superbee 0.4.3-pre.19 → 0.4.3-pre.20

package/dist/superbee.mjs

@@ -44,7 +44,7 @@ var __toESM = (mod, isNodeMode, target3) => (target3 = mod != null ? __create(__
 var define_SUPERBEE_BUILD_IDENTITY_default;
 var init_define_SUPERBEE_BUILD_IDENTITY = __esm({
   "<define:__SUPERBEE_BUILD_IDENTITY__>"() {
-    define_SUPERBEE_BUILD_IDENTITY_default = { schema: "superbee.build-identity.v1", package: { name: "superbee", version: "0.4.3-pre.19" }, source: { commit: "029ca1ac24072a5018883159d4d3e2f2de613301", dirty: false }, artifact: { channel: "npm-package" }, compatibility_contracts: { skill: 1, hook: 1, mcp: 1 } };
+    define_SUPERBEE_BUILD_IDENTITY_default = { schema: "superbee.build-identity.v1", package: { name: "superbee", version: "0.4.3-pre.20" }, source: { commit: "72beac1bac6d129a9e7792f1a5d5067d5220cf62", dirty: false }, artifact: { channel: "npm-package" }, compatibility_contracts: { skill: 1, hook: 1, mcp: 1 } };
   }
 });
 
@@ -3103,23 +3103,6 @@ var init_frontmatter = __esm({
   }
 });
 
-// ../core/src/meaningful-change-time.ts
-function meaningfulChangeTimeField(frontmatter) {
-  const generated = frontmatter.generated;
-  if (generated !== null && typeof generated === "object" && !Array.isArray(generated) && generated.at !== void 0) return "generated.at";
-  return "timestamp";
-}
-function meaningfulChangeTimeValue(frontmatter) {
-  return meaningfulChangeTimeField(frontmatter) === "generated.at" ? frontmatter.generated.at : frontmatter.timestamp;
-}
-var init_meaningful_change_time = __esm({
-  "../core/src/meaningful-change-time.ts"() {
-    "use strict";
-    init_define_SUPERBEE_BUILD_IDENTITY();
-    init_define_SUPERBEE_UPDATE_POLICY();
-  }
-});
-
 // ../core/src/errors.ts
 var InvalidInputError, OkfActorError, FilesystemIdentityAliasError, ConcurrentReplacementError;
 var init_errors = __esm({
@@ -3167,6 +3150,576 @@ var init_errors = __esm({
   }
 });
 
+// ../core/src/paths.ts
+function compareStorageKeys(a, b) {
+  const primary = a.localeCompare(b);
+  if (primary !== 0 || a === b) return primary;
+  const left = Array.from(a, (character) => character.codePointAt(0));
+  const right = Array.from(b, (character) => character.codePointAt(0));
+  for (let i = 0; i < Math.min(left.length, right.length); i++) {
+    if (left[i] !== right[i]) return left[i] - right[i];
+  }
+  return left.length - right.length;
+}
+function assertPortablePath(value, label) {
+  if (/[\u0000-\u001f\u007f]/u.test(value) || /^[a-z]:/i.test(value)) {
+    throw new InvalidInputError(`${label} must not contain controls or start with a drive prefix.`);
+  }
+  if (value.includes("\\") || value.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
+    throw new InvalidInputError(`${label} must be canonical and bundle-relative.`);
+  }
+}
+function assertSafeReservedFilename(name) {
+  if (!RESERVED_FILENAMES.includes(name)) {
+    throw new InvalidInputError("Reserved filename must be index.md or log.md.");
+  }
+}
+function toPosix(p2) {
+  return p2.replace(/\\/g, "/").replace(/\/{2,}/g, "/");
+}
+function isReservedFile(relPath) {
+  const base = toPosix(relPath).split("/").pop() ?? "";
+  return RESERVED_FILENAMES.includes(base);
+}
+function conceptIdFromPath(relPath) {
+  const norm = toPosix(relPath).replace(/^\.?\//, "").split("/").filter((segment) => segment !== ".").join("/");
+  return norm.endsWith(".md") ? norm.slice(0, -3) : norm;
+}
+function pathFromConceptId(id) {
+  assertSafeConceptId(id);
+  return `${id}.md`;
+}
+function assertSafeConceptId(id) {
+  if (typeof id !== "string" || id.trim() === "") {
+    throw new InvalidInputError("Concept id must be a non-empty string.");
+  }
+  assertPortablePath(id, "Concept id");
+  const segments = id.split("/");
+  if (segments.slice(0, -1).some((seg) => seg.toLowerCase().endsWith(".md"))) {
+    throw new InvalidInputError(
+      `Concept id must not contain a non-final segment ending in '.md': '${id}' (it collides with a concept file at that path).`
+    );
+  }
+}
+function nonCanonicalDocumentId(id) {
+  const segments = id.split("/");
+  if (segments.some((segment) => segment !== segment.trim())) return "segment_whitespace";
+  if (segments.some((segment) => FORMAT_AT_EDGE.test(segment) || FORMAT_INSIDE.test(segment))) return "format_character";
+  if (id !== id.normalize("NFC")) return "not_nfc";
+  return null;
+}
+function assertSafeBlobKey(key4) {
+  if (typeof key4 !== "string" || key4.trim() === "") {
+    throw new InvalidInputError("Blob key must be a non-empty string.");
+  }
+  assertPortablePath(key4, "Blob key");
+  const segments = key4.split("/");
+  if (segments.some((seg) => seg.startsWith("."))) {
+    throw new InvalidInputError(`Blob key must not contain dot-prefixed segments: '${key4}'.`);
+  }
+  if (segments.some((seg) => seg.toLowerCase().endsWith(".md"))) {
+    throw new InvalidInputError(
+      `Blob key '${key4}' has a path segment ending in '.md' (checked case-insensitively, at any depth), which collides with the concept-document namespace \u2014 write it as a doc instead.`
+    );
+  }
+}
+function assertSafeReservedDir(dir) {
+  if (typeof dir !== "string") {
+    throw new InvalidInputError("Reserved-file directory must be a string.");
+  }
+  if (dir !== "") assertPortablePath(dir, "Reserved-file directory");
+}
+var RESERVED_FILENAMES, FORMAT_AT_EDGE, FORMAT_INSIDE;
+var init_paths = __esm({
+  "../core/src/paths.ts"() {
+    "use strict";
+    init_define_SUPERBEE_BUILD_IDENTITY();
+    init_define_SUPERBEE_UPDATE_POLICY();
+    init_errors();
+    RESERVED_FILENAMES = ["index.md", "log.md"];
+    FORMAT_AT_EDGE = new RegExp("^\\p{Cf}|\\p{Cf}$", "u");
+    FORMAT_INSIDE = new RegExp("(?![\\u200c\\u200d])\\p{Cf}", "u");
+  }
+});
+
+// ../core/src/links.ts
+function normalizeSegments(segments) {
+  const out = [];
+  for (const segment of segments) {
+    if (segment === "" || segment === ".") continue;
+    if (segment === ".." && out.length > 0 && out[out.length - 1] !== "..") {
+      out.pop();
+      continue;
+    }
+    out.push(segment);
+  }
+  return out;
+}
+function joinPosix(base, rel) {
+  return normalizeSegments([...base.split("/"), ...rel.split("/")]).join("/");
+}
+function relativePosix(from, to) {
+  const fromSegments = normalizeSegments(from.split("/"));
+  const toSegments = normalizeSegments(to.split("/"));
+  let common = 0;
+  while (common < fromSegments.length && common < toSegments.length && fromSegments[common] === toSegments[common]) {
+    common++;
+  }
+  const ups = fromSegments.length - common;
+  return [...Array(ups).fill(".."), ...toSegments.slice(common)].join("/");
+}
+function isExternalHref(href) {
+  const h2 = href.trim();
+  return /^[a-z][a-z0-9+.-]*:\/\//i.test(h2) || h2.startsWith("mailto:") || h2.startsWith("#");
+}
+function extractMarkdownLinks(source2, options = {}) {
+  const body = options.skipCode ? maskMarkdownCode(source2) : source2;
+  const out = [];
+  let textOpen = -1;
+  let afterClose;
+  let hrefFirst;
+  let hrefRest;
+  for (let cursor = 0; cursor < body.length; cursor++) {
+    const char = body[cursor];
+    if (hrefRest) {
+      if (char === ")") {
+        if (hrefRest.open === 0 || body[hrefRest.open - 1] !== "!") {
+          out.push({
+            text: source2.slice(hrefRest.open + 1, hrefRest.close),
+            href: source2.slice(hrefRest.hrefStart, cursor)
+          });
+        }
+        textOpen = -1;
+        afterClose = void 0;
+        hrefFirst = void 0;
+        hrefRest = void 0;
+        continue;
+      }
+      if (char.trim() === "") hrefRest = void 0;
+    }
+    if (hrefFirst) {
+      if (char !== ")" && char.trim() !== "" && !hrefRest) {
+        hrefRest = hrefFirst;
+      }
+      hrefFirst = void 0;
+    }
+    if (afterClose) {
+      if (char === "(") {
+        hrefFirst = { ...afterClose, hrefStart: cursor + 1 };
+      }
+      afterClose = void 0;
+    }
+    if (textOpen >= 0 && char === "]") {
+      afterClose = { open: textOpen, close: cursor };
+      textOpen = -1;
+    }
+    if (char === "[" && textOpen < 0) textOpen = cursor;
+  }
+  return out;
+}
+function leadingIndent(line2, from, startColumn) {
+  let columns = 0;
+  let index2 = from;
+  while (index2 < line2.length) {
+    const char = line2[index2];
+    if (char === " ") columns += 1;
+    else if (char === "	") columns += 4 - (startColumn + columns) % 4;
+    else break;
+    index2++;
+  }
+  return { columns, chars: index2 - from };
+}
+function maskMarkdownCode(body) {
+  const out = body.split("");
+  const blank = (from, to) => {
+    for (let index2 = from; index2 < to; index2++) if (out[index2] !== "\n" && out[index2] !== "\r") out[index2] = " ";
+  };
+  const lists = [];
+  let fence = null;
+  let inParagraph = false;
+  let segmentStart = -1;
+  const closeSegment = (end) => {
+    if (segmentStart >= 0) maskCodeSpans(body, segmentStart, end, blank);
+    segmentStart = -1;
+  };
+  let lineStart = 0;
+  while (lineStart <= body.length) {
+    const newline = body.indexOf("\n", lineStart);
+    const lineEnd = newline < 0 ? body.length : newline;
+    const line2 = body.slice(lineStart, lineEnd);
+    let contentAt = 0;
+    let quotes = 0;
+    for (let match = /^ {0,3}> ?/.exec(line2); match; match = /^ {0,3}> ?/.exec(line2.slice(contentAt))) {
+      if (fence && quotes >= fence.quotes) break;
+      contentAt += match[0].length;
+      quotes++;
+    }
+    const { columns: indent2, chars } = leadingIndent(line2, contentAt, contentAt);
+    const rest = line2.slice(contentAt + chars).replace(/\r$/, "");
+    const isBlank = rest.trim() === "";
+    if (fence && (quotes < fence.quotes || !isBlank && indent2 < fence.container)) fence = null;
+    if (fence) {
+      const close = indent2 - fence.container <= 3 ? FENCE_OPEN.exec(rest) : null;
