squadrant 0.27.0 → 0.28.0

package/dist/index.js

@@ -466,7 +466,8 @@ function validateRuleFrontmatter(fm) {
     if (fm[k] !== void 0 && !isStrArr(fm[k]))
       p.push(`${k} must be a string array`);
   }
-  if (!Array.isArray(fm.sources) || fm.sources.length === 0) {
+  const mayBeSourceless = fm.status === "stale" || fm.status === "retired";
+  if (!Array.isArray(fm.sources) || fm.sources.length === 0 && !mayBeSourceless) {
     p.push("sources must be a non-empty array");
   } else {
     fm.sources.forEach((s, i) => {
@@ -500,6 +501,26 @@ function validateSourceEntry(e) {
     p.push("domain must be a string");
   if (e.sensitivity !== void 0 && e.sensitivity !== "local-only")
     p.push("sensitivity must be 'local-only' when set");
+  if (e.review !== void 0 && e.review !== "required")
+    p.push("review must be 'required' when set");
+  return p;
+}
+function validateErratum(e) {
+  if (!isObj(e))
+    return ["erratum must be an object"];
+  const p = [];
+  if (typeof e.id !== "string" || !RULE_ID_RE.test(e.id))
+    p.push(`id must match ${RULE_ID_RE}`);
+  for (const k of ["ref", "quote", "reason"]) {
+    if (typeof e[k] !== "string" || e[k] === "")
+      p.push(`${k} must be a non-empty string`);
+  }
+  if (e.evidence !== void 0 && !isStrArr(e.evidence))
+    p.push("evidence must be a string array");
+  for (const k of ["checked", "by", "at", "decision"]) {
+    if (e[k] !== void 0 && typeof e[k] !== "string")
+      p.push(`${k} must be a string`);
+  }
   return p;
 }
 function kbConfigs(cfg) {
@@ -624,22 +645,22 @@ function defaultCmuxConfigPath() {
   return join(homedir(), ".config", "cmux", "cmux.json");
 }
 function ensureSocketAutomation(opts = {}) {
-  const path59 = opts.path ?? defaultCmuxConfigPath();
-  if (!existsSync(path59)) {
-    mkdirSync(dirname(path59), { recursive: true });
-    writeFileSync(path59, MINIMAL_TEMPLATE);
-    return { path: path59, changed: true, alreadySet: false };
+  const path60 = opts.path ?? defaultCmuxConfigPath();
+  if (!existsSync(path60)) {
+    mkdirSync(dirname(path60), { recursive: true });
+    writeFileSync(path60, MINIMAL_TEMPLATE);
+    return { path: path60, changed: true, alreadySet: false };
   }
-  const text = readFileSync(path59, "utf-8");
+  const text = readFileSync(path60, "utf-8");
   const current = parse(text)?.automation?.socketControlMode;
   if (current === AUTOMATION_MODE) {
-    return { path: path59, changed: false, alreadySet: true };
+    return { path: path60, changed: false, alreadySet: true };
   }
   const edits = modify(text, [...SOCKET_CONTROL_MODE_PATH], AUTOMATION_MODE, {
     formattingOptions: { insertSpaces: true, tabSize: 2 }
   });
-  writeFileSync(path59, applyEdits(text, edits));
-  return { path: path59, changed: true, alreadySet: false };
+  writeFileSync(path60, applyEdits(text, edits));
+  return { path: path60, changed: true, alreadySet: false };
 }
 var SOCKET_CONTROL_MODE_PATH, AUTOMATION_MODE, MINIMAL_TEMPLATE;
 var init_cmux_config = __esm({
@@ -792,9 +813,9 @@ import { join as join4 } from "path";
 function defaultStatePath() {
   return join4(homedir3(), ".config", "squadrant", "state", "cmux-autoconfig.json");
 }
-function readState(path59) {
+function readState(path60) {
   try {
-    return JSON.parse(readConfigFileSync(path59));
+    return JSON.parse(readConfigFileSync(path60));
   } catch {
     return {};
   }
@@ -955,18 +976,18 @@ function detectDrift(user, def) {
       }
     }
   }
-  const checkBackend = (path59, backend, agentName) => {
+  const checkBackend = (path60, backend, agentName) => {
     if (backend === void 0)
       return;
     if (!isBackendMode(backend)) {
-      items.push({ path: path59, kind: "invalid", severity: "warn", current: backend, note: "unknown backend; expected native|direct|proxy" });
+      items.push({ path: path60, kind: "invalid", severity: "warn", current: backend, note: "unknown backend; expected native|direct|proxy" });
       return;
     }
     if (backend !== "native") {
       if (agentName !== "claude") {
-        items.push({ path: path59, kind: "invalid", severity: "warn", current: backend, note: `backend '${backend}' is claude-only (agent '${agentName ?? "?"}')` });
+        items.push({ path: path60, kind: "invalid", severity: "warn", current: backend, note: `backend '${backend}' is claude-only (agent '${agentName ?? "?"}')` });
       } else if (!router) {
-        items.push({ path: path59, kind: "invalid", severity: "warn", current: backend, note: `backend '${backend}' requires defaults.router` });
+        items.push({ path: path60, kind: "invalid", severity: "warn", current: backend, note: `backend '${backend}' requires defaults.router` });
       }
     }
   };
@@ -1859,6 +1880,7 @@ __export(dist_exports, {
   saveConfig: () => saveConfig,
   saveProjectOverride: () => saveProjectOverride,
   subscribedKbs: () => subscribedKbs,
+  validateErratum: () => validateErratum,
   validateRuleFrontmatter: () => validateRuleFrontmatter,
   validateSourceEntry: () => validateSourceEntry,
   withStamp: () => withStamp,
@@ -3510,10 +3532,10 @@ function detectForeignInstall(parsed, thisEntry, registeredEntryExists) {
     isUpgrade: isVersionUpgrade(parsed.daemonEntry, thisEntry)
   };
 }
-function sanitizePathForPlist(path59) {
+function sanitizePathForPlist(path60) {
   const seen = /* @__PURE__ */ new Set();
   const stable = [];
-  for (const p of path59.split(":")) {
+  for (const p of path60.split(":")) {
     if (!p)
       continue;
     if (p.includes("/.claude/plugins/"))
@@ -6053,11 +6075,11 @@ var init_captain_record = __esm({
 // packages/core/dist/opencode-session.js
 import { execFileSync as execFileSync4 } from "child_process";
 async function listSessions(port, fetchImpl = fetch, timeoutMs = 5e3) {
-  for (const path59 of ["/session", "/api/session"]) {
+  for (const path60 of ["/session", "/api/session"]) {
     const ac = new AbortController();
     const t = setTimeout(() => ac.abort(), timeoutMs);
     try {
-      const res = await fetchImpl(`http://127.0.0.1:${port}${path59}`, { signal: ac.signal });
+      const res = await fetchImpl(`http://127.0.0.1:${port}${path60}`, { signal: ac.signal });
       if (!res.ok)
         continue;
       const rows = await res.json();
@@ -6750,10 +6772,10 @@ function distBuiltAt() {
     return 0;
   }
 }
-function gatherLogStats(path59, now, windowMs) {
+function gatherLogStats(path60, now, windowMs) {
   let sizeBytes = 0;
   try {
-    sizeBytes = statSync3(path59).size;
+    sizeBytes = statSync3(path60).size;
   } catch {
     return { errorCount: 0, sizeBytes: 0, windowMs };
   }
@@ -6764,7 +6786,7 @@ function gatherLogStats(path59, now, windowMs) {
   const len = sizeBytes - start;
   let text = "";
   try {
-    const fd = openSync2(path59, "r");
+    const fd = openSync2(path60, "r");
     try {
       const buf = Buffer.alloc(len);
       readSync(fd, buf, 0, len, start);
@@ -9010,8 +9032,8 @@ var init_stream = __esm({
 // packages/core/dist/router/shim.js
 import { createServer as createServer3 } from "http";
 import { Readable } from "stream";
-function joinUrl(base, path59) {
-  return base.replace(/\/+$/, "") + path59;
+function joinUrl(base, path60) {
+  return base.replace(/\/+$/, "") + path60;
 }
 async function readBody(req) {
   const chunks = [];
@@ -9187,8 +9209,8 @@ function createRouterShim(opts) {
     writeJson(res, 200, { input_tokens: Math.max(1, Math.ceil(text.length / 4)) });
   }
   function handler(req, res) {
-    const path59 = pathnameOf(req.url);
-    if (req.method === "POST" && path59 === "/v1/messages") {
+    const path60 = pathnameOf(req.url);
+    if (req.method === "POST" && path60 === "/v1/messages") {
       void handleMessages(req, res).catch((err) => {
         log(`router internal error: ${err instanceof Error ? err.message : String(err)}`);
         if (!res.headersSent) {
@@ -9200,18 +9222,18 @@ function createRouterShim(opts) {
       });
       return;
     }
-    if (req.method === "POST" && path59 === "/v1/messages/count_tokens") {
+    if (req.method === "POST" && path60 === "/v1/messages/count_tokens") {
       void handleCountTokens(req, res).catch(() => {
         if (!res.headersSent)
           writeJson(res, 502, anthropicError(502, "api_error", "router internal error").body);
       });
       return;
     }
-    if (req.method === "GET" && path59 === "/v1/models") {
+    if (req.method === "GET" && path60 === "/v1/models") {
       writeJson(res, 200, modelsList([...advertisedModels]));
       return;
     }
-    if (req.method === "GET" && path59 === "/healthz") {
+    if (req.method === "GET" && path60 === "/healthz") {
       writeJson(res, 200, { ready: server?.listening === true, upstreamReachable, lastError });
       return;
     }
@@ -9480,11 +9502,11 @@ async function probeCaptainChannel(project, opts = {}) {
   }
 }
 async function httpReachable(port, fetchImpl, timeoutMs) {
-  for (const path59 of ["/session", "/api/session"]) {
+  for (const path60 of ["/session", "/api/session"]) {
     const ac = new AbortController();
     const t = setTimeout(() => ac.abort(), timeoutMs);
     try {
-      const res = await fetchImpl(`http://127.0.0.1:${port}${path59}`, { signal: ac.signal });
+      const res = await fetchImpl(`http://127.0.0.1:${port}${path60}`, { signal: ac.signal });
       if (res.ok)
         return true;
     } catch {
@@ -10341,16 +10363,281 @@ var init_paths = __esm({
   }
 });
 
-// packages/core/dist/knowledge/store.js
+// packages/core/dist/knowledge/ingest.js
+import crypto3 from "crypto";
 import fs15 from "fs";
 import os7 from "os";
 import path16 from "path";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+function refFor(kbRoot, file) {
+  const rel = path16.relative(kbRoot, file);
+  if (rel && !rel.startsWith("..") && !path16.isAbsolute(rel))
+    return rel.split(path16.sep).join("/");
+  const home = os7.homedir();
+  return file.startsWith(home + path16.sep) ? `~/${path16.relative(home, file).split(path16.sep).join("/")}` : file;
+}
+function readState2(kbRoot, ref) {
+  try {
+    return JSON.parse(fs15.readFileSync(stampFile(kbRoot, ref), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeState(kbRoot, st) {
+  fs15.mkdirSync(path16.join(kbRoot, CONVERTED_DIR), { recursive: true });
+  fs15.writeFileSync(stampFile(kbRoot, st.ref), JSON.stringify(st) + "\n");
+}
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        re += glob[i + 2] === "/" ? "(?:.*/)?" : ".*";
+        i += glob[i + 2] === "/" ? 2 : 1;
+      } else
+        re += "[^/]*";
+    } else if (c === "?")
+      re += "[^/]";
+    else
+      re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${re}$`);
+}
+function walkFiles(dir, out = []) {
+  if (!fs15.existsSync(dir))
+    return out;
+  for (const ent of fs15.readdirSync(dir, { withFileTypes: true })) {
+    if (ent.name === ".git" || ent.name === CONVERTED_DIR || ent.name === "node_modules")
+      continue;
+    const full = path16.join(dir, ent.name);
+    if (ent.isDirectory())
+      walkFiles(full, out);
+    else if (ent.isFile())
+      out.push(full);
+  }
+  return out;
+}
+function expandSource(kbRoot, entry) {
+  const abs = path16.resolve(kbRoot, expandHome(entry.path));
+  if (!/[*?]/.test(entry.path))
+    return fs15.existsSync(abs) && fs15.statSync(abs).isFile() ? [abs] : [];
+  const base = abs.split(/[*?]/)[0];
+  const root = base.endsWith(path16.sep) ? base : path16.dirname(base);
+  const re = globToRegExp(abs.split(path16.sep).join("/"));
+  return walkFiles(root).filter((f) => re.test(f.split(path16.sep).join("/"))).sort();
+}
+function sourceCovers(kbRoot, entry, ref) {
+  const abs = path16.resolve(kbRoot, expandHome(entry.path));
+  const file = fileForRef(kbRoot, ref);
+  return /[*?]/.test(entry.path) ? globToRegExp(abs.split(path16.sep).join("/")).test(file.split(path16.sep).join("/")) : abs === file;
+}
+function detectChange(kbRoot, file) {
+  const ref = refFor(kbRoot, file);
+  const st = fs15.statSync(file);
+  const prior = readState2(kbRoot, ref);
+  if (prior && prior.size === st.size && prior.mtimeMs === st.mtimeMs) {
+    return { ref, changed: false, stamp: { sha: prior.sha, size: st.size, mtimeMs: st.mtimeMs }, prior };
+  }
+  const sha = sha256(file);
+  return { ref, changed: !prior || prior.sha !== sha, stamp: { sha, size: st.size, mtimeMs: st.mtimeMs }, prior };
+}
+function splitSections(text) {
+  const cuts = [];
+  const re = /^#{1,6}[ \t]+(.+)$/gm;
+  for (let m = re.exec(text); m; m = re.exec(text))
+    cuts.push({ at: m.index, heading: m[1].trim() });
+  if (!cuts.length || cuts[0].at > 0)
+    cuts.unshift({ at: 0 });
+  const spans = [];
+  cuts.forEach((c, i) => {
+    const end = i + 1 < cuts.length ? cuts[i + 1].at : text.length;
+    let start = c.at;
+    while (end - start > SECTION_TARGET_CHARS * 1.5) {
+      const brk = text.indexOf("\n\n", start + SECTION_TARGET_CHARS);
+      if (brk < 0 || brk >= end)
+        break;
+      spans.push({ index: 0, start, end: brk, heading: c.heading });
+      start = brk + 2;
+    }
+    if (text.slice(start, end).trim())
+      spans.push({ index: 0, start, end, heading: c.heading });
+  });
+  return spans.map((s, i) => ({ ...s, index: i }));
+}
+async function planIngest(kbRoot, opts) {
+  const converter = opts.converter ?? markitdownConverter;
+  const cap = opts.maxSectionsPerPass ?? DEFAULT_MAX_SECTIONS_PER_PASS;
+  const plan = { sources: [], skipped: [], failed: [], carriedSections: 0, sectionCount: 0, estimatedTokens: 0, existing: opts.existing ?? [] };
+  let budget = cap;
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of opts.sources) {
+    for (const file of expandSource(kbRoot, entry)) {
+      const { ref, changed, stamp, prior } = detectChange(kbRoot, file);
+      if (seen.has(ref))
+        continue;
+      seen.add(ref);
+      const pending = !!prior && prior.cursor < prior.sections;
+      if (!changed && !pending)
+        continue;
+      if (entry.sensitivity === "local-only" && !opts.localModel) {
+        plan.skipped.push({ ref, reason: "sensitivity: local-only and no local model available" });
+        continue;
+      }
+      if (budget <= 0) {
+        plan.carriedSections += changed ? 1 : prior.sections - prior.cursor;
+        continue;
+      }
+      let text;
+      const conv = convertedFile(kbRoot, ref);
+      try {
+        if (!changed && fs15.existsSync(conv))
+          text = fs15.readFileSync(conv, "utf8");
+        else {
+          text = PASS_THROUGH.has(path16.extname(file).toLowerCase()) ? fs15.readFileSync(file, "utf8") : await converter(file);
+          if (!opts.dryRun) {
+            fs15.mkdirSync(path16.dirname(conv), { recursive: true });
+            fs15.writeFileSync(conv, text);
+          }
+        }
+      } catch (e) {
+        plan.failed.push({ ref, error: e.message.split("\n")[0] });
+        continue;
+      }
+      const all = splitSections(text);
+      const from = changed ? 0 : prior.cursor;
+      const take = all.slice(from, from + budget);
+      budget -= take.length;
+      plan.carriedSections += all.length - from - take.length;
+      plan.sectionCount += take.length;
+      plan.estimatedTokens += Math.ceil(take.reduce((n, s) => n + (s.end - s.start), 0) / CHARS_PER_TOKEN);
+      plan.sources.push({
+        ref,
+        file,
+        converted: conv,
+        sha: stamp.sha,
+        priority: entry.priority,
+        domain: entry.domain,
+        sensitivity: entry.sensitivity,
+        sections: take,
+        totalSections: all.length
+      });
+      if (!opts.dryRun)
+        writeState(kbRoot, { ref, ...stamp, sections: all.length, cursor: from + take.length, priority: entry.priority });
+    }
+  }
+  return plan;
+}
+var execFileAsync, CONVERTED_DIR, DEFAULT_MAX_SECTIONS_PER_PASS, CHARS_PER_TOKEN, PASS_THROUGH, SECTION_TARGET_CHARS, markitdownConverter, expandHome, fileForRef, cacheKey, convertedFile, stampFile, isGatedRef, sha256;
+var init_ingest = __esm({
+  "packages/core/dist/knowledge/ingest.js"() {
+    execFileAsync = promisify2(execFile2);
+    CONVERTED_DIR = ".converted";
+    DEFAULT_MAX_SECTIONS_PER_PASS = 40;
+    CHARS_PER_TOKEN = 4;
+    PASS_THROUGH = /* @__PURE__ */ new Set([".md", ".markdown", ".txt"]);
+    SECTION_TARGET_CHARS = 4e3;
+    markitdownConverter = async (file) => {
+      const { stdout } = await execFileAsync("markitdown", [file], { maxBuffer: 64 * 1024 * 1024 });
+      return stdout;
+    };
+    expandHome = (p) => p === "~" || p.startsWith("~/") ? path16.join(os7.homedir(), p.slice(1)) : p;
+    fileForRef = (kbRoot, ref) => path16.resolve(kbRoot, expandHome(ref));
+    cacheKey = (ref) => `${ref.replace(/[^A-Za-z0-9._-]+/g, "_")}.${crypto3.createHash("sha1").update(ref).digest("hex").slice(0, 6)}`;
+    convertedFile = (kbRoot, ref) => path16.join(kbRoot, CONVERTED_DIR, `${cacheKey(ref)}.md`);
+    stampFile = (kbRoot, ref) => path16.join(kbRoot, CONVERTED_DIR, `${cacheKey(ref)}.sha`);
+    isGatedRef = (kbRoot, sources, ref) => sources.some((e) => e.review === "required" && sourceCovers(kbRoot, e, ref));
+    sha256 = (file) => crypto3.createHash("sha256").update(fs15.readFileSync(file)).digest("hex");
+  }
+});
+
+// packages/core/dist/knowledge/verify.js
+function normalizeWithMap(src, keepBreakHyphen = false) {
+  const out = [];
+  const map2 = [];
+  const push = (s, at) => {
+    for (const ch of s) {
+      out.push(ch);
+      map2.push(at);
+    }
+  };
+  let i = 0;
+  while (i < src.length) {
+    const ch = src[i];
+    if (ch === "-" && /^-[ \t]*\r?\n[ \t]*[a-z]/.test(src.slice(i, i + 40)) && i > 0 && /[A-Za-z]/.test(src[i - 1])) {
+      if (keepBreakHyphen)
+        push("-", i);
+      i++;
+      while (/\s/.test(src[i]))
+        i++;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      const start = i;
+      while (i < src.length && /\s/.test(src[i]))
+        i++;
+      if (out.length && out[out.length - 1] !== " ")
+        push(" ", start);
+      continue;
+    }
+    if (MARKUP.has(ch)) {
+      i++;
+      continue;
+    }
+    if (LIGATURES[ch])
+      push(LIGATURES[ch], i);
+    else if (QUOTES[ch])
+      push(QUOTES[ch], i);
+    else if (DASHES.has(ch))
+      push("-", i);
+    else
+      push(ch, i);
+    i++;
+  }
+  while (out.length && out[out.length - 1] === " ") {
+    out.pop();
+    map2.pop();
+  }
+  return { text: out.join(""), map: map2 };
+}
+function findQuote(source, quote) {
+  const needle = normalizeText(quote);
+  if (!needle)
+    return null;
+  const views = typeof source === "string" ? normalizedViews(source) : source;
+  for (const hay of views) {
+    const at = hay.text.indexOf(needle);
+    if (at >= 0)
+      return [hay.map[at], hay.map[at + needle.length - 1] + 1];
+  }
+  return null;
+}
+var LIGATURES, QUOTES, DASHES, MARKUP, normalizeText, normalizedViews, DOCLING_DROP_THRESHOLD, needsDocling, spansOverlap;
+var init_verify = __esm({
+  "packages/core/dist/knowledge/verify.js"() {
+    LIGATURES = { "\uFB01": "fi", "\uFB02": "fl", "\uFB00": "ff", "\uFB03": "ffi", "\uFB04": "ffl", "\uFB05": "st", "\uFB06": "st" };
+    QUOTES = { "\u2018": "'", "\u2019": "'", "\u201A": "'", "\u201B": "'", "\u201C": '"', "\u201D": '"', "\u201E": '"', "\u201F": '"' };
+    DASHES = /* @__PURE__ */ new Set(["\u2010", "\u2011", "\u2012", "\u2013", "\u2014", "\u2015", "\u2212"]);
+    MARKUP = /* @__PURE__ */ new Set(["*", "_", "`", "\\"]);
+    normalizeText = (s) => normalizeWithMap(s).text;
+    normalizedViews = (src) => [normalizeWithMap(src), normalizeWithMap(src, true)];
+    DOCLING_DROP_THRESHOLD = 0.2;
+    needsDocling = (dropped, total) => total > 0 && dropped / total > DOCLING_DROP_THRESHOLD;
+    spansOverlap = (a, b) => a[0] < b[1] && b[0] < a[1];
+  }
+});
+
+// packages/core/dist/knowledge/store.js
+import fs16 from "fs";
+import os8 from "os";
+import path17 from "path";
 import matter2 from "gray-matter";
 function duplicateIdProblem(id, ignored, used) {
   return `duplicate id ${id}: ${ignored} is ignored, ${used} is used (live files win over _proposed, then path order). Fix: rename the id in one file, or delete or move one of them.`;
 }
 function isPendingProposalDup(e, rulesDir) {
-  return e.problems.every((p) => p.startsWith("duplicate id")) && path16.relative(rulesDir, e.file).split(path16.sep).includes(PROPOSED_DIR);
+  return e.problems.every((p) => p.startsWith("duplicate id")) && path17.relative(rulesDir, e.file).split(path17.sep).includes(PROPOSED_DIR);
 }
 function splitStatement(body) {
   const first = body.trim().split(/\n\s*\n/)[0] ?? "";
@@ -10359,8 +10646,8 @@ function splitStatement(body) {
 function listMarkdown(dir, includeProposed) {
   const out = [];
   const walk = (d) => {
-    for (const ent of fs15.readdirSync(d, { withFileTypes: true })) {
-      const full = path16.join(d, ent.name);
+    for (const ent of fs16.readdirSync(d, { withFileTypes: true })) {
+      const full = path17.join(d, ent.name);
       if (ent.isDirectory()) {
         if (ent.name === PROPOSED_DIR && !includeProposed)
           continue;
@@ -10371,11 +10658,11 @@ function listMarkdown(dir, includeProposed) {
     }
   };
   walk(dir);
-  const isProposed = (f) => path16.relative(dir, f).split(path16.sep).includes(PROPOSED_DIR);
+  const isProposed = (f) => path17.relative(dir, f).split(path17.sep).includes(PROPOSED_DIR);
   return out.sort((a, b) => Number(isProposed(a)) - Number(isProposed(b)) || (a < b ? -1 : a > b ? 1 : 0));
 }
 function loadRulesDir(dir, layer, opts = {}) {
-  if (!fs15.existsSync(dir))
+  if (!fs16.existsSync(dir))
     return { rules: [], errors: [] };
   const rules = [];
   const errors = [];
@@ -10383,7 +10670,7 @@ function loadRulesDir(dir, layer, opts = {}) {
   for (const file of listMarkdown(dir, opts.includeProposed ?? false)) {
     let parsed;
     try {
-      parsed = matter2(fs15.readFileSync(file, "utf8"), NO_JS_FRONTMATTER);
+      parsed = matter2(fs16.readFileSync(file, "utf8"), NO_JS_FRONTMATTER);
     } catch (e) {
       errors.push({ file, problems: [`frontmatter parse error: ${e.message}`] });
       continue;
@@ -10407,14 +10694,14 @@ function loadRulesDir(dir, layer, opts = {}) {
 function resolveSourceRef(ref, kbRoot, sources) {
   const bases = /* @__PURE__ */ new Set([kbRoot]);
   for (const s of sources) {
-    let d = path16.resolve(kbRoot, expandHome(s.path.split(/[*?[{]/)[0]));
-    for (let i = 0; i < 6 && d !== path16.dirname(d); i++) {
-      d = path16.dirname(d);
+    let d = path17.resolve(kbRoot, expandHome2(s.path.split(/[*?[{]/)[0]));
+    for (let i = 0; i < 6 && d !== path17.dirname(d); i++) {
+      d = path17.dirname(d);
       bases.add(d);
     }
   }
-  const cands = [path16.resolve(kbRoot, expandHome(ref)), ...[...bases].map((b) => path16.join(b, ref))];
-  return cands.find((c) => fs15.existsSync(c) && fs15.statSync(c).isFile());
+  const cands = [path17.resolve(kbRoot, expandHome2(ref)), ...[...bases].map((b) => path17.join(b, ref))];
+  return cands.find((c) => fs16.existsSync(c) && fs16.statSync(c).isFile());
 }
 function validateKb(opts) {
   const { rules, errors } = loadRulesDir(opts.rulesDir, "kb", { includeProposed: true });
@@ -10422,7 +10709,7 @@ function validateKb(opts) {
   const dups = errors.filter((e) => e.problems.some((p) => p.startsWith("duplicate id")) && !isPendingProposalDup(e, opts.rulesDir));
   const pendingDups = errors.filter((e) => isPendingProposalDup(e, opts.rulesDir)).length;
   const invalid = errors.filter((e) => !dups.includes(e) && !isPendingProposalDup(e, opts.rulesDir));
-  const proposed = rules.filter((r) => path16.relative(opts.rulesDir, r.file).split(path16.sep).includes(PROPOSED_DIR)).length;
+  const proposed = rules.filter((r) => path17.relative(opts.rulesDir, r.file).split(path17.sep).includes(PROPOSED_DIR)).length;
   checks.push({ level: "ok", message: `${rules.length + errors.length} rule files read (${rules.length - proposed} live, ${proposed + pendingDups} proposed parsed OK)` });
   if (invalid.length)
     for (const e of invalid)
@@ -10435,7 +10722,7 @@ function validateKb(opts) {
   else
     checks.push({ level: "ok", message: "no duplicate ids" });
   const cache = /* @__PURE__ */ new Map();
-  let verified = 0, unresolved = 0;
+  let verified = 0, unresolved = 0, notIngested = 0;
   for (const r of rules) {
     r.sources.forEach((src, i) => {
       const file = resolveSourceRef(src.ref, opts.kbRoot, opts.sources);
@@ -10443,16 +10730,33 @@ function validateKb(opts) {
         unresolved++;
         return;
       }
-      if (!cache.has(file))
-        cache.set(file, fs15.readFileSync(file, "utf8"));
-      if (cache.get(file).includes(src.quote))
+      const key = `${src.ref}\0${file}`;
+      if (!cache.has(key)) {
+        const conv = readState2(opts.kbRoot, src.ref) ? convertedFile(opts.kbRoot, src.ref) : null;
+        const cached = !!conv && fs16.existsSync(conv);
+        cache.set(key, {
+          hay: normalizedViews(fs16.readFileSync(cached ? conv : file, "utf8")),
+          convertible: !cached && !PASS_THROUGH.has(path17.extname(file).toLowerCase())
+        });
+      }
+      const { hay, convertible } = cache.get(key);
+      const span = findQuote(hay, src.quote);
+      if (span) {
         verified++;
+        const active = r.status === "active" && !path17.relative(opts.rulesDir, r.file).split(path17.sep).includes(PROPOSED_DIR);
+        const err = active ? (opts.errata ?? []).find((e) => e.ref === src.ref && ((o) => !!o && spansOverlap(o, span))(findQuote(hay, e.quote))) : void 0;
+        if (err)
+          checks.push({ level: "warn", message: `${r.id}: grounded in erratum ${err.id} (${err.reason}); re-check or retire it (${r.file})` });
+      } else if (convertible)
+        notIngested++;
       else
         checks.push({ level: "fail", message: `quote not found in ${file}: ${r.id} sources[${i}] (${r.file})` });
     });
   }
   if (!checks.some((c) => c.message.startsWith("quote not found")))
     checks.push({ level: "ok", message: `${verified} source quotes found in their source files` });
+  if (notIngested)
+    checks.push({ level: "skip", message: `${notIngested} source refs need conversion but have no .converted cache, quote not checked (run \`squadrant knowledge ingest <kb>\`)` });
   if (unresolved)
     checks.push({ level: "skip", message: `${unresolved} source refs not resolvable on this machine, quote not checked` });
   if (opts.domains) {
@@ -10463,22 +10767,24 @@ function validateKb(opts) {
   }
   return { checks, ok: !checks.some((c) => c.level === "fail") };
 }
-var NO_JS_FRONTMATTER, expandHome;
+var NO_JS_FRONTMATTER, expandHome2;
 var init_store2 = __esm({
   "packages/core/dist/knowledge/store.js"() {
     init_dist();
+    init_ingest();
     init_paths();
+    init_verify();
     NO_JS_FRONTMATTER = {
       engines: { javascript: { parse: () => {
         throw new Error("only YAML front matter is allowed");
       } } }
     };
-    expandHome = (p) => p === "~" || p.startsWith("~/") ? path16.join(os7.homedir(), p.slice(1)) : p;
+    expandHome2 = (p) => p === "~" || p.startsWith("~/") ? path17.join(os8.homedir(), p.slice(1)) : p;
   }
 });
 
