@abloh/core 0.1.0

package/dist/index.js

@@ -0,0 +1,4288 @@
+// src/schema.ts
+var MUTANT_STATUSES = [
+  "killed",
+  "timeout",
+  "survived",
+  "no-coverage",
+  "runtime-error",
+  "build-error",
+  "skipped-by-cap"
+];
+function emptyCounts() {
+  return {
+    killed: 0,
+    timeout: 0,
+    survived: 0,
+    "no-coverage": 0,
+    "runtime-error": 0,
+    "build-error": 0,
+    "skipped-by-cap": 0
+  };
+}
+function mutantIdentity(m) {
+  return [
+    m.file,
+    m.startLine,
+    m.endLine,
+    m.startColumn ?? "",
+    m.endColumn ?? "",
+    m.mutator,
+    m.originalText ?? "",
+    m.replacement ?? ""
+  ].join("\0");
+}
+var MUTATION_SCOPE_SURFACE = {
+  original: "full",
+  "covered-only": "covered-only",
+  // mutation ran on the covered subset PLUS forced error-handler mutants: still not the full diff,
+  // and the honest label for a reader deciding how much the score covers is the reduced one
+  "covered-plus-error-handlers": "covered-only",
+  "error-handlers-only": "error-handlers-only"
+};
+var REALISTIC_CATEGORIES = [
+  "missing-await",
+  "wrong-variable",
+  "argument-order",
+  "exception-swallow",
+  "off-by-one",
+  "wrong-constant"
+];
+var MAX_MUTANT_ROSTER = 2e4;
+
+// src/execution-axis.ts
+var LAYER0_EXECUTION = {
+  completed: "completed",
+  // we could not trust the coverage we collected — "not measured", never "nothing was covered"
+  "cannot-attest": "unavailable",
+  "not-applicable": "not-applicable",
+  "not-run": "skipped"
+};
+var LAYER1_EXECUTION = {
+  completed: "completed",
+  skipped: "skipped",
+  "not-run": "unavailable"
+};
+var lookup = (table, state) => table[state];
+function diffCoverageExecution(state) {
+  if (state === void 0 || state === null || state === "") return "unavailable";
+  return lookup(LAYER0_EXECUTION, state) ?? "unavailable";
+}
+function classicMutationExecution(state) {
+  if (state === void 0 || state === null || state === "") return "completed";
+  return lookup(LAYER1_EXECUTION, state) ?? "unavailable";
+}
+function assertNever(value, context) {
+  throw new Error(`${context}: unhandled variant ${JSON.stringify(value)}`);
+}
+
+// src/diff-scope.ts
+import { execFile } from "child_process";
+import { promisify } from "util";
+var pExecFile = promisify(execFile);
+var SOURCE_RE = /\.(ts|tsx|js|mjs|cjs|jsx)$/;
+var PYTHON_SOURCE_RE = /\.py$/;
+var PYTHON_EXCLUDE_RE = /((^|\/)tests?\/|(^|\/)test_[^\/]*\.py$|_test\.py$|(^|\/)conftest\.py$|(^|\/)(build|dist|docs?|examples?|benchmarks?|scripts?)\/|(^|\/)\.|site-packages\/|(^|\/)venv\/|\.egg-info\/|(^|\/)setup\.py$)/i;
+var EXCLUDE_RE = /(\.d\.ts$|\.test\.|\.spec\.|\.test-d\.|\.min\.|__tests__|__mocks__|^(tests?|e2e|scripts|docs?|examples?|benchmarks?|website|fixtures?|build|tools?)\/|(^|\/)tests?\.[mc]?[jt]sx?$|(^|\/)\.|\.config\.|\.bench\.|(^|\/)vitest[^\/]*\.[mc]?[jt]s$|jest\.setup)/i;
+function isUnambiguouslyCommentOnly(content) {
+  let rest = content.trimStart();
+  if (rest.startsWith("//")) return true;
+  while (rest.startsWith("/*")) {
+    const close = rest.indexOf("*/", 2);
+    if (close < 0) return true;
+    rest = rest.slice(close + 2).trimStart();
+    if (rest === "" || rest.startsWith("//")) return true;
+  }
+  return false;
+}
+var DiffScopeError = class extends Error {
+  constructor(message, cause) {
+    super(message);
+    this.cause = cause;
+    this.name = "DiffScopeError";
+  }
+  cause;
+};
+function unquoteGitPath(s) {
+  if (s.length < 2 || s[0] !== '"' || s[s.length - 1] !== '"') return null;
+  const inner = s.slice(1, -1);
+  const simple = { t: 9, n: 10, r: 13, '"': 34, "\\": 92, a: 7, b: 8, f: 12, v: 11 };
+  const bytes = [];
+  for (let k = 0; k < inner.length; k++) {
+    const ch = inner[k];
+    if (ch !== "\\") {
+      const codePoint = inner.codePointAt(k);
+      const literal = String.fromCodePoint(codePoint);
+      for (const b of Buffer.from(literal, "utf8")) bytes.push(b);
+      if (codePoint > 65535) k++;
+      continue;
+    }
+    const next = inner[k + 1];
+    if (next === void 0) return null;
+    if (next >= "0" && next <= "7") {
+      let oct = "";
+      let m = k + 1;
+      while (m < inner.length && oct.length < 3 && inner[m] >= "0" && inner[m] <= "7") {
+        oct += inner[m];
+        m++;
+      }
+      bytes.push(parseInt(oct, 8) & 255);
+      k = m - 1;
+    } else if (next in simple) {
+      bytes.push(simple[next]);
+      k++;
+    } else {
+      return null;
+    }
+  }
+  return Buffer.from(bytes).toString("utf8");
+}
+function parseUnifiedDiff(diffText, opts = {}) {
+  const sourceRe = opts.sourceRe ?? SOURCE_RE;
+  const excludeRe = opts.excludeRe ?? EXCLUDE_RE;
+  const dropComments = opts.dropComments ?? false;
+  const side = opts.side ?? "new";
+  const headerPrefix = side === "old" ? "--- " : "+++ ";
+  const headerPathPrefix = side === "old" ? "--- a/" : "+++ b/";
+  const sidePrefix = side === "old" ? "a/" : "b/";
+  const bodyMark = side === "old" ? "-" : "+";
+  const scopes = /* @__PURE__ */ new Map();
+  const inspectionScopes = /* @__PURE__ */ new Map();
+  const excluded = [];
+  const deletions = [];
+  const excludedSeen = /* @__PURE__ */ new Set();
+  let currentFile = null;
+  let pendingOldPath = null;
+  let deletedFile = null;
+  const lines = diffText.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (/^(?:old mode|new mode) 160000$/u.test(line) || /^index [0-9a-f.]+ 160000$/u.test(line)) {
+      throw new DiffScopeError(
+        "submodule revision changed in this range: measuring submodule diffs is not supported"
+      );
+    }
+    if (side === "new" && line.startsWith("--- ")) {
+      pendingOldPath = null;
+      if (line.startsWith("--- a/")) pendingOldPath = line.slice("--- a/".length);
+      else if (line.startsWith('--- "')) {
+        const decoded = unquoteGitPath(line.slice(4));
+        if (decoded && decoded.startsWith("a/")) pendingOldPath = decoded.slice(2);
+      }
+      continue;
+    }
+    if (line.startsWith(headerPrefix)) {
+      let newPath = null;
+      if (line.startsWith(headerPathPrefix)) newPath = line.slice(headerPathPrefix.length);
+      else if (line.startsWith(`${headerPrefix}"`)) {
+        const decoded = unquoteGitPath(line.slice(4));
+        if (decoded && decoded.startsWith(sidePrefix)) newPath = decoded.slice(2);
+      }
+      if (newPath === null) {
+        currentFile = null;
+        deletedFile = side === "new" && line.startsWith(`${headerPrefix}/dev/null`) && pendingOldPath !== null && sourceRe.test(pendingOldPath) && !excludeRe.test(pendingOldPath) ? pendingOldPath : null;
+        pendingOldPath = null;
+        continue;
+      }
+      deletedFile = null;
+      pendingOldPath = null;
+      currentFile = newPath;
+      const reason = !sourceRe.test(currentFile) ? "not-source" : excludeRe.test(currentFile) ? "excluded-pattern" : null;
+      if (reason !== null) {
+        if (!excludedSeen.has(currentFile)) {
+          excludedSeen.add(currentFile);
+          excluded.push({ file: currentFile, reason });
+        }
+        currentFile = null;
+      }
+      continue;
+    }
+    if (currentFile === null && deletedFile !== null && line.startsWith("@@")) {
+      const om = line.match(/@@ -(\d+)(?:,(\d+))?/);
+      if (om) {
+        deletions.push({
+          file: deletedFile,
+          oldStart: Number(om[1]),
+          oldLines: om[2] === void 0 ? 1 : Number(om[2])
+        });
+      }
+      continue;
+    }
+    if (currentFile && line.startsWith("@@")) {
+      const m = line.match(side === "old" ? /@@ -(\d+)(?:,(\d+))?/ : /\+(\d+)(?:,(\d+))?/);
+      if (!m) continue;
+      const newStart = Number(m[1]);
+      const count = m[2] === void 0 ? 1 : Number(m[2]);
+      if (count === 0) {
+        if (side === "new" && currentFile) {
+          const om = line.match(/@@ -(\d+)(?:,(\d+))?/);
+          if (om) {
+            deletions.push({
+              file: currentFile,
+              oldStart: Number(om[1]),
+              oldLines: om[2] === void 0 ? 1 : Number(om[2])
+            });
+          }
+        }
+        continue;
+      }
+      const added = [];
+      const inspected = [];
+      let ln = newStart;
+      let j = i + 1;
+      for (; j < lines.length; j++) {
+        const body = lines[j];
+        if (body.startsWith("\\")) continue;
+        if (!body.startsWith("+") && !body.startsWith("-")) break;
+        if (body.startsWith(bodyMark)) {
+          const content = body.slice(1);
+          inspected.push(ln);
+          if (!(dropComments && isUnambiguouslyCommentOnly(content))) added.push(ln);
+          ln++;
+        }
+      }
+      i = j - 1;
+      addRanges(scopes, currentFile, added);
+      addRanges(inspectionScopes, currentFile, inspected);
+    }
+  }
+  const toScopes = (m) => [...m.entries()].map(([file, ranges]) => ({
+    file,
+    ranges,
+    lines: ranges.reduce((a, [s, e]) => a + (e - s + 1), 0)
+  }));
+  const out = toScopes(scopes);
+  return {
+    scopes: out,
+    totalLines: out.reduce((a, f) => a + f.lines, 0),
+    excluded,
+    inspectionScopes: toScopes(inspectionScopes),
+    deletions
+  };
+}
+function addRanges(target, file, ns) {
+  if (ns.length === 0) return;
+  const ranges = target.get(file) ?? [];
+  let s = ns[0];
+  let prev = ns[0];
+  for (const n of ns.slice(1)) {
+    if (n === prev + 1) {
+      prev = n;
+      continue;
+    }
+    ranges.push([s, prev]);
+    s = n;
+    prev = n;
+  }
+  ranges.push([s, prev]);
+  target.set(file, ranges);
+}
+async function computeScope(cwd, base, head = "HEAD", opts = {}) {
+  let leftSide = base;
+  if (opts.againstWorkingTree) {
+    try {
+      const { stdout: mb } = await pExecFile("git", ["merge-base", base, "HEAD"], {
+        cwd,
+        maxBuffer: 128 * 1024 * 1024,
+        timeout: 6e4,
+        killSignal: "SIGKILL"
+      });
+      leftSide = mb.trim();
+      if (leftSide === "") throw new Error("empty merge-base output");
+    } catch (err) {
+      const detail = err instanceof Error ? err.message.trim().split("\n")[0] : String(err);
+      throw new DiffScopeError(`git merge-base ${base} HEAD failed in ${cwd}: ${detail}`, err);
+    }
+  }
+  const range = opts.againstWorkingTree ? leftSide : `${base}...${head}`;
+  const args = ["-c", "core.quotepath=false", "diff", "--ignore-submodules=none", range, "-U0", "--no-color"];
+  if (opts.pathspec) args.push("--", opts.pathspec);
+  let stdout;
+  try {
+    ({ stdout } = await pExecFile("git", args, { cwd, maxBuffer: 128 * 1024 * 1024, timeout: 6e4, killSignal: "SIGKILL" }));
+  } catch (err) {
+    const detail = err instanceof Error ? err.message.trim().split("\n")[0] : String(err);
+    throw new DiffScopeError(`git diff ${range} failed in ${cwd}: ${detail}`, err);
+  }
+  return parseUnifiedDiff(stdout, opts);
+}
+
+// src/diff-coverage.ts
+var LAYER0_SCOPE_DISCLOSURE = "scope of claim: one aggregate coverage run at the measured commit \u2014 no per-test attribution, no repetition, and no claim that any test asserts on these lines";
+function changedStructuralCoverage(scope, structural) {
+  if (structural === null) return null;
+  const inScope = /* @__PURE__ */ new Map();
+  for (const { file, line } of expandScopeLines(scope)) {
+    const lines = inScope.get(file) ?? /* @__PURE__ */ new Set();
+    lines.add(line);
+    inScope.set(file, lines);
+  }
+  let fnTotal = 0;
+  let fnInvoked = 0;
+  let brTotal = 0;
+  let brTaken = 0;
+  for (const [file, lines] of inScope) {
+    const rec = structural.get(file);
+    if (!rec) continue;
+    for (const s of rec.functions) {
+      if (!lines.has(s.line)) continue;
+      fnTotal++;
+      if (s.hits > 0) fnInvoked++;
+    }
+    for (const s of rec.branches) {
+      if (!lines.has(s.line)) continue;
+      brTotal++;
+      if (s.hits > 0) brTaken++;
+    }
+  }
+  return { functions: { total: fnTotal, invoked: fnInvoked }, branches: { total: brTotal, taken: brTaken } };
+}
+var MAX_EXPANDED_LINES = 1e6;
+var MAX_SCOPE_RANGES = 1e5;
+function expandScopeLines(scope) {
+  const byFile = /* @__PURE__ */ new Map();
+  let rangeCount = 0;
+  for (const fs of scope) {
+    for (const [start, end] of fs.ranges) {
+      if (!Number.isSafeInteger(start) || !Number.isSafeInteger(end) || start < 1 || end < start) {
+        throw new Error(`expandScopeLines: invalid range [${start}, ${end}] for ${fs.file}`);
+      }
+      if (end - start + 1 > MAX_EXPANDED_LINES) {
+        throw new Error(`expandScopeLines: more than ${MAX_EXPANDED_LINES} changed lines`);
+      }
+      rangeCount++;
+      if (rangeCount > MAX_SCOPE_RANGES) {
+        throw new Error(`expandScopeLines: more than ${MAX_SCOPE_RANGES} scope ranges`);
+      }
+      const ranges = byFile.get(fs.file) ?? [];
+      ranges.push([start, end]);
+      byFile.set(fs.file, ranges);
+    }
+  }
+  const mergedByFile = /* @__PURE__ */ new Map();
+  let uniqueTotal = 0;
+  for (const [file, ranges] of byFile) {
+    ranges.sort((a, b) => a[0] - b[0] || a[1] - b[1]);
+    const merged = [];
+    for (const [start, end] of ranges) {
+      const last = merged[merged.length - 1];
+      if (last && start <= last[1] + 1) {
+        if (end > last[1]) last[1] = end;
+      } else {
+        merged.push([start, end]);
+      }
+    }
+    for (const [start, end] of merged) {
+      uniqueTotal += end - start + 1;
+      if (uniqueTotal > MAX_EXPANDED_LINES) {
+        throw new Error(`expandScopeLines: more than ${MAX_EXPANDED_LINES} changed lines`);
+      }
+    }
+    mergedByFile.set(file, merged);
+  }
+  const out = [];
+  for (const file of [...mergedByFile.keys()].sort()) {
+    for (const [start, end] of mergedByFile.get(file)) {
+      for (let line = start; line <= end; line++) out.push({ file, line });
+    }
+  }
+  return out;
+}
+function missingScopedFiles(scope, coverage) {
+  const files = [...new Set(scope.map((s) => s.file))].sort();
+  return files.filter((f) => !coverage.has(f));
+}
+function classifyDiffCoverage(scope, coverage) {
+  const lines = expandScopeLines(scope).map(({ file, line }) => {
+    const hits = coverage.get(file)?.get(line);
+    const state = hits === void 0 ? "not-instrumented" : hits > 0 ? "covered" : "uncovered";
+    return { file, line, state };
+  });
+  return { lines, counts: countsFromLines(lines) };
+}
+function isNonExecutableLine(text, file = "source.ts", line = 1) {
+  const t = text.trim();
+  if (t === "") return true;
+  if (file.endsWith(".py")) return t.startsWith("#") || isPureStructuralPunctuation(t);
+  if (line === 1 && t.startsWith("#!")) return true;
+  const stripped = stripLeadingJsComments(text, false).rest.trim();
+  if (stripped === "") return true;
+  return isPureStructuralPunctuation(stripped);
+}
+function isPureStructuralPunctuation(text) {
+  return /^[()[\]{};,]+$/.test(text);
+}
+function stripLeadingJsComments(text, startsInsideBlock) {
+  let rest = text;
+  let insideBlock = startsInsideBlock;
+  for (; ; ) {
+    if (insideBlock) {
+      const close2 = rest.indexOf("*/");
+      if (close2 < 0) return { rest: "", insideBlock: true };
+      rest = rest.slice(close2 + 2);
+      insideBlock = false;
+    }
+    rest = rest.trimStart();
+    if (rest.startsWith("//")) return { rest: "", insideBlock: false };
+    if (!rest.startsWith("/*")) return { rest, insideBlock: false };
+    const close = rest.indexOf("*/", 2);
+    if (close < 0) return { rest: "", insideBlock: true };
+    rest = rest.slice(close + 2);
+  }
+}
+function opensTrailingJsBlockComment(text) {
+  let quote = null;
+  let escaped = false;
+  for (let i = 0; i < text.length; i++) {
+    const char = text[i];
+    if (quote !== null) {
+      if (escaped) {
+        escaped = false;
+      } else if (char === "\\") {
+        escaped = true;
+      } else if (char === quote) {
+        quote = null;
+      }
+      continue;
+    }
+    if (char === "'" || char === '"' || char === "`") {
+      quote = char;
+      continue;
+    }
+    if (char === "/" && text[i + 1] === "/") return false;
+    if (char === "/" && text[i + 1] === "*") {
+      const close = text.indexOf("*/", i + 2);
+      if (close < 0) return true;
+      i = close + 1;
+    }
+  }
+  return false;
+}
+function moduleSyntaxTokens(source) {
+  const text = source.join("\n");
+  const lineStarts = [0];
+  for (let index2 = 0; index2 < text.length; index2++) {
+    if (text[index2] === "\n") lineStarts.push(index2 + 1);
+  }
+  const lineOf = (offset) => {
+    let low = 0;
+    let high = lineStarts.length;
+    while (low + 1 < high) {
+      const middle = Math.floor((low + high) / 2);
+      if (lineStarts[middle] <= offset) low = middle;
+      else high = middle;
+    }
+    return low + 1;
+  };
+  const skipQuoted = (start, quote) => {
+    let index2 = start + 1;
+    while (index2 < text.length) {
+      if (text[index2] === "\\") index2 += 2;
+      else if (text[index2] === quote) return index2 + 1;
+      else index2 += 1;
+    }
+    return text.length;
+  };
+  const skipBlockComment = (start) => {
+    const close = text.indexOf("*/", start + 2);
+    return close < 0 ? text.length : close + 2;
+  };
+  const skipTemplateExpression = (start) => {
+    let depth2 = 1;
+    let index2 = start;
+    while (index2 < text.length && depth2 > 0) {
+      const char = text[index2];
+      if (char === "'" || char === '"') {
+        index2 = skipQuoted(index2, char);
+      } else if (char === "`") {
+        index2 = skipTemplate(index2);
+      } else if (char === "/" && text[index2 + 1] === "*") {
+        index2 = skipBlockComment(index2);
+      } else if (char === "/" && text[index2 + 1] === "/") {
+        const newline = text.indexOf("\n", index2 + 2);
+        index2 = newline < 0 ? text.length : newline + 1;
+      } else {
+        if (char === "{") depth2 += 1;
+        else if (char === "}") depth2 -= 1;
+        index2 += 1;
+      }
+    }
+    return index2;
+  };
+  const skipTemplate = (start) => {
+    let index2 = start + 1;
+    while (index2 < text.length) {
+      if (text[index2] === "\\") {
+        index2 += 2;
+      } else if (text[index2] === "`") {
+        return index2 + 1;
+      } else if (text[index2] === "$" && text[index2 + 1] === "{") {
+        index2 = skipTemplateExpression(index2 + 2);
+      } else {
+        index2 += 1;
+      }
+    }
+    return text.length;
+  };
+  const raw = [];
+  const regexPrefix = /* @__PURE__ */ new Set([
+    "(",
+    "[",
+    "{",
+    "=",
+    ",",
+    ":",
+    ";",
+    "!",
+    "?",
+    "+",
+    "-",
+    "*",
+    "%",
+    "&",
+    "|",
+    "^",
+    "~",
+    "return",
+    "case",
+    "throw",
+    "yield",
+    "await",
+    "typeof",
+    "void",
+    "delete",
+    "instanceof",
+    "in",
+    "of"
+  ]);
+  let index = 0;
+  while (index < text.length) {
+    const char = text[index];
+    if (index === 0 && char === "#" && text[index + 1] === "!") {
+      const newline = text.indexOf("\n", index + 2);
+      index = newline < 0 ? text.length : newline + 1;
+      continue;
+    }
+    if (/\s/u.test(char)) {
+      index += 1;
+      continue;
+    }
+    if (char === "/" && text[index + 1] === "/") {
+      const newline = text.indexOf("\n", index + 2);
+      index = newline < 0 ? text.length : newline + 1;
+      continue;
+    }
+    if (char === "/" && text[index + 1] === "*") {
+      index = skipBlockComment(index);
+      continue;
