squadrant 0.27.0 → 0.28.0

package/dist/squadrantd.js

@@ -305,7 +305,8 @@ function validateRuleFrontmatter(fm) {
     if (fm[k] !== void 0 && !isStrArr(fm[k]))
       p.push(`${k} must be a string array`);
   }
-  if (!Array.isArray(fm.sources) || fm.sources.length === 0) {
+  const mayBeSourceless = fm.status === "stale" || fm.status === "retired";
+  if (!Array.isArray(fm.sources) || fm.sources.length === 0 && !mayBeSourceless) {
     p.push("sources must be a non-empty array");
   } else {
     fm.sources.forEach((s, i) => {
@@ -339,6 +340,26 @@ function validateSourceEntry(e) {
     p.push("domain must be a string");
   if (e.sensitivity !== void 0 && e.sensitivity !== "local-only")
     p.push("sensitivity must be 'local-only' when set");
+  if (e.review !== void 0 && e.review !== "required")
+    p.push("review must be 'required' when set");
+  return p;
+}
+function validateErratum(e) {
+  if (!isObj(e))
+    return ["erratum must be an object"];
+  const p = [];
+  if (typeof e.id !== "string" || !RULE_ID_RE.test(e.id))
+    p.push(`id must match ${RULE_ID_RE}`);
+  for (const k of ["ref", "quote", "reason"]) {
+    if (typeof e[k] !== "string" || e[k] === "")
+      p.push(`${k} must be a non-empty string`);
+  }
+  if (e.evidence !== void 0 && !isStrArr(e.evidence))
+    p.push("evidence must be a string array");
+  for (const k of ["checked", "by", "at", "decision"]) {
+    if (e[k] !== void 0 && typeof e[k] !== "string")
+      p.push(`${k} must be a string`);
+  }
   return p;
 }
 function kbConfigs(cfg) {
@@ -463,22 +484,22 @@ function defaultCmuxConfigPath() {
   return join(homedir(), ".config", "cmux", "cmux.json");
 }
 function ensureSocketAutomation(opts = {}) {
-  const path42 = opts.path ?? defaultCmuxConfigPath();
-  if (!existsSync(path42)) {
-    mkdirSync(dirname(path42), { recursive: true });
-    writeFileSync(path42, MINIMAL_TEMPLATE);
-    return { path: path42, changed: true, alreadySet: false };
+  const path43 = opts.path ?? defaultCmuxConfigPath();
+  if (!existsSync(path43)) {
+    mkdirSync(dirname(path43), { recursive: true });
+    writeFileSync(path43, MINIMAL_TEMPLATE);
+    return { path: path43, changed: true, alreadySet: false };
   }
-  const text = readFileSync(path42, "utf-8");
+  const text = readFileSync(path43, "utf-8");
   const current = parse(text)?.automation?.socketControlMode;
   if (current === AUTOMATION_MODE) {
-    return { path: path42, changed: false, alreadySet: true };
+    return { path: path43, changed: false, alreadySet: true };
   }
   const edits = modify(text, [...SOCKET_CONTROL_MODE_PATH], AUTOMATION_MODE, {
     formattingOptions: { insertSpaces: true, tabSize: 2 }
   });
-  writeFileSync(path42, applyEdits(text, edits));
-  return { path: path42, changed: true, alreadySet: false };
+  writeFileSync(path43, applyEdits(text, edits));
+  return { path: path43, changed: true, alreadySet: false };
 }
 var SOCKET_CONTROL_MODE_PATH, AUTOMATION_MODE, MINIMAL_TEMPLATE;
 var init_cmux_config = __esm({
@@ -628,9 +649,9 @@ import { join as join4 } from "path";
 function defaultStatePath() {
   return join4(homedir3(), ".config", "squadrant", "state", "cmux-autoconfig.json");
 }
-function readState(path42) {
+function readState(path43) {
   try {
-    return JSON.parse(readConfigFileSync(path42));
+    return JSON.parse(readConfigFileSync(path43));
   } catch {
     return {};
   }
@@ -2577,10 +2598,10 @@ function detectForeignInstall(parsed, thisEntry, registeredEntryExists) {
     isUpgrade: isVersionUpgrade(parsed.daemonEntry, thisEntry)
   };
 }
-function sanitizePathForPlist(path42) {
+function sanitizePathForPlist(path43) {
   const seen = /* @__PURE__ */ new Set();
   const stable = [];
-  for (const p of path42.split(":")) {
+  for (const p of path43.split(":")) {
     if (!p)
       continue;
     if (p.includes("/.claude/plugins/"))
@@ -5120,11 +5141,11 @@ var init_captain_record = __esm({
 // packages/core/dist/opencode-session.js
 import { execFileSync as execFileSync4 } from "child_process";
 async function listSessions(port, fetchImpl = fetch, timeoutMs = 5e3) {
-  for (const path42 of ["/session", "/api/session"]) {
+  for (const path43 of ["/session", "/api/session"]) {
     const ac = new AbortController();
     const t = setTimeout(() => ac.abort(), timeoutMs);
     try {
-      const res = await fetchImpl(`http://127.0.0.1:${port}${path42}`, { signal: ac.signal });
+      const res = await fetchImpl(`http://127.0.0.1:${port}${path43}`, { signal: ac.signal });
       if (!res.ok)
         continue;
       const rows = await res.json();
@@ -5817,10 +5838,10 @@ function distBuiltAt() {
     return 0;
   }
 }
-function gatherLogStats(path42, now, windowMs) {
+function gatherLogStats(path43, now, windowMs) {
   let sizeBytes = 0;
   try {
-    sizeBytes = statSync3(path42).size;
+    sizeBytes = statSync3(path43).size;
   } catch {
     return { errorCount: 0, sizeBytes: 0, windowMs };
   }
@@ -5831,7 +5852,7 @@ function gatherLogStats(path42, now, windowMs) {
   const len = sizeBytes - start;
   let text = "";
   try {
-    const fd = openSync2(path42, "r");
+    const fd = openSync2(path43, "r");
     try {
       const buf = Buffer.alloc(len);
       readSync(fd, buf, 0, len, start);
@@ -8077,8 +8098,8 @@ var init_stream = __esm({
 // packages/core/dist/router/shim.js
 import { createServer as createServer3 } from "http";
 import { Readable } from "stream";
-function joinUrl(base, path42) {
-  return base.replace(/\/+$/, "") + path42;
+function joinUrl(base, path43) {
+  return base.replace(/\/+$/, "") + path43;
 }
 async function readBody(req) {
   const chunks = [];
@@ -8254,8 +8275,8 @@ function createRouterShim(opts) {
     writeJson(res, 200, { input_tokens: Math.max(1, Math.ceil(text.length / 4)) });
   }
   function handler(req, res) {
-    const path42 = pathnameOf(req.url);
-    if (req.method === "POST" && path42 === "/v1/messages") {
+    const path43 = pathnameOf(req.url);
+    if (req.method === "POST" && path43 === "/v1/messages") {
       void handleMessages(req, res).catch((err) => {
         log(`router internal error: ${err instanceof Error ? err.message : String(err)}`);
         if (!res.headersSent) {
@@ -8267,18 +8288,18 @@ function createRouterShim(opts) {
       });
       return;
     }
-    if (req.method === "POST" && path42 === "/v1/messages/count_tokens") {
+    if (req.method === "POST" && path43 === "/v1/messages/count_tokens") {
       void handleCountTokens(req, res).catch(() => {
         if (!res.headersSent)
           writeJson(res, 502, anthropicError(502, "api_error", "router internal error").body);
       });
       return;
     }
-    if (req.method === "GET" && path42 === "/v1/models") {
+    if (req.method === "GET" && path43 === "/v1/models") {
       writeJson(res, 200, modelsList([...advertisedModels]));
       return;
     }
-    if (req.method === "GET" && path42 === "/healthz") {
+    if (req.method === "GET" && path43 === "/healthz") {
       writeJson(res, 200, { ready: server?.listening === true, upstreamReachable, lastError });
       return;
     }
@@ -8547,11 +8568,11 @@ async function probeCaptainChannel(project, opts = {}) {
   }
 }
 async function httpReachable(port, fetchImpl, timeoutMs) {
-  for (const path42 of ["/session", "/api/session"]) {
+  for (const path43 of ["/session", "/api/session"]) {
     const ac = new AbortController();
     const t = setTimeout(() => ac.abort(), timeoutMs);
     try {
-      const res = await fetchImpl(`http://127.0.0.1:${port}${path42}`, { signal: ac.signal });
+      const res = await fetchImpl(`http://127.0.0.1:${port}${path43}`, { signal: ac.signal });
       if (res.ok)
         return true;
     } catch {
@@ -9408,16 +9429,281 @@ var init_paths = __esm({
   }
 });
 