 // packages/core/dist/knowledge/layers.js
-import fs16 from "fs";
+import fs17 from "fs";
 function loadKbRules(cfg, kb, opts = {}) {
   return loadRulesDir(kbRulesDir(cfg, kb), `kb:${kb}`, opts);
 }
@@ -10490,7 +10796,7 @@ function resolveProjectRules(cfg, project, opts = {}) {
   const errors = [];
   const warnings = [];
   for (const kb of subscribedKbs(cfg, project)) {
-    if (!fs16.existsSync(kbDir(cfg, kb))) {
+    if (!fs17.existsSync(kbDir(cfg, kb))) {
       warnings.push(`knowledge base '${kb}' not found (run: squadrant knowledge init ${kb})`);
       continue;
     }
@@ -10528,8 +10834,8 @@ var init_layers = __esm({
 });
 
 // packages/core/dist/knowledge/index-file.js
-import fs17 from "fs";
-import path17 from "path";
+import fs18 from "fs";
+import path18 from "path";
 function compileIndex(kb, rules, now = /* @__PURE__ */ new Date()) {
   return {
     kb,
@@ -10538,18 +10844,18 @@ function compileIndex(kb, rules, now = /* @__PURE__ */ new Date()) {
   };
 }
 function writeIndex(kbRoot, index) {
-  const file = path17.join(kbRoot, "index.json");
+  const file = path18.join(kbRoot, "index.json");
   const tmp = `${file}.tmp-${process.pid}`;
-  fs17.writeFileSync(tmp, JSON.stringify(index, null, 2) + "\n");
-  fs17.renameSync(tmp, file);
+  fs18.writeFileSync(tmp, JSON.stringify(index, null, 2) + "\n");
+  fs18.renameSync(tmp, file);
   return file;
 }
 function readIndex(kbRoot, kb) {
-  const file = path17.join(kbRoot, "index.json");
-  if (!fs17.existsSync(file))
+  const file = path18.join(kbRoot, "index.json");
+  if (!fs18.existsSync(file))
     return { index: null, problem: `index.json missing for kb '${kb}'` };
   try {
-    const index = JSON.parse(fs17.readFileSync(file, "utf8"));
+    const index = JSON.parse(fs18.readFileSync(file, "utf8"));
     if (!Array.isArray(index.rules))
       return { index: null, problem: `index.json corrupt for kb '${kb}' (no rules array)` };
     return { index };
@@ -13644,15 +13950,16 @@ var init_js_yaml = __esm({
 });
 
 // packages/core/dist/knowledge/sources.js
-import fs18 from "fs";
-import path18 from "path";
+import fs19 from "fs";
+import path19 from "path";
+import matter3 from "gray-matter";
 function loadSources(kbRoot) {
-  const file = path18.join(kbRoot, "sources.yaml");
-  if (!fs18.existsSync(file))
+  const file = path19.join(kbRoot, "sources.yaml");
+  if (!fs19.existsSync(file))
     return { sources: [], errors: [] };
   let data;
   try {
-    data = yaml.load(fs18.readFileSync(file, "utf8"));
+    data = yaml.load(fs19.readFileSync(file, "utf8"));
   } catch (e) {
     return { sources: [], errors: [`YAML parse error: ${e.message.split("\n")[0]}`] };
   }
@@ -13671,208 +13978,82 @@ function loadSources(kbRoot) {
   });
   return { sources, errors };
 }
+function dropEntryBlock(text, entryPath) {
+  const lines = text.split("\n");
+  const q = entryPath.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const head = new RegExp(`^-\\s+path:\\s*(['"]?)${q}\\1\\s*(#.*)?$`);
+  const i = lines.findIndex((l) => head.test(l));
+  if (i < 0)
+    return null;
+  let j = i + 1;
+  while (j < lines.length && /^\s+\S/.test(lines[j]))
+    j++;
+  return [...lines.slice(0, i), ...lines.slice(j)].join("\n");
+}
+function removeSource(kbRoot, rulesDir, entryPath, opts = {}) {
+  const file = path19.join(kbRoot, "sources.yaml");
+  const { sources } = loadSources(kbRoot);
+  const entry = sources.find((s) => s.path === entryPath);
+  if (!entry)
+    throw new Error(`no sources.yaml entry with path '${entryPath}' (give it exactly as listed by \`knowledge sources\`)`);
+  const edited = dropEntryBlock(fs19.readFileSync(file, "utf8"), entryPath);
+  if (edited === null)
+    throw new Error(`could not edit sources.yaml for '${entryPath}' (not a plain block entry); remove it by hand, then rerun to strip the refs`);
+  const res = { dryRun: !!opts.dryRun, entryRemoved: true, stripped: [], stale: [] };
+  const writes = [];
+  for (const rule2 of loadRulesDir(rulesDir, "kb").rules) {
+    const kept = rule2.sources.filter((s) => !sourceCovers(kbRoot, entry, s.ref));
+    if (kept.length === rule2.sources.length)
+      continue;
+    res.stripped.push(rule2.id);
+    const parsed = matter3(fs19.readFileSync(rule2.file, "utf8"), { engines: { javascript: () => {
+      throw new Error("only YAML front matter is allowed");
+    } } });
+    const fm = { ...parsed.data, sources: kept };
+    if (!kept.length) {
+      res.stale.push(rule2.id);
+      if (fm.status === "active")
+        fm.status = "stale";
+    }
+    writes.push({ file: rule2.file, text: matter3.stringify(parsed.content, JSON.parse(JSON.stringify(fm))) });
+  }
+  res.stripped.sort();
+  res.stale.sort();
+  if (opts.dryRun)
+    return res;
+  for (const w of writes)
+    fs19.writeFileSync(w.file, w.text);
+  fs19.writeFileSync(file, edited);
+  const name = opts.kbName ?? path19.basename(kbRoot);
+  writeIndex(kbRoot, compileIndex(name, loadRulesDir(rulesDir, `kb:${name}`).rules));
+  return res;
+}
 var SOURCES_TEMPLATE;
 var init_sources = __esm({
   "packages/core/dist/knowledge/sources.js"() {
     init_js_yaml();
     init_dist();
+    init_index_file();
+    init_ingest();
+    init_store2();
     SOURCES_TEMPLATE = `# Trusted sources for this knowledge base (spec \xA73). Only these can produce rules.
 # priority: company > project > agent (decides conflicts).
 # sensitivity: local-only  \u2192 never sent to a hosted model (D12).
+# review: required         \u2192 new rules from this source wait in rules/_proposed/ for the operator; they never go live on their own.
 #
 # - path: raw/finance/**
 #   priority: company
 # - path: ~/work/flooros/docs/handbook/**
 #   priority: project
 #   domain: coding
+# - path: raw/**
+#   priority: agent
+#   review: required
 []
 `;
   }
 });
 
-// packages/core/dist/knowledge/ingest.js
-import crypto3 from "crypto";
-import fs19 from "fs";
-import os8 from "os";
-import path19 from "path";
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-function refFor(kbRoot, file) {
-  const rel = path19.relative(kbRoot, file);
-  if (rel && !rel.startsWith("..") && !path19.isAbsolute(rel))
-    return rel.split(path19.sep).join("/");
-  const home = os8.homedir();
-  return file.startsWith(home + path19.sep) ? `~/${path19.relative(home, file).split(path19.sep).join("/")}` : file;
-}
-function readState2(kbRoot, ref) {
-  try {
-    return JSON.parse(fs19.readFileSync(stampFile(kbRoot, ref), "utf8"));
-  } catch {
-    return null;
-  }
-}
-function writeState(kbRoot, st) {
-  fs19.mkdirSync(path19.join(kbRoot, CONVERTED_DIR), { recursive: true });
-  fs19.writeFileSync(stampFile(kbRoot, st.ref), JSON.stringify(st) + "\n");
-}
-function globToRegExp(glob) {
-  let re = "";
-  for (let i = 0; i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "*") {
-      if (glob[i + 1] === "*") {
-        re += glob[i + 2] === "/" ? "(?:.*/)?" : ".*";
-        i += glob[i + 2] === "/" ? 2 : 1;
-      } else
-        re += "[^/]*";
-    } else if (c === "?")
-      re += "[^/]";
-    else
-      re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-  }
-  return new RegExp(`^${re}$`);
-}
-function walkFiles(dir, out = []) {
-  if (!fs19.existsSync(dir))
-    return out;
-  for (const ent of fs19.readdirSync(dir, { withFileTypes: true })) {
-    if (ent.name === ".git" || ent.name === CONVERTED_DIR || ent.name === "node_modules")
-      continue;
-    const full = path19.join(dir, ent.name);
-    if (ent.isDirectory())
-      walkFiles(full, out);
-    else if (ent.isFile())
-      out.push(full);
-  }
-  return out;
-}
-function expandSource(kbRoot, entry) {
-  const abs = path19.resolve(kbRoot, expandHome2(entry.path));
-  if (!/[*?]/.test(entry.path))
-    return fs19.existsSync(abs) && fs19.statSync(abs).isFile() ? [abs] : [];
-  const base = abs.split(/[*?]/)[0];
-  const root = base.endsWith(path19.sep) ? base : path19.dirname(base);
-  const re = globToRegExp(abs.split(path19.sep).join("/"));
-  return walkFiles(root).filter((f) => re.test(f.split(path19.sep).join("/"))).sort();
-}
-function detectChange(kbRoot, file) {
-  const ref = refFor(kbRoot, file);
-  const st = fs19.statSync(file);
-  const prior = readState2(kbRoot, ref);
-  if (prior && prior.size === st.size && prior.mtimeMs === st.mtimeMs) {
-    return { ref, changed: false, stamp: { sha: prior.sha, size: st.size, mtimeMs: st.mtimeMs }, prior };
-  }
-  const sha = sha256(file);
-  return { ref, changed: !prior || prior.sha !== sha, stamp: { sha, size: st.size, mtimeMs: st.mtimeMs }, prior };
-}
-function splitSections(text) {
-  const cuts = [];
-  const re = /^#{1,6}[ \t]+(.+)$/gm;
-  for (let m = re.exec(text); m; m = re.exec(text))
-    cuts.push({ at: m.index, heading: m[1].trim() });
-  if (!cuts.length || cuts[0].at > 0)
-    cuts.unshift({ at: 0 });
-  const spans = [];
-  cuts.forEach((c, i) => {
-    const end = i + 1 < cuts.length ? cuts[i + 1].at : text.length;
-    let start = c.at;
-    while (end - start > SECTION_TARGET_CHARS * 1.5) {
-      const brk = text.indexOf("\n\n", start + SECTION_TARGET_CHARS);
-      if (brk < 0 || brk >= end)
-        break;
-      spans.push({ index: 0, start, end: brk, heading: c.heading });
-      start = brk + 2;
-    }
-    if (text.slice(start, end).trim())
-      spans.push({ index: 0, start, end, heading: c.heading });
-  });
-  return spans.map((s, i) => ({ ...s, index: i }));
-}
-async function planIngest(kbRoot, opts) {
-  const converter = opts.converter ?? markitdownConverter;
-  const cap = opts.maxSectionsPerPass ?? DEFAULT_MAX_SECTIONS_PER_PASS;
-  const plan = { sources: [], skipped: [], failed: [], carriedSections: 0, sectionCount: 0, estimatedTokens: 0, existing: opts.existing ?? [] };
-  let budget = cap;
-  const seen = /* @__PURE__ */ new Set();
-  for (const entry of opts.sources) {
-    for (const file of expandSource(kbRoot, entry)) {
-      const { ref, changed, stamp, prior } = detectChange(kbRoot, file);
-      if (seen.has(ref))
-        continue;
-      seen.add(ref);
-      const pending = !!prior && prior.cursor < prior.sections;
-      if (!changed && !pending)
-        continue;
-      if (entry.sensitivity === "local-only" && !opts.localModel) {
-        plan.skipped.push({ ref, reason: "sensitivity: local-only and no local model available" });
-        continue;
-      }
-      if (budget <= 0) {
-        plan.carriedSections += changed ? 1 : prior.sections - prior.cursor;
-        continue;
-      }
-      let text;
-      const conv = convertedFile(kbRoot, ref);
-      try {
-        if (!changed && fs19.existsSync(conv))
-          text = fs19.readFileSync(conv, "utf8");
-        else {
-          text = PASS_THROUGH.has(path19.extname(file).toLowerCase()) ? fs19.readFileSync(file, "utf8") : await converter(file);
-          if (!opts.dryRun) {
-            fs19.mkdirSync(path19.dirname(conv), { recursive: true });
-            fs19.writeFileSync(conv, text);
-          }
-        }
-      } catch (e) {
-        plan.failed.push({ ref, error: e.message.split("\n")[0] });
-        continue;
-      }
-      const all = splitSections(text);
-      const from = changed ? 0 : prior.cursor;
-      const take = all.slice(from, from + budget);
-      budget -= take.length;
-      plan.carriedSections += all.length - from - take.length;
-      plan.sectionCount += take.length;
-      plan.estimatedTokens += Math.ceil(take.reduce((n, s) => n + (s.end - s.start), 0) / CHARS_PER_TOKEN);
-      plan.sources.push({
-        ref,
-        file,
-        converted: conv,
-        sha: stamp.sha,
-        priority: entry.priority,
-        domain: entry.domain,
-        sensitivity: entry.sensitivity,
-        sections: take,
-        totalSections: all.length
-      });
-      if (!opts.dryRun)
-        writeState(kbRoot, { ref, ...stamp, sections: all.length, cursor: from + take.length, priority: entry.priority });
-    }
-  }
-  return plan;
-}
-var execFileAsync, CONVERTED_DIR, DEFAULT_MAX_SECTIONS_PER_PASS, CHARS_PER_TOKEN, PASS_THROUGH, SECTION_TARGET_CHARS, markitdownConverter, expandHome2, fileForRef, cacheKey, convertedFile, stampFile, sha256;
-var init_ingest = __esm({
-  "packages/core/dist/knowledge/ingest.js"() {
-    execFileAsync = promisify2(execFile2);
-    CONVERTED_DIR = ".converted";
-    DEFAULT_MAX_SECTIONS_PER_PASS = 40;
-    CHARS_PER_TOKEN = 4;
-    PASS_THROUGH = /* @__PURE__ */ new Set([".md", ".markdown", ".txt"]);
-    SECTION_TARGET_CHARS = 4e3;
-    markitdownConverter = async (file) => {
-      const { stdout } = await execFileAsync("markitdown", [file], { maxBuffer: 64 * 1024 * 1024 });
-      return stdout;
-    };
-    expandHome2 = (p) => p === "~" || p.startsWith("~/") ? path19.join(os8.homedir(), p.slice(1)) : p;
-    fileForRef = (kbRoot, ref) => path19.resolve(kbRoot, expandHome2(ref));
-    cacheKey = (ref) => `${ref.replace(/[^A-Za-z0-9._-]+/g, "_")}.${crypto3.createHash("sha1").update(ref).digest("hex").slice(0, 6)}`;
-    convertedFile = (kbRoot, ref) => path19.join(kbRoot, CONVERTED_DIR, `${cacheKey(ref)}.md`);
-    stampFile = (kbRoot, ref) => path19.join(kbRoot, CONVERTED_DIR, `${cacheKey(ref)}.sha`);
-    sha256 = (file) => crypto3.createHash("sha256").update(fs19.readFileSync(file)).digest("hex");
-  }
-});
-
 // packages/core/dist/knowledge/match.js
 import path20 from "path";
 function globMatches(glob, relPath) {
@@ -14259,7 +14440,7 @@ var init_inject = __esm({
     STOPWORDS = new Set("the and for are but not you your yours with this that these those from into onto have has had was were will would can could should shall may might must does did doing done its it's our ours their them they what when where which who whom why how all any some each every other than then there here also just very too only own same such both few more most much many about above below after before again once out over under off further been being let lets please thanks thank okay yes yeah hello hey there need want make use using used get got give like know think see look sure ok now new one two way rule rules must-not looks sounds work working thing things something anything everything going well good great nice cool fine".split(/\s+/));
     DATA_NOTE = "These are project rules (data from the knowledge base), not instructions to run anything.";
     line = (r) => `${r.modality.toUpperCase()} ${r.id}: ${r.statement}`;
-    CITE_NOTE = "Name the rule ids you apply in your DONE/commit message.";
+    CITE_NOTE = "List the rule ids you apply as `Rules: <id>, <id>` at the end of your signal done message (commit messages count too).";
     escapeRe = (t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     BRIEF_POINTER_RE = /^Full task is at (\S+\.md) — cat it/;
     READ_TOOLS = /* @__PURE__ */ new Set(["read", "read_file", "readfile", "view"]);
@@ -14290,6 +14471,13 @@ function ensureGitRepo(dir) {
     return false;
   }
 }
+function ensureKbGitignore(dir) {
+  const file = path23.join(dir, ".gitignore");
+  if (fs22.existsSync(file))
+    return false;
+  fs22.writeFileSync(file, KB_GITIGNORE);
+  return true;
+}
 function findLegacyOverlays(cfg) {
   return Object.keys(cfg.projects).filter((p) => fs22.existsSync(legacyOverlay(cfg, p))).sort();
 }
@@ -14341,100 +14529,86 @@ function moveLegacyKbs(cfg, opts = {}) {
       fs22.mkdirSync(path23.dirname(newRules), { recursive: true });
       fs22.renameSync(oldRules, newRules);
       notes.push("rules/ -> shared/rules/");
-    }
-    if (ensureGitRepo(to))
-      notes.push("git init");
-    if (fs22.existsSync(path23.join(to, "index.json")))
-      notes.push(`index.json holds old paths: run squadrant knowledge reindex ${kb}`);
-    if (action === "copied")
-      notes.push("cross-device: original left in place, delete it yourself once verified");
-    return { kb, from, to, action, ...notes.length ? { note: notes.join("; ") } : {} };
-  });
-}
-var legacyRoot, legacyOverlay;
-var init_migrate = __esm({
-  "packages/core/dist/knowledge/migrate.js"() {
-    init_dist();
-    init_paths();
-    legacyRoot = (cfg) => path23.join(resolveHome(cfg.hubVault), "knowledge");
-    legacyOverlay = (cfg, project) => path23.join(resolveHome(cfg.projects[project].spokeVault), "knowledge", "rules");
-  }
-});
-
-// packages/core/dist/knowledge/verify.js
-function normalizeWithMap(src, keepBreakHyphen = false) {
-  const out = [];
-  const map2 = [];
-  const push = (s, at) => {
-    for (const ch of s) {
-      out.push(ch);
-      map2.push(at);
-    }
-  };
-  let i = 0;
-  while (i < src.length) {
-    const ch = src[i];
-    if (ch === "-" && /^-[ \t]*\r?\n[ \t]*[a-z]/.test(src.slice(i, i + 40)) && i > 0 && /[A-Za-z]/.test(src[i - 1])) {
-      if (keepBreakHyphen)
-        push("-", i);
-      i++;
-      while (/\s/.test(src[i]))
-        i++;
-      continue;
-    }
-    if (/\s/.test(ch)) {
-      const start = i;
-      while (i < src.length && /\s/.test(src[i]))
-        i++;
-      if (out.length && out[out.length - 1] !== " ")
-        push(" ", start);
-      continue;
-    }
-    if (LIGATURES[ch])
-      push(LIGATURES[ch], i);
-    else if (QUOTES[ch])
-      push(QUOTES[ch], i);
-    else if (DASHES.has(ch))
-      push("-", i);
-    else
-      push(ch, i);
-    i++;
+    }
+    if (ensureGitRepo(to))
+      notes.push("git init");
+    if (ensureKbGitignore(to))
+      notes.push("wrote .gitignore (raw/, .converted/)");
+    if (fs22.existsSync(path23.join(to, "index.json")))
+      notes.push(`index.json holds old paths: run squadrant knowledge reindex ${kb}`);
+    if (action === "copied")
+      notes.push("cross-device: original left in place, delete it yourself once verified");
+    return { kb, from, to, action, ...notes.length ? { note: notes.join("; ") } : {} };
+  });
+}
+var legacyRoot, KB_GITIGNORE, legacyOverlay;
+var init_migrate = __esm({
+  "packages/core/dist/knowledge/migrate.js"() {
+    init_dist();
+    init_paths();
+    legacyRoot = (cfg) => path23.join(resolveHome(cfg.hubVault), "knowledge");
+    KB_GITIGNORE = "# squadrant KB defaults: source documents stay local\nraw/\n.converted/\n";
+    legacyOverlay = (cfg, project) => path23.join(resolveHome(cfg.projects[project].spokeVault), "knowledge", "rules");
   }
-  while (out.length && out[out.length - 1] === " ") {
-    out.pop();
-    map2.pop();
+});
+
+// packages/core/dist/knowledge/errata.js
+import fs23 from "fs";
+import path24 from "path";
+function loadErrata(kbRoot) {
+  const file = path24.join(kbRoot, "errata.yaml");
+  if (!fs23.existsSync(file))
+    return { errata: [], errors: [] };
+  let data;
+  try {
+    data = yaml.load(fs23.readFileSync(file, "utf8"), { schema: yaml.JSON_SCHEMA });
+  } catch (e) {
+    return { errata: [], errors: [`YAML parse error: ${e.message.split("\n")[0]}`] };
   }
-  return { text: out.join(""), map: map2 };
+  if (data == null)
+    return { errata: [], errors: [] };
+  if (!Array.isArray(data))
+    return { errata: [], errors: ["errata.yaml must be a YAML list of entries"] };
+  const errata = [];
+  const errors = [];
+  data.forEach((entry, i) => {
+    const problems = validateErratum(entry);
+    if (problems.length)
+      errors.push(...problems.map((p) => `entry ${i}: ${p}`));
+    else
+      errata.push(entry);
+  });
+  return { errata, errors };
 }
-function findQuote(source, quote) {
-  const needle = normalizeText(quote);
-  if (!needle)
-    return null;
-  const views = typeof source === "string" ? normalizedViews(source) : source;
-  for (const hay of views) {
-    const at = hay.text.indexOf(needle);
-    if (at >= 0)
-      return [hay.map[at], hay.map[at + needle.length - 1] + 1];
+function orphanedErrata(kbRoot, errata, refs) {
+  const only = refs ? new Set(refs) : void 0;
+  const hays = /* @__PURE__ */ new Map();
+  const out = [];
+  for (const e of errata) {
+    if (only && !only.has(e.ref))
+      continue;
+    if (!hays.has(e.ref)) {
+      const conv = readState2(kbRoot, e.ref) ? convertedFile(kbRoot, e.ref) : null;
+      hays.set(e.ref, conv && fs23.existsSync(conv) ? normalizedViews(fs23.readFileSync(conv, "utf8")) : null);
+    }
+    const hay = hays.get(e.ref);
+    if (hay && !findQuote(hay, e.quote))
+      out.push({ id: e.id, ref: e.ref });
   }
-  return null;
+  return out;
 }
-var LIGATURES, QUOTES, DASHES, normalizeText, normalizedViews, DOCLING_DROP_THRESHOLD, needsDocling, spansOverlap;
-var init_verify = __esm({
-  "packages/core/dist/knowledge/verify.js"() {
-    LIGATURES = { "\uFB01": "fi", "\uFB02": "fl", "\uFB00": "ff", "\uFB03": "ffi", "\uFB04": "ffl", "\uFB05": "st", "\uFB06": "st" };
-    QUOTES = { "\u2018": "'", "\u2019": "'", "\u201A": "'", "\u201B": "'", "\u201C": '"', "\u201D": '"', "\u201E": '"', "\u201F": '"' };
-    DASHES = /* @__PURE__ */ new Set(["\u2010", "\u2011", "\u2012", "\u2013", "\u2014", "\u2015", "\u2212"]);
-    normalizeText = (s) => normalizeWithMap(s).text;
-    normalizedViews = (src) => [normalizeWithMap(src), normalizeWithMap(src, true)];
-    DOCLING_DROP_THRESHOLD = 0.2;
-    needsDocling = (dropped, total) => total > 0 && dropped / total > DOCLING_DROP_THRESHOLD;
-    spansOverlap = (a, b) => a[0] < b[1] && b[0] < a[1];
+var init_errata = __esm({
+  "packages/core/dist/knowledge/errata.js"() {
+    init_js_yaml();
+    init_dist();
+    init_ingest();
+    init_verify();
   }
 });
 
