@attalabs/vinaya 0.26.0 → 0.27.0

package/dist/index.js

@@ -1,8 +1,9 @@
 #!/usr/bin/env node
 
 // src/index.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
 import { readFileSync as readFileSync35 } from "node:fs";
-import { dirname as dirname12, join as join34 } from "node:path";
+import { dirname as dirname13, join as join34 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/commands/archive.ts
@@ -281,7 +282,7 @@ function issueListByLabelArgs(owner, repo, label) {
     "--state",
     "all",
     "--json",
-    "number,title,body,state,labels,milestone",
+    "number,title,body,state,labels,milestone,stateReason",
     "--limit",
     "200"
   ];
@@ -615,14 +616,19 @@ async function fetchTrancheIssuesAsync(owner, repo, slug) {
 var INTENTS_HEADING = /^#{1,6}\s*Tranche intents\s*$/im;
 var NEXT_HEADING = /^#{1,6}\s+\S/m;
 var INTENT_BULLET = /^-\s+([a-z0-9][a-z0-9-]*)\s*:\s*(.+)$/i;
-function intentGoalForSlug(description, slug) {
-  const text = stripCode(description, { inlineSpans: "keep" });
+function intentsSection(text) {
   const start = text.match(INTENTS_HEADING);
   if (!start || start.index === undefined)
-    return "";
+    return null;
   const rest = text.slice(start.index + start[0].length);
   const next = rest.match(NEXT_HEADING);
-  const section = rest.slice(0, next && next.index !== undefined ? next.index : rest.length);
+  return rest.slice(0, next && next.index !== undefined ? next.index : rest.length);
+}
+function intentGoalForSlug(description, slug) {
+  const text = stripCode(description, { inlineSpans: "keep" });
+  const section = intentsSection(text);
+  if (section === null)
+    return "";
   for (const line of section.split(`
 `)) {
     const trimmed = line.trim();
@@ -634,6 +640,23 @@ function intentGoalForSlug(description, slug) {
   }
   return "";
 }
+function intentLines(description) {
+  const text = stripCode(description, { inlineSpans: "keep" });
+  const section = intentsSection(text);
+  if (section === null)
+    return [];
+  const lines = [];
+  for (const line of section.split(`
+`)) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0)
+      continue;
+    const m = trimmed.match(INTENT_BULLET);
+    if (m)
+      lines.push({ slug: (m[1] ?? "").toLowerCase(), goal: (m[2] ?? "").trim() });
+  }
+  return lines;
+}
 function matchesLegacyMilestone(milestones, slug) {
   return milestones.find((m) => m.title === slug) ?? null;
 }
@@ -1904,6 +1927,7 @@ function isPrincipal(login, principalAllowlist) {
 // ../../packages/aeg-core/src/verdict-extraction.ts
 var HEAD_SHA_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Judged head:\s*([0-9a-f]{7,40})(?![A-Za-z0-9])/im;
 var OBJECTIVES_VERSION_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Objectives version:\s*([0-9a-f]{64})(?![A-Za-z0-9])/im;
+var RULING_ORDINAL_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?Ruling ordinal:\s*(\d+)(?!\d)/im;
 function firstFiveLines(comment) {
   return comment.split(`
 `).slice(0, 5).join(`
@@ -1917,6 +1941,15 @@ function extractObjectivesVersion(comment) {
   const m = firstFiveLines(comment).match(OBJECTIVES_VERSION_PATTERN);
   return m ? m[1].toLowerCase() : null;
 }
+function firstSevenLines(comment) {
+  return comment.split(`
+`).slice(0, 7).join(`
+`);
+}
+function extractRulingOrdinal(comment) {
+  const m = firstSevenLines(comment).match(RULING_ORDINAL_PATTERN);
+  return m ? Number.parseInt(m[1], 10) : null;
+}
 function extractVerdict(comments, valuePattern, missingLabel) {
   const candidates = comments.filter((c) => valuePattern.test(c));
   if (candidates.length === 0) {
@@ -1924,6 +1957,7 @@ function extractVerdict(comments, valuePattern, missingLabel) {
       value: `no ${missingLabel} pass was run before merge — DANGLING, see below`,
       headSha: null,
       objectivesVersion: null,
+      rulingOrdinal: null,
       danglingNote: `no ${missingLabel} verdict comment found on this PR`
     };
   }
@@ -1934,6 +1968,7 @@ function extractVerdict(comments, valuePattern, missingLabel) {
       value: `the most recent ${missingLabel} comment's VERDICT line is not within its first five lines — DANGLING, see below`,
       headSha: null,
       objectivesVersion: null,
+      rulingOrdinal: null,
       danglingNote: `the most recent ${missingLabel} verdict comment carries a VERDICT-shaped line outside the first-five-line read window`
     };
   }
@@ -1941,6 +1976,7 @@ function extractVerdict(comments, valuePattern, missingLabel) {
     value: m[1].toUpperCase().replace(/[_-]/g, " "),
     headSha: extractHeadSha(latest),
     objectivesVersion: extractObjectivesVersion(latest),
+    rulingOrdinal: extractRulingOrdinal(latest),
     danglingNote: null
   };
 }
@@ -2471,6 +2507,9 @@ import { createHash as createHash2 } from "node:crypto";
 var HEADING_RE = /^##[ \t]*Objectives[ \t]*$/im;
 var NEXT_HEADING_RE = /^##[ \t]/m;
 var OBJECTIVE_LINE_RE = /^O(\d+)\.[ \t]*(.*)$/;
+function maskedForHeadingSearch(body) {
+  return maskDetailsBlocks(maskCode(body));
+}
 function hasBacktickedPath(text) {
   let i = 0;
   while (i < text.length) {
@@ -2493,16 +2532,22 @@ function stripObjectiveBackticks(text) {
 function wordCount(text) {
   return text.split(/\s+/).filter((w) => /[a-z]/i.test(w)).length;
 }
-function objectivesSectionText(body) {
-  const heading = HEADING_RE.exec(body);
+function objectivesSectionBounds(body) {
+  const masked = maskedForHeadingSearch(body);
+  const heading = HEADING_RE.exec(masked);
   if (!heading)
     return null;
-  const afterHeading = body.slice(heading.index + heading[0].length);
+  const start = heading.index + heading[0].length;
+  const afterHeading = masked.slice(start);
   const next = NEXT_HEADING_RE.exec(afterHeading);
-  return next ? afterHeading.slice(0, next.index) : afterHeading;
+  return { start, end: next ? start + next.index : body.length };
+}
+function objectivesSectionText(body) {
+  const bounds = objectivesSectionBounds(body);
+  return bounds === null ? null : body.slice(bounds.start, bounds.end);
 }
 function hasObjectivesHeading(body) {
-  return HEADING_RE.test(body);
+  return HEADING_RE.test(maskedForHeadingSearch(body));
 }
 function objectivesOf(body) {
   const section = objectivesSectionText(body);
@@ -2566,6 +2611,15 @@ function isIssueNotFoundError(err) {
 `);
   return /could not resolve to an (?:issue|pull request)|\b404\b|not found/i.test(haystack);
 }
+function resolveObjectivesSource(prBody, issue, cutoverIssue) {
+  if (issue !== null && issue < cutoverIssue)
+    return { kind: "none" };
+  if (issue !== null)
+    return { kind: "issue", issue };
+  if (hasObjectivesHeading(prBody))
+    return { kind: "body" };
+  return { kind: "none" };
+}
 
 // ../../packages/aeg-core/src/premise-check.ts
 var ASSERTION_KINDS = new Set(["contains", "absent", "sha256"]);
@@ -2830,16 +2884,43 @@ function extractFencedBlocks(text) {
   return blocks;
 }
 var AEG_BRIEF_V1_MARKER = "<!-- aeg:brief:v1 -->";
-function contentAfterTwoLines(body) {
-  const first = body.indexOf(`
-`);
-  if (first === -1)
-    return "";
-  const second = body.indexOf(`
-`, first + 1);
-  if (second === -1)
-    return "";
-  return body.slice(second + 1);
+function contentAfterNLines(body, n) {
+  let idx = -1;
+  for (let i = 0;i < n; i++) {
+    idx = body.indexOf(`
+`, idx + 1);
+    if (idx === -1)
+      return "";
+  }
+  return body.slice(idx + 1);
+}
+function briefMarkerFor(version) {
+  return `<!-- aeg:brief:v${version} -->`;
+}
+var BRIEF_MARKER_LINE_RE = /^<!-- aeg:brief:v(\d+) -->$/;
+function parseBriefMarkerVersion(firstLine) {
+  const m = BRIEF_MARKER_LINE_RE.exec(firstLine.trim());
+  if (!m)
+    return null;
+  const version = Number.parseInt(m[1], 10);
+  return Number.isInteger(version) && version >= 1 ? version : null;
+}
+function frozenBriefContent(body, version) {
+  return contentAfterNLines(body, version === 1 ? 2 : 3);
+}
+function resolveNewestFrozenBrief(comments, allowlist) {
+  let best = null;
+  for (const c of comments) {
+    if (!isPrincipal(c.author, allowlist))
+      continue;
+    const version = parseBriefMarkerVersion(c.body.split(`
+`)[0] ?? "");
+    if (version === null)
+      continue;
+    if (best === null || version > best.version)
+      best = { ...c, version };
+  }
+  return best === null ? null : { ...best, content: frozenBriefContent(best.body, best.version) };
 }
 // ../../packages/aeg-core/src/doctrine-portability.ts
 var EXEMPT_LITERALS = new Set([
@@ -3196,6 +3277,30 @@ function checkDocsWithinSurface(body, issueNumber) {
   }
   return { status: errors.length > 0 ? "fail" : "pass", errors };
 }
+function checkSurfaceExcludesBoundDoc(body, docOwnersContent) {
+  if (docOwnersContent === null)
+    return { status: "pass", errors: [] };
+  const surface = parseIssueSurface(body);
+  if (!surface.ok)
+    return { status: "pass", errors: [] };
+  const { bindings } = parseDocOwners(docOwnersContent);
+  if (bindings.length === 0)
+    return { status: "pass", errors: [] };
+  const errors = [];
+  for (const binding of bindings) {
+    if (isUrlPointer(binding.pointer))
+      continue;
+    const inGlob = surface.value.in.find((g) => globsOverlap(binding.glob, g));
+    if (!inGlob)
+      continue;
+    const pointerPath = pointerToPath(binding.pointer);
+    const outGlob = surface.value.out.find((g) => globCoversPath(g, pointerPath));
+    if (!outGlob)
+      continue;
