  LivenessRegistry: () => LivenessRegistry,
+  MAX_DEDUP_PAIRS: () => MAX_DEDUP_PAIRS,
+  MONITOR_STALL_BUDGET_MS: () => MONITOR_STALL_BUDGET_MS,
+  NEVER_SURFACED_DAYS: () => NEVER_SURFACED_DAYS,
+  NOISY_MIN_SURFACED: () => NOISY_MIN_SURFACED,
+  NOISY_RATE: () => NOISY_RATE,
+  OPERATOR_INITIATED_COMMANDS: () => OPERATOR_INITIATED_COMMANDS,
+  PANE_IDLE_AFTER_MS: () => PANE_IDLE_AFTER_MS,
+  PASS_THROUGH: () => PASS_THROUGH,
+  PROBE_QUIET_MS: () => PROBE_QUIET_MS,
+  PROMPT_MIN_SCORE: () => PROMPT_MIN_SCORE,
+  PROMPT_RULE_CAP: () => PROMPT_RULE_CAP,
+  PROMPT_SINGLE_TERM_MIN_SCORE: () => PROMPT_SINGLE_TERM_MIN_SCORE,
+  PROPOSED_DIR: () => PROPOSED_DIR,
+  PROTOCOL_VERSION: () => PROTOCOL_VERSION,
+  READ_ONLY_CREW_SUBCOMMANDS: () => READ_ONLY_CREW_SUBCOMMANDS,
+  READ_ONLY_TOP_LEVEL_COMMANDS: () => READ_ONLY_TOP_LEVEL_COMMANDS,
+  ROUTER_READY_ATTEMPTS: () => ROUTER_READY_ATTEMPTS,
+  ROUTER_READY_DELAY_MS: () => ROUTER_READY_DELAY_MS,
+  RUNNING_STALE_MS: () => RUNNING_STALE_MS,
+  SCORE_WINDOW_DAYS: () => SCORE_WINDOW_DAYS,
+  SERVER_TOOL_TYPE_RE: () => SERVER_TOOL_TYPE_RE,
+  SESSION_RULE_CAP: () => SESSION_RULE_CAP,
+  SIDE_SESSION_ENV: () => SIDE_SESSION_ENV,
+  SOURCES_TEMPLATE: () => SOURCES_TEMPLATE,
   STALE_THRESHOLD_MS: () => STALE_THRESHOLD_MS,
   STUCK_ALERT_TEXT: () => STUCK_ALERT_TEXT,
   TERMINAL_RECORD_KEEP_PER_PROJECT: () => TERMINAL_RECORD_KEEP_PER_PROJECT,
@@ -12996,12 +15082,22 @@ __export(dist_exports, {
   WORK_ITEM_TTL_MS: () => WORK_ITEM_TTL_MS,
   WRITABLE_CONFIG_KEYS: () => WRITABLE_CONFIG_KEYS,
   _resetRestartInFlightForTest: () => _resetRestartInFlightForTest,
+  acquirePass: () => acquirePass,
+  addEscalation: () => addEscalation,
   ageText: () => ageText,
+  anchorTerms: () => anchorTerms,
   anthropicError: () => anthropicError,
+  appendAudit: () => appendAudit,
   appendCaptainMessage: () => appendCaptainMessage,
   appendToMailbox: () => appendToMailbox,
+  appendVerdict: () => appendVerdict,
+  applyBudget: () => applyBudget,
+  applyCandidates: () => applyCandidates,
+  applyDecisions: () => applyDecisions,
   assembleDaemonSnapshot: () => assembleDaemonSnapshot,
   assertBackendUsable: () => assertBackendUsable,
+  auditMachineId: () => auditMachineId,
+  baseHash: () => baseHash,
   bootWorkspace: () => bootWorkspace,
   buildClassifierInput: () => buildClassifierInput,
   buildCompletionProtocol: () => buildCompletionProtocol,
@@ -13009,6 +15105,7 @@ __export(dist_exports, {
   buildDaemonPath: () => buildDaemonPath,
   buildFreshness: () => buildFreshness,
   buildOpencodeGateRunCommand: () => buildOpencodeGateRunCommand,
+  buildReviewPacket: () => buildReviewPacket,
   buildRouterCredentialsRequest: () => buildRouterCredentialsRequest,
   buildRouterEnv: () => buildRouterEnv,
   buildSideFirstTurn: () => buildSideFirstTurn,
@@ -13018,17 +15115,24 @@ __export(dist_exports, {
   captainAliveStateFromHealth: () => captainAliveStateFromHealth,
   captainRecordPath: () => captainRecordPath,
   captainSocketPath: () => captainSocketPath,
+  changedRefs: () => changedRefs,
   checkFact: () => checkFact,
+  checkOverrides: () => checkOverrides,
   classifyCaptainPane: () => classifyCaptainPane,
   classifyHealth: () => classifyHealth,
   claudeEnvShadowsRouter: () => claudeEnvShadowsRouter,
   cleanPromptQuery: () => cleanPromptQuery,
   clearPending: () => clearPending,
   closeWorkItem: () => closeWorkItem,
+  compactAudit: () => compactAudit,
   compileIndex: () => compileIndex,
+  completePass: () => completePass,
+  computeAnchor: () => computeAnchor,
   computeRulesInjection: () => computeRulesInjection,
+  computeScores: () => computeScores,
   computeTemplateHash: () => computeTemplateHash,
   consumeExitMarker: () => consumeExitMarker,
+  convertedFile: () => convertedFile,
   createAttach: () => createAttach,
   createCaptainPaneReader: () => createCaptainPaneReader,
   createCrewPaneReader: () => createCrewPaneReader,
@@ -13062,6 +15166,8 @@ __export(dist_exports, {
   decideForeignInstall: () => decideForeignInstall,
   decideOpencodeGateWrap: () => decideOpencodeGateWrap,
   decodeFrames: () => decodeFrames,
+  dedupPairs: () => dedupPairs,
+  defaultAuditDir: () => defaultAuditDir,
   defaultGateCachePath: () => defaultGateCachePath,
   defaultGateDenyRules: () => defaultGateDenyRules,
   defaultIsPidAlive: () => defaultIsPidAlive,
@@ -13073,27 +15179,41 @@ __export(dist_exports, {
   deliverable: () => deliverable,
   deriveCaptainState: () => deriveCaptainState,
   describeOutcome: () => describeOutcome,
+  detectChange: () => detectChange,
   detectForeignInstall: () => detectForeignInstall,
   detectGroupAndUser: () => detectGroupAndUser,
   detectGroupId: () => detectGroupId,
   discoverCaptainSurface: () => discoverCaptainSurface,
   discoverLiveOpencodeServer: () => discoverLiveOpencodeServer,
   dispatchToSibling: () => dispatchToSibling,
+  domainCapExcess: () => domainCapExcess,
+  duePass: () => duePass,
   duplicateIdProblem: () => duplicateIdProblem,
   encodeFrame: () => encodeFrame,
   encodeMsg: () => encodeMsg,
   ensureDaemon: () => ensureDaemon,
+  ensureGitRepo: () => ensureGitRepo,
+  ensureKbGitignore: () => ensureKbGitignore,
   ensureSocksDir: () => ensureSocksDir,
+  escalationsFile: () => escalationsFile,
+  evaluateCodeConflict: () => evaluateCodeConflict,
   evaluatePermissionRequest: () => evaluatePermissionRequest,
   evaluateStall: () => evaluateStall,
   exitMarkerPath: () => exitMarkerPath,
+  expandSource: () => expandSource,
   extractToolPayload: () => extractToolPayload,
   extractUserIntentFromTranscript: () => extractUserIntentFromTranscript,
   fallsBackToPane: () => fallsBackToPane,
+  fileForRef: () => fileForRef,
   findCrewPane: () => findCrewPane,
+  findLegacyKbs: () => findLegacyKbs,
+  findLegacyOverlays: () => findLegacyOverlays,
   findOpenChildren: () => findOpenChildren,
   findProjectByThread: () => findProjectByThread,
+  findQuote: () => findQuote,
   findWorkItemById: () => findWorkItemById,
+  finishMessage: () => finishMessage,
+  finishReconcile: () => finishReconcile,
   forceKickstartAndVerify: () => forceKickstartAndVerify,
   formatCustomHeaders: () => formatCustomHeaders,
   formatInbound: () => formatInbound,
@@ -13108,6 +15228,8 @@ __export(dist_exports, {
   freshTrace: () => freshTrace,
   gateCacheKey: () => gateCacheKey,
   getDaemonPid: () => getDaemonPid,
+  globMatches: () => globMatches,
+  globToRegExp: () => globToRegExp,
   hasAutoGateCredential: () => hasAutoGateCredential,
   hasModalOptionList: () => hasModalOptionList,
   healCmdFor: () => healCmdFor,
@@ -13124,6 +15246,7 @@ __export(dist_exports, {
   isGateSession: () => isGateSession,
   isNotifyActive: () => isNotifyActive,
   isOperatorInitiatedCommand: () => isOperatorInitiatedCommand,
+  isPendingProposalDup: () => isPendingProposalDup,
   isReadOnlyCrewCommand: () => isReadOnlyCrewCommand,
   isReadOnlyTopLevelCommand: () => isReadOnlyTopLevelCommand,
   isSideTitle: () => isSideTitle,
@@ -13136,9 +15259,11 @@ __export(dist_exports, {
   kbRulesDir: () => kbRulesDir,
   kickstartArgv: () => kickstartArgv,
   launchOneWorkspace: () => launchOneWorkspace,
+  legacyKbDir: () => legacyKbDir,
   listSessions: () => listSessions,
   loadKbRules: () => loadKbRules,
   loadPending: () => loadPending,
+  loadProposals: () => loadProposals,