 // packages/core/dist/knowledge/anchor.js
-import fs23 from "fs";
-import path24 from "path";
+import fs24 from "fs";
+import path25 from "path";
 function* repoFiles(root) {
   let count = 0;
   const stack = [root];
@@ -14442,43 +14616,43 @@ function* repoFiles(root) {
     const dir = stack.pop();
     let ents;
     try {
-      ents = fs23.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name < b.name ? 1 : -1);
+      ents = fs24.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name < b.name ? 1 : -1);
     } catch {
       continue;
     }
     for (const ent of ents) {
       if (ent.isDirectory()) {
         if (!SKIP_DIRS.has(ent.name))
-          stack.push(path24.join(dir, ent.name));
-      } else if (ent.isFile() && CODE_EXT.has(path24.extname(ent.name))) {
+          stack.push(path25.join(dir, ent.name));
+      } else if (ent.isFile() && CODE_EXT.has(path25.extname(ent.name))) {
         if (++count > MAX_FILES)
           return;
-        yield path24.join(dir, ent.name);
+        yield path25.join(dir, ent.name);
       }
     }
   }
 }
 function computeAnchor(repoRoot, triggers) {
   const terms2 = anchorTerms(triggers);
-  if (!terms2.length || !fs23.existsSync(repoRoot))
+  if (!terms2.length || !fs24.existsSync(repoRoot))
     return null;
   const hits = [];
   for (const file of repoFiles(repoRoot)) {
     let text;
     try {
-      if (fs23.statSync(file).size > MAX_FILE_BYTES)
+      if (fs24.statSync(file).size > MAX_FILE_BYTES)
         continue;
-      text = fs23.readFileSync(file, "utf8");
+      text = fs24.readFileSync(file, "utf8");
     } catch {
       continue;
     }
-    const hay = `${path24.relative(repoRoot, file)}
+    const hay = `${path25.relative(repoRoot, file)}
 ${text}`.toLowerCase();
     const score = terms2.filter((t) => hay.includes(t)).length;
     if (!score)
       continue;
     const symbols2 = [...text.matchAll(SYMBOL_RE)].map((m) => m[1]).filter((s) => terms2.some((t) => s.toLowerCase().includes(t)));
-    hits.push({ rel: path24.relative(repoRoot, file).split(path24.sep).join("/"), score, symbols: symbols2 });
+    hits.push({ rel: path25.relative(repoRoot, file).split(path25.sep).join("/"), score, symbols: symbols2 });
   }
   if (!hits.length)
     return null;
@@ -14502,11 +14676,11 @@ var init_anchor = __esm({
 });
 
 // packages/core/dist/knowledge/extract.js
-import fs24 from "fs";
-import path25 from "path";
-import matter3 from "gray-matter";
+import fs25 from "fs";
+import path26 from "path";
+import matter4 from "gray-matter";
 function serialize(fm, body) {
-  return matter3.stringify(body.trim() + "\n", clean(fm));
+  return matter4.stringify(body.trim() + "\n", clean(fm));
 }
 function validateCandidate(c) {
   const p = [];
@@ -14549,9 +14723,9 @@ function upsertSource(fm, src) {
 }
 function applyCandidates(input, opts) {
   const { kb, kbRoot, rulesDir } = opts;
-  const res = { created: [], merged: [], proposed: [], superseded: [], stale: [], rejected: [], doclingFlags: [], idOverrides: [] };
+  const res = { created: [], merged: [], proposed: [], superseded: [], stale: [], rejected: [], doclingFlags: [], idOverrides: [], orphanedErrata: [] };
   const events = [];
-  const ev2 = (event, itemId, domain, extra = {}) => events.push({ kb, level: "group", project: "", domain, itemId, event, ...extra });
+  const ev2 = (event, itemId, extra = {}) => events.push({ kb, level: "group", project: "", domain: "rules", itemId, event, ...extra });
   const loaded = loadRulesDir(rulesDir, `kb:${kb}`);
   const work = /* @__PURE__ */ new Map();
   for (const r of loaded.rules) {
@@ -14570,13 +14744,13 @@ function applyCandidates(input, opts) {
     }
     const st = readState2(kbRoot, cand.source);
     const convFile = st ? convertedFile(kbRoot, cand.source) : null;
-    if (!st || !fs24.existsSync(convFile)) {
+    if (!st || !fs25.existsSync(convFile)) {
       res.rejected.push({ id: cand.id, source: cand.source, reason: "unknown source (not ingested)" });
       continue;
     }
     let hay = norm.get(cand.source);
     if (!hay) {
-      hay = normalizedViews(fs24.readFileSync(convFile, "utf8"));
+      hay = normalizedViews(fs25.readFileSync(convFile, "utf8"));
       norm.set(cand.source, hay);
     }
     const tot = totals.get(cand.source) ?? { total: 0, dropped: 0 };
@@ -14586,7 +14760,14 @@ function applyCandidates(input, opts) {
     if (!offset) {
       tot.dropped++;
       res.rejected.push({ id: cand.id, source: cand.source, reason: "ungrounded" });
-      ev2("item.rejected", cand.id, cand.domain, { reason: "ungrounded" });
+      ev2("item.rejected", cand.id, { reason: "ungrounded" });
+      continue;
+    }
+    const hit = (opts.errata ?? []).find((e) => e.ref === cand.source && ((o) => !!o && spansOverlap(o, offset))(findQuote(hay, e.quote)));
+    if (hit) {
+      tot.total--;
+      res.rejected.push({ id: cand.id, source: cand.source, reason: `errata:${hit.id}` });
+      ev2("item.rejected", cand.id, { reason: `errata:${hit.id}` });
       continue;
     }
     let id = cand.id;
@@ -14618,7 +14799,7 @@ ${cand.rationale.trim()}` : "");
       }
       continue;
     }
-    if (!target && contradicted.length === 0) {
+    if (!target && contradicted.length === 0 && !isGatedRef(kbRoot, opts.sources ?? [], cand.source)) {
       const fm2 = {
         id,
         domain: cand.domain,
@@ -14631,9 +14812,9 @@ ${cand.rationale.trim()}` : "");
         supersedes: [],
         conflictsWith: []
       };
-      work.set(id, { fm: fm2, body: bodyOf(), file: path25.join(rulesDir, cand.domain, `${id}.md`), dirty: true, isNew: true });
+      work.set(id, { fm: fm2, body: bodyOf(), file: path26.join(rulesDir, cand.domain, `${id}.md`), dirty: true, isNew: true });
       res.created.push(id);
-      ev2("item.applied", id, cand.domain);
+      ev2("item.applied", id);
       continue;
     }
     const fm = {
@@ -14648,26 +14829,26 @@ ${cand.rationale.trim()}` : "");
       supersedes: [],
       conflictsWith: contradicted
     };
-    const dir = path25.join(rulesDir, PROPOSED_DIR);
-    const file = path25.join(dir, `${id}@${st.sha.slice(0, SHA_LEN)}.md`);
+    const dir = path26.join(rulesDir, PROPOSED_DIR);
+    const file = path26.join(dir, `${id}@${st.sha.slice(0, SHA_LEN)}.md`);
     const text = serialize(fm, bodyOf());
-    if (fs24.existsSync(file) && fs24.readFileSync(file, "utf8") === text)
+    if (fs25.existsSync(file) && fs25.readFileSync(file, "utf8") === text)
       continue;
-    fs24.mkdirSync(dir, { recursive: true });
-    for (const other of fs24.readdirSync(dir)) {
-      if (!other.startsWith(`${id}@`) || !other.endsWith(".md") || path25.join(dir, other) === file)
+    fs25.mkdirSync(dir, { recursive: true });
+    for (const other of fs25.readdirSync(dir)) {
+      if (!other.startsWith(`${id}@`) || !other.endsWith(".md") || path26.join(dir, other) === file)
         continue;
-      const old = matter3(fs24.readFileSync(path25.join(dir, other), "utf8"));
+      const old = matter4(fs25.readFileSync(path26.join(dir, other), "utf8"));
       if (!old.data.sources?.some((s) => s.ref === cand.source))
         continue;
-      fs24.writeFileSync(path25.join(dir, other.replace(/\.md$/, ".superseded")), matter3.stringify(old.content, { ...old.data, supersededBy: path25.basename(file) }));
-      fs24.rmSync(path25.join(dir, other));
+      fs25.writeFileSync(path26.join(dir, other.replace(/\.md$/, ".superseded")), matter4.stringify(old.content, { ...old.data, supersededBy: path26.basename(file) }));
+      fs25.rmSync(path26.join(dir, other));
       res.superseded.push(other.replace(/\.md$/, ""));
-      ev2("item.superseded", id, fm.domain);
+      ev2("item.superseded", id);
     }
-    fs24.writeFileSync(file, text);
+    fs25.writeFileSync(file, text);
     res.proposed.push(`${id}@${st.sha.slice(0, SHA_LEN)}`);
-    ev2("item.proposed", id, fm.domain);
+    ev2("item.proposed", id);
   }
   for (const [id, w] of work) {
     if (touched.has(id) || w.fm.status !== "active" || w.isNew)
@@ -14693,11 +14874,12 @@ ${cand.rationale.trim()}` : "");
   for (const w of work.values()) {
     if (!w.dirty)
       continue;
-    fs24.mkdirSync(path25.dirname(w.file), { recursive: true });
+    fs25.mkdirSync(path26.dirname(w.file), { recursive: true });
     const text = serialize(w.fm, w.body);
-    if (!fs24.existsSync(w.file) || fs24.readFileSync(w.file, "utf8") !== text)
-      fs24.writeFileSync(w.file, text);
+    if (!fs25.existsSync(w.file) || fs25.readFileSync(w.file, "utf8") !== text)
+      fs25.writeFileSync(w.file, text);
   }
+  res.orphanedErrata = orphanedErrata(kbRoot, opts.errata ?? [], totals.keys());
   for (const [ref, t] of totals)
     if (needsDocling(t.dropped, t.total))
       res.doclingFlags.push({ ref, ...t });
@@ -14714,6 +14896,7 @@ var init_extract = __esm({
     init_anchor();
     init_index_file();
     init_ingest();
+    init_errata();
     init_paths();
     init_store2();
     init_verify();
@@ -14730,20 +14913,20 @@ var init_extract = __esm({
 });
 
 // packages/core/dist/knowledge/schedule.js
-import fs25 from "fs";
-import path26 from "path";
+import fs26 from "fs";
+import path27 from "path";
 function readSchedule(stateRoot) {
   try {
-    return JSON.parse(fs25.readFileSync(scheduleFile(stateRoot), "utf8"));
+    return JSON.parse(fs26.readFileSync(scheduleFile(stateRoot), "utf8"));
   } catch {
     return {};
   }
 }
 function writeSchedule(stateRoot, s) {
-  fs25.mkdirSync(stateRoot, { recursive: true });
+  fs26.mkdirSync(stateRoot, { recursive: true });
   const tmp = `${scheduleFile(stateRoot)}.${process.pid}.tmp`;
-  fs25.writeFileSync(tmp, JSON.stringify(s, null, 2) + "\n");
-  fs25.renameSync(tmp, scheduleFile(stateRoot));
+  fs26.writeFileSync(tmp, JSON.stringify(s, null, 2) + "\n");
+  fs26.renameSync(tmp, scheduleFile(stateRoot));
 }
 function snapshotSources(kbRoot, sources) {
   const out = {};
@@ -14823,7 +15006,7 @@ async function tickKnowledgeSchedule(d) {
       continue;
     try {
       const root = kbDir(d.cfg, kb);
-      if (!fs25.existsSync(root))
+      if (!fs26.existsSync(root))
         continue;
       const { sources } = loadSources(root);
       if (!sources.length)
@@ -14888,7 +15071,7 @@ var init_schedule = __esm({
     init_sources();
     RUNNING_STALE_MS = 6 * 60 * 60 * 1e3;
     DAY_MS = 24 * 60 * 60 * 1e3;
-    scheduleFile = (stateRoot) => path26.join(stateRoot, "knowledge-schedule.json");
+    scheduleFile = (stateRoot) => path27.join(stateRoot, "knowledge-schedule.json");
     reconcileConfig = (cfg, kb) => ({ ...DEFAULT_RECONCILE, ...kbConfigs(cfg)[kb]?.reconcile });
   }
 });
@@ -14896,19 +15079,19 @@ var init_schedule = __esm({
 // packages/core/dist/knowledge/review.js
 import crypto4 from "crypto";
 import { execFileSync as execFileSync7 } from "child_process";
-import fs26 from "fs";
-import path27 from "path";
-import matter4 from "gray-matter";
+import fs27 from "fs";
+import path28 from "path";
+import matter5 from "gray-matter";
 function readEscalations(kbRoot) {
   try {
-    return JSON.parse(fs26.readFileSync(escalationsFile(kbRoot), "utf8")).items;
+    return JSON.parse(fs27.readFileSync(escalationsFile(kbRoot), "utf8")).items;
   } catch {
     return [];
   }
 }
 function writeEscalations(kbRoot, items) {
-  fs26.mkdirSync(kbRoot, { recursive: true });
-  fs26.writeFileSync(escalationsFile(kbRoot), JSON.stringify({ items }, null, 2) + "\n");
+  fs27.mkdirSync(kbRoot, { recursive: true });
+  fs27.writeFileSync(escalationsFile(kbRoot), JSON.stringify({ items }, null, 2) + "\n");
 }
 function addEscalation(kbRoot, e) {
   const items = readEscalations(kbRoot);
@@ -14918,8 +15101,8 @@ function addEscalation(kbRoot, e) {
   return true;
 }
 function appendVerdict(kbRoot, v2, now) {
-  fs26.mkdirSync(kbRoot, { recursive: true });
-  fs26.appendFileSync(verdictsFile(kbRoot), JSON.stringify({ ts: now.toISOString(), ...v2 }) + "\n");
+  fs27.mkdirSync(kbRoot, { recursive: true });
+  fs27.appendFileSync(verdictsFile(kbRoot), JSON.stringify({ ts: now.toISOString(), ...v2 }) + "\n");
 }
 function priorityOfRef(c, ref) {
   if (ref.startsWith("agent:"))
@@ -14940,20 +15123,20 @@ function loadProposals(c) {
   const byId = new Map(live.map((r) => [r.id, r]));
   const proposals = [];
   const pdirs = /* @__PURE__ */ new Set();
-  for (const f of fs26.existsSync(dir) ? walkDirs(dir) : [])
-    if (path27.basename(f) === PROPOSED_DIR)
+  for (const f of fs27.existsSync(dir) ? walkDirs(dir) : [])
+    if (path28.basename(f) === PROPOSED_DIR)
       pdirs.add(f);
   for (const pd of pdirs) {
     for (const rule2 of loadRulesDir(pd, `kb:${c.kb}`, { includeProposed: true }).rules) {
-      proposals.push({ key: path27.basename(rule2.file).replace(/\.md$/, ""), rule: rule2, live: byId.get(rule2.id) });
+      proposals.push({ key: path28.basename(rule2.file).replace(/\.md$/, ""), rule: rule2, live: byId.get(rule2.id) });
     }
   }
   return { proposals, live };
 }
 function walkDirs(dir, out = []) {
-  for (const e of fs26.readdirSync(dir, { withFileTypes: true }))
+  for (const e of fs27.readdirSync(dir, { withFileTypes: true }))
     if (e.isDirectory()) {
-      const f = path27.join(dir, e.name);
+      const f = path28.join(dir, e.name);
       out.push(f);
       walkDirs(f, out);
     }
@@ -14982,9 +15165,9 @@ function promoteProposal(c, p, by, justification, events) {
       continue;
     const o = readFm(other.file);
     o.fm.status = "retired";
-    fs26.writeFileSync(other.file, fileText(o.fm, o.body));
+    fs27.writeFileSync(other.file, fileText(o.fm, o.body));
     retired.push(id);
-    events.push(ev(c, "item.superseded", id, o.fm.domain));
+    events.push(ev(c, "item.superseded", id));
   }
   const next = { ...fm, status: "active", approvedBy: by, justification, supersedes: [.../* @__PURE__ */ new Set([...fm.supersedes ?? [], ...retired])], conflictsWith: [] };
   if (p.live?.decision)
@@ -14992,17 +15175,17 @@ function promoteProposal(c, p, by, justification, events) {
   const anchors = anchorsFor(c, { ...next, anchors: p.live?.anchors ?? fm.anchors });
   if (anchors)
     next.anchors = anchors;
-  const target = p.live?.file ?? path27.join(dir, next.domain, `${next.id}.md`);
-  fs26.mkdirSync(path27.dirname(target), { recursive: true });
-  fs26.writeFileSync(target, fileText(next, body));
-  fs26.rmSync(p.rule.file);
-  events.push(ev(c, "item.approved", next.id, next.domain), ev(c, "item.applied", next.id, next.domain));
+  const target = p.live?.file ?? path28.join(dir, next.domain, `${next.id}.md`);
+  fs27.mkdirSync(path28.dirname(target), { recursive: true });
+  fs27.writeFileSync(target, fileText(next, body));
+  fs27.rmSync(p.rule.file);
+  events.push(ev(c, "item.approved", next.id), ev(c, "item.applied", next.id));
   if (p.live)
-    events.push(ev(c, "item.superseded", next.id, next.domain));
+    events.push(ev(c, "item.superseded", next.id));
 }
 function dropProposal(c, p, events) {
-  fs26.rmSync(p.rule.file);
-  events.push(ev(c, "item.rejected", p.rule.id, p.rule.domain, { reason: "reviewer" }));
+  fs27.rmSync(p.rule.file);
+  events.push(ev(c, "item.rejected", p.rule.id, { reason: "reviewer" }));
 }
 function mergeInto(c, p, targetId, live, events) {
   const t = live.find((r) => r.id === targetId);
@@ -15012,9 +15195,9 @@ function mergeInto(c, p, targetId, live, events) {
   for (const s of p.rule.sources)
     if (!tf.fm.sources.some((x) => x.ref === s.ref))
       tf.fm.sources.push(s);
-  fs26.writeFileSync(t.file, fileText(tf.fm, tf.body));
-  fs26.rmSync(p.rule.file);
-  events.push(ev(c, "item.superseded", p.rule.id, p.rule.domain), ev(c, "item.applied", targetId, t.domain));
+  fs27.writeFileSync(t.file, fileText(tf.fm, tf.body));
+  fs27.rmSync(p.rule.file);
+  events.push(ev(c, "item.superseded", p.rule.id), ev(c, "item.applied", targetId));
   return true;
 }
 function evaluateCodeConflict(c, rule2, cc) {
@@ -15088,14 +15271,15 @@ function applyDecisions(file, c) {
         f.fm.status = "active";
         if (d.loc && f.fm.sources[0])
           f.fm.sources[0].loc = d.loc;
-        if (conf >= threshold && !d.flag && !reasons.length) {
-          fs26.writeFileSync(rule2.file, fileText(f.fm, f.body));
+        const noSource = !rule2.sources.length;
+        if (conf >= threshold && !d.flag && !reasons.length && !noSource) {
+          fs27.writeFileSync(rule2.file, fileText(f.fm, f.body));
           res.applied.push(d.item);
-          events.push(ev(c, "item.applied", rule2.id, rule2.domain));
+          events.push(ev(c, "item.applied", rule2.id));
           verdict(d, "applied", { confidence: conf });
           continue;
         }
-        reasons.push(conf < threshold ? "low-confidence" : "reviewer-flagged");
+        reasons.push(noSource ? "no-source" : conf < threshold ? "low-confidence" : "reviewer-flagged");
       } else if (d.decision === "approve") {
         if (strong(rule2.modality))
           reasons.push("retiring must/must-not");
@@ -15106,9 +15290,9 @@ function applyDecisions(file, c) {
         if (!reasons.length) {
           const f = readFm(rule2.file);
           f.fm.status = "retired";
-          fs26.writeFileSync(rule2.file, fileText(f.fm, f.body));
+          fs27.writeFileSync(rule2.file, fileText(f.fm, f.body));
           res.applied.push(d.item);
-          events.push(ev(c, "item.archived", rule2.id, rule2.domain));
+          events.push(ev(c, "item.archived", rule2.id));
           verdict(d, "applied", { confidence: conf });
           continue;
         }
@@ -15123,6 +15307,8 @@ function applyDecisions(file, c) {
       reasons.push("reviewer-flagged");
     if (conf < threshold)
       reasons.push("low-confidence");
+    if (p.rule.sources.some((s) => isGatedRef(kbRoot, c.sources, s.ref)))
+      reasons.push("review-required");
     if (d.decision === "approve") {
       const myPri = priorityOfRule(c, p.rule);
       const conflicted = (p.rule.conflictsWith ?? []).map((id) => live.find((r) => r.id === id)).filter((r) => !!r);
@@ -15184,7 +15370,7 @@ function applyPair(pd, c, res, threshold, events, kbRoot, now) {
     for (const [x, y] of [[a, b], [b, a]]) {
       const f = readFm(x.file);
       f.fm.conflictsWith = [.../* @__PURE__ */ new Set([...f.fm.conflictsWith ?? [], y.id])];
-      fs26.writeFileSync(x.file, fileText(f.fm, f.body));
+      fs27.writeFileSync(x.file, fileText(f.fm, f.body));
     }
     return;
   }
@@ -15199,11 +15385,11 @@ function applyPair(pd, c, res, threshold, events, kbRoot, now) {
     if (!kf.fm.sources.some((x) => x.ref === s.ref))
       kf.fm.sources.push(s);
   kf.fm.supersedes = [.../* @__PURE__ */ new Set([...kf.fm.supersedes ?? [], drop.id])];
-  fs26.writeFileSync(keep.file, fileText(kf.fm, kf.body));
+  fs27.writeFileSync(keep.file, fileText(kf.fm, kf.body));
   const df = readFm(drop.file);
   df.fm.status = "retired";
-  fs26.writeFileSync(drop.file, fileText(df.fm, df.body));
-  events.push(ev(c, "item.superseded", drop.id, drop.domain), ev(c, "item.applied", keep.id, keep.domain));
+  fs27.writeFileSync(drop.file, fileText(df.fm, df.body));
+  events.push(ev(c, "item.superseded", drop.id), ev(c, "item.applied", keep.id));
   res.applied.push(key);
 }
 function resolveEscalation(c, key, r, by, reason) {
@@ -15233,9 +15419,9 @@ function resolveEscalation(c, key, r, by, reason) {
     f.fm.decision = decision;
     if (r.verdict === "supersede-with-code") {
       f.fm.status = "retired";
-      events.push(ev(c, "item.superseded", rule2.id, rule2.domain));
+      events.push(ev(c, "item.superseded", rule2.id));
     }
-    fs26.writeFileSync(rule2.file, fileText(f.fm, f.body));
+    fs27.writeFileSync(rule2.file, fileText(f.fm, f.body));
     return done(`${rule2.id}: ${r.verdict}`);
   }
   if (esc2.kind === "proposal") {
@@ -15252,23 +15438,26 @@ function resolveEscalation(c, key, r, by, reason) {
   }
   if (esc2.kind === "stale-retire") {
     const rule2 = live.find((x) => x.id === esc2.ruleId);
+    if (rule2 && r.kind !== "approve" && !rule2.sources.length) {
+      throw new Error(`Rule ${rule2.id} has no source, so it cannot be kept active. Add a source to the rule (or re-extract it), or retire it with --approve.`);
+    }
     if (rule2) {
       const f = readFm(rule2.file);
       f.fm.status = r.kind === "approve" ? "retired" : "active";
-      fs26.writeFileSync(rule2.file, fileText(f.fm, f.body));
-      events.push(ev(c, r.kind === "approve" ? "item.archived" : "item.applied", rule2.id, rule2.domain));
+      fs27.writeFileSync(rule2.file, fileText(f.fm, f.body));
+      events.push(ev(c, r.kind === "approve" ? "item.archived" : "item.applied", rule2.id));
     }
     return done(`${esc2.ruleId}: ${r.kind === "approve" ? "retired" : "kept"}`);
   }
   if (esc2.kind === "override-base-changed") {
-    const ov = esc2.item && fs26.existsSync(esc2.item) ? esc2.item : void 0;
+    const ov = esc2.item && fs27.existsSync(esc2.item) ? esc2.item : void 0;
     if (ov) {
       if (r.kind === "reject")
-        fs26.rmSync(ov);
+        fs27.rmSync(ov);
       else {
         const f = readFm(ov);
         f.fm.overridesBase = esc2.evidence?.docRev;
-        fs26.writeFileSync(ov, fileText(f.fm, f.body));
+        fs27.writeFileSync(ov, fileText(f.fm, f.body));
       }
     }
     return done(`${esc2.ruleId}: override ${r.kind === "reject" ? "dropped" : "kept"}`);
@@ -15292,11 +15481,11 @@ ${o.evidence}`).digest("hex");
     supersedes: [],
     conflictsWith: []
   };
-  const dir = path27.join(kbRulesDir(c.cfg, c.kb), PROPOSED_DIR);
-  fs26.mkdirSync(dir, { recursive: true });
-  const file = path27.join(dir, `${id}@${sha.slice(0, SHA_LEN2)}.md`);
-  fs26.writeFileSync(file, fileText(fm, o.statement));
-  appendAudit([ev(c, "item.proposed", id, domain)], c.audit);
+  const dir = path28.join(kbRulesDir(c.cfg, c.kb), PROPOSED_DIR);
+  fs27.mkdirSync(dir, { recursive: true });
+  const file = path28.join(dir, `${id}@${sha.slice(0, SHA_LEN2)}.md`);
+  fs27.writeFileSync(file, fileText(fm, o.statement));
+  appendAudit([ev(c, "item.proposed", id)], c.audit);
   return file;
 }
 function buildReviewPacket(c) {
@@ -15336,8 +15525,8 @@ var init_review = __esm({
     PRIORITY_RANK = { company: 3, project: 2, agent: 1 };
     SHA_LEN2 = 12;
     strong = (m) => m === "must" || m === "must-not";
-    escalationsFile = (kbRoot) => path27.join(kbRoot, "escalations.json");
-    verdictsFile = (kbRoot) => path27.join(kbRoot, "verdicts.jsonl");
+    escalationsFile = (kbRoot) => path28.join(kbRoot, "escalations.json");
+    verdictsFile = (kbRoot) => path28.join(kbRoot, "verdicts.jsonl");
     needsYouCount = (kbRoot) => readEscalations(kbRoot).filter((e) => e.needsYou).length;
     git = (root, args) => execFileSync7("git", ["-C", root, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     realGit = {
@@ -15358,34 +15547,34 @@ var init_review = __esm({
       },
       docDate(file) {
         try {
-          const d = git(path27.dirname(file), ["log", "-1", "--format=%cI", "--", path27.basename(file)]);
+          const d = git(path28.dirname(file), ["log", "-1", "--format=%cI", "--", path28.basename(file)]);
           if (d)
             return d;
         } catch {
         }
         try {
-          return fs26.statSync(file).mtime.toISOString();
+          return fs27.statSync(file).mtime.toISOString();
         } catch {
           return null;
         }
       }
     };
     nowOf = (c) => c.now?.() ?? /* @__PURE__ */ new Date();
-    fileText = (fm, body) => matter4.stringify(body.trim() + "\n", JSON.parse(JSON.stringify(fm)));
+    fileText = (fm, body) => matter5.stringify(body.trim() + "\n", JSON.parse(JSON.stringify(fm)));
     readFm = (file) => {
-      const m = matter4(fs26.readFileSync(file, "utf8"));
+      const m = matter5(fs27.readFileSync(file, "utf8"));
       return { fm: m.data, body: m.content };
     };
-    ev = (c, event, itemId, domain, extra = {}) => ({ kb: c.kb, level: "group", project: "", domain, itemId, event, ...extra });
+    ev = (c, event, itemId, extra = {}) => ({ kb: c.kb, level: "group", project: "", domain: "rules", itemId, event, ...extra });
     docRevOf = (r) => r.sources.map((s) => `${s.ref}@${s.sha.slice(0, SHA_LEN2)}`).join(",");
   }
 });
 