+    errors.push(`issue-validation Surface: \`${inGlob}\` in \`## Surface\`'s \`in:\` list matches ${DOC_OWNERS_PATH}:${binding.lineNum} (glob \`${binding.glob}\` → ${binding.pointer}), but \`${outGlob}\` in \`## Surface\`'s \`out:\` list excludes ${binding.pointer} — this task's own surface cannot satisfy doc-coverage and surface-scope at once.`);
+  }
+  return { status: errors.length > 0 ? "fail" : "pass", errors };
+}
 
 // ../../packages/aeg-core/src/coherence-checks.ts
 var R1_GRANDFATHERED_ISSUES = new Set([279, 280, 281, 282]);
@@ -3297,6 +3402,24 @@ function buildProvenanceBlock(facts) {
   return { block: lines.join(`
 `), issue, dangling };
 }
+// ../../packages/aeg-core/src/ruling-ordinal.ts
+var RULING_MARKER_ORDINAL = /^<!-- aeg:principal:ruling:\d+-(\d+) -->$/;
+function newestPrincipalRulingOrdinal(comments, allowlist) {
+  let best = 0;
+  for (const c of comments) {
+    if (!isPrincipal(c.author, allowlist))
+      continue;
+    const firstLine = (c.body.split(`
+`)[0] ?? "").trim();
+    const m = RULING_MARKER_ORDINAL.exec(firstLine);
+    if (!m)
+      continue;
+    const k = Number.parseInt(m[1], 10);
+    if (k > best)
+      best = k;
+  }
+  return best;
+}
 // ../../packages/aeg-core/src/diagram-model.ts
 import matter from "gray-matter";
 // ../../packages/aeg-core/src/reader-resolvable-prose.ts
@@ -3616,12 +3739,26 @@ function renderSection2(facts) {
     "",
     `- **Tranche:** \`${facts.trancheSlug}\`, task ${facts.taskId}, Issue #${facts.issue}. Branch \`task/${facts.trancheSlug}/${facts.taskId}\`. \`Depends-on: ${depends}\`, \`Conflicts-with: ${conflicts}\`. Confirm \`READY TO DISPATCH\` at your own Step 0.`,
     `- **Read Issue #${facts.issue} in full** for the complete rationale — do not re-derive it.`,
+    `- **Revision:** rendered at \`${facts.sourceRevision}\` — the checkout's HEAD equaled the remote default branch, and no pinned file below carried an uncommitted change, when these facts were read.`,
     `- ${facts.rationale.boundary}`,
     `- ${facts.rationale.trapsToAvoid}`
   ];
   return lines.join(`
 `);
 }
+function extractSourceRevision(briefText) {
+  const lines = briefText.split(`
+`);
+  const start = lines.findIndex((l) => /^##\s*2\.\s*Context\b/.test(l.trim()));
+  if (start === -1)
+    return null;
+  const rest = lines.slice(start + 1);
+  const end = rest.findIndex((l) => /^##\s/.test(l));
+  const section2 = (end === -1 ? rest : rest.slice(0, end)).join(`
+`);
+  const m = /^- \*\*Revision:\*\* rendered at `([0-9a-fA-F]{7,40})`/m.exec(section2);
+  return m ? m[1] : null;
+}
 function renderSection3(facts) {
   return ["## 3. Technical dependencies", "", `${facts.rationale.dependencyRationale}`].join(`
 `);
@@ -3825,6 +3962,9 @@ function renderBrief(facts, template) {
   const missing = [];
   if (facts.projects.length === 0)
     missing.push("Project (task has no Project(s) declared)");
+  if (!facts.sourceRevision) {
+    missing.push("Revision (no source revision resolved — the caller must refuse before render, never render with an empty one)");
+  }
   if (facts.objectives.length === 0 && facts.issue >= OBJECTIVES_SINCE_ISSUE) {
     missing.push("Objectives (Issue has no `## Objectives` section)");
   }
@@ -7959,14 +8099,41 @@ var COMMANDS = [
   },
   {
     name: "task dispatch",
-    description: "Render, pin, and post the brief on the Issue as the frozen original; start the developer",
+    description: "Deprecated — render, pin, and post the brief on the Issue as the frozen original; start the developer",
     flags: [
       { flag: "--agent <claude|codex|gemini>", description: "Start the developer through dispatchRole once posted" }
     ],
     details: [
       "Renders the brief from the Issue and the tree (the same assembly `brief render` uses) and posts it once as an Issue comment whose first line is `<!-- aeg:brief:v1 -->` and whose second line is `Brief hash: <sha256>` — the hash covers only the body below those two lines, so any reader recomputes it. Refuses outright, naming the existing comment's URL, when a `v1` comment already exists on the Issue — the brief is frozen by design, never overwritten or silently reissued.",
       "With `--agent`, starts the Developer through `dispatchRole` when `apps/cli/src/lib/dispatch.ts` exports it; otherwise prints the rendered brief and the manual dispatch instruction and exits `0` — a soft dependency, never a hard block.",
-      "Principal-only, with or without `--agent`: refuses before any render, forge read, or post when the authenticated `gh` identity is not on the Principal allowlist (or cannot be resolved at all) — dispatching is the `todo → in-flight` transition, not a general-purpose comment poster."
+      "Principal-only, with or without `--agent`: refuses before any render, forge read, or post when the authenticated `gh` identity is not on the Principal allowlist (or cannot be resolved at all) — dispatching is the `todo → in-flight` transition, not a general-purpose comment poster.",
+      "Deprecated in favor of `task brief` (preparation only) and `task run` (the full unattended loop) — kept for a documented compatibility window while callers migrate."
+    ],
+    status: "shipped"
+  },
+  {
+    name: "task brief",
+    description: "Render and freeze the brief as the Issue's original comment — preparation only, starts nobody",
+    details: [
+      "The preparation half of `task dispatch`, extracted so it is callable on its own: resolves the task's Issue, renders the brief, refuses on any gap, refuses when a frozen brief already exists, and posts it once as the same `aeg:brief:v1` Issue comment `task dispatch` posts. Starts no agent under any circumstances — there is no `--agent` flag here at all.",
+      "Successor to `task dispatch` for the preparation step; the full unattended run (preparation, then the developer, then the review loop) is `task run`."
+    ],
+    status: "shipped"
+  },
+  {
+    name: "task run",
+    description: "One command from a planned Issue to a reviewed pull request — exactly one developer started",
+    flags: [
+      {
+        flag: "--agent <claude|codex|gemini>",
+        description: "Vendor for the developer and both reviewers this run dispatches"
+      }
+    ],
+    details: [
+      "Composes `task brief`'s own preparation (`prepareTask`) with `dev-review-loop` (`devReviewLoop`) — nothing else. Preparation starts no agent; the loop's own round 1 reads the frozen brief off the Issue and is the only place a developer is ever dispatched from a fresh task, so exactly one developer is started by construction.",
+      "A brief already frozen on the Issue is reused, never re-posted — the second `task dispatch`/`task brief` call this composes around does not fail the whole run, it just skips straight to running the loop. A task whose Issue refuses preparation (a missing brief section, an unmet dispatch gate) is refused before any agent starts, with nothing posted.",
+      "Refuses when the frozen brief's developer branch already has an open pull request — the old `task dispatch` followed by `task run` cannot start two developers this way.",
+      "Exit and printed summary distinguish a published, reviewed pull request (exit `0`, the PR URL) from a pause (exit `1`, with the exact `vinaya dev-review-loop --resume <pr>` command to continue), a usage/argv error (exit `2`), and any other failure (exit `3`) — never sharing `1` with a pause, so an unattended host tells them apart from the exit code alone. A run that pauses is resumed with the loop's own existing `--resume <pr>` flag, never a flag on this command."
     ],
     status: "shipped"
   },
@@ -8174,6 +8341,15 @@ var COMMANDS = [
     ],
     status: "shipped"
   },
+  {
+    name: "milestone status",
+    description: "Print each of a Milestone's declared tranche intents with its derived lifecycle and issue counts",
+    flags: [{ flag: "--json", description: "Enveloped JSON output (schema: 1)" }],
+    details: [
+      "Read-only — writes nothing. For each `- <slug>: …` line in the Milestone's `### Tranche intents` section, prints the tranche's lifecycle (`planned`/`active`/`complete`) and its labeled Issues' counts (merged, open, not planned), all derived from the forge. Refuses if `<n>` isn't a real Milestone in this repo, or if the forge is unreachable."
+    ],
+    status: "shipped"
+  },
   {
     name: "review status",
     description: "Print the review loop's own state for a PR, and its branch's distance from the base",
@@ -8664,6 +8840,62 @@ function expandGlob(glob) {
 function sha256OfFile(path) {
   return createHash5("sha256").update(readFileSync9(path)).digest("hex");
 }
+function resolveRemoteDefaultBranch(cwd) {
+  let out;
+  try {
+    out = execFileSync9("git", ["ls-remote", "--symref", "origin", "HEAD"], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+  } catch {
+    return null;
+  }
+  const lines = out.split(`
+`);
+  const symrefLine = lines.find((l) => l.startsWith("ref:"));
+  const shaLine = lines.find((l) => !l.startsWith("ref:") && /\tHEAD$/.test(l));
+  const branch = symrefLine ? /^ref:\s*refs\/heads\/(\S+)/.exec(symrefLine)?.[1] : undefined;
+  const sha = shaLine?.split("\t")[0];
+  return branch && sha ? { branch, sha } : null;
+}
+function checkStaleAgainstRemote(headSha, resolveRemote = resolveRemoteDefaultBranch) {
+  const remote = resolveRemote();
+  if (!remote) {
+    return [
+      "the remote default branch could not be resolved (`git ls-remote origin HEAD` failed — offline?) — refusing rather than rendering from a checkout of unknown freshness."