   loadRulesDir: () => loadRulesDir,
   loadSessions: () => loadSessions,
   loadSources: () => loadSources,
@@ -13146,16 +15271,28 @@ __export(dist_exports, {
   mailboxStats: () => mailboxStats,
   makeGate: () => makeGate,
   markPendingWarned: () => markPendingWarned,
+  markitdownConverter: () => markitdownConverter,
   maskToken: () => maskToken,
+  matchPaths: () => matchPaths,
+  matchSymbols: () => matchSymbols,
   matchTier1Deny: () => matchTier1Deny,
   mediaKind: () => mediaKind,
   mediaMarker: () => mediaMarker,
+  mentionedPaths: () => mentionedPaths,
+  mentionsId: () => mentionsId,
   mergeClaudeEnvRouterSettings: () => mergeClaudeEnvRouterSettings,
   mintToken: () => mintToken,
+  moveLegacyKbs: () => moveLegacyKbs,
+  moveLegacyOverlays: () => moveLegacyOverlays,
   nameFromTitle: () => nameFromTitle,
+  needsDocling: () => needsDocling,
+  needsYouCount: () => needsYouCount,
   newestSessionInDirectory: () => newestSessionInDirectory,
   nextAutoName: () => nextAutoName,
   niceCrewCommand: () => niceCrewCommand,
+  normalizeText: () => normalizeText,
+  normalizeWithMap: () => normalizeWithMap,
+  normalizedViews: () => normalizedViews,
   notePaneScreen: () => notePaneScreen,
   notifyToggle: () => notifyToggle,
   parseBearer: () => parseBearer,
@@ -13164,39 +15301,57 @@ __export(dist_exports, {
   parseLiveOpencodeServers: () => parseLiveOpencodeServers,
   parseNotifyPref: () => parseNotifyPref,
   parseProgramArgs: () => parseProgramArgs,
+  planIngest: () => planIngest,
   plistPath: () => plistPath,
   pollBackoffMs: () => pollBackoffMs,
   pollNewestSessionInDirectory: () => pollNewestSessionInDirectory,
   prepareCaptainRoute: () => prepareCaptainRoute,
   printForeignInstallError: () => printForeignInstallError,
   printVersionUpgradeNotice: () => printVersionUpgradeNotice,
+  priorityOfRef: () => priorityOfRef,
+  priorityOfRule: () => priorityOfRule,
   probeCaptainChannel: () => probeCaptainChannel,
   programArgsBlock: () => programArgsBlock,
   projectHealth: () => projectHealth,
-  projectRulesDir: () => projectRulesDir,
+  promoteProposal: () => promoteProposal,
+  proposeAgentRule: () => proposeAgentRule,
   pruneSeenRules: () => pruneSeenRules,
   pruneTopics: () => pruneTopics,
   purgeExpiredWorkItems: () => purgeExpiredWorkItems,
+  readAuditRecords: () => readAuditRecords,
   readCaptainAddress: () => readCaptainAddress,
   readCursor: () => readCursor,
+  readEscalations: () => readEscalations,
   readFromCursor: () => readFromCursor,
+  readGitMessages: () => readGitMessages,
   readIndex: () => readIndex,
   readRunningMarker: () => readRunningMarker,
+  readSchedule: () => readSchedule,
   readSeenRules: () => readSeenRules,
+  readState: () => readState2,
+  readTargetPath: () => readTargetPath,
   readUserIntent: () => readUserIntent,
+  realGit: () => realGit,
   realpathOrSelf: () => realpathOrSelf,
   reapCrewChildren: () => reapCrewChildren,
   reapOrphanedCrews: () => reapOrphanedCrews,
+  reconcileConfig: () => reconcileConfig,
   reconcileLiveness: () => reconcileLiveness,
   recordSeenRules: () => recordSeenRules,
   recordSession: () => recordSession,
   recoverStall: () => recoverStall,
   reduce: () => reduce,
   reduceLifecycle: () => reduceLifecycle,
+  refFor: () => refFor,
   releaseDaemonLock: () => releaseDaemonLock,
   removeRunningMarker: () => removeRunningMarker,
   renderEnvAssignments: () => renderEnvAssignments,
   renderPlist: () => renderPlist,
+  renderReport: () => renderReport,
+  renderScoresSection: () => renderScoresSection,
+  repoRelativePaths: () => repoRelativePaths,
+  requestPass: () => requestPass,
+  requestText: () => requestText,
   reregisterDaemon: () => reregisterDaemon,
   resolveAgentBinDirs: () => resolveAgentBinDirs,
   resolveAndPersistOpencodeCaptain: () => resolveAndPersistOpencodeCaptain,
@@ -13204,6 +15359,7 @@ __export(dist_exports, {
   resolveClassifierModel: () => resolveClassifierModel,
   resolveCrewRoute: () => resolveCrewRoute,
   resolveCurrentProject: () => resolveCurrentProject,
+  resolveEscalation: () => resolveEscalation,
   resolveGate: () => resolveGate,
   resolveGateDenyRules: () => resolveGateDenyRules,
   resolveGateEngine: () => resolveGateEngine,
@@ -13220,6 +15376,8 @@ __export(dist_exports, {
   resolveSetupUserId: () => resolveSetupUserId,
   restartDaemonIfRunning: () => restartDaemonIfRunning,
   rotateIfNeeded: () => rotateIfNeeded,
+  ruleAuditScope: () => ruleAuditScope,
+  rulesFallbackPointer: () => rulesFallbackPointer,
   runAdapterConformance: () => runAdapterConformance,
   runCrewAnswer: () => runCrewAnswer,
   runCrewClose: () => runCrewClose,
@@ -13227,6 +15385,7 @@ __export(dist_exports, {
   runCrewRead: () => runCrewRead,
   runCrewSend: () => runCrewSend,
   runCrewSpawn: () => runCrewSpawn,
+  runFullChecks: () => runFullChecks,
   runLivenessTick: () => runLivenessTick,
   runNotifyConfirmation: () => runNotifyConfirmation,
   runRegisterCommands: () => runRegisterCommands,
@@ -13247,6 +15406,10 @@ __export(dist_exports, {
   sanitizeRequest: () => sanitizeRequest,
   saveSessions: () => saveSessions,
   saveState: () => saveState,
+  scanAndLogCitations: () => scanAndLogCitations,
+  scheduleFile: () => scheduleFile,
+  scoreKb: () => scoreKb,
+  scoresFile: () => scoresFile,
   screenHasSplashMarker: () => screenHasSplashMarker,
   screenHash: () => screenHash,
   screenShowsTrustPanel: () => screenShowsTrustPanel,
@@ -13263,13 +15426,18 @@ __export(dist_exports, {
   sideNameFromTitle: () => sideNameFromTitle,
   sideNextAutoName: () => sideNextAutoName,
   sideTitleFor: () => sideTitleFor,
+  snapshotSources: () => snapshotSources,
+  spansOverlap: () => spansOverlap,
+  splitSections: () => splitSections,
   splitStatement: () => splitStatement,
   stampFact: () => stampFact,
   startDaemon: () => startDaemon,
   startServer: () => startServer,
   stripBotMention: () => stripBotMention,
   surfaceVerdict: () => surfaceVerdict,
+  tally: () => tally,
   telegramPollLockPath: () => telegramPollLockPath,
+  tickKnowledgeSchedule: () => tickKnowledgeSchedule,
   timeoutGate: () => timeoutGate,
   titleFor: () => titleFor,
   toControlEvent: () => toControlEvent,
@@ -13278,16 +15446,23 @@ __export(dist_exports, {
   trustPanelAcceptKeys: () => trustPanelAcceptKeys,
   tryAcquireDaemonLock: () => tryAcquireDaemonLock,
   usageFromJson: () => usageFromJson,
+  usageReview: () => usageReview,
+  validateCandidate: () => validateCandidate,
   validateKb: () => validateKb,
+  verdictsFile: () => verdictsFile,
   waitForCaptainDelivery: () => waitForCaptainDelivery,
   waitForWarmup: () => waitForWarmup,
   wholeWordTerms: () => wholeWordTerms,
   withBudget: () => withBudget,
   writeCaptainAddress: () => writeCaptainAddress,
   writeCursor: () => writeCursor,
+  writeEscalations: () => writeEscalations,
   writeExitMarker: () => writeExitMarker,
   writeIndex: () => writeIndex,
+  writeReport: () => writeReport,
   writeRunningMarker: () => writeRunningMarker,
+  writeSchedule: () => writeSchedule,
+  writeScores: () => writeScores,
   writeTelegramConfig: () => writeTelegramConfig
 });
 var init_dist2 = __esm({
@@ -13386,7 +15561,7 @@ import { readdirSync as readdirSync4, readFileSync as readFileSync12 } from "fs"
 import { join as join18 } from "path";
 