 // packages/core/dist/knowledge/fullpass.js
 import crypto5 from "crypto";
-import fs27 from "fs";
-import path28 from "path";
-import matter5 from "gray-matter";
+import fs28 from "fs";
+import path29 from "path";
+import matter6 from "gray-matter";
 function dedupPairs(rules) {
   const active = rules.filter((r) => r.status === "active").sort((x, y) => x.id.localeCompare(y.id));
   const out = [];
@@ -15401,12 +15590,12 @@ function dedupPairs(rules) {
   return out.slice(0, MAX_DEDUP_PAIRS);
 }
 function readAuditRecords(kb, since, dir = defaultAuditDir()) {
-  if (!fs27.existsSync(dir))
+  if (!fs28.existsSync(dir))
     return [];
   const sinceMonth = since.toISOString().slice(0, 7);
   const out = [];
-  for (const f of fs27.readdirSync(dir).filter((n) => n.endsWith(".jsonl") && n.slice(0, 7) >= sinceMonth).sort()) {
-    for (const line2 of fs27.readFileSync(path28.join(dir, f), "utf8").split("\n")) {
+  for (const f of fs28.readdirSync(dir).filter((n) => n.endsWith(".jsonl") && n.slice(0, 7) >= sinceMonth).sort()) {
+    for (const line2 of fs28.readFileSync(path29.join(dir, f), "utf8").split("\n")) {
       if (!line2.trim())
         continue;
       try {
@@ -15469,8 +15658,8 @@ function checkOverrides(cfg, kb) {
         continue;
       const h = baseHash(b);
       if (!o.overridesBase) {
-        const m = matter5(fs27.readFileSync(o.file, "utf8"));
-        fs27.writeFileSync(o.file, matter5.stringify(m.content, { ...m.data, overridesBase: h }));
+        const m = matter6(fs28.readFileSync(o.file, "utf8"));
+        fs28.writeFileSync(o.file, matter6.stringify(m.content, { ...m.data, overridesBase: h }));
         continue;
       }
       out.push({ project, ruleId: o.id, file: o.file, baseHash: h, changed: o.overridesBase !== h });
@@ -15513,8 +15702,8 @@ var init_fullpass = __esm({
 });
 
 // packages/core/dist/knowledge/scores.js
-import fs28 from "fs";
-import path29 from "path";
+import fs29 from "fs";
+import path30 from "path";
 function tally(records, into = emptyTally()) {
   for (const e of records) {
     const domain = typeof e.domain === "string" && e.domain ? e.domain : "rules";
@@ -15523,7 +15712,7 @@ function tally(records, into = emptyTally()) {
       d.writes++;
     if (READ_EVENTS.has(e.event ?? ""))
       d.reads++;
-    if (!e.itemId)
+    if (!e.itemId || WRITE_EVENTS.has(e.event ?? ""))
       continue;
     const c = into.items[`${domain}|${e.itemId}`] ??= { ...zero(), domain, itemId: e.itemId };
     switch (e.event) {
@@ -15560,7 +15749,7 @@ function tally(records, into = emptyTally()) {
 }
 function parseLines(file) {
   const out = [];
-  for (const line2 of fs28.readFileSync(file, "utf8").split("\n")) {
+  for (const line2 of fs29.readFileSync(file, "utf8").split("\n")) {
     if (!line2.trim())
       continue;
     try {
@@ -15572,37 +15761,37 @@ function parseLines(file) {
 }
 function compactAudit(o) {
   const dir = o.dir ?? defaultAuditDir();
-  if (!fs28.existsSync(dir))
+  if (!fs29.existsSync(dir))
     return [];
   const cutoffMonth = new Date(o.now.getTime() - SCORE_WINDOW_DAYS * DAY_MS3).toISOString().slice(0, 7);
   const done = [];
-  for (const f of fs28.readdirSync(dir).sort()) {
+  for (const f of fs29.readdirSync(dir).sort()) {
     const m = MONTH_FILE_RE.exec(f);
     if (!m || m[1] >= cutoffMonth)
       continue;
     const [, month, machine] = m;
     const byKb = /* @__PURE__ */ new Map();
-    for (const r of parseLines(path29.join(dir, f)))
+    for (const r of parseLines(path30.join(dir, f)))
       byKb.set(r.kb ?? "", [...byKb.get(r.kb ?? "") ?? [], r]);
-    const statsPath = path29.join(dir, statsFileName(month, machine));
-    const prior = fs28.existsSync(statsPath) ? JSON.parse(fs28.readFileSync(statsPath, "utf8")) : null;
+    const statsPath = path30.join(dir, statsFileName(month, machine));
+    const prior = fs29.existsSync(statsPath) ? JSON.parse(fs29.readFileSync(statsPath, "utf8")) : null;
     const kbs = prior?.kbs ?? {};
     for (const [kb, recs] of byKb)
       kbs[kb] = tally(recs, kbs[kb]);
-    fs28.writeFileSync(`${statsPath}.tmp`, JSON.stringify({ month, machine, kbs }));
-    fs28.renameSync(`${statsPath}.tmp`, statsPath);
-    fs28.unlinkSync(path29.join(dir, f));
+    fs29.writeFileSync(`${statsPath}.tmp`, JSON.stringify({ month, machine, kbs }));
+    fs29.renameSync(`${statsPath}.tmp`, statsPath);
+    fs29.unlinkSync(path30.join(dir, f));
     done.push(month);
   }
   return done;
 }
 function readCompacted(kb, dir) {
   const t = emptyTally();
-  if (!fs28.existsSync(dir))
+  if (!fs29.existsSync(dir))
     return t;
-  for (const f of fs28.readdirSync(dir).filter((n) => n.endsWith(".stats.json"))) {
+  for (const f of fs29.readdirSync(dir).filter((n) => n.endsWith(".stats.json"))) {
     try {
-      const k = JSON.parse(fs28.readFileSync(path29.join(dir, f), "utf8")).kbs[kb];
+      const k = JSON.parse(fs29.readFileSync(path30.join(dir, f), "utf8")).kbs[kb];
       if (k)
         mergeTally(t, k);
     } catch {
@@ -15652,7 +15841,7 @@ function computeScores(i) {
       noise: w.noise,
       wrong: w.wrong,
       fireRate: w.surfaced,
-      pullRate: w.shown,
+      pullRate: w.shown + w.searched,
       useRate: ratio(w.cited, w.surfaced),
       noiseRate: ratio(w.noise, w.surfaced),
       violationRate: ratio(w.violated, w.surfaced),
@@ -15694,21 +15883,21 @@ function computeScores(i) {
 function scoreKb(o) {
   const dir = o.auditDir ?? defaultAuditDir();
   const records = [];
-  if (fs28.existsSync(dir)) {
-    for (const f of fs28.readdirSync(dir).filter((n) => MONTH_FILE_RE.test(n)).sort()) {
-      records.push(...parseLines(path29.join(dir, f)).filter((r) => r.kb === o.kb));
+  if (fs29.existsSync(dir)) {
+    for (const f of fs29.readdirSync(dir).filter((n) => MONTH_FILE_RE.test(n)).sort()) {
+      records.push(...parseLines(path30.join(dir, f)).filter((r) => r.kb === o.kb));
     }
   }
   let verdicts = [];
   try {
-    verdicts = fs28.readFileSync(path29.join(o.kbRoot, "verdicts.jsonl"), "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l));
+    verdicts = fs29.readFileSync(path30.join(o.kbRoot, "verdicts.jsonl"), "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l));
   } catch {
   }
   return computeScores({ kb: o.kb, records, now: o.now, known: o.known, compacted: readCompacted(o.kb, dir), verdicts });
 }
 function writeScores(kbRoot, s) {
-  fs28.mkdirSync(kbRoot, { recursive: true });
-  fs28.writeFileSync(scoresFile(kbRoot), JSON.stringify(s, null, 2) + "\n");
+  fs29.mkdirSync(kbRoot, { recursive: true });
+  fs29.writeFileSync(scoresFile(kbRoot), JSON.stringify(s, null, 2) + "\n");
 }
 function renderScoresSection(s) {
   const pct = (x) => x === null ? "n/a" : `${Math.round(x * 100)}%`;
@@ -15721,7 +15910,7 @@ function renderScoresSection(s) {
     ...used.length ? [
       "| Item | Surfaced | Pulled | Cited | Use | Noise | Violated |",
       "|---|---|---|---|---|---|---|",
-      ...used.map((x) => `| ${x.itemId} | ${x.surfaced} | ${x.shown} | ${x.cited} | ${pct(x.useRate)} | ${pct(x.noiseRate)} | ${pct(x.violationRate)} |`)
+      ...used.map((x) => `| ${x.itemId} | ${x.surfaced} | ${x.pullRate} | ${x.cited} | ${pct(x.useRate)} | ${pct(x.noiseRate)} | ${pct(x.violationRate)} |`)
     ] : ["No items surfaced."],
     "",
     `- Never fired (${never.length}): ${never.slice(0, 20).join(", ") || "none"}${never.length > 20 ? ", \u2026" : ""}`,
@@ -15749,13 +15938,13 @@ var init_scores = __esm({
     MONTH_FILE_RE = /^(\d{4}-\d{2})\.(.+)\.jsonl$/;
     statsFileName = (month, machine) => `${month}.${machine}.stats.json`;
     ratio = (n, d) => d ? Math.round(n / d * 1e3) / 1e3 : null;
-    scoresFile = (kbRoot) => path29.join(kbRoot, "scores.json");
+    scoresFile = (kbRoot) => path30.join(kbRoot, "scores.json");
   }
 });
 
 // packages/core/dist/knowledge/report.js
-import fs29 from "fs";
-import path30 from "path";
+import fs30 from "fs";
+import path31 from "path";
 function renderReport(cfg, kb, o) {
   const { rules } = loadKbRules(cfg, kb, { includeProposed: true });
   const count = (s) => rules.filter((r) => r.status === s).length;
@@ -15777,6 +15966,11 @@ function renderReport(cfg, kb, o) {
   const info = esc2.filter((e) => !e.needsYou);
   if (info.length)
     L.push("", `## For information (${info.length})`, "", ...info.map((e) => `- **${e.key}**: ${e.explanation}`));
+  const { errata, errors: errataErrors } = loadErrata(kbDir(cfg, kb));
+  const orphans = orphanedErrata(kbDir(cfg, kb), errata);
+  if (orphans.length || errataErrors.length) {
+    L.push("", `## Errata to re-check (${orphans.length + errataErrors.length})`, "", ...orphans.map((e) => `- **${e.id}** (${e.ref}): quote no longer found in the source; the raw file changed. Re-check it in errata.yaml.`), ...errataErrors.map((e) => `- errata.yaml: ${e}`));
+  }
   if (o.full) {
     const { usage: usage2, caps } = o.full;
     L.push("", "## Usage (30 days)", "", `- Surfaced: ${Object.values(usage2.surfaced).reduce((a, b) => a + b, 0)} times across ${Object.keys(usage2.surfaced).length} rules.`, `- Never surfaced (re-check triggers): ${usage2.neverSurfaced.join(", ") || "none"}`, `- Noisy (narrow triggers): ${usage2.noisy.join(", ") || "none"}`, `- Violation feedback (reword): ${usage2.violated.join(", ") || "none"}`, `- Domains over cap: ${caps.map((c) => `${c.domain} (${c.count}/${c.cap})`).join(", ") || "none"}`);
@@ -15786,12 +15980,13 @@ function renderReport(cfg, kb, o) {
   return L.join("\n") + "\n";
 }
 function writeReport(cfg, kb, o) {
-  const file = path30.join(kbDir(cfg, kb), "REPORT.md");
-  fs29.writeFileSync(file, renderReport(cfg, kb, o));
+  const file = path31.join(kbDir(cfg, kb), "REPORT.md");
+  fs30.writeFileSync(file, renderReport(cfg, kb, o));
   return file;
 }
 var init_report = __esm({
   "packages/core/dist/knowledge/report.js"() {
+    init_errata();
     init_layers();
     init_paths();
     init_review();
@@ -15835,44 +16030,63 @@ var init_reconcile = __esm({
 
 // packages/core/dist/knowledge/cite.js
 function scanAndLogCitations(i) {
-  const at = i.at ?? i.sink?.now?.() ?? /* @__PURE__ */ new Date();
-  const since = new Date(at.getTime() - (i.lookbackDays ?? CITE_LOOKBACK_DAYS) * DAY_MS4);
-  const dir = i.sink?.dir ?? defaultAuditDir();
-  const delivered = /* @__PURE__ */ new Map();
-  const already = /* @__PURE__ */ new Set();
-  for (const r of readAuditRecords(void 0, since, dir)) {
-    if (!r.itemId || r.project !== i.project)
-      continue;
-    if (r.event === "item.cited" && r.ref === i.ref)
-      already.add(r.itemId);
-    if (!(r.event === "item.surfaced" || r.event === "item.shown") || Date.parse(r.ts) > at.getTime())
-      continue;
-    if (i.session && r.session && r.session !== i.session)
-      continue;
-    delivered.set(r.itemId, r);
-  }
-  const hits = [...delivered].filter(([id]) => !already.has(id) && mentionsId(i.text, id));
-  appendAudit(hits.map(([itemId, r]) => ({
-    kb: String(r.kb ?? ""),
-    level: String(r.level ?? "project"),
-    project: i.project,
-    domain: String(r.domain ?? "rules"),
-    itemId,
-    event: "item.cited",
-    ref: i.ref,
-    ...i.agent ? { agent: i.agent } : {},
-    ...i.session ? { session: i.session } : {}
-  })), i.sink);
-  return hits.map(([id]) => id);
+  return scanCitations([i], i);
+}
+function scanCitations(texts, o) {
+  if (!texts.length)
+    return [];
+  const now = o.sink?.now?.() ?? /* @__PURE__ */ new Date();
+  const lookbackMs = (o.lookbackDays ?? CITE_LOOKBACK_DAYS) * DAY_MS4;
+  const ats = texts.map((t) => (t.at ?? now).getTime());
+  const records = readAuditRecords(void 0, new Date(Math.min(...ats) - lookbackMs), o.sink?.dir ?? defaultAuditDir()).filter((r) => r.itemId && r.project === o.project);
+  const already = new Set(records.filter((r) => r.event === "item.cited").map((r) => `${r.ref}|${r.itemId}`));
+  const deliveries = records.filter((r) => (r.event === "item.surfaced" || r.event === "item.shown" || r.event === "item.searched") && !(o.session && r.session && r.session !== o.session));
+  const events = [];
+  texts.forEach((t, n) => {
+    const at = ats[n];
+    const delivered = /* @__PURE__ */ new Map();
+    for (const r of deliveries) {
+      const ts = Date.parse(r.ts);
+      if (ts <= at && ts >= at - lookbackMs)
+        delivered.set(r.itemId, r);
+    }
+    for (const [itemId, r] of delivered) {
+      if (already.has(`${t.ref}|${itemId}`) || !mentionsId(t.text, itemId))
+        continue;
+      already.add(`${t.ref}|${itemId}`);
+      events.push({
+        kb: String(r.kb ?? ""),
+        level: String(r.level ?? "project"),
+        project: o.project,
+        domain: String(r.domain ?? "rules"),
+        itemId,
+        event: "item.cited",
+        ref: t.ref,
+        ...o.agent ? { agent: o.agent } : {},
+        ...o.session ? { session: o.session } : {}
+      });
+    }
+  });
+  appendAudit(events, o.sink);
+  return events.map((e) => e.itemId);
 }
 function readGitMessages(repo, since, run) {
-  const out = run(["-C", repo, "log", `--since=${since.toISOString()}`, "--format=%x1e%H%x1f%cI%x1f%B"]);
+  return parseLog(run(["-C", repo, "log", "--all", `--since=${since.toISOString()}`, LOG_FORMAT]));
+}
+function readBranchOnlyMessages(repo, run, max = 200) {
+  const branch = run(["-C", repo, "rev-parse", "--abbrev-ref", "HEAD"]).trim();
+  if (!branch)
+    return [];
+  const own = branch === "HEAD" ? [] : [`--exclude=${branch}`];
+  return parseLog(run(["-C", repo, "log", `--max-count=${max}`, "HEAD", "--not", ...own, "--branches", ...own.length ? [`--exclude=*/${branch}`] : [], "--remotes", LOG_FORMAT]));
+}
+function parseLog(out) {
   return out.split("").filter((c) => c.trim()).map((c) => {
     const [sha, at, ...rest] = c.split("");
     return { sha: sha.trim(), at: new Date(at), text: rest.join("") };
   });
 }
-var DAY_MS4, CITE_LOOKBACK_DAYS, escapeRe2, mentionsId;
+var DAY_MS4, CITE_LOOKBACK_DAYS, escapeRe2, mentionsId, LOG_FORMAT;
 var init_cite = __esm({
   "packages/core/dist/knowledge/cite.js"() {
     init_audit();
@@ -15881,6 +16095,7 @@ var init_cite = __esm({
     CITE_LOOKBACK_DAYS = 7;
     escapeRe2 = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     mentionsId = (text, id) => new RegExp(`(?<![\\w.-])${escapeRe2(id)}(?![\\w-])`).test(text);
+    LOG_FORMAT = "--format=%x1e%H%x1f%cI%x1f%B";
   }
 });
 