+    }
+    const start = index;
+    let kind;
+    let value;
+    if (char === "'" || char === '"') {
+      kind = "string";
+      index = skipQuoted(index, char);
+      value = "string";
+    } else if (char === "`") {
+      kind = "punctuation";
+      index = skipTemplate(index);
+      value = "template";
+    } else if (char === "/" && (raw.length === 0 || regexPrefix.has(raw[raw.length - 1].value))) {
+      let cursor = index + 1;
+      let inClass = false;
+      let closed = false;
+      while (cursor < text.length && text[cursor] !== "\n") {
+        if (text[cursor] === "\\") cursor += 2;
+        else if (text[cursor] === "[") {
+          inClass = true;
+          cursor += 1;
+        } else if (text[cursor] === "]") {
+          inClass = false;
+          cursor += 1;
+        } else if (text[cursor] === "/" && !inClass) {
+          cursor += 1;
+          while (cursor < text.length && /[A-Za-z]/u.test(text[cursor])) cursor += 1;
+          closed = true;
+          break;
+        } else cursor += 1;
+      }
+      kind = "punctuation";
+      if (closed) {
+        index = cursor;
+        value = "regex";
+      } else {
+        index += 1;
+        value = "/";
+      }
+    } else if (/[A-Za-z_$]/u.test(char)) {
+      kind = "identifier";
+      index += 1;
+      while (index < text.length && /[A-Za-z0-9_$]/u.test(text[index])) index += 1;
+      value = text.slice(start, index);
+    } else {
+      kind = "punctuation";
+      value = char;
+      index += 1;
+    }
+    raw.push({
+      kind,
+      value,
+      startLine: lineOf(start),
+      endLine: lineOf(Math.max(start, index - 1))
+    });
+  }
+  let depth = 0;
+  return raw.map((token) => {
+    const withDepth = { ...token, depthBefore: depth };
+    if (token.value === "{") depth += 1;
+    else if (token.value === "}") depth = Math.max(0, depth - 1);
+    return withDepth;
+  });
+}
+function matchingModuleDelimiter(tokens, openIndex, open, close) {
+  if (tokens[openIndex]?.value !== open) return null;
+  let depth = 0;
+  for (let index = openIndex; index < tokens.length; index++) {
+    if (tokens[index].value === open) depth += 1;
+    else if (tokens[index].value === close && --depth === 0) return index;
+  }
+  return null;
+}
+function finishStaticModuleSource(tokens, sourceIndex) {
+  if (tokens[sourceIndex]?.kind !== "string") return null;
+  let end = sourceIndex;
+  let next = sourceIndex + 1;
+  if (tokens[next]?.value === "with" || tokens[next]?.value === "assert") {
+    const close = matchingModuleDelimiter(tokens, next + 1, "{", "}");
+    if (close === null) return null;
+    end = close;
+    next = close + 1;
+  }
+  if (tokens[next]?.value === ";") end = next;
+  return end;
+}
+function parseStaticImport(tokens, start) {
+  let index = start + 1;
+  const first = tokens[index];
+  if (first === void 0 || first.value === "(" || first.value === ".") return null;
+  if (first.kind === "string") return finishStaticModuleSource(tokens, index);
+  if (tokens[index]?.value === "type") index += 1;
+  const clauseStart = tokens[index];
+  if (clauseStart === void 0) return null;
+  if (clauseStart.kind === "identifier") {
+    index += 1;
+    if (tokens[index]?.value === ",") index += 1;
+  }
+  if (tokens[index]?.value === "{") {
+    const close = matchingModuleDelimiter(tokens, index, "{", "}");
+    if (close === null) return null;
+    index = close + 1;
+  } else if (tokens[index]?.value === "*") {
+    if (tokens[index + 1]?.value !== "as" || tokens[index + 2]?.kind !== "identifier") return null;
+    index += 3;
+  } else if (tokens[index - 1]?.kind !== "identifier") {
+    return null;
+  }
+  if (tokens[index]?.value !== "from" || tokens[index + 1]?.kind !== "string") return null;
+  return finishStaticModuleSource(tokens, index + 1);
+}
+function parseExportTypeDeclaration(tokens, start) {
+  let braces = 0;
+  let brackets = 0;
+  let parentheses = 0;
+  let sawEquals = false;
+  for (let index = start + 2; index < tokens.length; index++) {
+    const value = tokens[index].value;
+    if (value === "{") braces += 1;
+    else if (value === "}") braces = Math.max(0, braces - 1);
+    else if (value === "[") brackets += 1;
+    else if (value === "]") brackets = Math.max(0, brackets - 1);
+    else if (value === "(") parentheses += 1;
+    else if (value === ")") parentheses = Math.max(0, parentheses - 1);
+    else if (value === "=" && braces === 0 && brackets === 0 && parentheses === 0) sawEquals = true;
+    else if (value === ";" && braces === 0 && brackets === 0 && parentheses === 0) {
+      return sawEquals ? index : null;
+    }
+  }
+  return null;
+}
+function parseExportInterface(tokens, start) {
+  let open = start + 2;
+  while (open < tokens.length && tokens[open].value !== "{") {
+    if (tokens[open].value === ";") return null;
+    open += 1;
+  }
+  const close = matchingModuleDelimiter(tokens, open, "{", "}");
+  if (close === null) return null;
+  return tokens[close + 1]?.value === ";" ? close + 1 : close;
+}
+function parseStaticExport(tokens, start) {
+  let index = start + 1;
+  if (tokens[index]?.value === "type") {
+    if (tokens[index + 1]?.value !== "{" && tokens[index + 1]?.value !== "*") {
+      return parseExportTypeDeclaration(tokens, start);
+    }
+    index += 1;
+  } else if (tokens[index]?.value === "interface") {
+    return parseExportInterface(tokens, start);
+  }
+  if (tokens[index]?.value === "{") {
+    const close = matchingModuleDelimiter(tokens, index, "{", "}");
+    if (close === null) return null;
+    index = close + 1;
+    if (tokens[index]?.value === "from") {
+      if (tokens[index + 1]?.kind !== "string") return null;
+      return finishStaticModuleSource(tokens, index + 1);
+    }
+    return tokens[index]?.value === ";" ? index : close;
+  }
+  if (tokens[index]?.value !== "*") return null;
+  index += 1;
+  if (tokens[index]?.value === "as") {
+    if (tokens[index + 1]?.kind !== "identifier") return null;
+    index += 2;
+  }
+  if (tokens[index]?.value !== "from" || tokens[index + 1]?.kind !== "string") return null;
+  return finishStaticModuleSource(tokens, index + 1);
+}
+function definitelyDeclarativeModuleLines(source) {
+  const tokens = moduleSyntaxTokens(source);
+  const owned = /* @__PURE__ */ new Set();
+  let activeLine = -1;
+  let lineHasUnownedToken = false;
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index];
+    if (token.startLine !== activeLine) {
+      activeLine = token.startLine;
+      lineHasUnownedToken = false;
+    }
+    if (owned.has(index)) continue;
+    if (lineHasUnownedToken || token.value !== "import" && token.value !== "export" || token.depthBefore !== 0) {
+      lineHasUnownedToken = true;
+      continue;
+    }
+    const previous = tokens[index - 1];
+    if (previous !== void 0 && previous.endLine < token.startLine && previous.value !== ";" && previous.value !== "}" && !owned.has(index - 1)) {
+      lineHasUnownedToken = true;
+      continue;
+    }
+    const end = token.value === "import" ? parseStaticImport(tokens, index) : parseStaticExport(tokens, index);
+    if (end === null) {
+      lineHasUnownedToken = true;
+      continue;
+    }
+    for (let ownedIndex = index; ownedIndex <= end; ownedIndex++) owned.add(ownedIndex);
+  }
+  const byLine = /* @__PURE__ */ new Map();
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index];
+    for (let line = token.startLine; line <= token.endLine; line++) {
+      const indexes = byLine.get(line) ?? [];
+      indexes.push(index);
+      byLine.set(line, indexes);
+    }
+  }
+  const out = /* @__PURE__ */ new Set();
+  for (const [line, indexes] of byLine) {
+    if (indexes.length > 0 && indexes.every((index) => owned.has(index))) out.add(line);
+  }
+  return out;
+}
+function definitelyNonExecutableLines(file, source) {
+  const out = /* @__PURE__ */ new Set();
+  if (file.endsWith(".py")) {
+    for (let i = 0; i < source.length; i++) {
+      if (isNonExecutableLine(source[i], file, i + 1)) out.add(i + 1);
+    }
+    return out;
+  }
+  const declarativeModuleLines = definitelyDeclarativeModuleLines(source);
+  let insideBlock = false;
+  let insideTemplate = false;
+  for (let i = 0; i < source.length; i++) {
+    const t = source[i].trim();
+    if (insideTemplate) {
+      if (hasOddUnescapedBackticks(source[i])) insideTemplate = false;
+      continue;
+    }
+    if (i === 0 && t.startsWith("#!")) {
+      out.add(1);
+      continue;
+    }
+    const stripped = stripLeadingJsComments(source[i], insideBlock);
+    insideBlock = stripped.insideBlock;
+    const rest = stripped.rest.trim();
+    if (rest === "" || isPureStructuralPunctuation(rest) || declarativeModuleLines.has(i + 1) || // Plain function/class declaration OPENERS (no default-parameter expressions, which execute
+    // per call). vitest 4's AST-aware mapping emits no statement for these lines, so without
+    // this rescue every changed declaration line reads as a false gap. Excluding them cannot
+    // hide execution: the body lines still demand their own evidence.
+    /^(?:export\s+)?(?:default\s+)?(?:async\s+)?function\s*\*?\s*[A-Za-z0-9_$]*\s*\([^)=]*\)\s*\{$/u.test(rest) || /^(?:export\s+)?(?:default\s+)?(?:abstract\s+)?class\s+[A-Za-z0-9_$]+(?:\s+extends\s+[A-Za-z0-9_$.]+)?\s*\{$/u.test(rest)) {
+      out.add(i + 1);
+    }
+    if (!insideBlock && rest !== "" && opensTrailingJsBlockComment(rest)) insideBlock = true;
+    if (rest !== "" && hasOddUnescapedBackticks(rest)) insideTemplate = true;
+  }
+  return out;
+}
+function hasOddUnescapedBackticks(text) {
+  let count = 0;
+  for (let i = 0; i < text.length; i++) {
+    if (text[i] !== "`") continue;
+    let slashes = 0;
+    for (let j = i - 1; j >= 0 && text[j] === "\\"; j--) slashes++;
+    if (slashes % 2 === 0) count++;
+  }
+  return count % 2 === 1;
+}
+function markNonExecutable(lines, sourceOf) {
+  const cache = /* @__PURE__ */ new Map();
+  const nonExecutable = /* @__PURE__ */ new Map();
+  let marked = 0;
+  const out = lines.map((l) => {
+    if (l.state !== "not-instrumented") return l;
+    if (!cache.has(l.file)) cache.set(l.file, sourceOf(l.file));
+    const src = cache.get(l.file);
+    if (src === null || src === void 0) return l;
+    if (!nonExecutable.has(l.file)) nonExecutable.set(l.file, definitelyNonExecutableLines(l.file, src));
+    if (!nonExecutable.get(l.file).has(l.line)) return l;
+    marked++;
+    return { ...l, state: "not-executable" };
+  });
+  return { lines: out, marked };
+}
+function countsFromLines(lines) {
+  let covered = 0;
+  let uncovered = 0;
+  let notInstrumented = 0;
+  let notExecutable = 0;
+  for (const l of lines) {
+    if (l.state === "covered") covered++;
+    else if (l.state === "uncovered") uncovered++;
+    else if (l.state === "not-executable") notExecutable++;
+    else notInstrumented++;
+  }
+  return {
+    changed: lines.length - notExecutable,
+    covered,
+    uncovered,
+    notInstrumented,
+    ...notExecutable > 0 ? { notExecutable } : {}
+  };
+}
+function uncoveredCount(counts) {
+  return counts.uncovered + counts.notInstrumented;
+}
+function coveredLinesToScope(lines) {
+  const byFile = /* @__PURE__ */ new Map();
+  for (const l of lines) {
+    if (l.state !== "covered") continue;
+    const arr = byFile.get(l.file) ?? [];
+    arr.push(l.line);
+    byFile.set(l.file, arr);
+  }
+  const out = [];
+  for (const file of [...byFile.keys()].sort()) {
+    const nums = [...new Set(byFile.get(file))].sort((a, b) => a - b);
+    const ranges = [];
+    let s = nums[0];
+    let prev = nums[0];
+    for (const n of nums.slice(1)) {
+      if (n === prev + 1) {
+        prev = n;
+        continue;
+      }
+      ranges.push([s, prev]);
+      s = n;
+      prev = n;
+    }
+    ranges.push([s, prev]);
+    out.push({ file, ranges, lines: ranges.reduce((a, [rs, re]) => a + (re - rs + 1), 0) });
+  }
+  return out;
+}
+function validateDiffCoverageLines(scope, lines) {
+  const expected = expandScopeLines(scope);
+  const expectedKeys = new Set(expected.map((e) => `${e.file} ${e.line}`));
+  if (lines.length !== expected.length) {
+    throw new Error(`diffCoverage lines: expected ${expected.length} entries (one per changed line), got ${lines.length}`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const l of lines) {
+    if (!Number.isInteger(l.line) || l.line < 1) throw new Error(`diffCoverage lines: invalid line ${JSON.stringify(l.line)}`);
+    if (l.state !== "covered" && l.state !== "uncovered" && l.state !== "not-instrumented" && l.state !== "not-executable") {
+      throw new Error(`diffCoverage lines: invalid state ${JSON.stringify(l.state)}`);
+    }
+    const key = `${l.file} ${l.line}`;
+    if (!expectedKeys.has(key)) throw new Error(`diffCoverage lines: entry ${l.file}:${l.line} is not in the changed-line scope`);
+    if (seen.has(key)) throw new Error(`diffCoverage lines: duplicate entry ${l.file}:${l.line}`);
+    seen.add(key);
+  }
+  return countsFromLines(lines);
+}
+
+// src/score.ts
+function tallyCounts(mutants) {
+  const counts = emptyCounts();
+  for (const m of mutants) counts[m.status]++;
+  return counts;
+}
+function denominatorOf(counts) {
+  return counts.killed + counts.timeout + counts.survived + counts["no-coverage"];
+}
+function errorCountOf(counts) {
+  return counts["runtime-error"] + counts["build-error"];
+}
+function pct(n, d) {
+  return d > 0 ? Number((100 * n / d).toFixed(1)) : null;
+}
+function computeScores({ counts, confirmedEquivalent = 0, tier = 1, triageValidated = false }) {
+  const killedish = counts.killed + counts.timeout;
+  const denom = denominatorOf(counts);
+  const rawScore = pct(killedish, denom);
+  const triagedScore = tier === 0 ? null : pct(killedish, denom - confirmedEquivalent);
+  return {
+    rawScore,
+    triagedScore,
+    denominator: denom,
+    errorCount: errorCountOf(counts),
+    confirmedEquivalent,
+    triageValidated
+  };
+}
+var DEFAULT_FLOOR = {
+  minMutantsExecuted: 10,
+  maxErrorRate: 0.2,
+  minSamplingFraction: 0.5
+};
+function evaluateFloor(counts, mutantsPlanned, mutantsRun, policy = DEFAULT_FLOOR) {
+  const denom = denominatorOf(counts);
+  const errRate = mutantsPlanned > 0 ? errorCountOf(counts) / mutantsPlanned : 1;
+  const sampFrac = mutantsPlanned > 0 ? mutantsRun / mutantsPlanned : 0;
+  const minMutantsExecuted = denom >= policy.minMutantsExecuted;
+  const maxErrorRate = errRate <= policy.maxErrorRate;
+  const minSamplingFraction = sampFrac >= policy.minSamplingFraction;
+  return {
+    minMutantsExecuted,
+    maxErrorRate,
+    minSamplingFraction,
+    passed: minMutantsExecuted && maxErrorRate && minSamplingFraction
+  };
+}
+function evaluateGate(scores, floor, opts) {
+  const { threshold, tier = 1 } = opts;
+  if (!floor.passed) {
+    const which = [
+      !floor.minMutantsExecuted && "too few mutants executed",
+      !floor.maxErrorRate && "error rate too high",
+      !floor.minSamplingFraction && "sampling fraction too low"
+    ].filter(Boolean).join("; ");
+    return { status: "cannot-attest", score: null, threshold, reason: `evidence floor failed: ${which}` };
+  }
+  const useTriaged = tier !== 0 && scores.triageValidated;
+  const score = useTriaged ? scores.triagedScore ?? scores.rawScore : scores.rawScore;
+  if (score === null) return { status: "cannot-attest", score: null, threshold, reason: "no scoreable mutants" };
+  const basis = useTriaged ? "triaged score" : "score";
+  return score >= threshold ? { status: "pass", score, threshold, reason: `${basis} ${score}% \u2265 threshold ${threshold}%` } : { status: "fail", score, threshold, reason: `${basis} ${score}% < threshold ${threshold}%` };
+}
+var DIFF_COVERAGE_THRESHOLD = 100;
+function evaluateDiffCoverageGate(dc) {
+  if (dc.state === "completed") {
+    const c = dc.counts;
+    if (c.changed === 0) return null;
+    const missing = uncoveredCount(c);
+    const rawScore = pct(c.covered, c.changed);
+    if (missing === 0) {
+      return { status: "pass", score: rawScore, threshold: DIFF_COVERAGE_THRESHOLD, reason: `all ${c.changed} changed line(s) covered` };
+    }
+    const score = rawScore !== null && rawScore >= 100 ? 99.9 : rawScore;
+    return {
+      status: "fail",
+      score,
+      threshold: DIFF_COVERAGE_THRESHOLD,
+      reason: `${missing} of ${c.changed} changed lines have no test executing them`
+    };
+  }
+  if (dc.state === "cannot-attest") {
+    return { status: "cannot-attest", score: null, threshold: DIFF_COVERAGE_THRESHOLD, reason: dc.reason };
+  }
+  return null;
+}
+function combineLayerGates(diffCoverage, _diffCoverageGate, mutationGate, opts) {
+  const { threshold } = opts;
+  const diffCoverageGate = evaluateDiffCoverageGate(diffCoverage);
+  if (diffCoverage.state === "completed") {
+    if (diffCoverageGate && diffCoverageGate.status === "fail") {
+      return { overall: diffCoverageGate, decisiveLayer: "layer-0" };
+    }
+  } else if (diffCoverage.state === "cannot-attest") {
+    return {
+      overall: diffCoverageGate ?? { status: "cannot-attest", score: null, threshold, reason: diffCoverage.reason },
+      decisiveLayer: "layer-0"
+    };
+  } else if (diffCoverage.state === "not-applicable" && (diffCoverage.reason === "empty-scope" || diffCoverage.reason === "no-executable-lines" || diffCoverage.reason === "deletion-only")) {
+    const reason = diffCoverage.reason === "no-executable-lines" ? "no executable changed lines" : diffCoverage.reason === "deletion-only" ? "deletion-only change \u2014 no new line to execute and no mutation scope" : "no scoreable mutants";
+    return { overall: { status: "cannot-attest", score: null, threshold, reason }, decisiveLayer: "none" };
+  } else if (diffCoverage.state === "not-run") {
+    return { overall: { status: "cannot-attest", score: null, threshold, reason: "no scoreable mutants" }, decisiveLayer: "none" };
+  }
+  if (mutationGate) return { overall: mutationGate, decisiveLayer: "layer-1" };
+  return { overall: { status: "cannot-attest", score: null, threshold, reason: "no scoreable mutants" }, decisiveLayer: "none" };
+}
+
+// src/headroom.ts
+function zFor(confidence) {
+  if (confidence >= 0.99) return 2.5758;
+  if (confidence >= 0.95) return 1.96;
+  if (confidence >= 0.9) return 1.6449;
+  return 1.96;
+}
+function wilsonInterval(successes, n, confidence = 0.95) {
+  if (n <= 0) return { lower: 0, upper: 1 };
+  const z = zFor(confidence);
+  const p = successes / n;
+  const z2 = z * z;
+  const denom = 1 + z2 / n;
+  const centre = p + z2 / (2 * n);
+  const spread = z * Math.sqrt(p * (1 - p) / n + z2 / (4 * n * n));
+  return {
+    lower: Math.max(0, (centre - spread) / denom),
+    upper: Math.min(1, (centre + spread) / denom)
+  };
+}
+var pct2 = (x) => Number((100 * x).toFixed(1));
+function classicHeadroom(omissions, opts) {
+  const confidence = opts.confidence ?? 0.95;
+  const total = omissions.length;
+  const classicMissed = omissions.filter((o) => !o.classicDetected).length;
+  if (total === 0) {
+    return {
+      total: 0,
+      classicMissed: 0,
+      ceilingPct: null,
+      lowerPct: null,
+      upperPct: null,
+      confidence,
+      marginPct: opts.marginPct,
+      // An empty corpus is not a pass. Treating "no evidence" as "proceed" would let the programme
+      // start on the strength of having measured nothing at all.