+    ];
+  }
+  if (headSha !== remote.sha) {
+    return [
+      `checkout HEAD \`${headSha}\` is behind the remote default branch \`${remote.branch}\` at \`${remote.sha}\` — fetch and update before preparing a brief.`
+    ];
+  }
+  return [];
+}
+function checkDirtyPinnedFiles(pinnedPaths, cwd) {
+  if (pinnedPaths.length === 0)
+    return [];
+  let out;
+  try {
+    out = execFileSync9("git", ["status", "--porcelain", "--", ...pinnedPaths], {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+  } catch (err) {
+    return [
+      `could not check working-tree status for the brief's pinned files: ${err instanceof Error ? err.message : String(err)}`
+    ];
+  }
+  if (!out.trim())
+    return [];
+  const dirty = out.split(`
+`).filter((l) => l.length > 0).map((l) => l.slice(3).trim()).filter(Boolean);
+  return [
+    `checkout carries uncommitted changes to pinned file(s): ${dirty.join(", ")} — commit or discard them before preparing a brief.`
+  ];
+}
 function resolveBoundaryPaths(tokens, allTrackedFiles) {
   const trackedSet = new Set(allTrackedFiles);
   const resolved = new Set;
@@ -8716,6 +8948,10 @@ async function assembleAndRenderBrief(trancheSlug, taskId, surfaceGlobsOverride)
       missing: ["could not resolve owner/repo (set AEG_REPO=owner/repo, or confirm `git remote get-url origin`)."]
     };
   }
+  const headSha = git(["rev-parse", "HEAD"]);
+  const staleness = checkStaleAgainstRemote(headSha);
+  if (staleness.length > 0)
+    return { ok: false, missing: staleness };
   const source = createForgeSource({ owner: repo.owner, repo: repo.repo });
   let tranche;
   try {
@@ -8797,6 +9033,9 @@ async function assembleAndRenderBrief(trancheSlug, taskId, surfaceGlobsOverride)
 `).map((s) => s.trim()).filter(Boolean);
   const boundaryTokens = extractBoundaryFilePaths(rationale.boundary ?? "");
   const surfaceFiles = resolveBoundaryPaths(boundaryTokens, allTrackedFiles).sort().map((path) => ({ path, sha256: sha256OfFile(path), packageName: packageNameForPath(path) }));
+  const dirtiness = checkDirtyPinnedFiles(surfaceFiles.map((f) => f.path));
+  if (dirtiness.length > 0)
+    return { ok: false, missing: dirtiness };
   const workspaces = workspaceGlobs();
   const consumersOf = buildConsumersOf(workspaces, listDirs, readManifest);
   const partsResult = parseIssueParts(issueBody);
@@ -8826,7 +9065,8 @@ async function assembleAndRenderBrief(trancheSlug, taskId, surfaceGlobsOverride)
     dispatchBlockers: gate.blockers,
     surfaceFiles,
     consumersOf,
-    docOwnersContent: existsSync7(DOC_OWNERS_PATH2) ? readFileSync9(DOC_OWNERS_PATH2, "utf8") : null
+    docOwnersContent: existsSync7(DOC_OWNERS_PATH2) ? readFileSync9(DOC_OWNERS_PATH2, "utf8") : null,
+    sourceRevision: headSha
   };
   const template = readFileSync9(TEMPLATE_PATH, "utf8");
   const result = renderBrief(facts, template);
@@ -10563,6 +10803,27 @@ function log(e) {
 
 // src/lib/dispatch.ts
 import { dirname as dirname7, join as join14 } from "node:path";
+var ANSI_RESET = "\x1B[0m";
+var ROLE_ANSI = {
+  planner: "\x1B[34m",
+  developer: "\x1B[36m",
+  "code-reviewer": "\x1B[35m",
+  security: "\x1B[31m",
+  principal: "\x1B[33m",
+  archivist: "\x1B[32m",
+  architect: "\x1B[93m"
+};
+var LOOP_ANSI = "\x1B[90m";
+function colourEnabled(stream) {
+  return Boolean(stream.isTTY) && process.env.NO_COLOR === undefined;
+}
+function colourAgentLine(role, line, stream) {
+  const prefixed = `[${role}] ${line}`;
+  return colourEnabled(stream) ? `${ROLE_ANSI[role]}${prefixed}${ANSI_RESET}` : prefixed;
+}
+function colourLoopLine(line, stream) {
+  return colourEnabled(stream) ? `${LOOP_ANSI}${line}${ANSI_RESET}` : line;
+}
 var AGENT_VENDOR_NAMES = ["claude", "codex", "gemini"];
 function isAgentVendor2(value) {
   return AGENT_VENDOR_NAMES.includes(value);
@@ -10757,6 +11018,14 @@ function recordResumeState(record) {
     return null;
   }
 }
+function readResumeRecord(role, agent, repo, task, pr) {
+  try {
+    const path = resumeRecordPathFor(role, agent, repo, task, pr);
+    return JSON.parse(readFileSync14(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
 function renderClaudeEvent(obj) {
   const type = obj.type;
   if (type === "assistant" || type === "user") {
@@ -10929,6 +11198,10 @@ async function dispatchRole(role, agent, prompt2, opts) {
   const effectId = randomUUID2();
   const vendor = VENDOR_TABLE[agent];
   const start = Date.now();
+  const writeLifecycle = (msg) => {
+    process.stderr.write(`${colourLoopLine(msg, process.stderr)}
+`);
+  };
   const roundField = opts.round !== undefined ? { round: opts.round } : {};
   const resolvedModel = opts.model !== undefined ? `requested:${opts.model}` : "default";
   if (opts.model !== undefined) {
@@ -10948,8 +11221,7 @@ async function dispatchRole(role, agent, prompt2, opts) {
         usage: null,
         duration_ms: durationMs
       });
-      process.stderr.write(`[vinaya dispatch ${effectId}] ${role} via ${agent}: refused — model '${opts.model}' is a ${foreignVendor} model; ` + `${agent} does not accept it. ${agent} accepts its own model names (never a ${foreignVendor} alias or a ` + `'${foreignVendor}-'/'gemma-' full name).
-`);
+      writeLifecycle(`[vinaya dispatch ${effectId}] ${role} via ${agent}: refused — model '${opts.model}' is a ${foreignVendor} model; ` + `${agent} does not accept it. ${agent} accepts its own model names (never a ${foreignVendor} alias or a ` + `'${foreignVendor}-'/'gemma-' full name).`);
       await waitForDispatchLine(outboxPath, priorSize, runId, effectId, "dispatch_failed");
       return { exitCode: null, durationMs, usage: null, resumeId: null, timedOut: false, failureReason: "refused" };
     }
@@ -11006,8 +11278,7 @@ async function dispatchRole(role, agent, prompt2, opts) {
     const MAX_STDOUT_BYTES = 1e6;
     const outputTee = openOutputTee(effectId);
     if (outputTee.path !== null) {
-      process.stderr.write(`[vinaya dispatch ${effectId}] ${role} via ${agent}: output teed to ${outputTee.path}
-`);
+      writeLifecycle(`[vinaya dispatch ${effectId}] ${role} via ${agent}: output teed to ${outputTee.path}`);
     }
     let renderCarry = "";
     child.stdout.on("data", (chunk) => {
@@ -11023,9 +11294,13 @@ async function dispatchRole(role, agent, prompt2, opts) {
           continue;
         try {
           const rendered = vendor.renderEvent(JSON.parse(line));
-          if (rendered)
-            process.stderr.write(`${rendered}
+          if (rendered) {
+            const out = rendered.split(`
+`).map((l) => colourAgentLine(role, l, process.stderr)).join(`
+`);
+            process.stderr.write(`${out}
 `);
+          }
         } catch {}
       }
     });
@@ -11034,22 +11309,18 @@ async function dispatchRole(role, agent, prompt2, opts) {
     });
     const heartbeatTimer = setInterval(() => {
       const elapsedS = Math.round((Date.now() - start) / 1000);
-      process.stderr.write(`[vinaya dispatch ${effectId}] ${role} via ${agent}: still running — ${elapsedS}s elapsed (ceiling ${Math.round(timeoutMs / 1000)}s)
-`);
+      writeLifecycle(`[vinaya dispatch ${effectId}] ${role} via ${agent}: still running — ${elapsedS}s elapsed (ceiling ${Math.round(timeoutMs / 1000)}s)`);
     }, HEARTBEAT_INTERVAL_MS);
     const warnLeadMs = timeoutWarningLeadMs(timeoutMs);
     const warnTimer = setTimeout(() => {
-      process.stderr.write(`[vinaya dispatch ${effectId}] ${role} via ${agent}: approaching timeout — SIGTERM in ~${Math.round(warnLeadMs / 1000)}s unless it finishes first
-`);
+      writeLifecycle(`[vinaya dispatch ${effectId}] ${role} via ${agent}: approaching timeout — SIGTERM in ~${Math.round(warnLeadMs / 1000)}s unless it finishes first`);
     }, Math.max(timeoutMs - warnLeadMs, 0));
     const timeoutTimer = setTimeout(() => {
       timedOut = true;
-      process.stderr.write(`[vinaya dispatch ${effectId}] ${role} via ${agent}: ceiling reached — sending SIGTERM
-`);
+      writeLifecycle(`[vinaya dispatch ${effectId}] ${role} via ${agent}: ceiling reached — sending SIGTERM`);
       child.kill("SIGTERM");
       killTimer = setTimeout(() => {
-        process.stderr.write(`[vinaya dispatch ${effectId}] ${role} via ${agent}: still alive after SIGTERM — sending SIGKILL
-`);
+        writeLifecycle(`[vinaya dispatch ${effectId}] ${role} via ${agent}: still alive after SIGTERM — sending SIGKILL`);
         child.kill("SIGKILL");
       }, SIGKILL_GRACE_MS);
     }, timeoutMs);
@@ -11134,8 +11405,7 @@ async function dispatchRole(role, agent, prompt2, opts) {
           capturedAt: new Date().toISOString()
         });
         if (resumeRecordPath !== null) {
-          process.stderr.write(`[vinaya dispatch ${effectId}] ${role} via ${agent}: resumable — session recorded at ${resumeRecordPath}
-`);
+          writeLifecycle(`[vinaya dispatch ${effectId}] ${role} via ${agent}: resumable — session recorded at ${resumeRecordPath}`);