@@ -15898,6 +16113,7 @@ var init_knowledge2 = __esm({
     init_migrate();
     init_verify();
     init_ingest();
+    init_errata();
     init_anchor();
     init_extract();
     init_match();
@@ -15957,6 +16173,7 @@ __export(dist_exports2, {
   NOISY_RATE: () => NOISY_RATE,
   OPERATOR_INITIATED_COMMANDS: () => OPERATOR_INITIATED_COMMANDS,
   PANE_IDLE_AFTER_MS: () => PANE_IDLE_AFTER_MS,
+  PASS_THROUGH: () => PASS_THROUGH,
   PROBE_QUIET_MS: () => PROBE_QUIET_MS,
   PROMPT_MIN_SCORE: () => PROMPT_MIN_SCORE,
   PROMPT_RULE_CAP: () => PROMPT_RULE_CAP,
@@ -16096,6 +16313,7 @@ __export(dist_exports2, {
   encodeMsg: () => encodeMsg,
   ensureDaemon: () => ensureDaemon,
   ensureGitRepo: () => ensureGitRepo,
+  ensureKbGitignore: () => ensureKbGitignore,
   ensureSocksDir: () => ensureSocksDir,
   escalationsFile: () => escalationsFile,
   evaluateCodeConflict: () => evaluateCodeConflict,
@@ -16146,6 +16364,7 @@ __export(dist_exports2, {
   isDaemonSocketLive: () => isDaemonSocketLive,
   isGateCacheEnabled: () => isGateCacheEnabled,
   isGateSession: () => isGateSession,
+  isGatedRef: () => isGatedRef,
   isNotifyActive: () => isNotifyActive,
   isOperatorInitiatedCommand: () => isOperatorInitiatedCommand,
   isPendingProposalDup: () => isPendingProposalDup,
@@ -16163,6 +16382,7 @@ __export(dist_exports2, {
   launchOneWorkspace: () => launchOneWorkspace,
   legacyKbDir: () => legacyKbDir,
   listSessions: () => listSessions,
+  loadErrata: () => loadErrata,
   loadKbRules: () => loadKbRules,
   loadPending: () => loadPending,
   loadProposals: () => loadProposals,
@@ -16197,6 +16417,7 @@ __export(dist_exports2, {
   normalizedViews: () => normalizedViews,
   notePaneScreen: () => notePaneScreen,
   notifyToggle: () => notifyToggle,
+  orphanedErrata: () => orphanedErrata,
   parseBearer: () => parseBearer,
   parseClassifierVerdict: () => parseClassifierVerdict,
   parseCommand: () => parseCommand,
@@ -16221,6 +16442,7 @@ __export(dist_exports2, {
   pruneTopics: () => pruneTopics,
   purgeExpiredWorkItems: () => purgeExpiredWorkItems,
   readAuditRecords: () => readAuditRecords,
+  readBranchOnlyMessages: () => readBranchOnlyMessages,
   readCaptainAddress: () => readCaptainAddress,
   readCursor: () => readCursor,
   readEscalations: () => readEscalations,
@@ -16247,6 +16469,7 @@ __export(dist_exports2, {
   refFor: () => refFor,
   releaseDaemonLock: () => releaseDaemonLock,
   removeRunningMarker: () => removeRunningMarker,
+  removeSource: () => removeSource,
   renderEnvAssignments: () => renderEnvAssignments,
   renderPlist: () => renderPlist,
   renderReport: () => renderReport,
@@ -16309,6 +16532,7 @@ __export(dist_exports2, {
   saveSessions: () => saveSessions,
   saveState: () => saveState,
   scanAndLogCitations: () => scanAndLogCitations,
+  scanCitations: () => scanCitations,
   scheduleFile: () => scheduleFile,
   scoreKb: () => scoreKb,
   scoresFile: () => scoresFile,
@@ -16329,6 +16553,7 @@ __export(dist_exports2, {
   sideNextAutoName: () => sideNextAutoName,
   sideTitleFor: () => sideTitleFor,
   snapshotSources: () => snapshotSources,
+  sourceCovers: () => sourceCovers,
   spansOverlap: () => spansOverlap,
   splitSections: () => splitSections,
   splitStatement: () => splitStatement,
@@ -16424,7 +16649,7 @@ var init_dist2 = __esm({
 });
 
 // packages/agents/dist/claude/registry.js
-import fs30 from "fs";
+import fs31 from "fs";
 import { join as join17 } from "path";
 import { homedir as homedir7 } from "os";
 function parseRegistryDir(files, readFile7) {
@@ -16469,11 +16694,11 @@ function readClaudeStatus(task) {
     return void 0;
   let files;
   try {
-    files = fs30.readdirSync(CLAUDE_SESSIONS_DIR);
+    files = fs31.readdirSync(CLAUDE_SESSIONS_DIR);
   } catch {
     return void 0;
   }
-  const entries = parseRegistryDir(files, (name) => fs30.readFileSync(join17(CLAUDE_SESSIONS_DIR, name), "utf8"));
+  const entries = parseRegistryDir(files, (name) => fs31.readFileSync(join17(CLAUDE_SESSIONS_DIR, name), "utf8"));
   let entry;
   if (task.messagingSocketPath) {
     entry = entries.find((e) => e.messagingSocketPath === task.messagingSocketPath);
@@ -16488,11 +16713,11 @@ function readClaudeStatus(task) {
 function readClaudeStatusByCwd(cwd) {
   let files;
   try {
-    files = fs30.readdirSync(CLAUDE_SESSIONS_DIR);
+    files = fs31.readdirSync(CLAUDE_SESSIONS_DIR);
   } catch {
     return void 0;
   }
-  const entries = parseRegistryDir(files, (name) => fs30.readFileSync(join17(CLAUDE_SESSIONS_DIR, name), "utf8"));
+  const entries = parseRegistryDir(files, (name) => fs31.readFileSync(join17(CLAUDE_SESSIONS_DIR, name), "utf8"));
   const entry = entries.find((e) => e.cwd === cwd);
   if (!entry)
     return void 0;
@@ -16501,11 +16726,11 @@ function readClaudeStatusByCwd(cwd) {
 function readClaudeStatusBySocketPath(socketPath2) {
   let files;
   try {
-    files = fs30.readdirSync(CLAUDE_SESSIONS_DIR);
+    files = fs31.readdirSync(CLAUDE_SESSIONS_DIR);
   } catch {
     return void 0;
   }
-  const entries = parseRegistryDir(files, (name) => fs30.readFileSync(join17(CLAUDE_SESSIONS_DIR, name), "utf8"));
+  const entries = parseRegistryDir(files, (name) => fs31.readFileSync(join17(CLAUDE_SESSIONS_DIR, name), "utf8"));
   const entry = entries.find((e) => e.messagingSocketPath === socketPath2);
   if (!entry)
     return void 0;
@@ -16928,8 +17153,8 @@ var init_registry2 = __esm({
 });
 
 // packages/agents/dist/drivers/launch-cmd.js
-import fs31 from "fs";
-import path31 from "path";
+import fs32 from "fs";
+import path32 from "path";
 function buildAgentCmd(agentName, registry, role, fresh, permissionMode, model, templatesDir, messagingSocketPath, sessionName, thinking, captainBoot, settingsPath) {
   const driver = registry.getDriver(agentName);
   if (driver.name === "claude") {
@@ -16956,14 +17181,14 @@ function buildAgentCmd(agentName, registry, role, fresh, permissionMode, model,
       cmd += ` --settings ${settingsPath}`;
     }
     if (templatesDir) {
-      const roleFile2 = path31.join(templatesDir, `${role}.claude.md`);
-      const legacyRoleFile = path31.join(templatesDir, `${role}.CLAUDE.md`);
-      const actualRoleFile = fs31.existsSync(roleFile2) ? roleFile2 : fs31.existsSync(legacyRoleFile) ? legacyRoleFile : null;
+      const roleFile2 = path32.join(templatesDir, `${role}.claude.md`);
+      const legacyRoleFile = path32.join(templatesDir, `${role}.CLAUDE.md`);
+      const actualRoleFile = fs32.existsSync(roleFile2) ? roleFile2 : fs32.existsSync(legacyRoleFile) ? legacyRoleFile : null;
       if (actualRoleFile) {
         cmd += ` --append-system-prompt-file ${actualRoleFile}`;
       }
-      const pluginDir = path31.join(templatesDir, "..", "plugin");
-      if (fs31.existsSync(pluginDir)) {
+      const pluginDir = path32.join(templatesDir, "..", "plugin");
+      if (fs32.existsSync(pluginDir)) {
         cmd += ` --plugin-dir ${pluginDir}`;
       }
     }
@@ -16972,14 +17197,14 @@ function buildAgentCmd(agentName, registry, role, fresh, permissionMode, model,
     }
     return cmd;
   }
-  const roleFile = templatesDir ? path31.join(templatesDir, `${role}.${driver.templateSuffix}.md`) : void 0;
+  const roleFile = templatesDir ? path32.join(templatesDir, `${role}.${driver.templateSuffix}.md`) : void 0;
   return driver.buildCommand({
     prompt: `You are a squadrant ${role}. Read your instructions from ${roleFile ?? role} and begin.`,
     workdir: process.cwd(),
     role,
     model,
     autoApprove: true,
-    promptFile: roleFile && fs31.existsSync(roleFile) ? roleFile : void 0,
+    promptFile: roleFile && fs32.existsSync(roleFile) ? roleFile : void 0,
     ...captainBoot && role === "captain" ? {
       interactive: true,
       ...captainBoot.port ? { port: captainBoot.port } : {},
@@ -17009,7 +17234,7 @@ var init_drivers = __esm({
 
 // packages/agents/dist/projection/cursor.js
 import { mkdir, readFile, writeFile } from "fs/promises";
-import path32 from "path";
+import path33 from "path";
 import os10 from "os";
 function renderMdc(source) {
   const skillSections = source.skills.map((s) => `## Skill: ${s.name}
@@ -17058,7 +17283,7 @@ function createCursorEmitter() {
       if (scope === "user") {
         return [
           {
-            path: path32.join(os10.homedir(), ".cursor/rules/squadrant-global.mdc"),
+            path: path33.join(os10.homedir(), ".cursor/rules/squadrant-global.mdc"),
             shared: false,
             format: "mdc"
           }
@@ -17068,7 +17293,7 @@ function createCursorEmitter() {
         return [];
       return [
         {
-          path: path32.join(projectRoot, ".cursor/rules/squadrant.mdc"),
+          path: path33.join(projectRoot, ".cursor/rules/squadrant.mdc"),
           shared: false,
           format: "mdc"
         }
@@ -17085,7 +17310,7 @@ function createCursorEmitter() {
           diff: buildDiff(existing, generated)
         };
       }
-      await mkdir(path32.dirname(dest.path), { recursive: true });
+      await mkdir(path33.dirname(dest.path), { recursive: true });
       await writeFile(dest.path, generated, "utf-8");
       return {
         written: true,
@@ -17136,7 +17361,7 @@ var init_marker = __esm({
 
 // packages/agents/dist/projection/codex.js
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import path33 from "path";
+import path34 from "path";
 import os11 from "os";
 function renderMarkdown(source) {
   const skillSections = source.skills.map((s) => `## Skill: ${s.name}
@@ -17161,7 +17386,7 @@ function createCodexEmitter() {
     destinations(scope, projectRoot) {
       if (scope === "user") {
         return [{
-          path: path33.join(os11.homedir(), ".codex/AGENTS.md"),
+          path: path34.join(os11.homedir(), ".codex/AGENTS.md"),
           shared: true,
           format: "markdown"
         }];
@@ -17169,7 +17394,7 @@ function createCodexEmitter() {
       if (!projectRoot)
         return [];
       return [{
-        path: path33.join(projectRoot, "AGENTS.md"),
+        path: path34.join(projectRoot, "AGENTS.md"),
         shared: true,
         format: "markdown"
       }];
@@ -17190,7 +17415,7 @@ ${existing ?? ""}
 ${generated}`
         };
       }
-      await mkdir2(path33.dirname(dest.path), { recursive: true });
+      await mkdir2(path34.dirname(dest.path), { recursive: true });
       await writeFile2(dest.path, generated, "utf-8");
       return {
         written: true,
@@ -17208,7 +17433,7 @@ var init_codex2 = __esm({
 
 // packages/agents/dist/projection/gemini.js
 import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
-import path34 from "path";
+import path35 from "path";
 import os12 from "os";
 function renderMarkdown2(source) {
   const skillSections = source.skills.map((s) => `## Skill: ${s.name}
@@ -17233,7 +17458,7 @@ function createGeminiEmitter() {
     destinations(scope, projectRoot) {
       if (scope === "user") {
         return [{
-          path: path34.join(os12.homedir(), ".gemini/GEMINI.md"),
+          path: path35.join(os12.homedir(), ".gemini/GEMINI.md"),
           shared: true,
           format: "markdown"
         }];
@@ -17241,7 +17466,7 @@ function createGeminiEmitter() {
       if (!projectRoot)
         return [];
       return [{
-        path: path34.join(projectRoot, "GEMINI.md"),
+        path: path35.join(projectRoot, "GEMINI.md"),
         shared: true,
         format: "markdown"
       }];
@@ -17262,7 +17487,7 @@ ${existing ?? ""}
 ${generated}`
         };
       }
-      await mkdir3(path34.dirname(dest.path), { recursive: true });
+      await mkdir3(path35.dirname(dest.path), { recursive: true });
       await writeFile3(dest.path, generated, "utf-8");
       return {
         written: true,
@@ -17280,7 +17505,7 @@ var init_gemini2 = __esm({
 
 // packages/agents/dist/projection/opencode.js
 import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "fs/promises";
-import path35 from "path";
+import path36 from "path";
 import os13 from "os";
 function renderMarkdown3(source) {
   const skillSections = source.skills.map((s) => `## Skill: ${s.name}
@@ -17305,7 +17530,7 @@ function createOpencodeEmitter() {
     destinations(scope, projectRoot) {
       if (scope === "user") {
         return [{
-          path: path35.join(os13.homedir(), ".config", "opencode", "AGENTS.md"),
+          path: path36.join(os13.homedir(), ".config", "opencode", "AGENTS.md"),
           shared: true,
           format: "markdown"
         }];
@@ -17313,7 +17538,7 @@ function createOpencodeEmitter() {
       if (!projectRoot)
         return [];
       return [{
-        path: path35.join(projectRoot, "AGENTS.md"),
+        path: path36.join(projectRoot, "AGENTS.md"),
         shared: true,
         format: "markdown"
       }];
@@ -17334,7 +17559,7 @@ ${existing ?? ""}
 ${generated}`
         };
       }
-      await mkdir4(path35.dirname(dest.path), { recursive: true });
+      await mkdir4(path36.dirname(dest.path), { recursive: true });
       await writeFile4(dest.path, generated, "utf-8");
       return {
         written: true,
@@ -17351,12 +17576,12 @@ var init_opencode2 = __esm({
 });
 
 // packages/agents/dist/projection/opencode-skills.js
-import fs32 from "fs";
+import fs33 from "fs";
 import os14 from "os";
-import path36 from "path";
+import path37 from "path";
 function defaultOpencodeSkillsRoot(env = process.env) {
-  const configHome = env.XDG_CONFIG_HOME || path36.join(os14.homedir(), ".config");
-  return path36.join(configHome, "opencode", "skills");
+  const configHome = env.XDG_CONFIG_HOME || path37.join(os14.homedir(), ".config");
+  return path37.join(configHome, "opencode", "skills");
 }
 function parseSkillName(raw) {
   const fm = raw.match(/^---\r?\n([\s\S]*?)\r?\n---/);
@@ -17370,62 +17595,62 @@ function parseSkillName(raw) {
 }
 function listSourceSkills(sourceSkillsDir) {
   const out = /* @__PURE__ */ new Map();
-  if (!fs32.existsSync(sourceSkillsDir))
+  if (!fs33.existsSync(sourceSkillsDir))
     return out;
-  for (const entry of fs32.readdirSync(sourceSkillsDir, { withFileTypes: true })) {
+  for (const entry of fs33.readdirSync(sourceSkillsDir, { withFileTypes: true })) {
     if (!entry.isDirectory())
       continue;
-    const skillPath = path36.join(sourceSkillsDir, entry.name, "SKILL.md");
-    if (!fs32.existsSync(skillPath))
+    const skillPath = path37.join(sourceSkillsDir, entry.name, "SKILL.md");
+    if (!fs33.existsSync(skillPath))
       continue;
-    const name = parseSkillName(fs32.readFileSync(skillPath, "utf-8"));
+    const name = parseSkillName(fs33.readFileSync(skillPath, "utf-8"));
     if (name && SAFE_NAME.test(name))
       out.set(name, skillPath);
   }
   return out;
 }
 function hasMarker(dir) {
-  return fs32.existsSync(path36.join(dir, OPENCODE_SKILL_MARKER));
+  return fs33.existsSync(path37.join(dir, OPENCODE_SKILL_MARKER));
 }
 function syncOpencodeSkills(opts) {
   const result = { written: [], unchanged: [], removed: [], skipped: [] };
   const wanted = listSourceSkills(opts.sourceSkillsDir);
-  if (wanted.size === 0 && !fs32.existsSync(opts.sourceSkillsDir))
+  if (wanted.size === 0 && !fs33.existsSync(opts.sourceSkillsDir))
     return result;
   if (!opts.dryRun)
-    fs32.mkdirSync(opts.skillsRoot, { recursive: true });
+    fs33.mkdirSync(opts.skillsRoot, { recursive: true });
   for (const [name, srcPath] of wanted) {
-    const targetDir = path36.join(opts.skillsRoot, name);
-    const targetSkill = path36.join(targetDir, "SKILL.md");
+    const targetDir = path37.join(opts.skillsRoot, name);
+    const targetSkill = path37.join(targetDir, "SKILL.md");
     const managed = hasMarker(targetDir);
-    if (fs32.existsSync(targetSkill) && !managed) {
+    if (fs33.existsSync(targetSkill) && !managed) {
       result.skipped.push({ name, reason: "foreign-collision" });
       continue;
     }
-    const current = fs32.existsSync(targetSkill) ? fs32.readFileSync(targetSkill) : null;
-    if (current && current.equals(fs32.readFileSync(srcPath))) {
+    const current = fs33.existsSync(targetSkill) ? fs33.readFileSync(targetSkill) : null;
+    if (current && current.equals(fs33.readFileSync(srcPath))) {
       if (!managed && !opts.dryRun) {
-        fs32.writeFileSync(path36.join(targetDir, OPENCODE_SKILL_MARKER), MARKER_BODY);
+        fs33.writeFileSync(path37.join(targetDir, OPENCODE_SKILL_MARKER), MARKER_BODY);
       }
       result.unchanged.push(name);
       continue;
     }
     if (!opts.dryRun) {
-      fs32.mkdirSync(targetDir, { recursive: true });
-      fs32.copyFileSync(srcPath, targetSkill);
-      fs32.writeFileSync(path36.join(targetDir, OPENCODE_SKILL_MARKER), MARKER_BODY);
+      fs33.mkdirSync(targetDir, { recursive: true });
+      fs33.copyFileSync(srcPath, targetSkill);
+      fs33.writeFileSync(path37.join(targetDir, OPENCODE_SKILL_MARKER), MARKER_BODY);
     }
     result.written.push(name);
   }
-  if (fs32.existsSync(opts.skillsRoot)) {
-    for (const entry of fs32.readdirSync(opts.skillsRoot, { withFileTypes: true })) {
+  if (fs33.existsSync(opts.skillsRoot)) {
+    for (const entry of fs33.readdirSync(opts.skillsRoot, { withFileTypes: true })) {
       if (!entry.isDirectory() || wanted.has(entry.name))
         continue;
-      const dir = path36.join(opts.skillsRoot, entry.name);
+      const dir = path37.join(opts.skillsRoot, entry.name);
       if (!hasMarker(dir))
         continue;
       if (!opts.dryRun)
-        fs32.rmSync(dir, { recursive: true, force: true });
+        fs33.rmSync(dir, { recursive: true, force: true });
       result.removed.push(entry.name);
     }
   }
@@ -17433,7 +17658,7 @@ function syncOpencodeSkills(opts) {
 }
 function syncShippedOpencodeSkills(opts) {
   return syncOpencodeSkills({
-    sourceSkillsDir: path36.join(opts.pkgRoot, "plugin", "skills"),
+    sourceSkillsDir: path37.join(opts.pkgRoot, "plugin", "skills"),
     skillsRoot: opts.skillsRoot ?? defaultOpencodeSkillsRoot(),
     dryRun: opts.dryRun
   });
@@ -17449,7 +17674,7 @@ var init_opencode_skills = __esm({
 
 // packages/agents/dist/projection/claude.js
 import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile5 } from "fs/promises";
-import path37 from "path";
+import path38 from "path";
 import os15 from "os";
 function renderMarkdown4(source) {
   const skillSections = source.skills.map((s) => `## Skill: ${s.name}
@@ -17474,7 +17699,7 @@ function createClaudeEmitter() {
     destinations(scope, projectRoot) {
       if (scope === "user") {
         return [{
-          path: path37.join(os15.homedir(), ".claude/CLAUDE.md"),
+          path: path38.join(os15.homedir(), ".claude/CLAUDE.md"),
           shared: true,
           format: "markdown"
         }];
@@ -17482,7 +17707,7 @@ function createClaudeEmitter() {
       if (!projectRoot)
         return [];
       return [{
-        path: path37.join(projectRoot, "CLAUDE.md"),
+        path: path38.join(projectRoot, "CLAUDE.md"),
         shared: true,
         format: "markdown"
       }];
@@ -17503,7 +17728,7 @@ ${existing ?? ""}
 ${generated}`
         };
       }
-      await mkdir5(path37.dirname(dest.path), { recursive: true });
+      await mkdir5(path38.dirname(dest.path), { recursive: true });
       await writeFile5(dest.path, generated, "utf-8");
       return {
         written: true,
@@ -18538,8 +18763,8 @@ function resolveLastAssistantText(payload) {
   const derived = deriveTranscriptPath(p?.session_id, cwd);
   if (derived)
     candidates.push(derived);
-  for (const path59 of candidates) {
-    const text = readLastAssistantText(path59);
+  for (const path60 of candidates) {
+    const text = readLastAssistantText(path60);
     if (text != null)
       return text;
   }
@@ -19428,22 +19653,22 @@ var init_receipt_listener = __esm({
 });
 
 // packages/agents/dist/claude/api-key-approval.js
-import fs33 from "fs";
+import fs34 from "fs";
 import os16 from "os";
-import path38 from "path";
+import path39 from "path";
 function ensureClaudeApiKeyApproved(apiKey, opts = {}) {
   const suffix = apiKey.slice(-20);
   if (!suffix)
     return { changed: false, reason: "empty api key" };
-  const file = opts.claudeJsonPath ?? path38.join(os16.homedir(), ".claude.json");
+  const file = opts.claudeJsonPath ?? path39.join(os16.homedir(), ".claude.json");
   const log = opts.log ?? (() => {
   });
-  if (!fs33.existsSync(file)) {
+  if (!fs34.existsSync(file)) {
     return { changed: false, reason: "no ~/.claude.json yet \u2014 skipping routed-key pre-approval" };
   }
   let doc;
   try {
-    doc = JSON.parse(fs33.readFileSync(file, "utf8"));
+    doc = JSON.parse(fs34.readFileSync(file, "utf8"));
   } catch {
     return {
       changed: false,
@@ -19465,11 +19690,11 @@ function ensureClaudeApiKeyApproved(apiKey, opts = {}) {
   };
   const tmp = `${file}.squadrant-tmp`;
   try {
-    fs33.writeFileSync(tmp, JSON.stringify(doc, null, 2) + "\n", { mode: fs33.statSync(file).mode & 511 });
-    fs33.renameSync(tmp, file);
+    fs34.writeFileSync(tmp, JSON.stringify(doc, null, 2) + "\n", { mode: fs34.statSync(file).mode & 511 });
+    fs34.renameSync(tmp, file);
   } catch (e) {
     try {
-      fs33.unlinkSync(tmp);
+      fs34.unlinkSync(tmp);
     } catch {
     }
     return {
@@ -19578,10 +19803,10 @@ var init_http_channel = __esm({
           return cached;
         const directory = this.directoryFor?.(taskId);
         const createdAfterMs = this.createdAfterFor?.(taskId);
-        for (const path59 of ["/session?", "/api/session?"]) {
+        for (const path60 of ["/session?", "/api/session?"]) {
           let res;
           try {
-            res = await this.request(`http://127.0.0.1:${port}${path59}`, { method: "GET" });
+            res = await this.request(`http://127.0.0.1:${port}${path60}`, { method: "GET" });
           } catch {
             return void 0;
           }
@@ -19661,12 +19886,12 @@ var init_fact_adapter = __esm({
 });
 
 // packages/agents/dist/rules-hooks/install.js
-import fs34 from "fs";
+import fs35 from "fs";
 import os17 from "os";
-import path39 from "path";
+import path40 from "path";
 function readJson(file) {
   try {
-    const v2 = JSON.parse(fs34.readFileSync(file, "utf8"));
+    const v2 = JSON.parse(fs35.readFileSync(file, "utf8"));
     return typeof v2 === "object" && v2 !== null && !Array.isArray(v2) ? v2 : {};
   } catch (err) {
     if (err.code === "ENOENT")
@@ -19688,24 +19913,24 @@ function mergeHooks(root, agent, specs, cli, timeout) {
 function writeIfChanged(file, next, dryRun) {
   let prev = null;
   try {
-    prev = fs34.readFileSync(file, "utf8");
+    prev = fs35.readFileSync(file, "utf8");
   } catch {
   }
   const changed = prev !== next;
   if (changed && !dryRun) {
-    fs34.mkdirSync(path39.dirname(file), { recursive: true });
-    fs34.writeFileSync(file, next);
+    fs35.mkdirSync(path40.dirname(file), { recursive: true });
+    fs35.writeFileSync(file, next);
   }
   return { path: file, changed };
 }
 function installCodexRulesHooks(opts = {}) {
   const env = opts.env ?? process.env;
-  const file = opts.target ?? path39.join(env.CODEX_HOME ?? path39.join(os17.homedir(), ".codex"), "hooks.json");
+  const file = opts.target ?? path40.join(env.CODEX_HOME ?? path40.join(os17.homedir(), ".codex"), "hooks.json");
   const merged = mergeHooks(readJson(file), "codex", CODEX_HOOKS, opts.cli ?? "squadrant", 5);
   return writeIfChanged(file, JSON.stringify(merged, null, 2) + "\n", opts.dryRun);
 }
 function installGeminiRulesHooks(opts = {}) {
-  const file = opts.target ?? path39.join(os17.homedir(), ".gemini", "settings.json");
+  const file = opts.target ?? path40.join(os17.homedir(), ".gemini", "settings.json");
   const merged = mergeHooks(readJson(file), "gemini", GEMINI_HOOKS, opts.cli ?? "squadrant", 5e3);
   return writeIfChanged(file, JSON.stringify(merged, null, 2) + "\n", opts.dryRun);
 }
@@ -19746,9 +19971,9 @@ export const SquadrantRules = async ({ directory }) => {
 }
 function installOpencodeRulesHooks(opts = {}) {
   const env = opts.env ?? process.env;
-  const file = opts.target ?? path39.join(env.XDG_CONFIG_HOME || path39.join(os17.homedir(), ".config"), "opencode", "plugin", "squadrant-rules.js");
+  const file = opts.target ?? path40.join(env.XDG_CONFIG_HOME || path40.join(os17.homedir(), ".config"), "opencode", "plugin", "squadrant-rules.js");
   try {
-    if (!fs34.readFileSync(file, "utf8").startsWith(OPENCODE_PLUGIN_MARKER))
+    if (!fs35.readFileSync(file, "utf8").startsWith(OPENCODE_PLUGIN_MARKER))
       return { path: file, changed: false, skipped: "foreign-file" };
   } catch {
   }
@@ -20724,13 +20949,13 @@ var init_notifiers = __esm({
 });
 