-// packages/core/dist/knowledge/store.js
+// packages/core/dist/knowledge/ingest.js
+import crypto3 from "crypto";
 import fs15 from "fs";
 import os7 from "os";
 import path16 from "path";
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+function refFor(kbRoot, file) {
+  const rel = path16.relative(kbRoot, file);
+  if (rel && !rel.startsWith("..") && !path16.isAbsolute(rel))
+    return rel.split(path16.sep).join("/");
+  const home = os7.homedir();
+  return file.startsWith(home + path16.sep) ? `~/${path16.relative(home, file).split(path16.sep).join("/")}` : file;
+}
+function readState2(kbRoot, ref) {
+  try {
+    return JSON.parse(fs15.readFileSync(stampFile(kbRoot, ref), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writeState(kbRoot, st) {
+  fs15.mkdirSync(path16.join(kbRoot, CONVERTED_DIR), { recursive: true });
+  fs15.writeFileSync(stampFile(kbRoot, st.ref), JSON.stringify(st) + "\n");
+}
+function globToRegExp(glob) {
+  let re = "";
+  for (let i = 0; i < glob.length; i++) {
+    const c = glob[i];
+    if (c === "*") {
+      if (glob[i + 1] === "*") {
+        re += glob[i + 2] === "/" ? "(?:.*/)?" : ".*";
+        i += glob[i + 2] === "/" ? 2 : 1;
+      } else
+        re += "[^/]*";
+    } else if (c === "?")
+      re += "[^/]";
+    else
+      re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  }
+  return new RegExp(`^${re}$`);
+}
+function walkFiles(dir, out = []) {
+  if (!fs15.existsSync(dir))
+    return out;
+  for (const ent of fs15.readdirSync(dir, { withFileTypes: true })) {
+    if (ent.name === ".git" || ent.name === CONVERTED_DIR || ent.name === "node_modules")
+      continue;
+    const full = path16.join(dir, ent.name);
+    if (ent.isDirectory())
+      walkFiles(full, out);
+    else if (ent.isFile())
+      out.push(full);
+  }
+  return out;
+}
+function expandSource(kbRoot, entry) {
+  const abs = path16.resolve(kbRoot, expandHome(entry.path));
+  if (!/[*?]/.test(entry.path))
+    return fs15.existsSync(abs) && fs15.statSync(abs).isFile() ? [abs] : [];
+  const base = abs.split(/[*?]/)[0];
+  const root = base.endsWith(path16.sep) ? base : path16.dirname(base);
+  const re = globToRegExp(abs.split(path16.sep).join("/"));
+  return walkFiles(root).filter((f) => re.test(f.split(path16.sep).join("/"))).sort();
+}
+function sourceCovers(kbRoot, entry, ref) {
+  const abs = path16.resolve(kbRoot, expandHome(entry.path));
+  const file = fileForRef(kbRoot, ref);
+  return /[*?]/.test(entry.path) ? globToRegExp(abs.split(path16.sep).join("/")).test(file.split(path16.sep).join("/")) : abs === file;
+}
+function detectChange(kbRoot, file) {
+  const ref = refFor(kbRoot, file);
+  const st = fs15.statSync(file);
+  const prior = readState2(kbRoot, ref);
+  if (prior && prior.size === st.size && prior.mtimeMs === st.mtimeMs) {
+    return { ref, changed: false, stamp: { sha: prior.sha, size: st.size, mtimeMs: st.mtimeMs }, prior };
+  }
+  const sha = sha256(file);
+  return { ref, changed: !prior || prior.sha !== sha, stamp: { sha, size: st.size, mtimeMs: st.mtimeMs }, prior };
+}
+function splitSections(text) {
+  const cuts = [];
+  const re = /^#{1,6}[ \t]+(.+)$/gm;
+  for (let m = re.exec(text); m; m = re.exec(text))
+    cuts.push({ at: m.index, heading: m[1].trim() });
+  if (!cuts.length || cuts[0].at > 0)
+    cuts.unshift({ at: 0 });
+  const spans = [];
+  cuts.forEach((c, i) => {
+    const end = i + 1 < cuts.length ? cuts[i + 1].at : text.length;
+    let start = c.at;
+    while (end - start > SECTION_TARGET_CHARS * 1.5) {
+      const brk = text.indexOf("\n\n", start + SECTION_TARGET_CHARS);
+      if (brk < 0 || brk >= end)
+        break;
+      spans.push({ index: 0, start, end: brk, heading: c.heading });
+      start = brk + 2;
+    }
+    if (text.slice(start, end).trim())
+      spans.push({ index: 0, start, end, heading: c.heading });
+  });
+  return spans.map((s, i) => ({ ...s, index: i }));
+}
+async function planIngest(kbRoot, opts) {
+  const converter = opts.converter ?? markitdownConverter;
+  const cap = opts.maxSectionsPerPass ?? DEFAULT_MAX_SECTIONS_PER_PASS;
+  const plan = { sources: [], skipped: [], failed: [], carriedSections: 0, sectionCount: 0, estimatedTokens: 0, existing: opts.existing ?? [] };
+  let budget = cap;
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of opts.sources) {
+    for (const file of expandSource(kbRoot, entry)) {
+      const { ref, changed, stamp, prior } = detectChange(kbRoot, file);
+      if (seen.has(ref))
+        continue;
+      seen.add(ref);
+      const pending = !!prior && prior.cursor < prior.sections;
+      if (!changed && !pending)
+        continue;
+      if (entry.sensitivity === "local-only" && !opts.localModel) {
+        plan.skipped.push({ ref, reason: "sensitivity: local-only and no local model available" });
+        continue;
+      }
+      if (budget <= 0) {
+        plan.carriedSections += changed ? 1 : prior.sections - prior.cursor;
+        continue;
+      }
+      let text;
+      const conv = convertedFile(kbRoot, ref);
+      try {
+        if (!changed && fs15.existsSync(conv))
+          text = fs15.readFileSync(conv, "utf8");
+        else {
+          text = PASS_THROUGH.has(path16.extname(file).toLowerCase()) ? fs15.readFileSync(file, "utf8") : await converter(file);
+          if (!opts.dryRun) {
+            fs15.mkdirSync(path16.dirname(conv), { recursive: true });
+            fs15.writeFileSync(conv, text);
+          }
+        }
+      } catch (e) {
+        plan.failed.push({ ref, error: e.message.split("\n")[0] });
+        continue;
+      }
+      const all = splitSections(text);
+      const from = changed ? 0 : prior.cursor;
+      const take = all.slice(from, from + budget);
+      budget -= take.length;
+      plan.carriedSections += all.length - from - take.length;
+      plan.sectionCount += take.length;
+      plan.estimatedTokens += Math.ceil(take.reduce((n, s) => n + (s.end - s.start), 0) / CHARS_PER_TOKEN);
+      plan.sources.push({
+        ref,
+        file,
+        converted: conv,
+        sha: stamp.sha,
+        priority: entry.priority,
+        domain: entry.domain,
+        sensitivity: entry.sensitivity,
+        sections: take,
+        totalSections: all.length
+      });
+      if (!opts.dryRun)
+        writeState(kbRoot, { ref, ...stamp, sections: all.length, cursor: from + take.length, priority: entry.priority });
+    }
+  }
+  return plan;
+}
+var execFileAsync, CONVERTED_DIR, DEFAULT_MAX_SECTIONS_PER_PASS, CHARS_PER_TOKEN, PASS_THROUGH, SECTION_TARGET_CHARS, markitdownConverter, expandHome, fileForRef, cacheKey, convertedFile, stampFile, isGatedRef, sha256;
+var init_ingest = __esm({
+  "packages/core/dist/knowledge/ingest.js"() {
+    execFileAsync = promisify2(execFile2);
+    CONVERTED_DIR = ".converted";
+    DEFAULT_MAX_SECTIONS_PER_PASS = 40;
+    CHARS_PER_TOKEN = 4;
+    PASS_THROUGH = /* @__PURE__ */ new Set([".md", ".markdown", ".txt"]);
+    SECTION_TARGET_CHARS = 4e3;
+    markitdownConverter = async (file) => {
+      const { stdout } = await execFileAsync("markitdown", [file], { maxBuffer: 64 * 1024 * 1024 });
+      return stdout;
+    };
+    expandHome = (p) => p === "~" || p.startsWith("~/") ? path16.join(os7.homedir(), p.slice(1)) : p;
+    fileForRef = (kbRoot, ref) => path16.resolve(kbRoot, expandHome(ref));
+    cacheKey = (ref) => `${ref.replace(/[^A-Za-z0-9._-]+/g, "_")}.${crypto3.createHash("sha1").update(ref).digest("hex").slice(0, 6)}`;
+    convertedFile = (kbRoot, ref) => path16.join(kbRoot, CONVERTED_DIR, `${cacheKey(ref)}.md`);
+    stampFile = (kbRoot, ref) => path16.join(kbRoot, CONVERTED_DIR, `${cacheKey(ref)}.sha`);
+    isGatedRef = (kbRoot, sources, ref) => sources.some((e) => e.review === "required" && sourceCovers(kbRoot, e, ref));
+    sha256 = (file) => crypto3.createHash("sha256").update(fs15.readFileSync(file)).digest("hex");
+  }
+});
+
+// packages/core/dist/knowledge/verify.js
+function normalizeWithMap(src, keepBreakHyphen = false) {
+  const out = [];
+  const map2 = [];
+  const push = (s, at) => {
+    for (const ch of s) {
+      out.push(ch);
+      map2.push(at);
+    }
+  };
+  let i = 0;
+  while (i < src.length) {
+    const ch = src[i];
+    if (ch === "-" && /^-[ \t]*\r?\n[ \t]*[a-z]/.test(src.slice(i, i + 40)) && i > 0 && /[A-Za-z]/.test(src[i - 1])) {
+      if (keepBreakHyphen)
+        push("-", i);
+      i++;
+      while (/\s/.test(src[i]))
+        i++;
+      continue;
+    }
+    if (/\s/.test(ch)) {
+      const start = i;
+      while (i < src.length && /\s/.test(src[i]))
+        i++;
+      if (out.length && out[out.length - 1] !== " ")
+        push(" ", start);
+      continue;
+    }
+    if (MARKUP.has(ch)) {
+      i++;
+      continue;
+    }
+    if (LIGATURES[ch])
+      push(LIGATURES[ch], i);
+    else if (QUOTES[ch])
+      push(QUOTES[ch], i);
+    else if (DASHES.has(ch))
+      push("-", i);
+    else
+      push(ch, i);
+    i++;
+  }
+  while (out.length && out[out.length - 1] === " ") {
+    out.pop();
+    map2.pop();
+  }
+  return { text: out.join(""), map: map2 };
+}
+function findQuote(source, quote) {
+  const needle = normalizeText(quote);
+  if (!needle)
+    return null;
+  const views = typeof source === "string" ? normalizedViews(source) : source;
+  for (const hay of views) {
+    const at = hay.text.indexOf(needle);
+    if (at >= 0)
+      return [hay.map[at], hay.map[at + needle.length - 1] + 1];
+  }
+  return null;
+}
+var LIGATURES, QUOTES, DASHES, MARKUP, normalizeText, normalizedViews, DOCLING_DROP_THRESHOLD, needsDocling, spansOverlap;
+var init_verify = __esm({
+  "packages/core/dist/knowledge/verify.js"() {
+    LIGATURES = { "\uFB01": "fi", "\uFB02": "fl", "\uFB00": "ff", "\uFB03": "ffi", "\uFB04": "ffl", "\uFB05": "st", "\uFB06": "st" };
+    QUOTES = { "\u2018": "'", "\u2019": "'", "\u201A": "'", "\u201B": "'", "\u201C": '"', "\u201D": '"', "\u201E": '"', "\u201F": '"' };
+    DASHES = /* @__PURE__ */ new Set(["\u2010", "\u2011", "\u2012", "\u2013", "\u2014", "\u2015", "\u2212"]);
+    MARKUP = /* @__PURE__ */ new Set(["*", "_", "`", "\\"]);
+    normalizeText = (s) => normalizeWithMap(s).text;
+    normalizedViews = (src) => [normalizeWithMap(src), normalizeWithMap(src, true)];
+    DOCLING_DROP_THRESHOLD = 0.2;
+    needsDocling = (dropped, total) => total > 0 && dropped / total > DOCLING_DROP_THRESHOLD;
+    spansOverlap = (a, b) => a[0] < b[1] && b[0] < a[1];
+  }
+});
+
+// packages/core/dist/knowledge/store.js
+import fs16 from "fs";
+import os8 from "os";
+import path17 from "path";
 import matter2 from "gray-matter";
 function duplicateIdProblem(id, ignored, used) {
   return `duplicate id ${id}: ${ignored} is ignored, ${used} is used (live files win over _proposed, then path order). Fix: rename the id in one file, or delete or move one of them.`;
 }
 function isPendingProposalDup(e, rulesDir) {
-  return e.problems.every((p) => p.startsWith("duplicate id")) && path16.relative(rulesDir, e.file).split(path16.sep).includes(PROPOSED_DIR);
+  return e.problems.every((p) => p.startsWith("duplicate id")) && path17.relative(rulesDir, e.file).split(path17.sep).includes(PROPOSED_DIR);
 }
 function splitStatement(body) {
   const first = body.trim().split(/\n\s*\n/)[0] ?? "";
@@ -9426,8 +9712,8 @@ function splitStatement(body) {
 function listMarkdown(dir, includeProposed) {
   const out = [];
   const walk = (d) => {
-    for (const ent of fs15.readdirSync(d, { withFileTypes: true })) {
-      const full = path16.join(d, ent.name);
+    for (const ent of fs16.readdirSync(d, { withFileTypes: true })) {
+      const full = path17.join(d, ent.name);
       if (ent.isDirectory()) {
         if (ent.name === PROPOSED_DIR && !includeProposed)
           continue;
@@ -9438,11 +9724,11 @@ function listMarkdown(dir, includeProposed) {
     }
   };
   walk(dir);
-  const isProposed = (f) => path16.relative(dir, f).split(path16.sep).includes(PROPOSED_DIR);
+  const isProposed = (f) => path17.relative(dir, f).split(path17.sep).includes(PROPOSED_DIR);
   return out.sort((a, b) => Number(isProposed(a)) - Number(isProposed(b)) || (a < b ? -1 : a > b ? 1 : 0));
 }
 function loadRulesDir(dir, layer, opts = {}) {
-  if (!fs15.existsSync(dir))
+  if (!fs16.existsSync(dir))
     return { rules: [], errors: [] };
   const rules = [];
   const errors = [];
@@ -9450,7 +9736,7 @@ function loadRulesDir(dir, layer, opts = {}) {
   for (const file of listMarkdown(dir, opts.includeProposed ?? false)) {
     let parsed;
     try {
-      parsed = matter2(fs15.readFileSync(file, "utf8"), NO_JS_FRONTMATTER);
+      parsed = matter2(fs16.readFileSync(file, "utf8"), NO_JS_FRONTMATTER);
     } catch (e) {
       errors.push({ file, problems: [`frontmatter parse error: ${e.message}`] });
       continue;
@@ -9474,14 +9760,14 @@ function loadRulesDir(dir, layer, opts = {}) {
 function resolveSourceRef(ref, kbRoot, sources) {
   const bases = /* @__PURE__ */ new Set([kbRoot]);
   for (const s of sources) {
-    let d = path16.resolve(kbRoot, expandHome(s.path.split(/[*?[{]/)[0]));
-    for (let i = 0; i < 6 && d !== path16.dirname(d); i++) {
-      d = path16.dirname(d);
+    let d = path17.resolve(kbRoot, expandHome2(s.path.split(/[*?[{]/)[0]));
+    for (let i = 0; i < 6 && d !== path17.dirname(d); i++) {
+      d = path17.dirname(d);
       bases.add(d);
     }
   }
-  const cands = [path16.resolve(kbRoot, expandHome(ref)), ...[...bases].map((b) => path16.join(b, ref))];
-  return cands.find((c) => fs15.existsSync(c) && fs15.statSync(c).isFile());
+  const cands = [path17.resolve(kbRoot, expandHome2(ref)), ...[...bases].map((b) => path17.join(b, ref))];
+  return cands.find((c) => fs16.existsSync(c) && fs16.statSync(c).isFile());
 }
 function validateKb(opts) {
   const { rules, errors } = loadRulesDir(opts.rulesDir, "kb", { includeProposed: true });
@@ -9489,7 +9775,7 @@ function validateKb(opts) {
   const dups = errors.filter((e) => e.problems.some((p) => p.startsWith("duplicate id")) && !isPendingProposalDup(e, opts.rulesDir));
   const pendingDups = errors.filter((e) => isPendingProposalDup(e, opts.rulesDir)).length;
   const invalid = errors.filter((e) => !dups.includes(e) && !isPendingProposalDup(e, opts.rulesDir));
-  const proposed = rules.filter((r) => path16.relative(opts.rulesDir, r.file).split(path16.sep).includes(PROPOSED_DIR)).length;
+  const proposed = rules.filter((r) => path17.relative(opts.rulesDir, r.file).split(path17.sep).includes(PROPOSED_DIR)).length;
   checks.push({ level: "ok", message: `${rules.length + errors.length} rule files read (${rules.length - proposed} live, ${proposed + pendingDups} proposed parsed OK)` });
   if (invalid.length)
     for (const e of invalid)
@@ -9502,7 +9788,7 @@ function validateKb(opts) {
   else
     checks.push({ level: "ok", message: "no duplicate ids" });
   const cache = /* @__PURE__ */ new Map();
-  let verified = 0, unresolved = 0;
+  let verified = 0, unresolved = 0, notIngested = 0;
   for (const r of rules) {
     r.sources.forEach((src, i) => {
       const file = resolveSourceRef(src.ref, opts.kbRoot, opts.sources);
@@ -9510,16 +9796,33 @@ function validateKb(opts) {
         unresolved++;
         return;
       }
-      if (!cache.has(file))
-        cache.set(file, fs15.readFileSync(file, "utf8"));
-      if (cache.get(file).includes(src.quote))
+      const key = `${src.ref}\0${file}`;
+      if (!cache.has(key)) {
+        const conv = readState2(opts.kbRoot, src.ref) ? convertedFile(opts.kbRoot, src.ref) : null;
+        const cached = !!conv && fs16.existsSync(conv);
+        cache.set(key, {
+          hay: normalizedViews(fs16.readFileSync(cached ? conv : file, "utf8")),
+          convertible: !cached && !PASS_THROUGH.has(path17.extname(file).toLowerCase())
+        });
+      }
+      const { hay, convertible } = cache.get(key);
+      const span = findQuote(hay, src.quote);
+      if (span) {
         verified++;
+        const active = r.status === "active" && !path17.relative(opts.rulesDir, r.file).split(path17.sep).includes(PROPOSED_DIR);
+        const err = active ? (opts.errata ?? []).find((e) => e.ref === src.ref && ((o) => !!o && spansOverlap(o, span))(findQuote(hay, e.quote))) : void 0;
+        if (err)
+          checks.push({ level: "warn", message: `${r.id}: grounded in erratum ${err.id} (${err.reason}); re-check or retire it (${r.file})` });
+      } else if (convertible)
+        notIngested++;
       else
         checks.push({ level: "fail", message: `quote not found in ${file}: ${r.id} sources[${i}] (${r.file})` });
     });
   }
   if (!checks.some((c) => c.message.startsWith("quote not found")))
     checks.push({ level: "ok", message: `${verified} source quotes found in their source files` });
+  if (notIngested)
+    checks.push({ level: "skip", message: `${notIngested} source refs need conversion but have no .converted cache, quote not checked (run \`squadrant knowledge ingest <kb>\`)` });
   if (unresolved)
     checks.push({ level: "skip", message: `${unresolved} source refs not resolvable on this machine, quote not checked` });
   if (opts.domains) {
@@ -9530,22 +9833,24 @@ function validateKb(opts) {
   }
   return { checks, ok: !checks.some((c) => c.level === "fail") };
 }
-var NO_JS_FRONTMATTER, expandHome;
+var NO_JS_FRONTMATTER, expandHome2;
 var init_store2 = __esm({
   "packages/core/dist/knowledge/store.js"() {
     init_dist();
+    init_ingest();
     init_paths();
+    init_verify();
     NO_JS_FRONTMATTER = {
       engines: { javascript: { parse: () => {
         throw new Error("only YAML front matter is allowed");
       } } }
     };
-    expandHome = (p) => p === "~" || p.startsWith("~/") ? path16.join(os7.homedir(), p.slice(1)) : p;
+    expandHome2 = (p) => p === "~" || p.startsWith("~/") ? path17.join(os8.homedir(), p.slice(1)) : p;
   }
 });
 