+      verdict: "inconclusive",
+      reason: "no qualified omissions in the frozen corpus \u2014 nothing to bound"
+    };
+  }
+  const { lower, upper } = wilsonInterval(classicMissed, total, confidence);
+  const ceilingPct = pct2(classicMissed / total);
+  const lowerPct = pct2(lower);
+  const upperPct = pct2(upper);
+  if (upperPct < opts.marginPct) {
+    return {
+      total,
+      classicMissed,
+      ceilingPct,
+      lowerPct,
+      upperPct,
+      confidence,
+      marginPct: opts.marginPct,
+      verdict: "stop",
+      reason: `classic already detects ${total - classicMissed} of ${total} qualified omissions, so the maximum possible realistic-only rate is ${ceilingPct}% (upper bound ${upperPct}%), below the declared margin of ${opts.marginPct}% \u2014 no model can clear it; stop before Stage B`
+    };
+  }
+  if (lowerPct >= opts.marginPct) {
+    return {
+      total,
+      classicMissed,
+      ceilingPct,
+      lowerPct,
+      upperPct,
+      confidence,
+      marginPct: opts.marginPct,
+      verdict: "proceed",
+      reason: `classic misses ${classicMissed} of ${total} qualified omissions; the ceiling is ${ceilingPct}% (lower bound ${lowerPct}%), at or above the declared margin of ${opts.marginPct}%`
+    };
+  }
+  return {
+    total,
+    classicMissed,
+    ceilingPct,
+    lowerPct,
+    upperPct,
+    confidence,
+    marginPct: opts.marginPct,
+    verdict: "inconclusive",
+    reason: `ceiling ${ceilingPct}% with a ${Math.round(confidence * 100)}% interval of ${lowerPct}\u2013${upperPct}% straddles the declared margin of ${opts.marginPct}% \u2014 ${total} qualified omissions cannot settle it; enlarge the corpus rather than reading the point estimate`
+  };
+}
+function conditionalPower(informativeN, opts) {
+  const confidence = opts.confidence ?? 0.95;
+  const margin = opts.marginPct / 100;
+  if (informativeN <= 0) {
+    return {
+      informativeN: 0,
+      marginPct: opts.marginPct,
+      confidence,
+      detectionsNeeded: null,
+      bestPossibleLowerPct: 0,
+      verdict: "underpowered",
+      reason: "classic missed nothing \u2014 there are no omissions on which the method could add anything"
+    };
+  }
+  const bestPossibleLowerPct = pct2(wilsonInterval(informativeN, informativeN, confidence).lower);
+  let detectionsNeeded = null;
+  for (let k = 0; k <= informativeN; k++) {
+    if (wilsonInterval(k, informativeN, confidence).lower >= margin) {
+      detectionsNeeded = k;
+      break;
+    }
+  }
+  if (detectionsNeeded === null) {
+    return {
+      informativeN,
+      marginPct: opts.marginPct,
+      confidence,
+      detectionsNeeded: null,
+      bestPossibleLowerPct,
+      verdict: "underpowered",
+      reason: `with ${informativeN} classic-missed omission(s), even a perfect ${informativeN}/${informativeN} result has a lower bound of ${bestPossibleLowerPct}%, below the declared margin of ${opts.marginPct}% \u2014 the bar is unreachable by construction; enlarge the corpus or lower the margin BEFORE running`
+    };
+  }
+  if (detectionsNeeded >= informativeN) {
+    return {
+      informativeN,
+      marginPct: opts.marginPct,
+      confidence,
+      detectionsNeeded,
+      bestPossibleLowerPct,
+      verdict: "underpowered",
+      reason: `only a perfect ${informativeN}/${informativeN} clears the ${opts.marginPct}% margin, so a single miss \u2014 from one flaky item \u2014 reads as failure for a method that works; there is no power against any realistic effect`
+    };
+  }
+  return {
+    informativeN,
+    marginPct: opts.marginPct,
+    confidence,
+    detectionsNeeded,
+    bestPossibleLowerPct,
+    verdict: "adequate",
+    reason: `${detectionsNeeded} of ${informativeN} classic-missed omissions would clear the ${opts.marginPct}% margin at ${Math.round(confidence * 100)}% confidence, with room to miss ${informativeN - detectionsNeeded}`
+  };
+}
+
+// src/historical-pairs.ts
+function stableOutcome(cell) {
+  if (cell.outcomes.length === 0) return null;
+  const first = cell.outcomes[0];
+  return cell.outcomes.every((o) => o === first) ? first : null;
+}
+var MIN_CELL_REPEATS = 3;
+function qualifyHistoricalPair(pair, opts = {}) {
+  const minRepeats = opts.minRepeats ?? MIN_CELL_REPEATS;
+  const reasons = [];
+  if (pair.isolation.differingTestHunks < 1) {
+    reasons.push("strong and weak do not differ by any test hunk \u2014 there is no regression delta to measure");
+  }
+  if (pair.isolation.strongDigestExcludingHunk !== pair.isolation.weakDigestExcludingHunk) {
+    reasons.push(
+      "everything outside the differing test hunk must be byte-identical (production files, helpers, fixtures, config, dependencies, every other test) \u2014 the digests differ"
+    );
+  }
+  const cells = [
+    // [label, cell, required outcome, is this the cell that must fail by the intended assertion]
+    ["fixed code under the STRONG suite", pair.fixedUnderStrong, "pass", false],
+    ["fixed code under the WEAK suite", pair.fixedUnderWeak, "pass", false],
+    ["the historical fault under the STRONG suite", pair.faultUnderStrong, "fail", true],
+    ["the historical fault under the WEAK suite", pair.faultUnderWeak, "pass", false]
+  ];
+  for (const [label, cell, required, needsAssertion] of cells) {
+    if (cell.outcomes.length < minRepeats) {
+      reasons.push(`${label}: ${cell.outcomes.length} repeat(s), need at least ${minRepeats} to rule out flakiness`);
+      continue;
+    }
+    const stable = stableOutcome(cell);
+    if (stable === null) {
+      reasons.push(`${label}: repeats disagree (${cell.outcomes.join(", ")}) \u2014 a flaky cell cannot support a verdict`);
+      continue;
+    }
+    if (stable === "error") {
+      reasons.push(`${label}: harness error, which is not evidence about the tests`);
+      continue;
+    }
+    if (stable !== required) {
+      if (label.includes("fault") && label.includes("WEAK") && stable === "fail") {
+        reasons.push(
+          "the historical fault still FAILS under the weak suite \u2014 removing that test did not create the claimed omission, so this item proves nothing"
+        );
+      } else if (label.includes("fault") && label.includes("STRONG") && stable === "pass") {
+        reasons.push(
+          "the historical fault PASSES under the strong suite \u2014 the regression test does not actually catch the bug it shipped with"
+        );
+      } else {
+        reasons.push(`${label}: expected ${required}, observed ${stable}`);
+      }
+      continue;
+    }
+    if (needsAssertion && cell.failedByIntendedAssertion !== true) {
+      reasons.push(
+        "the historical fault fails under strong, but NOT by the intended assertion \u2014 a timeout, build error or unrelated flaky test is the harness noticing damage, which any mutation achieves"
+      );
+    }
+  }
+  return { id: pair.id, verdict: reasons.length === 0 ? "qualified" : "rejected", reasons };
+}
+var EXPECTED_ORACLE_CELL = "strong-fail-weak-pass";
+function evaluateAssay(observations) {
+  const failures = [];
+  for (const o of observations) {
+    if (!o.reachedExecution) {
+      failures.push({
+        pairId: o.pairId,
+        reason: "the oracle mutant never reached execution \u2014 a structural gate rejected the real bug itself"
+      });
+      continue;
+    }
+    if (o.observed !== EXPECTED_ORACLE_CELL) {
+      failures.push({
+        pairId: o.pairId,
+        reason: `the real historical bug landed in ${o.observed}, not ${EXPECTED_ORACLE_CELL} \u2014 the pipeline cannot detect a known fault`
+      });
+      continue;
+    }
+    if (!o.attributedToIntendedAssertion) {
+      failures.push({
+        pairId: o.pairId,
+        reason: "the oracle mutant reached the expected cell, but the failure was not attributed to the intended assertion"
+      });
+    }
+  }
+  if (observations.length === 0) {
+    return { verdict: "invalid", checked: 0, failures: [], reason: "no oracle observations \u2014 the positive control never ran" };
+  }
+  return failures.length === 0 ? {
+    verdict: "valid",
+    checked: observations.length,
+    failures: [],
+    reason: `all ${observations.length} oracle mutants landed in ${EXPECTED_ORACLE_CELL}, attributed to the intended assertion`
+  } : {
+    verdict: "invalid",
+    checked: observations.length,
+    failures,
+    reason: `${failures.length} of ${observations.length} oracle mutants did not behave as a perfect proposal must \u2014 the assay cannot measure any model until this is fixed`
+  };
+}
+function qualifyCorpus(pairs, opts = {}) {
+  const results = pairs.map((p) => qualifyHistoricalPair(p, opts));
+  return {
+    qualified: results.filter((r) => r.verdict === "qualified"),
+    rejected: results.filter((r) => r.verdict === "rejected")
+  };
+}
+
+// src/experiment-manifest.ts
+var PLACEHOLDER = /^(tbd|todo|xxx|\?+|n\/?a|placeholder|fixme)$/i;
+function blank(v) {
+  if (v === null || v === void 0) return true;
+  if (typeof v === "string") return v.trim().length === 0 || PLACEHOLDER.test(v.trim());
+  if (Array.isArray(v)) return v.length === 0;
+  return false;
+}
+var HEX64 = /^[0-9a-f]{64}$/;
+function validateManifest(m) {
+  const problems = [];
+  if (!m) return { frozen: false, problems: ["no manifest \u2014 nothing has been preregistered"] };
+  if (m.schema !== "attest-benchmark-manifest/v1") problems.push('schema must be "attest-benchmark-manifest/v1"');
+  if (blank(m.frozenAt)) problems.push("frozenAt is required \u2014 a manifest with no freeze date cannot be shown to predate the data");
+  for (const [field, v] of [
+    ["corpusHash", m.corpusHash],
+    ["analysisCodeHash", m.analysisCodeHash],
+    ["promptHash", m.promptHash]
+  ]) {
+    if (blank(v)) problems.push(`${field} is required \u2014 without it nobody can prove the experiment ran on what it claims`);
+    else if (!HEX64.test(String(v))) problems.push(`${field} must be a 64-character hex digest`);
+  }
+  if (blank(m.models)) problems.push("models must be enumerated \u2014 'the strong ones' is not a preregistration");
+  else {
+    m.models.forEach((mm, i) => {
+      if (blank(mm?.id)) problems.push(`models[${i}].id is required (the exact identifier sent on the wire)`);
+      if (!mm?.provider) problems.push(`models[${i}].provider is required so the cost basis is unambiguous`);
+    });
+  }
+  const positives = [
+    ["corpusClusters", m.corpusClusters],
+    ["drawsPerCell", m.drawsPerCell],
+    ["minimumUsefulMarginPct", m.minimumUsefulMarginPct],
+    ["stageBValidOutputFraction", m.stageBValidOutputFraction],
+    ["reviewerRealismThresholdPct", m.reviewerRealismThresholdPct],
+    ["proposalSlotsPerOmission", m.proposalSlotsPerOmission]
+  ];
+  for (const [field, v] of positives) {
+    if (typeof v !== "number" || !Number.isFinite(v) || v <= 0) {
+      problems.push(`${field} must be a positive number, decided before any data exists`);
+    }
+  }
+  if (typeof m.heldOutClusters !== "number" || !Number.isFinite(m.heldOutClusters) || m.heldOutClusters < 0) {
+    problems.push("heldOutClusters must be a number (0 is allowed, but only if stated deliberately)");
+  }
+  if (typeof m.confidence !== "number" || !(m.confidence > 0.5 && m.confidence < 1)) {
+    problems.push("confidence must be between 0.5 and 1 (e.g. 0.95)");
+  }
+  if (typeof m.stageBValidOutputFraction === "number" && m.stageBValidOutputFraction > 1) {
+    problems.push("stageBValidOutputFraction is a fraction of 1, not a percentage");
+  }
+  if (!m.multiplicityProcedure) {
+    problems.push("multiplicityProcedure is required \u2014 comparing six models is a family, and ignoring that inflates false positives");
+  }
+  if (blank(m.topSelectionRule)) problems.push("topSelectionRule must be a stated procedure, not a decision made after screening");
+  if (blank(m.categoryQuotas) || Object.keys(m.categoryQuotas ?? {}).length === 0) {
+    problems.push("categoryQuotas are required \u2014 without them category is confounded with repository");
+  }
+  if (blank(m.exclusionOrder)) {
+    problems.push("exclusionOrder is required \u2014 replacing an inconvenient item after seeing its result is the most direct way to fake a finding");
+  }
+  if (blank(m.stopRules)) problems.push("stopRules must be written down before they can be applied honestly");
+  return { frozen: problems.length === 0, problems };
+}
+function canStartStageB(inputs) {
+  const blockers = [];
+  const manifest = validateManifest(inputs.manifest);
+  if (!manifest.frozen) {
+    blockers.push(...manifest.problems.map((p) => `manifest: ${p}`));
+  }
+  if (!inputs.headroom) {
+    blockers.push("classic-headroom has not been computed \u2014 it is free and determines whether the corpus can measure anything");
+  }
+  if (!inputs.power) {
+    blockers.push("conditional power has not been computed \u2014 nobody has checked the declared margin is testable on this corpus");
+  } else if (inputs.power.verdict === "underpowered") {
+    blockers.push(`underpowered: ${inputs.power.reason}`);
+  }
+  if (!inputs.assay) {
+    blockers.push("the perfect-proposer positive control has not been run \u2014 the instrument is unverified");
+  } else if (inputs.assay.verdict === "invalid") {
+    blockers.push(`assay invalid: ${inputs.assay.reason}`);
+  }
+  if (!inputs.qualification) {
+    blockers.push("historical pairs have not been qualified \u2014 the corpus is unverified");
+  } else if (inputs.qualification.qualified.length === 0) {
+    blockers.push("no historical pair survived qualification \u2014 there is nothing to measure against");
+  }
+  if (!inputs.deterministicBaselineRun) {
+    blockers.push(
+      "the deterministic operator baseline has not been run \u2014 without it a model win cannot be distinguished from Stryker's operator set simply being incomplete"
+    );
+  }
+  return { ready: blockers.length === 0, blockers };
+}
+
+// src/policy.ts
+import { readFileSync, existsSync, realpathSync } from "fs";
+import { dirname } from "path";
+import { homedir } from "os";
+import { parse as parseYaml } from "yaml";
+
+// src/ci-property-search.ts
+import { createHash } from "crypto";
+var CI_PROPERTY_AUTHORITIES = [
+  "machine-sourced",
+  "source-grounded"
+];
+var CI_PROPERTY_OUTCOMES = [
+  "pr-regression",
+  "new-contract-counterexample",
+  "source-grounded-test-gap",
+  "pre-existing-counterexample",
+  "possible-duplicate",
+  "no-counterexample-found",
+  "disagreement",
+  "scenario-uncovered",
+  "inconclusive",
+  "not-applicable"
+];
+var CI_PROPERTY_STATES = [
+  "completed",
+  "partial",
+  "unavailable",
+  "disabled",
+  "disabled-by-tier",
+  "not-run"
+];
+var CI_RESIDUAL_STATES = [
+  "covered-existing",
+  "proposed-closed",
+  "open",
+  "inconclusive"
+];
+var CI_PROPERTY_CAPS = [1, 2, 4, 8];
+var HEX642 = /^[a-f0-9]{64}$/;
+var SHA40 = /^[a-f0-9]{40}$/;
+var CONTROL = /[\u0000-\u001f\u007f]/;
+function sha256(value) {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function boundedIdentity(name, value) {
+  if (value.length === 0 || value.length > 500 || CONTROL.test(value)) {
+    throw new Error(`${name} must be a bounded printable identity`);
+  }
+}
+function opaqueIdentity(name, value) {
+  if (value.length === 0 || value.length > 1e4) {
+    throw new Error(`${name} must be a bounded non-empty identity`);
+  }
+}
+function digest(name, value) {
+  if (!HEX642.test(value)) throw new Error(`${name} must be a lowercase sha256 digest`);
+}
+function nonNegativeInteger(name, value) {
+  if (!Number.isInteger(value) || value < 0) {
+    throw new Error(`${name} must be a non-negative integer`);
+  }
+}
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).filter(([, item]) => item !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function ciPropertyLedgerDigest(ledger) {
+  return sha256(canonical(ledger));
+}
+function validateCiResidualGapLedger(input) {
+  if (input.schema !== "attest-ci-residual-ledger/v1") {
+    throw new Error("CI residual ledger has an unknown schema");
+  }
+  if (!SHA40.test(input.headSha) || !SHA40.test(input.mergeBaseSha)) {
+    throw new Error("CI residual ledger requires full lowercase HEAD and merge-base SHAs");
+  }
+  digest("policyDigest", input.policyDigest);
+  const identities = /* @__PURE__ */ new Set();
+  for (const [index, entry] of input.entries.entries()) {
+    boundedIdentity(`entries[${index}].gapIdentity`, entry.gapIdentity);
+    boundedIdentity(`entries[${index}].targetPath`, entry.targetPath);
+    boundedIdentity(`entries[${index}].targetSymbol`, entry.targetSymbol);
+    boundedIdentity(`entries[${index}].producerVersion`, entry.producerVersion);
+    if (entry.headSha !== input.headSha || entry.mergeBaseSha !== input.mergeBaseSha) {
+      throw new Error("every CI residual entry must belong to the ledger revisions");
+    }
+    for (const [name, value] of [
+      ["targetDigest", entry.targetDigest],
+      ["sourceDigest", entry.sourceDigest]
+    ]) {
+      digest(`entries[${index}].${name}`, value);
+    }
+    if (!Number.isInteger(entry.changedRange.startLine) || !Number.isInteger(entry.changedRange.endLine) || entry.changedRange.startLine < 1 || entry.changedRange.endLine < entry.changedRange.startLine) {
+      throw new Error(`entries[${index}].changedRange is invalid`);
+    }
+    if (identities.has(entry.gapIdentity)) {
+      throw new Error(`duplicate CI residual identity '${entry.gapIdentity}'`);
+    }
+    identities.add(entry.gapIdentity);
+    if (entry.kind === "patch-revert") {
+      if (!entry.patchUnitId || !entry.patchDigest) {
+        throw new Error("patch-revert residuals require unit and patch identities");
+      }
+      boundedIdentity("patchUnitId", entry.patchUnitId);
+      digest("patchDigest", entry.patchDigest);
+    } else if (entry.kind !== "unsupported-site") {
+      if (!entry.mutantIdentity) {
+        throw new Error(`${entry.kind} residuals require mutantIdentity`);
+      }
+      opaqueIdentity("mutantIdentity", entry.mutantIdentity);
+    }
+    if (entry.state === "proposed-closed") {
+      if (entry.proofVerdict !== "proven" || entry.wholeSuiteVerdict !== "green" || !entry.candidateDigest || !entry.candidateTestPath || !entry.candidateTestName) {
+        throw new Error(
+          "proposed-closed requires a proven, whole-suite-green candidate with local identity"
+        );
+      }
+      digest("candidateDigest", entry.candidateDigest);
+      boundedIdentity("candidateTestPath", entry.candidateTestPath);
+      boundedIdentity("candidateTestName", entry.candidateTestName);
+    }
+  }
+  const expected = ciPropertyLedgerDigest({
+    schema: input.schema,
+    headSha: input.headSha,
+    mergeBaseSha: input.mergeBaseSha,
+    policyDigest: input.policyDigest,
+    entries: input.entries
+  });
+  if (input.ledgerDigest !== expected) {
+    throw new Error("CI residual ledger digest does not bind the ordered entries");
+  }
+  return {
+    ...input,
+    entries: input.entries.map((entry) => ({
+      ...entry,
+      changedRange: { ...entry.changedRange }
+    }))
+  };
+}
+function isCiPropertyCandidateCap(value) {
+  return CI_PROPERTY_CAPS.includes(value);
+}
+function sanitizeCiPropertySummary(input) {
+  if (!CI_PROPERTY_OUTCOMES.includes(input.outcome)) {
+    throw new Error("CI property summary has an unknown outcome");
+  }
+  if (!CI_PROPERTY_AUTHORITIES.includes(input.authority)) {
+    throw new Error("CI property summary has an unknown authority");
+  }
+  for (const [name, value] of [
+    ["findingId", input.findingId],
+    ["targetDigest", input.targetDigest],
+    ["intentDigest", input.intentDigest],
+    ["behaviourKey", input.behaviourKey],
+    ["sourceSetDigest", input.sourceSetDigest]
+  ]) {
+    digest(name, value);
+  }
+  if (input.candidateDigest !== null) digest("candidateDigest", input.candidateDigest);
+  nonNegativeInteger("headReplays", input.headReplays);
+  nonNegativeInteger("comparisonReplays", input.comparisonReplays);
+  const differentialFinding = input.outcome === "pr-regression" || input.outcome === "source-grounded-test-gap";
+  if (differentialFinding) {
+    if (!input.targetExecuted || !input.assertionExecuted || input.headReplays !== 3 || input.comparisonReplays !== 3 || input.candidateDigest === null) {
+      throw new Error("a CI property finding requires target, assertion, candidate, and 3/3 replay proof");
+    }
+  }
+  if (input.outcome === "new-contract-counterexample" && (!input.targetExecuted || !input.assertionExecuted || input.headReplays !== 3 || input.comparisonReplays !== 0 || input.candidateDigest === null)) {
+    throw new Error(
+      "a new-contract counterexample requires a 3/3 HEAD proof and an absent comparison target"
+    );
+  }
+  if (input.outcome === "no-counterexample-found" && (!input.targetExecuted || !input.assertionExecuted)) {
+    throw new Error("no-counterexample-found requires target and assertion execution");
+  }
+  return {
+    findingId: input.findingId,
+    outcome: input.outcome,
+    authority: input.authority,
+    targetDigest: input.targetDigest,
+    intentDigest: input.intentDigest,
+    behaviourKey: input.behaviourKey,
+    sourceSetDigest: input.sourceSetDigest,
+    headReplays: input.headReplays,
+    comparisonReplays: input.comparisonReplays,
+    targetExecuted: input.targetExecuted,
+    assertionExecuted: input.assertionExecuted,
+    candidateDigest: input.candidateDigest
+  };
+}
+function buildCiPropertySearchBlock(input) {
+  if (!isCiPropertyCandidateCap(input.candidateCap)) {
+    throw new Error("candidateCap must be one of 1, 2, 4, or 8");
+  }
+  for (const [name, value] of [
+    ["selectedTargets", input.selectedTargets],
+    ["validatedRules", input.validatedRules],
+    ["executedRules", input.executedRules],
+    ["duplicatesSuppressed", input.duplicatesSuppressed],
+    ["expectedSummaries", input.expectedSummaries],
+    ["llmCalls", input.llmCalls],
+    ["wallMs", input.wallMs]
+  ]) {
+    nonNegativeInteger(name, value);
+  }
+  if (input.selectedTargets > 2) throw new Error("CI property search may select at most two targets");
+  if (input.executedRules > input.validatedRules) {
+    throw new Error("executedRules cannot exceed validatedRules");
+  }
+  if (input.executedRules > input.selectedTargets * input.candidateCap) {
+    throw new Error("executedRules exceeds the target and candidate caps");
+  }
+  if (input.costUsd !== null && (!Number.isFinite(input.costUsd) || input.costUsd < 0)) {
+    throw new Error("costUsd must be null or a non-negative finite number");
+  }
+  for (const [name, value] of [
+    ["ledgerDigest", input.ledgerDigest],
+    ["evidencePackDigest", input.evidencePackDigest],
+    ["proofsDigest", input.proofsDigest]
+  ]) {
+    digest(name, value);
+  }
+  const containerDigests = [...new Set(input.containerDigests)];
+  for (const value of containerDigests) digest("containerDigest", value);
+  for (const model of input.models) boundedIdentity("model", model);
+  const summaries = input.summaries.map(sanitizeCiPropertySummary);
+  const ids = new Set(summaries.map((summary) => summary.findingId));
+  if (ids.size !== summaries.length) {
+    throw new Error("CI property summary identities must be unique");
+  }
+  if (summaries.length > input.expectedSummaries) {
+    throw new Error("CI property summaries exceed expected measured rules");
+  }
+  const byOutcome = Object.fromEntries(
+    CI_PROPERTY_OUTCOMES.map((outcome) => [outcome, 0])
+  );
+  for (const summary of summaries) byOutcome[summary.outcome] += 1;
+  const findings = byOutcome["pr-regression"] + byOutcome["new-contract-counterexample"] + byOutcome["source-grounded-test-gap"];
+  if (findings > 2) throw new Error("CI property output may contain at most two findings");
+  return {
+    state: summaries.length === input.expectedSummaries ? "completed" : "partial",
+    mode: input.mode,
+    candidateCap: input.candidateCap,
+    counts: {
+      selectedTargets: input.selectedTargets,
+      validatedRules: input.validatedRules,
+      executedRules: input.executedRules,
+      findings,
+      duplicatesSuppressed: input.duplicatesSuppressed,
+      byOutcome
+    },
+    summaries,
+    ledgerDigest: input.ledgerDigest,
+    evidencePackDigest: input.evidencePackDigest,
+    proofsDigest: input.proofsDigest,
+    containerDigests,
+    models: [...input.models],
+    llmCalls: input.llmCalls,
+    costUsd: input.costUsd,
+    wallMs: input.wallMs
+  };
+}
+
+// src/policy.ts
+var CLUSTER_STRATEGIES = ["line", "structural"];
+function isClusterStrategy(v) {
+  return typeof v === "string" && CLUSTER_STRATEGIES.includes(v);
+}
+var DEFAULT_CLASSIC_MUTATION = {
+  /**
+   * Triage runs on gpt-5.6-terra at `high`.
+   *
+   * Benchmarked, not chosen: at `high` it made zero wrong equivalence calls and at `medium` it made
+   * two — which is why the effort is pinned here rather than left to the provider default. The
+   * effort is part of the classifier IDENTITY (it is baked into every cache key and triage record),
+   * so a run at a different effort is a different classifier, not the same one tuned.
+   *
+   * Only tier 1+ ever reaches this; tier 0 makes no model calls at all.
+  */
+  models: {
+    triage: { provider: "hosted", model: "gpt-5.6-terra", effort: "high" },
+    // The fix-loop generation benchmark was run with Sol at xhigh; pin that exact model identity.
+    fixLoop: { provider: "hosted", model: "gpt-5.6-sol", effort: "xhigh" },
+    /**
+     * Gap NAMING runs terra at `xhigh`.
+     *
+     * Measured on 65 real surviving mutants across 4 node-cron files: 65 of 65 named, with zero
+     * vague nouns and zero names joining two behaviours with "and" — the two failure patterns
+     * Kenneth identified when grading an earlier run by hand.
+     *
+     * Effort matters more here than elsewhere and the evidence is partly indirect. On the older
+     * clustering prompt terra scored 88% at `high` and 95% at `xhigh`; at `xhigh` it also declined a
+     * merge it had got WRONG at `high` (it had labelled `if (s.endsWith('Z')) return 0` as "parsing
+     * nonzero offsets" — the opposite branch) and split it into two correct names instead. That is
+     * the model catching its own error class, which is the behaviour worth paying for.
+     *
+     * HONEST LIMIT: the naming-only prompt was never run at `high`, so `xhigh` is proven adequate,
+     * not proven necessary — some of the 88%→65/65 gain belongs to the prompt rather than the
+     * effort. It costs roughly 2x latency (52-93s per file against 13-39s). Kenneth pinned xhigh
+     * deliberately with that tradeoff stated.
+     */
+    naming: { provider: "hosted", model: "gpt-5.6-terra", effort: "xhigh" },
+    layer2Intent: { provider: "hosted", model: "gpt-5.6-sol", effort: "high" },
+    layer2Test: { provider: "hosted", model: "gpt-5.6-sol", effort: "high" },
+    // CI invariance is one Terra-XHIGH mechanism: both model tasks share the same frozen identity.
+    //
+    // Measured 2026-08-05, four arms x three runs on ts-pattern through the production path, the
+    // only axis varying being this default:
+    //
+    //   arm          real verdicts   rules validated (avg)   stage time (avg)
+    //   terra-high        1 / 3              1.33                   98 s
+    //   terra-xhigh       3 / 3              2.33                  123 s
+    //   sol-high          3 / 3              3.67                  175 s
+    //   sol-xhigh         0 / 3              1.33                  204 s  (2 runs hit the ceiling)
+    //
+    // terra-high — what shipped before this line changed — produced a usable verdict in one run of
+    // three: once inconclusive, once validating no rule at all, so there was nothing to execute.
+    // sol-xhigh is worse still, blowing perCandidateDeadlineMs twice and returning inconclusive on
+    // the run that did finish. Both remaining arms went 3/3.