 // packages/workspaces/dist/workspaces/obsidian.js
-import fs35 from "fs/promises";
+import fs36 from "fs/promises";
 import { existsSync as existsSync11 } from "fs";
-import path40 from "path";
+import path41 from "path";
 function resolveInRoot(root, relative) {
-  const joined = path40.resolve(root, relative);
-  const normalized2 = path40.resolve(root) + path40.sep;
-  if (joined !== path40.resolve(root) && !joined.startsWith(normalized2)) {
+  const joined = path41.resolve(root, relative);
+  const normalized2 = path41.resolve(root) + path41.sep;
+  if (joined !== path41.resolve(root) && !joined.startsWith(normalized2)) {
     throw new Error(`Path '${relative}' escapes workspace root`);
   }
   return joined;
@@ -20749,16 +20974,16 @@ function createObsidianDriver(scope) {
       };
     },
     async read(rel) {
-      return fs35.readFile(resolveInRoot(root, rel), "utf-8");
+      return fs36.readFile(resolveInRoot(root, rel), "utf-8");
     },
     async write(rel, content) {
       const abs = resolveInRoot(root, rel);
-      await fs35.mkdir(path40.dirname(abs), { recursive: true });
-      await fs35.writeFile(abs, content);
+      await fs36.mkdir(path41.dirname(abs), { recursive: true });
+      await fs36.writeFile(abs, content);
     },
     async exists(rel) {
       try {
-        await fs35.access(resolveInRoot(root, rel));
+        await fs36.access(resolveInRoot(root, rel));
         return true;
       } catch {
         return false;
@@ -20766,13 +20991,13 @@ function createObsidianDriver(scope) {
     },
     async list(rel) {
       try {
-        return await fs35.readdir(resolveInRoot(root, rel));
+        return await fs36.readdir(resolveInRoot(root, rel));
       } catch {
         return [];
       }
     },
     async mkdir(rel) {
-      await fs35.mkdir(resolveInRoot(root, rel), { recursive: true });
+      await fs36.mkdir(resolveInRoot(root, rel), { recursive: true });
     }
   };
 }
@@ -21186,9 +21411,9 @@ function defaultListFiles(dir) {
     return [];
   }
 }
-function defaultReadFile(path59) {
+function defaultReadFile(path60) {
   try {
-    return readFileSync17(path59, "utf-8");
+    return readFileSync17(path60, "utf-8");
   } catch {
     return void 0;
   }
@@ -21681,16 +21906,16 @@ function extractDetail(sub, payload) {
   }
   return void 0;
 }
-function defaultReadFile2(path59) {
+function defaultReadFile2(path60) {
   try {
-    return readFileSync18(path59, "utf-8");
+    return readFileSync18(path60, "utf-8");
   } catch {
     return void 0;
   }
 }
-function defaultWriteFile(path59, content) {
-  mkdirSync8(path59.replace(/\/[^/]+$/, ""), { recursive: true });
-  writeFileSync11(path59, content, "utf-8");
+function defaultWriteFile(path60, content) {
+  mkdirSync8(path60.replace(/\/[^/]+$/, ""), { recursive: true });
+  writeFileSync11(path60, content, "utf-8");
 }
 var CLAUDE_HOOK_EVENTS, DEFAULT_CLI_CMD, FOREIGN_AUTO_GATE_MARKER, SUBAGENT_MODEL_KEY, SMALL_FAST_MODEL_KEY, NativeHookSource;
 var init_native_hook_source = __esm({
@@ -22262,9 +22487,9 @@ init_dist();
 init_dist4();
 import { Command } from "commander";
 import { execSync as execSync7 } from "child_process";
-import fs36 from "fs";
+import fs37 from "fs";
 import { stat } from "fs/promises";
-import path41 from "path";
+import path42 from "path";
 import chalk3 from "chalk";
 
 // packages/cli/src/commands/health-view.ts
@@ -22366,7 +22591,7 @@ function settingsHaveAgentTeams() {
   try {
     const home = process.env.HOME || "";
     const settings = JSON.parse(
-      fs36.readFileSync(`${home}/.claude/settings.json`, "utf-8")
+      fs37.readFileSync(`${home}/.claude/settings.json`, "utf-8")
     );
     return settings?.env?.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS === "1";
   } catch {
@@ -22377,7 +22602,7 @@ function pluginInstalled(pluginKey) {
   try {
     const home = process.env.HOME || "";
     const plugins = JSON.parse(
-      fs36.readFileSync(
+      fs37.readFileSync(
         `${home}/.claude/plugins/installed_plugins.json`,
         "utf-8"
       )
@@ -22401,9 +22626,9 @@ function tryGetVersion(cmd) {
 }
 function candidateGlobalInstalls(roots) {
   const out = [];
-  if (roots.npm) out.push({ manager: "npm", packageJsonPath: path41.join(roots.npm, "squadrant", "package.json") });
-  if (roots.pnpm) out.push({ manager: "pnpm", packageJsonPath: path41.join(roots.pnpm, "squadrant", "package.json") });
-  if (roots.yarn) out.push({ manager: "yarn", packageJsonPath: path41.join(roots.yarn, "node_modules", "squadrant", "package.json") });
+  if (roots.npm) out.push({ manager: "npm", packageJsonPath: path42.join(roots.npm, "squadrant", "package.json") });
+  if (roots.pnpm) out.push({ manager: "pnpm", packageJsonPath: path42.join(roots.pnpm, "squadrant", "package.json") });
+  if (roots.yarn) out.push({ manager: "yarn", packageJsonPath: path42.join(roots.yarn, "node_modules", "squadrant", "package.json") });
   return out;
 }
 function findInstalledSquadrants(candidates, readVersion) {
@@ -22423,7 +22648,7 @@ ${lines.join("\n")}
 }
 function readPackageVersion(packageJsonPath) {
   try {
-    const pkg2 = JSON.parse(fs36.readFileSync(packageJsonPath, "utf-8"));
+    const pkg2 = JSON.parse(fs37.readFileSync(packageJsonPath, "utf-8"));
     return typeof pkg2.version === "string" ? pkg2.version : null;
   } catch {
     return null;
@@ -22506,7 +22731,7 @@ var doctorCommand = new Command("doctor").description("Check system health and p
   ));
   checkOptional(
     "Obsidian installed",
-    commandExists("obsidian") || fs36.existsSync("/Applications/Obsidian.app"),
+    commandExists("obsidian") || fs37.existsSync("/Applications/Obsidian.app"),
     "viewer for the hub vault; the vault is plain Markdown",
     "Install from: https://obsidian.md"
   );
@@ -22603,7 +22828,7 @@ var doctorCommand = new Command("doctor").description("Check system health and p
     const emitter = projectionRegistry.get(name);
     const [userDest] = emitter.destinations("user");
     if (!userDest) continue;
-    const dir = path41.dirname(userDest.path);
+    const dir = path42.dirname(userDest.path);
     let status;
     try {
       await stat(dir);
@@ -22624,7 +22849,7 @@ var doctorCommand = new Command("doctor").description("Check system health and p
   results.push(
     check(
       "Squadrant config exists",
-      fs36.existsSync(
+      fs37.existsSync(
         process.env.SQUADRANT_CONFIG || `${process.env.HOME}/.config/squadrant/config.json`
       ),
       "Run: squadrant init"
@@ -22708,8 +22933,8 @@ init_dist();
 init_dist4();
 init_dist();
 import { Command as Command2 } from "commander";
-import fs37 from "fs";
-import path42 from "path";
+import fs38 from "fs";
+import path43 from "path";
 import os18 from "os";
 import readline from "readline";
 import chalk4 from "chalk";
@@ -22960,22 +23185,22 @@ function detectClaudeAuth(probe = {}) {
 // packages/cli/src/commands/init.ts
 init_dist3();
 function findPackageRoot() {
-  let dir = path42.dirname(new URL(import.meta.url).pathname);
+  let dir = path43.dirname(new URL(import.meta.url).pathname);
   while (dir !== "/") {
-    if (fs37.existsSync(path42.join(dir, "package.json"))) return dir;
-    dir = path42.dirname(dir);
+    if (fs38.existsSync(path43.join(dir, "package.json"))) return dir;
+    dir = path43.dirname(dir);
   }
   return process.cwd();
 }
 function copyDirRecursive(src, dest) {
-  fs37.mkdirSync(dest, { recursive: true });
-  for (const entry of fs37.readdirSync(src, { withFileTypes: true })) {
-    const srcPath = path42.join(src, entry.name);
-    const destPath = path42.join(dest, entry.name);
+  fs38.mkdirSync(dest, { recursive: true });
+  for (const entry of fs38.readdirSync(src, { withFileTypes: true })) {
+    const srcPath = path43.join(src, entry.name);
+    const destPath = path43.join(dest, entry.name);
     if (entry.isDirectory()) {
       copyDirRecursive(srcPath, destPath);
     } else {
-      fs37.copyFileSync(srcPath, destPath);
+      fs38.copyFileSync(srcPath, destPath);
     }
   }
 }
@@ -23017,7 +23242,7 @@ function warnIfNoAnthropic(preset, auth) {
 var initCommand = new Command2("init").description("Guided first-time setup: provider, hub vault, agents, plugins, projects (re-run-safe)").option("--hub <path>", "Hub vault path", "~/squadrant-hub").option("--preset <id>", "provider preset: a|b|c (non-interactive; d accepted as a deprecated alias for c)").action(async (opts) => {
   const hubPath = resolveHome(opts.hub);
   const pkgRoot = findPackageRoot();
-  const configDir = path42.join(os18.homedir(), ".config", "squadrant");
+  const configDir = path43.join(os18.homedir(), ".config", "squadrant");
   const isTTY = process.stdin.isTTY === true;
   console.log(chalk4.bold("\nSquadrant Init\n"));
   let explicitPreset;
@@ -23055,8 +23280,8 @@ var initCommand = new Command2("init").description("Guided first-time setup: pro
   }
   const wsRegistry = new WorkspaceRegistry({ obsidian: createObsidianDriver });
   try {
-    if (fs37.existsSync(DEFAULT_CONFIG_PATH)) {
-      const existing = JSON.parse(fs37.readFileSync(DEFAULT_CONFIG_PATH, "utf-8"));
+    if (fs38.existsSync(DEFAULT_CONFIG_PATH)) {
+      const existing = JSON.parse(fs38.readFileSync(DEFAULT_CONFIG_PATH, "utf-8"));
       wsRegistry.get(existing.workspace ?? "obsidian");
     }
   } catch (err) {
@@ -23064,7 +23289,7 @@ var initCommand = new Command2("init").description("Guided first-time setup: pro
     return;
   }
   stepHeader(1, 5, "Hub vault");
-  const configExists = fs37.existsSync(DEFAULT_CONFIG_PATH);
+  const configExists = fs38.existsSync(DEFAULT_CONFIG_PATH);
   let config;
   if (configExists) {
     console.log(chalk4.yellow("    \u26A0 Config already exists, skipping creation"));
@@ -23102,37 +23327,37 @@ var initCommand = new Command2("init").description("Guided first-time setup: pro
     saveConfig(config);
     console.log(chalk4.green(`    \u2714 Config updated at ${DEFAULT_CONFIG_PATH}`));
   }
-  const hubTemplate = path42.join(pkgRoot, "obsidian", "hub");
-  if (fs37.existsSync(hubPath)) {
+  const hubTemplate = path43.join(pkgRoot, "obsidian", "hub");
+  if (fs38.existsSync(hubPath)) {
     console.log(chalk4.yellow(`    \u26A0 Hub vault already exists at ${hubPath}`));
-  } else if (fs37.existsSync(hubTemplate)) {
+  } else if (fs38.existsSync(hubTemplate)) {
     copyDirRecursive(hubTemplate, hubPath);
     console.log(chalk4.green(`    \u2714 Hub vault scaffolded at ${hubPath}`));
   } else {
-    fs37.mkdirSync(hubPath, { recursive: true });
+    fs38.mkdirSync(hubPath, { recursive: true });
     console.log(chalk4.yellow(`    \u26A0 Hub template not found; created empty directory at ${hubPath}`));
   }
-  const hubDashboardSrc = path42.join(pkgRoot, "obsidian", "hub", "dashboard.md");
-  const hubDashboardDest = path42.join(hubPath, "dashboard.md");
-  if (fs37.existsSync(hubDashboardSrc)) {
-    fs37.copyFileSync(hubDashboardSrc, hubDashboardDest);
+  const hubDashboardSrc = path43.join(pkgRoot, "obsidian", "hub", "dashboard.md");
+  const hubDashboardDest = path43.join(hubPath, "dashboard.md");
+  if (fs38.existsSync(hubDashboardSrc)) {
+    fs38.copyFileSync(hubDashboardSrc, hubDashboardDest);
     console.log(chalk4.green(`    \u2714 Dashboard refreshed`));
   }
-  fs37.mkdirSync(path42.join(hubPath, "projects"), { recursive: true });
+  fs38.mkdirSync(path43.join(hubPath, "projects"), { recursive: true });
   ensureRuntimeSynced({ sourceRoot: pkgRoot, runtimeRoot: configDir });
   console.log(chalk4.green(`    \u2714 Runtime assets synced to ${configDir}`));
   stepHeader(2, 5, "Agent + projection setup");
-  const settingsPath = path42.join(os18.homedir(), ".claude", "settings.json");
+  const settingsPath = path43.join(os18.homedir(), ".claude", "settings.json");
   try {
     let settings = {};
-    if (fs37.existsSync(settingsPath)) {
-      settings = JSON.parse(fs37.readFileSync(settingsPath, "utf-8"));
+    if (fs38.existsSync(settingsPath)) {
+      settings = JSON.parse(fs38.readFileSync(settingsPath, "utf-8"));
     }
     const env = settings.env || {};
     if (env.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS !== "1") {
       settings.env = { ...env, CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS: "1" };
-      fs37.mkdirSync(path42.dirname(settingsPath), { recursive: true });
-      fs37.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+      fs38.mkdirSync(path43.dirname(settingsPath), { recursive: true });
+      fs38.writeFileSync(settingsPath, JSON.stringify(settings, null, 2) + "\n");
       console.log(chalk4.green("    \u2714 Agent Teams enabled in ~/.claude/settings.json"));
     } else {
       console.log(chalk4.green("    \u2714 Agent Teams already enabled"));
@@ -23185,7 +23410,7 @@ var initCommand = new Command2("init").description("Guided first-time setup: pro
     chalk4.cyan("    Absolute path to your first project (Enter to skip): ")
   );
   if (projectPath) {
-    const projectName = path42.basename(projectPath);
+    const projectName = path43.basename(projectPath);
     console.log(chalk4.bold(`
     Run this to register it:`));
     console.log(chalk4.cyan(`      squadrant projects add ${projectName} ${projectPath}
@@ -23213,8 +23438,8 @@ var initCommand = new Command2("init").description("Guided first-time setup: pro
 init_dist();
 init_dist2();
 import { Command as Command3 } from "commander";
-import fs38 from "fs";
-import path43 from "path";
+import fs39 from "fs";
+import path44 from "path";
 import chalk5 from "chalk";
 function restartAfterProjectsAdd(opts) {
   const doRestart = opts.doRestart ?? restartDaemonIfRunning;
@@ -23226,22 +23451,22 @@ function restartAfterProjectsAdd(opts) {
   }
 }
 function findPackageRoot2() {
-  let dir = path43.dirname(new URL(import.meta.url).pathname);
+  let dir = path44.dirname(new URL(import.meta.url).pathname);
   while (dir !== "/") {
-    if (fs38.existsSync(path43.join(dir, "package.json"))) return dir;
-    dir = path43.dirname(dir);
+    if (fs39.existsSync(path44.join(dir, "package.json"))) return dir;
+    dir = path44.dirname(dir);
   }
   return process.cwd();
 }
 function copyDirRecursive2(src, dest) {
-  fs38.mkdirSync(dest, { recursive: true });
-  for (const entry of fs38.readdirSync(src, { withFileTypes: true })) {
-    const srcPath = path43.join(src, entry.name);
-    const destPath = path43.join(dest, entry.name);
+  fs39.mkdirSync(dest, { recursive: true });
+  for (const entry of fs39.readdirSync(src, { withFileTypes: true })) {
+    const srcPath = path44.join(src, entry.name);
+    const destPath = path44.join(dest, entry.name);
     if (entry.isDirectory()) {
       copyDirRecursive2(srcPath, destPath);
     } else {
-      fs38.copyFileSync(srcPath, destPath);
+      fs39.copyFileSync(srcPath, destPath);
     }
   }
 }
@@ -23277,7 +23502,7 @@ var addCmd = new Command3("add").description("Register a project").argument("<na
     process.exit(1);
   }
   const resolvedPath = resolveHome(projectPath);
-  if (!fs38.existsSync(path43.join(resolvedPath, ".git"))) {
+  if (!fs39.existsSync(path44.join(resolvedPath, ".git"))) {
     console.log(chalk5.yellow(`
   \u26A0 No .git found at ${resolvedPath}. Make sure this is the project root, not a parent directory.
 `));
@@ -23330,7 +23555,7 @@ var addCmd = new Command3("add").description("Register a project").argument("<na
   \u26A0 Group '${group}' already has '${primary[0]}' as primary. Overriding.`));
     }
   }
-  const spokeVault = opts.spoke ? resolveHome(opts.spoke) : path43.join(config.hubVault, "spokes", name);
+  const spokeVault = opts.spoke ? resolveHome(opts.spoke) : path44.join(config.hubVault, "spokes", name);
   const project = {
     path: resolvedPath,
     captainName,
@@ -23345,20 +23570,20 @@ var addCmd = new Command3("add").description("Register a project").argument("<na
   \u2714 Project '${name}' registered`));
   restartAfterProjectsAdd({ noRestart: opts.restart === false });
   const pkgRoot = findPackageRoot2();
-  const spokeTemplate = path43.join(pkgRoot, "obsidian", "spoke");
-  if (fs38.existsSync(spokeVault)) {
+  const spokeTemplate = path44.join(pkgRoot, "obsidian", "spoke");
+  if (fs39.existsSync(spokeVault)) {
     console.log(chalk5.yellow(`  \u26A0 Spoke vault already exists at ${spokeVault}, skipping scaffold`));
-  } else if (fs38.existsSync(spokeTemplate)) {
+  } else if (fs39.existsSync(spokeTemplate)) {
     copyDirRecursive2(spokeTemplate, spokeVault);
-    const statusPath = path43.join(spokeVault, "status.md");
-    if (fs38.existsSync(statusPath)) {
-      const content = fs38.readFileSync(statusPath, "utf-8");
+    const statusPath = path44.join(spokeVault, "status.md");
+    if (fs39.existsSync(statusPath)) {
+      const content = fs39.readFileSync(statusPath, "utf-8");
       const updated = content.replace(/^project: unnamed/m, `project: ${name}`);
-      fs38.writeFileSync(statusPath, updated);
+      fs39.writeFileSync(statusPath, updated);
     }
     console.log(chalk5.green(`  \u2714 Spoke vault scaffolded at ${spokeVault}`));
   } else {
-    fs38.mkdirSync(spokeVault, { recursive: true });
+    fs39.mkdirSync(spokeVault, { recursive: true });
     console.log(chalk5.yellow(`  \u26A0 Spoke template not found; created empty dir at ${spokeVault}`));
   }
   console.log("");
@@ -23427,10 +23652,10 @@ init_dist3();
 init_dist();
 import { Command as Command5 } from "commander";
 import { execSync as execSync9 } from "child_process";
-import path44 from "path";
+import path45 from "path";
 import os19 from "os";
 import chalk7 from "chalk";
-var TEMPLATES_DIR2 = path44.join(os19.homedir(), ".config", "squadrant", "templates");
+var TEMPLATES_DIR2 = path45.join(os19.homedir(), ".config", "squadrant", "templates");
 var TASK_PROMPTS = {
   briefing: "Run your daily briefing using the squadrant:command-ops skill. Read all spoke handoffs, yesterday's logs, current status; produce a concise cross-project briefing; save to {hubVault}/daily-logs/YYYY-MM-DD.md; then exit.",
   "learnings-review": "Run a learnings review using the squadrant:command-ops skill. Scan {spokeVault}/learnings across all projects, identify cross-project patterns, propose captured-skill or fix actions, and exit when done.",
@@ -23463,7 +23688,7 @@ async function runCommandSpawn(input) {
   if (!agent) {
     throw new Error(`Unknown agent '${agentName}'. Known: claude, codex, gemini, opencode.`);
   }
-  const promptFile = path44.join(TEMPLATES_DIR2, `command.${agent.templateSuffix}.md`);
+  const promptFile = path45.join(TEMPLATES_DIR2, `command.${agent.templateSuffix}.md`);
   const cliCommand = agent.buildCommand({
     prompt,
     workdir: process.cwd(),
@@ -23504,7 +23729,7 @@ init_dist3();
 import { Command as Command9 } from "commander";
 import { createConnection as createConnection4 } from "net";
 import { randomUUID as randomUUID5 } from "crypto";
-import { execFileSync as execFileSync11 } from "child_process";
+import { execFileSync as execFileSync11, spawnSync } from "child_process";
 import { homedir as homedir15 } from "os";
 import { join as join27 } from "path";
 import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync13 } from "fs";
@@ -23986,6 +24211,31 @@ function defaultWriteResult(id, payload) {
   writeFileSync13(file, payload);
   return file;
 }
+var CITE_GIT_TIMEOUT_MS = 2e3;
+var citeGit = (args) => {
+  const r = spawnSync("git", args, { encoding: "utf8", timeout: CITE_GIT_TIMEOUT_MS, stdio: ["ignore", "pipe", "ignore"] });
+  if (r.error) throw r.error;
+  return r.status === 0 ? r.stdout : "";
+};
+function logSignalCitations(state, o) {
+  const env = o.env ?? process.env;
+  const project = o.project ?? env.SQUADRANT_CREW_PROJECT;
+  if (state !== "done" && state !== "review" || !project) return [];
+  const texts = o.message ? [{ text: o.message, ref: `crew-${state}:${o.taskId ?? env.SQUADRANT_CREW_TASK_ID}` }] : [];
+  try {
+    texts.push(...readBranchOnlyMessages(o.cwd ?? process.cwd(), o.git ?? citeGit).map((c) => ({ text: c.text, ref: `git:${c.sha}`, at: c.at })));
+  } catch (e) {
+    process.stderr.write(`squadrant: rule citation scan of commits skipped: ${e.message}
+`);
+  }
+  try {
+    return scanCitations(texts, { project, sink: o.audit });
+  } catch (e) {
+    process.stderr.write(`squadrant: rule citation scan skipped: ${e.message}
+`);
+    return [];
+  }
+}
 async function runCrewSignal(signal, o, deps) {
   const taskId = o.taskId ?? process.env.SQUADRANT_CREW_TASK_ID;
   const project = o.project ?? process.env.SQUADRANT_CREW_PROJECT;
@@ -24174,13 +24424,7 @@ function addControlPlaneCrewCommands(crew) {
         ...opts.project !== void 0 ? { project: opts.project } : {},
         writeResult: defaultWriteResult
       }, { call: squadrantdCall });
-      const citeProject = opts.project ?? process.env.SQUADRANT_CREW_PROJECT;
-      if ((state === "done" || state === "review") && opts.message && citeProject) {
-        try {
-          scanAndLogCitations({ text: opts.message, ref: `crew-${state}:${opts.taskId ?? process.env.SQUADRANT_CREW_TASK_ID}`, project: citeProject });
-        } catch {
-        }
-      }
+      logSignalCitations(state, opts);
       process.exit(0);
     } catch (e) {
       process.stderr.write(`${e.message}
@@ -24269,7 +24513,7 @@ import { connect as netConnect2 } from "net";
 init_dist3();
 init_dist2();
 import { createServer as createServer4, connect as netConnect } from "net";
-import fs39 from "fs";
+import fs40 from "fs";
 import { join as join28 } from "path";
 import { randomUUID as randomUUID6 } from "crypto";
 import chalk10 from "chalk";
@@ -24277,15 +24521,15 @@ var shared;
 var registryEntryPath = () => join28(CLAUDE_SESSIONS_DIR, `${process.pid}.json`);
 function unregisterSenderIdentity() {
   try {
-    fs39.unlinkSync(registryEntryPath());
+    fs40.unlinkSync(registryEntryPath());
   } catch {
   }
 }
 function registerSenderIdentity(socketPath2) {
   try {
     unregisterSenderIdentity();
-    fs39.mkdirSync(CLAUDE_SESSIONS_DIR, { recursive: true });
-    fs39.writeFileSync(
+    fs40.mkdirSync(CLAUDE_SESSIONS_DIR, { recursive: true });
+    fs40.writeFileSync(
       registryEntryPath(),
       JSON.stringify({
         pid: process.pid,
@@ -24311,7 +24555,7 @@ async function sharedReceiptListener() {
     // must never be the reason we refuse to start.
     unlinkStale: (p) => {
       try {
-        fs39.unlinkSync(p);
+        fs40.unlinkSync(p);
       } catch {
       }
     },
@@ -24336,7 +24580,7 @@ async function buildCaptainChannel() {
     // in /tmp/x registers cwd "/private/tmp/x" on macOS, so cwd matching silently
     // missed and every captain ping reported accepted-unconfirmed.
     statusFor: (taskId) => readClaudeStatusBySocketPath(captainSocketPath(taskId)),
-    wire: (p, e) => writeLine(p, e, { connect: (path59) => netConnect(path59) }),
+    wire: (p, e) => writeLine(p, e, { connect: (path60) => netConnect(path60) }),
     receipts,
     newMsgId: () => randomUUID6(),
     sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
@@ -24365,7 +24609,7 @@ async function sendClaudeFirstTurnViaPeer(runtime, o, getTaskRecord) {
     socketPathFor: () => o.messagingSocketPath,
     sessionIdFor: () => readClaudeStatusBySocketPath(o.messagingSocketPath)?.sessionId,
     statusFor: () => readClaudeStatusBySocketPath(o.messagingSocketPath),
-    wire: (p, e) => writeLine(p, e, { connect: (path59) => netConnect2(path59) }),
+    wire: (p, e) => writeLine(p, e, { connect: (path60) => netConnect2(path60) }),
     receipts,
     newMsgId: () => randomUUID7(),
     sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
@@ -24509,7 +24753,7 @@ async function runCrewSend2(project, name, message, opts) {
       socketPathFor: (taskId) => tasks.find((t) => t.id === taskId)?.messagingSocketPath,
       sessionIdFor: (taskId) => tasks.find((t) => t.id === taskId)?.sessionId,
       statusFor: (taskId) => readClaudeStatus(tasks.find((t) => t.id === taskId)),
-      wire: (p, e) => writeLine(p, e, { connect: (path59) => netConnect3(path59) }),
+      wire: (p, e) => writeLine(p, e, { connect: (path60) => netConnect3(path60) }),
       receipts,
       newMsgId: () => randomUUID8(),
       sleep: (ms) => new Promise((r) => setTimeout(r, ms)),
@@ -24903,11 +25147,11 @@ init_dist4();
 init_dist();
 init_dist2();
 import { Command as Command12 } from "commander";
-import fs40 from "fs";
-import path45 from "path";
+import fs41 from "fs";
+import path46 from "path";
 import os20 from "os";
 import chalk13 from "chalk";
-var TEMPLATES_DIR3 = path45.join(os20.homedir(), ".config", "squadrant", "templates");
+var TEMPLATES_DIR3 = path46.join(os20.homedir(), ".config", "squadrant", "templates");
 async function runSideSpawn2(input) {
   const config = loadConfig();
   const proj = config.projects[input.project];
@@ -24932,7 +25176,7 @@ async function runSideSpawn2(input) {
   }
   const sideModel = sideRole?.model;
   const sideThinking = sideRole?.thinking;
-  const promptFile = path45.join(
+  const promptFile = path46.join(
     TEMPLATES_DIR3,
     `side.${input.role}.${agent.templateSuffix}.md`
   );
@@ -24940,7 +25184,7 @@ async function runSideSpawn2(input) {
     prompt: input.topic,
     workdir: spawnCwd,
     role: "side",
-    promptFile: fs40.existsSync(promptFile) ? promptFile : void 0,
+    promptFile: fs41.existsSync(promptFile) ? promptFile : void 0,
     interactive: true,
     permissionMode: config.defaults.permissions?.crew ?? "auto",
     ...sideModel ? { model: sideModel } : {},
@@ -25203,8 +25447,8 @@ function renderDashboard(rows, opts) {
 