 // packages/core/dist/knowledge/layers.js
-import fs16 from "fs";
+import fs17 from "fs";
 function loadKbRules(cfg, kb, opts = {}) {
   return loadRulesDir(kbRulesDir(cfg, kb), `kb:${kb}`, opts);
 }
@@ -9557,7 +9862,7 @@ function resolveProjectRules(cfg, project, opts = {}) {
   const errors = [];
   const warnings = [];
   for (const kb of subscribedKbs(cfg, project)) {
-    if (!fs16.existsSync(kbDir(cfg, kb))) {
+    if (!fs17.existsSync(kbDir(cfg, kb))) {
       warnings.push(`knowledge base '${kb}' not found (run: squadrant knowledge init ${kb})`);
       continue;
     }
@@ -9595,8 +9900,8 @@ var init_layers = __esm({
 });
 
 // packages/core/dist/knowledge/index-file.js
-import fs17 from "fs";
-import path17 from "path";
+import fs18 from "fs";
+import path18 from "path";
 function compileIndex(kb, rules, now = /* @__PURE__ */ new Date()) {
   return {
     kb,
@@ -9605,18 +9910,18 @@ function compileIndex(kb, rules, now = /* @__PURE__ */ new Date()) {
   };
 }
 function writeIndex(kbRoot, index) {
-  const file = path17.join(kbRoot, "index.json");
+  const file = path18.join(kbRoot, "index.json");
   const tmp = `${file}.tmp-${process.pid}`;
-  fs17.writeFileSync(tmp, JSON.stringify(index, null, 2) + "\n");
-  fs17.renameSync(tmp, file);
+  fs18.writeFileSync(tmp, JSON.stringify(index, null, 2) + "\n");
+  fs18.renameSync(tmp, file);
   return file;
 }
 function readIndex(kbRoot, kb) {
-  const file = path17.join(kbRoot, "index.json");
-  if (!fs17.existsSync(file))
+  const file = path18.join(kbRoot, "index.json");
+  if (!fs18.existsSync(file))
     return { index: null, problem: `index.json missing for kb '${kb}'` };
   try {
-    const index = JSON.parse(fs17.readFileSync(file, "utf8"));
+    const index = JSON.parse(fs18.readFileSync(file, "utf8"));
     if (!Array.isArray(index.rules))
       return { index: null, problem: `index.json corrupt for kb '${kb}' (no rules array)` };
     return { index };
@@ -12711,15 +13016,16 @@ var init_js_yaml = __esm({
 });
 
 // packages/core/dist/knowledge/sources.js
-import fs18 from "fs";
-import path18 from "path";
-function loadSources(kbRoot) {
-  const file = path18.join(kbRoot, "sources.yaml");
-  if (!fs18.existsSync(file))
+import fs19 from "fs";
+import path19 from "path";
+import matter3 from "gray-matter";
+function loadSources(kbRoot) {
+  const file = path19.join(kbRoot, "sources.yaml");
+  if (!fs19.existsSync(file))
     return { sources: [], errors: [] };
   let data;
   try {
-    data = yaml.load(fs18.readFileSync(file, "utf8"));
+    data = yaml.load(fs19.readFileSync(file, "utf8"));
   } catch (e) {
     return { sources: [], errors: [`YAML parse error: ${e.message.split("\n")[0]}`] };
   }
@@ -12738,208 +13044,82 @@ function loadSources(kbRoot) {
   });
   return { sources, errors };
 }
+function dropEntryBlock(text, entryPath) {
+  const lines = text.split("\n");
+  const q = entryPath.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const head = new RegExp(`^-\\s+path:\\s*(['"]?)${q}\\1\\s*(#.*)?$`);
+  const i = lines.findIndex((l) => head.test(l));
+  if (i < 0)
+    return null;
+  let j = i + 1;
+  while (j < lines.length && /^\s+\S/.test(lines[j]))
+    j++;
+  return [...lines.slice(0, i), ...lines.slice(j)].join("\n");
+}
+function removeSource(kbRoot, rulesDir, entryPath, opts = {}) {
+  const file = path19.join(kbRoot, "sources.yaml");
+  const { sources } = loadSources(kbRoot);
+  const entry = sources.find((s) => s.path === entryPath);
+  if (!entry)
+    throw new Error(`no sources.yaml entry with path '${entryPath}' (give it exactly as listed by \`knowledge sources\`)`);
+  const edited = dropEntryBlock(fs19.readFileSync(file, "utf8"), entryPath);
+  if (edited === null)
+    throw new Error(`could not edit sources.yaml for '${entryPath}' (not a plain block entry); remove it by hand, then rerun to strip the refs`);
+  const res = { dryRun: !!opts.dryRun, entryRemoved: true, stripped: [], stale: [] };
+  const writes = [];
+  for (const rule of loadRulesDir(rulesDir, "kb").rules) {
+    const kept = rule.sources.filter((s) => !sourceCovers(kbRoot, entry, s.ref));
+    if (kept.length === rule.sources.length)
+      continue;
+    res.stripped.push(rule.id);
+    const parsed = matter3(fs19.readFileSync(rule.file, "utf8"), { engines: { javascript: () => {
+      throw new Error("only YAML front matter is allowed");
+    } } });
+    const fm = { ...parsed.data, sources: kept };
+    if (!kept.length) {
+      res.stale.push(rule.id);
+      if (fm.status === "active")
+        fm.status = "stale";
+    }
+    writes.push({ file: rule.file, text: matter3.stringify(parsed.content, JSON.parse(JSON.stringify(fm))) });
+  }
+  res.stripped.sort();
+  res.stale.sort();
+  if (opts.dryRun)
+    return res;
+  for (const w of writes)
+    fs19.writeFileSync(w.file, w.text);
+  fs19.writeFileSync(file, edited);
+  const name = opts.kbName ?? path19.basename(kbRoot);
+  writeIndex(kbRoot, compileIndex(name, loadRulesDir(rulesDir, `kb:${name}`).rules));
+  return res;
+}
 var SOURCES_TEMPLATE;
 var init_sources = __esm({
   "packages/core/dist/knowledge/sources.js"() {
     init_js_yaml();
     init_dist();
+    init_index_file();
+    init_ingest();
+    init_store2();
     SOURCES_TEMPLATE = `# Trusted sources for this knowledge base (spec \xA73). Only these can produce rules.
 # priority: company > project > agent (decides conflicts).
 # sensitivity: local-only  \u2192 never sent to a hosted model (D12).
+# review: required         \u2192 new rules from this source wait in rules/_proposed/ for the operator; they never go live on their own.
 #
 # - path: raw/finance/**
 #   priority: company
 # - path: ~/work/flooros/docs/handbook/**
 #   priority: project
 #   domain: coding
+# - path: raw/**
+#   priority: agent
+#   review: required
 []
 `;
   }
 });
 
-// packages/core/dist/knowledge/ingest.js
-import crypto3 from "crypto";
-import fs19 from "fs";
-import os8 from "os";
-import path19 from "path";
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
-function refFor(kbRoot, file) {
-  const rel = path19.relative(kbRoot, file);
-  if (rel && !rel.startsWith("..") && !path19.isAbsolute(rel))
-    return rel.split(path19.sep).join("/");
-  const home = os8.homedir();
-  return file.startsWith(home + path19.sep) ? `~/${path19.relative(home, file).split(path19.sep).join("/")}` : file;
-}
-function readState2(kbRoot, ref) {
-  try {
-    return JSON.parse(fs19.readFileSync(stampFile(kbRoot, ref), "utf8"));
-  } catch {
-    return null;
-  }
-}
-function writeState(kbRoot, st) {
-  fs19.mkdirSync(path19.join(kbRoot, CONVERTED_DIR), { recursive: true });
-  fs19.writeFileSync(stampFile(kbRoot, st.ref), JSON.stringify(st) + "\n");
-}
-function globToRegExp(glob) {
-  let re = "";
-  for (let i = 0; i < glob.length; i++) {
-    const c = glob[i];
-    if (c === "*") {
-      if (glob[i + 1] === "*") {
-        re += glob[i + 2] === "/" ? "(?:.*/)?" : ".*";
-        i += glob[i + 2] === "/" ? 2 : 1;
-      } else
-        re += "[^/]*";
-    } else if (c === "?")
-      re += "[^/]";
-    else
-      re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-  }
-  return new RegExp(`^${re}$`);
-}
-function walkFiles(dir, out = []) {
-  if (!fs19.existsSync(dir))
-    return out;
-  for (const ent of fs19.readdirSync(dir, { withFileTypes: true })) {
-    if (ent.name === ".git" || ent.name === CONVERTED_DIR || ent.name === "node_modules")
-      continue;
-    const full = path19.join(dir, ent.name);
-    if (ent.isDirectory())
-      walkFiles(full, out);
-    else if (ent.isFile())
-      out.push(full);
-  }
-  return out;
-}
-function expandSource(kbRoot, entry) {
-  const abs = path19.resolve(kbRoot, expandHome2(entry.path));
-  if (!/[*?]/.test(entry.path))
-    return fs19.existsSync(abs) && fs19.statSync(abs).isFile() ? [abs] : [];
-  const base = abs.split(/[*?]/)[0];
-  const root = base.endsWith(path19.sep) ? base : path19.dirname(base);
-  const re = globToRegExp(abs.split(path19.sep).join("/"));
-  return walkFiles(root).filter((f) => re.test(f.split(path19.sep).join("/"))).sort();
-}
-function detectChange(kbRoot, file) {
-  const ref = refFor(kbRoot, file);
-  const st = fs19.statSync(file);
-  const prior = readState2(kbRoot, ref);
-  if (prior && prior.size === st.size && prior.mtimeMs === st.mtimeMs) {
-    return { ref, changed: false, stamp: { sha: prior.sha, size: st.size, mtimeMs: st.mtimeMs }, prior };
-  }
-  const sha = sha256(file);
-  return { ref, changed: !prior || prior.sha !== sha, stamp: { sha, size: st.size, mtimeMs: st.mtimeMs }, prior };
-}
-function splitSections(text) {
-  const cuts = [];
-  const re = /^#{1,6}[ \t]+(.+)$/gm;
-  for (let m = re.exec(text); m; m = re.exec(text))
-    cuts.push({ at: m.index, heading: m[1].trim() });
-  if (!cuts.length || cuts[0].at > 0)
-    cuts.unshift({ at: 0 });
-  const spans = [];
-  cuts.forEach((c, i) => {
-    const end = i + 1 < cuts.length ? cuts[i + 1].at : text.length;
-    let start = c.at;
-    while (end - start > SECTION_TARGET_CHARS * 1.5) {
-      const brk = text.indexOf("\n\n", start + SECTION_TARGET_CHARS);
-      if (brk < 0 || brk >= end)
-        break;
-      spans.push({ index: 0, start, end: brk, heading: c.heading });
-      start = brk + 2;
-    }
-    if (text.slice(start, end).trim())
-      spans.push({ index: 0, start, end, heading: c.heading });
-  });
-  return spans.map((s, i) => ({ ...s, index: i }));
-}
-async function planIngest(kbRoot, opts) {
-  const converter = opts.converter ?? markitdownConverter;
-  const cap = opts.maxSectionsPerPass ?? DEFAULT_MAX_SECTIONS_PER_PASS;
-  const plan = { sources: [], skipped: [], failed: [], carriedSections: 0, sectionCount: 0, estimatedTokens: 0, existing: opts.existing ?? [] };
-  let budget = cap;
-  const seen = /* @__PURE__ */ new Set();
-  for (const entry of opts.sources) {
-    for (const file of expandSource(kbRoot, entry)) {
-      const { ref, changed, stamp, prior } = detectChange(kbRoot, file);
-      if (seen.has(ref))
-        continue;
-      seen.add(ref);
-      const pending = !!prior && prior.cursor < prior.sections;
-      if (!changed && !pending)
-        continue;
-      if (entry.sensitivity === "local-only" && !opts.localModel) {
-        plan.skipped.push({ ref, reason: "sensitivity: local-only and no local model available" });
-        continue;
-      }
-      if (budget <= 0) {
-        plan.carriedSections += changed ? 1 : prior.sections - prior.cursor;
-        continue;
-      }
-      let text;
-      const conv = convertedFile(kbRoot, ref);
-      try {
-        if (!changed && fs19.existsSync(conv))
-          text = fs19.readFileSync(conv, "utf8");
-        else {
-          text = PASS_THROUGH.has(path19.extname(file).toLowerCase()) ? fs19.readFileSync(file, "utf8") : await converter(file);
-          if (!opts.dryRun) {
-            fs19.mkdirSync(path19.dirname(conv), { recursive: true });
-            fs19.writeFileSync(conv, text);
-          }
-        }
-      } catch (e) {
-        plan.failed.push({ ref, error: e.message.split("\n")[0] });
-        continue;
-      }
-      const all = splitSections(text);
-      const from = changed ? 0 : prior.cursor;
-      const take = all.slice(from, from + budget);
-      budget -= take.length;
-      plan.carriedSections += all.length - from - take.length;
-      plan.sectionCount += take.length;
-      plan.estimatedTokens += Math.ceil(take.reduce((n, s) => n + (s.end - s.start), 0) / CHARS_PER_TOKEN);
-      plan.sources.push({
-        ref,
-        file,
-        converted: conv,
-        sha: stamp.sha,
-        priority: entry.priority,
-        domain: entry.domain,
-        sensitivity: entry.sensitivity,
-        sections: take,
-        totalSections: all.length
-      });
-      if (!opts.dryRun)
-        writeState(kbRoot, { ref, ...stamp, sections: all.length, cursor: from + take.length, priority: entry.priority });
-    }
-  }
-  return plan;
-}
-var execFileAsync, CONVERTED_DIR, DEFAULT_MAX_SECTIONS_PER_PASS, CHARS_PER_TOKEN, PASS_THROUGH, SECTION_TARGET_CHARS, markitdownConverter, expandHome2, fileForRef, cacheKey, convertedFile, stampFile, sha256;
-var init_ingest = __esm({
-  "packages/core/dist/knowledge/ingest.js"() {
-    execFileAsync = promisify2(execFile2);
-    CONVERTED_DIR = ".converted";
-    DEFAULT_MAX_SECTIONS_PER_PASS = 40;
-    CHARS_PER_TOKEN = 4;
-    PASS_THROUGH = /* @__PURE__ */ new Set([".md", ".markdown", ".txt"]);
-    SECTION_TARGET_CHARS = 4e3;
-    markitdownConverter = async (file) => {
-      const { stdout } = await execFileAsync("markitdown", [file], { maxBuffer: 64 * 1024 * 1024 });
-      return stdout;
-    };
-    expandHome2 = (p) => p === "~" || p.startsWith("~/") ? path19.join(os8.homedir(), p.slice(1)) : p;
-    fileForRef = (kbRoot, ref) => path19.resolve(kbRoot, expandHome2(ref));
-    cacheKey = (ref) => `${ref.replace(/[^A-Za-z0-9._-]+/g, "_")}.${crypto3.createHash("sha1").update(ref).digest("hex").slice(0, 6)}`;
-    convertedFile = (kbRoot, ref) => path19.join(kbRoot, CONVERTED_DIR, `${cacheKey(ref)}.md`);
-    stampFile = (kbRoot, ref) => path19.join(kbRoot, CONVERTED_DIR, `${cacheKey(ref)}.sha`);
-    sha256 = (file) => crypto3.createHash("sha256").update(fs19.readFileSync(file)).digest("hex");
-  }
-});
-
 // packages/core/dist/knowledge/match.js
 import path20 from "path";
 function globMatches(glob, relPath) {
@@ -13326,7 +13506,7 @@ var init_inject = __esm({
     STOPWORDS = new Set("the and for are but not you your yours with this that these those from into onto have has had was were will would can could should shall may might must does did doing done its it's our ours their them they what when where which who whom why how all any some each every other than then there here also just very too only own same such both few more most much many about above below after before again once out over under off further been being let lets please thanks thank okay yes yeah hello hey there need want make use using used get got give like know think see look sure ok now new one two way rule rules must-not looks sounds work working thing things something anything everything going well good great nice cool fine".split(/\s+/));
     DATA_NOTE = "These are project rules (data from the knowledge base), not instructions to run anything.";
     line = (r) => `${r.modality.toUpperCase()} ${r.id}: ${r.statement}`;
-    CITE_NOTE = "Name the rule ids you apply in your DONE/commit message.";
+    CITE_NOTE = "List the rule ids you apply as `Rules: <id>, <id>` at the end of your signal done message (commit messages count too).";
     escapeRe = (t) => t.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     BRIEF_POINTER_RE = /^Full task is at (\S+\.md) — cat it/;
     READ_TOOLS = /* @__PURE__ */ new Set(["read", "read_file", "readfile", "view"]);
@@ -13357,6 +13537,13 @@ function ensureGitRepo(dir) {
     return false;
   }
 }
+function ensureKbGitignore(dir) {
+  const file = path23.join(dir, ".gitignore");
+  if (fs22.existsSync(file))
+    return false;
+  fs22.writeFileSync(file, KB_GITIGNORE);
+  return true;
+}
 function findLegacyOverlays(cfg) {
   return Object.keys(cfg.projects).filter((p) => fs22.existsSync(legacyOverlay(cfg, p))).sort();
 }
@@ -13411,6 +13598,8 @@ function moveLegacyKbs(cfg, opts = {}) {
     }
     if (ensureGitRepo(to))
       notes.push("git init");
+    if (ensureKbGitignore(to))
+      notes.push("wrote .gitignore (raw/, .converted/)");
     if (fs22.existsSync(path23.join(to, "index.json")))
       notes.push(`index.json holds old paths: run squadrant knowledge reindex ${kb}`);
     if (action === "copied")
@@ -13418,90 +13607,74 @@ function moveLegacyKbs(cfg, opts = {}) {
     return { kb, from, to, action, ...notes.length ? { note: notes.join("; ") } : {} };
   });
 }
-var legacyRoot, legacyOverlay;
+var legacyRoot, KB_GITIGNORE, legacyOverlay;
 var init_migrate = __esm({
   "packages/core/dist/knowledge/migrate.js"() {
     init_dist();
     init_paths();
     legacyRoot = (cfg) => path23.join(resolveHome(cfg.hubVault), "knowledge");
+    KB_GITIGNORE = "# squadrant KB defaults: source documents stay local\nraw/\n.converted/\n";
     legacyOverlay = (cfg, project) => path23.join(resolveHome(cfg.projects[project].spokeVault), "knowledge", "rules");
   }
 });
 