+    //
+    // sol-high yields 57% more rules and terra-xhigh runs 42% faster. At the shipped
+    // `candidateCap: 1` every rule past the first is DISCARDED, so sol-high's yield is currently
+    // unrealisable while its latency is paid on every pull request — hence terra-xhigh. Re-run the
+    // sweep before trusting that ordering at a raised cap, where pool size is the whole point.
+    //
+    // RE-RUN at cap 8 on the v7 prompts (2026-08-05 evening, planted-regression fixture, 3 runs
+    // per arm):
+    //
+    //   arm          proposed/kept        executed       findings   deadline hits
+    //   terra-xhigh  2, 5, 4              2, 2, 4        1          1 of 3
+    //   sol-high     8, 8, 8              7, 6, 4        0          3 of 3
+    //
+    // The prediction inverted. sol-high's yield advantage became full 8-rule pools and produced
+    // nothing — its extra rules were passing properties of unmeasured strength, and every one of
+    // its runs burned into the 600 s stage deadline. terra-xhigh proposed less and produced the
+    // lane's FIRST model-generated pr-regression (counterexample [null,null], 3/3 head, 3/3
+    // base). At N=3 per arm that is directional rather than decisive, but there is currently no
+    // axis on which sol-high wins: findings terra, latency terra, container cost terra. Default
+    // stays terra-xhigh; re-examine only with wide-measurement data across several repositories.
+    ciPropertyIntent: { provider: "hosted", model: "gpt-5.6-terra", effort: "xhigh" },
+    ciPropertyTest: { provider: "hosted", model: "gpt-5.6-terra", effort: "xhigh" }
+  },
+  deterministicMutants: { enabled: false, maxRun: 25 },
+  perTest: { enabled: true, fullSuiteAuditSampleSize: null, fullSuiteMismatchTolerance: null },
+  fixLoop: { enabled: true, maxCandidates: 10, proofRepetitions: 2, suiteConfirmation: "inline", syntheticEnvironment: {} },
+  errorPaths: { staticAnalysis: true, failOnUntested: false, failOnAntiPattern: false, forceHandlerMutation: false }
+};
+function cloneClassicMutation() {
+  return {
+    // deep-copied per task, or a policy file setting `models.triage.effort` would write through to
+    // the module-level default and change the classifier identity for every later load
+    ...DEFAULT_CLASSIC_MUTATION.models ? { models: Object.fromEntries(Object.entries(DEFAULT_CLASSIC_MUTATION.models).map(([task, m]) => [task, { ...m }])) } : {},
+    deterministicMutants: { ...DEFAULT_CLASSIC_MUTATION.deterministicMutants },
+    perTest: { ...DEFAULT_CLASSIC_MUTATION.perTest },
+    fixLoop: {
+      ...DEFAULT_CLASSIC_MUTATION.fixLoop,
+      syntheticEnvironment: { ...DEFAULT_CLASSIC_MUTATION.fixLoop.syntheticEnvironment ?? {} }
+    },
+    errorPaths: { ...DEFAULT_CLASSIC_MUTATION.errorPaths }
+  };
+}
+var DEFAULT_MECHANISMS = {
+  scenarioSearch: {
+    enabled: false,
+    profile: "research",
+    lanes: ["property"],
+    sourceModes: ["machine-sourced", "source-grounded", "corroborated", "code-inferred"],
+    maxTargets: 5,
+    maxCandidatesPerTarget: 5,
+    maxAgentTurnsPerTarget: 100,
+    maxModelCalls: 100,
+    totalDeadlineMs: 36e5,
+    executionDeadlineMs: 12e4,
+    replayRepetitions: 3,
+    requireContainer: true,
+    failOnCounterexample: false
+  },
+  ciPropertySearch: {
+    // The bounded CI path is customer-facing and advisory: source-grounded model proposals are
+    // credited only after immutable HEAD/base replay, and never change mutation score or gate.
+    //
+    // PARKED 2026-08-06. Off by default because the lane produced zero findings on the frozen
+    // cohort of real suite-evading regressions across three configurations, and every finding it
+    // produced on a planted fixture traced back to information leaked into its own inputs. The
+    // CLI parks it ahead of this setting either way; this makes the shipped configuration say the
+    // same thing, so nobody reads `true` here and concludes the lane is live.
+    enabled: false,
+    mode: "advisory",
+    authorities: ["machine-sourced", "source-grounded"],
+    maxTargets: 2,
+    // 8, raised from 1 (2026-08-05), which makes it equal to `claimPoolSize` — every rule the
+    // intent stage validates now runs, and nothing is generated then discarded.
+    //
+    // The raise was expected to be expensive and is not, because the assumption behind the old
+    // value turned out to be wrong. Cap 1 was chosen to avoid paying for 8 candidates. Measured
+    // across 9 intent calls on ts-pattern, the stage asked for 8 rules and returned 2, 3, 2, 2, 2,
+    // 0, 1, 3, 2 — never more than 3. The fixture repo had been overriding this to 8 the whole
+    // time, so every one of those runs already ran uncapped, and across all of them there is not a
+    // single `dropped-pool-cap` or `unexecuted-policy-stop` record. The cap has never truncated
+    // anything.
+    //
+    // So the cost of this line is the difference between running one validated rule and running
+    // the two or three that exist: roughly 1.5-2x the stage, not 8x, and comfortably inside
+    // `totalDeadlineMs`. Batching and container pooling were designed to make cap 8 affordable and
+    // are not needed at this pool size; revisit them if intent yield ever climbs past about 4.
+    candidateCap: 8,
+    maxFindings: 2,
+    claimPoolSize: 8,
+    propertyRuns: 200,
+    replayRepetitions: 3,
+    setupRepairAttempts: 1,
+    totalDeadlineMs: 6e5,
+    // 180 s, raised from 90 s (2026-08-05). The intent call is the reasoning stage — it reads the
+    // evidence pack and returns the whole rule pool in one response — and at the pinned
+    // gpt-5.6-terra high-effort configuration it did not fit: measured on ts-pattern it burned the
+    // entire 90 s window across two attempts and reported failureKind "timeout" with zero
+    // validated rules, so the stage could never execute a single rule. The 90 s budget and the
+    // high-effort model pin were never reconciled with each other.
+    //
+    // Knock-on to know: this same field is the container process timeout, so a hung property run
+    // now takes 180 s rather than 90 s to fail. It remains bounded by totalDeadlineMs.
+    perCandidateDeadlineMs: 18e4,
+    maxEvidenceSources: 24,
+    maxEvidenceBytes: 262144,
+    requireContainer: true,
+    failOnFinding: false
+  },
+  patchRevert: {
+    // BETA, opt-in. A repository turns it on in abloh.yml:
+    //
+    //   research:
+    //     patchRevert:
+    //       enabled: true
+    //
+    // Off here rather than on-with-a-kill-switch because the lane spends real CI wall time on
+    // every pull request, and a verification tool that silently lengthens someone's build is the
+    // wrong default however good its findings are.
+    enabled: false,
+    batchedImpactScreen: true
+  }
+};
+function cloneResearch() {
+  return {
+    scenarioSearch: {
+      ...DEFAULT_MECHANISMS.scenarioSearch,
+      lanes: [...DEFAULT_MECHANISMS.scenarioSearch.lanes],
+      sourceModes: [...DEFAULT_MECHANISMS.scenarioSearch.sourceModes]
+    },
+    invariant: {
+      ...DEFAULT_MECHANISMS.ciPropertySearch,
+      authorities: [...DEFAULT_MECHANISMS.ciPropertySearch.authorities]
+    }
+  };
+}
+function clonePatchRevert() {
+  return { ...DEFAULT_MECHANISMS.patchRevert };
+}
+var DEFAULT_DIFF_COVERAGE = { shortCircuit: false };
+var DEFAULT_MUTATION = {
+  // uncapped by default: a silent sample would change what every existing run measures; capping
+  // is an explicit, disclosed policy choice per repo
+  maxMutantsPerRun: null,
+  ignoreStatic: true,
+  recheckRepetitions: null,
+  recheckTimeoutFactorMultiplier: null
+};
+var DEFAULT_SANDBOX = { envFiles: [] };
+var DEFAULT_ENVIRONMENT_IMAGE_DIGEST = "6c74791e557ce11fc957704f6d4fe134a7bc8d6f5ca4403205b2966bd488f6b3";
+var DEFAULT_ENVIRONMENT_IMAGE_REF = `node:22.23.1-bookworm-slim@sha256:${DEFAULT_ENVIRONMENT_IMAGE_DIGEST}`;
+var DEFAULT_ENVIRONMENT = {
+  services: [],
+  requiredVariables: [],
+  identityFiles: [],
+  setupCommands: [],
+  generatedFiles: []
+};
+var DEFAULT_FINDINGS = { clustering: "structural", naming: false };
+var DEFAULT_POLICY = {
+  threshold: 70,
+  enforce: false,
+  /*
+   * Tier 2 is the default posture: Abloh retains the mutated source span and the model's own
+   * output alongside the structural result.
+   *
+   * IT WAS 0, THEN 1, AND IS NOW 2. Each step widened what a run with no tier in its policy does.
+   * At 1 the triage model ran in the customer's own CI under their credentials and only structure
+   * reached Abloh; at 2 the mutated span (`originalText`), the classifier's rationale and proven
+   * test bodies reach Abloh as well, as digest-bound sidecars.
+   *
+   * WHAT THAT COMMITS A CUSTOMER TO, stated plainly because a default nobody chose is still a
+   * choice somebody made for them: a customer who never writes a tier into their policy has their
+   * source snippets stored by Abloh. This used to require a deliberate act by an administrator and
+   * no longer does. Lowering it is still one setting away — the tier is per-organization and the
+   * sanitizer decides at ingest, so a run measured at a lower tier stays structural forever.
+   */
+  tier: 2,
+  floor: DEFAULT_FLOOR,
+  mutation: DEFAULT_MUTATION,
+  sandbox: DEFAULT_SANDBOX,
+  target: {},
+  environment: DEFAULT_ENVIRONMENT,
+  diffCoverage: DEFAULT_DIFF_COVERAGE,
+  flaky: "quarantine",
+  flaggedPaths: [],
+  scoreAggregation: "worst-of-packages",
+  approvers: [],
+  classicMutation: DEFAULT_CLASSIC_MUTATION,
+  patchRevert: DEFAULT_MECHANISMS.patchRevert,
+  research: { scenarioSearch: DEFAULT_MECHANISMS.scenarioSearch, invariant: DEFAULT_MECHANISMS.ciPropertySearch },
+  findings: DEFAULT_FINDINGS
+};
+var KNOWN_KEYS = ["threshold", "enforce", "tier", "floor", "mutation", "sandbox", "target", "environment", "diffCoverage", "flaky", "flaggedPaths", "approvers", "classicMutation", "patchRevert", "findings", "scoreAggregation"];
+var RESEARCH_KEY_ALLOWED = () => process.env.ABLOH_RESEARCH_POLICY === "1";
+var KNOWN_TARGET_KEYS = ["directory"];
+var KNOWN_FINDINGS_KEYS = ["clustering", "naming"];
+var KNOWN_MUTATION_KEYS = ["maxMutantsPerRun", "ignoreStatic", "recheckRepetitions", "recheckTimeoutFactorMultiplier"];
+var KNOWN_SANDBOX_KEYS = ["envFiles"];
+var KNOWN_ENVIRONMENT_KEYS = [
+  "runtimeImage",
+  "installDirectory",
+  "installCommand",
+  "services",
+  "requiredVariables",
+  "identityFiles",
+  "setupCommands",
+  "generatedFiles",
+  "testCommand"
+];
+var KNOWN_CLASSIC_MUTATION_KEYS = ["deterministicMutants", "perTest", "fixLoop", "errorPaths", "models"];
+var KNOWN_DETERMINISTIC_KEYS = ["enabled", "maxRun"];
+var KNOWN_PERTEST_KEYS = ["enabled", "fullSuiteAuditSampleSize", "fullSuiteMismatchTolerance"];
+var KNOWN_FIXLOOP_KEYS = ["enabled", "maxCandidates", "proofRepetitions", "suiteConfirmation", "syntheticEnvironment", "generationDeadlineMs", "proofDeadlineMs", "cacheDir"];
+var KNOWN_ERRORPATHS_KEYS = ["staticAnalysis", "failOnUntested", "failOnAntiPattern", "forceHandlerMutation"];
+var KNOWN_FLOOR_KEYS = ["minMutantsExecuted", "maxErrorRate", "minSamplingFraction"];
+var KNOWN_DIFF_COVERAGE_KEYS = ["shortCircuit"];
+var KNOWN_RESEARCH_KEYS = ["scenarioSearch", "invariant"];
+var KNOWN_SCENARIO_SEARCH_KEYS = [
+  "enabled",
+  "profile",
+  "lanes",
+  "sourceModes",
+  "maxTargets",
+  "maxCandidatesPerTarget",
+  "maxAgentTurnsPerTarget",
+  "maxModelCalls",
+  "totalDeadlineMs",
+  "executionDeadlineMs",
+  "replayRepetitions",
+  "requireContainer",
+  "cacheDir",
+  "failOnCounterexample"
+];
+var REQUIRED_ENABLED_SCENARIO_SEARCH_KEYS = [
+  "profile",
+  "lanes",
+  "sourceModes",
+  "maxTargets",
+  "maxCandidatesPerTarget",
+  "maxAgentTurnsPerTarget",
+  "maxModelCalls",
+  "totalDeadlineMs",
+  "executionDeadlineMs",
+  "replayRepetitions",
+  "requireContainer"
+];
+var KNOWN_SCENARIO_LANES = ["property", "value", "state", "failure"];
+var KNOWN_SCENARIO_AUTHORITIES = [
+  "machine-sourced",
+  "source-grounded",
+  "corroborated",
+  "code-inferred"
+];
+var KNOWN_PATCH_REVERT_KEYS = ["enabled", "batchedImpactScreen"];
+var KNOWN_CI_PROPERTY_KEYS = [
+  "enabled",
+  "mode",
+  "authorities",
+  "maxTargets",
+  "candidateCap",
+  "maxFindings",
+  "claimPoolSize",
+  "propertyRuns",
+  "replayRepetitions",
+  "setupRepairAttempts",
+  "totalDeadlineMs",
+  "perCandidateDeadlineMs",
+  "maxEvidenceSources",
+  "maxEvidenceBytes",
+  "requireContainer",
+  "failOnFinding",
+  "cacheDir"
+];
+var REQUIRED_ENABLED_CI_PROPERTY_KEYS = [
+  "mode",
+  "authorities",
+  "maxTargets",
+  "candidateCap",
+  "maxFindings",
+  "claimPoolSize",
+  "propertyRuns",
+  "replayRepetitions",
+  "setupRepairAttempts",
+  "totalDeadlineMs",
+  "perCandidateDeadlineMs",
+  "maxEvidenceSources",
+  "maxEvidenceBytes",
+  "requireContainer",
+  "failOnFinding"
+];
+function isPlainObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function fail(path, msg) {
+  throw new Error(`invalid ${path}: ${msg}`);
+}
+function checkNumber(path, key, v, min, max) {
+  if (typeof v !== "number" || !Number.isFinite(v)) fail(path, `${key} must be a number, got ${JSON.stringify(v)}`);
+  if (v < min || v > max) fail(path, `${key} must be between ${min} and ${max}, got ${v}`);
+  return v;
+}
+function checkStringArray(path, key, v) {
+  if (!Array.isArray(v) || v.some((x) => typeof x !== "string")) {
+    fail(path, `${key} must be an array of strings, got ${JSON.stringify(v)}`);
+  }
+  return v;
+}
+function preparedTestCommandProblem(value) {
+  if (typeof value !== "string" || value.trim().length === 0) return "must be a non-empty string";
+  if (Buffer.byteLength(value, "utf8") > 4096) return "must be at most 4096 UTF-8 bytes";
+  if (/[\0\r\n]/u.test(value)) return "must be one line without NUL bytes";
+  if (/[;&|<>`]/u.test(value) || /\$\(/u.test(value)) {
+    return "must be one literal command without shell composition, redirection, or substitution; put complex setup in the repository's normal test script";
+  }
+  if (/^\s*[A-Za-z_][A-Za-z0-9_]*=/u.test(value)) {
+    return "must not contain inline environment assignments; declare required variable names under environment.requiredVariables and supply values through the caller environment";
+  }
+  if (/[\$*?\[\]~]/u.test(value)) {
+    return "must not contain shell expansion characters ($, *, ?, [, ], or ~); use a repository script with literal arguments";
+  }
+  return null;
+}
+function immutableImageProblem(value) {
+  if (typeof value !== "string" || value.length === 0) return "must be a non-empty string";
+  if (value.length > 384) return "must be at most 384 characters";
+  if (!/^[a-z0-9][a-z0-9._:/-]*@sha256:[a-f0-9]{64}$/u.test(value)) {
+    return "must be a lowercase immutable OCI reference ending in @sha256:<64 hex>";
+  }
+  return null;
+}
+function validatePreparedTestCommand(value, label = "test command") {
+  const problem = preparedTestCommandProblem(value);
+  if (problem) throw new Error(`${label} ${problem}`);
+  return value.trim();
+}
+function parsePreparedTestCommand(value, label = "test command") {
+  const command = validatePreparedTestCommand(value, label);
+  return parseLiteralArguments(command, label);
+}
+function parseLiteralArguments(command, label = "command") {
+  if (Buffer.byteLength(command, "utf8") > MAX_LITERAL_COMMAND_BYTES || /[\0\r\n]/u.test(command)) {
+    throw new Error(`${label} must be one bounded line without NUL bytes`);
+  }
+  const argv = [];
+  let token = "";
+  let quote = null;
+  let started = false;
+  for (let index = 0; index < command.length; index += 1) {
+    const char = command[index];
+    if (quote === "single") {
+      if (char === "'") quote = null;
+      else token += char;
+      started = true;
+      continue;
+    }
+    if (quote === "double") {
+      if (char === '"') {
+        quote = null;
+      } else if (char === "\\") {
+        const next = command[index + 1];
+        if (next === '"' || next === "\\") {
+          token += next;
+          index += 1;
+        } else {
+          token += "\\";
+        }
+      } else {
+        token += char;
+      }
+      started = true;
+      continue;
+    }
+    if (char === "\\") {
+      const next = command[index + 1];
+      if (next === void 0) throw new Error(`${label} contains an unterminated escape`);
+      token += next;
+      index += 1;
+      started = true;
+    } else if (char === "'") {
+      quote = "single";
+      started = true;
+    } else if (char === '"') {
+      quote = "double";
+      started = true;
+    } else if (/\s/u.test(char)) {
+      if (started) {
+        argv.push(token);
+        token = "";
+        started = false;
+      }
+    } else {
+      token += char;
+      started = true;
+    }
+  }
+  if (quote !== null) throw new Error(`${label} contains an unterminated quote`);
+  if (started) argv.push(token);
+  if (argv.length === 0 || argv.length > MAX_LITERAL_ARGUMENTS || argv.some((entry) => entry.length > 4096)) {
+    throw new Error(`${label} must contain 1 to 128 bounded arguments`);
+  }
+  return argv;
+}
+var MAX_LITERAL_ARGUMENTS = 128;
+var MAX_LITERAL_COMMAND_BYTES = 256 * 1024;
+function checkBool(path, key, v) {
+  if (typeof v !== "boolean") fail(path, `${key} must be true or false, got ${JSON.stringify(v)}`);
+  return v;
+}
+function checkOptCacheDir(path, key, v) {
+  if (typeof v !== "string" || v.length === 0) fail(path, `${key} must be a non-empty string path, got ${JSON.stringify(v)}`);
+  if (!v.startsWith("/")) fail(path, `${key} must be an ABSOLUTE path (a workspace-relative cache can be seeded by the repo), got ${JSON.stringify(v)}`);
+  if (v.includes("..")) fail(path, `${key} must not contain '..', got ${JSON.stringify(v)}`);
+  const home = homedir();
+  if (!home || !(v === home || v.startsWith(`${home}/`))) {
+    fail(path, `${key} must live under the invoking user's home directory (${home || "unknown"}) \u2014 these caches hold generated code that is later executed, so a shared or world-writable path is refused; got ${JSON.stringify(v)}`);
+  }
+  try {
+    const realHome = realpathSync(home);
+    let probe = v;
+    while (!existsSync(probe)) {
+      const parent = dirname(probe);
+      if (parent === probe) break;
+      probe = parent;
+    }
+    const real = realpathSync(probe);
+    if (!(real === realHome || real.startsWith(`${realHome}/`))) {
+      fail(path, `${key} resolves outside the user's home (via ${real}) \u2014 a symlinked cache is the same exposure as a shared one`);
+    }
+  } catch {
+    fail(path, `${key} could not be resolved on this filesystem, so its ownership cannot be established`);
+  }
+  return v;
+}
+function checkIntRange(path, key, v, min, max) {
+  if (typeof v !== "number" || !Number.isInteger(v) || v < min || v > max) {
+    fail(path, `${key} must be an integer between ${min} and ${max}, got ${JSON.stringify(v)}`);
+  }
+  return v;
+}
+function checkNestedKeys(path, label, obj, known) {
+  const unknown = Object.keys(obj).filter((k) => !known.includes(k));
+  if (unknown.length > 0) fail(path, `unknown ${label} key(s): ${unknown.join(", ")} (known: ${known.join(", ")})`);
+}
+function validateClassicMutation(path, raw, out) {
+  if (!isPlainObject(raw)) fail(path, `classicMutation must be a mapping, got ${JSON.stringify(raw)}`);
+  checkNestedKeys(path, "classicMutation", raw, KNOWN_CLASSIC_MUTATION_KEYS);
+  if ("deterministicMutants" in raw) {
+    const d = raw.deterministicMutants;
+    if (!isPlainObject(d)) fail(path, `classicMutation.deterministicMutants must be a mapping, got ${JSON.stringify(d)}`);
+    checkNestedKeys(path, "classicMutation.deterministicMutants", d, KNOWN_DETERMINISTIC_KEYS);
+    if ("enabled" in d) {
+      out.deterministicMutants.enabled = checkBool(path, "classicMutation.deterministicMutants.enabled", d.enabled);
+    }
+    if ("maxRun" in d) {
+      out.deterministicMutants.maxRun = checkIntRange(path, "classicMutation.deterministicMutants.maxRun", d.maxRun, 0, 500);
+    }
+  }
+  if ("perTest" in raw) {
+    const p = raw.perTest;
+    if (!isPlainObject(p)) fail(path, `classicMutation.perTest must be a mapping, got ${JSON.stringify(p)}`);
+    checkNestedKeys(path, "classicMutation.perTest", p, KNOWN_PERTEST_KEYS);
+    if ("enabled" in p) out.perTest.enabled = checkBool(path, "classicMutation.perTest.enabled", p.enabled);
+    if ("fullSuiteAuditSampleSize" in p) {
+      out.perTest.fullSuiteAuditSampleSize = p.fullSuiteAuditSampleSize === null ? null : checkIntRange(path, "classicMutation.perTest.fullSuiteAuditSampleSize", p.fullSuiteAuditSampleSize, 1, 1e4);
+    }
+    if ("fullSuiteMismatchTolerance" in p) {