+      if (close && close[1][0] === fence.char && close[1].length >= fence.length && close[2].trim() === "") fence = null;
+      blank(lineStart, lineEnd);
+    } else if (isBlank) {
+      closeSegment(lineStart);
+      inParagraph = false;
+    } else {
+      if (!inParagraph) while (lists.length > 0 && lists[lists.length - 1] > indent2) lists.pop();
+      let container = lists.length > 0 ? lists[lists.length - 1] : 0;
+      let relative3 = indent2 - container;
+      let text5 = rest;
+      let textAt = lineStart + contentAt + chars;
+      const marker = relative3 <= 3 && !THEMATIC_BREAK.test(text5) ? LIST_MARKER.exec(text5) : null;
+      if (marker) {
+        closeSegment(lineStart);
+        const markerEnd = indent2 + marker[1].length;
+        const spacing = leadingIndent(marker[2], 0, contentAt + markerEnd).columns;
+        const wide = marker[2] === "" || spacing >= 5;
+        lists.push(markerEnd + (wide ? 1 : spacing));
+        container = lists[lists.length - 1];
+        text5 = text5.slice(marker[1].length + (wide ? 0 : marker[2].length));
+        textAt += marker[1].length + (wide ? 0 : marker[2].length);
+        relative3 = wide ? Math.max(spacing - 1, 0) : 0;
+        inParagraph = false;
+      }
+      const open5 = relative3 <= 3 ? FENCE_OPEN.exec(text5) : null;
+      if (open5 && !(open5[1][0] === "`" && open5[2].includes("`"))) {
+        closeSegment(lineStart);
+        fence = { char: open5[1][0], length: open5[1].length, container, quotes };
+        blank(textAt, lineEnd);
+        inParagraph = false;
+      } else if (!inParagraph && relative3 >= 4) {
+        closeSegment(lineStart);
+        blank(textAt, lineEnd);
+      } else if (ATX_HEADING.test(text5) || THEMATIC_BREAK.test(text5)) {
+        closeSegment(lineStart);
+        maskCodeSpans(body, textAt, lineEnd, blank);
+        inParagraph = false;
+      } else {
+        if (segmentStart < 0) segmentStart = textAt;
+        inParagraph = text5.trim() !== "";
+      }
+    }
+    if (newline < 0) break;
+    lineStart = newline + 1;
+  }
+  closeSegment(body.length);
+  return out.join("");
+}
+function maskCodeSpans(body, from, to, blank) {
+  const runs = [];
+  for (let index2 = from; index2 < to; ) {
+    if (body[index2] !== "`") {
+      index2++;
+      continue;
+    }
+    let end = index2;
+    while (end < to && body[end] === "`") end++;
+    runs.push({ at: index2, length: end - index2 });
+    index2 = end;
+  }
+  const byLength = /* @__PURE__ */ new Map();
+  runs.forEach((run, position2) => {
+    const list6 = byLength.get(run.length);
+    if (list6) list6.push(position2);
+    else byLength.set(run.length, [position2]);
+  });
+  const next = /* @__PURE__ */ new Map();
+  const nextRun = (length, after) => {
+    const list6 = byLength.get(length);
+    if (!list6) return -1;
+    let cursor = next.get(length) ?? 0;
+    while (cursor < list6.length && list6[cursor] <= after) cursor++;
+    next.set(length, cursor);
+    return cursor < list6.length ? list6[cursor] : -1;
+  };
+  let escapeScan = from;
+  let escaped = false;
+  for (let position2 = 0; position2 < runs.length; position2++) {
+    let { at, length } = runs[position2];
+    for (; escapeScan < at; escapeScan++) escaped = body[escapeScan] === "\\" ? !escaped : false;
+    if (escaped) {
+      at += 1;
+      length -= 1;
+      escaped = false;
+      if (length === 0) continue;
+      const list6 = byLength.get(length);
+      if (!list6) continue;
+    }
+    const closer = nextRun(length, position2);
+    if (closer < 0) continue;
+    const close = runs[closer];
+    blank(at, close.at + close.length);
+    position2 = closer;
+    escapeScan = close.at + close.length;
+    escaped = false;
+  }
+}
+function resolveConceptId(fromId, href) {
+  const target3 = (href.split("#")[0] ?? "").split("?")[0]?.trim() ?? "";
+  if (target3 === "" || isExternalHref(target3)) return null;
+  if (!target3.endsWith(".md")) return null;
+  let resolved;
+  if (target3.startsWith("/")) {
+    resolved = target3.slice(1);
+  } else {
+    const slash = fromId.lastIndexOf("/");
+    const fromDir = slash >= 0 ? fromId.slice(0, slash) : "";
+    resolved = joinPosix(fromDir, target3);
+  }
+  resolved = resolved.replace(/^(\.\.\/)+/, "");
+  if (isReservedFile(resolved)) return null;
+  const id = resolved.replace(/\.md$/, "");
+  try {
+    assertSafeConceptId(id);
+    return id;
+  } catch (error51) {
+    if (error51 instanceof InvalidInputError) return null;
+    throw error51;
+  }
+}
+function relativeHref(fromId, target3) {
+  const t = target3.trim();
+  if (isExternalHref(t)) return t;
+  assertSafeConceptId(fromId);
+  assertSafeConceptId(t);
+  const targetId = t;
+  const slash = fromId.lastIndexOf("/");
+  const fromDir = slash >= 0 ? fromId.slice(0, slash) : "";
+  return relativePosix(fromDir, `${targetId}.md`);
+}
+function parseLinksFromDoc(doc2) {
+  const links = [];
+  for (const raw of extractMarkdownLinks(doc2.body)) {
+    const to = resolveConceptId(doc2.id, raw.href);
+    if (to === null) continue;
+    links.push({ from: doc2.id, to, text: raw.text, href: raw.href });
+  }
+  return links;
+}
+var FENCE_OPEN, LIST_MARKER, THEMATIC_BREAK, ATX_HEADING;
+var init_links = __esm({
+  "../core/src/links.ts"() {
+    "use strict";
+    init_define_SUPERBEE_BUILD_IDENTITY();
+    init_define_SUPERBEE_UPDATE_POLICY();
+    init_paths();
+    init_errors();
+    FENCE_OPEN = /^(`{3,}|~{3,})(.*)$/;
+    LIST_MARKER = /^([-+*]|\d{1,9}[.)])([ \t]+|$)/;
+    THEMATIC_BREAK = /^(?:(?:\*[ \t]*){3,}|(?:-[ \t]*){3,}|(?:_[ \t]*){3,})$/;
+    ATX_HEADING = /^#{1,6}(?:[ \t]|$)/;
+  }
+});
+
+// ../core/src/body-replace-guards.ts
+function previewTruncationNotice(omitted) {
+  return `${BODY_PREVIEW_TRUNCATION_MARKER} ${omitted} more character(s) are NOT shown`;
+}
+function attachBodyPreview(rec, body, fullBodyHelp) {
+  if (body.length <= BODY_PREVIEW_LIMIT) {
+    rec.body = body;
+    return;
+  }
+  const omitted = body.length - BODY_PREVIEW_LIMIT;
+  rec[BODY_PREVIEW_KEY] = `${body.slice(0, BODY_PREVIEW_LIMIT)}
+
+${previewTruncationNotice(omitted)} \u2014 this value is a preview, not the document body; use this record's help to read the complete body before rewriting it.`;
+  rec.body_truncated = true;
+  rec.body_chars = body.length;
+  rec.help = [...fullBodyHelp];
+}
+function matchesPreviewSlice(candidate, preview4) {
+  if (candidate === preview4) return true;
+  const trimmed = preview4.trimEnd();
+  return trimmed !== "" && candidate.trimEnd() === trimmed;
+}
+function firstForeignNotice(storedBody, nextBody) {
+  const preservesStoredBody = nextBody.includes(storedBody.trimEnd());
+  const every = new RegExp(BODY_PREVIEW_TRUNCATION_SIGNATURE.source, `${BODY_PREVIEW_TRUNCATION_SIGNATURE.flags}g`);
+  for (const match of nextBody.matchAll(every)) {
+    if (!(preservesStoredBody && storedBody.includes(match[0]))) return match[0];
+  }
+  return void 0;
+}
+function isSameStoredBody(nextBody, existingBody) {
+  return normalizeDocumentBodyForStorage(nextBody) === normalizeDocumentBodyForStorage(existingBody);
+}
+function bodyPreviewFinding(existing, nextBody) {
+  if (isSameStoredBody(nextBody, existing.body)) return;
+  const notice = firstForeignNotice(existing.body, nextBody);
+  if (notice !== void 0) return { reason: "preview_marker", marker: BODY_PREVIEW_TRUNCATION_MARKER, notice };
+  if (existing.body.length > BODY_PREVIEW_LIMIT && matchesPreviewSlice(nextBody, existing.body.slice(0, BODY_PREVIEW_LIMIT))) {
+    return { reason: "stored_body_preview", preview_limit: BODY_PREVIEW_LIMIT, supplied_body_chars: nextBody.length, stored_body_chars: existing.body.length };
+  }
+}
+function captureBodyReplacePosture(value) {
+  if (value === void 0) return;
+  if (value === null || typeof value !== "object" || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value))) {
+    throw new InvalidInputError("bodyReplace must be an object with boolean acceptTruncatedBody and/or replaceLinks fields.");
+  }
+  const captured = {};
+  for (const key4 of Reflect.ownKeys(value)) {
+    if (key4 !== "acceptTruncatedBody" && key4 !== "replaceLinks") throw new InvalidInputError("Unknown bodyReplace field.");
+    const descriptor = Object.getOwnPropertyDescriptor(value, key4);
+    if (!("value" in descriptor) || typeof descriptor.value !== "boolean") throw new InvalidInputError(`bodyReplace.${key4} must be a boolean.`);
+    captured[key4] = descriptor.value;
+  }
+  return captured;
+}
+function computeDroppedLinks(existingLinks, nextLinks, mode = "target") {
+  const nextByTarget = /* @__PURE__ */ new Map();
+  for (const l of nextLinks) {
+    const key4 = mode === "exact-edge" ? JSON.stringify([l.from, l.to]) : l.to;
+    const bucket = nextByTarget.get(key4);
+    if (bucket) bucket.push(l);
+    else nextByTarget.set(key4, [l]);
+  }
+  const existingByTarget = /* @__PURE__ */ new Map();
+  for (const l of existingLinks) {
+    const key4 = mode === "exact-edge" ? JSON.stringify([l.from, l.to]) : l.to;
+    const bucket = existingByTarget.get(key4);
+    if (bucket) bucket.push(l);
+    else existingByTarget.set(key4, [l]);
+  }
+  const dropped = [];
+  for (const [target3, oldOccurrences] of existingByTarget) {
+    const available = [...nextByTarget.get(target3) ?? []];
+    const unmatchedExact = [];
+    for (const old of oldOccurrences) {
+      const idx = available.findIndex((n) => n.text === old.text);
+      if (idx >= 0) available.splice(idx, 1);
+      else unmatchedExact.push(old);
+    }
+    for (const old of unmatchedExact) {
+      if (mode === "target" && available.length > 0) available.shift();
+      else dropped.push(old);
+    }
+  }
+  return dropped;
+}
+function droppedLinks(_bundle, existing, nextBody) {
+  return computeDroppedLinks(parseLinksFromDoc(existing), parseLinksFromDoc({ ...existing, body: nextBody }));