         }
       }
       const reportedModel = vendor.parseModel(stdoutBuf);
@@ -11161,10 +11431,10 @@ async function dispatchRole(role, agent, prompt2, opts) {
 
 // src/lib/dev-review-loop.ts
 import { randomUUID as randomUUID3 } from "node:crypto";
-import { execFileSync as execFileSync17 } from "node:child_process";
-import { mkdirSync as mkdirSync5, mkdtempSync as mkdtempSync3, readFileSync as readFileSync17, rmSync as rmSync6, unlinkSync as unlinkSync2, writeFileSync as writeFileSync9 } from "node:fs";
-import { tmpdir as tmpdir4 } from "node:os";
-import { dirname as dirname8, join as join18 } from "node:path";
+import { execFileSync as execFileSync16 } from "node:child_process";
+import { existsSync as existsSync13, mkdirSync as mkdirSync5, mkdtempSync as mkdtempSync2, readFileSync as readFileSync17, rmSync as rmSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync8 } from "node:fs";
+import { tmpdir as tmpdir3 } from "node:os";
+import { dirname as dirname8, join as join17 } from "node:path";
 
 // src/commands/review-post.ts
 import { execFileSync as execFileSync15 } from "node:child_process";
@@ -11494,6 +11764,15 @@ function readProjectPaths(root = repoRoot()) {
     return [];
   }
 }
+function readDocOwnersContent(root = repoRoot()) {
+  if (!root)
+    return null;
+  try {
+    return readFileSync15(join15(root, DOC_OWNERS_PATH), "utf8");
+  } catch {
+    return null;
+  }
+}
 var CHECK_ISSUE_CONTENT = "issue-content";
 var ISSUE_CONTENT_RECOVERY = {
   blastRadius: "Add a second registered `Project(s)` this task also touches, or a `blast-radius-ack: <why one lens is enough>` line, then re-run `{cmd}`.",
@@ -11501,7 +11780,8 @@ var ISSUE_CONTENT_RECOVERY = {
   rationaleNamesDocs: 'Name a concrete doc/skill path (e.g. `aeg-root/…`, `.claude/skills/…/SKILL.md`) in "Docs to keep coherent" or "Traps", or write the `no-doc-surface` sentinel if the surface genuinely has none, then re-run `{cmd}`.',
   surfaceGlobsResolve: "Fix the named `## Surface` `in:` glob so it matches at least one real tracked file (a typo, or a directory that does not exist yet), then re-run `{cmd}`.",
   partsCiteObjectives: "Fix the named Part to cite an objective id the `## Objectives` section actually defines, or add the missing objective, then re-run `{cmd}`.",
-  docsWithinSurface: 'Move the named doc pointer to a path `## Surface`\'s `in:` globs actually cover (never widen the surface just to fit the pointer — that renders an unusable brief), or drop it from "Docs to keep coherent" if this task does not really keep it coherent, then re-run `{cmd}`.'
+  docsWithinSurface: 'Move the named doc pointer to a path `## Surface`\'s `in:` globs actually cover (never widen the surface just to fit the pointer — that renders an unusable brief), or drop it from "Docs to keep coherent" if this task does not really keep it coherent, then re-run `{cmd}`.',
+  surfaceExcludesBoundDoc: "Either move the named `out:` glob so it no longer covers the bound document, or narrow the `in:` glob so it no longer reaches the doc-owners binding — the Issue cannot declare both at once. Then re-run `{cmd}`."
 };
 function validateIssueContent(input) {
   const findings = [
@@ -11513,7 +11793,8 @@ function validateIssueContent(input) {
     [checkRationaleNamesDocs(input.body).errors, "rationaleNamesDocs"],
     [checkSurfaceGlobsResolve(input.body, input.resolvesToFile).errors, "surfaceGlobsResolve"],
     [checkPartsCiteDefinedObjectives(input.body).errors, "partsCiteObjectives"],
-    [checkDocsWithinSurface(input.body, input.issueNumber).errors, "docsWithinSurface"]
+    [checkDocsWithinSurface(input.body, input.issueNumber).errors, "docsWithinSurface"],
+    [checkSurfaceExcludesBoundDoc(input.body, input.docOwnersContent).errors, "surfaceExcludesBoundDoc"]
   ];
   const errors = [];
   for (const [messages, kind] of findings) {
@@ -11587,7 +11868,8 @@ function validateTaskIssue(body, title, labels, retryCommand, issueNumber) {
     projectPaths: readProjectPaths(),
     retryCommand,
     issueNumber,
-    resolvesToFile: (glob) => expandGlob(glob).length > 0
+    resolvesToFile: (glob) => expandGlob(glob).length > 0,
+    docOwnersContent: readDocOwnersContent()
   });
   if (contentErrors.length > 0)
     refuse2(contentErrors);
@@ -11707,14 +11989,14 @@ function renderFindingsSection(findings) {
 class ObjectivesParseError extends Error {
 }
 var OBJECTIVE_ID_ONLY = /^O\d+$/;
-var STRUCTURAL_MARKER_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?(?:VERDICT|Judged head|Objectives version):/i;
+var STRUCTURAL_MARKER_PATTERN = /^[ \t]*(?:\*{1,3}|_{1,3})?(?:VERDICT|Judged head|Objectives version|Ruling ordinal):/i;
 function invalidObjectiveEvidenceReason(evidence) {
   if (evidence.includes(`
 `)) {
     return "evidence contains a newline — each objective renders as exactly one line";
   }
   if (STRUCTURAL_MARKER_PATTERN.test(evidence)) {
-    return "evidence looks like a VERDICT:/Judged head:/Objectives version: line, which would corrupt the rendered comment's structural markers";
+    return "evidence looks like a VERDICT:/Judged head:/Objectives version:/Ruling ordinal: line, which would corrupt the rendered comment's structural markers";
   }
   return null;
 }
@@ -11797,6 +12079,7 @@ function renderCodeReviewComment(input) {
   if (input.objectivesVersion !== null) {
     lines.push(`Objectives version: ${input.objectivesVersion}`, "");
   }
+  lines.push(`Ruling ordinal: ${input.rulingOrdinal}`, "");
   if (input.scopeEvidence !== null) {
     lines.push("```", input.scopeEvidence, "```", "");
   }
@@ -11820,6 +12103,7 @@ function renderSecurityComment(input) {
   if (input.objectivesVersion !== null) {
     lines.push(`Objectives version: ${input.objectivesVersion}`, "");
   }
+  lines.push(`Ruling ordinal: ${input.rulingOrdinal}`, "");
   lines.push("FINDINGS (ordered by severity):", renderFindingsSection(sorted), "");
   if (input.objectiveResults !== null) {
     lines.push(renderObjectivesBlock(input.objectiveResults), "");
@@ -11900,6 +12184,7 @@ function renderEscalationComment(input) {
   if (input.objectivesVersion !== null) {
     lines.push(`Objectives version: ${input.objectivesVersion}`, "");
   }
+  lines.push(`Ruling ordinal: ${input.rulingOrdinal}`, "");
   lines.push(input.summary, "", renderTokensLine(input.role, input.roleLabel, input), renderCastByLine(input.roleLabel, input.sessionId));
   return lines.join(`
 `);
@@ -11909,7 +12194,7 @@ function isBoundToHead(extraction, headSha) {
     return false;
   return headSha.toLowerCase().startsWith(extraction.headSha.toLowerCase());
 }
-function checkExtraction(extraction, expectedValue, headSha, expectedObjectivesVersion) {
+function checkExtraction(extraction, expectedValue, headSha, expectedObjectivesVersion, expectedRulingOrdinal) {
   if (extraction.danglingNote) {
     return {
       ok: false,
@@ -11937,6 +12222,12 @@ function checkExtraction(extraction, expectedValue, headSha, expectedObjectivesV
       reason: `re-extraction found objectives version ${extraction.objectivesVersion ?? "none"}, expected ${expectedObjectivesVersion ?? "none"} — the posted comment's Objectives version: line does not match what this command rendered.`
     };
   }
+  if (extraction.rulingOrdinal !== expectedRulingOrdinal) {
+    return {
+      ok: false,
+      reason: `re-extraction found ruling ordinal ${extraction.rulingOrdinal ?? "none"}, expected ${expectedRulingOrdinal} — the posted comment's Ruling ordinal: line does not match what this command rendered.`
+    };
+  }
   return { ok: true, reason: "clean" };
 }
 function principalBodies(comments, principalAllowlist) {
@@ -11952,14 +12243,14 @@ function checkNoCrossRoleVerdict(postedBody, crossExtract, crossRoleLabel) {
   }
   return null;
 }
-function verifyPostedCodeReview(comments, verdict, headSha, principalAllowlist, postedBody, objectivesVersion2) {
-  const own = checkExtraction(extractCodeReviewVerdict(principalBodies(comments, principalAllowlist)), CODE_REVIEW_VERDICT_TEXT[verdict], headSha, objectivesVersion2);
+function verifyPostedCodeReview(comments, verdict, headSha, principalAllowlist, postedBody, objectivesVersion2, rulingOrdinal) {
+  const own = checkExtraction(extractCodeReviewVerdict(principalBodies(comments, principalAllowlist)), CODE_REVIEW_VERDICT_TEXT[verdict], headSha, objectivesVersion2, rulingOrdinal);
   if (!own.ok)
     return own;
   return checkNoCrossRoleVerdict(postedBody, extractSecurityReviewVerdict, "security") ?? own;
 }
-function verifyPostedSecurity(comments, verdict, headSha, principalAllowlist, postedBody, objectivesVersion2) {
-  const own = checkExtraction(extractSecurityReviewVerdict(principalBodies(comments, principalAllowlist)), verdict, headSha, objectivesVersion2);
+function verifyPostedSecurity(comments, verdict, headSha, principalAllowlist, postedBody, objectivesVersion2, rulingOrdinal) {