 // packages/agents/dist/claude/registry.js
-import fs20 from "fs";
+import fs30 from "fs";
 import { join as join17 } from "path";
 import { homedir as homedir7 } from "os";
 var CLAUDE_SESSIONS_DIR = join17(homedir7(), ".claude", "sessions");
@@ -13431,11 +15606,11 @@ function toLifecycleSnapshot(entry, taskId, alive, now) {
 function readClaudeStatusBySocketPath(socketPath) {
   let files;
   try {
-    files = fs20.readdirSync(CLAUDE_SESSIONS_DIR);
+    files = fs30.readdirSync(CLAUDE_SESSIONS_DIR);
   } catch {
     return void 0;
   }
-  const entries = parseRegistryDir(files, (name) => fs20.readFileSync(join17(CLAUDE_SESSIONS_DIR, name), "utf8"));
+  const entries = parseRegistryDir(files, (name) => fs30.readFileSync(join17(CLAUDE_SESSIONS_DIR, name), "utf8"));
   const entry = entries.find((e) => e.messagingSocketPath === socketPath);
   if (!entry)
     return void 0;
@@ -13458,38 +15633,38 @@ import { homedir as homedir8 } from "os";
 var SQUADRANT_STATE_DIR = join19(homedir8(), ".config", "squadrant", "state");
 