+}
+function guardTruncatedBodyPreview(existing, nextBody, acceptTruncatedBody) {
+  if (acceptTruncatedBody) return;
+  const finding = bodyPreviewFinding(existing, nextBody);
+  if (finding) throw new BodyReplaceError(existing.id, finding, BODY_PREVIEW_TRUNCATION_SIGNATURE.test(existing.body));
+}
+function guardDroppedLinks(bundle, existing, nextBody, replaceLinks) {
+  if (replaceLinks || isSameStoredBody(nextBody, existing.body)) return;
+  const dropped = droppedLinks(bundle, existing, nextBody);
+  if (dropped.length) throw new BodyReplaceError(existing.id, { reason: "dropped_links", dropped_links: dropped });
+}
+function guardBodyReplace(bundle, existing, nextBody, posture) {
+  if (isSameStoredBody(nextBody, existing.body)) return;
+  guardTruncatedBodyPreview(existing, nextBody, Boolean(posture?.acceptTruncatedBody));
+  guardDroppedLinks(bundle, existing, nextBody, Boolean(posture?.replaceLinks));
+}
+function assertTypedListPatch(kind2, storageField) {
+  const types = kind2.fields.types ?? {};
+  const type = Object.hasOwn(types, storageField) ? types[storageField] : void 0;
+  if (type === "string-list" || type === "https-url-list") throw new TypedListPatchError(storageField, type);
+}
+var BODY_PREVIEW_LIMIT, BODY_PREVIEW_TRUNCATION_MARKER, BODY_PREVIEW_TRUNCATION_SIGNATURE, BODY_PREVIEW_KEY, BODY_PREVIEW_RESERVED_KEYS, BodyReplaceError, TypedListPatchError;
+var init_body_replace_guards = __esm({
+  "../core/src/body-replace-guards.ts"() {
+    "use strict";
+    init_define_SUPERBEE_BUILD_IDENTITY();
+    init_define_SUPERBEE_UPDATE_POLICY();
+    init_frontmatter();
+    init_links();
+    init_errors();
+    BODY_PREVIEW_LIMIT = 1e3;
+    BODY_PREVIEW_TRUNCATION_MARKER = "[superbee:body-preview-truncated]";
+    BODY_PREVIEW_TRUNCATION_SIGNATURE = /\[superbee:body-preview-truncated\]\s+\d+\s+more\s+characters?\(?s?\)?\s+are\s+NOT\s+shown/i;
+    BODY_PREVIEW_KEY = "body_preview";
+    BODY_PREVIEW_RESERVED_KEYS = [
+      "body",
+      BODY_PREVIEW_KEY,
+      "body_truncated",
+      "body_chars",
+      "help"
+    ];
+    BodyReplaceError = class extends InvalidInputError {
+      id;
+      finding;
+      storedCarriesNotice;
+      constructor(id, finding, storedCarriesNotice = false) {
+        super(`Body replacement of '${id}' refused: ${finding.reason}.`);
+        this.name = "BodyReplaceError";
+        this.id = id;
+        this.finding = finding;
+        this.storedCarriesNotice = storedCarriesNotice;
+      }
+    };
+    TypedListPatchError = class extends InvalidInputError {
+      field;
+      fieldType;
+      constructor(field, fieldType) {
+        super(`'${field}' is a ${fieldType} field; use an explicit whole-list replacement.`);
+        this.name = "TypedListPatchError";
+        this.field = field;
+        this.fieldType = fieldType;
+      }
+    };
+  }
+});
+
+// ../core/src/version-transport.ts
+function isContentVersion(value) {
+  return typeof value === "string" && /^sha256:[0-9a-f]{64}$/.test(value);
+}
+function stripETagWrapper(raw) {
+  let value = raw.trim();
+  if (value.startsWith("W/")) value = value.slice(2);
+  if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
+    value = value.slice(1, -1);
+  }
+  return value;
+}
+var VersionConflict;
+var init_version_transport = __esm({
+  "../core/src/version-transport.ts"() {
+    "use strict";
+    init_define_SUPERBEE_BUILD_IDENTITY();
+    init_define_SUPERBEE_UPDATE_POLICY();
+    VersionConflict = class extends Error {
+      name = "VersionConflict";
+      id;
+      expected;
+      actual;
+      constructor(id, expected, actual) {
+        super(
+          `version conflict on '${id}': expected ${expected ?? "absent"}, found ${actual ?? "none"} (the document changed since you read it \u2014 re-read and retry)`
+        );
+        this.id = id;
+        this.expected = expected;
+        this.actual = actual;
+      }
+    };
+  }
+});
+
+// ../core/src/meaningful-change-time.ts
+function meaningfulChangeTimeField(frontmatter) {
+  const generated = frontmatter.generated;
+  if (generated !== null && typeof generated === "object" && !Array.isArray(generated) && generated.at !== void 0) return "generated.at";
+  return "timestamp";
+}
+function meaningfulChangeTimeValue(frontmatter) {
+  return meaningfulChangeTimeField(frontmatter) === "generated.at" ? frontmatter.generated.at : frontmatter.timestamp;
+}
+var init_meaningful_change_time = __esm({
+  "../core/src/meaningful-change-time.ts"() {
+    "use strict";
+    init_define_SUPERBEE_BUILD_IDENTITY();
+    init_define_SUPERBEE_UPDATE_POLICY();
+  }
+});
+
 // ../core/src/okf-actor.ts
 function isOkfActor(value) {
   if (typeof value !== "string" || value.trim() !== value || value.length === 0 || /\s/.test(value)) {
@@ -3786,370 +4339,6 @@ var init_document_write_policy = __esm({
   }
 });
 
-// ../core/src/paths.ts
-function compareStorageKeys(a, b) {
-  const primary = a.localeCompare(b);
-  if (primary !== 0 || a === b) return primary;
-  const left = Array.from(a, (character) => character.codePointAt(0));
-  const right = Array.from(b, (character) => character.codePointAt(0));
-  for (let i = 0; i < Math.min(left.length, right.length); i++) {
-    if (left[i] !== right[i]) return left[i] - right[i];
-  }
-  return left.length - right.length;
-}
-function assertPortablePath(value, label) {
-  if (/[\u0000-\u001f\u007f]/u.test(value) || /^[a-z]:/i.test(value)) {
-    throw new InvalidInputError(`${label} must not contain controls or start with a drive prefix.`);
-  }
-  if (value.includes("\\") || value.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
-    throw new InvalidInputError(`${label} must be canonical and bundle-relative.`);
-  }
-}
-function assertSafeReservedFilename(name) {
-  if (!RESERVED_FILENAMES.includes(name)) {
-    throw new InvalidInputError("Reserved filename must be index.md or log.md.");
-  }
-}
-function toPosix(p2) {
-  return p2.replace(/\\/g, "/").replace(/\/{2,}/g, "/");
-}
-function isReservedFile(relPath) {
-  const base = toPosix(relPath).split("/").pop() ?? "";
-  return RESERVED_FILENAMES.includes(base);
-}
-function conceptIdFromPath(relPath) {
-  const norm = toPosix(relPath).replace(/^\.?\//, "").split("/").filter((segment) => segment !== ".").join("/");
-  return norm.endsWith(".md") ? norm.slice(0, -3) : norm;
-}
-function pathFromConceptId(id) {
-  assertSafeConceptId(id);
-  return `${id}.md`;
-}
-function assertSafeConceptId(id) {
-  if (typeof id !== "string" || id.trim() === "") {
-    throw new InvalidInputError("Concept id must be a non-empty string.");
-  }
-  assertPortablePath(id, "Concept id");
-  const segments = id.split("/");
-  if (segments.slice(0, -1).some((seg) => seg.toLowerCase().endsWith(".md"))) {
-    throw new InvalidInputError(
-      `Concept id must not contain a non-final segment ending in '.md': '${id}' (it collides with a concept file at that path).`
-    );
-  }
-}
-function nonCanonicalDocumentId(id) {
-  const segments = id.split("/");
-  if (segments.some((segment) => segment !== segment.trim())) return "segment_whitespace";
-  if (segments.some((segment) => FORMAT_AT_EDGE.test(segment) || FORMAT_INSIDE.test(segment))) return "format_character";
-  if (id !== id.normalize("NFC")) return "not_nfc";
-  return null;
-}
-function assertSafeBlobKey(key4) {
-  if (typeof key4 !== "string" || key4.trim() === "") {
-    throw new InvalidInputError("Blob key must be a non-empty string.");
-  }
-  assertPortablePath(key4, "Blob key");
-  const segments = key4.split("/");
-  if (segments.some((seg) => seg.startsWith("."))) {
-    throw new InvalidInputError(`Blob key must not contain dot-prefixed segments: '${key4}'.`);
-  }
-  if (segments.some((seg) => seg.toLowerCase().endsWith(".md"))) {
-    throw new InvalidInputError(
-      `Blob key '${key4}' has a path segment ending in '.md' (checked case-insensitively, at any depth), which collides with the concept-document namespace \u2014 write it as a doc instead.`
-    );
-  }
-}
-function assertSafeReservedDir(dir) {
-  if (typeof dir !== "string") {
-    throw new InvalidInputError("Reserved-file directory must be a string.");
-  }
-  if (dir !== "") assertPortablePath(dir, "Reserved-file directory");
-}
-var RESERVED_FILENAMES, FORMAT_AT_EDGE, FORMAT_INSIDE;
-var init_paths = __esm({
-  "../core/src/paths.ts"() {
-    "use strict";
-    init_define_SUPERBEE_BUILD_IDENTITY();
-    init_define_SUPERBEE_UPDATE_POLICY();
-    init_errors();
-    RESERVED_FILENAMES = ["index.md", "log.md"];
-    FORMAT_AT_EDGE = new RegExp("^\\p{Cf}|\\p{Cf}$", "u");
-    FORMAT_INSIDE = new RegExp("(?![\\u200c\\u200d])\\p{Cf}", "u");
-  }
-});
-
-// ../core/src/links.ts
-function normalizeSegments(segments) {
-  const out = [];
-  for (const segment of segments) {
-    if (segment === "" || segment === ".") continue;
-    if (segment === ".." && out.length > 0 && out[out.length - 1] !== "..") {
-      out.pop();
-      continue;
-    }
-    out.push(segment);
-  }
-  return out;
-}
-function joinPosix(base, rel) {
-  return normalizeSegments([...base.split("/"), ...rel.split("/")]).join("/");
-}
-function relativePosix(from, to) {
-  const fromSegments = normalizeSegments(from.split("/"));
-  const toSegments = normalizeSegments(to.split("/"));
-  let common = 0;
-  while (common < fromSegments.length && common < toSegments.length && fromSegments[common] === toSegments[common]) {
-    common++;
-  }
-  const ups = fromSegments.length - common;
-  return [...Array(ups).fill(".."), ...toSegments.slice(common)].join("/");
-}
-function isExternalHref(href) {
-  const h2 = href.trim();
-  return /^[a-z][a-z0-9+.-]*:\/\//i.test(h2) || h2.startsWith("mailto:") || h2.startsWith("#");
-}
-function extractMarkdownLinks(source2, options = {}) {