+  const own = checkExtraction(extractSecurityReviewVerdict(principalBodies(comments, principalAllowlist)), verdict, headSha, objectivesVersion2, rulingOrdinal);
   if (!own.ok)
     return own;
   return checkNoCrossRoleVerdict(postedBody, extractCodeReviewVerdict, "code-review") ?? own;
@@ -12199,32 +12490,39 @@ function fetchIssueBodyForObjectives(issue) {
 function resolveObjectivesForPr(pr) {
   const prBody = fetchPrBody(pr);
   const { issue } = extractIssue(prBody);
-  if (issue !== null && issue < OBJECTIVES_SINCE_ISSUE)
+  const source = resolveObjectivesSource(prBody, issue, OBJECTIVES_SINCE_ISSUE);
+  if (source.kind === "none")
     return { kind: "skip" };
-  if (issue !== null) {
+  if (source.kind === "issue") {
     let issueBody;
     try {
-      issueBody = fetchIssueBodyForObjectives(issue);
+      issueBody = fetchIssueBodyForObjectives(source.issue);
     } catch (err) {
       if (isIssueNotFoundError(err)) {
-        refuseCmd(`Issue #${issue} does not resolve via \`gh issue view\` — no objectives to judge against.`, "Confirm the Issue exists, or fix `Closes #N` in the PR body, then re-run.");
+        refuseCmd(`Issue #${source.issue} does not resolve via \`gh issue view\` — no objectives to judge against.`, "Confirm the Issue exists, or fix `Closes #N` in the PR body, then re-run.");
       }
-      refuseCmd(`Could not fetch Issue #${issue}'s body via \`gh issue view\` to resolve its objectives — no objectives to judge against: ${err instanceof Error ? err.message : String(err)}`, "Confirm `gh auth status` passes, then re-run.");
+      refuseCmd(`Could not fetch Issue #${source.issue}'s body via \`gh issue view\` to resolve its objectives — no objectives to judge against: ${err instanceof Error ? err.message : String(err)}`, "Confirm `gh auth status` passes, then re-run.");
     }
-    const parsed = objectivesOf(issueBody);
-    if (!parsed.ok) {
-      refuseCmd(`Issue #${issue}'s \`## Objectives\` section does not parse (${parsed.errors.join("; ")}) — no objectives to judge against.`, "Fix the Issue body, then re-run.");
+    const parsed2 = objectivesOf(issueBody);
+    if (!parsed2.ok) {
+      refuseCmd(`Issue #${source.issue}'s \`## Objectives\` section does not parse (${parsed2.errors.join("; ")}) — no objectives to judge against.`, "Fix the Issue body, then re-run.");
     }
-    return { kind: "list", objectives: parsed.objectives, version: objectivesVersion(parsed.objectives) };
+    return { kind: "list", objectives: parsed2.objectives, version: objectivesVersion(parsed2.objectives) };
   }
-  if (hasObjectivesHeading(prBody)) {
-    const parsed = objectivesOf(prBody);
-    if (!parsed.ok) {
-      refuseCmd(`This PR body's own \`## Objectives\` section does not parse (${parsed.errors.join("; ")}) — no objectives to judge against.`, "Fix the PR body's Objectives section, then re-run.");
-    }
-    return { kind: "list", objectives: parsed.objectives, version: objectivesVersion(parsed.objectives) };
+  const parsed = objectivesOf(prBody);
+  if (!parsed.ok) {
+    refuseCmd(`This PR body's own \`## Objectives\` section does not parse (${parsed.errors.join("; ")}) — no objectives to judge against.`, "Fix the PR body's Objectives section, then re-run.");
+  }
+  return { kind: "list", objectives: parsed.objectives, version: objectivesVersion(parsed.objectives) };
+}
+function resolveRulingOrdinalForPr(pr) {
+  let comments;
+  try {
+    comments = fetchComments(pr);
+  } catch (err) {
+    refuseCmd(`Could not fetch PR ${pr}'s comments via \`gh pr view --json comments\` to resolve the newest ruling ordinal: ${err instanceof Error ? err.message : String(err)}`, "Confirm `gh auth status` passes, then re-run.");
   }
-  refuseCmd("no objectives to judge against — this PR closes no Issue and its body carries no `## Objectives` section.", "Add `Closes #N` pointing at an Issue with an `## Objectives` list, or add a `## Objectives` section to the PR body, then re-run.");
+  return newestPrincipalRulingOrdinal(comments, resolvePrincipalAllowlist(loadTrustAnchorConfig()));
 }
 function readObjectivesFile(path) {
   if (path.trim() === "") {
@@ -12248,7 +12546,7 @@ function readObjectivesFile(path) {
 function resolveObjectiveResultsForCommand(resolution, objectivesFileRaw) {
   if (resolution.kind === "skip") {
     if (objectivesFileRaw !== undefined) {
-      refuseCmd("`--objectives-file` was given, but no objectives to judge against exist for this PR (its Issue predates the objectives cutover).", "Drop `--objectives-file` for this PR, or judge against a post-cutover Issue.");
+      refuseCmd("`--objectives-file` was given, but no objectives to judge against exist for this PR (either its Issue predates the objectives cutover, or it closes no Issue and its body carries no `## Objectives` section).", "Drop `--objectives-file` for this PR, judge against a post-cutover Issue, or add a `## Objectives` section to the PR body.");
     }
     return { objectivesVersion: null, objectiveResults: null };
   }
@@ -12437,6 +12735,7 @@ async function reviewPostCommand(args) {
     const headSha2 = resolveHeadSha(pr);
     const escalationObjectivesResolution = resolveObjectivesForPr(pr);
     const escalationObjectivesVersion = escalationObjectivesResolution.kind === "list" ? escalationObjectivesResolution.version : null;
+    const escalationRulingOrdinal = resolveRulingOrdinalForPr(pr);
     const body2 = renderEscalationComment({
       ...tokens,
       headSha: headSha2,
@@ -12444,7 +12743,8 @@ async function reviewPostCommand(args) {
       summary,
       role: tokensRole,
       roleLabel,
-      objectivesVersion: escalationObjectivesVersion
+      objectivesVersion: escalationObjectivesVersion,
+      rulingOrdinal: escalationRulingOrdinal
     });
     checkRenderedCommentOrRefuse(body2, { kind: "escalation" });
     if (printOnly) {
@@ -12502,6 +12802,7 @@ Self-verification: clean — no verdict extracted.
     const objectivesResolution2 = resolveObjectivesForPr(pr);
     const { objectivesVersion: resolvedObjectivesVersion2, objectiveResults: objectiveResults2 } = resolveObjectiveResultsForCommand(objectivesResolution2, flags.get("--objectives-file"));
     refuseIfCleanVerdictHasNotMetObjective(isCleanVerdict(verdict2), "APPROVE", objectiveResults2);
+    const resolvedRulingOrdinal2 = resolveRulingOrdinalForPr(pr);
     let comments2;
     try {
       comments2 = fetchComments(pr);
@@ -12521,7 +12822,8 @@ Self-verification: clean — no verdict extracted.
       tests,
       docs,
       objectivesVersion: resolvedObjectivesVersion2,
-      objectiveResults: objectiveResults2
+      objectiveResults: objectiveResults2,
+      rulingOrdinal: resolvedRulingOrdinal2
     };
     const body2 = renderCodeReviewComment(input2);
     checkRenderedCommentOrRefuse(body2, { kind: "code-review", verdict: verdict2 });
@@ -12536,7 +12838,7 @@ Self-verification: clean — no verdict extracted.
     } catch (err) {
       refuseCmd(`Posted the comment (${url2}) but could not re-fetch PR ${pr}'s comments to self-verify: ${err instanceof Error ? err.message : String(err)}`, "Check `gh auth status`/network and manually confirm the posted comment parses cleanly — this command could not verify it.");
     }
-    const result2 = verifyPostedCodeReview(postComments2, verdict2, headSha2, principalAllowlist2, body2, resolvedObjectivesVersion2);
+    const result2 = verifyPostedCodeReview(postComments2, verdict2, headSha2, principalAllowlist2, body2, resolvedObjectivesVersion2, resolvedRulingOrdinal2);
     if (!result2.ok) {
       refuseCmd(`Posted comment ${url2}, but self-verification FAILED on re-parse: ${result2.reason}`, "The posted comment does not re-parse clean through the same extractCodeReviewVerdict/extractSecurityReviewVerdict functions the merge gate calls. Do not treat the post as valid — inspect the comment and this command for drift, fix, and re-run.");
     }
@@ -12579,6 +12881,7 @@ Self-verification: clean — re-parsed VERDICT is bound to head ${headSha2}.
   const objectivesResolution = resolveObjectivesForPr(pr);
   const { objectivesVersion: resolvedObjectivesVersion, objectiveResults } = resolveObjectiveResultsForCommand(objectivesResolution, flags.get("--objectives-file"));
   refuseIfCleanVerdictHasNotMetObjective(isCleanVerdict(verdict), "PASS", objectiveResults);
+  const resolvedRulingOrdinal = resolveRulingOrdinalForPr(pr);
   let comments;
   try {
     comments = fetchComments(pr);
@@ -12595,7 +12898,8 @@ Self-verification: clean — re-parsed VERDICT is bound to head ${headSha2}.
     secrets,
     secretsEvidence,
     objectivesVersion: resolvedObjectivesVersion,
-    objectiveResults
+    objectiveResults,
+    rulingOrdinal: resolvedRulingOrdinal
   };
   const body = renderSecurityComment(input);
   checkRenderedCommentOrRefuse(body, { kind: "security", verdict });
@@ -12610,7 +12914,7 @@ Self-verification: clean — re-parsed VERDICT is bound to head ${headSha2}.