-// packages/core/dist/knowledge/verify.js
-function normalizeWithMap(src, keepBreakHyphen = false) {
+// packages/core/dist/knowledge/errata.js
+import fs23 from "fs";
+import path24 from "path";
+function loadErrata(kbRoot) {
+  const file = path24.join(kbRoot, "errata.yaml");
+  if (!fs23.existsSync(file))
+    return { errata: [], errors: [] };
+  let data;
+  try {
+    data = yaml.load(fs23.readFileSync(file, "utf8"), { schema: yaml.JSON_SCHEMA });
+  } catch (e) {
+    return { errata: [], errors: [`YAML parse error: ${e.message.split("\n")[0]}`] };
+  }
+  if (data == null)
+    return { errata: [], errors: [] };
+  if (!Array.isArray(data))
+    return { errata: [], errors: ["errata.yaml must be a YAML list of entries"] };
+  const errata = [];
+  const errors = [];
+  data.forEach((entry, i) => {
+    const problems = validateErratum(entry);
+    if (problems.length)
+      errors.push(...problems.map((p) => `entry ${i}: ${p}`));
+    else
+      errata.push(entry);
+  });
+  return { errata, errors };
+}
+function orphanedErrata(kbRoot, errata, refs) {
+  const only = refs ? new Set(refs) : void 0;
+  const hays = /* @__PURE__ */ new Map();
   const out = [];
-  const map2 = [];
-  const push = (s, at) => {
-    for (const ch of s) {
-      out.push(ch);
-      map2.push(at);
-    }
-  };
-  let i = 0;
-  while (i < src.length) {
-    const ch = src[i];
-    if (ch === "-" && /^-[ \t]*\r?\n[ \t]*[a-z]/.test(src.slice(i, i + 40)) && i > 0 && /[A-Za-z]/.test(src[i - 1])) {
-      if (keepBreakHyphen)
-        push("-", i);
-      i++;
-      while (/\s/.test(src[i]))
-        i++;
-      continue;
-    }
-    if (/\s/.test(ch)) {
-      const start = i;
-      while (i < src.length && /\s/.test(src[i]))
-        i++;
-      if (out.length && out[out.length - 1] !== " ")
-        push(" ", start);
+  for (const e of errata) {
+    if (only && !only.has(e.ref))
       continue;
+    if (!hays.has(e.ref)) {
+      const conv = readState2(kbRoot, e.ref) ? convertedFile(kbRoot, e.ref) : null;
+      hays.set(e.ref, conv && fs23.existsSync(conv) ? normalizedViews(fs23.readFileSync(conv, "utf8")) : null);
     }
-    if (LIGATURES[ch])
-      push(LIGATURES[ch], i);
-    else if (QUOTES[ch])
-      push(QUOTES[ch], i);
-    else if (DASHES.has(ch))
-      push("-", i);
-    else
-      push(ch, i);
-    i++;
-  }
-  while (out.length && out[out.length - 1] === " ") {
-    out.pop();
-    map2.pop();
-  }
-  return { text: out.join(""), map: map2 };
-}
-function findQuote(source, quote) {
-  const needle = normalizeText(quote);
-  if (!needle)
-    return null;
-  const views = typeof source === "string" ? normalizedViews(source) : source;
-  for (const hay of views) {
-    const at = hay.text.indexOf(needle);
-    if (at >= 0)
-      return [hay.map[at], hay.map[at + needle.length - 1] + 1];
+    const hay = hays.get(e.ref);
+    if (hay && !findQuote(hay, e.quote))
+      out.push({ id: e.id, ref: e.ref });
   }
-  return null;
+  return out;
 }
-var LIGATURES, QUOTES, DASHES, normalizeText, normalizedViews, DOCLING_DROP_THRESHOLD, needsDocling, spansOverlap;
-var init_verify = __esm({
-  "packages/core/dist/knowledge/verify.js"() {
-    LIGATURES = { "\uFB01": "fi", "\uFB02": "fl", "\uFB00": "ff", "\uFB03": "ffi", "\uFB04": "ffl", "\uFB05": "st", "\uFB06": "st" };
-    QUOTES = { "\u2018": "'", "\u2019": "'", "\u201A": "'", "\u201B": "'", "\u201C": '"', "\u201D": '"', "\u201E": '"', "\u201F": '"' };
-    DASHES = /* @__PURE__ */ new Set(["\u2010", "\u2011", "\u2012", "\u2013", "\u2014", "\u2015", "\u2212"]);
-    normalizeText = (s) => normalizeWithMap(s).text;
-    normalizedViews = (src) => [normalizeWithMap(src), normalizeWithMap(src, true)];
-    DOCLING_DROP_THRESHOLD = 0.2;
-    needsDocling = (dropped, total) => total > 0 && dropped / total > DOCLING_DROP_THRESHOLD;
-    spansOverlap = (a, b) => a[0] < b[1] && b[0] < a[1];
+var init_errata = __esm({
+  "packages/core/dist/knowledge/errata.js"() {
+    init_js_yaml();
+    init_dist();
+    init_ingest();
+    init_verify();
   }
 });
 
 // packages/core/dist/knowledge/anchor.js
-import fs23 from "fs";
-import path24 from "path";
+import fs24 from "fs";
+import path25 from "path";
 function* repoFiles(root) {
   let count = 0;
   const stack = [root];
@@ -13509,43 +13682,43 @@ function* repoFiles(root) {
     const dir = stack.pop();
     let ents;
     try {
-      ents = fs23.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name < b.name ? 1 : -1);
+      ents = fs24.readdirSync(dir, { withFileTypes: true }).sort((a, b) => a.name < b.name ? 1 : -1);
     } catch {
       continue;
     }
     for (const ent of ents) {
       if (ent.isDirectory()) {
         if (!SKIP_DIRS.has(ent.name))
-          stack.push(path24.join(dir, ent.name));
-      } else if (ent.isFile() && CODE_EXT.has(path24.extname(ent.name))) {
+          stack.push(path25.join(dir, ent.name));
+      } else if (ent.isFile() && CODE_EXT.has(path25.extname(ent.name))) {
         if (++count > MAX_FILES)
           return;
-        yield path24.join(dir, ent.name);
+        yield path25.join(dir, ent.name);
       }
     }
   }
 }
 function computeAnchor(repoRoot, triggers) {
   const terms2 = anchorTerms(triggers);
-  if (!terms2.length || !fs23.existsSync(repoRoot))
+  if (!terms2.length || !fs24.existsSync(repoRoot))
     return null;
   const hits = [];
   for (const file of repoFiles(repoRoot)) {
     let text;
     try {
-      if (fs23.statSync(file).size > MAX_FILE_BYTES)
+      if (fs24.statSync(file).size > MAX_FILE_BYTES)
         continue;
-      text = fs23.readFileSync(file, "utf8");
+      text = fs24.readFileSync(file, "utf8");
     } catch {
       continue;
     }
-    const hay = `${path24.relative(repoRoot, file)}
+    const hay = `${path25.relative(repoRoot, file)}
 ${text}`.toLowerCase();
     const score = terms2.filter((t) => hay.includes(t)).length;
     if (!score)
       continue;
     const symbols2 = [...text.matchAll(SYMBOL_RE)].map((m) => m[1]).filter((s) => terms2.some((t) => s.toLowerCase().includes(t)));
-    hits.push({ rel: path24.relative(repoRoot, file).split(path24.sep).join("/"), score, symbols: symbols2 });
+    hits.push({ rel: path25.relative(repoRoot, file).split(path25.sep).join("/"), score, symbols: symbols2 });
   }
   if (!hits.length)
     return null;
@@ -13569,11 +13742,11 @@ var init_anchor = __esm({
 });
 