-  const body = options.skipCode ? maskMarkdownCode(source2) : source2;
-  const out = [];
-  let textOpen = -1;
-  let afterClose;
-  let hrefFirst;
-  let hrefRest;
-  for (let cursor = 0; cursor < body.length; cursor++) {
-    const char = body[cursor];
-    if (hrefRest) {
-      if (char === ")") {
-        if (hrefRest.open === 0 || body[hrefRest.open - 1] !== "!") {
-          out.push({
-            text: source2.slice(hrefRest.open + 1, hrefRest.close),
-            href: source2.slice(hrefRest.hrefStart, cursor)
-          });
-        }
-        textOpen = -1;
-        afterClose = void 0;
-        hrefFirst = void 0;
-        hrefRest = void 0;
-        continue;
-      }
-      if (char.trim() === "") hrefRest = void 0;
-    }
-    if (hrefFirst) {
-      if (char !== ")" && char.trim() !== "" && !hrefRest) {
-        hrefRest = hrefFirst;
-      }
-      hrefFirst = void 0;
-    }
-    if (afterClose) {
-      if (char === "(") {
-        hrefFirst = { ...afterClose, hrefStart: cursor + 1 };
-      }
-      afterClose = void 0;
-    }
-    if (textOpen >= 0 && char === "]") {
-      afterClose = { open: textOpen, close: cursor };
-      textOpen = -1;
-    }
-    if (char === "[" && textOpen < 0) textOpen = cursor;
-  }
-  return out;
-}
-function leadingIndent(line2, from, startColumn) {
-  let columns = 0;
-  let index2 = from;
-  while (index2 < line2.length) {
-    const char = line2[index2];
-    if (char === " ") columns += 1;
-    else if (char === "	") columns += 4 - (startColumn + columns) % 4;
-    else break;
-    index2++;
-  }
-  return { columns, chars: index2 - from };
-}
-function maskMarkdownCode(body) {
-  const out = body.split("");
-  const blank = (from, to) => {
-    for (let index2 = from; index2 < to; index2++) if (out[index2] !== "\n" && out[index2] !== "\r") out[index2] = " ";
-  };
-  const lists = [];
-  let fence = null;
-  let inParagraph = false;
-  let segmentStart = -1;
-  const closeSegment = (end) => {
-    if (segmentStart >= 0) maskCodeSpans(body, segmentStart, end, blank);
-    segmentStart = -1;
-  };
-  let lineStart = 0;
-  while (lineStart <= body.length) {
-    const newline = body.indexOf("\n", lineStart);
-    const lineEnd = newline < 0 ? body.length : newline;
-    const line2 = body.slice(lineStart, lineEnd);
-    let contentAt = 0;
-    let quotes = 0;
-    for (let match = /^ {0,3}> ?/.exec(line2); match; match = /^ {0,3}> ?/.exec(line2.slice(contentAt))) {
-      if (fence && quotes >= fence.quotes) break;
-      contentAt += match[0].length;
-      quotes++;
-    }
-    const { columns: indent2, chars } = leadingIndent(line2, contentAt, contentAt);
-    const rest = line2.slice(contentAt + chars).replace(/\r$/, "");
-    const isBlank = rest.trim() === "";
-    if (fence && (quotes < fence.quotes || !isBlank && indent2 < fence.container)) fence = null;
-    if (fence) {
-      const close = indent2 - fence.container <= 3 ? FENCE_OPEN.exec(rest) : null;
-      if (close && close[1][0] === fence.char && close[1].length >= fence.length && close[2].trim() === "") fence = null;
-      blank(lineStart, lineEnd);
-    } else if (isBlank) {
-      closeSegment(lineStart);
-      inParagraph = false;
-    } else {
-      if (!inParagraph) while (lists.length > 0 && lists[lists.length - 1] > indent2) lists.pop();
-      let container = lists.length > 0 ? lists[lists.length - 1] : 0;
-      let relative3 = indent2 - container;
-      let text5 = rest;
-      let textAt = lineStart + contentAt + chars;
-      const marker = relative3 <= 3 && !THEMATIC_BREAK.test(text5) ? LIST_MARKER.exec(text5) : null;
-      if (marker) {
-        closeSegment(lineStart);
-        const markerEnd = indent2 + marker[1].length;
-        const spacing = leadingIndent(marker[2], 0, contentAt + markerEnd).columns;
-        const wide = marker[2] === "" || spacing >= 5;
-        lists.push(markerEnd + (wide ? 1 : spacing));
-        container = lists[lists.length - 1];
-        text5 = text5.slice(marker[1].length + (wide ? 0 : marker[2].length));
-        textAt += marker[1].length + (wide ? 0 : marker[2].length);
-        relative3 = wide ? Math.max(spacing - 1, 0) : 0;
-        inParagraph = false;
-      }
-      const open5 = relative3 <= 3 ? FENCE_OPEN.exec(text5) : null;
-      if (open5 && !(open5[1][0] === "`" && open5[2].includes("`"))) {
-        closeSegment(lineStart);
-        fence = { char: open5[1][0], length: open5[1].length, container, quotes };
-        blank(textAt, lineEnd);
-        inParagraph = false;
-      } else if (!inParagraph && relative3 >= 4) {
-        closeSegment(lineStart);
-        blank(textAt, lineEnd);
-      } else if (ATX_HEADING.test(text5) || THEMATIC_BREAK.test(text5)) {
-        closeSegment(lineStart);
-        maskCodeSpans(body, textAt, lineEnd, blank);
-        inParagraph = false;
-      } else {
-        if (segmentStart < 0) segmentStart = textAt;
-        inParagraph = text5.trim() !== "";
-      }
-    }
-    if (newline < 0) break;
-    lineStart = newline + 1;
-  }
-  closeSegment(body.length);
-  return out.join("");
-}
-function maskCodeSpans(body, from, to, blank) {
-  const runs = [];
-  for (let index2 = from; index2 < to; ) {
-    if (body[index2] !== "`") {
-      index2++;
-      continue;
-    }
-    let end = index2;
-    while (end < to && body[end] === "`") end++;
-    runs.push({ at: index2, length: end - index2 });
-    index2 = end;
-  }
-  const byLength = /* @__PURE__ */ new Map();
-  runs.forEach((run, position2) => {
-    const list6 = byLength.get(run.length);
-    if (list6) list6.push(position2);
-    else byLength.set(run.length, [position2]);
-  });
-  const next = /* @__PURE__ */ new Map();
-  const nextRun = (length, after) => {
-    const list6 = byLength.get(length);
-    if (!list6) return -1;
-    let cursor = next.get(length) ?? 0;
-    while (cursor < list6.length && list6[cursor] <= after) cursor++;
-    next.set(length, cursor);
-    return cursor < list6.length ? list6[cursor] : -1;
-  };
-  let escapeScan = from;
-  let escaped = false;
-  for (let position2 = 0; position2 < runs.length; position2++) {
-    let { at, length } = runs[position2];
-    for (; escapeScan < at; escapeScan++) escaped = body[escapeScan] === "\\" ? !escaped : false;
-    if (escaped) {
-      at += 1;
-      length -= 1;
-      escaped = false;
-      if (length === 0) continue;
-      const list6 = byLength.get(length);
-      if (!list6) continue;
-    }
-    const closer = nextRun(length, position2);
-    if (closer < 0) continue;
-    const close = runs[closer];
-    blank(at, close.at + close.length);
-    position2 = closer;
-    escapeScan = close.at + close.length;
-    escaped = false;
-  }
-}
-function resolveConceptId(fromId, href) {
-  const target3 = (href.split("#")[0] ?? "").split("?")[0]?.trim() ?? "";
-  if (target3 === "" || isExternalHref(target3)) return null;
-  if (!target3.endsWith(".md")) return null;
-  let resolved;
-  if (target3.startsWith("/")) {
-    resolved = target3.slice(1);
-  } else {
-    const slash = fromId.lastIndexOf("/");
-    const fromDir = slash >= 0 ? fromId.slice(0, slash) : "";
-    resolved = joinPosix(fromDir, target3);
-  }
-  resolved = resolved.replace(/^(\.\.\/)+/, "");
-  if (isReservedFile(resolved)) return null;
-  const id = resolved.replace(/\.md$/, "");
-  try {
-    assertSafeConceptId(id);
-    return id;
-  } catch (error51) {
-    if (error51 instanceof InvalidInputError) return null;
-    throw error51;
-  }
-}
-function relativeHref(fromId, target3) {
-  const t = target3.trim();
-  if (isExternalHref(t)) return t;
-  assertSafeConceptId(fromId);
-  assertSafeConceptId(t);
-  const targetId = t;
-  const slash = fromId.lastIndexOf("/");
-  const fromDir = slash >= 0 ? fromId.slice(0, slash) : "";
-  return relativePosix(fromDir, `${targetId}.md`);
-}
-function parseLinksFromDoc(doc2) {
-  const links = [];
-  for (const raw of extractMarkdownLinks(doc2.body)) {
-    const to = resolveConceptId(doc2.id, raw.href);
-    if (to === null) continue;
-    links.push({ from: doc2.id, to, text: raw.text, href: raw.href });
-  }
-  return links;
-}
-var FENCE_OPEN, LIST_MARKER, THEMATIC_BREAK, ATX_HEADING;
-var init_links = __esm({
-  "../core/src/links.ts"() {
-    "use strict";
-    init_define_SUPERBEE_BUILD_IDENTITY();
-    init_define_SUPERBEE_UPDATE_POLICY();
-    init_paths();
-    init_errors();
-    FENCE_OPEN = /^(`{3,}|~{3,})(.*)$/;
-    LIST_MARKER = /^([-+*]|\d{1,9}[.)])([ \t]+|$)/;
-    THEMATIC_BREAK = /^(?:(?:\*[ \t]*){3,}|(?:-[ \t]*){3,}|(?:_[ \t]*){3,})$/;
-    ATX_HEADING = /^#{1,6}(?:[ \t]|$)/;
-  }
-});
-
 // ../core/src/portable-frontmatter.ts
 function parseLeadingFrontmatter(raw, context2) {
   const split = splitLeadingFrontmatter(raw, context2);
@@ -4410,11 +4599,34 @@ async function listBlobs(backend, prefix) {
 async function deleteBlob(backend, key4, options) {
   return backend.deleteBlob(key4, options);
 }
+async function writeDocVersionedGuarded(backend, doc2, options = {}) {
+  const candidate = structuredClone(doc2);
+  assertWritableConceptDocument(candidate);
+  const posture = captureBodyReplacePosture(options.bodyReplace);
+  const captured = { ...options, ...posture === void 0 ? {} : { bodyReplace: posture } };
+  let existing;
+  try {
+    existing = await backend.read(candidate.id);
+  } catch (error51) {
+    if (error51?.code !== "ENOENT") throw error51;
+  }
+  const observed = existing?.version ?? null;
+  if (captured.expectedVersion !== void 0 && captured.expectedVersion !== observed) {
+    throw new VersionConflict(candidate.id, captured.expectedVersion, observed);
+  }
+  if ((posture?.replaceLinks || posture?.acceptTruncatedBody) && captured.expectedVersion === void 0) {