 // packages/web/dist/sync-hub.js
 init_dist();
-import fs41 from "fs";
-import path46 from "path";
+import fs42 from "fs";
+import path47 from "path";
 function buildMirrorMarkdown(s) {
   const fenced = "```";
   return [
@@ -25230,15 +25474,15 @@ function buildMirrorMarkdown(s) {
 function syncHub(deps) {
   if (!deps.config.hubVault)
     return [];
-  const writeFile6 = deps.writeFile ?? ((p, c) => fs41.writeFileSync(p, c));
-  const mkdir6 = deps.mkdir ?? ((p) => fs41.mkdirSync(p, { recursive: true }));
-  const projectsDir = path46.join(resolveHome(deps.config.hubVault), "projects");
+  const writeFile6 = deps.writeFile ?? ((p, c) => fs42.writeFileSync(p, c));
+  const mkdir6 = deps.mkdir ?? ((p) => fs42.mkdirSync(p, { recursive: true }));
+  const projectsDir = path47.join(resolveHome(deps.config.hubVault), "projects");
   mkdir6(projectsDir);
   const out = [];
   for (const s of deps.statuses) {
     if (s.state === "unknown")
       continue;
-    const hubPath = path46.join(projectsDir, `${s.project}.md`);
+    const hubPath = path47.join(projectsDir, `${s.project}.md`);
     try {
       writeFile6(hubPath, buildMirrorMarkdown(s));
       out.push({ project: s.project, hubPath });
@@ -26244,18 +26488,18 @@ function renderHtml(snap, opts = {}) {
 import { closeSync as closeSync3, openSync as openSync3, readSync as readSync2, statSync as statSync4 } from "fs";
 var LOG_TAIL_BYTES = 256 * 1024;
 var LOG_RING_SIZE = 1e3;
-function defaultSize(path59) {
+function defaultSize(path60) {
   try {
-    return statSync4(path59).size;
+    return statSync4(path60).size;
   } catch {
     return 0;
   }
 }
-function defaultRead(path59, start, len) {
+function defaultRead(path60, start, len) {
   if (len <= 0)
     return "";
   try {
-    const fd = openSync3(path59, "r");
+    const fd = openSync3(path60, "r");
     try {
       const buf = Buffer.alloc(len);
       const n = readSync2(fd, buf, 0, len, start);
@@ -26275,8 +26519,8 @@ var LogTailer = class {
   ring = [];
   size;
   read;
-  constructor(path59, ringSize = LOG_RING_SIZE, deps = {}) {
-    this.path = path59;
+  constructor(path60, ringSize = LOG_RING_SIZE, deps = {}) {
+    this.path = path60;
     this.ringSize = ringSize;
     this.size = deps.size ?? defaultSize;
     this.read = deps.read ?? defaultRead;
@@ -26552,8 +26796,8 @@ init_dist4();
 init_dist2();
 import { Command as Command14 } from "commander";
 import { execSync as execSync11, execFileSync as execFileSync13 } from "child_process";
-import fs42 from "fs";
-import path47 from "path";
+import fs43 from "fs";
+import path48 from "path";
 import os21 from "os";
 import chalk16 from "chalk";
 
@@ -26646,8 +26890,8 @@ function resolveLaunchBackend(o) {
 // packages/cli/src/commands/launch.ts
 init_dist2();
 var CMUX_APP = "/Applications/cmux.app";
-var TEMPLATES_DIR4 = path47.join(os21.homedir(), ".config", "squadrant", "templates");
-var SESSIONS_PATH2 = path47.join(os21.homedir(), ".config", "squadrant", "sessions.json");
+var TEMPLATES_DIR4 = path48.join(os21.homedir(), ".config", "squadrant", "templates");
+var SESSIONS_PATH2 = path48.join(os21.homedir(), ".config", "squadrant", "sessions.json");
 function shouldWireCaptainChannel(agentName, config) {
   return agentName === "claude" && resolveCaptainChannelMode(config.defaults) !== "off";
 }
@@ -26744,7 +26988,7 @@ var launchCommand = new Command14("launch").description(
       initialPrompt = "Run your startup checklist: use the squadrant:command-ops skill, complete your daily briefing, then report ready.";
     }
     const runtime = projectName ? runtimes.forProject(projectName, config) : runtimes.global(config);
-    const stateRoot = path47.join(os21.homedir(), ".config", "squadrant", "state");
+    const stateRoot = path48.join(os21.homedir(), ".config", "squadrant", "state");
     const isOpencodeCaptain = role === "captain" && agentName === "opencode" && !!projectName;
     if (isOpencodeCaptain && !isOpencodeCaptainDir(cwd)) {
       console.error(chalk16.red(`
@@ -26897,12 +27141,12 @@ var launchCommand = new Command14("launch").description(
   }
   if (opts.all) {
     const hubPath = resolveHome(config.hubVault);
-    fs42.mkdirSync(hubPath, { recursive: true });
+    fs43.mkdirSync(hubPath, { recursive: true });
     console.log(chalk16.bold("\nLaunching all captain workspaces\n"));
     for (const [name, proj] of Object.entries(config.projects)) {
       const projPath = resolveHome(proj.path);
       const spokePath = resolveHome(proj.spokeVault);
-      if (!fs42.existsSync(spokePath)) {
+      if (!fs43.existsSync(spokePath)) {
         const spokeDriver = new WorkspaceRegistry({ obsidian: createObsidianDriver }).forProject(name, config);
         await ensureSpokeLayout(spokeDriver);
         console.log(chalk16.cyan(`  \u2714 Created spoke vault at ${spokePath}`));
@@ -26940,7 +27184,7 @@ Launching ${selected.length} captain workspace(s) in parallel
       const proj = config.projects[name];
       const projPath = resolveHome(proj.path);
       const spokePath = resolveHome(proj.spokeVault);
-      if (!fs42.existsSync(spokePath)) {
+      if (!fs43.existsSync(spokePath)) {
         const spokeDriver = new WorkspaceRegistry({ obsidian: createObsidianDriver }).forProject(name, config);
         await ensureSpokeLayout(spokeDriver);
         console.log(chalk16.cyan(`  \u2714 Created spoke vault at ${spokePath}`));
@@ -26964,7 +27208,7 @@ Launching ${selected.length} captain workspace(s) in parallel
     const proj = config.projects[project];
     const projPath = resolveHome(proj.path);
     const spokePath = resolveHome(proj.spokeVault);
-    if (!fs42.existsSync(spokePath)) {
+    if (!fs43.existsSync(spokePath)) {
       const spokeDriver = new WorkspaceRegistry({ obsidian: createObsidianDriver }).forProject(project, config);
       await ensureSpokeLayout(spokeDriver);
       console.log(chalk16.cyan(`  \u2714 Created spoke vault at ${spokePath}`));
@@ -27100,24 +27344,24 @@ Shutting down captain workspace for '${project}'...
 // packages/cli/src/commands/feedback.ts
 init_dist();
 import { Command as Command16 } from "commander";
-import fs43 from "fs";
+import fs44 from "fs";
 import os22 from "os";
-import path48 from "path";
+import path49 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import { execSync as execSync12 } from "child_process";
 import chalk18 from "chalk";
 var REPO_URL = "https://github.com/tu11aa/squadrant";
 function readPkgVersion() {
   try {
-    const pkgPath = path48.join(path48.dirname(fileURLToPath3(import.meta.url)), "..", "package.json");
-    return JSON.parse(fs43.readFileSync(pkgPath, "utf-8")).version ?? "unknown";
+    const pkgPath = path49.join(path49.dirname(fileURLToPath3(import.meta.url)), "..", "package.json");
+    return JSON.parse(fs44.readFileSync(pkgPath, "utf-8")).version ?? "unknown";
   } catch {
     return "unknown";
   }
 }
 function readMetrics(metricsPath) {
   try {
-    return JSON.parse(fs43.readFileSync(metricsPath, "utf-8"));
+    return JSON.parse(fs44.readFileSync(metricsPath, "utf-8"));
   } catch {
     return {};
   }
@@ -27155,7 +27399,7 @@ function buildIssueUrl(metrics, squadrantVersion) {
 }
 var feedbackCommand = new Command16("feedback").description("Open a pre-filled GitHub issue for feedback or bug reports").action(() => {
   const config = loadConfig();
-  const metricsPath = config.metrics?.path || path48.join(os22.homedir(), ".config", "squadrant", "metrics.json");
+  const metricsPath = config.metrics?.path || path49.join(os22.homedir(), ".config", "squadrant", "metrics.json");
   const metrics = readMetrics(metricsPath);
   const version = readStamp(config) ?? readPkgVersion();
   const issueUrl = buildIssueUrl(metrics, version);
@@ -27455,9 +27699,9 @@ workspaceCommand.command("read").description("Print the contents of a scope-rela
   const config = loadConfig();
   const registry = buildRegistry2();
   try {
-    const { projectTarget, path: path59 } = resolveTargetAndPath(arg1, arg2, !!opts.hub);
+    const { projectTarget, path: path60 } = resolveTargetAndPath(arg1, arg2, !!opts.hub);
     const driver = resolveDriver(registry, config, projectTarget, !!opts.hub);
-    const content = await driver.read(path59);
+    const content = await driver.read(path60);
     process.stdout.write(content);
   } catch (err) {
     console.error(chalk21.red(err.message));
@@ -27469,26 +27713,26 @@ workspaceCommand.command("write").description("Write content to a scope-relative
   const registry = buildRegistry2();
   try {
     let projectTarget;
-    let path59;
+    let path60;
     let rawContent;
     if (opts.hub) {
       if (arg3 !== void 0) {
         throw new Error("With --hub, pass only the path and content");
       }
       projectTarget = void 0;
-      path59 = arg1;
+      path60 = arg1;
       rawContent = arg2;
     } else {
       if (arg3 === void 0) {
         throw new Error("Missing content \u2014 usage: <project> <path> <content>");
       }
       projectTarget = arg1;
-      path59 = arg2;
+      path60 = arg2;
       rawContent = arg3;
     }
     const driver = resolveDriver(registry, config, projectTarget, !!opts.hub);
     const payload = rawContent === "-" ? await readStdin() : rawContent;
-    await driver.write(path59, payload);
+    await driver.write(path60, payload);
   } catch (err) {
     console.error(chalk21.red(err.message));
     process.exit(1);
@@ -27498,9 +27742,9 @@ workspaceCommand.command("list").description("List entries in a scope-relative d
   const config = loadConfig();
   const registry = buildRegistry2();
   try {
-    const { projectTarget, path: path59 } = resolveTargetAndPath(arg1, arg2, !!opts.hub);
+    const { projectTarget, path: path60 } = resolveTargetAndPath(arg1, arg2, !!opts.hub);
     const driver = resolveDriver(registry, config, projectTarget, !!opts.hub);
-    const entries = await driver.list(path59);
+    const entries = await driver.list(path60);
     for (const entry of entries) console.log(entry);
   } catch (err) {
     console.error(chalk21.red(err.message));
@@ -27511,9 +27755,9 @@ workspaceCommand.command("exists").description("Exit 0 if path exists, 1 if not"
   const config = loadConfig();
   const registry = buildRegistry2();
   try {
-    const { projectTarget, path: path59 } = resolveTargetAndPath(arg1, arg2, !!opts.hub);
+    const { projectTarget, path: path60 } = resolveTargetAndPath(arg1, arg2, !!opts.hub);
     const driver = resolveDriver(registry, config, projectTarget, !!opts.hub);
-    const ok2 = await driver.exists(path59);
+    const ok2 = await driver.exists(path60);
     process.exit(ok2 ? 0 : 1);
   } catch (err) {
     console.error(chalk21.red(err.message));
@@ -27524,9 +27768,9 @@ workspaceCommand.command("mkdir").description("Recursively create a scope-relati
   const config = loadConfig();
   const registry = buildRegistry2();
   try {
-    const { projectTarget, path: path59 } = resolveTargetAndPath(arg1, arg2, !!opts.hub);
+    const { projectTarget, path: path60 } = resolveTargetAndPath(arg1, arg2, !!opts.hub);
     const driver = resolveDriver(registry, config, projectTarget, !!opts.hub);
-    await driver.mkdir(path59);
+    await driver.mkdir(path60);
   } catch (err) {
     console.error(chalk21.red(err.message));
     process.exit(1);
@@ -27566,8 +27810,8 @@ init_dist4();
 init_dist();
 import { Command as Command21 } from "commander";
 import chalk23 from "chalk";
-import fs44 from "fs";
-import path49 from "path";
+import fs45 from "fs";
+import path50 from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function parseScope(v2) {
   if (v2 !== "user" && v2 !== "project") {
@@ -27576,10 +27820,10 @@ function parseScope(v2) {
   return v2;
 }
 function findPackageRoot3() {
-  let dir = path49.dirname(fileURLToPath4(import.meta.url));
+  let dir = path50.dirname(fileURLToPath4(import.meta.url));
   while (dir !== "/" && dir !== "") {
-    if (fs44.existsSync(path49.join(dir, "package.json"))) return dir;
-    dir = path49.dirname(dir);
+    if (fs45.existsSync(path50.join(dir, "package.json"))) return dir;
+    dir = path50.dirname(dir);
   }
   return process.cwd();
 }
@@ -27794,12 +28038,12 @@ init_dist();
 init_dist();
 init_dist2();
 import { Command as Command23 } from "commander";
-import fs45 from "fs";
+import fs46 from "fs";
 import { fileURLToPath as fileURLToPath5 } from "url";
 import { dirname as dirname8, join as join31 } from "path";
 import chalk24 from "chalk";
 function runConfigCheck(opts) {
-  const raw = JSON.parse(fs45.readFileSync(opts.configPath, "utf-8"));
+  const raw = JSON.parse(fs46.readFileSync(opts.configPath, "utf-8"));
   const def = getDefaultConfig();
   const items = detectDrift(raw, def);
   let working = raw;
@@ -27887,7 +28131,7 @@ function printItems(items) {
 var configCommand = new Command23("config").description("Inspect and reconcile squadrant config");
 configCommand.command("check").description("Detect config drift vs the current default schema").option("--fix", "Apply the safe tier (add missing, remove deprecated)", false).option("--accept", "Stamp the current version without changing config (dismiss advisories)", false).option("--json", "Output drift items as JSON", false).action((opts) => {
   const pkgVersion = readPkgVersion2();
-  if (!fs45.existsSync(DEFAULT_CONFIG_PATH)) {
+  if (!fs46.existsSync(DEFAULT_CONFIG_PATH)) {
     console.log(chalk24.yellow("No config found \u2014 run `squadrant init` first."));
     return;
   }
@@ -27933,7 +28177,7 @@ configCommand.command("set").description("Write a config value by dotted key (e.
 });
 function readPkgVersion2() {
   const pkgPath = join31(dirname8(fileURLToPath5(import.meta.url)), "..", "package.json");
-  return JSON.parse(fs45.readFileSync(pkgPath, "utf-8")).version;
+  return JSON.parse(fs46.readFileSync(pkgPath, "utf-8")).version;
 }
 
 // packages/cli/src/commands/heal.ts
@@ -28378,8 +28622,8 @@ var cmuxCommand = new Command28("cmux").description("cmux integration helpers").
 // packages/cli/src/commands/effort.ts
 init_dist();
 init_dist2();
-import fs46 from "fs";
-import path50 from "path";
+import fs47 from "fs";
+import path51 from "path";
 import { Command as Command29 } from "commander";
 import chalk30 from "chalk";
 var VALID_EFFORTS = ["max", "balance", "low"];
@@ -28422,9 +28666,9 @@ function effortScopeLabel(projectName) {
 }
 function canonical(p) {
   try {
-    return fs46.realpathSync(p);
+    return fs47.realpathSync(p);
   } catch {
-    return path50.resolve(p);
+    return path51.resolve(p);
   }
 }
 async function notifyCaptainsOfEffort(effort, config, driver, cwd = process.cwd(), append, scopeProject, projectConfigRoot) {
@@ -28474,7 +28718,7 @@ var effortCommand = new Command29("effort").description("Get or set the crew tok
     const config = loadConfig();
     const registry = new RuntimeRegistry2({ cmux: createCmuxDriver2() });
     const driver = registry.global(config);
-    const stateRoot = path50.join(path50.dirname(DEFAULT_CONFIG_PATH), "state");
+    const stateRoot = path51.join(path51.dirname(DEFAULT_CONFIG_PATH), "state");
     const append = (project, text) => appendCaptainMessage({ stateRoot, project, text, source: "daemon" });
     await notifyCaptainsOfEffort(effort, config, driver, process.cwd(), append, options.project);
   } catch {
@@ -28484,13 +28728,13 @@ var effortCommand = new Command29("effort").description("Get or set the crew tok
 
 // packages/cli/src/commands/tokens.ts
 init_dist();
-import fs47 from "fs";
-import path51 from "path";
+import fs48 from "fs";
+import path52 from "path";
 import os23 from "os";
 import readline3 from "readline";
 import { Command as Command30 } from "commander";
 import chalk31 from "chalk";
-var CLAUDE_PROJECTS_DIR = path51.join(os23.homedir(), ".claude", "projects");
+var CLAUDE_PROJECTS_DIR = path52.join(os23.homedir(), ".claude", "projects");
 function parseTranscriptLine(rawLine) {
   const line2 = rawLine.trim();
   if (!line2) return { timestamp: null, usage: null };
@@ -28540,7 +28784,7 @@ function foldTranscriptLine(agg, rawLine, state) {
 async function aggregateTranscriptFile(filePath) {
   const agg = emptySessionAggregate();
   const state = { lastCacheRead: null };
-  const rl = readline3.createInterface({ input: fs47.createReadStream(filePath), crlfDelay: Infinity });
+  const rl = readline3.createInterface({ input: fs48.createReadStream(filePath), crlfDelay: Infinity });
   for await (const line2 of rl) {
     foldTranscriptLine(agg, line2, state);
   }
@@ -28608,22 +28852,22 @@ function buildRoleReport(role, sessions) {
 }
 async function readdirSafe(dir) {
   try {
-    return await fs47.promises.readdir(dir);
+    return await fs48.promises.readdir(dir);
   } catch {
     return [];
   }
 }
 async function listJsonlFiles(dir) {
   const entries = await readdirSafe(dir);
-  return entries.filter((e) => e.endsWith(".jsonl")).map((e) => path51.join(dir, e));
+  return entries.filter((e) => e.endsWith(".jsonl")).map((e) => path52.join(dir, e));
 }
 async function findTranscriptDirs(claudeProjectsDir, captainSlug) {
   const entries = await readdirSafe(claudeProjectsDir);
   const captainDirs = [];
   const crewDirs = [];
   for (const entry of entries) {
-    if (entry === captainSlug) captainDirs.push(path51.join(claudeProjectsDir, entry));
-    else if (isCrewDirName(entry, captainSlug)) crewDirs.push(path51.join(claudeProjectsDir, entry));
+    if (entry === captainSlug) captainDirs.push(path52.join(claudeProjectsDir, entry));
+    else if (isCrewDirName(entry, captainSlug)) crewDirs.push(path52.join(claudeProjectsDir, entry));
   }
   return { captainDirs, crewDirs };
 }
@@ -29110,8 +29354,8 @@ import { join as join36 } from "path";
 import { homedir as homedir20 } from "os";
 
 // packages/cli/src/lib/captain-session-registry.ts
-import fs48 from "fs";
-import path52 from "path";
+import fs49 from "fs";
+import path53 from "path";
 
 // packages/cli/src/lib/handoff-facts.ts
 var STALE_FETCH_WARNING_MS = 24 * 60 * 60 * 1e3;
@@ -29162,15 +29406,15 @@ function assembleHandoffFacts(live, claudeMem, gapSessions, checkpoint, now, ext
 // packages/cli/src/lib/captain-session-registry.ts
 var CAPTAIN_SESSION_REGISTRY_FILE = "captain-sessions.jsonl";
 function appendCaptainSession(spokeVault, record) {
-  fs48.mkdirSync(spokeVault, { recursive: true });
-  const file = path52.join(spokeVault, CAPTAIN_SESSION_REGISTRY_FILE);
-  fs48.appendFileSync(file, JSON.stringify(record) + "\n");
+  fs49.mkdirSync(spokeVault, { recursive: true });
+  const file = path53.join(spokeVault, CAPTAIN_SESSION_REGISTRY_FILE);
+  fs49.appendFileSync(file, JSON.stringify(record) + "\n");
 }
 function readCaptainSessionRegistry(spokeVault) {
-  const file = path52.join(spokeVault, CAPTAIN_SESSION_REGISTRY_FILE);
-  if (!fs48.existsSync(file)) return [];
+  const file = path53.join(spokeVault, CAPTAIN_SESSION_REGISTRY_FILE);
+  if (!fs49.existsSync(file)) return [];
   const records = [];
-  for (const line2 of fs48.readFileSync(file, "utf-8").split("\n")) {
+  for (const line2 of fs49.readFileSync(file, "utf-8").split("\n")) {
     if (!line2.trim()) continue;
     try {
       records.push(JSON.parse(line2));
@@ -29620,13 +29864,13 @@ function hooksCommand() {
 // packages/cli/src/commands/work.ts
 init_dist();
 init_dist2();
-import path53 from "path";
+import path54 from "path";
 import { Command as Command34 } from "commander";
 import chalk34 from "chalk";
 function detectCurrentProject(config, cwd = process.cwd()) {
   for (const [name, proj] of Object.entries(config.projects)) {
     const projPath = resolveHome(proj.path);
-    if (cwd === projPath || cwd.startsWith(projPath + path53.sep)) return name;
+    if (cwd === projPath || cwd.startsWith(projPath + path54.sep)) return name;
   }
   return void 0;
 }
@@ -29758,14 +30002,14 @@ var workCommand = new Command34("work").description("Track your own in-flight wo
 // packages/cli/src/commands/handoff.ts
 init_dist();
 import { Command as Command35 } from "commander";
-import path56 from "path";
+import path57 from "path";
 import os24 from "os";
 