+      out.perTest.fullSuiteMismatchTolerance = p.fullSuiteMismatchTolerance === null ? null : checkNumber(path, "classicMutation.perTest.fullSuiteMismatchTolerance", p.fullSuiteMismatchTolerance, 0, 1);
+    }
+    if (out.perTest.fullSuiteAuditSampleSize === null !== (out.perTest.fullSuiteMismatchTolerance === null)) {
+      fail(path, "classicMutation.perTest full-suite audit sample size and mismatch tolerance must be configured together");
+    }
+  }
+  if ("fixLoop" in raw) {
+    const f = raw.fixLoop;
+    if (!isPlainObject(f)) fail(path, `classicMutation.fixLoop must be a mapping, got ${JSON.stringify(f)}`);
+    checkNestedKeys(path, "classicMutation.fixLoop", f, KNOWN_FIXLOOP_KEYS);
+    if ("enabled" in f) out.fixLoop.enabled = checkBool(path, "classicMutation.fixLoop.enabled", f.enabled);
+    if ("maxCandidates" in f) out.fixLoop.maxCandidates = checkIntRange(path, "classicMutation.fixLoop.maxCandidates", f.maxCandidates, 0, 200);
+    if ("proofRepetitions" in f) out.fixLoop.proofRepetitions = checkIntRange(path, "classicMutation.fixLoop.proofRepetitions", f.proofRepetitions, 1, 10);
+    if ("suiteConfirmation" in f) {
+      if (f.suiteConfirmation !== "inline" && f.suiteConfirmation !== "deferred") {
+        fail(path, "classicMutation.fixLoop.suiteConfirmation must be 'inline' or 'deferred'");
+      }
+      out.fixLoop.suiteConfirmation = f.suiteConfirmation;
+    }
+    if ("syntheticEnvironment" in f) {
+      if (!isPlainObject(f.syntheticEnvironment)) {
+        fail(path, "classicMutation.fixLoop.syntheticEnvironment must be a mapping of literal strings");
+      }
+      const entries = Object.entries(f.syntheticEnvironment);
+      if (entries.length > 16) fail(path, "classicMutation.fixLoop.syntheticEnvironment exceeds the 16-value cap");
+      const environment = {};
+      for (const [key, value] of entries) {
+        if (!/^ATTEST_TEST_[A-Z0-9_]{1,64}$/u.test(key) || /(SECRET|TOKEN|PASSWORD|CREDENTIAL|PRIVATE|ACCESS_KEY|API_KEY)/u.test(key) || typeof value !== "string" || value.length > 512 || /[\u0000-\u001f\u007f]/u.test(value)) {
+          fail(path, "classicMutation.fixLoop.syntheticEnvironment requires bounded non-secret ATTEST_TEST_ string literals");
+        }
+        environment[key] = value;
+      }
+      out.fixLoop.syntheticEnvironment = environment;
+    }
+    if ("generationDeadlineMs" in f) out.fixLoop.generationDeadlineMs = checkIntRange(path, "classicMutation.fixLoop.generationDeadlineMs", f.generationDeadlineMs, 6e4, 72e5);
+    if ("proofDeadlineMs" in f) out.fixLoop.proofDeadlineMs = checkIntRange(path, "classicMutation.fixLoop.proofDeadlineMs", f.proofDeadlineMs, 6e4, 72e5);
+    if ("cacheDir" in f) out.fixLoop.cacheDir = checkOptCacheDir(path, "classicMutation.fixLoop.cacheDir", f.cacheDir);
+  }
+  if ("errorPaths" in raw) {
+    const e = raw.errorPaths;
+    if (!isPlainObject(e)) fail(path, `classicMutation.errorPaths must be a mapping, got ${JSON.stringify(e)}`);
+    checkNestedKeys(path, "classicMutation.errorPaths", e, KNOWN_ERRORPATHS_KEYS);
+    if ("staticAnalysis" in e) out.errorPaths.staticAnalysis = checkBool(path, "classicMutation.errorPaths.staticAnalysis", e.staticAnalysis);
+    if ("failOnUntested" in e) out.errorPaths.failOnUntested = checkBool(path, "classicMutation.errorPaths.failOnUntested", e.failOnUntested);
+    if ("failOnAntiPattern" in e) out.errorPaths.failOnAntiPattern = checkBool(path, "classicMutation.errorPaths.failOnAntiPattern", e.failOnAntiPattern);
+    if ("forceHandlerMutation" in e) out.errorPaths.forceHandlerMutation = checkBool(path, "classicMutation.errorPaths.forceHandlerMutation", e.forceHandlerMutation);
+  }
+  if ("models" in raw) {
+    fail(
+      path,
+      "classicMutation.models is not allowed \u2014 the models are fixed by the service, because a project must not choose the model that judges it"
+    );
+  }
+  if (out.errorPaths.failOnAntiPattern && !out.errorPaths.staticAnalysis) {
+    fail(path, "classicMutation.errorPaths.failOnAntiPattern requires staticAnalysis: true \u2014 anti-patterns are only detected by the scanner, so this rule could never fire");
+  }
+  if (out.errorPaths.failOnUntested && !out.errorPaths.staticAnalysis && !out.errorPaths.forceHandlerMutation) {
+    fail(
+      path,
+      "classicMutation.errorPaths.failOnUntested requires staticAnalysis: true or forceHandlerMutation: true \u2014 without either, no handler mutant is ever identified and this rule could never fire"
+    );
+  }
+}
+function validateResearch(path, raw, out) {
+  if (!isPlainObject(raw)) fail(path, `research must be a mapping, got ${JSON.stringify(raw)}`);
+  checkNestedKeys(path, "research", raw, KNOWN_RESEARCH_KEYS);
+  if ("scenarioSearch" in raw) {
+    const s = raw.scenarioSearch;
+    if (!isPlainObject(s)) {
+      fail(path, `research.scenarioSearch must be a mapping, got ${JSON.stringify(s)}`);
+    }
+    checkNestedKeys(
+      path,
+      "research.scenarioSearch",
+      s,
+      KNOWN_SCENARIO_SEARCH_KEYS
+    );
+    if ("enabled" in s) {
+      out.scenarioSearch.enabled = checkBool(
+        path,
+        "research.scenarioSearch.enabled",
+        s.enabled
+      );
+    }
+    if ("profile" in s) {
+      if (s.profile !== "research") {
+        fail(
+          path,
+          `research.scenarioSearch.profile must be 'research' before benchmark promotion, got ${JSON.stringify(s.profile)}`
+        );
+      }
+      out.scenarioSearch.profile = s.profile;
+    }
+    if ("lanes" in s) {
+      if (!Array.isArray(s.lanes) || s.lanes.length === 0 || s.lanes.some(
+        (lane) => typeof lane !== "string" || !KNOWN_SCENARIO_LANES.includes(lane)
+      )) {
+        fail(
+          path,
+          `research.scenarioSearch.lanes must be a non-empty subset of ${KNOWN_SCENARIO_LANES.join(", ")}, got ${JSON.stringify(s.lanes)}`
+        );
+      }
+      if (new Set(s.lanes).size !== s.lanes.length) {
+        fail(path, "research.scenarioSearch.lanes must not contain duplicates");
+      }
+      const selected = new Set(s.lanes);
+      out.scenarioSearch.lanes = KNOWN_SCENARIO_LANES.filter(
+        (lane) => selected.has(lane)
+      );
+    }
+    if ("sourceModes" in s) {
+      if (!Array.isArray(s.sourceModes) || s.sourceModes.length === 0 || s.sourceModes.some(
+        (mode) => typeof mode !== "string" || !KNOWN_SCENARIO_AUTHORITIES.includes(mode)
+      )) {
+        fail(
+          path,
+          `research.scenarioSearch.sourceModes must be a non-empty subset of ${KNOWN_SCENARIO_AUTHORITIES.join(", ")}, got ${JSON.stringify(s.sourceModes)}`
+        );
+      }
+      if (new Set(s.sourceModes).size !== s.sourceModes.length) {
+        fail(
+          path,
+          "research.scenarioSearch.sourceModes must not contain duplicates"
+        );
+      }
+      const selected = new Set(s.sourceModes);
+      out.scenarioSearch.sourceModes = KNOWN_SCENARIO_AUTHORITIES.filter(
+        (mode) => selected.has(mode)
+      );
+    }
+    if ("maxTargets" in s) {
+      out.scenarioSearch.maxTargets = checkIntRange(
+        path,
+        "research.scenarioSearch.maxTargets",
+        s.maxTargets,
+        1,
+        100
+      );
+    }
+    if ("maxCandidatesPerTarget" in s) {
+      out.scenarioSearch.maxCandidatesPerTarget = checkIntRange(
+        path,
+        "research.scenarioSearch.maxCandidatesPerTarget",
+        s.maxCandidatesPerTarget,
+        1,
+        100
+      );
+    }
+    if ("maxAgentTurnsPerTarget" in s) {
+      out.scenarioSearch.maxAgentTurnsPerTarget = checkIntRange(
+        path,
+        "research.scenarioSearch.maxAgentTurnsPerTarget",
+        s.maxAgentTurnsPerTarget,
+        1,
+        200
+      );
+    }
+    if ("maxModelCalls" in s) {
+      out.scenarioSearch.maxModelCalls = checkIntRange(
+        path,
+        "research.scenarioSearch.maxModelCalls",
+        s.maxModelCalls,
+        1,
+        1e3
+      );
+    }
+    if ("totalDeadlineMs" in s) {
+      out.scenarioSearch.totalDeadlineMs = checkIntRange(
+        path,
+        "research.scenarioSearch.totalDeadlineMs",
+        s.totalDeadlineMs,
+        6e4,
+        72e5
+      );
+    }
+    if ("executionDeadlineMs" in s) {
+      out.scenarioSearch.executionDeadlineMs = checkIntRange(
+        path,
+        "research.scenarioSearch.executionDeadlineMs",
+        s.executionDeadlineMs,
+        1e3,
+        6e5
+      );
+    }
+    if ("replayRepetitions" in s) {
+      out.scenarioSearch.replayRepetitions = checkIntRange(
+        path,
+        "research.scenarioSearch.replayRepetitions",
+        s.replayRepetitions,
+        1,
+        10
+      );
+    }
+    if ("requireContainer" in s) {
+      if (s.requireContainer !== true) {
+        fail(
+          path,
+          "research.scenarioSearch.requireContainer must be true \u2014 generated tests never execute on the host"
+        );
+      }
+      out.scenarioSearch.requireContainer = true;
+    }
+    if ("cacheDir" in s) {
+      out.scenarioSearch.cacheDir = checkOptCacheDir(
+        path,
+        "research.scenarioSearch.cacheDir",
+        s.cacheDir
+      );
+    }
+    if ("failOnCounterexample" in s) {
+      if (s.failOnCounterexample !== false) {
+        fail(
+          path,
+          "research.scenarioSearch.failOnCounterexample must remain false before benchmark and shadow promotion"
+        );
+      }
+      out.scenarioSearch.failOnCounterexample = false;
+    }
+    if (out.scenarioSearch.enabled) {
+      const missing = REQUIRED_ENABLED_SCENARIO_SEARCH_KEYS.filter(
+        (key) => !(key in s)
+      );
+      if (missing.length > 0) {
+        fail(
+          path,
+          `research.scenarioSearch enabled runs require explicit research limits: ${missing.join(", ")}`
+        );
+      }
+    }
+    if (out.scenarioSearch.executionDeadlineMs > out.scenarioSearch.totalDeadlineMs) {
+      fail(
+        path,
+        "research.scenarioSearch.executionDeadlineMs cannot exceed totalDeadlineMs"
+      );
+    }
+  }
+  if ("invariant" in raw) {
+    const c = raw.invariant;
+    if (!isPlainObject(c)) {
+      fail(path, `research.invariant must be a mapping, got ${JSON.stringify(c)}`);
+    }
+    checkNestedKeys(
+      path,
+      "research.invariant",
+      c,
+      KNOWN_CI_PROPERTY_KEYS
+    );
+    if ("enabled" in c) {
+      out.invariant.enabled = checkBool(
+        path,
+        "research.invariant.enabled",
+        c.enabled
+      );
+    }
+    if ("mode" in c) {
+      if (c.mode !== "shadow" && c.mode !== "advisory") {
+        fail(
+          path,
+          `research.invariant.mode must be shadow or advisory, got ${JSON.stringify(c.mode)}`
+        );
+      }
+      out.invariant.mode = c.mode;
+    }
+    if ("authorities" in c) {
+      if (!Array.isArray(c.authorities) || c.authorities.length === 0 || c.authorities.some(
+        (authority) => typeof authority !== "string" || !CI_PROPERTY_AUTHORITIES.includes(authority)
+      )) {
+        fail(
+          path,
+          `research.invariant.authorities must be a non-empty subset of ${CI_PROPERTY_AUTHORITIES.join(", ")}, got ${JSON.stringify(c.authorities)}`
+        );
+      }
+      if (new Set(c.authorities).size !== c.authorities.length) {
+        fail(path, "research.invariant.authorities must not contain duplicates");
+      }
+      const selected = new Set(c.authorities);
+      out.invariant.authorities = CI_PROPERTY_AUTHORITIES.filter(
+        (authority) => selected.has(authority)
+      );
+    }
+    if ("maxTargets" in c) {
+      out.invariant.maxTargets = checkIntRange(
+        path,
+        "research.invariant.maxTargets",
+        c.maxTargets,
+        1,
+        2
+      );
+    }
+    if ("candidateCap" in c) {
+      if (!CI_PROPERTY_CAPS.includes(c.candidateCap)) {
+        fail(
+          path,
+          `research.invariant.candidateCap must be one of ${CI_PROPERTY_CAPS.join(", ")}, got ${JSON.stringify(c.candidateCap)}`
+        );
+      }
+      out.invariant.candidateCap = c.candidateCap;
+    }
+    if ("maxFindings" in c) {
+      out.invariant.maxFindings = checkIntRange(
+        path,
+        "research.invariant.maxFindings",
+        c.maxFindings,
+        1,
+        2
+      );
+    }
+    if ("claimPoolSize" in c) {
+      const size = checkIntRange(
+        path,
+        "research.invariant.claimPoolSize",
+        c.claimPoolSize,
+        8,
+        8
+      );
+      out.invariant.claimPoolSize = size;
+    }
+    if ("propertyRuns" in c) {
+      out.invariant.propertyRuns = checkIntRange(
+        path,
+        "research.invariant.propertyRuns",
+        c.propertyRuns,
+        200,
+        200
+      );
+    }
+    if ("replayRepetitions" in c) {
+      out.invariant.replayRepetitions = checkIntRange(
+        path,
+        "research.invariant.replayRepetitions",
+        c.replayRepetitions,
+        3,
+        3
+      );
+    }
+    if ("setupRepairAttempts" in c) {
+      out.invariant.setupRepairAttempts = checkIntRange(
+        path,
+        "research.invariant.setupRepairAttempts",
+        c.setupRepairAttempts,
+        0,
+        1
+      );
+    }
+    if ("totalDeadlineMs" in c) {
+      out.invariant.totalDeadlineMs = checkIntRange(
+        path,
+        "research.invariant.totalDeadlineMs",
+        c.totalDeadlineMs,
+        6e4,
+        6e5
+      );
+    }
+    if ("perCandidateDeadlineMs" in c) {
+      out.invariant.perCandidateDeadlineMs = checkIntRange(
+        path,
+        "research.invariant.perCandidateDeadlineMs",
+        c.perCandidateDeadlineMs,
+        1e3,
+        18e4
+      );
+    }
+    if ("maxEvidenceSources" in c) {
+      out.invariant.maxEvidenceSources = checkIntRange(
+        path,
+        "research.invariant.maxEvidenceSources",
+        c.maxEvidenceSources,
+        1,
+        24
+      );
+    }
+    if ("maxEvidenceBytes" in c) {
+      out.invariant.maxEvidenceBytes = checkIntRange(
+        path,
+        "research.invariant.maxEvidenceBytes",
+        c.maxEvidenceBytes,
+        1024,
+        262144
+      );
+    }
+    if ("requireContainer" in c) {
+      if (c.requireContainer !== true) {
+        fail(
+          path,
+          "research.invariant.requireContainer must be true \u2014 generated tests never execute on the host"
+        );
+      }
+      out.invariant.requireContainer = true;
+    }
+    if ("failOnFinding" in c) {
+      if (c.failOnFinding !== false) {
+        fail(
+          path,
+          "research.invariant.failOnFinding must remain false in version 1"
+        );
+      }
+      out.invariant.failOnFinding = false;
+    }
+    if ("cacheDir" in c) {
+      out.invariant.cacheDir = checkOptCacheDir(
+        path,
+        "research.invariant.cacheDir",
+        c.cacheDir
+      );
+    }
+    if (out.invariant.enabled) {
+      const missing = REQUIRED_ENABLED_CI_PROPERTY_KEYS.filter(
+        (key) => !(key in c)
+      );
+      if (missing.length > 0) {
+        fail(
+          path,
+          `research.invariant enabled runs require explicit CI limits: ${missing.join(", ")}`
+        );
+      }
+    }
+    if (out.invariant.perCandidateDeadlineMs > out.invariant.totalDeadlineMs) {
+      fail(
+        path,
+        "research.invariant.perCandidateDeadlineMs cannot exceed totalDeadlineMs"
+      );
+    }
+    if (out.invariant.candidateCap > out.invariant.claimPoolSize) {
+      fail(
+        path,
+        "research.invariant.candidateCap cannot exceed claimPoolSize"
+      );
+    }
+  }
+}
+function validatePatchRevert(path, raw, out) {
+  if (!isPlainObject(raw)) {
+    fail(path, `patchRevert must be a mapping, got ${JSON.stringify(raw)}`);
+  }
+  checkNestedKeys(path, "patchRevert", raw, KNOWN_PATCH_REVERT_KEYS);
+  if ("enabled" in raw) {
+    out.enabled = checkBool(path, "patchRevert.enabled", raw.enabled);
+  }
+  if ("batchedImpactScreen" in raw) {
+    out.batchedImpactScreen = checkBool(path, "patchRevert.batchedImpactScreen", raw.batchedImpactScreen);
+  }
+}
+function classicMutationTier(policy, effectiveTier = policy.tier) {
+  const tier0 = effectiveTier === 0;
+  return {
+    fixLoop: tier0 ? "disabled-by-tier" : policy.classicMutation.fixLoop.enabled ? "enabled" : "disabled",
+    perTest: policy.classicMutation.perTest.enabled ? "enabled" : "disabled",
+    errorPathStatic: policy.classicMutation.errorPaths.staticAnalysis ? "enabled" : "disabled"
+  };
+}
+function researchTier(policy, effectiveTier = policy.tier) {
+  const tier0 = effectiveTier === 0;
+  return {
+    scenarioSearch: tier0 ? "disabled-by-tier" : policy.research.scenarioSearch.enabled ? "enabled" : "disabled",
+    ciPropertySearch: tier0 ? "disabled-by-tier" : policy.research.invariant.enabled ? "enabled" : "disabled"
+  };
+}
+function validatePolicy(raw, path) {
+  const policy = {
+    ...DEFAULT_POLICY,
+    floor: { ...DEFAULT_POLICY.floor },
+    mutation: { ...DEFAULT_POLICY.mutation },
+    sandbox: { envFiles: [...DEFAULT_POLICY.sandbox.envFiles] },
+    target: { ...DEFAULT_POLICY.target },
+    environment: {
+      ...DEFAULT_POLICY.environment,
+      services: DEFAULT_POLICY.environment.services.map((service) => ({ ...service })),
+      requiredVariables: [...DEFAULT_POLICY.environment.requiredVariables],
+      identityFiles: [...DEFAULT_POLICY.environment.identityFiles],
+      setupCommands: [...DEFAULT_POLICY.environment.setupCommands],
+      generatedFiles: [...DEFAULT_POLICY.environment.generatedFiles]
+    },
+    diffCoverage: { ...DEFAULT_POLICY.diffCoverage },
+    flaggedPaths: [],
+    scoreAggregation: DEFAULT_POLICY.scoreAggregation,
+    approvers: [],
+    classicMutation: cloneClassicMutation(),
+    patchRevert: clonePatchRevert(),
+    research: cloneResearch(),
+    findings: { ...DEFAULT_POLICY.findings }
+  };
+  if (raw === null || raw === void 0) return policy;
+  if (!isPlainObject(raw)) fail(path, `policy must be a mapping of keys to values, got ${Array.isArray(raw) ? "an array" : `a ${typeof raw}`}`);
+  const permitted = RESEARCH_KEY_ALLOWED() ? [...KNOWN_KEYS, "research"] : KNOWN_KEYS;
+  const unknown = Object.keys(raw).filter((k) => !permitted.includes(k));
+  if (unknown.length > 0) fail(path, `unknown key(s): ${unknown.join(", ")} (known: ${KNOWN_KEYS.join(", ")})`);
+  if ("threshold" in raw) policy.threshold = checkNumber(path, "threshold", raw.threshold, 0, 100);
+  if ("enforce" in raw) {
+    if (typeof raw.enforce !== "boolean") fail(path, `enforce must be true or false, got ${JSON.stringify(raw.enforce)}`);
+    policy.enforce = raw.enforce;
+  }
+  if ("tier" in raw) {
+    if (raw.tier !== 0 && raw.tier !== 1 && raw.tier !== 2) fail(path, `tier must be 0, 1, or 2, got ${JSON.stringify(raw.tier)}`);
+    policy.tier = raw.tier;
+  }
+  if ("floor" in raw) {
+    const floor = raw.floor;
+    if (!isPlainObject(floor)) fail(path, `floor must be a mapping, got ${JSON.stringify(floor)}`);
+    const unknownFloor = Object.keys(floor).filter((k) => !KNOWN_FLOOR_KEYS.includes(k));
+    if (unknownFloor.length > 0) fail(path, `unknown floor key(s): ${unknownFloor.join(", ")} (known: ${KNOWN_FLOOR_KEYS.join(", ")})`);
+    if ("minMutantsExecuted" in floor) {
+      const v = floor.minMutantsExecuted;
+      if (typeof v !== "number" || !Number.isInteger(v) || v < 1) {
+        fail(path, `floor.minMutantsExecuted must be an integer >= 1, got ${JSON.stringify(v)}`);
+      }
+      policy.floor.minMutantsExecuted = v;
+    }
+    if ("maxErrorRate" in floor) policy.floor.maxErrorRate = checkNumber(path, "floor.maxErrorRate", floor.maxErrorRate, 0, 1);
+    if ("minSamplingFraction" in floor) {
+      policy.floor.minSamplingFraction = checkNumber(path, "floor.minSamplingFraction", floor.minSamplingFraction, 0, 1);
+    }
+  }
+  if ("mutation" in raw) {
+    const mu = raw.mutation;
+    if (!isPlainObject(mu)) fail(path, `mutation must be a mapping, got ${JSON.stringify(mu)}`);
+    const unknownMu = Object.keys(mu).filter((k) => !KNOWN_MUTATION_KEYS.includes(k));
+    if (unknownMu.length > 0) fail(path, `unknown mutation key(s): ${unknownMu.join(", ")} (known: ${KNOWN_MUTATION_KEYS.join(", ")})`);
+    if ("maxMutantsPerRun" in mu) {
+      policy.mutation.maxMutantsPerRun = mu.maxMutantsPerRun === null ? null : checkIntRange(path, "mutation.maxMutantsPerRun", mu.maxMutantsPerRun, 1, 1e6);
+    }
+    if ("ignoreStatic" in mu) policy.mutation.ignoreStatic = checkBool(path, "mutation.ignoreStatic", mu.ignoreStatic);
+    if ("recheckRepetitions" in mu) {
+      policy.mutation.recheckRepetitions = mu.recheckRepetitions === null ? null : checkIntRange(path, "mutation.recheckRepetitions", mu.recheckRepetitions, 2, 10);
+    }
+    if ("recheckTimeoutFactorMultiplier" in mu) {