   } catch (err) {
     refuseCmd(`Posted the comment (${url}) but could not re-fetch PR ${pr}'s comments to self-verify: ${err instanceof Error ? err.message : String(err)}`, "Check `gh auth status`/network and manually confirm the posted comment parses cleanly — this command could not verify it.");
   }
-  const result = verifyPostedSecurity(postComments, verdict, headSha, principalAllowlist, body, resolvedObjectivesVersion);
+  const result = verifyPostedSecurity(postComments, verdict, headSha, principalAllowlist, body, resolvedObjectivesVersion, resolvedRulingOrdinal);
   if (!result.ok) {
     refuseCmd(`Posted comment ${url}, but self-verification FAILED on re-parse: ${result.reason}`, "The posted comment does not re-parse clean through the same extractCodeReviewVerdict/extractSecurityReviewVerdict functions the merge gate calls. Do not treat the post as valid — inspect the comment and this command for drift, fix, and re-run.");
   }
@@ -12625,244 +12929,125 @@ Self-verification: clean — re-parsed VERDICT is bound to head ${headSha}.
   }
 }
 
-// src/lib/dispatch-task.ts
-import { execFileSync as execFileSync16 } from "node:child_process";
-import { createHash as createHash7 } from "node:crypto";
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "node:fs";
-import { tmpdir as tmpdir3 } from "node:os";
-import { join as join17 } from "node:path";
-var DISPATCH_AGENTS = ["claude", "codex", "gemini"];
+// src/lib/review-gate-check-name.ts
+var REVIEW_GATE_CHECK_RUN_NAME = "vinaya review gate";
 
-class DispatchTaskError extends Error {
-}
+// src/lib/dev-review-loop.ts
 function sh3(cmd, args) {
   return execFileSync16(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
-function briefHash(brief) {
-  return createHash7("sha256").update(`${brief}
-`).digest("hex");
-}
-function fetchIssueComments(n) {
+function resolveHead(branch) {
   let out;
   try {
-    out = sh3("gh", ["issue", "view", String(n), "--json", "comments"]);
+    out = sh3("git", ["ls-remote", "origin", `refs/heads/${branch}`]);
   } catch (err) {
-    throw new DispatchTaskError(`could not fetch Issue #${n}'s comments (\`gh issue view\`) to check for an existing brief — refusing rather than risking a duplicate: ${err instanceof Error ? err.message : String(err)}`);
+    throw new Error(`resolveHead: \`git ls-remote origin refs/heads/${branch}\` failed: ${err instanceof Error ? err.message : String(err)}`);
   }
+  const sha = out.split(/\s+/)[0] ?? "";
+  if (!sha)
+    throw new Error(`resolveHead: branch \`${branch}\` has no head on \`origin\` (empty ls-remote output).`);
+  return sha;
+}
+function fetchMechanicalCheckRuns(headSha) {
+  let out;
   try {
-    return JSON.parse(out).comments;
+    out = sh3("gh", [
+      "api",
+      `repos/{owner}/{repo}/commits/${headSha}/check-runs`,
+      "--paginate",
+      "--jq",
+      ".check_runs[] | {id, name, status, conclusion}"
+    ]);
   } catch {
-    throw new DispatchTaskError(`could not parse \`gh issue view ${n} --json comments\` output.`);
+    return null;
   }
-}
-function fetchIssueBody(n) {
-  try {
-    return JSON.parse(sh3("gh", ["issue", "view", String(n), "--json", "body"])).body;
-  } catch (err) {
-    throw new DispatchTaskError(`could not fetch Issue #${n}'s body (\`gh issue view\`) to resolve its suggested agent-class: ${err instanceof Error ? err.message : String(err)}`);
+  const runs = out.split(`
+`).filter((l) => l.trim().length > 0).map((l) => JSON.parse(l));
+  const latestByName = new Map;
+  for (const run2 of runs) {
+    const seen = latestByName.get(run2.name);
+    if (!seen || run2.id > seen.id)
+      latestByName.set(run2.name, run2);
   }
+  return Array.from(latestByName.values()).filter((r) => r.name !== REVIEW_GATE_CHECK_RUN_NAME);
 }
-function extractAgentClass(rawRationaleField) {
-  const m = /agent-class\**\s*[—–-]\s*(\w+)/i.exec(rawRationaleField);
-  const word = m?.[1]?.toLowerCase();
-  return word !== undefined && isAgentClass(word) ? word : null;
+function fetchCiConclusion(headSha) {
+  const latest = fetchMechanicalCheckRuns(headSha);
+  if (latest === null || latest.length === 0)
+    return "pending";
+  if (latest.some((r) => r.status !== "completed"))
+    return "pending";
+  if (latest.every((r) => r.conclusion === "success" || r.conclusion === "neutral" || r.conclusion === "skipped")) {
+    return "green";
+  }
+  return "red";
 }
-function resolveModelFromRationale(agent, rawRationaleField, explicitModel) {
-  if (explicitModel !== undefined)
-    return explicitModel;
-  const agentClass = rawRationaleField !== undefined ? extractAgentClass(rawRationaleField) : null;
-  if (agentClass === null)
-    return;
-  return resolveClassModel(agent, agentClass) ?? undefined;
+function fetchFailingCheckNames(headSha) {
+  const latest = fetchMechanicalCheckRuns(headSha);
+  if (latest === null)
+    return [];
+  return latest.filter((r) => r.status === "completed").filter((r) => r.conclusion !== "success" && r.conclusion !== "neutral" && r.conclusion !== "skipped").map((r) => r.name);
 }
-function resolveModelForDispatch(agent, issue, explicitModel) {
-  if (explicitModel !== undefined)
-    return explicitModel;
-  const raw = parseRationaleFields(fetchIssueBody(issue)).suggestedAgentClass;
-  return resolveModelFromRationale(agent, raw, undefined);
+var RULING_MARKER = /^<!-- aeg:principal:ruling:\d+-\d+ -->$/;
+function contentAfterOneLine(body) {
+  const idx = body.indexOf(`
+`);
+  return idx === -1 ? "" : body.slice(idx + 1);
 }
-function findExistingV1Comment(n) {
-  return fetchIssueComments(n).find((c) => c.body.split(`
-`)[0] === AEG_BRIEF_V1_MARKER) ?? null;
+function markerComments(raw) {
+  const parsed = JSON.parse(raw);
+  return parsed.comments.map((c) => ({ body: c.body, author: c.author?.login ?? null }));
 }
-async function resolveDispatchRole() {
-  const dispatchModulePath = "./dispatch.js";
-  try {
-    const mod = await import(dispatchModulePath);
-    return typeof mod.dispatchRole === "function" ? mod.dispatchRole : null;
-  } catch {
-    return null;
-  }
-}
-function printManualDispatchInstruction(tranche, n, agent) {
-  process.stdout.write(`
-vinaya task dispatch: \`dispatchRole\` is not available yet (apps/cli/src/lib/dispatch.ts has no such export) — the brief above is posted; start the developer yourself:
-
-` + `  vinaya dispatch developer --agent ${agent} --tranche ${tranche} --task ${n}
-
-Once \`dispatchRole\` ships, the same \`--agent\` flag on \`task dispatch\` will start it automatically.