 // packages/cli/src/lib/handoff-live-repo.ts
 init_dist();
 import { execFileSync as execFileSync15 } from "child_process";
-import fs49 from "fs";
-import path54 from "path";
+import fs50 from "fs";
+import path55 from "path";
 
 // packages/cli/src/lib/handoff-branch-state.ts
 function tryRun(runner, cmd, args, cwd) {
@@ -29904,7 +30148,7 @@ function localAheadOfBase(runner, projectPath, base) {
 }
 function readFetchAgeMs(projectPath, now) {
   try {
-    const stat2 = fs49.statSync(path54.join(projectPath, ".git", "FETCH_HEAD"));
+    const stat2 = fs50.statSync(path55.join(projectPath, ".git", "FETCH_HEAD"));
     return Math.max(0, now - stat2.mtime.getTime());
   } catch {
     return null;
@@ -29975,7 +30219,7 @@ function gatherLiveRepoState(projectPath, fallbackBaseBranch, tasks, runner = de
 
 // packages/cli/src/lib/handoff-claude-mem.ts
 import { createRequire } from "module";
-import fs50 from "fs";
+import fs51 from "fs";
 var { DatabaseSync } = createRequire(import.meta.url)("node:sqlite");
 var CLAUDE_MEM_RECENCY_LIMIT = 20;
 function decisionText(row) {
@@ -29989,7 +30233,7 @@ function decisionText(row) {
   return row.narrative ?? "";
 }
 function queryClaudeMem(dbPath, project) {
-  if (!fs50.existsSync(dbPath)) return null;
+  if (!fs51.existsSync(dbPath)) return null;
   let db;
   try {
     db = new DatabaseSync(dbPath, { readOnly: true });
@@ -30032,7 +30276,7 @@ function queryClaudeMem(dbPath, project) {
 }
 
 // packages/cli/src/lib/handoff-transcript.ts
-import fs51 from "fs";
+import fs52 from "fs";
 var TRANSCRIPT_BYTE_CAP = 2e5;
 var DIGEST_BYTE_CAP = 8 * 1024;
 var PROMPT_TRUNCATE_CHARS = 300;
@@ -30141,27 +30385,27 @@ function extractMessages(tailText) {
   return { lastUserMessage, lastAssistantText, digest };
 }
 function extractTranscriptTail(transcriptPath, byteCap = TRANSCRIPT_BYTE_CAP) {
-  if (!fs51.existsSync(transcriptPath)) return null;
-  const content = fs51.readFileSync(transcriptPath, "utf-8");
+  if (!fs52.existsSync(transcriptPath)) return null;
+  const content = fs52.readFileSync(transcriptPath, "utf-8");
   const { lastUserMessage, lastAssistantText, digest } = extractMessages(tailOf(content, byteCap));
-  const mtimeIso = fs51.statSync(transcriptPath).mtime.toISOString();
+  const mtimeIso = fs52.statSync(transcriptPath).mtime.toISOString();
   return { path: transcriptPath, mtimeIso, lastUserMessage, lastAssistantText, digest };
 }
 
 // packages/cli/src/lib/handoff-archive.ts
-import fs52 from "fs";
-import path55 from "path";
+import fs53 from "fs";
+import path56 from "path";
 function readNewestArchivedHandoff(spokeVault, now) {
-  const dir = path55.join(spokeVault, "handoffs");
-  if (!fs52.existsSync(dir)) return null;
-  const candidates = fs52.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".json")).map((e) => {
-    const full = path55.join(dir, e.name);
-    return { name: e.name, full, mtime: fs52.statSync(full).mtime };
+  const dir = path56.join(spokeVault, "handoffs");
+  if (!fs53.existsSync(dir)) return null;
+  const candidates = fs53.readdirSync(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".json")).map((e) => {
+    const full = path56.join(dir, e.name);
+    return { name: e.name, full, mtime: fs53.statSync(full).mtime };
   }).sort((a, b) => b.mtime.getTime() - a.mtime.getTime());
   for (const candidate of candidates) {
     let content;
     try {
-      content = JSON.parse(fs52.readFileSync(candidate.full, "utf-8"));
+      content = JSON.parse(fs53.readFileSync(candidate.full, "utf-8"));
     } catch {
       continue;
     }
@@ -30171,7 +30415,7 @@ function readNewestArchivedHandoff(spokeVault, now) {
 }
 
 // packages/cli/src/commands/handoff.ts
-var CLAUDE_MEM_DB_PATH = path56.join(os24.homedir(), ".claude-mem", "claude-mem.db");
+var CLAUDE_MEM_DB_PATH = path57.join(os24.homedir(), ".claude-mem", "claude-mem.db");
 async function defaultFetchTasks(project) {
   return await squadrantdCall({ kind: "list", project });
 }
@@ -30239,9 +30483,9 @@ function filterSessions(rows, f) {
     if (f.agent && r.agent !== f.agent) return false;
     if (f.liveOnly && r.status === "stale") return false;
     if (f.project) {
-      const path59 = f.projects?.[f.project];
+      const path60 = f.projects?.[f.project];
       const byRecord = r.project === f.project;
-      const byCwd = !!path59 && !!r.cwd && (r.cwd === normalized(path59) || r.cwd.startsWith(normalized(path59) + "/"));
+      const byCwd = !!path60 && !!r.cwd && (r.cwd === normalized(path60) || r.cwd.startsWith(normalized(path60) + "/"));
       if (!byRecord && !byCwd) return false;
     }
     return true;
@@ -30332,7 +30576,7 @@ init_dist();
 init_dist2();
 init_dist3();
 import os25 from "os";
-import path57 from "path";
+import path58 from "path";
 import { Command as Command37 } from "commander";
 import chalk36 from "chalk";
 
@@ -30450,7 +30694,7 @@ function buildWhoamiDeps(opts = {}) {
   const projects = Object.fromEntries(
     Object.entries(config.projects).map(([n, p]) => [n, resolveHome(p.path)])
   );
-  const root = stateRoot ?? path57.join(os25.homedir(), ".config", "squadrant", "state");
+  const root = stateRoot ?? path58.join(os25.homedir(), ".config", "squadrant", "state");
   const store = createStore(root);
   const merged = {
     env: process.env,
@@ -30502,11 +30746,11 @@ var whoamiCommand = new Command37("whoami").description("Show the agent session
 // packages/cli/src/commands/knowledge.ts
 init_dist();
 init_dist2();
-import fs53 from "fs";
+import fs54 from "fs";
 import os26 from "os";
-import path58 from "path";
+import path59 from "path";
 import readline4 from "readline/promises";
-import { spawnSync } from "child_process";
+import { spawnSync as spawnSync2 } from "child_process";
 import { Command as Command39 } from "commander";
 import chalk38 from "chalk";
 
@@ -30571,7 +30815,8 @@ function runRulesSearch(query, opts, configPath = DEFAULT_CONFIG_PATH) {
   const rules = loadFor(opts, configPath);
   const hits = searchRules(rules, query, { statuses: opts.all ? [...RULE_STATUSES] : DEFAULT_SEARCH_STATUSES });
   const project = resolveRulesProject(loadConfig(configPath), opts);
-  appendAudit([{ kb: "", level: "project", project, domain: "rules", itemId: "", event: "item.searched", query, score: hits[0]?.score }], opts.audit);
+  const shown = hits.slice(0, parseLimit(opts.limit));
+  appendAudit(shown.length ? shown.map((h) => ({ ...ruleAuditScope(h.rule), project, domain: "rules", itemId: h.rule.id, event: "item.searched", query, score: h.score })) : [{ kb: "", level: "project", project, domain: "rules", itemId: "", event: "item.searched", query }], opts.audit);
   return hits;
 }
 function runRulesList(opts, configPath = DEFAULT_CONFIG_PATH) {
@@ -30654,22 +30899,23 @@ function runKnowledgeInit(kb, configPath = DEFAULT_CONFIG_PATH) {
   const cfg = loadConfig(configPath);
   const dir = kbDir(cfg, kb);
   const created = [];
-  for (const d of [path58.join(dir, "raw"), kbRulesDir(cfg, kb), path58.join(kbRulesDir(cfg, kb), PROPOSED_DIR)]) {
-    if (!fs53.existsSync(d)) {
-      fs53.mkdirSync(d, { recursive: true });
-      created.push(path58.relative(dir, d));
+  for (const d of [path59.join(dir, "raw"), kbRulesDir(cfg, kb), path59.join(kbRulesDir(cfg, kb), PROPOSED_DIR)]) {
+    if (!fs54.existsSync(d)) {
+      fs54.mkdirSync(d, { recursive: true });
+      created.push(path59.relative(dir, d));
     }
   }
-  const sourcesFile = path58.join(dir, "sources.yaml");
-  if (!fs53.existsSync(sourcesFile)) {
-    fs53.writeFileSync(sourcesFile, SOURCES_TEMPLATE);
+  const sourcesFile = path59.join(dir, "sources.yaml");
+  if (!fs54.existsSync(sourcesFile)) {
+    fs54.writeFileSync(sourcesFile, SOURCES_TEMPLATE);
     created.push("sources.yaml");
   }
-  if (!fs53.existsSync(path58.join(dir, "index.json"))) {
+  if (!fs54.existsSync(path59.join(dir, "index.json"))) {
     writeIndex(dir, compileIndex(kb, []));
     created.push("index.json");
   }
   if (ensureGitRepo(dir)) created.push(".git");
+  if (ensureKbGitignore(dir)) created.push(".gitignore");
   if (!kbConfigs(cfg)[kb]) {
     cfg.knowledgeBases = { ...cfg.knowledgeBases ?? {}, [kb]: {} };
     saveConfig(cfg, configPath);
@@ -30681,7 +30927,7 @@ function runKnowledgeSubscribe(kb, project, configPath = DEFAULT_CONFIG_PATH) {
   const cfg = loadConfig(configPath);
   const pc = cfg.projects[project];
   if (!pc) throw new Error(`Unknown project '${project}'`);
-  if (!fs53.existsSync(kbDir(cfg, kb))) {
+  if (!fs54.existsSync(kbDir(cfg, kb))) {
     throw new Error(`Knowledge base '${kb}' does not exist. Run: squadrant knowledge init ${kb}`);
   }
   const list = pc.knowledge ?? [];
@@ -30696,21 +30942,37 @@ function runKnowledgeSources(kb, configPath = DEFAULT_CONFIG_PATH) {
   const cfg = loadConfig(configPath);
   return loadSources(kbDir(cfg, kb));
 }
+function runKnowledgeSourcesRemove(kb, entryPath, opts = {}, configPath = DEFAULT_CONFIG_PATH) {
+  assertKbName(kb);
+  const cfg = loadConfig(configPath);
+  if (!fs54.existsSync(kbDir(cfg, kb))) throw new Error(`Knowledge base '${kb}' does not exist. Run: squadrant knowledge init ${kb}`);
+  return removeSource(kbDir(cfg, kb), kbRulesDir(cfg, kb), entryPath, { ...opts, kbName: kb });
+}
 var knowledgeCommand = new Command39("knowledge").description("Manage rules knowledge bases (#893)");
 knowledgeCommand.command("init <kb>").description("Create a knowledge base (its own git repo) under ~/squadrant/kb/<kb>/").action((kb) => {
   const { dir, created } = runKnowledgeInit(kb);
   console.log(created.length ? chalk38.green(`Initialised ${dir} (${created.join(", ")})`) : `Already initialised: ${dir}`);
+  console.log(chalk38.dim("raw/ and .converted/ are git-ignored by default (edit .gitignore to opt in)."));
   console.log(chalk38.dim(KNOWLEDGE_PRIVACY_NOTICE));
 });
 knowledgeCommand.command("subscribe <kb>").description("Subscribe a project to a knowledge base").requiredOption("--project <name>", "project to subscribe").action((kb, opts) => {
   const list = runKnowledgeSubscribe(kb, opts.project);
   console.log(`${opts.project} knowledge: ${list.join(", ")}`);
 });
-knowledgeCommand.command("sources <kb>").description("List the trusted sources of a knowledge base").action((kb) => {
+knowledgeCommand.command("sources <kb>").description("List the trusted sources of a knowledge base; --remove drops one and strips its refs from rules").option("--remove <path>", "remove the sources.yaml entry with this exact path; rules left with no source become stale").option("--dry-run", "with --remove: print what would change, write nothing").action((kb, o) => {
+  if (o.dryRun && !o.remove) throw new Error("--dry-run only applies to --remove");
+  if (o.remove) {
+    const r = runKnowledgeSourcesRemove(kb, o.remove, { dryRun: o.dryRun });
+    const stripped = r.stripped.length - r.stale.length;
+    console.log(`${r.dryRun ? "would remove" : "removed"} ${o.remove}: ${r.stripped.length} rules lose a ref, ${r.stale.length} left with no source (stale), ${stripped} keep another source`);
+    for (const id of r.stale) console.log(chalk38.yellow(`  stale: ${id}`));
+    if (r.dryRun) console.log(chalk38.dim("dry run: nothing written"));
+    return;
+  }
   const { sources, errors } = runKnowledgeSources(kb);
   if (!sources.length && !errors.length) console.log("(no sources \u2014 edit sources.yaml)");
   for (const s of sources) {
-    console.log(`  ${s.priority.padEnd(8)} ${s.path}${s.domain ? `  [${s.domain}]` : ""}${s.sensitivity ? chalk38.yellow("  local-only") : ""}`);
+    console.log(`  ${s.priority.padEnd(8)} ${s.path}${s.domain ? `  [${s.domain}]` : ""}${s.sensitivity ? chalk38.yellow("  local-only") : ""}${s.review ? chalk38.cyan("  review: required") : ""}`);
   }
   for (const e of errors) console.log(chalk38.red(`  \u2718 ${e}`));
   if (errors.length) process.exitCode = 1;
@@ -30718,9 +30980,9 @@ knowledgeCommand.command("sources <kb>").description("List the trusted sources o
 function runKnowledgeReindex(kb, configPath = DEFAULT_CONFIG_PATH) {
   assertKbName(kb);
   const cfg = loadConfig(configPath);
-  if (!fs53.existsSync(kbDir(cfg, kb))) throw new Error(`Knowledge base '${kb}' does not exist. Run: squadrant knowledge init ${kb}`);
+  if (!fs54.existsSync(kbDir(cfg, kb))) throw new Error(`Knowledge base '${kb}' does not exist. Run: squadrant knowledge init ${kb}`);
   const { rules: all, errors: allErrors } = loadKbRules(cfg, kb, { includeProposed: true });
-  const proposedRoot = path58.join(kbRulesDir(cfg, kb), PROPOSED_DIR) + path58.sep;
+  const proposedRoot = path59.join(kbRulesDir(cfg, kb), PROPOSED_DIR) + path59.sep;
   const live = all.filter((r) => !r.file.startsWith(proposedRoot));
   const pendingDups = allErrors.filter((e) => isPendingProposalDup(e, kbRulesDir(cfg, kb)));
   const errors = allErrors.filter((e) => !pendingDups.includes(e));
@@ -30730,11 +30992,15 @@ function runKnowledgeReindex(kb, configPath = DEFAULT_CONFIG_PATH) {
 function runKnowledgeValidate(kb, configPath = DEFAULT_CONFIG_PATH) {
   assertKbName(kb);
   const cfg = loadConfig(configPath);
-  if (!fs53.existsSync(kbDir(cfg, kb))) throw new Error(`Knowledge base '${kb}' does not exist. Run: squadrant knowledge init ${kb}`);
+  if (!fs54.existsSync(kbDir(cfg, kb))) throw new Error(`Knowledge base '${kb}' does not exist. Run: squadrant knowledge init ${kb}`);
   const { sources, errors } = loadSources(kbDir(cfg, kb));
-  const res = validateKb({ rulesDir: kbRulesDir(cfg, kb), kbRoot: kbDir(cfg, kb), sources, domains: kbConfigs(cfg)[kb]?.domains });
-  const srcChecks = errors.map((e) => ({ level: "fail", message: `sources.yaml: ${e}` }));
-  return { checks: [...srcChecks, ...res.checks], ok: res.ok && !errors.length };
+  const { errata, errors: errataErrors } = loadErrata(kbDir(cfg, kb));
+  const res = validateKb({ rulesDir: kbRulesDir(cfg, kb), kbRoot: kbDir(cfg, kb), sources, errata, domains: kbConfigs(cfg)[kb]?.domains });
+  const srcChecks = [
+    ...errors.map((e) => ({ level: "fail", message: `sources.yaml: ${e}` })),
+    ...errataErrors.map((e) => ({ level: "fail", message: `errata.yaml: ${e}` }))
+  ];
+  return { checks: [...srcChecks, ...res.checks], ok: res.ok && !srcChecks.length };
 }
 knowledgeCommand.command("reindex <kb>").description("Recompile index.json from the KB's rule files").action((kb) => {
   const r = runKnowledgeReindex(kb);
@@ -30760,7 +31026,7 @@ knowledgeCommand.command("migrate").description("Move <hubVault>/knowledge/<kb>/
 function requireKb(kb, configPath) {
   assertKbName(kb);
   const cfg = loadConfig(configPath);
-  if (!fs53.existsSync(kbDir(cfg, kb))) throw new Error(`Knowledge base '${kb}' does not exist. Run: squadrant knowledge init ${kb}`);
+  if (!fs54.existsSync(kbDir(cfg, kb))) throw new Error(`Knowledge base '${kb}' does not exist. Run: squadrant knowledge init ${kb}`);
   return cfg;
 }
 async function runKnowledgeIngest(kb, opts = {}, configPath = DEFAULT_CONFIG_PATH) {
@@ -30779,10 +31045,14 @@ async function runKnowledgeIngest(kb, opts = {}, configPath = DEFAULT_CONFIG_PAT
 }
 function runKnowledgeApply(kb, candidatesFile, configPath = DEFAULT_CONFIG_PATH) {
   const cfg = requireKb(kb, configPath);
-  const input = JSON.parse(fs53.readFileSync(candidatesFile, "utf8"));
+  const input = JSON.parse(fs54.readFileSync(candidatesFile, "utf8"));
   if (!input || !Array.isArray(input.candidates)) throw new Error("candidates file must be { complete?: string[], candidates: [...] }");
   const projects = Object.entries(cfg.projects).filter(([name, pc]) => pc.path && subscribedKbs(cfg, name).includes(kb)).map(([name, pc]) => ({ name, root: resolveHome(pc.path) }));
-  return applyCandidates(input, { kb, kbRoot: kbDir(cfg, kb), rulesDir: kbRulesDir(cfg, kb), projects });
+  const { errata, errors } = loadErrata(kbDir(cfg, kb));
+  if (errors.length) throw new Error(`errata.yaml: ${errors.join("; ")}`);
+  const { sources, errors: sourceErrors } = loadSources(kbDir(cfg, kb));
+  if (sourceErrors.length) throw new Error(`sources.yaml: ${sourceErrors.join("; ")}`);
+  return applyCandidates(input, { kb, kbRoot: kbDir(cfg, kb), rulesDir: kbRulesDir(cfg, kb), projects, sources, errata });
 }
 knowledgeCommand.command("ingest <kb>").description("Detect changed sources, convert them (markitdown) into .converted/, and print the section plan for the knowledge-extract skill").option("--dry-run", "estimate tokens only; write nothing").option("--json", "print the full plan as JSON").option("--local-model", "a local model is available, so sensitivity: local-only sources are planned instead of skipped").option("--max-sections <n>", "override maxSectionsPerPass", (v2) => parseInt(v2, 10)).action(async (kb, opts) => {
   const plan = await runKnowledgeIngest(kb, opts);
@@ -30801,16 +31071,19 @@ knowledgeCommand.command("apply <kb> <candidates>").description("Verify extracte
   console.log(`created ${r.created.length}, merged ${r.merged.length}, proposed ${r.proposed.length}, superseded ${r.superseded.length}, stale ${r.stale.length}, rejected ${r.rejected.length}`);
   for (const x of r.rejected) console.log(chalk38.red(`  \u2718 ${x.id} (${x.source}): ${x.reason}`));
   for (const x of r.idOverrides) console.log(chalk38.dim(`  id ${x.from} \u2192 ${x.to} (matched by quote offset)`));
+  for (const e of r.orphanedErrata) console.log(chalk38.yellow(`  errata ${e.id} (${e.ref}): quote no longer found; the raw file changed, re-check it`));
   for (const d of r.doclingFlags) console.log(chalk38.yellow(`  ${d.ref}: ${d.dropped}/${d.total} candidates dropped; conversion likely poor, try docling`));
 });
-var defaultStateRoot2 = () => path58.join(path58.dirname(DEFAULT_CONFIG_PATH), "state");
+var defaultStateRoot2 = () => path59.join(path59.dirname(DEFAULT_CONFIG_PATH), "state");
 function reviewContext(kb, configPath) {
   const cfg = requireKb(kb, configPath);
   const projects = Object.entries(cfg.projects).filter(([name, pc]) => pc.path && subscribedKbs(cfg, name).includes(kb)).map(([name, pc]) => ({ name, root: resolveHome(pc.path) }));
-  return { cfg, kb, sources: loadSources(kbDir(cfg, kb)).sources, projects };
+  const { sources, errors } = loadSources(kbDir(cfg, kb));
+  if (errors.length) throw new Error(`sources.yaml: ${errors.join("; ")}`);
+  return { cfg, kb, sources, projects };
 }
 function runKnowledgeReviewApply(kb, file, configPath = DEFAULT_CONFIG_PATH) {
-  return applyDecisions(JSON.parse(fs53.readFileSync(file, "utf8")), reviewContext(kb, configPath));
+  return applyDecisions(JSON.parse(fs54.readFileSync(file, "utf8")), reviewContext(kb, configPath));
 }
 function runKnowledgeResolve(kb, key, r, by, reason, configPath = DEFAULT_CONFIG_PATH) {
   return resolveEscalation(reviewContext(kb, configPath), key, r, by, reason);
@@ -30858,8 +31131,8 @@ ${e.explanation}`);
       else if (ans === "r") r = { kind: "reject" };
       else if (ans === "e" && e.kind === "proposal") {
         const ctx = reviewContext(kb, DEFAULT_CONFIG_PATH);
-        const file = path58.join(kbRulesDir(ctx.cfg, kb), PROPOSED_DIR, `${e.item}.md`);
-        spawnSync(process.env.EDITOR ?? "vi", [file], { stdio: "inherit" });
+        const file = path59.join(kbRulesDir(ctx.cfg, kb), PROPOSED_DIR, `${e.item}.md`);
+        spawnSync2(process.env.EDITOR ?? "vi", [file], { stdio: "inherit" });
         r = { kind: "approve" };
       }
       if (r) console.log(chalk38.green(runKnowledgeResolve(kb, e.key, r, by, reason)));
@@ -30930,7 +31203,7 @@ function renderStats(all) {
   const pct = (x) => x === null ? "-" : `${Math.round(x * 100)}%`;
   return all.flatMap((s) => [
     `${s.kb} (last ${s.windowDays} days)`,
-    ...s.items.map((x) => `  ${x.itemId}  surfaced ${x.surfaced}  pulled ${x.shown}  cited ${x.cited}  use ${pct(x.useRate)}  noise ${pct(x.noiseRate)}  violated ${pct(x.violationRate)}${x.neverFired30d ? "  NEVER FIRED" : ""}`),
+    ...s.items.map((x) => `  ${x.itemId}  surfaced ${x.surfaced}  pulled ${x.pullRate}  cited ${x.cited}  use ${pct(x.useRate)}  noise ${pct(x.noiseRate)}  violated ${pct(x.violationRate)}${x.neverFired30d ? "  NEVER FIRED" : ""}`),
     ...s.domains.map((d) => `  domain ${d.domain}: writes ${d.writesPerMonth}/mo  reads ${d.readsPerMonth}/mo${d.deadDomain ? "  DEAD DOMAIN" : ""}`),
     `  agents: ${Object.entries(s.perAgentCoverage).map(([k, v2]) => `${k} ${v2}`).join(", ") || "none"}`
   ]);
@@ -30941,10 +31214,10 @@ knowledgeCommand.command("stats").description("Scores computed from the audit lo
   else for (const l of renderStats(all)) console.log(l);
 });
 function runKnowledgeCiteScan(o) {
-  const run = o.git_run ?? ((args) => spawnSync("git", args, { encoding: "utf8" }).stdout ?? "");
+  const run = o.git_run ?? ((args) => spawnSync2("git", args, { encoding: "utf8" }).stdout ?? "");
   if (o.git) {
     const since = new Date((o.audit?.now?.() ?? /* @__PURE__ */ new Date()).getTime() - (o.sinceDays ?? 30) * 864e5);
-    return readGitMessages(o.git, since, run).flatMap((c) => scanAndLogCitations({ text: c.text, ref: `git:${c.sha}`, project: o.project, at: c.at, sink: o.audit }));
+    return scanCitations(readGitMessages(o.git, since, run).map((c) => ({ text: c.text, ref: `git:${c.sha}`, at: c.at })), { project: o.project, sink: o.audit });
   }
   if (!o.text) throw new Error("Pass --text <message> or --git <repo>");
   return scanAndLogCitations({ text: o.text, ref: o.ref ?? "manual", project: o.project, sink: o.audit });