 // packages/agents/dist/drivers/launch-cmd.js
-import fs21 from "fs";
-import path19 from "path";
+import fs31 from "fs";
+import path31 from "path";
 
 // packages/agents/dist/projection/cursor.js
 import { mkdir, readFile, writeFile } from "fs/promises";
-import path20 from "path";
-import os8 from "os";
+import path32 from "path";
+import os10 from "os";
 
 // packages/agents/dist/projection/codex.js
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import path21 from "path";
-import os9 from "os";
+import path33 from "path";
+import os11 from "os";
 
 // packages/agents/dist/projection/gemini.js
 import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
-import path22 from "path";
-import os10 from "os";
+import path34 from "path";
+import os12 from "os";
 
 // packages/agents/dist/projection/opencode.js
 import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "fs/promises";
-import path23 from "path";
-import os11 from "os";
+import path35 from "path";
+import os13 from "os";
 
 // packages/agents/dist/projection/opencode-skills.js
-import fs22 from "fs";
-import os12 from "os";
-import path24 from "path";
+import fs32 from "fs";
+import os14 from "os";
+import path36 from "path";
 var OPENCODE_SKILL_MARKER = ".squadrant-managed";
 var MARKER_BODY = "squadrant\n";
 function defaultOpencodeSkillsRoot(env = process.env) {
-  const configHome = env.XDG_CONFIG_HOME || path24.join(os12.homedir(), ".config");
-  return path24.join(configHome, "opencode", "skills");
+  const configHome = env.XDG_CONFIG_HOME || path36.join(os14.homedir(), ".config");
+  return path36.join(configHome, "opencode", "skills");
 }
 var SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 function parseSkillName(raw) {
@@ -13504,62 +15679,62 @@ function parseSkillName(raw) {
 }
 function listSourceSkills(sourceSkillsDir) {
   const out = /* @__PURE__ */ new Map();
-  if (!fs22.existsSync(sourceSkillsDir))
+  if (!fs32.existsSync(sourceSkillsDir))
     return out;
-  for (const entry of fs22.readdirSync(sourceSkillsDir, { withFileTypes: true })) {
+  for (const entry of fs32.readdirSync(sourceSkillsDir, { withFileTypes: true })) {
     if (!entry.isDirectory())
       continue;
-    const skillPath = path24.join(sourceSkillsDir, entry.name, "SKILL.md");
-    if (!fs22.existsSync(skillPath))
+    const skillPath = path36.join(sourceSkillsDir, entry.name, "SKILL.md");
+    if (!fs32.existsSync(skillPath))
       continue;
-    const name = parseSkillName(fs22.readFileSync(skillPath, "utf-8"));
+    const name = parseSkillName(fs32.readFileSync(skillPath, "utf-8"));
     if (name && SAFE_NAME.test(name))
       out.set(name, skillPath);
   }
   return out;
 }
 function hasMarker(dir) {
-  return fs22.existsSync(path24.join(dir, OPENCODE_SKILL_MARKER));
+  return fs32.existsSync(path36.join(dir, OPENCODE_SKILL_MARKER));
 }
 function syncOpencodeSkills(opts) {
   const result = { written: [], unchanged: [], removed: [], skipped: [] };
   const wanted = listSourceSkills(opts.sourceSkillsDir);
-  if (wanted.size === 0 && !fs22.existsSync(opts.sourceSkillsDir))
+  if (wanted.size === 0 && !fs32.existsSync(opts.sourceSkillsDir))
     return result;
   if (!opts.dryRun)
-    fs22.mkdirSync(opts.skillsRoot, { recursive: true });
+    fs32.mkdirSync(opts.skillsRoot, { recursive: true });
   for (const [name, srcPath] of wanted) {
-    const targetDir = path24.join(opts.skillsRoot, name);
-    const targetSkill = path24.join(targetDir, "SKILL.md");
+    const targetDir = path36.join(opts.skillsRoot, name);
+    const targetSkill = path36.join(targetDir, "SKILL.md");
     const managed = hasMarker(targetDir);
-    if (fs22.existsSync(targetSkill) && !managed) {
+    if (fs32.existsSync(targetSkill) && !managed) {
       result.skipped.push({ name, reason: "foreign-collision" });
       continue;
     }
-    const current = fs22.existsSync(targetSkill) ? fs22.readFileSync(targetSkill) : null;
-    if (current && current.equals(fs22.readFileSync(srcPath))) {
+    const current = fs32.existsSync(targetSkill) ? fs32.readFileSync(targetSkill) : null;
+    if (current && current.equals(fs32.readFileSync(srcPath))) {
       if (!managed && !opts.dryRun) {
-        fs22.writeFileSync(path24.join(targetDir, OPENCODE_SKILL_MARKER), MARKER_BODY);
+        fs32.writeFileSync(path36.join(targetDir, OPENCODE_SKILL_MARKER), MARKER_BODY);
       }
       result.unchanged.push(name);
       continue;
     }
     if (!opts.dryRun) {
-      fs22.mkdirSync(targetDir, { recursive: true });
-      fs22.copyFileSync(srcPath, targetSkill);
-      fs22.writeFileSync(path24.join(targetDir, OPENCODE_SKILL_MARKER), MARKER_BODY);
+      fs32.mkdirSync(targetDir, { recursive: true });
+      fs32.copyFileSync(srcPath, targetSkill);
+      fs32.writeFileSync(path36.join(targetDir, OPENCODE_SKILL_MARKER), MARKER_BODY);
     }
     result.written.push(name);
   }
-  if (fs22.existsSync(opts.skillsRoot)) {
-    for (const entry of fs22.readdirSync(opts.skillsRoot, { withFileTypes: true })) {
+  if (fs32.existsSync(opts.skillsRoot)) {
+    for (const entry of fs32.readdirSync(opts.skillsRoot, { withFileTypes: true })) {
       if (!entry.isDirectory() || wanted.has(entry.name))
         continue;
-      const dir = path24.join(opts.skillsRoot, entry.name);
+      const dir = path36.join(opts.skillsRoot, entry.name);
       if (!hasMarker(dir))
         continue;
       if (!opts.dryRun)
-        fs22.rmSync(dir, { recursive: true, force: true });
+        fs32.rmSync(dir, { recursive: true, force: true });
       result.removed.push(entry.name);
     }
   }
@@ -13567,7 +15742,7 @@ function syncOpencodeSkills(opts) {
 }
 function syncShippedOpencodeSkills(opts) {
   return syncOpencodeSkills({
-    sourceSkillsDir: path24.join(opts.pkgRoot, "plugin", "skills"),
+    sourceSkillsDir: path36.join(opts.pkgRoot, "plugin", "skills"),
     skillsRoot: opts.skillsRoot ?? defaultOpencodeSkillsRoot(),
     dryRun: opts.dryRun
   });
@@ -13575,8 +15750,8 @@ function syncShippedOpencodeSkills(opts) {
 