-`);
-}
-async function withPromptFile(prompt2, fn) {
-  const dir = mkdtempSync2(join17(tmpdir3(), "vinaya-dispatch-prompt-"));
-  const promptFile = join17(dir, "prompt.md");
-  writeFileSync8(promptFile, prompt2, "utf8");
-  try {
-    return await fn(promptFile);
-  } finally {
-    rmSync5(dir, { recursive: true, force: true });
-  }
-}
-function resolveDispatchAuthorization() {
-  const login = currentGhLogin();
-  const allowlist = resolvePrincipalAllowlist(loadTrustAnchorConfig());
-  return { authorized: login !== null && isPrincipal(login, allowlist), login };
-}
-var defaultDeps2 = {
-  assembleAndRenderBrief,
-  findExistingV1Comment,
-  postMarkedComment,
-  resolveDispatchRole,
-  resolveDispatchAuthorization,
-  resolveModelForDispatch
-};
-async function dispatchTask(input, deps = defaultDeps2) {
-  const { tranche, n, agent, model } = input;
-  {
-    const { authorized, login } = deps.resolveDispatchAuthorization();
-    if (!authorized) {
-      throw new DispatchTaskError(login === null ? "could not resolve the identity `gh` is authenticated as — `task dispatch` is Principal-only and refuses rather than proceeding with an unverified actor." : `\`${login}\` is not on the Principal allowlist — \`task dispatch\` is Principal-only.`);
-    }
-  }
-  const result = await deps.assembleAndRenderBrief(tranche, String(n));
-  if (!result.ok) {
-    throw new DispatchTaskError(`cannot dispatch — brief render refused:
-${result.missing.map((m) => `  - ${m}`).join(`
-`)}`);
-  }
-  const issue = result.issue;
-  const existing = deps.findExistingV1Comment(issue);
-  if (existing) {
-    throw new DispatchTaskError(`Task ${n} in tranche \`${tranche}\` is already dispatched — see ${existing.url}`);
-  }
-  let dispatchRole2 = null;
-  let resolvedModel;
-  if (agent) {
-    dispatchRole2 = await deps.resolveDispatchRole();
-    if (dispatchRole2) {
-      resolvedModel = deps.resolveModelForDispatch(agent, issue, model);
-    }
-  }
-  const hash = briefHash(result.brief);
-  const commentBody = `Brief hash: ${hash}
-${result.brief}`;
-  const url = deps.postMarkedComment("issue", String(issue), AEG_BRIEF_V1_MARKER, commentBody);
-  if (agent) {
-    if (dispatchRole2) {
-      await withPromptFile(result.brief, (promptFile) => dispatchRole2("developer", agent, result.brief, {
-        task: issue,
-        promptFile,
-        model: resolvedModel
-      }));
-    } else {
-      printManualDispatchInstruction(tranche, n, agent);
-    }
-  }
-  return { posted: true, commentUrl: url, brief: result.brief };
-}
-
-// src/lib/dev-review-loop.ts
-function sh4(cmd, args) {
-  return execFileSync17(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
-}
-function resolveHead(branch) {
-  let out;
-  try {
-    out = sh4("git", ["ls-remote", "origin", `refs/heads/${branch}`]);
-  } catch (err) {
-    throw new Error(`resolveHead: \`git ls-remote origin refs/heads/${branch}\` failed: ${err instanceof Error ? err.message : String(err)}`);
-  }
-  const sha = out.split(/\s+/)[0] ?? "";
-  if (!sha)
-    throw new Error(`resolveHead: branch \`${branch}\` has no head on \`origin\` (empty ls-remote output).`);
-  return sha;
-}
-function fetchCiConclusion(headSha) {
-  let out;
-  try {
-    out = sh4("gh", [
-      "api",
-      `repos/{owner}/{repo}/commits/${headSha}/check-runs`,
-      "--paginate",
-      "--jq",
-      ".check_runs[] | {id, name, status, conclusion}"
-    ]);
-  } catch {
-    return "pending";
-  }
-  const runs = out.split(`
-`).filter((l) => l.trim().length > 0).map((l) => JSON.parse(l));
-  if (runs.length === 0)
-    return "pending";
-  const latestByName = new Map;
-  for (const run2 of runs) {
-    const seen = latestByName.get(run2.name);
-    if (!seen || run2.id > seen.id)
-      latestByName.set(run2.name, run2);
-  }
-  const latest = Array.from(latestByName.values());
-  if (latest.some((r) => r.status !== "completed"))
-    return "pending";
-  if (latest.every((r) => r.conclusion === "success" || r.conclusion === "neutral" || r.conclusion === "skipped")) {
-    return "green";
-  }
-  return "red";
-}
-var RULING_MARKER = /^<!-- aeg:principal:ruling:\d+-\d+ -->$/;
-function contentAfterOneLine(body) {
-  const idx = body.indexOf(`
-`);
-  return idx === -1 ? "" : body.slice(idx + 1);
-}
-function markerComments(raw) {
-  const parsed = JSON.parse(raw);
-  return parsed.comments.map((c) => ({ body: c.body, author: c.author?.login ?? null }));
-}
-function principalAllowlist() {
-  return resolvePrincipalAllowlist(loadTrustAnchorConfig());
+function principalAllowlist() {
+  return resolvePrincipalAllowlist(loadTrustAnchorConfig());
 }
 function filterPrincipalRulings(comments, allowlist) {
   return comments.filter((c) => isPrincipal(c.author, allowlist)).filter((c) => RULING_MARKER.test(c.body.split(`
 `)[0] ?? "")).map((c) => contentAfterOneLine(c.body).trim());
 }
 function findPrincipalFrozenBrief(comments, allowlist) {
-  return comments.find((c) => c.body.split(`
-`)[0] === AEG_BRIEF_V1_MARKER && isPrincipal(c.author, allowlist)) ?? null;
+  return resolveNewestFrozenBrief(comments, allowlist);
 }
 function fetchRulings(prNumber) {
   let out;
   try {
-    out = sh4("gh", ["pr", "view", String(prNumber), "--json", "comments"]);
+    out = sh3("gh", ["pr", "view", String(prNumber), "--json", "comments"]);
   } catch (err) {
     throw new Error(`fetchRulings: could not fetch PR #${prNumber}'s comments: ${err instanceof Error ? err.message : String(err)}`);
   }
   return filterPrincipalRulings(markerComments(out), principalAllowlist());
 }
-function fetchFrozenBrief(issueNumber) {
+function fetchNewestRulingOrdinal(prNumber) {
+  let out;
+  try {
+    out = sh3("gh", ["pr", "view", String(prNumber), "--json", "comments"]);
+  } catch (err) {
+    throw new Error(`fetchNewestRulingOrdinal: could not fetch PR #${prNumber}'s comments: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  return newestPrincipalRulingOrdinal(markerComments(out), principalAllowlist());
+}
+function fetchIssueComments(issueNumber, caller) {
   let out;
   try {
-    out = sh4("gh", ["issue", "view", String(issueNumber), "--json", "comments"]);
+    out = sh3("gh", ["issue", "view", String(issueNumber), "--json", "comments"]);
   } catch (err) {
-    throw new Error(`fetchFrozenBrief: could not fetch Issue #${issueNumber}'s comments: ${err instanceof Error ? err.message : String(err)}`);
+    throw new Error(`${caller}: could not fetch Issue #${issueNumber}'s comments: ${err instanceof Error ? err.message : String(err)}`);
   }
-  const found = findPrincipalFrozenBrief(markerComments(out), principalAllowlist());
+  return markerComments(out);
+}
+function fetchFrozenBrief(issueNumber) {
+  const found = resolveNewestFrozenBrief(fetchIssueComments(issueNumber, "fetchFrozenBrief"), principalAllowlist());
   if (!found) {
-    throw new Error(`fetchFrozenBrief: Issue #${issueNumber} carries no principal-authored, frozen \`aeg:brief:v1\` comment — \`vinaya task dispatch\` must post the brief before this loop can start.`);
+    throw new Error(`fetchFrozenBrief: Issue #${issueNumber} carries no principal-authored, frozen \`aeg:brief:v<k>\` comment — \`vinaya task brief\` must post the brief before this loop can start.`);
   }
-  return contentAfterTwoLines(found.body);
+  return found.content;
+}
+var NO_SOURCE_REVISION = "(none — pre-task-4 frozen brief)";
+function fetchSourceRevision(issueNumber) {
+  return extractSourceRevision(fetchFrozenBrief(issueNumber)) ?? NO_SOURCE_REVISION;
 }
 function fetchIssueTitle(issueNumber) {
-  const out = sh4("gh", ["issue", "view", String(issueNumber), "--json", "title"]);
+  const out = sh3("gh", ["issue", "view", String(issueNumber), "--json", "title"]);
   return JSON.parse(out).title;
 }
 function extractObjectivesSection(body) {
@@ -12876,8 +13061,106 @@ function extractObjectivesSection(body) {
   return (end === -1 ? rest : rest.slice(0, end)).join(`
 `).trim();
 }
-function fetchIssueObjectives(issueNumber) {
-  return extractObjectivesSection(fetchFrozenBrief(issueNumber));
+var OBJECTIVES_EDIT_MARKER_RE = /^<!--\s*aeg:objectives:v(\d+)\s*-->$/;
+function findLatestPrincipalObjectivesEdit(comments, allowlist) {
+  let best = null;
+  for (const c of comments) {
+    if (!isPrincipal(c.author, allowlist))
+      continue;
+    const m = OBJECTIVES_EDIT_MARKER_RE.exec((c.body.split(`
+`)[0] ?? "").trim());
+    if (!m)
+      continue;
+    const k = Number.parseInt(m[1], 10);
+    if (best === null || k > best.k)
+      best = { k, comment: c };
+  }
+  return best?.comment ?? null;
+}
+function parseObjectiveLines(raw) {
+  const parsed = objectivesOf(["## Objectives", "", raw].join(`
+`));
+  return parsed.ok ? parsed.objectives : null;
+}
+function parseObjectivesEditComment(body) {
+  const lines = body.split(`
+`);
+  const previousIdx = lines.findIndex((l) => l.trim() === "Previous:");
+  const nowIdx = lines.findIndex((l) => l.trim() === "Now:");
+  const reasonLine = lines.find((l) => l.startsWith("Reason:"));
+  const versionLine = lines.find((l) => l.startsWith("Version:"));
+  if (previousIdx === -1 || nowIdx === -1 || nowIdx < previousIdx || !reasonLine || !versionLine)
+    return null;
+  const previousBlock = lines.slice(previousIdx + 1, nowIdx).join(`
+`).trim();
+  const nowRest = lines.slice(nowIdx + 1);
+  const nowEnd = nowRest.findIndex((l) => l.trim() === "");
+  const nowBlock = (nowEnd === -1 ? nowRest : nowRest.slice(0, nowEnd)).join(`
+`).trim();
+  const previous = parseObjectiveLines(previousBlock);
+  const now = parseObjectiveLines(nowBlock);
+  if (!previous || !now)
+    return null;
+  return {
+    previous,
+    now,
+    reason: reasonLine.slice("Reason:".length).trim(),
+    version: versionLine.slice("Version:".length).trim()
+  };
+}
+function resolveIssueObjectives(issueNumber) {
+  let out;
+  try {
+    out = sh3("gh", ["issue", "view", String(issueNumber), "--json", "comments"]);
+  } catch (err) {
+    throw new Error(`resolveIssueObjectives: could not fetch Issue #${issueNumber}'s comments: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  const comments = markerComments(out);