 // packages/core/dist/knowledge/extract.js
-import fs24 from "fs";
-import path25 from "path";
-import matter3 from "gray-matter";
+import fs25 from "fs";
+import path26 from "path";
+import matter4 from "gray-matter";
 function serialize(fm, body) {
-  return matter3.stringify(body.trim() + "\n", clean(fm));
+  return matter4.stringify(body.trim() + "\n", clean(fm));
 }
 function validateCandidate(c) {
   const p = [];
@@ -13616,9 +13789,9 @@ function upsertSource(fm, src) {
 }
 function applyCandidates(input, opts) {
   const { kb, kbRoot, rulesDir } = opts;
-  const res = { created: [], merged: [], proposed: [], superseded: [], stale: [], rejected: [], doclingFlags: [], idOverrides: [] };
+  const res = { created: [], merged: [], proposed: [], superseded: [], stale: [], rejected: [], doclingFlags: [], idOverrides: [], orphanedErrata: [] };
   const events = [];
-  const ev2 = (event, itemId, domain, extra = {}) => events.push({ kb, level: "group", project: "", domain, itemId, event, ...extra });
+  const ev2 = (event, itemId, extra = {}) => events.push({ kb, level: "group", project: "", domain: "rules", itemId, event, ...extra });
   const loaded = loadRulesDir(rulesDir, `kb:${kb}`);
   const work = /* @__PURE__ */ new Map();
   for (const r of loaded.rules) {
@@ -13637,13 +13810,13 @@ function applyCandidates(input, opts) {
     }
     const st = readState2(kbRoot, cand.source);
     const convFile = st ? convertedFile(kbRoot, cand.source) : null;
-    if (!st || !fs24.existsSync(convFile)) {
+    if (!st || !fs25.existsSync(convFile)) {
       res.rejected.push({ id: cand.id, source: cand.source, reason: "unknown source (not ingested)" });
       continue;
     }
     let hay = norm.get(cand.source);
     if (!hay) {
-      hay = normalizedViews(fs24.readFileSync(convFile, "utf8"));
+      hay = normalizedViews(fs25.readFileSync(convFile, "utf8"));
       norm.set(cand.source, hay);
     }
     const tot = totals.get(cand.source) ?? { total: 0, dropped: 0 };
@@ -13653,7 +13826,14 @@ function applyCandidates(input, opts) {
     if (!offset) {
       tot.dropped++;
       res.rejected.push({ id: cand.id, source: cand.source, reason: "ungrounded" });
-      ev2("item.rejected", cand.id, cand.domain, { reason: "ungrounded" });
+      ev2("item.rejected", cand.id, { reason: "ungrounded" });
+      continue;
+    }
+    const hit = (opts.errata ?? []).find((e) => e.ref === cand.source && ((o) => !!o && spansOverlap(o, offset))(findQuote(hay, e.quote)));
+    if (hit) {
+      tot.total--;
+      res.rejected.push({ id: cand.id, source: cand.source, reason: `errata:${hit.id}` });
+      ev2("item.rejected", cand.id, { reason: `errata:${hit.id}` });
       continue;
     }
     let id = cand.id;
@@ -13685,7 +13865,7 @@ ${cand.rationale.trim()}` : "");
       }
       continue;
     }
-    if (!target && contradicted.length === 0) {
+    if (!target && contradicted.length === 0 && !isGatedRef(kbRoot, opts.sources ?? [], cand.source)) {
       const fm2 = {
         id,
         domain: cand.domain,
@@ -13698,9 +13878,9 @@ ${cand.rationale.trim()}` : "");
         supersedes: [],
         conflictsWith: []
       };
-      work.set(id, { fm: fm2, body: bodyOf(), file: path25.join(rulesDir, cand.domain, `${id}.md`), dirty: true, isNew: true });
+      work.set(id, { fm: fm2, body: bodyOf(), file: path26.join(rulesDir, cand.domain, `${id}.md`), dirty: true, isNew: true });
       res.created.push(id);
-      ev2("item.applied", id, cand.domain);
+      ev2("item.applied", id);
       continue;
     }
     const fm = {
@@ -13715,26 +13895,26 @@ ${cand.rationale.trim()}` : "");
       supersedes: [],
       conflictsWith: contradicted
     };
-    const dir = path25.join(rulesDir, PROPOSED_DIR);
-    const file = path25.join(dir, `${id}@${st.sha.slice(0, SHA_LEN)}.md`);
+    const dir = path26.join(rulesDir, PROPOSED_DIR);
+    const file = path26.join(dir, `${id}@${st.sha.slice(0, SHA_LEN)}.md`);
     const text = serialize(fm, bodyOf());
-    if (fs24.existsSync(file) && fs24.readFileSync(file, "utf8") === text)
+    if (fs25.existsSync(file) && fs25.readFileSync(file, "utf8") === text)
       continue;
-    fs24.mkdirSync(dir, { recursive: true });
-    for (const other of fs24.readdirSync(dir)) {
-      if (!other.startsWith(`${id}@`) || !other.endsWith(".md") || path25.join(dir, other) === file)
+    fs25.mkdirSync(dir, { recursive: true });
+    for (const other of fs25.readdirSync(dir)) {
+      if (!other.startsWith(`${id}@`) || !other.endsWith(".md") || path26.join(dir, other) === file)
         continue;
-      const old = matter3(fs24.readFileSync(path25.join(dir, other), "utf8"));
+      const old = matter4(fs25.readFileSync(path26.join(dir, other), "utf8"));
       if (!old.data.sources?.some((s) => s.ref === cand.source))
         continue;
-      fs24.writeFileSync(path25.join(dir, other.replace(/\.md$/, ".superseded")), matter3.stringify(old.content, { ...old.data, supersededBy: path25.basename(file) }));
-      fs24.rmSync(path25.join(dir, other));
+      fs25.writeFileSync(path26.join(dir, other.replace(/\.md$/, ".superseded")), matter4.stringify(old.content, { ...old.data, supersededBy: path26.basename(file) }));
+      fs25.rmSync(path26.join(dir, other));
       res.superseded.push(other.replace(/\.md$/, ""));
-      ev2("item.superseded", id, fm.domain);
+      ev2("item.superseded", id);
     }
-    fs24.writeFileSync(file, text);
+    fs25.writeFileSync(file, text);
     res.proposed.push(`${id}@${st.sha.slice(0, SHA_LEN)}`);
-    ev2("item.proposed", id, fm.domain);
+    ev2("item.proposed", id);
   }
   for (const [id, w] of work) {
     if (touched.has(id) || w.fm.status !== "active" || w.isNew)
@@ -13760,11 +13940,12 @@ ${cand.rationale.trim()}` : "");
   for (const w of work.values()) {
     if (!w.dirty)
       continue;
-    fs24.mkdirSync(path25.dirname(w.file), { recursive: true });
+    fs25.mkdirSync(path26.dirname(w.file), { recursive: true });
     const text = serialize(w.fm, w.body);
-    if (!fs24.existsSync(w.file) || fs24.readFileSync(w.file, "utf8") !== text)
-      fs24.writeFileSync(w.file, text);
+    if (!fs25.existsSync(w.file) || fs25.readFileSync(w.file, "utf8") !== text)
+      fs25.writeFileSync(w.file, text);
   }
+  res.orphanedErrata = orphanedErrata(kbRoot, opts.errata ?? [], totals.keys());
   for (const [ref, t] of totals)
     if (needsDocling(t.dropped, t.total))
       res.doclingFlags.push({ ref, ...t });
@@ -13781,6 +13962,7 @@ var init_extract = __esm({
     init_anchor();
     init_index_file();
     init_ingest();
+    init_errata();
     init_paths();
     init_store2();
     init_verify();
@@ -13797,20 +13979,20 @@ var init_extract = __esm({
 });
 
 // packages/core/dist/knowledge/schedule.js
-import fs25 from "fs";
-import path26 from "path";
+import fs26 from "fs";
+import path27 from "path";
 function readSchedule(stateRoot) {
   try {
-    return JSON.parse(fs25.readFileSync(scheduleFile(stateRoot), "utf8"));
+    return JSON.parse(fs26.readFileSync(scheduleFile(stateRoot), "utf8"));
   } catch {
     return {};
   }
 }
 function writeSchedule(stateRoot, s) {
-  fs25.mkdirSync(stateRoot, { recursive: true });
+  fs26.mkdirSync(stateRoot, { recursive: true });
   const tmp = `${scheduleFile(stateRoot)}.${process.pid}.tmp`;
-  fs25.writeFileSync(tmp, JSON.stringify(s, null, 2) + "\n");
-  fs25.renameSync(tmp, scheduleFile(stateRoot));
+  fs26.writeFileSync(tmp, JSON.stringify(s, null, 2) + "\n");
+  fs26.renameSync(tmp, scheduleFile(stateRoot));
 }
 function snapshotSources(kbRoot, sources) {
   const out = {};
@@ -13890,7 +14072,7 @@ async function tickKnowledgeSchedule(d) {
       continue;
     try {
       const root = kbDir(d.cfg, kb);
-      if (!fs25.existsSync(root))
+      if (!fs26.existsSync(root))
         continue;
       const { sources } = loadSources(root);
       if (!sources.length)
@@ -13955,7 +14137,7 @@ var init_schedule = __esm({
     init_sources();
     RUNNING_STALE_MS = 6 * 60 * 60 * 1e3;
     DAY_MS = 24 * 60 * 60 * 1e3;
-    scheduleFile = (stateRoot) => path26.join(stateRoot, "knowledge-schedule.json");
+    scheduleFile = (stateRoot) => path27.join(stateRoot, "knowledge-schedule.json");
     reconcileConfig = (cfg, kb) => ({ ...DEFAULT_RECONCILE, ...kbConfigs(cfg)[kb]?.reconcile });
   }
 });
@@ -13963,19 +14145,19 @@ var init_schedule = __esm({
 // packages/core/dist/knowledge/review.js
 import crypto4 from "crypto";
 import { execFileSync as execFileSync7 } from "child_process";
-import fs26 from "fs";
-import path27 from "path";
-import matter4 from "gray-matter";
+import fs27 from "fs";
+import path28 from "path";
+import matter5 from "gray-matter";
 function readEscalations(kbRoot) {
   try {
-    return JSON.parse(fs26.readFileSync(escalationsFile(kbRoot), "utf8")).items;
+    return JSON.parse(fs27.readFileSync(escalationsFile(kbRoot), "utf8")).items;
   } catch {
     return [];
   }
 }
 function writeEscalations(kbRoot, items) {
-  fs26.mkdirSync(kbRoot, { recursive: true });
-  fs26.writeFileSync(escalationsFile(kbRoot), JSON.stringify({ items }, null, 2) + "\n");
+  fs27.mkdirSync(kbRoot, { recursive: true });
+  fs27.writeFileSync(escalationsFile(kbRoot), JSON.stringify({ items }, null, 2) + "\n");
 }
 function addEscalation(kbRoot, e) {
   const items = readEscalations(kbRoot);
@@ -13985,8 +14167,8 @@ function addEscalation(kbRoot, e) {
   return true;
 }
 function appendVerdict(kbRoot, v2, now) {
-  fs26.mkdirSync(kbRoot, { recursive: true });
-  fs26.appendFileSync(verdictsFile(kbRoot), JSON.stringify({ ts: now.toISOString(), ...v2 }) + "\n");
+  fs27.mkdirSync(kbRoot, { recursive: true });
+  fs27.appendFileSync(verdictsFile(kbRoot), JSON.stringify({ ts: now.toISOString(), ...v2 }) + "\n");
 }
 function priorityOfRef(c, ref) {
   if (ref.startsWith("agent:"))
@@ -14007,20 +14189,20 @@ function loadProposals(c) {
   const byId = new Map(live.map((r) => [r.id, r]));
   const proposals = [];
   const pdirs = /* @__PURE__ */ new Set();
-  for (const f of fs26.existsSync(dir) ? walkDirs(dir) : [])
-    if (path27.basename(f) === PROPOSED_DIR)
+  for (const f of fs27.existsSync(dir) ? walkDirs(dir) : [])
+    if (path28.basename(f) === PROPOSED_DIR)
       pdirs.add(f);
   for (const pd of pdirs) {
     for (const rule of loadRulesDir(pd, `kb:${c.kb}`, { includeProposed: true }).rules) {
-      proposals.push({ key: path27.basename(rule.file).replace(/\.md$/, ""), rule, live: byId.get(rule.id) });
+      proposals.push({ key: path28.basename(rule.file).replace(/\.md$/, ""), rule, live: byId.get(rule.id) });
     }
   }
   return { proposals, live };
 }
 function walkDirs(dir, out = []) {
-  for (const e of fs26.readdirSync(dir, { withFileTypes: true }))
+  for (const e of fs27.readdirSync(dir, { withFileTypes: true }))
     if (e.isDirectory()) {
-      const f = path27.join(dir, e.name);
+      const f = path28.join(dir, e.name);
       out.push(f);
       walkDirs(f, out);
     }
@@ -14049,9 +14231,9 @@ function promoteProposal(c, p, by, justification, events) {
       continue;
     const o = readFm(other.file);
     o.fm.status = "retired";
-    fs26.writeFileSync(other.file, fileText(o.fm, o.body));
+    fs27.writeFileSync(other.file, fileText(o.fm, o.body));
     retired.push(id);
-    events.push(ev(c, "item.superseded", id, o.fm.domain));
+    events.push(ev(c, "item.superseded", id));
   }
   const next = { ...fm, status: "active", approvedBy: by, justification, supersedes: [.../* @__PURE__ */ new Set([...fm.supersedes ?? [], ...retired])], conflictsWith: [] };
   if (p.live?.decision)
@@ -14059,17 +14241,17 @@ function promoteProposal(c, p, by, justification, events) {
   const anchors = anchorsFor(c, { ...next, anchors: p.live?.anchors ?? fm.anchors });
   if (anchors)
     next.anchors = anchors;
-  const target = p.live?.file ?? path27.join(dir, next.domain, `${next.id}.md`);
-  fs26.mkdirSync(path27.dirname(target), { recursive: true });
-  fs26.writeFileSync(target, fileText(next, body));
-  fs26.rmSync(p.rule.file);
-  events.push(ev(c, "item.approved", next.id, next.domain), ev(c, "item.applied", next.id, next.domain));
+  const target = p.live?.file ?? path28.join(dir, next.domain, `${next.id}.md`);
+  fs27.mkdirSync(path28.dirname(target), { recursive: true });
+  fs27.writeFileSync(target, fileText(next, body));
+  fs27.rmSync(p.rule.file);
+  events.push(ev(c, "item.approved", next.id), ev(c, "item.applied", next.id));
   if (p.live)
-    events.push(ev(c, "item.superseded", next.id, next.domain));
+    events.push(ev(c, "item.superseded", next.id));
 }
 function dropProposal(c, p, events) {
-  fs26.rmSync(p.rule.file);
-  events.push(ev(c, "item.rejected", p.rule.id, p.rule.domain, { reason: "reviewer" }));
+  fs27.rmSync(p.rule.file);
+  events.push(ev(c, "item.rejected", p.rule.id, { reason: "reviewer" }));
 }
 function mergeInto(c, p, targetId, live, events) {
   const t = live.find((r) => r.id === targetId);
@@ -14079,9 +14261,9 @@ function mergeInto(c, p, targetId, live, events) {
   for (const s of p.rule.sources)
     if (!tf.fm.sources.some((x) => x.ref === s.ref))
       tf.fm.sources.push(s);
-  fs26.writeFileSync(t.file, fileText(tf.fm, tf.body));
-  fs26.rmSync(p.rule.file);
-  events.push(ev(c, "item.superseded", p.rule.id, p.rule.domain), ev(c, "item.applied", targetId, t.domain));
+  fs27.writeFileSync(t.file, fileText(tf.fm, tf.body));
+  fs27.rmSync(p.rule.file);
+  events.push(ev(c, "item.superseded", p.rule.id), ev(c, "item.applied", targetId));
   return true;
 }
 function evaluateCodeConflict(c, rule, cc) {
@@ -14155,14 +14337,15 @@ function applyDecisions(file, c) {
         f.fm.status = "active";
         if (d.loc && f.fm.sources[0])
           f.fm.sources[0].loc = d.loc;
-        if (conf >= threshold && !d.flag && !reasons.length) {
-          fs26.writeFileSync(rule.file, fileText(f.fm, f.body));
+        const noSource = !rule.sources.length;
+        if (conf >= threshold && !d.flag && !reasons.length && !noSource) {
+          fs27.writeFileSync(rule.file, fileText(f.fm, f.body));
           res.applied.push(d.item);
-          events.push(ev(c, "item.applied", rule.id, rule.domain));
+          events.push(ev(c, "item.applied", rule.id));
           verdict(d, "applied", { confidence: conf });
           continue;
         }
-        reasons.push(conf < threshold ? "low-confidence" : "reviewer-flagged");
+        reasons.push(noSource ? "no-source" : conf < threshold ? "low-confidence" : "reviewer-flagged");
       } else if (d.decision === "approve") {
         if (strong(rule.modality))
           reasons.push("retiring must/must-not");
@@ -14173,9 +14356,9 @@ function applyDecisions(file, c) {
         if (!reasons.length) {
           const f = readFm(rule.file);
           f.fm.status = "retired";
-          fs26.writeFileSync(rule.file, fileText(f.fm, f.body));
+          fs27.writeFileSync(rule.file, fileText(f.fm, f.body));
           res.applied.push(d.item);
-          events.push(ev(c, "item.archived", rule.id, rule.domain));
+          events.push(ev(c, "item.archived", rule.id));
           verdict(d, "applied", { confidence: conf });
           continue;
         }
@@ -14190,6 +14373,8 @@ function applyDecisions(file, c) {
       reasons.push("reviewer-flagged");
     if (conf < threshold)
       reasons.push("low-confidence");
+    if (p.rule.sources.some((s) => isGatedRef(kbRoot, c.sources, s.ref)))
+      reasons.push("review-required");
     if (d.decision === "approve") {
       const myPri = priorityOfRule(c, p.rule);
       const conflicted = (p.rule.conflictsWith ?? []).map((id) => live.find((r) => r.id === id)).filter((r) => !!r);
@@ -14251,7 +14436,7 @@ function applyPair(pd, c, res, threshold, events, kbRoot, now) {
     for (const [x, y] of [[a, b], [b, a]]) {
       const f = readFm(x.file);
       f.fm.conflictsWith = [.../* @__PURE__ */ new Set([...f.fm.conflictsWith ?? [], y.id])];
-      fs26.writeFileSync(x.file, fileText(f.fm, f.body));
+      fs27.writeFileSync(x.file, fileText(f.fm, f.body));
     }
     return;
   }
@@ -14266,11 +14451,11 @@ function applyPair(pd, c, res, threshold, events, kbRoot, now) {
     if (!kf.fm.sources.some((x) => x.ref === s.ref))
       kf.fm.sources.push(s);
   kf.fm.supersedes = [.../* @__PURE__ */ new Set([...kf.fm.supersedes ?? [], drop.id])];
-  fs26.writeFileSync(keep.file, fileText(kf.fm, kf.body));
+  fs27.writeFileSync(keep.file, fileText(kf.fm, kf.body));
   const df = readFm(drop.file);
   df.fm.status = "retired";
-  fs26.writeFileSync(drop.file, fileText(df.fm, df.body));
-  events.push(ev(c, "item.superseded", drop.id, drop.domain), ev(c, "item.applied", keep.id, keep.domain));
+  fs27.writeFileSync(drop.file, fileText(df.fm, df.body));
+  events.push(ev(c, "item.superseded", drop.id), ev(c, "item.applied", keep.id));
   res.applied.push(key);
 }
 function resolveEscalation(c, key, r, by, reason) {
@@ -14300,9 +14485,9 @@ function resolveEscalation(c, key, r, by, reason) {
     f.fm.decision = decision;
     if (r.verdict === "supersede-with-code") {
       f.fm.status = "retired";
-      events.push(ev(c, "item.superseded", rule.id, rule.domain));
+      events.push(ev(c, "item.superseded", rule.id));
     }
-    fs26.writeFileSync(rule.file, fileText(f.fm, f.body));
+    fs27.writeFileSync(rule.file, fileText(f.fm, f.body));
     return done(`${rule.id}: ${r.verdict}`);
   }
   if (esc.kind === "proposal") {
@@ -14319,23 +14504,26 @@ function resolveEscalation(c, key, r, by, reason) {
   }
   if (esc.kind === "stale-retire") {
     const rule = live.find((x) => x.id === esc.ruleId);
+    if (rule && r.kind !== "approve" && !rule.sources.length) {
+      throw new Error(`Rule ${rule.id} has no source, so it cannot be kept active. Add a source to the rule (or re-extract it), or retire it with --approve.`);
+    }
     if (rule) {
       const f = readFm(rule.file);
       f.fm.status = r.kind === "approve" ? "retired" : "active";
-      fs26.writeFileSync(rule.file, fileText(f.fm, f.body));
-      events.push(ev(c, r.kind === "approve" ? "item.archived" : "item.applied", rule.id, rule.domain));
+      fs27.writeFileSync(rule.file, fileText(f.fm, f.body));
+      events.push(ev(c, r.kind === "approve" ? "item.archived" : "item.applied", rule.id));
     }
     return done(`${esc.ruleId}: ${r.kind === "approve" ? "retired" : "kept"}`);
   }
   if (esc.kind === "override-base-changed") {
-    const ov = esc.item && fs26.existsSync(esc.item) ? esc.item : void 0;
+    const ov = esc.item && fs27.existsSync(esc.item) ? esc.item : void 0;
     if (ov) {
       if (r.kind === "reject")
-        fs26.rmSync(ov);
+        fs27.rmSync(ov);
       else {
         const f = readFm(ov);
         f.fm.overridesBase = esc.evidence?.docRev;
-        fs26.writeFileSync(ov, fileText(f.fm, f.body));
+        fs27.writeFileSync(ov, fileText(f.fm, f.body));
       }
     }
     return done(`${esc.ruleId}: override ${r.kind === "reject" ? "dropped" : "kept"}`);
@@ -14359,11 +14547,11 @@ ${o.evidence}`).digest("hex");
     supersedes: [],
     conflictsWith: []
   };
-  const dir = path27.join(kbRulesDir(c.cfg, c.kb), PROPOSED_DIR);
-  fs26.mkdirSync(dir, { recursive: true });
-  const file = path27.join(dir, `${id}@${sha.slice(0, SHA_LEN2)}.md`);
-  fs26.writeFileSync(file, fileText(fm, o.statement));
-  appendAudit([ev(c, "item.proposed", id, domain)], c.audit);
+  const dir = path28.join(kbRulesDir(c.cfg, c.kb), PROPOSED_DIR);
+  fs27.mkdirSync(dir, { recursive: true });
+  const file = path28.join(dir, `${id}@${sha.slice(0, SHA_LEN2)}.md`);
+  fs27.writeFileSync(file, fileText(fm, o.statement));
+  appendAudit([ev(c, "item.proposed", id)], c.audit);
   return file;
 }
 function buildReviewPacket(c) {
@@ -14403,8 +14591,8 @@ var init_review = __esm({
     PRIORITY_RANK = { company: 3, project: 2, agent: 1 };
     SHA_LEN2 = 12;
     strong = (m) => m === "must" || m === "must-not";
-    escalationsFile = (kbRoot) => path27.join(kbRoot, "escalations.json");
-    verdictsFile = (kbRoot) => path27.join(kbRoot, "verdicts.jsonl");
+    escalationsFile = (kbRoot) => path28.join(kbRoot, "escalations.json");
+    verdictsFile = (kbRoot) => path28.join(kbRoot, "verdicts.jsonl");
     needsYouCount = (kbRoot) => readEscalations(kbRoot).filter((e) => e.needsYou).length;
     git = (root, args) => execFileSync7("git", ["-C", root, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
     realGit = {
@@ -14425,34 +14613,34 @@ var init_review = __esm({
       },
       docDate(file) {
         try {
-          const d = git(path27.dirname(file), ["log", "-1", "--format=%cI", "--", path27.basename(file)]);
+          const d = git(path28.dirname(file), ["log", "-1", "--format=%cI", "--", path28.basename(file)]);
           if (d)
             return d;
         } catch {
         }
         try {
-          return fs26.statSync(file).mtime.toISOString();
+          return fs27.statSync(file).mtime.toISOString();
         } catch {
           return null;
         }
       }
     };
     nowOf = (c) => c.now?.() ?? /* @__PURE__ */ new Date();
-    fileText = (fm, body) => matter4.stringify(body.trim() + "\n", JSON.parse(JSON.stringify(fm)));
+    fileText = (fm, body) => matter5.stringify(body.trim() + "\n", JSON.parse(JSON.stringify(fm)));
     readFm = (file) => {
-      const m = matter4(fs26.readFileSync(file, "utf8"));
+      const m = matter5(fs27.readFileSync(file, "utf8"));
       return { fm: m.data, body: m.content };
     };
-    ev = (c, event, itemId, domain, extra = {}) => ({ kb: c.kb, level: "group", project: "", domain, itemId, event, ...extra });
+    ev = (c, event, itemId, extra = {}) => ({ kb: c.kb, level: "group", project: "", domain: "rules", itemId, event, ...extra });
     docRevOf = (r) => r.sources.map((s) => `${s.ref}@${s.sha.slice(0, SHA_LEN2)}`).join(",");
   }
 });
 