 // packages/agents/dist/projection/claude.js
 import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile5 } from "fs/promises";
-import path25 from "path";
-import os13 from "os";
+import path37 from "path";
+import os15 from "os";
 
 // packages/agents/dist/codex/app-server-client.js
 import { EventEmitter } from "events";
@@ -13794,51 +15969,51 @@ var CodexAppServerSource = class {
    * are ignored — terminal state still comes exclusively from `squadrant crew signal`
    * (anti-#2576 invariant).
    */
-  observe(ev) {
-    const snap = toSnapshot(ev);
+  observe(ev2) {
+    const snap = toSnapshot(ev2);
     if (!snap || !this.deps)
       return;
     this.cache.set(snap.taskId, snap);
     this.deps.report(snap);
   }
 };
-function toSnapshot(ev) {
+function toSnapshot(ev2) {
   const now = Date.now();
-  switch (ev.type) {
+  switch (ev2.type) {
     // ── running: a turn is live ──────────────────────────────────────────────
     case "task.started":
     case "task.reattached":
     case "task.turn.started":
     case "task.delta":
     case "task.progress":
-      return { taskId: ev.id, state: "running", alive: true, origin: "agent", at: now };
+      return { taskId: ev2.id, state: "running", alive: true, origin: "agent", at: now };
     // ── idle: turn ended, crew alive, awaiting next input ────────────────────
     // task.failed: the turn ended with an error, but the crew process is alive.
     // task.session.ended: process is gone (alive:false) — signals liveness loss.
     case "task.turn.completed":
-      return { taskId: ev.id, state: "idle", alive: true, origin: "agent", at: now };
+      return { taskId: ev2.id, state: "idle", alive: true, origin: "agent", at: now };
     case "task.failed":
-      return { taskId: ev.id, state: "idle", alive: true, origin: "agent", at: now };
+      return { taskId: ev2.id, state: "idle", alive: true, origin: "agent", at: now };
     case "task.session.ended":
-      return { taskId: ev.id, state: "idle", alive: false, origin: "agent", at: now };
+      return { taskId: ev2.id, state: "idle", alive: false, origin: "agent", at: now };
     // ── needsInput: crew is blocked on a human ───────────────────────────────
     case "task.approval.requested":
       return {
-        taskId: ev.id,
+        taskId: ev2.id,
         state: "needsInput",
         alive: true,
         origin: "agent",
         at: now,
-        detail: { note: ev.question, reason: ev.kind }
+        detail: { note: ev2.question, reason: ev2.kind }
       };
     case "task.input.requested":
       return {
-        taskId: ev.id,
+        taskId: ev2.id,
         state: "needsInput",
         alive: true,
         origin: "agent",
         at: now,
-        detail: { note: ev.question }
+        detail: { note: ev2.question }
       };
     // ── terminal / notify-only — ignored ────────────────────────────────────
     // task.done, task.blocked, task.cancelled: terminal state from crew signal only.
@@ -14123,9 +16298,9 @@ var CodexInteractiveDriver = class {
     const taskId = tid ? this.taskByThread.get(tid) : void 0;
     if (!taskId)
       return;
-    const ev = normalizeAppServerNotification(taskId, n);
-    if (ev)
-      this.deps.emit(ev);
+    const ev2 = normalizeAppServerNotification(taskId, n);
+    if (ev2)
+      this.deps.emit(ev2);
   }
   onServerRequest(r) {
     const tid = r.params?.threadId ?? r.params?.thread_id;
@@ -14920,9 +17095,9 @@ var ClaudeReceiptListener = class {
 };
 