+    throw new InvalidInputError("bodyReplace overrides require an explicit expected version (If-Match or If-None-Match: *).");
+  }
+  if (existing) guardBodyReplace({ root: "", backend }, existing.doc, candidate.body, posture);
+  return writeDocVersioned(backend, candidate, { ...captured, expectedVersion: observed });
+}
 var init_engine = __esm({
   "../core/src/engine.ts"() {
     "use strict";
     init_define_SUPERBEE_BUILD_IDENTITY();
     init_define_SUPERBEE_UPDATE_POLICY();
+    init_body_replace_guards();
+    init_version_transport();
     init_document_write_policy();
     init_errors();
     init_frontmatter_contract();
@@ -4422,6 +4634,7 @@ var init_engine = __esm({
     init_paths();
     init_portable_frontmatter();
     init_query_filter();
+    init_body_replace_guards();
   }
 });
 
@@ -5846,41 +6059,6 @@ var init_sha256 = __esm({
   }
 });
 
-// ../core/src/version-transport.ts
-function isContentVersion(value) {
-  return typeof value === "string" && /^sha256:[0-9a-f]{64}$/.test(value);
-}
-function stripETagWrapper(raw) {
-  let value = raw.trim();
-  if (value.startsWith("W/")) value = value.slice(2);
-  if (value.length >= 2 && value.startsWith('"') && value.endsWith('"')) {
-    value = value.slice(1, -1);
-  }
-  return value;
-}
-var VersionConflict;
-var init_version_transport = __esm({
-  "../core/src/version-transport.ts"() {
-    "use strict";
-    init_define_SUPERBEE_BUILD_IDENTITY();
-    init_define_SUPERBEE_UPDATE_POLICY();
-    VersionConflict = class extends Error {
-      name = "VersionConflict";
-      id;
-      expected;
-      actual;
-      constructor(id, expected, actual) {
-        super(
-          `version conflict on '${id}': expected ${expected ?? "absent"}, found ${actual ?? "none"} (the document changed since you read it \u2014 re-read and retry)`
-        );
-        this.id = id;
-        this.expected = expected;
-        this.actual = actual;
-      }
-    };
-  }
-});
-
 // ../core/src/versioning.ts
 function sha256Hex(input) {
   return sha256HexOfUtf8(input);
@@ -8677,6 +8855,7 @@ function assertJournalGuard(expected, current) {
   if (!equalJournalValue(a, b)) throw new JournalGuardConflict(a.target);
 }
 function captureIntentUpdate(patch, options) {
+  if (Object.hasOwn(patch, "bodyReplace")) throw new JournalGuardConflict("bodyReplace");
   const guard = captureJournalGuardOption(options);
   if (guard !== void 0) captureJournalValue({ patch, options });
   if (options.document && guard === void 0) throw new JournalGuardConflict(options.document.id);
@@ -8747,7 +8926,17 @@ function captureJournalDeleteOptions(target3, options) {
   }
   return captured;
 }
+function captureNewDocumentIntent(intent) {
+  const captured = captureJournalValue(intent);
+  const posture = captureBodyReplacePosture(captured.bodyReplace);
+  if (posture !== void 0) {
+    if (captured.kind !== "document.write") throw new JournalGuardConflict(captured.target);
+    return { ...captured, bodyReplace: posture };
+  }
+  return captured;
+}
 function assertDeletionIntent(target3, options) {
+  if (options.intent && Object.hasOwn(options.intent, "bodyReplace")) throw new JournalSnapshotConflict(target3);
   if (options.intent === void 0 && options.supersede === void 0) return;
   if (options.guard !== void 0 || options.intent !== void 0 && (options.intent.kind !== DOCUMENT_DELETE_KIND || options.intent.target !== target3)) {
     throw new JournalSnapshotConflict(target3);
@@ -8782,6 +8971,7 @@ var init_journaled_backend = __esm({
     "use strict";
     init_define_SUPERBEE_BUILD_IDENTITY();
     init_define_SUPERBEE_UPDATE_POLICY();
+    init_body_replace_guards();
     init_paths();
     init_versioning();
     DOCUMENT_DELETE_KIND = "document.delete";
@@ -8906,8 +9096,8 @@ function captureRemoteFrontmatter(frontmatter) {
   };
   return visit3(frontmatter, "frontmatter", 0);
 }
-function encodeRemoteDocument(frontmatter, body) {
-  const payload = Object.assign(/* @__PURE__ */ Object.create(null), { frontmatter: captureRemoteFrontmatter(frontmatter), body });
+function encodeRemoteDocument(frontmatter, body, bodyReplace) {
+  const payload = Object.assign(/* @__PURE__ */ Object.create(null), { frontmatter: captureRemoteFrontmatter(frontmatter), body, ...bodyReplace === void 0 ? {} : { bodyReplace: captureBodyReplacePosture(bodyReplace) } });
   return JSON.stringify(payload);
 }
 var RemoteDocumentValueError;
@@ -8916,6 +9106,7 @@ var init_remote_document_codec = __esm({
     "use strict";
     init_define_SUPERBEE_BUILD_IDENTITY();
     init_define_SUPERBEE_UPDATE_POLICY();
+    init_body_replace_guards();
     init_errors();
     RemoteDocumentValueError = class extends InvalidInputError {
       path;
@@ -9501,7 +9692,7 @@ var init_remote_backend = __esm({
         if (options.expectedVersion === null) headers["If-None-Match"] = "*";
         else if (options.expectedVersion !== void 0) headers["If-Match"] = options.expectedVersion;
         if (options.actor) headers["X-Actor"] = options.actor;
-        const body = encodeRemoteDocument(doc2.frontmatter, doc2.body ?? "");
+        const body = encodeRemoteDocument(doc2.frontmatter, doc2.body ?? "", options.bodyReplace);
         let minted = false;
         if (options.requestId !== void 0) {
           assertRequestIdentity(options.requestId);
@@ -9874,7 +10065,11 @@ function buildTransport(remote, options) {
         return { kind: "refused", code: "USAGE", message: `remote operation transport: unsupported intent kind '${intent.kind}'`, executed: false };
       }
       let parsed2;
+      let posture;
       try {
+        const descriptor = Object.getOwnPropertyDescriptor(intent, "bodyReplace");
+        if (descriptor && !("value" in descriptor)) throw new Error("bodyReplace must be an explicit data field.");
+        posture = captureBodyReplacePosture(descriptor?.value);
         parsed2 = parseMarkdown(intent.content, pathFromConceptId(intent.target));
       } catch (error51) {
         return { kind: "refused", code: "USAGE", message: error51 instanceof Error ? error51.message : String(error51), executed: false };
@@ -9883,6 +10078,7 @@ function buildTransport(remote, options) {
       const writeOptions = {
         expectedVersion: intent.base,
         requestId: intent.requestId,
+        ...posture === void 0 ? {} : { bodyReplace: posture },
         ...options.actor === void 0 ? {} : { actor: options.actor }
       };
       try {
@@ -9910,6 +10106,7 @@ var init_remote_operations = __esm({
     "use strict";
     init_define_SUPERBEE_BUILD_IDENTITY();
     init_define_SUPERBEE_UPDATE_POLICY();
+    init_body_replace_guards();
     init_frontmatter();
     init_paths();
     init_remote_backend();
@@ -9973,146 +10170,6 @@ var init_mutation = __esm({
   }
 });
 
-// ../core/src/body-replace-guards.ts
-function previewTruncationNotice(omitted) {
-  return `${BODY_PREVIEW_TRUNCATION_MARKER} ${omitted} more character(s) are NOT shown`;
-}
-function attachBodyPreview(rec, body, fullBodyHelp) {
-  if (body.length <= BODY_PREVIEW_LIMIT) {
-    rec.body = body;
-    return;
-  }
-  const omitted = body.length - BODY_PREVIEW_LIMIT;
-  rec[BODY_PREVIEW_KEY] = `${body.slice(0, BODY_PREVIEW_LIMIT)}
-
-${previewTruncationNotice(omitted)} \u2014 this value is a preview, not the document body; use this record's help to read the complete body before rewriting it.`;
-  rec.body_truncated = true;
-  rec.body_chars = body.length;
-  rec.help = [...fullBodyHelp];
-}
-function matchesPreviewSlice(candidate, preview4) {
-  if (candidate === preview4) return true;
-  const trimmed = preview4.trimEnd();
-  return trimmed !== "" && candidate.trimEnd() === trimmed;
-}
-function firstForeignNotice(storedBody, nextBody) {
-  const preservesStoredBody = nextBody.includes(storedBody.trimEnd());
-  const every = new RegExp(BODY_PREVIEW_TRUNCATION_SIGNATURE.source, `${BODY_PREVIEW_TRUNCATION_SIGNATURE.flags}g`);
-  for (const match of nextBody.matchAll(every)) {
-    if (!(preservesStoredBody && storedBody.includes(match[0]))) return match[0];
-  }
-  return void 0;
-}
-function isSameStoredBody(nextBody, existingBody) {
-  return normalizeDocumentBodyForStorage(nextBody) === normalizeDocumentBodyForStorage(existingBody);
-}
-function bodyPreviewFinding(existing, nextBody) {
-  if (isSameStoredBody(nextBody, existing.body)) return;
-  const notice = firstForeignNotice(existing.body, nextBody);
-  if (notice !== void 0) return { reason: "preview_marker", marker: BODY_PREVIEW_TRUNCATION_MARKER, notice };
-  if (existing.body.length > BODY_PREVIEW_LIMIT && matchesPreviewSlice(nextBody, existing.body.slice(0, BODY_PREVIEW_LIMIT))) {
-    return { reason: "stored_body_preview", preview_limit: BODY_PREVIEW_LIMIT, supplied_body_chars: nextBody.length, stored_body_chars: existing.body.length };
-  }
-}
-function computeDroppedLinks(existingLinks, nextLinks, mode = "target") {
-  const nextByTarget = /* @__PURE__ */ new Map();
-  for (const l of nextLinks) {
-    const key4 = mode === "exact-edge" ? JSON.stringify([l.from, l.to]) : l.to;
-    const bucket = nextByTarget.get(key4);
-    if (bucket) bucket.push(l);
-    else nextByTarget.set(key4, [l]);
-  }
-  const existingByTarget = /* @__PURE__ */ new Map();
-  for (const l of existingLinks) {
-    const key4 = mode === "exact-edge" ? JSON.stringify([l.from, l.to]) : l.to;
-    const bucket = existingByTarget.get(key4);
-    if (bucket) bucket.push(l);
-    else existingByTarget.set(key4, [l]);
-  }
-  const dropped = [];
-  for (const [target3, oldOccurrences] of existingByTarget) {
-    const available = [...nextByTarget.get(target3) ?? []];
-    const unmatchedExact = [];
-    for (const old of oldOccurrences) {
-      const idx = available.findIndex((n) => n.text === old.text);
-      if (idx >= 0) available.splice(idx, 1);
-      else unmatchedExact.push(old);
-    }