 // packages/core/dist/knowledge/fullpass.js
 import crypto5 from "crypto";
-import fs27 from "fs";
-import path28 from "path";
-import matter5 from "gray-matter";
+import fs28 from "fs";
+import path29 from "path";
+import matter6 from "gray-matter";
 function dedupPairs(rules) {
   const active = rules.filter((r) => r.status === "active").sort((x, y) => x.id.localeCompare(y.id));
   const out = [];
@@ -14468,12 +14656,12 @@ function dedupPairs(rules) {
   return out.slice(0, MAX_DEDUP_PAIRS);
 }
 function readAuditRecords(kb, since, dir = defaultAuditDir()) {
-  if (!fs27.existsSync(dir))
+  if (!fs28.existsSync(dir))
     return [];
   const sinceMonth = since.toISOString().slice(0, 7);
   const out = [];
-  for (const f of fs27.readdirSync(dir).filter((n) => n.endsWith(".jsonl") && n.slice(0, 7) >= sinceMonth).sort()) {
-    for (const line2 of fs27.readFileSync(path28.join(dir, f), "utf8").split("\n")) {
+  for (const f of fs28.readdirSync(dir).filter((n) => n.endsWith(".jsonl") && n.slice(0, 7) >= sinceMonth).sort()) {
+    for (const line2 of fs28.readFileSync(path29.join(dir, f), "utf8").split("\n")) {
       if (!line2.trim())
         continue;
       try {
@@ -14536,8 +14724,8 @@ function checkOverrides(cfg, kb) {
         continue;
       const h = baseHash(b);
       if (!o.overridesBase) {
-        const m = matter5(fs27.readFileSync(o.file, "utf8"));
-        fs27.writeFileSync(o.file, matter5.stringify(m.content, { ...m.data, overridesBase: h }));
+        const m = matter6(fs28.readFileSync(o.file, "utf8"));
+        fs28.writeFileSync(o.file, matter6.stringify(m.content, { ...m.data, overridesBase: h }));
         continue;
       }
       out.push({ project, ruleId: o.id, file: o.file, baseHash: h, changed: o.overridesBase !== h });
@@ -14580,8 +14768,8 @@ var init_fullpass = __esm({
 });
 
 // packages/core/dist/knowledge/scores.js
-import fs28 from "fs";
-import path29 from "path";
+import fs29 from "fs";
+import path30 from "path";
 function tally(records, into = emptyTally()) {
   for (const e of records) {
     const domain = typeof e.domain === "string" && e.domain ? e.domain : "rules";
@@ -14590,7 +14778,7 @@ function tally(records, into = emptyTally()) {
       d.writes++;
     if (READ_EVENTS.has(e.event ?? ""))
       d.reads++;
-    if (!e.itemId)
+    if (!e.itemId || WRITE_EVENTS.has(e.event ?? ""))
       continue;
     const c = into.items[`${domain}|${e.itemId}`] ??= { ...zero(), domain, itemId: e.itemId };
     switch (e.event) {
@@ -14627,7 +14815,7 @@ function tally(records, into = emptyTally()) {
 }
 function parseLines(file) {
   const out = [];
-  for (const line2 of fs28.readFileSync(file, "utf8").split("\n")) {
+  for (const line2 of fs29.readFileSync(file, "utf8").split("\n")) {
     if (!line2.trim())
       continue;
     try {
@@ -14639,37 +14827,37 @@ function parseLines(file) {
 }
 function compactAudit(o) {
   const dir = o.dir ?? defaultAuditDir();
-  if (!fs28.existsSync(dir))
+  if (!fs29.existsSync(dir))
     return [];
   const cutoffMonth = new Date(o.now.getTime() - SCORE_WINDOW_DAYS * DAY_MS3).toISOString().slice(0, 7);
   const done = [];
-  for (const f of fs28.readdirSync(dir).sort()) {
+  for (const f of fs29.readdirSync(dir).sort()) {
     const m = MONTH_FILE_RE.exec(f);
     if (!m || m[1] >= cutoffMonth)
       continue;
     const [, month, machine] = m;
     const byKb = /* @__PURE__ */ new Map();
-    for (const r of parseLines(path29.join(dir, f)))
+    for (const r of parseLines(path30.join(dir, f)))
       byKb.set(r.kb ?? "", [...byKb.get(r.kb ?? "") ?? [], r]);
-    const statsPath = path29.join(dir, statsFileName(month, machine));
-    const prior = fs28.existsSync(statsPath) ? JSON.parse(fs28.readFileSync(statsPath, "utf8")) : null;
+    const statsPath = path30.join(dir, statsFileName(month, machine));
+    const prior = fs29.existsSync(statsPath) ? JSON.parse(fs29.readFileSync(statsPath, "utf8")) : null;
     const kbs = prior?.kbs ?? {};
     for (const [kb, recs] of byKb)
       kbs[kb] = tally(recs, kbs[kb]);
-    fs28.writeFileSync(`${statsPath}.tmp`, JSON.stringify({ month, machine, kbs }));
-    fs28.renameSync(`${statsPath}.tmp`, statsPath);
-    fs28.unlinkSync(path29.join(dir, f));
+    fs29.writeFileSync(`${statsPath}.tmp`, JSON.stringify({ month, machine, kbs }));
+    fs29.renameSync(`${statsPath}.tmp`, statsPath);
+    fs29.unlinkSync(path30.join(dir, f));
     done.push(month);
   }
   return done;
 }
 function readCompacted(kb, dir) {
   const t = emptyTally();
-  if (!fs28.existsSync(dir))
+  if (!fs29.existsSync(dir))
     return t;
-  for (const f of fs28.readdirSync(dir).filter((n) => n.endsWith(".stats.json"))) {
+  for (const f of fs29.readdirSync(dir).filter((n) => n.endsWith(".stats.json"))) {
     try {
-      const k = JSON.parse(fs28.readFileSync(path29.join(dir, f), "utf8")).kbs[kb];
+      const k = JSON.parse(fs29.readFileSync(path30.join(dir, f), "utf8")).kbs[kb];
       if (k)
         mergeTally(t, k);
     } catch {
@@ -14719,7 +14907,7 @@ function computeScores(i) {
       noise: w.noise,
       wrong: w.wrong,
       fireRate: w.surfaced,
-      pullRate: w.shown,
+      pullRate: w.shown + w.searched,
       useRate: ratio(w.cited, w.surfaced),
       noiseRate: ratio(w.noise, w.surfaced),
       violationRate: ratio(w.violated, w.surfaced),
@@ -14761,21 +14949,21 @@ function computeScores(i) {
 function scoreKb(o) {
   const dir = o.auditDir ?? defaultAuditDir();
   const records = [];
-  if (fs28.existsSync(dir)) {
-    for (const f of fs28.readdirSync(dir).filter((n) => MONTH_FILE_RE.test(n)).sort()) {
-      records.push(...parseLines(path29.join(dir, f)).filter((r) => r.kb === o.kb));
+  if (fs29.existsSync(dir)) {
+    for (const f of fs29.readdirSync(dir).filter((n) => MONTH_FILE_RE.test(n)).sort()) {
+      records.push(...parseLines(path30.join(dir, f)).filter((r) => r.kb === o.kb));
     }
   }
   let verdicts = [];
   try {
-    verdicts = fs28.readFileSync(path29.join(o.kbRoot, "verdicts.jsonl"), "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l));
+    verdicts = fs29.readFileSync(path30.join(o.kbRoot, "verdicts.jsonl"), "utf8").split("\n").filter(Boolean).map((l) => JSON.parse(l));
   } catch {
   }
   return computeScores({ kb: o.kb, records, now: o.now, known: o.known, compacted: readCompacted(o.kb, dir), verdicts });
 }
 function writeScores(kbRoot, s) {
-  fs28.mkdirSync(kbRoot, { recursive: true });
-  fs28.writeFileSync(scoresFile(kbRoot), JSON.stringify(s, null, 2) + "\n");
+  fs29.mkdirSync(kbRoot, { recursive: true });
+  fs29.writeFileSync(scoresFile(kbRoot), JSON.stringify(s, null, 2) + "\n");
 }
 function renderScoresSection(s) {
   const pct = (x) => x === null ? "n/a" : `${Math.round(x * 100)}%`;
@@ -14788,7 +14976,7 @@ function renderScoresSection(s) {
     ...used.length ? [
       "| Item | Surfaced | Pulled | Cited | Use | Noise | Violated |",
       "|---|---|---|---|---|---|---|",
-      ...used.map((x) => `| ${x.itemId} | ${x.surfaced} | ${x.shown} | ${x.cited} | ${pct(x.useRate)} | ${pct(x.noiseRate)} | ${pct(x.violationRate)} |`)
+      ...used.map((x) => `| ${x.itemId} | ${x.surfaced} | ${x.pullRate} | ${x.cited} | ${pct(x.useRate)} | ${pct(x.noiseRate)} | ${pct(x.violationRate)} |`)
     ] : ["No items surfaced."],
     "",
     `- Never fired (${never.length}): ${never.slice(0, 20).join(", ") || "none"}${never.length > 20 ? ", \u2026" : ""}`,
@@ -14816,13 +15004,13 @@ var init_scores = __esm({
     MONTH_FILE_RE = /^(\d{4}-\d{2})\.(.+)\.jsonl$/;
     statsFileName = (month, machine) => `${month}.${machine}.stats.json`;
     ratio = (n, d) => d ? Math.round(n / d * 1e3) / 1e3 : null;
-    scoresFile = (kbRoot) => path29.join(kbRoot, "scores.json");
+    scoresFile = (kbRoot) => path30.join(kbRoot, "scores.json");
   }
 });
 