 // packages/agents/dist/claude/api-key-approval.js
-import fs23 from "fs";
-import os14 from "os";
-import path26 from "path";
+import fs33 from "fs";
+import os16 from "os";
+import path38 from "path";
 
 // packages/agents/dist/opencode/http-channel.js
 init_dist2();
@@ -15014,10 +17189,10 @@ var OpencodeHttpChannel = class {
       return cached;
     const directory = this.directoryFor?.(taskId);
     const createdAfterMs = this.createdAfterFor?.(taskId);
-    for (const path29 of ["/session?", "/api/session?"]) {
+    for (const path42 of ["/session?", "/api/session?"]) {
       let res;
       try {
-        res = await this.request(`http://127.0.0.1:${port}${path29}`, { method: "GET" });
+        res = await this.request(`http://127.0.0.1:${port}${path42}`, { method: "GET" });
       } catch {
         return void 0;
       }
@@ -15090,13 +17265,18 @@ function createOpencodeFactAdapter(deps) {
   };
 }
 
+// packages/agents/dist/rules-hooks/install.js
+import fs34 from "fs";
+import os17 from "os";
+import path39 from "path";
+
 // packages/workspaces/dist/runtimes/cmux.js
 init_dist();
 init_dist();
 init_dist();
 init_dist2();
 init_dist2();
-import { execFile as execFile2, execFileSync as execFileSync6 } from "child_process";
+import { execFile as execFile3, execFileSync as execFileSync8 } from "child_process";
 var CMUX_TIMEOUT = 15e3;
 var CmuxTimeoutError = class extends Error {
   constructor(cmd) {
@@ -15106,7 +17286,7 @@ var CmuxTimeoutError = class extends Error {
 };
 function cmux(args) {
   return new Promise((resolve4, reject) => {
-    execFile2(
+    execFile3(
       resolveCmuxBin(),
       args,
       // CMUX_QUIET=1 silences cmux 0.64's one-time deprecation hints (e.g. the
@@ -15126,7 +17306,7 @@ function cmux(args) {
 }
 function cmuxStdin(args, input) {
   return new Promise((resolve4, reject) => {
-    const child = execFile2(resolveCmuxBin(), args, { encoding: "utf-8", timeout: CMUX_TIMEOUT, env: { ...process.env, CMUX_QUIET: "1" } }, (err, stdout) => {
+    const child = execFile3(resolveCmuxBin(), args, { encoding: "utf-8", timeout: CMUX_TIMEOUT, env: { ...process.env, CMUX_QUIET: "1" } }, (err, stdout) => {
       if (err) {
         reject(err.code === "ETIMEDOUT" ? new CmuxTimeoutError(args.join(" ")) : err);
         return;
@@ -15549,7 +17729,7 @@ function createCmuxDriver() {
     async sendToSurface(surface, text, opts) {
       const ws = surface.workspaceId;
       const sf = surface.surfaceId;
-      const deliver = async () => {
+      const deliver2 = async () => {
         const dbg = sendDebugEnabled();
         let preBox = null;
         if (dbg) {
@@ -15579,7 +17759,7 @@ function createCmuxDriver() {
         if (state === "dialog")
           throw new DeferDelivery(null, "modal");
         if (state === "empty") {
-          await deliver();
+          await deliver2();
           return;
         }
       }
@@ -15597,7 +17777,7 @@ function createCmuxDriver() {
       if (hasModalOptionList2(screen))
         throw new DeferDelivery(null, "modal");
       if (draft === "") {
-        await deliver();
+        await deliver2();
         return;
       }
       if (!opts?.probe)
@@ -15625,7 +17805,7 @@ function createCmuxDriver() {
         throw new DeferDelivery(draft);
       }
       if (liveness === "no-draft") {
-        await deliver();
+        await deliver2();
         return;
       }
       if (rawBefore !== null && rawAfter !== null) {
@@ -15635,7 +17815,7 @@ function createCmuxDriver() {
           await restoreGrapheme(lastGrapheme);
           throw new DeferDelivery(draft);
         }
-        await deliver();
+        await deliver2();
         return;
       }
       throw new DeferDelivery(draft);
@@ -15770,15 +17950,15 @@ var RuntimeRegistry = class {
 
 // packages/workspaces/dist/notifiers/cmux.js
 init_dist();
-import { execFile as execFileCb, execFileSync as execFileSync7 } from "child_process";
-import { promisify as promisify2 } from "util";
-var execFile3 = promisify2(execFileCb);
+import { execFile as execFileCb, execFileSync as execFileSync9 } from "child_process";
+import { promisify as promisify3 } from "util";
+var execFile4 = promisify3(execFileCb);
 function createCmuxNotifier(_scope) {
   return {
     name: "cmux",
     async probe() {
       try {
-        execFileSync7(resolveCmuxBin(), ["capabilities"], { encoding: "utf-8", stdio: "pipe", timeout: CMUX_TIMEOUT });
+        execFileSync9(resolveCmuxBin(), ["capabilities"], { encoding: "utf-8", stdio: "pipe", timeout: CMUX_TIMEOUT });
         return { installed: true, reachable: true };
       } catch (err) {
         const code = err.code;
@@ -15789,7 +17969,7 @@ function createCmuxNotifier(_scope) {
       }
     },
     async notify(message) {
-      await execFile3("squadrant", ["runtime", "send", "--command", message], { encoding: "utf-8", timeout: CMUX_TIMEOUT });
+      await execFile4("squadrant", ["runtime", "send", "--command", message], { encoding: "utf-8", timeout: CMUX_TIMEOUT });
     }
   };
 }
@@ -15826,9 +18006,9 @@ var NotifierRegistry = class {
 };
 