+      policy.mutation.recheckTimeoutFactorMultiplier = mu.recheckTimeoutFactorMultiplier === null ? null : checkNumber(path, "mutation.recheckTimeoutFactorMultiplier", mu.recheckTimeoutFactorMultiplier, 1.01, 20);
+    }
+    if (policy.mutation.recheckRepetitions === null !== (policy.mutation.recheckTimeoutFactorMultiplier === null)) {
+      fail(path, "mutation recheck repetitions and timeout-factor multiplier must be configured together");
+    }
+  }
+  if ("sandbox" in raw) {
+    const sb = raw.sandbox;
+    if (!isPlainObject(sb)) fail(path, `sandbox must be a mapping, got ${JSON.stringify(sb)}`);
+    const unknownSb = Object.keys(sb).filter((k) => !KNOWN_SANDBOX_KEYS.includes(k));
+    if (unknownSb.length > 0) fail(path, `unknown sandbox key(s): ${unknownSb.join(", ")} (known: ${KNOWN_SANDBOX_KEYS.join(", ")})`);
+    if ("envFiles" in sb) {
+      const v = sb.envFiles;
+      if (!Array.isArray(v) || v.some((x) => typeof x !== "string" || x.length === 0)) {
+        fail(path, `sandbox.envFiles must be an array of non-empty strings, got ${JSON.stringify(v)}`);
+      }
+      for (const f of v) {
+        if (f.startsWith("/") || f.split(/[\\/]+/).some((seg) => seg === "..")) {
+          fail(path, `sandbox.envFiles entries must be repo-relative without "..": ${JSON.stringify(f)}`);
+        }
+      }
+      policy.sandbox.envFiles = [...v];
+    }
+  }
+  if ("target" in raw) {
+    const target = raw.target;
+    if (!isPlainObject(target)) fail(path, `target must be a mapping, got ${JSON.stringify(target)}`);
+    checkNestedKeys(path, "target", target, KNOWN_TARGET_KEYS);
+    if ("directory" in target) {
+      const value = target.directory;
+      if (typeof value !== "string" || value.length === 0 || value.startsWith("/") || value.includes("\\") || value.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
+        fail(path, `target.directory must be a normalized repo-relative path, got ${JSON.stringify(value)}`);
+      }
+      policy.target.directory = value;
+    }
+  }
+  if ("environment" in raw) {
+    const environment = raw.environment;
+    if (!isPlainObject(environment)) {
+      fail(path, `environment must be a mapping, got ${JSON.stringify(environment)}`);
+    }
+    checkNestedKeys(path, "environment", environment, KNOWN_ENVIRONMENT_KEYS);
+    if ("runtimeImage" in environment) {
+      const problem = immutableImageProblem(environment.runtimeImage);
+      if (problem) fail(path, `environment.runtimeImage ${problem}`);
+      policy.environment.runtimeImage = environment.runtimeImage;
+    }
+    if ("installDirectory" in environment) {
+      const value = environment.installDirectory;
+      if (typeof value !== "string" || value.length === 0 || value.startsWith("/") || value.includes("\\") || value !== "." && value.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
+        fail(path, `environment.installDirectory must be '.' or a normalized repo-relative path, got ${JSON.stringify(value)}`);
+      }
+      policy.environment.installDirectory = value;
+    }
+    if ("installCommand" in environment) {
+      const problem = preparedTestCommandProblem(environment.installCommand);
+      if (problem) fail(path, `environment.installCommand ${problem}`);
+      policy.environment.installCommand = environment.installCommand.trim();
+    }
+    if ("services" in environment) {
+      if (!Array.isArray(environment.services) || environment.services.length > 2) {
+        fail(path, "environment.services must be an array containing at most PostgreSQL and Redis");
+      }
+      const services = [];
+      for (const [index, service] of environment.services.entries()) {
+        if (!isPlainObject(service)) {
+          fail(path, `environment.services[${index}] must be a mapping`);
+        }
+        checkNestedKeys(path, `environment.services[${index}]`, service, ["kind", "image"]);
+        if (service.kind !== "postgres" && service.kind !== "redis") {
+          fail(path, `environment.services[${index}].kind must be 'postgres' or 'redis'`);
+        }
+        const problem = immutableImageProblem(service.image);
+        if (problem) fail(path, `environment.services[${index}].image ${problem}`);
+        services.push({ kind: service.kind, image: service.image });
+      }
+      if (new Set(services.map((service) => service.kind)).size !== services.length) {
+        fail(path, "environment.services may declare each service kind only once");
+      }
+      policy.environment.services = services.sort((left, right) => left.kind.localeCompare(right.kind));
+    }
+    if ("requiredVariables" in environment) {
+      const values = checkStringArray(
+        path,
+        "environment.requiredVariables",
+        environment.requiredVariables
+      );
+      if (values.length > 64 || values.some((value) => !/^[A-Za-z_][A-Za-z0-9_]{0,127}$/u.test(value))) {
+        fail(
+          path,
+          "environment.requiredVariables must contain at most 64 portable environment-variable names"
+        );
+      }
+      const reserved = values.filter((value) => value.toUpperCase().startsWith("ABLOH_") || value.toUpperCase().startsWith("ATTEST_") || [
+        "ANTHROPIC_API_KEY",
+        "AWS_ACCESS_KEY_ID",
+        "AWS_SECRET_ACCESS_KEY",
+        "AWS_SESSION_TOKEN",
+        "GH_TOKEN",
+        "GITHUB_TOKEN",
+        "OPENAI_API_KEY"
+      ].includes(value.toUpperCase()));
+      if (reserved.length > 0) {
+        fail(path, `environment.requiredVariables contains reserved engine credential name(s): ${reserved.join(", ")}`);
+      }
+      policy.environment.requiredVariables = [...new Set(values)].sort();
+    }
+    if ("identityFiles" in environment) {
+      const values = checkStringArray(path, "environment.identityFiles", environment.identityFiles);
+      if (values.length > 64) {
+        fail(path, "environment.identityFiles must contain at most 64 paths");
+      }
+      for (const value of values) {
+        if (value.length === 0 || value.startsWith("/") || value.includes("\\") || value.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
+          fail(
+            path,
+            `environment.identityFiles entries must be normalized repo-relative paths: ${JSON.stringify(value)}`
+          );
+        }
+      }
+      policy.environment.identityFiles = [...new Set(values)].sort();
+    }
+    if ("setupCommands" in environment) {
+      const values = checkStringArray(path, "environment.setupCommands", environment.setupCommands);
+      if (values.length > 8) {
+        fail(path, "environment.setupCommands must contain at most 8 commands");
+      }
+      for (const value of values) {
+        const problem = preparedTestCommandProblem(value);
+        if (problem) fail(path, `environment.setupCommands entry ${problem}`);
+      }
+      policy.environment.setupCommands = values.map((value) => value.trim());
+    }
+    if ("generatedFiles" in environment) {
+      const values = checkStringArray(path, "environment.generatedFiles", environment.generatedFiles);
+      if (values.length > 128) {
+        fail(path, "environment.generatedFiles must contain at most 128 paths");
+      }
+      for (const value of values) {
+        if (value.length === 0 || value.startsWith("/") || value.includes("\\") || value.split("/").some((segment) => segment === "" || segment === "." || segment === "..")) {
+          fail(
+            path,
+            `environment.generatedFiles entries must be normalized repo-relative paths: ${JSON.stringify(value)}`
+          );
+        }
+      }
+      policy.environment.generatedFiles = [...new Set(values)].sort();
+    }
+    if ("testCommand" in environment) {
+      const problem = preparedTestCommandProblem(environment.testCommand);
+      if (problem) fail(path, `environment.testCommand ${problem}`);
+      policy.environment.testCommand = environment.testCommand.trim();
+    }
+  }
+  if ("diffCoverage" in raw) {
+    const dc = raw.diffCoverage;
+    if (!isPlainObject(dc)) fail(path, `diffCoverage must be a mapping, got ${JSON.stringify(dc)}`);
+    const unknownDc = Object.keys(dc).filter((k) => !KNOWN_DIFF_COVERAGE_KEYS.includes(k));
+    if (unknownDc.length > 0) {
+      fail(path, `unknown diffCoverage key(s): ${unknownDc.join(", ")} (known: ${KNOWN_DIFF_COVERAGE_KEYS.join(", ")})`);
+    }
+    if ("shortCircuit" in dc) {
+      if (typeof dc.shortCircuit !== "boolean") fail(path, `diffCoverage.shortCircuit must be true or false, got ${JSON.stringify(dc.shortCircuit)}`);
+      policy.diffCoverage.shortCircuit = dc.shortCircuit;
+    }
+  }
+  if ("flaky" in raw) {
+    if (raw.flaky !== "quarantine" && raw.flaky !== "strict") {
+      fail(path, `flaky must be "quarantine" or "strict", got ${JSON.stringify(raw.flaky)}`);
+    }
+    policy.flaky = raw.flaky;
+  }
+  if ("flaggedPaths" in raw) policy.flaggedPaths = checkStringArray(path, "flaggedPaths", raw.flaggedPaths);
+  if ("scoreAggregation" in raw) {
+    if (raw.scoreAggregation !== "standalone" && raw.scoreAggregation !== "worst-of-packages") {
+      fail(path, `scoreAggregation must be "standalone" or "worst-of-packages", got ${JSON.stringify(raw.scoreAggregation)}`);
+    }
+    policy.scoreAggregation = raw.scoreAggregation;
+  }
+  if ("approvers" in raw) policy.approvers = checkStringArray(path, "approvers", raw.approvers);
+  if ("classicMutation" in raw) validateClassicMutation(path, raw.classicMutation, policy.classicMutation);
+  if ("patchRevert" in raw) validatePatchRevert(path, raw.patchRevert, policy.patchRevert);
+  if ("research" in raw && RESEARCH_KEY_ALLOWED()) validateResearch(path, raw.research, policy.research);
+  if ("findings" in raw) {
+    const f = raw.findings;
+    if (!isPlainObject(f)) fail(path, `findings must be a mapping, got ${JSON.stringify(f)}`);
+    const unknownF = Object.keys(f).filter((k) => !KNOWN_FINDINGS_KEYS.includes(k));
+    if (unknownF.length > 0) {
+      fail(path, `unknown findings key(s): ${unknownF.join(", ")} (known: ${KNOWN_FINDINGS_KEYS.join(", ")})`);
+    }
+    if ("clustering" in f) {
+      if (!CLUSTER_STRATEGIES.includes(f.clustering)) {
+        fail(path, `findings.clustering must be one of ${CLUSTER_STRATEGIES.join(", ")}, got ${JSON.stringify(f.clustering)}`);
+      }
+      policy.findings.clustering = f.clustering;
+    }
+    if ("naming" in f) {
+      if (typeof f.naming !== "boolean") {
+        fail(path, `findings.naming must be true or false, got ${JSON.stringify(f.naming)}`);
+      }
+      policy.findings.naming = f.naming;
+    }
+  }
+  return policy;
+}
+function loadPolicy(path) {
+  if (!existsSync(path)) return validatePolicy(null, path);
+  let raw;
+  try {
+    raw = parseYaml(readFileSync(path, "utf8"));
+  } catch (err) {
+    throw new Error(`invalid ${path}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return validatePolicy(raw, path);
+}
+
+// src/worst-of.ts
+var GATE_SEVERITY = { pass: 0, fail: 1, "cannot-attest": 2 };
+function deriveWorstOfGate(input) {
+  let worst = {
+    status: input.pooledGate.status,
+    score: input.pooledGate.score,
+    reason: input.pooledGate.reason ?? "pooled gate",
+    directory: null
+  };
+  for (const row of input.rows) {
+    let status;
+    let score = null;
+    let reason;
+    if (row.l0State === "cannot-attest" || row.mutationState === "cannot-attest") {
+      status = "cannot-attest";
+      reason = `package ${row.directory}: evidence could not be attested`;
+    } else if (!row.scoreable) {
+      continue;
+    } else {
+      const scores = computeScores({
+        counts: row.mutationCounts,
+        confirmedEquivalent: row.confirmedEquivalent,
+        tier: input.tier
+      });
+      score = input.useTriagedBasis && scores.triagedScore !== null ? scores.triagedScore : scores.rawScore;
+      const l0Fails = row.l0Counts !== null && row.l0Counts.uncovered + row.l0Counts.notInstrumented > 0;
+      if (l0Fails) {
+        status = "fail";
+        reason = `package ${row.directory}: ${row.l0Counts.uncovered + row.l0Counts.notInstrumented} changed line(s) unexecuted`;
+      } else if (score !== null && score < input.threshold) {
+        status = "fail";
+        reason = `package ${row.directory}: score ${score}% below threshold ${input.threshold}%`;
+      } else {
+        status = "pass";
+        reason = `package ${row.directory}: passed`;
+      }
+    }
+    if (GATE_SEVERITY[status] > GATE_SEVERITY[worst.status]) {
+      worst = { status, score, reason, directory: row.directory };
+    }
+  }
+  return {
+    gate: {
+      status: worst.status,
+      score: worst.score,
+      threshold: input.threshold,
+      reason: worst.reason
+    },
+    decisivePackage: worst.directory
+  };
+}
+
+// src/base64.ts
+function isCanonicalBase64(value) {
+  if (value.length % 4 !== 0) return false;
+  let padding = 0;
+  while (padding < 2 && padding < value.length && value.charCodeAt(value.length - 1 - padding) === 61) {
+    padding += 1;
+  }
+  const body = value.length - padding;
+  for (let index = 0; index < body; index += 1) {
+    const code = value.charCodeAt(index);
+    const alphabet = code >= 65 && code <= 90 || // A-Z
+    code >= 97 && code <= 122 || // a-z
+    code >= 48 && code <= 57 || // 0-9
+    code === 43 || // +
+    code === 47;
+    if (!alphabet) return false;
+  }
+  return true;
+}
+
+// src/findings.ts
+var TRIAGE_REASON_CODES = [
+  "EQUIVALENT_NO_OBSERVABLE_EFFECT",
+  "EQUIVALENT_DEAD_BRANCH",
+  "EQUIVALENT_REDUNDANT_CONDITION",
+  "GAP_MISSING_ASSERTION",
+  "GAP_UNCOVERED_BRANCH",
+  "GAP_BOUNDARY_UNTESTED",
+  "GAP_ERROR_PATH_UNTESTED",
+  "UNCLEAR_NEEDS_HUMAN"
+];
+var MECHANICAL_ERROR_PATH_REASON = "GAP_ERROR_PATH_UNTESTED";
+var REASON_GLOSS = {
+  /* Each value is a COMPLETE headline, not a fragment: it is used as the leading
+     clause of the finding title, so "No test checks this — the boundary case is not
+     tested" (two ways of saying the same thing) is the failure mode to avoid. */
+  GAP_MISSING_ASSERTION: "No test asserts on the result",
+  GAP_UNCOVERED_BRANCH: "No test exercises this branch",
+  GAP_BOUNDARY_UNTESTED: "No test covers the boundary case",
+  GAP_ERROR_PATH_UNTESTED: "No test drives this error path",
+  UNCLEAR_NEEDS_HUMAN: "Needs a human look",
+  /* The equivalent codes are reasons a survivor is NOT a gap, so they must not read
+     as a missing test. Rendered so a customer reviewing an override sees the stated
+     reason in English. */
+  EQUIVALENT_NO_OBSERVABLE_EFFECT: "Likely equivalent \u2014 no observable effect",
+  EQUIVALENT_DEAD_BRANCH: "Likely equivalent \u2014 the branch cannot be reached",
+  EQUIVALENT_REDUNDANT_CONDITION: "Likely equivalent \u2014 the condition is redundant"
+};
+var MUTATOR_GLOSS = {
+  ArithmeticOperator: "swapped an arithmetic operator (e.g. + to -)",
+  ArrayDeclaration: "emptied an array literal",
+  AssignmentOperator: "swapped a compound assignment (e.g. += to -=)",
+  BlockStatement: "removed an entire block body",
+  BooleanLiteral: "inverted a boolean",
+  ConditionalExpression: "forced a branch condition to a constant",
+  EqualityOperator: "moved a comparison boundary (e.g. < to <=)",
+  LogicalOperator: "swapped && and ||",
+  MethodExpression: "dropped or replaced a method call",
+  ObjectLiteral: "emptied an object literal",
+  OptionalChaining: "toggled optional chaining",
+  Regex: "altered a regular expression",
+  StringLiteral: "changed a string literal",
+  UnaryOperator: "flipped a unary operator (e.g. +x to -x)",
+  UpdateOperator: "flipped an increment/decrement",
+  ArrowFunction: "replaced an arrow-function body with undefined",
+  ReturnValue: "replaced a return value with a plausible wrong value",
+  GuardRemoval: "deleted a whole guard clause",
+  ThrowRemoval: "deleted a throw statement"
+};
+var MAX_FINDING_DESCRIPTION_LEN = 200;
+var CODE_SYNTAX = /[`{}]|=>|::/u;
+var PRINTABLE_ASCII = /^[\x20-\x7E]*$/u;
+var ENGLISH_APOSTROPHE = /(?<=[A-Za-z])'(?=[A-Za-z])|(?<=s)'(?![A-Za-z])/gu;
+var ANY_QUOTE = /["']/u;
+function normalizePunctuation(text) {
+  return text.replace(/[\u2010-\u2015]/gu, "-").replace(/[\u2018\u2019\u201A\u201B]/gu, "'").replace(/[\u201C-\u201F]/gu, '"').replace(/\u2026/gu, "...").replace(/[\u00A0\u2007\u202F]/gu, " ");
+}
+function sanitizeFindingDescription(raw) {
+  if (typeof raw !== "string") return null;
+  const text = normalizePunctuation(raw.trim().replace(/\s+/gu, " "));
+  if (text.length === 0 || text.length > MAX_FINDING_DESCRIPTION_LEN) return null;
+  if (!PRINTABLE_ASCII.test(text)) return null;
+  if (CODE_SYNTAX.test(text)) return null;
+  if (ANY_QUOTE.test(text.replace(ENGLISH_APOSTROPHE, ""))) return null;
+  return text;
+}
+function describeMutationEvidence(mutator, status, location) {
+  const file = location && typeof location.file === "string" ? location.file : null;
+  const line = location && typeof location.startLine === "number" ? `:${location.startLine}` : "";
+  const at = file ? ` at ${file}${line}` : "";
+  if (status === "no-coverage") {
+    return `Nothing in your suite executes this line${at}, so no mutation could be measured here.`;
+  }
+  const known = typeof mutator === "string" ? MUTATOR_GLOSS[mutator] : void 0;
+  if (known) return `We ${known}${at} and every test still passed.`;
+  const named = typeof mutator === "string" && mutator.length > 0 ? mutator : "a mutation";
+  return `We planted ${named}${at} and every test still passed.`;
+}
+function describeReasonCode(code) {
+  if (typeof code !== "string" || code.length === 0) return null;
+  return REASON_GLOSS[code] ?? code;
+}
+function describeFinding(finding) {
+  const triage = finding.triage && typeof finding.triage === "object" ? finding.triage : null;
+  const sentence = sanitizeFindingDescription(triage?.description);
+  if (sentence) return sentence;
+  if (finding.status === "no-coverage") return "No test runs this line";
+  const rawCode = triage ? triage.reasonCode : null;
+  return describeReasonCode(typeof rawCode === "string" ? rawCode : null) ?? "No test checks this line";
+}
+function mechanicalErrorPathDisposition() {
+  return { verdict: "real-gap", reasonCode: MECHANICAL_ERROR_PATH_REASON, confidence: 1, mechanical: true };
+}
+var FINDING_SEVERITIES = ["low", "medium", "high", "critical"];
+var SEVERITY_BY_REASON = {
+  /* Nothing exercises the failure path. The one people find in production. */
+  GAP_ERROR_PATH_UNTESTED: 3,
+  /* A whole branch never runs, so every behaviour behind it is unmeasured. */
+  GAP_UNCOVERED_BRANCH: 2,
+  /* The path runs, but only in the middle of its range — off-by-ones live here. */
+  GAP_BOUNDARY_UNTESTED: 2,
+  /* The code ran and the test watched it happen without checking the result. */
+  GAP_MISSING_ASSERTION: 1,
+  /* The classifier declined to call it. A person has to look; that is not the same as urgent. */
+  UNCLEAR_NEEDS_HUMAN: 1,
+  /* Only reachable when a customer has overridden an equivalence verdict — it is on the list
+     because they put it there, so it is listed, quietly. */
+  EQUIVALENT_NO_OBSERVABLE_EFFECT: 0,
+  EQUIVALENT_DEAD_BRANCH: 0,
+  EQUIVALENT_REDUNDANT_CONDITION: 0
+};
+var UNSURE_BELOW = 0.5;
+function findingSeverity(finding) {
+  const reasonCode = typeof finding.triage?.reasonCode === "string" ? finding.triage.reasonCode : null;
+  const confidence = typeof finding.triage?.confidence === "number" && Number.isFinite(finding.triage.confidence) ? finding.triage.confidence : null;
+  let score = reasonCode === null ? 1 : SEVERITY_BY_REASON[reasonCode] ?? 1;
+  if (finding.status === "no-coverage" || finding.coveredBy === 0) score += 1;
+  if (confidence !== null && confidence < UNSURE_BELOW) score -= 1;
+  const clamped = Math.max(0, Math.min(FINDING_SEVERITIES.length - 1, score));
+  return FINDING_SEVERITIES[clamped];
+}
+function findingKind(finding) {
+  const reasonCode = typeof finding.triage?.reasonCode === "string" ? finding.triage.reasonCode : null;
+  if (reasonCode === MECHANICAL_ERROR_PATH_REASON) return "error-handler";
+  return finding.status === "no-coverage" ? "uncovered-line" : "surviving-mutant";
+}
+function isConfirmedEquivalent(t) {
+  return !!t && !t.mechanical && t.verdict === "likely-equivalent" && !t.overridden;
+}
+function redactTriageForEgress(t) {
+  const { rationale: _rationale, ...rest } = t;
+  return rest;
+}
+var MUTATOR_TOKEN_RE = /^[A-Za-z][A-Za-z0-9_]{0,63}$/u;
+function groupFindingsByLine(findings) {
+  const groups = /* @__PURE__ */ new Map();
+  const reasonTallies = /* @__PURE__ */ new Map();
+  const soleDescription = /* @__PURE__ */ new Map();
+  const reasonDescription = /* @__PURE__ */ new Map();
+  for (const f of findings) {
+    if (typeof f.file !== "string" || typeof f.startLine !== "number") continue;
+    const endLine = typeof f.endLine === "number" ? f.endLine : f.startLine;