-    for (const old of unmatchedExact) {
-      if (mode === "target" && available.length > 0) available.shift();
-      else dropped.push(old);
-    }
-  }
-  return dropped;
-}
-function droppedLinks(_bundle, existing, nextBody) {
-  return computeDroppedLinks(parseLinksFromDoc(existing), parseLinksFromDoc({ ...existing, body: nextBody }));
-}
-function guardTruncatedBodyPreview(existing, nextBody, acceptTruncatedBody) {
-  if (acceptTruncatedBody) return;
-  const finding = bodyPreviewFinding(existing, nextBody);
-  if (finding) throw new BodyReplaceError(existing.id, finding, BODY_PREVIEW_TRUNCATION_SIGNATURE.test(existing.body));
-}
-function guardDroppedLinks(bundle, existing, nextBody, replaceLinks) {
-  if (replaceLinks || isSameStoredBody(nextBody, existing.body)) return;
-  const dropped = droppedLinks(bundle, existing, nextBody);
-  if (dropped.length) throw new BodyReplaceError(existing.id, { reason: "dropped_links", dropped_links: dropped });
-}
-function guardBodyReplace(bundle, existing, nextBody, posture) {
-  if (isSameStoredBody(nextBody, existing.body)) return;
-  guardTruncatedBodyPreview(existing, nextBody, Boolean(posture?.acceptTruncatedBody));
-  guardDroppedLinks(bundle, existing, nextBody, Boolean(posture?.replaceLinks));
-}
-function assertTypedListPatch(kind2, storageField) {
-  const types = kind2.fields.types ?? {};
-  const type = Object.hasOwn(types, storageField) ? types[storageField] : void 0;
-  if (type === "string-list" || type === "https-url-list") throw new TypedListPatchError(storageField, type);
-}
-var BODY_PREVIEW_LIMIT, BODY_PREVIEW_TRUNCATION_MARKER, BODY_PREVIEW_TRUNCATION_SIGNATURE, BODY_PREVIEW_KEY, BODY_PREVIEW_RESERVED_KEYS, BodyReplaceError, TypedListPatchError;
-var init_body_replace_guards = __esm({
-  "../core/src/body-replace-guards.ts"() {
-    "use strict";
-    init_define_SUPERBEE_BUILD_IDENTITY();
-    init_define_SUPERBEE_UPDATE_POLICY();
-    init_frontmatter();
-    init_links();
-    init_errors();
-    BODY_PREVIEW_LIMIT = 1e3;
-    BODY_PREVIEW_TRUNCATION_MARKER = "[superbee:body-preview-truncated]";
-    BODY_PREVIEW_TRUNCATION_SIGNATURE = /\[superbee:body-preview-truncated\]\s+\d+\s+more\s+characters?\(?s?\)?\s+are\s+NOT\s+shown/i;
-    BODY_PREVIEW_KEY = "body_preview";
-    BODY_PREVIEW_RESERVED_KEYS = [
-      "body",
-      BODY_PREVIEW_KEY,
-      "body_truncated",
-      "body_chars",
-      "help"
-    ];
-    BodyReplaceError = class extends InvalidInputError {
-      id;
-      finding;
-      storedCarriesNotice;
-      constructor(id, finding, storedCarriesNotice = false) {
-        super(`Body replacement of '${id}' refused: ${finding.reason}.`);
-        this.name = "BodyReplaceError";
-        this.id = id;
-        this.finding = finding;
-        this.storedCarriesNotice = storedCarriesNotice;
-      }
-    };
-    TypedListPatchError = class extends InvalidInputError {
-      field;
-      fieldType;
-      constructor(field, fieldType) {
-        super(`'${field}' is a ${fieldType} field; use an explicit whole-list replacement.`);
-        this.name = "TypedListPatchError";
-        this.field = field;
-        this.fieldType = fieldType;
-      }
-    };
-  }
-});
-
 // ../core/src/managed-document-metadata.ts
 function isManagedDocumentMetadataField(field) {
   return MANAGED_DOCUMENT_METADATA_FIELDS.has(field);
@@ -11921,7 +11978,8 @@ async function mutateDocument(opts) {
     const { warnings } = validateCandidate(opts.id, candidate, opts.registry, opts.strict, okfVersion, decisionNow);
     const { doc: doc2, version: version4 } = await writeDocVersionedForEdition2(opts.bundle, { id: opts.id, ...candidate }, okfVersion, {
       expectedVersion: null,
-      actor: opts.actor
+      actor: opts.actor,
+      bodyReplace: opts.bodyReplace
     });
     return { doc: doc2, changed: true, version: version4, warnings };
   }
@@ -11994,7 +12052,8 @@ async function mutateDocument(opts) {
       write: async (next, expectedVersion) => {
         const written = await writeDocVersionedForEdition2(opts.bundle, next, okfVersion, {
           expectedVersion,
-          actor: opts.actor
+          actor: opts.actor,
+          bodyReplace: opts.bodyReplace
         });
         savedDoc2 = written.doc;
         return written.version;
@@ -12036,7 +12095,8 @@ async function mutateDocument(opts) {
     write: async (next, expectedVersion) => {
       const written = await writeDocVersionedForEdition2(opts.bundle, next, okfVersion, {
         expectedVersion: hardCas ? opts.expectedVersion : expectedVersion,
-        actor: opts.actor
+        actor: opts.actor,
+        bodyReplace: opts.bodyReplace
       });
       savedDoc = written.doc;
       return written.version;
@@ -29050,7 +29110,7 @@ var init_source_profiles = __esm({
         };
       }
     });
-    SOURCE_PLUGIN_CORE_VERSION = "0.2.0-pre.29";
+    SOURCE_PLUGIN_CORE_VERSION = "0.2.0-pre.30";
     SOURCE_PROFILES = Object.freeze([restJsonProfile].map((profile) => Object.freeze({ id: profile.id, version: profile.version, kind: profile.kind })));
   }
 });
@@ -39277,6 +39337,7 @@ var init_indexeddb_backend = __esm({
     "use strict";
     init_define_SUPERBEE_BUILD_IDENTITY();
     init_define_SUPERBEE_UPDATE_POLICY();
+    init_journaled_backend();
     init_content_type();
     init_frontmatter();
     init_mutation_attribution();
@@ -39728,6 +39789,7 @@ var init_indexeddb_backend = __esm({
         }
         assertSafeConceptId(id);
         assertJournalResolutionOptions(id, options);
+        if (options.intent) options = { ...options, intent: captureNewDocumentIntent(options.intent) };
         const raw = stringifyDoc(doc2.frontmatter, doc2.body ?? "");
         const version4 = versionOfBytes(raw);
         if (snapshotGuard && (doc2.id !== id || options.intent && options.intent.target !== id)) throw new JournalGuardConflict(id);
@@ -40590,6 +40652,14 @@ async function bootstrap(remote, local, options = {}) {
   await backend.writeMeta(BOOTSTRAP_KEY, marker);
   return marker;
 }
+function composedBodyReplace(...postures) {
+  const declarations = postures.map(captureBodyReplacePosture).filter((row5) => row5 !== void 0);
+  if (!declarations.length) return;
+  return {
+    replaceLinks: declarations.some((row5) => row5.replaceLinks === true),
+    acceptTruncatedBody: declarations.some((row5) => row5.acceptTruncatedBody === true)
+  };
+}
 function supersedingIntent(kind2, superseded, now) {
   const deleting = kind2 === DOCUMENT_DELETE_KIND;
   if (deleting && superseded.base === null) return void 0;
@@ -40600,6 +40670,7 @@ function supersedingIntent(kind2, superseded, now) {
     base: superseded.base,
     baseContent: superseded.baseContent,
     createdAt: now,
+    ...!deleting && superseded.kind === "document.write" && superseded.bodyReplace !== void 0 ? { bodyReplace: composedBodyReplace(superseded.bodyReplace) } : {},
     ...superseded.after !== void 0 ? { after: superseded.after } : {},
     ...!deleting && superseded.recreates !== void 0 && superseded.base === null ? { recreates: superseded.recreates } : {}
   };
@@ -40656,8 +40727,11 @@ function chainedBase(intent) {
 function journalingBackend(backend, id, recorded) {
   const write = async (target3, doc2, options = {}) => {
     if (target3 !== id) throw new Error(`commitLocal for '${id}' cannot write '${target3}'`);
+    const declaredPosture = captureBodyReplacePosture(options.bodyReplace);
     for (let attempt = 0; ; attempt++) {
       const composed = await composeIntent(backend, id, (/* @__PURE__ */ new Date()).toISOString());
+      const posture = composedBodyReplace(composed.intent.bodyReplace, declaredPosture);
+      if (posture !== void 0) composed.intent = { ...composed.intent, bodyReplace: posture };
       try {
         const written = await backend.writeJournaled(id, doc2, { ...options, ...composed });
         recorded.intent = written.intent;
@@ -40887,6 +40961,7 @@ async function resolveConflict(local, remote, reviewed, choice, options = {}) {
     base: shared.base.version,
     baseContent: shared.base.content,
     createdAt: resolvedAt,
+    bodyReplace: { replaceLinks: true },
     ...recreates !== void 0 ? { recreates } : {}
   };
   let written;
@@ -41208,7 +41283,11 @@ async function foldRefusedChain(backend, listed2) {
   if (chain.length !== 2 || !head2 || !successor || !isContentRefusal(head2) || successor.requestId !== listed2.requestId || successor.state !== "pending" || successor.attempts !== 0 || successor.after !== head2.requestId) return null;
   const deleting = successor.kind === DOCUMENT_DELETE_KIND;
   if (deleting ? snapshot4.document !== null : !snapshot4.document || successor.local !== snapshot4.document.version || successor.content !== snapshot4.raw) return null;
-  const intent = supersedingIntent(deleting ? DOCUMENT_DELETE_KIND : "document.write", head2, (/* @__PURE__ */ new Date()).toISOString());
+  let intent = supersedingIntent(deleting ? DOCUMENT_DELETE_KIND : "document.write", head2, (/* @__PURE__ */ new Date()).toISOString());
+  if (!deleting && intent) {
+    const posture = composedBodyReplace(intent.bodyReplace, successor.bodyReplace);
+    if (posture !== void 0) intent = { ...intent, bodyReplace: posture };
+  }
   const resolveIntents = { expected: chain };
   try {
     if (deleting) {
@@ -41538,6 +41617,7 @@ var init_local_bundle = __esm({
     "use strict";
     init_define_SUPERBEE_BUILD_IDENTITY();
     init_define_SUPERBEE_UPDATE_POLICY();
+    init_engine();
     init_document_codec();
     init_governed_body_write();
     init_verification();
@@ -41838,6 +41918,13 @@ function validateIntentChanges(changes, format2, file2) {
   for (const change of changes) {
     if (change.family !== "intent" || change.value === null) continue;
     const row5 = change.value;