 // packages/workspaces/dist/workspaces/obsidian.js
-import fs24 from "fs/promises";
+import fs35 from "fs/promises";
 import { existsSync as existsSync11 } from "fs";
-import path27 from "path";
+import path40 from "path";
 
 // packages/workspaces/dist/workspaces/registry.js
 init_dist();
@@ -15988,9 +18168,9 @@ import { homedir as homedir11 } from "os";
 // packages/workspaces/dist/cmux-daemon/store-fingerprint.js
 init_dist();
 init_dist2();
-import { execFileSync as execFileSync8 } from "child_process";
+import { execFileSync as execFileSync10 } from "child_process";
 function defaultExecPs(pid) {
-  return execFileSync8("ps", ["-o", "command=", "-p", String(pid)], {
+  return execFileSync10("ps", ["-o", "command=", "-p", String(pid)], {
     encoding: "utf-8",
     stdio: ["ignore", "pipe", "ignore"]
   });
@@ -16378,9 +18558,9 @@ function defaultListFiles(dir) {
     return [];
   }
 }
-function defaultReadFile(path29) {
+function defaultReadFile(path42) {
   try {
-    return readFileSync17(path29, "utf-8");
+    return readFileSync17(path42, "utf-8");
   } catch {
     return void 0;
   }
@@ -16412,7 +18592,9 @@ var CLAUDE_HOOK_EVENTS = [
   ["PermissionRequest", "permission-request"],
   // #763: the turn died on an API error — today squadrant has no source for
   // this at all; without it the watchdog reports a plain stall (wrong story).
-  ["StopFailure", "stop-failure"]
+  ["StopFailure", "stop-failure"],
+  // #899: rules whose globs/anchors match the file just read are injected as context.
+  ["PostToolUse", "post-tool-use", "Read"]
 ];
 var DEFAULT_CLI_CMD = "squadrant";
 function hookCommandFor(eventName, sub, hookCmd, gateCmd) {
@@ -16758,16 +18940,16 @@ function extractDetail(sub, payload) {
   }
   return void 0;
 }
-function defaultReadFile2(path29) {
+function defaultReadFile2(path42) {
   try {
-    return readFileSync18(path29, "utf-8");
+    return readFileSync18(path42, "utf-8");
   } catch {
     return void 0;
   }
 }
-function defaultWriteFile(path29, content) {
-  mkdirSync8(path29.replace(/\/[^/]+$/, ""), { recursive: true });
-  writeFileSync11(path29, content, "utf-8");
+function defaultWriteFile(path42, content) {
+  mkdirSync8(path42.replace(/\/[^/]+$/, ""), { recursive: true });
+  writeFileSync11(path42, content, "utf-8");
 }
 
 // packages/workspaces/dist/crew-pane.js
@@ -16852,9 +19034,9 @@ init_dist();
 
 // packages/cli/src/lib/daemon-restart-broadcast.ts
 init_dist();
-import path28 from "path";
+import path41 from "path";
 function statePath2(stateRoot) {
-  return path28.join(stateRoot, "daemon-restart-state.json");
+  return path41.join(stateRoot, "daemon-restart-state.json");
 }
 function computeRestartSignature(version, buildMtimeMs) {
   return `${version}::${buildMtimeMs}`;
@@ -16903,7 +19085,7 @@ async function maybeBroadcastDaemonRestart(opts) {
 