 // packages/core/dist/knowledge/report.js
-import fs29 from "fs";
-import path30 from "path";
+import fs30 from "fs";
+import path31 from "path";
 function renderReport(cfg, kb, o) {
   const { rules } = loadKbRules(cfg, kb, { includeProposed: true });
   const count = (s) => rules.filter((r) => r.status === s).length;
@@ -14844,6 +15032,11 @@ function renderReport(cfg, kb, o) {
   const info = esc.filter((e) => !e.needsYou);
   if (info.length)
     L.push("", `## For information (${info.length})`, "", ...info.map((e) => `- **${e.key}**: ${e.explanation}`));
+  const { errata, errors: errataErrors } = loadErrata(kbDir(cfg, kb));
+  const orphans = orphanedErrata(kbDir(cfg, kb), errata);
+  if (orphans.length || errataErrors.length) {
+    L.push("", `## Errata to re-check (${orphans.length + errataErrors.length})`, "", ...orphans.map((e) => `- **${e.id}** (${e.ref}): quote no longer found in the source; the raw file changed. Re-check it in errata.yaml.`), ...errataErrors.map((e) => `- errata.yaml: ${e}`));
+  }
   if (o.full) {
     const { usage: usage2, caps } = o.full;
     L.push("", "## Usage (30 days)", "", `- Surfaced: ${Object.values(usage2.surfaced).reduce((a, b) => a + b, 0)} times across ${Object.keys(usage2.surfaced).length} rules.`, `- Never surfaced (re-check triggers): ${usage2.neverSurfaced.join(", ") || "none"}`, `- Noisy (narrow triggers): ${usage2.noisy.join(", ") || "none"}`, `- Violation feedback (reword): ${usage2.violated.join(", ") || "none"}`, `- Domains over cap: ${caps.map((c) => `${c.domain} (${c.count}/${c.cap})`).join(", ") || "none"}`);
@@ -14853,12 +15046,13 @@ function renderReport(cfg, kb, o) {
   return L.join("\n") + "\n";
 }
 function writeReport(cfg, kb, o) {
-  const file = path30.join(kbDir(cfg, kb), "REPORT.md");
-  fs29.writeFileSync(file, renderReport(cfg, kb, o));
+  const file = path31.join(kbDir(cfg, kb), "REPORT.md");
+  fs30.writeFileSync(file, renderReport(cfg, kb, o));
   return file;
 }
 var init_report = __esm({
   "packages/core/dist/knowledge/report.js"() {
+    init_errata();
     init_layers();
     init_paths();
     init_review();
@@ -14902,44 +15096,63 @@ var init_reconcile = __esm({
 
 // packages/core/dist/knowledge/cite.js
 function scanAndLogCitations(i) {
-  const at = i.at ?? i.sink?.now?.() ?? /* @__PURE__ */ new Date();
-  const since = new Date(at.getTime() - (i.lookbackDays ?? CITE_LOOKBACK_DAYS) * DAY_MS4);
-  const dir = i.sink?.dir ?? defaultAuditDir();
-  const delivered = /* @__PURE__ */ new Map();
-  const already = /* @__PURE__ */ new Set();
-  for (const r of readAuditRecords(void 0, since, dir)) {
-    if (!r.itemId || r.project !== i.project)
-      continue;
-    if (r.event === "item.cited" && r.ref === i.ref)
-      already.add(r.itemId);
-    if (!(r.event === "item.surfaced" || r.event === "item.shown") || Date.parse(r.ts) > at.getTime())
-      continue;
-    if (i.session && r.session && r.session !== i.session)
-      continue;
-    delivered.set(r.itemId, r);
-  }
-  const hits = [...delivered].filter(([id]) => !already.has(id) && mentionsId(i.text, id));
-  appendAudit(hits.map(([itemId, r]) => ({
-    kb: String(r.kb ?? ""),
-    level: String(r.level ?? "project"),
-    project: i.project,
-    domain: String(r.domain ?? "rules"),
-    itemId,
-    event: "item.cited",
-    ref: i.ref,
-    ...i.agent ? { agent: i.agent } : {},
-    ...i.session ? { session: i.session } : {}
-  })), i.sink);
-  return hits.map(([id]) => id);
+  return scanCitations([i], i);
+}
+function scanCitations(texts, o) {
+  if (!texts.length)
+    return [];
+  const now = o.sink?.now?.() ?? /* @__PURE__ */ new Date();
+  const lookbackMs = (o.lookbackDays ?? CITE_LOOKBACK_DAYS) * DAY_MS4;
+  const ats = texts.map((t) => (t.at ?? now).getTime());
+  const records = readAuditRecords(void 0, new Date(Math.min(...ats) - lookbackMs), o.sink?.dir ?? defaultAuditDir()).filter((r) => r.itemId && r.project === o.project);
+  const already = new Set(records.filter((r) => r.event === "item.cited").map((r) => `${r.ref}|${r.itemId}`));
+  const deliveries = records.filter((r) => (r.event === "item.surfaced" || r.event === "item.shown" || r.event === "item.searched") && !(o.session && r.session && r.session !== o.session));
+  const events = [];
+  texts.forEach((t, n) => {
+    const at = ats[n];
+    const delivered = /* @__PURE__ */ new Map();
+    for (const r of deliveries) {
+      const ts = Date.parse(r.ts);
+      if (ts <= at && ts >= at - lookbackMs)
+        delivered.set(r.itemId, r);
+    }
+    for (const [itemId, r] of delivered) {
+      if (already.has(`${t.ref}|${itemId}`) || !mentionsId(t.text, itemId))
+        continue;
+      already.add(`${t.ref}|${itemId}`);
+      events.push({
+        kb: String(r.kb ?? ""),
+        level: String(r.level ?? "project"),
+        project: o.project,
+        domain: String(r.domain ?? "rules"),
+        itemId,
+        event: "item.cited",
+        ref: t.ref,
+        ...o.agent ? { agent: o.agent } : {},
+        ...o.session ? { session: o.session } : {}
+      });
+    }
+  });
+  appendAudit(events, o.sink);
+  return events.map((e) => e.itemId);
 }
 function readGitMessages(repo, since, run) {
-  const out = run(["-C", repo, "log", `--since=${since.toISOString()}`, "--format=%x1e%H%x1f%cI%x1f%B"]);
+  return parseLog(run(["-C", repo, "log", "--all", `--since=${since.toISOString()}`, LOG_FORMAT]));
+}
+function readBranchOnlyMessages(repo, run, max = 200) {
+  const branch = run(["-C", repo, "rev-parse", "--abbrev-ref", "HEAD"]).trim();
+  if (!branch)
+    return [];
+  const own = branch === "HEAD" ? [] : [`--exclude=${branch}`];
+  return parseLog(run(["-C", repo, "log", `--max-count=${max}`, "HEAD", "--not", ...own, "--branches", ...own.length ? [`--exclude=*/${branch}`] : [], "--remotes", LOG_FORMAT]));
+}
+function parseLog(out) {
   return out.split("").filter((c) => c.trim()).map((c) => {
     const [sha, at, ...rest] = c.split("");
     return { sha: sha.trim(), at: new Date(at), text: rest.join("") };
   });
 }
-var DAY_MS4, CITE_LOOKBACK_DAYS, escapeRe2, mentionsId;
+var DAY_MS4, CITE_LOOKBACK_DAYS, escapeRe2, mentionsId, LOG_FORMAT;
 var init_cite = __esm({
   "packages/core/dist/knowledge/cite.js"() {
     init_audit();
@@ -14948,6 +15161,7 @@ var init_cite = __esm({
     CITE_LOOKBACK_DAYS = 7;
     escapeRe2 = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
     mentionsId = (text, id) => new RegExp(`(?<![\\w.-])${escapeRe2(id)}(?![\\w-])`).test(text);
+    LOG_FORMAT = "--format=%x1e%H%x1f%cI%x1f%B";
   }
 });
 
@@ -14965,6 +15179,7 @@ var init_knowledge2 = __esm({
     init_migrate();
     init_verify();
     init_ingest();
+    init_errata();
     init_anchor();
     init_extract();
     init_match();
@@ -15024,6 +15239,7 @@ __export(dist_exports, {
   NOISY_RATE: () => NOISY_RATE,
   OPERATOR_INITIATED_COMMANDS: () => OPERATOR_INITIATED_COMMANDS,
   PANE_IDLE_AFTER_MS: () => PANE_IDLE_AFTER_MS,
+  PASS_THROUGH: () => PASS_THROUGH,
   PROBE_QUIET_MS: () => PROBE_QUIET_MS,
   PROMPT_MIN_SCORE: () => PROMPT_MIN_SCORE,
   PROMPT_RULE_CAP: () => PROMPT_RULE_CAP,
@@ -15163,6 +15379,7 @@ __export(dist_exports, {
   encodeMsg: () => encodeMsg,
   ensureDaemon: () => ensureDaemon,
   ensureGitRepo: () => ensureGitRepo,
+  ensureKbGitignore: () => ensureKbGitignore,
   ensureSocksDir: () => ensureSocksDir,
   escalationsFile: () => escalationsFile,
   evaluateCodeConflict: () => evaluateCodeConflict,
@@ -15213,6 +15430,7 @@ __export(dist_exports, {
   isDaemonSocketLive: () => isDaemonSocketLive,
   isGateCacheEnabled: () => isGateCacheEnabled,
   isGateSession: () => isGateSession,
+  isGatedRef: () => isGatedRef,
   isNotifyActive: () => isNotifyActive,
   isOperatorInitiatedCommand: () => isOperatorInitiatedCommand,
   isPendingProposalDup: () => isPendingProposalDup,
@@ -15230,6 +15448,7 @@ __export(dist_exports, {
   launchOneWorkspace: () => launchOneWorkspace,
   legacyKbDir: () => legacyKbDir,
   listSessions: () => listSessions,
+  loadErrata: () => loadErrata,
   loadKbRules: () => loadKbRules,
   loadPending: () => loadPending,
   loadProposals: () => loadProposals,
@@ -15264,6 +15483,7 @@ __export(dist_exports, {
   normalizedViews: () => normalizedViews,
   notePaneScreen: () => notePaneScreen,
   notifyToggle: () => notifyToggle,
+  orphanedErrata: () => orphanedErrata,
   parseBearer: () => parseBearer,
   parseClassifierVerdict: () => parseClassifierVerdict,
   parseCommand: () => parseCommand,
@@ -15288,6 +15508,7 @@ __export(dist_exports, {
   pruneTopics: () => pruneTopics,
   purgeExpiredWorkItems: () => purgeExpiredWorkItems,
   readAuditRecords: () => readAuditRecords,
+  readBranchOnlyMessages: () => readBranchOnlyMessages,
   readCaptainAddress: () => readCaptainAddress,
   readCursor: () => readCursor,
   readEscalations: () => readEscalations,
@@ -15314,6 +15535,7 @@ __export(dist_exports, {
   refFor: () => refFor,
   releaseDaemonLock: () => releaseDaemonLock,
   removeRunningMarker: () => removeRunningMarker,
+  removeSource: () => removeSource,
   renderEnvAssignments: () => renderEnvAssignments,
   renderPlist: () => renderPlist,
   renderReport: () => renderReport,
@@ -15376,6 +15598,7 @@ __export(dist_exports, {
   saveSessions: () => saveSessions,
   saveState: () => saveState,
   scanAndLogCitations: () => scanAndLogCitations,
+  scanCitations: () => scanCitations,
   scheduleFile: () => scheduleFile,
   scoreKb: () => scoreKb,
   scoresFile: () => scoresFile,
@@ -15396,6 +15619,7 @@ __export(dist_exports, {
   sideNextAutoName: () => sideNextAutoName,
   sideTitleFor: () => sideTitleFor,
   snapshotSources: () => snapshotSources,
+  sourceCovers: () => sourceCovers,
   spansOverlap: () => spansOverlap,
   splitSections: () => splitSections,
   splitStatement: () => splitStatement,
@@ -15530,7 +15754,7 @@ import { readdirSync as readdirSync4, readFileSync as readFileSync12 } from "fs"
 import { join as join18 } from "path";
 