+    if (!("recordFamily" in row5) && row5.bodyReplace !== void 0) {
+      try {
+        captureNewDocumentIntent(row5);
+      } catch {
+        throw new FileJournalCorruptError(file2, "invalid document edit intent");
+      }
+    }
     if ("recordFamily" in row5) {
       if (row5.recordFamily !== "blob" || format2 < 2) throw new FileJournalCorruptError(file2, "blob intent is not allowed in this format");
       if (blobIntentFormat(row5) > format2) throw new FileJournalCorruptError(file2, "blob not-dispatched evidence is not allowed in this format");
@@ -41958,6 +42045,7 @@ var init_file_journaled_backend = __esm({
     "use strict";
     init_define_SUPERBEE_BUILD_IDENTITY();
     init_define_SUPERBEE_UPDATE_POLICY();
+    init_journaled_backend();
     init_blob_contract();
     init_blob_journal();
     init_content_type();
@@ -42423,6 +42511,7 @@ var init_file_journaled_backend = __esm({
         }
         assertSafeConceptId(id);
         assertJournalResolutionOptions(id, options);
+        if (options.intent) options = { ...options, intent: captureNewDocumentIntent(options.intent) };
         if (snapshotGuard && (doc2.id !== id || options.intent && options.intent.target !== id)) throw new JournalGuardConflict(id);
         const raw = stringifyDoc(doc2.frontmatter, doc2.body ?? "");
         const version4 = versionOfBytes(raw);
@@ -93267,6 +93356,9 @@ function errorFromCaught(err) {
   if (err instanceof RemoteDocumentValueError) {
     return errorResponse(500, "RUNTIME", err.message);
   }
+  if (err instanceof BodyReplaceError) {
+    return errorResponse(400, "USAGE", err.message, { id: err.id, ...err.finding });
+  }
   if (err instanceof InvalidInputError) {
     return errorResponse(400, "USAGE", err.message);
   }
@@ -93544,7 +93636,9 @@ function buildRouter(options) {
       return errorResponse(400, "USAGE", "request body field body must be a string when present");
     }
     const writeOptions = writeOptionsFromRequest(req, attribution);
-    const result3 = await writeDocVersioned(
+    const posture = captureBodyReplacePosture(payload.bodyReplace);
+    if (posture !== void 0) writeOptions.bodyReplace = posture;
+    const result3 = await writeDocVersionedGuarded(
       backend,
       { id, frontmatter: payload.frontmatter, body: payload.body ?? "" },
       writeOptions
@@ -152473,20 +152567,35 @@ async function localBundle(dir, cwd = process.cwd(), home2 = homedir49()) {
   if (process.platform !== "darwin" && process.platform !== "linux") throw refuse("unsupported_supervision_platform");
   return target3.canonicalRoot;
 }
-async function toolIdentity(file2) {
-  if (typeof file2 !== "string" || !path64.isAbsolute(file2)) throw refuse("absolute_tool_required");
+function toolSelections(values, home2) {
+  const selections = {};
+  for (const [handle, value] of Object.entries(values)) {
+    if (!key3.test(handle)) throw refuse("tool_handle");
+    let selected2;
+    if (typeof value === "string") selected2 = { path: value, versionFlag: "--version" };
+    else {
+      if (!record16(value) || Object.keys(value).length !== 2 || !Object.hasOwn(value, "path") || !Object.hasOwn(value, "versionFlag") || typeof value.path !== "string" || value.versionFlag !== "--version" && value.versionFlag !== "-version") throw refuse("tool_selection");
+      selected2 = { path: value.path, versionFlag: value.versionFlag };
+    }
+    if (!path64.isAbsolute(selected2.path)) throw refuse("absolute_tool_required");
+    assertPathOutsidePrivateState(selected2.path, home2);
+    selections[handle] = selected2;
+  }
+  return selections;
+}
+async function toolIdentity({ path: file2, versionFlag }) {
   const resolved = await realpath15(file2);
   const bytes = await localFileBytes(resolved, 256 * 1024 * 1024);
   const magic = bytes.subarray(0, 4).toString("hex");
   const native = process.platform === "linux" ? magic === "7f454c46" : ["feedface", "cefaedfe", "feedfacf", "cffaedfe", "cafebabe", "bebafeca", "cafebabf", "bfbafeca"].includes(magic);
   if (!native) throw refuse("native_tool_binary_required");
-  const version4 = await probeToolVersion(resolved);
+  const version4 = await probeToolVersion(resolved, versionFlag);
   if (await realpath15(resolved) !== resolved || hash2(await localFileBytes(resolved, 256 * 1024 * 1024)) !== hash2(bytes)) throw refuse("tool_changed_rebind_required");
-  return { path: resolved, sha256: hash2(bytes), version: version4 };
+  return { path: resolved, sha256: hash2(bytes), version: version4, versionFlag };
 }
-async function probeToolVersion(file2) {
+async function probeToolVersion(file2, versionFlag) {
   return new Promise((resolve2, reject) => {
-    const child = spawn5(file2, ["--version"], { detached: true, env: { PATH: "/usr/bin:/bin" }, stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn5(file2, [versionFlag], { detached: true, env: { PATH: "/usr/bin:/bin" }, stdio: ["ignore", "pipe", "pipe"] });
     let settled = false, stdout = "", bytes = 0, failureReason;
     const finish = async (reason) => {
       failureReason ??= reason;
@@ -152523,6 +152632,7 @@ async function bindLocalOperation(operation, bundle, config2, accept, home2 = ho
   if (!record16(config2) || !record16(config2.resources) || !record16(config2.tools) || !Object.hasOwn(LOCAL_OPERATION_PROFILES, config2.profile)) throw refuse("binding_config");
   const profile = LOCAL_OPERATION_PROFILES[config2.profile];
   if (Object.keys(config2.resources).length === 0 || Object.keys(config2.resources).length > profile.files || Object.keys(config2.tools).length > 8) throw refuse("binding_count");
+  const selectedTools = toolSelections(config2.tools, home2);
   const resources = {}, tools = {}, expectedInputs = {};
   let total = 0;
   for (const [role, value] of Object.entries(config2.resources)) {
@@ -152534,39 +152644,71 @@ async function bindLocalOperation(operation, bundle, config2, accept, home2 = ho
     resources[role] = { path: selected2, logicalRef: value.logicalRef };
     expectedInputs[role] = hash2(bytes);
   }
-  for (const [handle, file2] of Object.entries(config2.tools)) {
-    if (typeof file2 !== "string") throw refuse("tool_selection");
-    if (!key3.test(handle)) throw refuse("tool_handle");
-    assertPathOutsidePrivateState(file2, home2);
-    tools[handle] = await toolIdentity(file2);
-  }
+  for (const [handle, selected2] of Object.entries(selectedTools)) tools[handle] = await toolIdentity(selected2);
   const outputRoot = await ordinaryDirectory(config2.outputRoot, home2, bundle), rootStatus = await lstat13(outputRoot);
   const binding2 = { v: 1, bundle, operation, pluginDigest: selection.digest, generation: selection.generation, capability: selection.capability, resources, tools, outputRoot, outputRootIdentity: { dev: rootStatus.dev, ino: rootStatus.ino }, profile: config2.profile };
   const digest4 = hash2(canonicalJson3(binding2));
-  if (accept === void 0) return { status: "preview", digest: digest4, operation, profile: config2.profile, expectedInputs, resources: Object.keys(resources), tools: Object.fromEntries(Object.entries(tools).map(([name, t]) => [name, { sha256: t.sha256, version: t.version }])), effects: ["trusted code with ambient authority; no OS sandbox", "copies selected inputs; creates private local files; consumes compute", "supported adapter makes no network requests; network is not sandboxed", "HTML export is separate from Artifact publication"], next: `superbee op bind ${commandToken(operation)} --local --resources-file <same-file> --accept ${commandToken(digest4)} --dir <same-bundle>` };
+  if (accept === void 0) return { status: "preview", digest: digest4, operation, profile: config2.profile, expectedInputs, resources: Object.keys(resources), tools: toolEvidence(tools), effects: ["trusted code with ambient authority; no OS sandbox", "copies selected inputs; creates private local files; consumes compute", "supported adapter makes no network requests; network is not sandboxed", "HTML export is separate from Artifact publication"], next: `superbee op bind ${commandToken(operation)} --local --resources-file <same-file> --accept ${commandToken(digest4)} --dir <same-bundle>` };
   if (accept !== digest4) throw refuse("binding_acceptance_changed");
   const id = randomUUID9();
   await writeUserStateFileAtomic0600(home2, path64.join(canonicalUserStateDir(home2), "local-operation-bindings"), `${id}.json`, JSON.stringify(binding2));
   return { status: "bound", binding: id, digest: digest4, operation, expectedInputs, next: `superbee op run ${commandToken(operation)} --local --binding ${commandToken(id)} --input-file <run-input.json> --dir <same-bundle>` };
 }
-async function outputBudget(directory, maximumBytes, maximumFiles) {
-  let bytes = 0, count6 = 0;
-  const scan3 = async (dir) => {
-    const entries = await readdir10(dir, { withFileTypes: true });
-    for (const entry of entries) {
-      if (++count6 > maximumFiles * 2) return false;
-      const file2 = path64.join(dir, entry.name), status2 = await lstat13(file2);
-      if (status2.isSymbolicLink() || !status2.isFile() && !status2.isDirectory()) return false;
-      if (status2.isDirectory()) {
-        if (!await scan3(file2)) return false;
-      } else {
-        bytes += status2.size;
-        if (bytes > maximumBytes) return false;
+function outputFailure(phase, error51) {
+  return { phase, errno: error51 instanceof OutputScanError ? error51.errno : "unknown", syscall: error51 instanceof OutputScanError ? error51.syscall : "unknown" };
+}
+async function outputBudget(directory, maximumBytes, maximumFiles, live = false, io = outputBudgetIo) {
+  for (let attempt = 1; ; attempt++) {
+    let bytes = 0, count6 = 0;
+    const scan3 = async (dir) => {
+      let entries;
+      try {
+        entries = await io.readdir(dir);
+      } catch (error51) {