+    const key = `${f.file} ${f.startLine} ${endLine}`;
+    const mutator = typeof f.mutator === "string" && MUTATOR_TOKEN_RE.test(f.mutator) ? f.mutator : null;
+    const rawCode = f.triage && typeof f.triage === "object" ? f.triage.reasonCode : null;
+    const reasonCode = typeof rawCode === "string" && MUTATOR_TOKEN_RE.test(rawCode) ? rawCode : null;
+    const group = groups.get(key);
+    if (group) {
+      group.count += 1;
+      if (mutator) group.mutators.push(mutator);
+    } else {
+      groups.set(key, {
+        first: typeof f.mutantId === "string" ? f.mutantId : String(groups.size),
+        file: f.file,
+        startLine: f.startLine,
+        endLine,
+        mutators: mutator ? [mutator] : [],
+        count: 1,
+        reasons: []
+      });
+    }
+    const sentence = sanitizeFindingDescription(
+      f.triage && typeof f.triage === "object" ? f.triage.description : null
+    );
+    if (reasonCode) {
+      const tally = reasonTallies.get(key) ?? /* @__PURE__ */ new Map();
+      tally.set(reasonCode, (tally.get(reasonCode) ?? 0) + 1);
+      reasonTallies.set(key, tally);
+      const reasonKey = `${key}\0${reasonCode}`;
+      if (sentence && !reasonDescription.has(reasonKey)) {
+        reasonDescription.set(reasonKey, sentence);
+      }
+    }
+    if (!group && sentence) soleDescription.set(key, sentence);
+  }
+  for (const [key, group] of groups) {
+    group.reasons = [...reasonTallies.get(key) ?? /* @__PURE__ */ new Map()].sort(([an, ac], [bn, bc]) => bc - ac || an.localeCompare(bn)).map(([code, count]) => {
+      const description = reasonDescription.get(`${key}\0${code}`);
+      return description ? { code, count, description } : { code, count };
+    });
+    const sentence = soleDescription.get(key);
+    if (group.count === 1 && sentence) group.description = sentence;
+  }
+  return [...groups.values()];
+}
+function toGapFindings(mutants) {
+  return mutants.filter((m) => m.status === "survived" || m.status === "no-coverage").map((m) => ({
+    mutantId: m.id,
+    file: m.file,
+    startLine: m.startLine,
+    endLine: m.endLine,
+    mutator: m.mutator,
+    replacement: m.replacement,
+    status: m.status,
+    coveredBy: m.coveredBy,
+    // carried through, not dropped: absent on the Python engine and on historical artifacts,
+    // where clustering degrades to the line key and says so rather than guessing a span
+    ...m.startColumn !== void 0 ? { startColumn: m.startColumn } : {},
+    ...m.endColumn !== void 0 ? { endColumn: m.endColumn } : {},
+    ...m.originalText !== void 0 ? { originalText: m.originalText } : {}
+  }));
+}
+
+// src/gap-identity.ts
+function gapKeys(gaps) {
+  const ordered = gaps.map((gap, index) => ({ gap, index })).sort(
+    (a, b) => a.gap.file !== b.gap.file ? a.gap.file < b.gap.file ? -1 : 1 : a.gap.mutator !== b.gap.mutator ? a.gap.mutator < b.gap.mutator ? -1 : 1 : a.gap.startLine !== b.gap.startLine ? a.gap.startLine - b.gap.startLine : (
+      /* Same file, same mutator, same line: two mutants of one kind on one line. Their
+         relative order is arbitrary but must be DETERMINISTIC, so fall back to the order
+         they arrived in rather than leaving it to the sort's stability guarantees. */
+      a.index - b.index
+    )
+  );
+  const seen = /* @__PURE__ */ new Map();
+  const keys = new Array(gaps.length);
+  for (const { gap, index } of ordered) {
+    const bucket = JSON.stringify([gap.file, gap.mutator]);
+    const ordinal = seen.get(bucket) ?? 0;
+    seen.set(bucket, ordinal + 1);
+    keys[index] = JSON.stringify([gap.file, gap.mutator, ordinal]);
+  }
+  return keys;
+}
+
+// src/operators.ts
+var STRUCTURAL = /* @__PURE__ */ new Set([
+  "BlockStatement",
+  // removes an entire statement-block body
+  "ConditionalExpression",
+  // forces a guard/branch to true|false
+  "MethodExpression",
+  // drops a method call (e.g. .trim(), .filter())
+  "ArrayDeclaration",
+  // empties an array literal → []
+  "ObjectLiteral",
+  // empties an object literal → {}
+  "ArrowFunction",
+  // replaces an arrow body with undefined
+  "OptionalChaining"
+  // toggles optional chaining
+]);
+var CUSTOM = /* @__PURE__ */ new Set([
+  "ReturnValue",
+  // replace a return value with a type-plausible wrong value
+  "GuardRemoval",
+  // delete a whole `if (cond) return/throw ...` guard
+  "ThrowRemoval"
+  // delete a `throw ...;` statement
+]);
+function operatorClass(mutator) {
+  if (CUSTOM.has(mutator)) return "custom";
+  if (STRUCTURAL.has(mutator)) return "structural";
+  return "operator";
+}
+function operatorClassBreakdown(mutators) {
+  const out = { structural: 0, operator: 0, custom: 0 };
+  for (const m of mutators) out[operatorClass(m)]++;
+  return out;
+}
+function operatorClassSummary(mutators) {
+  const b = operatorClassBreakdown(mutators);
+  const parts = [];
+  if (b.structural) parts.push(`${b.structural} structural`);
+  if (b.custom) parts.push(`${b.custom} custom`);
+  if (b.operator) parts.push(`${b.operator} operator`);
+  return parts.length ? parts.join(", ") : "none";
+}
+
+// src/classic-mutation-gate.ts
+function applyLayer1Gate(input) {
+  const { baseGate } = input;
+  if (baseGate.status === "cannot-attest") return baseGate;
+  const reasons = [];
+  if (input.failOnUntested && input.untestedHandlerMutantCount > 0) {
+    reasons.push(`${input.untestedHandlerMutantCount} untested changed error-handler mutant(s)`);
+  }
+  if (input.failOnAntiPattern && input.antiPatternCount > 0) {
+    reasons.push(`${input.antiPatternCount} error-handler anti-pattern(s)`);
+  }
+  if (reasons.length === 0) return baseGate;
+  return {
+    ...baseGate,
+    status: "fail",
+    reason: `${baseGate.reason ? baseGate.reason + "; " : ""}error-path policy: ${reasons.join(", ")}`
+  };
+}
+
+// src/test-findings.ts
+import { createHash as createHash2 } from "crypto";
+var USABLE = /* @__PURE__ */ new Set(["killed", "timeout", "survived", "no-coverage"]);
+function digest2(parts) {
+  const h = createHash2("sha256");
+  for (const p of parts) h.update(p + "\n");
+  return h.digest("hex");
+}
+function analyzeTestFindings(input) {
+  const { flakyTests, attributionComplete } = input;
+  const covered = /* @__PURE__ */ new Map();
+  const credited = /* @__PURE__ */ new Map();
+  const ensure = (map, key) => {
+    let s = map.get(key);
+    if (!s) {
+      s = /* @__PURE__ */ new Set();
+      map.set(key, s);
+    }
+    return s;
+  };
+  for (const m of input.mutants) {
+    if (!USABLE.has(m.status)) continue;
+    for (const t of m.coveredByTests ?? []) {
+      if (flakyTests.has(t)) continue;
+      ensure(covered, t).add(m.id);
+    }
+    if (m.status === "killed" || m.status === "timeout") {
+      for (const t of m.killedByTests ?? []) {
+        if (flakyTests.has(t)) continue;
+        ensure(credited, t).add(m.id);
+      }
+    }
+  }
+  const verdicts = [];
+  const unassessed = [];
+  for (const [test, coveredSet] of covered) {
+    const creditedSet = credited.get(test);
+    const creditedCount = creditedSet ? creditedSet.size : 0;
+    if (coveredSet.size === 0 || creditedCount > 0) continue;
+    if (!attributionComplete) {
+      unassessed.push(test);
+      continue;
+    }
+    verdicts.push({ test, kind: "asserts-nothing", coveredCount: coveredSet.size, creditedKillCount: 0 });
+  }
+  if (attributionComplete) {
+    const groups = /* @__PURE__ */ new Map();
+    const fingerprints = /* @__PURE__ */ new Map();
+    for (const [test, coveredSet] of covered) {
+      if (coveredSet.size === 0) continue;
+      const creditedSet = credited.get(test) ?? /* @__PURE__ */ new Set();
+      const coveredSorted = [...coveredSet].sort();
+      const killedSorted = [...creditedSet].sort();
+      const key = digest2(["cov", ...coveredSorted, "kill", ...killedSorted]);
+      (groups.get(key) ?? groups.set(key, []).get(key)).push(test);
+      fingerprints.set(key, { covered: coveredSorted, killed: killedSorted });
+    }
+    for (const [key, members] of groups) {
+      if (members.length < 2) continue;
+      const fp = fingerprints.get(key);
+      for (const test of members) {
+        verdicts.push({
+          test,
+          kind: "duplicate-effectiveness",
+          coveredCount: fp.covered.length,
+          creditedKillCount: fp.killed.length,
+          duplicateGroupDigest: key
+        });
+      }
+    }
+  }
+  verdicts.sort((a, b) => a.kind < b.kind ? -1 : a.kind > b.kind ? 1 : a.test < b.test ? -1 : a.test > b.test ? 1 : 0);
+  unassessed.sort();
+  return { verdicts, unassessed, attribution: attributionComplete ? "complete" : "partial" };
+}
+function testIdentityDigest(canonical3) {
+  return createHash2("sha256").update(canonical3).digest("hex");
+}
+
+// src/scenario-search.ts
+var SCENARIO_LANES = ["property", "value", "state", "failure"];
+var SCENARIO_AUTHORITIES = [
+  "machine-sourced",
+  "source-grounded",
+  "corroborated",
+  "code-inferred"
+];
+var SCENARIO_OUTCOMES = [
+  "confirmed-counterexample",
+  "candidate-counterexample",
+  "no-counterexample-found",
+  "scenario-uncovered",
+  "disagreement",
+  "inconclusive",
+  "not-applicable"
+];
+var SCENARIO_SEARCH_STATES = [
+  "completed",
+  "partial",
+  "unavailable",
+  "disabled",
+  "disabled-by-tier",
+  "not-run"
+];
+var SCENARIO_SOURCE_KINDS = [
+  "contract",
+  "schema",
+  "documentation",
+  "ticket",
+  "test",
+  "type",
+  "example",
+  "code",
+  "trace"
+];
+var SCENARIO_SOURCE_INDEPENDENCE = [
+  "independent",
+  "derived-from-target",
+  "unknown"
+];
+var HEX_64 = /^[a-f0-9]{64}$/;
+var MAX_IDENTITY_LENGTH = 200;
+function enumGuard(values, value) {
+  return typeof value === "string" && values.includes(value);
+}
+function isScenarioLane(value) {
+  return enumGuard(SCENARIO_LANES, value);
+}
+function isScenarioAuthority(value) {
+  return enumGuard(SCENARIO_AUTHORITIES, value);
+}
+function isScenarioOutcome(value) {
+  return enumGuard(SCENARIO_OUTCOMES, value);
+}
+function isScenarioSearchState(value) {
+  return enumGuard(SCENARIO_SEARCH_STATES, value);
+}
+function assertNonNegativeInteger(name, value) {
+  if (!Number.isInteger(value) || value < 0) {
+    throw new Error(`${name} must be a non-negative integer`);
+  }
+}
+function assertIdentity(name, value) {
+  if (value.length === 0 || value.length > MAX_IDENTITY_LENGTH || /[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(`${name} must be a bounded printable identity`);
+  }
+}
+function assertDigest(name, value) {
+  if (!HEX_64.test(value)) throw new Error(`${name} must be a lowercase 64-hex sha256`);
+}
+function emptyRecord(keys) {
+  return Object.fromEntries(keys.map((key) => [key, 0]));
+}
+function sanitizeScenarioSummary(input) {
+  if (!isScenarioLane(input.lane)) throw new Error("scenario summary has an unknown lane");
+  if (!isScenarioAuthority(input.authority)) {
+    throw new Error("scenario summary has an unknown authority");
+  }
+  if (!isScenarioOutcome(input.outcome)) throw new Error("scenario summary has an unknown outcome");
+  for (const [name, value] of [
+    ["scenarioId", input.scenarioId],
+    ["targetDigest", input.targetDigest],
+    ["intentDigest", input.intentDigest],
+    ["sourceSetDigest", input.sourceSetDigest],
+    ["containerDigest", input.containerDigest]
+  ]) {
+    assertDigest(name, value);
+  }
+  for (const [name, value] of [
+    ["runner", input.runner],
+    ["intentPromptVersion", input.intentPromptVersion],
+    ["testPromptVersion", input.testPromptVersion],
+    ["toolVersion", input.toolVersion]
+  ]) {
+    assertIdentity(name, value);
+  }
+  if (input.model !== null) assertIdentity("model", input.model);
+  assertNonNegativeInteger("runs", input.runs);
+  if (input.replayed !== void 0) assertNonNegativeInteger("replayed", input.replayed);
+  const replayedCounterexample = input.outcome === "confirmed-counterexample" || input.outcome === "candidate-counterexample";
+  if (replayedCounterexample) {
+    if (input.runs === 0 || (input.replayed ?? 0) === 0) {
+      throw new Error("a counterexample requires an executed search and a plain replay");
+    }
+    if (!input.targetExecuted || !input.assertionExecuted) {
+      throw new Error("a counterexample requires both target and assertion execution");
+    }
+  }
+  if (input.outcome === "confirmed-counterexample" && input.authority !== "machine-sourced" && input.authority !== "source-grounded") {
+    throw new Error("a confirmed counterexample requires sourced authority");
+  }
+  if (input.outcome === "candidate-counterexample" && input.authority !== "corroborated" && input.authority !== "code-inferred") {
+    throw new Error("a candidate counterexample requires corroborated or code-inferred authority");
+  }
+  if (input.outcome === "no-counterexample-found") {
+    if (input.runs === 0 || !input.targetExecuted || !input.assertionExecuted) {
+      throw new Error("no-counterexample-found requires an executed target and assertion");
+    }
+  }
+  return {
+    scenarioId: input.scenarioId,
+    lane: input.lane,
+    authority: input.authority,
+    outcome: input.outcome,
+    targetDigest: input.targetDigest,
+    intentDigest: input.intentDigest,
+    sourceSetDigest: input.sourceSetDigest,
+    runs: input.runs,
+    ...input.replayed === void 0 ? {} : { replayed: input.replayed },
+    targetExecuted: input.targetExecuted,
+    assertionExecuted: input.assertionExecuted,
+    runner: input.runner,
+    model: input.model,
+    intentPromptVersion: input.intentPromptVersion,
+    testPromptVersion: input.testPromptVersion,
+    toolVersion: input.toolVersion,
+    containerDigest: input.containerDigest
+  };
+}
+function deriveScenarioSearchCounts(selectedTargets, inputSummaries) {
+  assertNonNegativeInteger("selectedTargets", selectedTargets);
+  const summaries = inputSummaries.map(sanitizeScenarioSummary);
+  if (summaries.length > selectedTargets) {
+    throw new Error("measured scenario summaries cannot exceed selected targets");
+  }
+  const ids = new Set(summaries.map((summary) => summary.scenarioId));
+  if (ids.size !== summaries.length) throw new Error("scenario summary ids must be unique");
+  const byOutcome = emptyRecord(SCENARIO_OUTCOMES);
+  const byLane = emptyRecord(SCENARIO_LANES);
+  const byAuthority = emptyRecord(SCENARIO_AUTHORITIES);
+  for (const summary of summaries) {
+    byOutcome[summary.outcome] += 1;
+    byLane[summary.lane] += 1;
+    byAuthority[summary.authority] += 1;
+  }
+  return {
+    counts: {
+      selectedTargets,
+      measuredTargets: summaries.length,
+      unmeasuredTargets: selectedTargets - summaries.length,
+      byOutcome,
+      byLane,
+      byAuthority
+    },
+    summaries
+  };
+}
+function buildScenarioSearchBlock(input) {
+  for (const [name, value] of [
+    ["policyDigest", input.policyDigest],
+    ["evidencePackDigest", input.evidencePackDigest],
+    ["proofsDigest", input.proofsDigest],
+    ["containerImageDigest", input.containerImageDigest]
+  ]) {
+    assertDigest(name, value);
+  }
+  for (const [name, value] of [
+    ["engineVersion", input.engineVersion],
+    ["runnerAdapterVersion", input.runnerAdapterVersion],
+    ["toolProtocolVersion", input.toolProtocolVersion]
+  ]) {
+    assertIdentity(name, value);
+  }
+  for (const model of input.models) assertIdentity("model", model);
+  for (const [name, value] of [
+    ["llmCalls", input.llmCalls],
+    ["cacheHits", input.cacheHits],
+    ["inputTokens", input.inputTokens],
+    ["outputTokens", input.outputTokens],
+    ["wallMs", input.wallMs]
+  ]) {
+    assertNonNegativeInteger(name, value);
+  }
+  if (input.reasoningTokens !== null) {
+    assertNonNegativeInteger("reasoningTokens", input.reasoningTokens);
+  }
+  if (input.costUsd !== null && (!Number.isFinite(input.costUsd) || input.costUsd < 0)) {
+    throw new Error("costUsd must be null or a non-negative finite number");
+  }
+  if (input.restrictions.containerRequired !== true || input.restrictions.network !== "none" || input.restrictions.credentials !== "none" || input.restrictions.productionWrites !== "denied") {
+    throw new Error("scenario search restrictions may not be weakened");
+  }
+  const { counts, summaries } = deriveScenarioSearchCounts(
+    input.selectedTargets,
+    input.summaries
+  );
+  return {
+    state: counts.unmeasuredTargets === 0 ? "completed" : "partial",
+    engineVersion: input.engineVersion,
+    policyDigest: input.policyDigest,
+    evidencePackDigest: input.evidencePackDigest,
+    proofsDigest: input.proofsDigest,
+    containerImageDigest: input.containerImageDigest,
+    runnerAdapterVersion: input.runnerAdapterVersion,
+    toolProtocolVersion: input.toolProtocolVersion,
+    models: [...input.models],
+    llmCalls: input.llmCalls,
+    cacheHits: input.cacheHits,
+    inputTokens: input.inputTokens,
+    outputTokens: input.outputTokens,
+    reasoningTokens: input.reasoningTokens,
+    costUsd: input.costUsd,
+    wallMs: input.wallMs,
+    restrictions: {
+      containerRequired: true,
+      network: "none",
+      credentials: "none",
+      productionWrites: "denied"
+    },
+    counts,
+    summaries
+  };
+}
+
+// src/ci-property-ranking.ts
+import { createHash as createHash3 } from "crypto";
+var FAMILIES_BY_MUTATOR = {
+  // Value and arithmetic flips: a quantity comes out wrong, so ask what the quantity conserves.
+  ArithmeticOperator: ["conservation", "monotonicity"],
+  AssignmentOperator: ["conservation", "monotonicity"],
+  UnaryOperator: ["monotonicity", "conservation"],
+  UpdateOperator: ["monotonicity", "conservation"],
+  // Branch and guard flips: a decision goes the wrong way at some input, so ask where the
+  // accept/reject line sits.
+  BooleanLiteral: ["acceptance-boundary"],
+  ConditionalExpression: ["acceptance-boundary", "error-containment"],
+  EqualityOperator: ["acceptance-boundary", "monotonicity"],
+  LogicalOperator: ["acceptance-boundary"],
+  GuardRemoval: ["acceptance-boundary", "error-containment"],
+  // Text and pattern flips: what changes is a representation, not a decision.
+  Regex: ["normalization-equivalence", "acceptance-boundary"],
+  StringLiteral: ["normalization-equivalence", "serialization-preservation"],
+  // Dropped calls and emptied literals: something the code builds up is lost.
+  MethodExpression: ["normalization-equivalence", "idempotence", "order-preservation"],
+  ArrayDeclaration: ["conservation", "order-preservation", "partition-recombine"],
+  ObjectLiteral: ["serialization-preservation", "round-trip"],
+  ReturnValue: ["round-trip", "representation-boundary"],
+  // Whole constructs removed: the alarming ones. Effects show up as state left behind.
+  BlockStatement: ["state-transition", "non-mutation", "resource-lifecycle"],
+  ArrowFunction: ["state-transition", "round-trip"],
+  OptionalChaining: ["error-containment"],
+  ThrowRemoval: ["error-containment", "recovery-continuity"]
+};
+function signalText(value, limit) {
+  return value.replace(/\s+/gu, " ").trim().slice(0, limit);
+}
+function survivingMutantObligationSignals(entries) {
+  const signals = [];
+  for (const entry of entries) {
+    if (entry.state !== "open" || entry.mutantIdentity === void 0) continue;
+    const parts = entry.mutantIdentity.split("\0");
+    const mutator = parts[5];
+    if (mutator === void 0) continue;
+    const families = FAMILIES_BY_MUTATOR[mutator];
+    if (families === void 0 || families.length === 0) continue;
+    const siteLine = Number(parts[1]);
+    const startLine = Number.isInteger(siteLine) && siteLine >= 1 ? siteLine : entry.changedRange.startLine;
+    const siteEnd = Number(parts[2]);
+    const endLine = Number.isInteger(siteEnd) && siteEnd >= startLine ? siteEnd : startLine;
+    signals.push({
+      // One signal per mutant, aimed at the FIRST family — the map orders each operator's
+      // families by fit, and one aimed signal beats three diluted ones under the 24-signal cap.
+      family: families[0],
+      trigger: signalText(
+        `a ${mutator} mutation at this location survived the repository's own test suite, so its behaviour there is not pinned by any existing test`,
+        200
+      ),
+      authority: "mechanical-risk",
+      path: entry.targetPath,
+      startLine,
+      endLine,
+      targetSymbols: [signalText(entry.targetSymbol, 500)],
+      searchTerms: [signalText(entry.targetSymbol, 100), signalText(mutator, 100)],
+      // Survival outranks static analysis. A surviving mutant is a DEMONSTRATED behaviour delta
+      // the suite cannot see; a structural hint is a guess that one might exist there — yet
+      // structural families claim strength 3 while operator-class mutants claimed 2, so the
+      // proven signal sorted below the guesses and could be evicted by the 24-signal cap.