 // packages/agents/dist/claude/registry.js
-import fs30 from "fs";
+import fs31 from "fs";
 import { join as join17 } from "path";
 import { homedir as homedir7 } from "os";
 var CLAUDE_SESSIONS_DIR = join17(homedir7(), ".claude", "sessions");
@@ -15575,11 +15799,11 @@ function toLifecycleSnapshot(entry, taskId, alive, now) {
 function readClaudeStatusBySocketPath(socketPath) {
   let files;
   try {
-    files = fs30.readdirSync(CLAUDE_SESSIONS_DIR);
+    files = fs31.readdirSync(CLAUDE_SESSIONS_DIR);
   } catch {
     return void 0;
   }
-  const entries = parseRegistryDir(files, (name) => fs30.readFileSync(join17(CLAUDE_SESSIONS_DIR, name), "utf8"));
+  const entries = parseRegistryDir(files, (name) => fs31.readFileSync(join17(CLAUDE_SESSIONS_DIR, name), "utf8"));
   const entry = entries.find((e) => e.messagingSocketPath === socketPath);
   if (!entry)
     return void 0;
@@ -15602,38 +15826,38 @@ import { homedir as homedir8 } from "os";
 var SQUADRANT_STATE_DIR = join19(homedir8(), ".config", "squadrant", "state");
 
 // packages/agents/dist/drivers/launch-cmd.js
-import fs31 from "fs";
-import path31 from "path";
+import fs32 from "fs";
+import path32 from "path";
 
 // packages/agents/dist/projection/cursor.js
 import { mkdir, readFile, writeFile } from "fs/promises";
-import path32 from "path";
+import path33 from "path";
 import os10 from "os";
 
 // packages/agents/dist/projection/codex.js
 import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises";
-import path33 from "path";
+import path34 from "path";
 import os11 from "os";
 
 // packages/agents/dist/projection/gemini.js
 import { mkdir as mkdir3, readFile as readFile3, writeFile as writeFile3 } from "fs/promises";
-import path34 from "path";
+import path35 from "path";
 import os12 from "os";
 
 // packages/agents/dist/projection/opencode.js
 import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "fs/promises";
-import path35 from "path";
+import path36 from "path";
 import os13 from "os";
 
 // packages/agents/dist/projection/opencode-skills.js
-import fs32 from "fs";
+import fs33 from "fs";
 import os14 from "os";
-import path36 from "path";
+import path37 from "path";
 var OPENCODE_SKILL_MARKER = ".squadrant-managed";
 var MARKER_BODY = "squadrant\n";
 function defaultOpencodeSkillsRoot(env = process.env) {
-  const configHome = env.XDG_CONFIG_HOME || path36.join(os14.homedir(), ".config");
-  return path36.join(configHome, "opencode", "skills");
+  const configHome = env.XDG_CONFIG_HOME || path37.join(os14.homedir(), ".config");
+  return path37.join(configHome, "opencode", "skills");
 }
 var SAFE_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 function parseSkillName(raw) {
@@ -15648,62 +15872,62 @@ function parseSkillName(raw) {
 }
 function listSourceSkills(sourceSkillsDir) {
   const out = /* @__PURE__ */ new Map();
-  if (!fs32.existsSync(sourceSkillsDir))
+  if (!fs33.existsSync(sourceSkillsDir))
     return out;
-  for (const entry of fs32.readdirSync(sourceSkillsDir, { withFileTypes: true })) {
+  for (const entry of fs33.readdirSync(sourceSkillsDir, { withFileTypes: true })) {
     if (!entry.isDirectory())
       continue;
-    const skillPath = path36.join(sourceSkillsDir, entry.name, "SKILL.md");
-    if (!fs32.existsSync(skillPath))
+    const skillPath = path37.join(sourceSkillsDir, entry.name, "SKILL.md");
+    if (!fs33.existsSync(skillPath))
       continue;
-    const name = parseSkillName(fs32.readFileSync(skillPath, "utf-8"));
+    const name = parseSkillName(fs33.readFileSync(skillPath, "utf-8"));
     if (name && SAFE_NAME.test(name))
       out.set(name, skillPath);
   }
   return out;
 }
 function hasMarker(dir) {
-  return fs32.existsSync(path36.join(dir, OPENCODE_SKILL_MARKER));
+  return fs33.existsSync(path37.join(dir, OPENCODE_SKILL_MARKER));
 }
 function syncOpencodeSkills(opts) {
   const result = { written: [], unchanged: [], removed: [], skipped: [] };
   const wanted = listSourceSkills(opts.sourceSkillsDir);
-  if (wanted.size === 0 && !fs32.existsSync(opts.sourceSkillsDir))
+  if (wanted.size === 0 && !fs33.existsSync(opts.sourceSkillsDir))
     return result;
   if (!opts.dryRun)
-    fs32.mkdirSync(opts.skillsRoot, { recursive: true });
+    fs33.mkdirSync(opts.skillsRoot, { recursive: true });
   for (const [name, srcPath] of wanted) {
-    const targetDir = path36.join(opts.skillsRoot, name);
-    const targetSkill = path36.join(targetDir, "SKILL.md");
+    const targetDir = path37.join(opts.skillsRoot, name);
+    const targetSkill = path37.join(targetDir, "SKILL.md");
     const managed = hasMarker(targetDir);
-    if (fs32.existsSync(targetSkill) && !managed) {
+    if (fs33.existsSync(targetSkill) && !managed) {
       result.skipped.push({ name, reason: "foreign-collision" });
       continue;
     }
-    const current = fs32.existsSync(targetSkill) ? fs32.readFileSync(targetSkill) : null;
-    if (current && current.equals(fs32.readFileSync(srcPath))) {
+    const current = fs33.existsSync(targetSkill) ? fs33.readFileSync(targetSkill) : null;
+    if (current && current.equals(fs33.readFileSync(srcPath))) {
       if (!managed && !opts.dryRun) {
-        fs32.writeFileSync(path36.join(targetDir, OPENCODE_SKILL_MARKER), MARKER_BODY);
+        fs33.writeFileSync(path37.join(targetDir, OPENCODE_SKILL_MARKER), MARKER_BODY);
       }
       result.unchanged.push(name);
       continue;
     }
     if (!opts.dryRun) {
-      fs32.mkdirSync(targetDir, { recursive: true });
-      fs32.copyFileSync(srcPath, targetSkill);
-      fs32.writeFileSync(path36.join(targetDir, OPENCODE_SKILL_MARKER), MARKER_BODY);
+      fs33.mkdirSync(targetDir, { recursive: true });
+      fs33.copyFileSync(srcPath, targetSkill);
+      fs33.writeFileSync(path37.join(targetDir, OPENCODE_SKILL_MARKER), MARKER_BODY);
     }
     result.written.push(name);
   }
-  if (fs32.existsSync(opts.skillsRoot)) {
-    for (const entry of fs32.readdirSync(opts.skillsRoot, { withFileTypes: true })) {
+  if (fs33.existsSync(opts.skillsRoot)) {
+    for (const entry of fs33.readdirSync(opts.skillsRoot, { withFileTypes: true })) {
       if (!entry.isDirectory() || wanted.has(entry.name))
         continue;
-      const dir = path36.join(opts.skillsRoot, entry.name);
+      const dir = path37.join(opts.skillsRoot, entry.name);
       if (!hasMarker(dir))
         continue;
       if (!opts.dryRun)
-        fs32.rmSync(dir, { recursive: true, force: true });
+        fs33.rmSync(dir, { recursive: true, force: true });
       result.removed.push(entry.name);
     }
   }
@@ -15711,7 +15935,7 @@ function syncOpencodeSkills(opts) {
 }
 function syncShippedOpencodeSkills(opts) {
   return syncOpencodeSkills({
-    sourceSkillsDir: path36.join(opts.pkgRoot, "plugin", "skills"),
+    sourceSkillsDir: path37.join(opts.pkgRoot, "plugin", "skills"),
     skillsRoot: opts.skillsRoot ?? defaultOpencodeSkillsRoot(),
     dryRun: opts.dryRun
   });
@@ -15719,7 +15943,7 @@ function syncShippedOpencodeSkills(opts) {
 
 // packages/agents/dist/projection/claude.js
 import { mkdir as mkdir5, readFile as readFile5, writeFile as writeFile5 } from "fs/promises";
-import path37 from "path";
+import path38 from "path";
 import os15 from "os";
 
 // packages/agents/dist/codex/app-server-client.js
@@ -17064,9 +17288,9 @@ var ClaudeReceiptListener = class {
 };
 
 // packages/agents/dist/claude/api-key-approval.js
-import fs33 from "fs";
+import fs34 from "fs";
 import os16 from "os";
-import path38 from "path";
+import path39 from "path";
 
 // packages/agents/dist/opencode/http-channel.js
 init_dist2();
@@ -17158,10 +17382,10 @@ var OpencodeHttpChannel = class {
       return cached;
     const directory = this.directoryFor?.(taskId);
     const createdAfterMs = this.createdAfterFor?.(taskId);
-    for (const path42 of ["/session?", "/api/session?"]) {
+    for (const path43 of ["/session?", "/api/session?"]) {
       let res;
       try {
-        res = await this.request(`http://127.0.0.1:${port}${path42}`, { method: "GET" });
+        res = await this.request(`http://127.0.0.1:${port}${path43}`, { method: "GET" });
       } catch {
         return void 0;
       }
@@ -17235,9 +17459,9 @@ function createOpencodeFactAdapter(deps) {
 }
 
 // packages/agents/dist/rules-hooks/install.js
-import fs34 from "fs";
+import fs35 from "fs";
 import os17 from "os";
-import path39 from "path";
+import path40 from "path";
 
 // packages/workspaces/dist/runtimes/cmux.js
 init_dist();
@@ -17975,9 +18199,9 @@ var NotifierRegistry = class {
 };
 
 // packages/workspaces/dist/workspaces/obsidian.js
-import fs35 from "fs/promises";
+import fs36 from "fs/promises";
 import { existsSync as existsSync11 } from "fs";
-import path40 from "path";
+import path41 from "path";
 
 // packages/workspaces/dist/workspaces/registry.js
 init_dist();
@@ -18527,9 +18751,9 @@ function defaultListFiles(dir) {
     return [];
   }
 }
-function defaultReadFile(path42) {
+function defaultReadFile(path43) {
   try {
-    return readFileSync17(path42, "utf-8");
+    return readFileSync17(path43, "utf-8");
   } catch {
     return void 0;
   }
@@ -18909,16 +19133,16 @@ function extractDetail(sub, payload) {
   }
   return void 0;
 }
-function defaultReadFile2(path42) {
+function defaultReadFile2(path43) {
   try {
-    return readFileSync18(path42, "utf-8");
+    return readFileSync18(path43, "utf-8");
   } catch {
     return void 0;
   }
 }
-function defaultWriteFile(path42, content) {
-  mkdirSync8(path42.replace(/\/[^/]+$/, ""), { recursive: true });
-  writeFileSync11(path42, content, "utf-8");
+function defaultWriteFile(path43, content) {
+  mkdirSync8(path43.replace(/\/[^/]+$/, ""), { recursive: true });
+  writeFileSync11(path43, content, "utf-8");
 }
 
 // packages/workspaces/dist/crew-pane.js
@@ -19003,9 +19227,9 @@ init_dist();
 
 // packages/cli/src/lib/daemon-restart-broadcast.ts
 init_dist();
-import path41 from "path";
+import path42 from "path";
 function statePath2(stateRoot) {
-  return path41.join(stateRoot, "daemon-restart-state.json");
+  return path42.join(stateRoot, "daemon-restart-state.json");
 }
 function computeRestartSignature(version, buildMtimeMs) {
   return `${version}::${buildMtimeMs}`;
@@ -19054,7 +19278,7 @@ async function maybeBroadcastDaemonRestart(opts) {
 
 // packages/cli/src/lib/captain-channel-factory.ts
 import { createServer as createServer4, connect as netConnect } from "net";
-import fs36 from "fs";
+import fs37 from "fs";
 import { join as join26 } from "path";
 import { randomUUID as randomUUID5 } from "crypto";
 import chalk2 from "chalk";
@@ -19063,15 +19287,15 @@ var shared;
 var registryEntryPath = () => join26(CLAUDE_SESSIONS_DIR, `${process.pid}.json`);
 function unregisterSenderIdentity() {
   try {
-    fs36.unlinkSync(registryEntryPath());
+    fs37.unlinkSync(registryEntryPath());
   } catch {
   }
 }
 function registerSenderIdentity(socketPath) {
   try {
     unregisterSenderIdentity();
-    fs36.mkdirSync(CLAUDE_SESSIONS_DIR, { recursive: true });
-    fs36.writeFileSync(
+    fs37.mkdirSync(CLAUDE_SESSIONS_DIR, { recursive: true });
+    fs37.writeFileSync(
       registryEntryPath(),
       JSON.stringify({
         pid: process.pid,
@@ -19097,7 +19321,7 @@ async function sharedReceiptListener() {
     // must never be the reason we refuse to start.
     unlinkStale: (p) => {
       try {
-        fs36.unlinkSync(p);
+        fs37.unlinkSync(p);
       } catch {
       }
     },
@@ -19122,7 +19346,7 @@ async function buildCaptainChannel() {
     // in /tmp/x registers cwd "/private/tmp/x" on macOS, so cwd matching silently
     // missed and every captain ping reported accepted-unconfirmed.
     statusFor: (taskId) => readClaudeStatusBySocketPath(captainSocketPath(taskId)),
-    wire: (p, e) => writeLine(p, e, { connect: (path42) => netConnect(path42) }),
+    wire: (p, e) => writeLine(p, e, { connect: (path43) => netConnect(path43) }),
     receipts,
     newMsgId: () => randomUUID5(),
     sleep: (ms) => new Promise((r) => setTimeout(r, ms)),