+        throw new OutputScanError(error51, dir !== directory);
+      }
+      for (const entry of entries) {
+        if (++count6 > maximumFiles * 2) return false;
+        const file2 = path64.join(dir, entry.name);
+        let status2;
+        try {
+          status2 = await io.lstat(file2);
+        } catch (error51) {
+          throw new OutputScanError(error51, true);
+        }
+        if (status2.isSymbolicLink() || !status2.isFile() && !status2.isDirectory()) return false;
+        if (status2.isDirectory()) {
+          if (!await scan3(file2)) return false;
+        } else {
+          bytes += status2.size;
+          if (bytes > maximumBytes) return false;
+        }
       }
+      return true;
+    };
+    try {
+      return await scan3(directory);
+    } catch (error51) {
+      if (live && attempt < 3 && error51 instanceof OutputScanError && error51.vanishedDescendant) continue;
+      throw error51;
     }
-    return true;
+  }
+}
+function startOutputBudgetPoll(directory, maximumBytes, maximumFiles, report, scan3 = outputBudget) {
+  let pending, stopped = false;
+  const timer = setInterval(() => {
+    if (stopped || pending) return;
+    pending = scan3(directory, maximumBytes, maximumFiles, true).then((ok4) => {
+      if (!ok4) report("output_limit");
+    }).catch((error51) => report("output_validation", error51)).finally(() => {
+      pending = void 0;
+    });
+  }, 50);
+  return async () => {
+    stopped = true;
+    clearInterval(timer);
+    await pending;
   };
-  return scan3(directory);
 }
 async function groupPresent(pid) {
   try {
@@ -152635,7 +152777,7 @@ async function runLocalOperation(operation, bundle, bindingId, input, options =
     resources[role] = { path: captured, logicalRef: resource.logicalRef, sha256: sha2562 };
     inputs.push({ role, logicalRef: resource.logicalRef, sha256: sha2562, bytes: bytes.length });
   }
-  const manifest2 = { version: 1, invocationId: id, operation, implementationId: selection.capability.implementationId, plugin: { digest: selection.digest, generation: selection.generation, assets: selection.assets }, inputs, settingsDigest: hash2(canonicalJson3(input.settings)), tools: Object.fromEntries(Object.entries(binding2.tools).map(([name, t]) => [name, { sha256: t.sha256, version: t.version }])), profile: binding2.profile, platform: { os: process.platform, arch: process.arch, node: process.version }, startedAt: (/* @__PURE__ */ new Date()).toISOString(), status: "interrupted_unconfirmed", reason: "parent_outcome_unknown", outputs: [], publication: "not_attempted" };
+  const manifest2 = { version: 1, invocationId: id, operation, implementationId: selection.capability.implementationId, plugin: { digest: selection.digest, generation: selection.generation, assets: selection.assets }, inputs, settingsDigest: hash2(canonicalJson3(input.settings)), tools: toolEvidence(binding2.tools), profile: binding2.profile, platform: { os: process.platform, arch: process.arch, node: process.version }, startedAt: (/* @__PURE__ */ new Date()).toISOString(), status: "interrupted_unconfirmed", reason: "parent_outcome_unknown", outputs: [], publication: "not_attempted" };
   const manifestPath = path64.join(workspace, "manifest.json");
   await writeFile3(manifestPath, JSON.stringify(manifest2, null, 2), { mode: 384, flag: "wx" });
   const maximumOutputBytes = Math.min(selection.capability.maximumOutputBytes ?? DEFAULT_MAXIMUM_OUTPUT_BYTES, DEFAULT_MAXIMUM_OUTPUT_BYTES);
@@ -152658,16 +152800,10 @@ async function runLocalOperation(operation, bundle, bindingId, input, options =
   };
   child.stdout.on("data", capture2);
   child.stderr.on("data", capture2);
-  let checking = false;
-  const budget = setInterval(() => {
-    if (checking) return;
-    checking = true;
-    void outputBudget(outputDirectory, profile.outputBytes, profile.files).then((ok4) => {
-      if (!ok4) terminate("output_limit");
-    }).catch(() => terminate("output_validation")).finally(() => {
-      checking = false;
-    });
-  }, 50);
+  const stopBudget = startOutputBudgetPoll(outputDirectory, profile.outputBytes, profile.files, (why, error51) => {
+    manifest2.outputValidationFailure ??= outputFailure("live", error51);
+    terminate(why);
+  });
   const deadline = setTimeout(() => terminate("deadline"), profile.deadlineMs);
   const abort = () => terminate("cancelled");
   options.signal?.addEventListener("abort", abort, { once: true });
@@ -152712,9 +152848,10 @@ async function runLocalOperation(operation, bundle, bindingId, input, options =
     child.send({ type: "initialize", entryPath: selection.entryPath, capabilityName: selection.capability.name, maximumOutputBytes, protocolBytes: DEFAULT_MAXIMUM_OUTPUT_BYTES, tools: binding2.tools, resources, profile, invocation: { id, outputDirectory, assetDirectory: selection.rootPath, profile: binding2.profile }, input: input.settings });
   });
   clearTimeout(deadline);
-  clearInterval(budget);
+  const budgetStopped = stopBudget();
   options.signal?.removeEventListener("abort", abort);
   const stopped = child.pid !== void 0 ? await stopGroup(child.pid, profile.graceMs) : closed;
+  await budgetStopped;
   for (const [tool, identity] of Object.entries(binding2.tools)) {
     try {
       if (await realpath15(identity.path) !== identity.path || hash2(await localFileBytes(identity.path, 256 * 1024 * 1024)) !== identity.sha256) throw Error();
@@ -152748,9 +152885,10 @@ async function runLocalOperation(operation, bundle, bindingId, input, options =
       for (const entry of all2) if (entry.isFile() && !seen.has(path64.relative(outputDirectory, path64.join(entry.parentPath, entry.name)))) throw refuse("undeclared_output");
       manifest2.settings = result3.settings ?? input.settings;
       manifest2.partialOutputState = "validated";
-    } catch {
+    } catch (error51) {
       manifest2.status = "failed";
       manifest2.reason = "output_validation";
+      manifest2.outputValidationFailure = outputFailure("final", error51);
       manifest2.outputs = [];
     }
   }
@@ -152777,7 +152915,7 @@ async function runLocalOperation(operation, bundle, bindingId, input, options =
   await writeFile3(manifestPath, JSON.stringify(manifest2, null, 2), { mode: 384 });
   return { invocationId: id, status: manifest2.status, reason: manifest2.reason, manifest: manifestPath, outputs: manifest2.outputs, export: manifest2.export === void 0 ? void 0 : { ...manifest2.export, ...exportPath ? { path: exportPath } : {} }, publication: "not_attempted" };
 }
-var LOCAL_OPERATION_PROFILES, record16, hash2, refuse, key3, within;
+var LOCAL_OPERATION_PROFILES, record16, hash2, refuse, key3, within, toolEvidence, outputBudgetIo, OutputScanError;
 var init_local_operation = __esm({
   "../cli/src/local-operation.ts"() {
     "use strict";
@@ -152805,6 +152943,20 @@ var init_local_operation = __esm({
       const rel = path64.relative(root, target3);
       return rel !== "" && !rel.startsWith(`..${path64.sep}`) && rel !== ".." && !path64.isAbsolute(rel);
     };
+    toolEvidence = (tools) => Object.fromEntries(Object.entries(tools).map(([name, t]) => [name, { sha256: t.sha256, version: t.version, versionFlag: t.versionFlag ?? "--version" }]));
+    outputBudgetIo = { readdir: (directory) => readdir10(directory, { withFileTypes: true }), lstat: (file2) => lstat13(file2) };
+    OutputScanError = class extends Error {
+      errno;
+      syscall;
+      vanishedDescendant;
+      constructor(error51, descendant) {
+        super("output_scan_failed");
+        const value = error51;
+        this.errno = typeof value?.code === "string" && /^E[A-Z0-9]{1,30}$/.test(value.code) ? value.code : "unknown";
+        this.syscall = value?.syscall === "lstat" || value?.syscall === "scandir" ? value.syscall : "unknown";
+        this.vanishedDescendant = descendant && this.errno === "ENOENT";
+      }
+    };
   }
 });
 
@@ -153176,15 +153328,18 @@ exports one validated HTML into the selected ordinary output root without publis
 Trusted code has ambient local authority; process supervision is not an OS sandbox.
 
 Local binding resources JSON contains resources (role -> {path, logicalRef}), tools (handle ->
-absolute executable path), outputRoot (existing ordinary directory outside the bundle/private
+absolute executable path or exact {path, versionFlag}), outputRoot (existing ordinary directory outside the bundle/private
 state), and profile (synthetic-v1: 16 MiB inputs/32 MiB outputs/30 seconds, or comparison-v1:
 128 MiB inputs/128 MiB outputs/120 seconds). Inputs are finite individual regular files; adapters
 must refuse unclosed dependencies. Preview returns expectedInputs hashes. Run input JSON contains
 {expectedInputs: {role: "sha256:..."}, settings: {...}}. Confirm new hashes for changed inputs.
 Tool paths resolve to native physical binaries; executable scripts/wrappers are refused.
 Symlink launcher/virtual-environment semantics are not
-preserved. Use a copied interpreter when needed. Bind pins executable bytes and --version, not
-arbitrary installed libraries or OS dependencies. These profiles are not qualified private-pilot
+preserved. Use a copied interpreter when needed. String tool paths probe with --version; explicit
+versionFlag accepts only --version or -version. All selections are validated before any probe;
+there is no flag fallback or arbitrary probe argv. Bind pins executable bytes, version output
+and the selected flag, not arbitrary installed libraries or OS dependencies. Existing stored
+bindings without a flag retain --version in new run evidence; earlier receipts are unchanged. These profiles are not qualified private-pilot
 limits or CPU/RAM/disk isolation.
 
 Without --local, a local or Git bundle has no host operations: op list answers none, and op run is refused