 // packages/cli/src/lib/captain-channel-factory.ts
 import { createServer as createServer4, connect as netConnect } from "net";
-import fs25 from "fs";
+import fs36 from "fs";
 import { join as join26 } from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 import chalk2 from "chalk";
@@ -16912,15 +19094,15 @@ var shared;
 var registryEntryPath = () => join26(CLAUDE_SESSIONS_DIR, `${process.pid}.json`);
 function unregisterSenderIdentity() {
   try {
-    fs25.unlinkSync(registryEntryPath());
+    fs36.unlinkSync(registryEntryPath());
   } catch {
   }
 }
 function registerSenderIdentity(socketPath) {
   try {
     unregisterSenderIdentity();
-    fs25.mkdirSync(CLAUDE_SESSIONS_DIR, { recursive: true });
-    fs25.writeFileSync(
+    fs36.mkdirSync(CLAUDE_SESSIONS_DIR, { recursive: true });
+    fs36.writeFileSync(
       registryEntryPath(),
       JSON.stringify({
         pid: process.pid,
@@ -16946,7 +19128,7 @@ async function sharedReceiptListener() {
     // must never be the reason we refuse to start.
     unlinkStale: (p) => {
       try {
-        fs25.unlinkSync(p);
+        fs36.unlinkSync(p);
       } catch {
       }
     },
@@ -16971,7 +19153,7 @@ async function buildCaptainChannel() {
     // in /tmp/x registers cwd "/private/tmp/x" on macOS, so cwd matching silently
     // missed and every captain ping reported accepted-unconfirmed.
     statusFor: (taskId) => readClaudeStatusBySocketPath(captainSocketPath(taskId)),
-    wire: (p, e) => writeLine(p, e, { connect: (path29) => netConnect(path29) }),
+    wire: (p, e) => writeLine(p, e, { connect: (path42) => netConnect(path42) }),
     receipts,
     newMsgId: () => randomUUID5(),
     sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
@@ -17137,25 +19319,25 @@ function startSquadrantd(opts = {}) {
   ctx.cancelPromotionsFor = cancelPromotionsFor;
   const codexAppServerSource = new CodexAppServerSource();
   const codexDriver = opts.codexDriver ?? new CodexInteractiveDriver({
-    emit: (ev) => {
-      const found = ctx.store.listAll().find((r) => r.id === ev.id);
+    emit: (ev2) => {
+      const found = ctx.store.listAll().find((r) => r.id === ev2.id);
       if (!found) return;
-      void ctx.d.handle({ kind: "event", project: found.project, event: ev });
-      if (ev.type === "task.delta")
-        ctx.broadcast(ev.id, { type: "delta", taskId: ev.id, text: ev.chunk });
-      else if (ev.type === "task.turn.started")
-        ctx.broadcast(ev.id, { type: "turn-started", taskId: ev.id });
-      else if (ev.type === "task.turn.completed")
-        ctx.broadcast(ev.id, { type: "turn-completed", taskId: ev.id });
-      else if (ev.type === "task.input.requested") {
-        ctx.broadcast(ev.id, { type: "input-requested", taskId: ev.id, requestId: ev.requestId, question: ev.question });
-        ctx.schedulePromotion(ev.id, ev.requestId, "input", ev.question);
-      } else if (ev.type === "task.approval.requested") {
-        ctx.broadcast(ev.id, { type: "approval-requested", taskId: ev.id, requestId: ev.requestId, question: ev.question, kind: ev.kind });
-        ctx.schedulePromotion(ev.id, ev.requestId, "approval", ev.question);
-      } else if (ev.type === "task.reattached")
-        ctx.broadcast(ev.id, { type: "reattached", taskId: ev.id });
-      codexAppServerSource.observe(ev);
+      void ctx.d.handle({ kind: "event", project: found.project, event: ev2 });
+      if (ev2.type === "task.delta")
+        ctx.broadcast(ev2.id, { type: "delta", taskId: ev2.id, text: ev2.chunk });
+      else if (ev2.type === "task.turn.started")
+        ctx.broadcast(ev2.id, { type: "turn-started", taskId: ev2.id });
+      else if (ev2.type === "task.turn.completed")
+        ctx.broadcast(ev2.id, { type: "turn-completed", taskId: ev2.id });
+      else if (ev2.type === "task.input.requested") {
+        ctx.broadcast(ev2.id, { type: "input-requested", taskId: ev2.id, requestId: ev2.requestId, question: ev2.question });
+        ctx.schedulePromotion(ev2.id, ev2.requestId, "input", ev2.question);
+      } else if (ev2.type === "task.approval.requested") {
+        ctx.broadcast(ev2.id, { type: "approval-requested", taskId: ev2.id, requestId: ev2.requestId, question: ev2.question, kind: ev2.kind });
+        ctx.schedulePromotion(ev2.id, ev2.requestId, "approval", ev2.question);
+      } else if (ev2.type === "task.reattached")
+        ctx.broadcast(ev2.id, { type: "reattached", taskId: ev2.id });
+      codexAppServerSource.observe(ev2);
     }
   });
   const violationLogState = /* @__PURE__ */ new Map();
@@ -17179,23 +19361,23 @@ function startSquadrantd(opts = {}) {
   const opencodeRequestIds = { n: 1 };
   const eventsSource = createEventsSource({
     adapters: [createOpencodeFactAdapter({ nextRequestId: () => opencodeRequestIds.n++ })],
-    emit: (ev) => {
-      const found = store.listAll().find((r) => r.id === ev.id);
+    emit: (ev2) => {
+      const found = store.listAll().find((r) => r.id === ev2.id);
       if (!found) return;
-      void ctx.d.handle({ kind: "event", project: found.project, event: ev });
-      if (ev.type === "task.approval.requested")
-        ctx.schedulePromotion(ev.id, ev.requestId, "approval", ev.question);
+      void ctx.d.handle({ kind: "event", project: found.project, event: ev2 });
+      if (ev2.type === "task.approval.requested")
+        ctx.schedulePromotion(ev2.id, ev2.requestId, "approval", ev2.question);
     },
     onViolation: onEventsViolation,
     check: { stallBudgetMs: 6e4, disagreeWindowMs: 5e3 }
   });
   const opencodeBridge = opts.opencodeBridge ?? new OpencodeSseBridge({
-    emit: (ev) => {
-      const found = store.listAll().find((r) => r.id === ev.id);
+    emit: (ev2) => {
+      const found = store.listAll().find((r) => r.id === ev2.id);
       if (!found) return;
-      void ctx.d.handle({ kind: "event", project: found.project, event: ev });
-      if (ev.type === "task.approval.requested")
-        ctx.schedulePromotion(ev.id, ev.requestId, "approval", ev.question);
+      void ctx.d.handle({ kind: "event", project: found.project, event: ev2 });
+      if (ev2.type === "task.approval.requested")
+        ctx.schedulePromotion(ev2.id, ev2.requestId, "approval", ev2.question);
     },
     ingest: (raw, taskId) => eventsSource.ingest("opencode-sse", raw, { taskId }),
     // #828: a crew wrapped by auto-gate has BOTH bash and edit at "ask" in its
@@ -17215,10 +19397,10 @@ function startSquadrantd(opts = {}) {
     log
   });
   const cmuxEventsBridge = opts.cmuxEventsBridge ?? new CmuxEventsBridge({
-    emit: (ev) => {
-      const found = store.listAll().find((r) => r.id === ev.id);
+    emit: (ev2) => {
+      const found = store.listAll().find((r) => r.id === ev2.id);
       if (!found) return;
-      void ctx.d.handle({ kind: "event", project: found.project, event: ev });
+      void ctx.d.handle({ kind: "event", project: found.project, event: ev2 });
     },
     resolve: (hook) => {
       if (!hook.cwd) return void 0;
@@ -17574,7 +19756,20 @@ if (process.argv[1] && process.argv[1].endsWith("squadrantd.js")) {
 `);
       process.exit(0);
     }
-    const h = startSquadrantd({ sweepMs: 3e4 });
+    const h = startSquadrantd({
+      sweepMs: 3e4,
+      // #898: KB reconcile scheduler on the 60s tick. Enqueues to the home captain's mailbox; never spawns.
+      knowledgeTick: async () => {
+        const stateRoot = join27(homedir14(), ".config", "squadrant", "state");
+        await tickKnowledgeSchedule({
+          cfg: loadConfig(),
+          stateRoot,
+          log: (m) => process.stderr.write(`[squadrantd] ${m}
+`),
+          enqueue: (project, text) => appendCaptainMessage({ stateRoot, project, text, source: "daemon" })
+        });
+      }
+    });
     const shutdown = (signal) => {
       void h.stop(signal).finally(() => process.exit(0));
     };