+      strength: 3,
+      mutator: signalText(mutator, 100)
+    });
+  }
+  return signals.sort(
+    (left, right) => right.strength - left.strength || left.path.localeCompare(right.path) || left.startLine - right.startLine
+  );
+}
+function ciPropertyMutatorFamilies(mutantIdentity2) {
+  if (mutantIdentity2 === void 0) return [];
+  const mutator = mutantIdentity2.split("\0")[5];
+  return mutator === void 0 ? [] : FAMILIES_BY_MUTATOR[mutator] ?? [];
+}
+var HEX643 = /^[a-f0-9]{64}$/;
+function sha2562(value) {
+  return createHash3("sha256").update(value, "utf8").digest("hex");
+}
+function canonical2(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical2).join(",")}]`;
+  if (value && typeof value === "object") {
+    return `{${Object.entries(value).filter(([, item]) => item !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, item]) => `${JSON.stringify(key)}:${canonical2(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function mergeTargetCandidates(classicMutation, sourced) {
+  if (classicMutation.path !== sourced.path || classicMutation.symbol !== sourced.symbol || classicMutation.changeKind !== sourced.changeKind) {
+    throw new Error(
+      `conflicting CI property target identity '${classicMutation.targetDigest}'`
+    );
+  }
+  return {
+    ...classicMutation,
+    runnerSupported: classicMutation.runnerSupported && sourced.runnerSupported,
+    hasIndependentEvidence: classicMutation.hasIndependentEvidence || sourced.hasIndependentEvidence,
+    publiclyReachable: classicMutation.publiclyReachable && sourced.publiclyReachable,
+    excludedChange: classicMutation.excludedChange || sourced.excludedChange,
+    generatedOrBinary: classicMutation.generatedOrBinary || sourced.generatedOrBinary,
+    requiresForbiddenExternalResource: classicMutation.requiresForbiddenExternalResource || sourced.requiresForbiddenExternalResource,
+    sourceConflict: classicMutation.sourceConflict || sourced.sourceConflict,
+    allKnownLayer1GapsClosed: classicMutation.allKnownLayer1GapsClosed || sourced.allKnownLayer1GapsClosed,
+    sourceIntroducesDifferentRule: classicMutation.sourceIntroducesDifferentRule || sourced.sourceIntroducesDifferentRule,
+    openLayer1Residuals: Math.max(
+      classicMutation.openLayer1Residuals,
+      sourced.openLayer1Residuals
+    ),
+    mutationSiteAbsent: classicMutation.mutationSiteAbsent || sourced.mutationSiteAbsent,
+    changedBranchHasDirectTest: classicMutation.changedBranchHasDirectTest || sourced.changedBranchHasDirectTest,
+    supportedPropertyFamilies: Math.max(
+      classicMutation.supportedPropertyFamilies,
+      sourced.supportedPropertyFamilies
+    ),
+    estimatedSetupCost: Math.max(
+      classicMutation.estimatedSetupCost,
+      sourced.estimatedSetupCost
+    )
+  };
+}
+function buildCiPropertyTargetUniverse(input) {
+  const universe = /* @__PURE__ */ new Map();
+  const add = (target, source) => {
+    const existing = universe.get(target.targetDigest);
+    if (existing === void 0) {
+      universe.set(target.targetDigest, target);
+      return;
+    }
+    if (source === "classicMutation") {
+      throw new Error(`duplicate Layer 1 CI property target '${target.targetDigest}'`);
+    }
+    universe.set(target.targetDigest, mergeTargetCandidates(existing, target));
+  };
+  for (const target of input.layer1Targets) add(target, "classicMutation");
+  const sourced = /* @__PURE__ */ new Set();
+  for (const target of input.sourceTargets) {
+    if (sourced.has(target.targetDigest)) {
+      throw new Error(
+        `duplicate independently sourced CI property target '${target.targetDigest}'`
+      );
+    }
+    sourced.add(target.targetDigest);
+    add(target, "independent-source");
+  }
+  return [...universe.values()].sort(
+    (left, right) => left.targetDigest.localeCompare(right.targetDigest)
+  );
+}
+function targetRejections(target) {
+  const reasons = [];
+  if (!HEX643.test(target.targetDigest)) reasons.push("invalid-target-digest");
+  if (!target.runnerSupported) reasons.push("unsupported-runner");
+  if (!target.hasIndependentEvidence) reasons.push("no-independent-evidence");
+  if (!target.publiclyReachable) reasons.push("not-publicly-reachable");
+  if (target.excludedChange) reasons.push("test-config-vendor-or-build-only");
+  if (target.generatedOrBinary) reasons.push("generated-or-binary");
+  if (target.requiresForbiddenExternalResource) reasons.push("forbidden-external-resource");
+  if (target.sourceConflict) reasons.push("source-disagreement");
+  if (target.allKnownLayer1GapsClosed && !target.sourceIntroducesDifferentRule) {
+    reasons.push("all-known-gaps-closed");
+  }
+  if (!Number.isInteger(target.openLayer1Residuals) || target.openLayer1Residuals < 0) {
+    reasons.push("invalid-open-residual-count");
+  }
+  if (!Number.isInteger(target.supportedPropertyFamilies) || target.supportedPropertyFamilies < 0) {
+    reasons.push("invalid-property-family-count");
+  }
+  if (!Number.isFinite(target.estimatedSetupCost) || target.estimatedSetupCost < 0) {
+    reasons.push("invalid-setup-cost");
+  }
+  return reasons;
+}
+function compareTargets(left, right) {
+  const flags = [
+    (target) => target.hasIndependentEvidence,
+    (target) => target.openLayer1Residuals > 0,
+    (target) => target.mutationSiteAbsent,
+    (target) => target.publiclyReachable,
+    (target) => !target.changedBranchHasDirectTest
+  ];
+  for (const flag of flags) {
+    const difference = Number(flag(right)) - Number(flag(left));
+    if (difference !== 0) return difference;
+  }
+  if (right.supportedPropertyFamilies !== left.supportedPropertyFamilies) {
+    return right.supportedPropertyFamilies - left.supportedPropertyFamilies;
+  }
+  if (left.estimatedSetupCost !== right.estimatedSetupCost) {
+    return left.estimatedSetupCost - right.estimatedSetupCost;
+  }
+  return left.targetDigest.localeCompare(right.targetDigest);
+}
+function selectCiPropertyTargets(input, maxTargets = 2) {
+  if (!Number.isInteger(maxTargets) || maxTargets < 1 || maxTargets > 2) {
+    throw new Error("CI property maxTargets must be one or two");
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const target of input) {
+    if (seen.has(target.targetDigest)) {
+      throw new Error(`duplicate CI property target '${target.targetDigest}'`);
+    }
+    seen.add(target.targetDigest);
+  }
+  const reasons = new Map(
+    input.map((target) => [target.targetDigest, targetRejections(target)])
+  );
+  const eligible = input.filter((target) => reasons.get(target.targetDigest).length === 0).sort(compareTargets);
+  const selected = eligible.slice(0, maxTargets);
+  const selectedIds = new Set(selected.map((target) => target.targetDigest));
+  return {
+    selected,
+    decisions: input.map((target) => {
+      const targetReasons = [...reasons.get(target.targetDigest)];
+      const chosen = selectedIds.has(target.targetDigest);
+      if (!chosen && targetReasons.length === 0) targetReasons.push("target-budget");
+      return { target, selected: chosen, reasons: targetReasons };
+    }).sort(
+      (left, right) => left.target.targetDigest.localeCompare(right.target.targetDigest)
+    )
+  };
+}
+function ciPropertyBehaviourKey(rule) {
+  return sha2562(
+    canonical2({
+      targetDigest: rule.targetDigest,
+      propertyFamily: rule.propertyFamily.trim().toLowerCase(),
+      operationSequence: rule.operationSequence.map((step) => step.trim()),
+      observation: {
+        kind: rule.observation.kind.trim().toLowerCase(),
+        subject: rule.observation.subject.trim(),
+        expected: rule.observation.expected.trim()
+      },
+      inputDomainKinds: [...new Set(rule.inputDomainKinds.map((kind) => kind.trim().toLowerCase()))].sort(),
+      sourceSetDigest: rule.sourceSetDigest
+    })
+  );
+}
+function compareRules(left, right) {
+  const authority = { "machine-sourced": 0, "source-grounded": 1 };
+  if (authority[left.authority] !== authority[right.authority]) {
+    return authority[left.authority] - authority[right.authority];
+  }
+  const match = { exact: 0, indirect: 1, none: 2 };
+  if (match[left.openLayer1Match] !== match[right.openLayer1Match]) {
+    return match[left.openLayer1Match] - match[right.openLayer1Match];
+  }
+  if (left.riskTriggerStrength !== right.riskTriggerStrength) {
+    return right.riskTriggerStrength - left.riskTriggerStrength;
+  }
+  if (left.evidenceSpecificity !== right.evidenceSpecificity) {
+    return right.evidenceSpecificity - left.evidenceSpecificity;
+  }
+  if (left.inputValidityConfidence !== right.inputValidityConfidence) {
+    return right.inputValidityConfidence - left.inputValidityConfidence;
+  }
+  if (left.templateSupported !== right.templateSupported) {
+    return Number(right.templateSupported) - Number(left.templateSupported);
+  }
+  if (left.setupDependencyCount !== right.setupDependencyCount) {
+    return left.setupDependencyCount - right.setupDependencyCount;
+  }
+  if (left.modelPriority !== right.modelPriority) {
+    return left.modelPriority - right.modelPriority;
+  }
+  return left.intentDigest.localeCompare(right.intentDigest);
+}
+function rankCiPropertyRules(input, options = {}) {
+  const poolSize = options.poolSize ?? 8;
+  if (!Number.isInteger(poolSize) || poolSize < 1 || poolSize > 8) {
+    throw new Error("CI property rule pool must contain one to eight rules");
+  }
+  const closed = options.closedBehaviourKeys ?? /* @__PURE__ */ new Set();
+  const intentIds = /* @__PURE__ */ new Set();
+  const behaviourIds = /* @__PURE__ */ new Set();
+  const accepted = [];
+  const dropped = [];
+  for (const rule of input) {
+    if (!HEX643.test(rule.intentDigest) || !HEX643.test(rule.targetDigest) || !HEX643.test(rule.sourceSetDigest)) {
+      throw new Error("CI property rules require sha256 intent, target, and source-set identities");
+    }
+    if (!Number.isInteger(rule.setupDependencyCount) || rule.setupDependencyCount < 0) {
+      throw new Error("setupDependencyCount must be a non-negative integer");
+    }
+    for (const [name, value] of [
+      ["evidenceSpecificity", rule.evidenceSpecificity],
+      ["riskTriggerStrength", rule.riskTriggerStrength],
+      ["inputValidityConfidence", rule.inputValidityConfidence]
+    ]) {
+      if (!Number.isInteger(value) || value < 0 || value > 3) {
+        throw new Error(`${name} must be an integer from zero to three`);
+      }
+    }
+    if (!Number.isInteger(rule.modelPriority) || rule.modelPriority < 0) {
+      throw new Error("modelPriority must be a non-negative integer");
+    }
+    if (intentIds.has(rule.intentDigest)) {
+      dropped.push({ intentDigest: rule.intentDigest, reason: "duplicate-intent" });
+      continue;
+    }
+    intentIds.add(rule.intentDigest);
+    const behaviourKey = ciPropertyBehaviourKey(rule);
+    if (closed.has(behaviourKey)) {
+      dropped.push({ intentDigest: rule.intentDigest, reason: "closed-classicMutation" });
+      continue;
+    }
+    if (behaviourIds.has(behaviourKey)) {
+      dropped.push({ intentDigest: rule.intentDigest, reason: "duplicate-behaviour" });
+      continue;
+    }
+    behaviourIds.add(behaviourKey);
+    accepted.push({ ...rule, behaviourKey });
+  }
+  accepted.sort(compareRules);
+  const firstByFamily = [];
+  const repeatedFamilies = [];
+  const families = /* @__PURE__ */ new Set();
+  for (const rule of accepted) {
+    if (families.has(rule.propertyFamily)) repeatedFamilies.push(rule);
+    else {
+      families.add(rule.propertyFamily);
+      firstByFamily.push(rule);
+    }
+  }
+  const ordered = [...firstByFamily, ...repeatedFamilies];
+  for (const rule of ordered.slice(poolSize)) {
+    dropped.push({ intentDigest: rule.intentDigest, reason: "pool-cap" });
+  }
+  return { ranked: ordered.slice(0, poolSize), dropped };
+}
+
+// src/ci-property-obligations.ts
+var CI_PROPERTY_FAMILIES = [
+  "round-trip",
+  "idempotence",
+  "order-preservation",
+  "monotonicity",
+  "normalization-equivalence",
+  "partition-recombine",
+  "serialization-preservation",
+  "acceptance-boundary",
+  "state-transition",
+  "error-containment",
+  "recovery-continuity",
+  "non-mutation",
+  "cache-coherence",
+  "representation-boundary",
+  "resource-lifecycle",
+  "conservation"
+];
+var CI_OBLIGATION_SIGNAL_AUTHORITIES = [
+  "explicit-contract",
+  "mechanical-risk"
+];
+
+// src/customer-environment.ts
+import { homedir as homedir2 } from "os";
+import { isAbsolute, join } from "path";
+var PORTABLE_RUNTIME_NAMES = /* @__PURE__ */ new Set([
+  "CI",
+  "HOME",
+  "LANG",
+  "LC_ALL",
+  "LC_CTYPE",
+  "LOGNAME",
+  "NODE_ENV",
+  "NO_COLOR",
+  "PATH",
+  "PATHEXT",
+  "SHELL",
+  "SYSTEMROOT",
+  "TEMP",
+  "TERM",
+  "TMP",
+  "TMPDIR",
+  "TZ",
+  "USER"
+]);
+var RESERVED_EXACT = /* @__PURE__ */ new Set([
+  "ANTHROPIC_API_KEY",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "GH_TOKEN",
+  "GITHUB_TOKEN",
+  "OPENAI_API_KEY",
+  // These are engine-enforced package-manager safety controls. A repository must not be able to
+  // re-enable Corepack downloads or package-registry access by listing one in abloh.yml.
+  "COREPACK_ENABLE_AUTO_PIN",
+  "COREPACK_ENABLE_NETWORK",
+  "COREPACK_DEFAULT_TO_LATEST",
+  "COREPACK_HOME",
+  "BUN_OPTIONS",
+  "DO_NOT_TRACK",
+  "NPM_CONFIG_AUDIT",
+  "NPM_CONFIG_FUND",
+  "NPM_CONFIG_OFFLINE",
+  "NPM_CONFIG_UPDATE_NOTIFIER",
+  // Node preload and module-resolution flags execute before the requested tool. In particular,
+  // `--preserve-symlinks` makes pnpm's flat compatibility links outrank packages' declared nested
+  // dependencies; customer-controlled preload flags would also execute arbitrary code inside the
+  // engine process. Neither belongs in a measured customer environment.
+  "NODE_OPTIONS",
+  "PNPM_DISABLE_SELF_UPDATE_CHECK",
+  "YARN_ENABLE_NETWORK",
+  "YARN_ENABLE_TELEMETRY",
+  // Yarn 4 rejects `YARN_OFFLINE` as an unknown legacy configuration key. Keep it reserved so a
+  // repository cannot reintroduce it; `YARN_ENABLE_NETWORK=0` is the supported network boundary.
+  "YARN_OFFLINE"
+]);
+function packageManagerSafetyEnvironment(source) {
+  const home = source.HOME ?? homedir2();
+  const corepackHome = source.COREPACK_HOME ?? join(home, ".cache", "node", "corepack");
+  if (!isAbsolute(corepackHome)) {
+    throw new Error("COREPACK_HOME must be absolute so delegated package-manager bytes can be bound");
+  }
+  return {
+    BUN_OPTIONS: "--no-install",
+    COREPACK_ENABLE_AUTO_PIN: "0",
+    COREPACK_ENABLE_NETWORK: "0",
+    COREPACK_DEFAULT_TO_LATEST: "0",
+    COREPACK_HOME: corepackHome,
+    DO_NOT_TRACK: "1",
+    NPM_CONFIG_AUDIT: "false",
+    NPM_CONFIG_FUND: "false",
+    NPM_CONFIG_OFFLINE: "true",
+    NPM_CONFIG_UPDATE_NOTIFIER: "false",
+    PNPM_DISABLE_SELF_UPDATE_CHECK: "true",
+    // pnpm >=11 inspects node_modules before running scripts and refuses entries it did not
+    // create — including Abloh's staged coverage-provider overlay. Measurement consumes the
+    // prepared tree as-is; re-verification (like re-installation) is never part of a run.
+    npm_config_verify_deps_before_run: "false",
+    YARN_ENABLE_NETWORK: "0",
+    YARN_ENABLE_TELEMETRY: "0"
+  };
+}
+function isReservedCustomerVariable(name) {
+  const upper = name.toUpperCase();
+  return upper.startsWith("ABLOH_") || upper.startsWith("ATTEST_") || RESERVED_EXACT.has(upper);
+}
+function customerEnvironmentNames(required) {
+  const names = new Set(PORTABLE_RUNTIME_NAMES);
+  for (const name of required) {
+    if (isReservedCustomerVariable(name)) {
+      throw new Error(`environment variable ${name} is reserved for Abloh and cannot be exposed to repository code`);
+    }
+    names.add(name);
+  }
+  return [...names].sort();
+}
+function buildCustomerProcessEnvironment(source = process.env, required = [], overrides = {}) {
+  const missing = required.filter((name) => source[name] === void 0);
+  if (missing.length > 0) {
+    throw new Error(`prepared test environment is missing required variable(s): ${missing.join(", ")}`);
+  }
+  const output = {};
+  for (const name of customerEnvironmentNames(required)) {
+    const value = source[name];
+    if (value !== void 0) output[name] = value;
+  }
+  for (const [name, value] of Object.entries(overrides)) {
+    if (isReservedCustomerVariable(name)) {
+      throw new Error(`environment override ${name} is reserved for Abloh`);
+    }
+    output[name] = value;
+  }
+  Object.assign(output, packageManagerSafetyEnvironment(source));
+  return output;
+}
+function containsEngineCredential(environment) {
+  return Object.keys(environment).some(isReservedCustomerVariable);
+}
+
+// src/capability-registry.ts
+var PROVIDER_RAW_FORMAT = {
+  v8: "istanbul-coverage-final-v1",
+  babel: "istanbul-coverage-final-v1",
+  c8: "istanbul-coverage-final-v1",
+  "bun-lcov": "lcov-v1",
+  "coverage.py": "coverage-py-json-v1"
+};
+var RUNNER_CAPABILITIES = [
+  { runner: "jest", ecosystem: "js", layer0Providers: ["v8", "babel"], layer0Enabled: true, mutation: "stryker-plugin", perTestDrivable: true },
+  { runner: "vitest", ecosystem: "js", layer0Providers: ["v8"], layer0Enabled: true, mutation: "stryker-plugin", perTestDrivable: true },
+  { runner: "mocha", ecosystem: "js", layer0Providers: ["c8"], layer0Enabled: true, mutation: "stryker-plugin", perTestDrivable: true },
+  { runner: "node-test", ecosystem: "js", layer0Providers: ["c8"], layer0Enabled: true, mutation: "whole-suite-command", perTestDrivable: true },
+  { runner: "ava", ecosystem: "js", layer0Providers: ["c8"], layer0Enabled: true, mutation: "whole-suite-command", perTestDrivable: true },
+  { runner: "tap", ecosystem: "js", layer0Providers: ["c8"], layer0Enabled: true, mutation: "stryker-plugin", perTestDrivable: true },
+  { runner: "jasmine", ecosystem: "js", layer0Providers: ["c8"], layer0Enabled: true, mutation: "stryker-plugin", perTestDrivable: true },
+  // Layer 0 disabled: bun 1.3.14 reported an unexecuted line as covered and emits no per-function
+  // records to correct with. "bun-lcov" stays recognized so historical artifacts validate.
+  { runner: "bun", ecosystem: "js", layer0Providers: ["bun-lcov"], layer0Enabled: false, mutation: "whole-suite-command", perTestDrivable: true },
+  { runner: "pytest", ecosystem: "python", layer0Providers: ["coverage.py"], layer0Enabled: true, mutation: "cosmic-ray", perTestDrivable: false }
+];
+var BY_RUNNER = new Map(RUNNER_CAPABILITIES.map((c) => [c.runner, c]));
+function capability(runner) {
+  const found = BY_RUNNER.get(runner);
+  if (found === void 0) throw new Error(`unknown runner in capability registry: ${runner}`);
+  return found;
+}
+function knownRunner(runner) {
+  return BY_RUNNER.has(runner);
+}
+function jsRunners() {
+  return RUNNER_CAPABILITIES.filter((c) => c.ecosystem === "js").map((c) => c.runner);
+}
+function layer0EnabledRunners(ecosystem) {
+  return RUNNER_CAPABILITIES.filter((c) => c.layer0Enabled && (ecosystem === void 0 || c.ecosystem === ecosystem)).map((c) => c.runner);
+}
+function strykerPluginRunners() {
+  return RUNNER_CAPABILITIES.filter((c) => c.mutation === "stryker-plugin").map((c) => c.runner);
+}
+function recognizedProvidersFor(runner) {
+  return new Set(capability(runner).layer0Providers);
+}
+var TARGET_ARTIFACT_KEYS = [
+  "repo",
+  "baseSha",
+  "sha",
+  "runner",
+  "directory",
+  "targetSelection"
+];
+var HANDOFF_TARGET_KEYS = ["baseSha", "sha", "runner"];
+var HANDOFF_EVIDENCE_KEYS_V1 = [
+  "schema",
+  "engine",
+  "target",
+  "scope",
+  "diffCoverage",
+  "rawCoverageDigest",
+  "rawCoverageFormat",
+  "mutationExecution",
+  "mutationScope",
+  "tier",
+  "mutantsPlanned",
+  "mutantsRun",
+  "counts",
+  "scores",
+  "floor",
+  "gate",
+  "baseline",
+  "findingCount",
+  "findings",
+  "policy",
+  "rationalesDigest",
+  "rawReportDigest",
+  "skipBaseline"
+];
+var HANDOFF_EVIDENCE_KEYS_V2 = [
+  ...HANDOFF_EVIDENCE_KEYS_V1,
+  "evidenceProfile",
+  "packages",
+  "mutantRoster",
+  // Reverse-patch verification (opt-in beta): an advisory verdict, its cost, and bounded gap
+  // locations. Advisory on both sides of the wire — no score, floor, gate or certificate
+  // computation reads it.
+  "patchRevert"
+];
+var TARGET_SELECTION_KINDS = [
+  "declared-policy",
+  "declared-cli",
+  "auto-diff",
+  "auto-diff-multi",
+  "repository-root"
+];
+export {
+  CI_OBLIGATION_SIGNAL_AUTHORITIES,
+  CI_PROPERTY_AUTHORITIES,
+  CI_PROPERTY_CAPS,
+  CI_PROPERTY_FAMILIES,
+  CI_PROPERTY_OUTCOMES,
+  CI_PROPERTY_STATES,
+  CI_RESIDUAL_STATES,
+  CLUSTER_STRATEGIES,
+  DEFAULT_CLASSIC_MUTATION,
+  DEFAULT_DIFF_COVERAGE,
+  DEFAULT_ENVIRONMENT,
+  DEFAULT_ENVIRONMENT_IMAGE_DIGEST,
+  DEFAULT_ENVIRONMENT_IMAGE_REF,
+  DEFAULT_FINDINGS,
+  DEFAULT_FLOOR,
+  DEFAULT_MECHANISMS,
+  DEFAULT_MUTATION,
+  DEFAULT_POLICY,
+  DEFAULT_SANDBOX,
+  DIFF_COVERAGE_THRESHOLD,
+  DiffScopeError,
+  EXCLUDE_RE,
+  EXPECTED_ORACLE_CELL,
+  FINDING_SEVERITIES,
+  HANDOFF_EVIDENCE_KEYS_V1,
+  HANDOFF_EVIDENCE_KEYS_V2,
+  HANDOFF_TARGET_KEYS,
+  LAYER0_EXECUTION,
+  LAYER0_SCOPE_DISCLOSURE,
+  LAYER1_EXECUTION,
+  MAX_EXPANDED_LINES,
+  MAX_FINDING_DESCRIPTION_LEN,
+  MAX_LITERAL_ARGUMENTS,
+  MAX_LITERAL_COMMAND_BYTES,
+  MAX_MUTANT_ROSTER,
+  MAX_SCOPE_RANGES,
+  MECHANICAL_ERROR_PATH_REASON,
+  MIN_CELL_REPEATS,
+  MUTANT_STATUSES,
+  MUTATION_SCOPE_SURFACE,
+  PROVIDER_RAW_FORMAT,
+  PYTHON_EXCLUDE_RE,
+  PYTHON_SOURCE_RE,
+  REALISTIC_CATEGORIES,
+  RUNNER_CAPABILITIES,
+  SCENARIO_AUTHORITIES,
+  SCENARIO_LANES,
+  SCENARIO_OUTCOMES,
+  SCENARIO_SEARCH_STATES,
+  SCENARIO_SOURCE_INDEPENDENCE,
+  SCENARIO_SOURCE_KINDS,
+  SOURCE_RE,
+  TARGET_ARTIFACT_KEYS,
+  TARGET_SELECTION_KINDS,
+  TRIAGE_REASON_CODES,
+  analyzeTestFindings,
+  applyLayer1Gate,
+  assertNever,
+  buildCiPropertySearchBlock,
+  buildCiPropertyTargetUniverse,
+  buildCustomerProcessEnvironment,
+  buildScenarioSearchBlock,
+  canStartStageB,
+  capability,
+  changedStructuralCoverage,
+  ciPropertyBehaviourKey,
+  ciPropertyLedgerDigest,
+  ciPropertyMutatorFamilies,
+  classicHeadroom,
+  classicMutationExecution,
+  classicMutationTier,
+  classifyDiffCoverage,
+  combineLayerGates,
+  computeScope,
+  computeScores,
+  conditionalPower,
+  containsEngineCredential,
+  countsFromLines,
+  coveredLinesToScope,
+  customerEnvironmentNames,
+  denominatorOf,
+  deriveScenarioSearchCounts,
+  deriveWorstOfGate,
+  describeFinding,
+  describeMutationEvidence,
+  describeReasonCode,
+  diffCoverageExecution,
+  emptyCounts,
+  errorCountOf,
+  evaluateAssay,
+  evaluateDiffCoverageGate,
+  evaluateFloor,
+  evaluateGate,
+  expandScopeLines,
+  findingKind,
+  findingSeverity,
+  gapKeys,
+  groupFindingsByLine,
+  isCanonicalBase64,
+  isCiPropertyCandidateCap,
+  isClusterStrategy,
+  isConfirmedEquivalent,
+  isNonExecutableLine,
+  isReservedCustomerVariable,
+  isScenarioAuthority,
+  isScenarioLane,
+  isScenarioOutcome,
+  isScenarioSearchState,
+  jsRunners,
+  knownRunner,
+  layer0EnabledRunners,
+  loadPolicy,
+  markNonExecutable,
+  mechanicalErrorPathDisposition,
+  missingScopedFiles,
+  mutantIdentity,
+  operatorClass,
+  operatorClassBreakdown,
+  operatorClassSummary,
+  parseLiteralArguments,
+  parsePreparedTestCommand,
+  parseUnifiedDiff,
+  qualifyCorpus,
+  qualifyHistoricalPair,
+  rankCiPropertyRules,
+  recognizedProvidersFor,
+  redactTriageForEgress,
+  researchTier,
+  sanitizeCiPropertySummary,
+  sanitizeFindingDescription,
+  sanitizeScenarioSummary,
+  selectCiPropertyTargets,
+  stableOutcome,
+  strykerPluginRunners,
+  survivingMutantObligationSignals,
+  tallyCounts,
+  testIdentityDigest,
+  toGapFindings,
+  uncoveredCount,
+  validateCiResidualGapLedger,
+  validateDiffCoverageLines,
+  validateManifest,
+  validatePolicy,
+  validatePreparedTestCommand,
+  wilsonInterval
+};