+  const allowlist = principalAllowlist();
+  const latestEdit = findLatestPrincipalObjectivesEdit(comments, allowlist);
+  if (latestEdit) {
+    const parsed = parseObjectivesEditComment(latestEdit.body);
+    if (parsed) {
+      return {
+        text: parsed.now.map((o) => `${o.id}. ${o.text}`).join(`
+`),
+        version: parsed.version,
+        edit: { previous: parsed.previous, now: parsed.now, reason: parsed.reason }
+      };
+    }
+  }
+  const brief = findPrincipalFrozenBrief(comments, allowlist);
+  if (!brief) {
+    throw new Error(`resolveIssueObjectives: Issue #${issueNumber} carries no principal-authored, frozen \`aeg:brief:v1\` comment — \`vinaya task dispatch\` must post the brief before this loop can start.`);
+  }
+  const text = extractObjectivesSection(brief.content);
+  if (text.length === 0)
+    return { text: "", version: null, edit: null };
+  const parsedObjectives = objectivesOf(["## Objectives", "", text].join(`
+`));
+  return { text, version: parsedObjectives.ok ? objectivesVersion(parsedObjectives.objectives) : null, edit: null };
+}
+function describeObjectivesEdit(issueNumber, edit) {
+  const { previous, now, reason } = edit;
+  const base = `vinaya issue objectives edit ${issueNumber}`;
+  const sameThrough = (n) => previous.slice(0, n).every((o, i) => o.id === now[i]?.id && o.text === now[i]?.text);
+  if (now.length === previous.length + 1 && sameThrough(previous.length)) {
+    const added = now[now.length - 1];
+    return `${base} --add "${added.text}" --reason "${reason}"`;
+  }
+  if (now.length === previous.length - 1) {
+    const missing = previous.find((p) => !now.some((n) => n.id === p.id));
+    if (missing && now.every((n, i) => n.id === previous.filter((p) => p.id !== missing.id)[i]?.id)) {
+      return `${base} --drop ${missing.id} --reason "${reason}"`;
+    }
+  }
+  if (now.length === previous.length) {
+    const changed = now.find((n, i) => previous[i]?.id === n.id && previous[i]?.text !== n.text);
+    if (changed && now.every((n, i) => n.id === previous[i]?.id)) {
+      return `${base} --replace ${changed.id} "${changed.text}" --reason "${reason}"`;
+    }
+  }
+  return `${base} — could not reconstruct the exact flags from the edit comment's Previous:/Now: diff; Reason: ${reason}`;
 }
 var ISSUE_TITLE_SHAPE = /^\[([^\]]+)\]\s+(\d+)\s+[—-]/;
 function developerBranchFor(issueNumber, fetchTitle = fetchIssueTitle) {
@@ -12890,7 +13173,7 @@ function developerBranchFor(issueNumber, fetchTitle = fetchIssueTitle) {
 }
 function findOpenPrForBranch(branch) {
   try {
-    const out = sh4("gh", ["pr", "list", "--head", branch, "--state", "open", "--json", "number,headRefName"]);
+    const out = sh3("gh", ["pr", "list", "--head", branch, "--state", "open", "--json", "number,headRefName"]);
     const list = JSON.parse(out);
     const found = list.find((p) => p.headRefName === branch);
     return found ? { number: found.number, branch } : null;
@@ -12919,26 +13202,50 @@ function renderReviewerPrompt(facts) {
 `) : "(none)",
     "",
     `HEAD: ${facts.head}`,
-    `CI: ${facts.ciConclusion}`
+    `CI: ${facts.ciConclusion}`,
+    `BRIEF REVISION: ${facts.revision}`
   ].join(`
 `);
 }
 function outboxRoot() {
-  return join18(GLOBAL_VINAYA_HOME, "outbox");
+  return join17(GLOBAL_VINAYA_HOME, "outbox");
 }
 function heldVerdictPath(root, task, round, role) {
-  return join18(root, "dev-review-loop", String(task), `round-${round}-${role}.md`);
+  return join17(root, "dev-review-loop", String(task), `round-${round}-${role}.md`);
 }
 function writeHeldVerdict(root, task, round, role, renderedComment) {
-  const dir = join18(root, "dev-review-loop", String(task));
+  const dir = join17(root, "dev-review-loop", String(task));
   mkdirSync5(dir, { recursive: true });
-  writeFileSync9(heldVerdictPath(root, task, round, role), renderedComment, "utf8");
+  writeFileSync8(heldVerdictPath(root, task, round, role), renderedComment, "utf8");
+}
+function reviewerWorkDir(root, task, round, role, attempt = 1) {
+  const suffix = attempt > 1 ? `-retry${attempt - 1}` : "";
+  return join17(root, "dev-review-loop", String(task), `round-${round}-${role}-work${suffix}`);
 }
-function reviewerWorkDir(root, task, round, role) {
-  return join18(root, "dev-review-loop", String(task), `round-${round}-${role}-work`);
+function missingReviewerArtifacts(workDir, hasObjectives) {
+  const missing = [];
+  const reportRaw = readIfExists(join17(workDir, "report.txt"));
+  if (reportRaw === null)
+    missing.push("report.txt");
+  if (!existsSync13(join17(workDir, "findings.txt")))
+    missing.push("findings.txt");
+  const isEscalation = reportRaw !== null && parseReport(reportRaw).ESCALATE !== undefined;
+  if (hasObjectives && !isEscalation && !existsSync13(join17(workDir, "objectives.txt")))
+    missing.push("objectives.txt");
+  return missing;
+}
+
+class ReviewerInfrastructureFailure extends Error {
+  role;
+  missing;
+  constructor(role, missing) {
+    super(`${role}'s work directory carried no ${missing.join(" and no ")} after a fresh dispatch and one fresh retry.`);
+    this.role = role;
+    this.missing = missing;
+  }
 }
 function forgeEffectPath(root, task, key) {
-  return join18(root, "dev-review-loop", String(task), `effect-${key}.json`);
+  return join17(root, "dev-review-loop", String(task), `effect-${key}.json`);
 }
 function readForgeEffect(path) {
   const raw = readIfExists(path);
@@ -12952,7 +13259,7 @@ function readForgeEffect(path) {
 }
 function writeForgeEffect(path, record) {
   mkdirSync5(dirname8(path), { recursive: true });
-  writeFileSync9(path, JSON.stringify(record), "utf8");
+  writeFileSync8(path, JSON.stringify(record), "utf8");
 }
 function postForgeEffectOnce(root, task, key, poster) {
   const path = forgeEffectPath(root, task, key);
@@ -12966,20 +13273,20 @@ function postForgeEffectOnce(root, task, key, poster) {
   return url;
 }
 function postPrComment(pr, body) {
-  const dir = mkdtempSync3(join18(tmpdir4(), "vinaya-dev-review-loop-comment-"));
-  const tmp = join18(dir, "comment.md");
-  writeFileSync9(tmp, body, "utf8");
+  const dir = mkdtempSync2(join17(tmpdir3(), "vinaya-dev-review-loop-comment-"));
+  const tmp = join17(dir, "comment.md");
+  writeFileSync8(tmp, body, "utf8");
   try {
-    return execFileSync17("gh", ["pr", "comment", String(pr), "--body-file", tmp], {
+    return execFileSync16("gh", ["pr", "comment", String(pr), "--body-file", tmp], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
   } finally {
-    rmSync6(dir, { recursive: true, force: true });
+    rmSync5(dir, { recursive: true, force: true });
   }
 }
 function fetchAllPrCommentBodies(pr) {
-  const out = sh4("gh", ["pr", "view", String(pr), "--json", "comments"]);
+  const out = sh3("gh", ["pr", "view", String(pr), "--json", "comments"]);
   return principalBodies(markerComments(out), principalAllowlist());
 }
 function publishRound(root, input) {
@@ -13010,9 +13317,9 @@ function publishRound(root, input) {
 function pauseMarker(reason) {
   return `<!-- aeg:loop:paused:${reason} -->`;
 }
-function renderPauseComment(prNumber, reason) {
+function renderPauseComment(prNumber, reason, detail) {
   return [
-    `The dev-review-loop paused: ${reason}.`,
+    `The dev-review-loop paused: ${reason}${detail ? ` — ${detail}` : ""}.`,
     "",
     "A Principal ruling is needed before this can continue. Once one is posted on this PR, resume with:",
     "",
@@ -13022,16 +13329,16 @@ function renderPauseComment(prNumber, reason) {
   ].join(`
 `);
 }
-function postPauseComment(root, task, round, head, prNumber, reason) {
-  postForgeEffectOnce(root, task, `pause-${round}-${head}`, () => postMarkedComment("pr", String(prNumber), pauseMarker(reason), renderPauseComment(prNumber, reason)));
+function postPauseComment(root, task, round, head, prNumber, reason, detail) {
+  postForgeEffectOnce(root, task, `pause-${round}-${head}`, () => postMarkedComment("pr", String(prNumber), pauseMarker(reason), renderPauseComment(prNumber, reason, detail)));
 }
 function pauseStatePath(root, task) {
-  return join18(root, "dev-review-loop", String(task), "pause-state.json");
+  return join17(root, "dev-review-loop", String(task), "pause-state.json");
 }
 function writePauseState(root, state) {
   const path = pauseStatePath(root, state.task);
   mkdirSync5(dirname8(path), { recursive: true });
-  writeFileSync9(path, JSON.stringify(state), "utf8");
+  writeFileSync8(path, JSON.stringify(state), "utf8");
 }
 function readPauseState(root, task) {
   const raw = readIfExists(pauseStatePath(root, task));
@@ -13077,41 +13384,41 @@ function readIfExists(path) {
     return null;
   }
 }
-function withPromptFile2(prompt2, fn) {
-  const dir = mkdtempSync3(join18(tmpdir4(), "vinaya-dev-review-loop-prompt-"));
-  const promptFile = join18(dir, "prompt.md");
-  writeFileSync9(promptFile, prompt2, "utf8");
+function withPromptFile(prompt2, fn) {
+  const dir = mkdtempSync2(join17(tmpdir3(), "vinaya-dev-review-loop-prompt-"));
+  const promptFile = join17(dir, "prompt.md");
+  writeFileSync8(promptFile, prompt2, "utf8");
   try {
     return fn(promptFile);
   } finally {
-    rmSync6(dir, { recursive: true, force: true });
+    rmSync5(dir, { recursive: true, force: true });
   }
 }
 
 class DevReviewLoopResumeError extends Error {
 }
 function defaultRepoRoot() {
-  return sh4("git", ["rev-parse", "--show-toplevel"]);
+  return sh3("git", ["rev-parse", "--show-toplevel"]);
 }
 function defaultGitRevParseOriginMain() {
-  return sh4("git", ["rev-parse", "origin/main"]);
+  return sh3("git", ["rev-parse", "origin/main"]);
 }
 function defaultGitFetch(sha) {
   try {
-    execFileSync17("git", ["fetch", "--quiet", "origin", sha], { stdio: ["ignore", "ignore", "ignore"] });
+    execFileSync16("git", ["fetch", "--quiet", "origin", sha], { stdio: ["ignore", "ignore", "ignore"] });
   } catch {}
 }
 function defaultGitDiffShortstat(base, head) {
   try {
-    return sh4("git", ["diff", `${base}...${head}`, "--shortstat"]);
+    return sh3("git", ["diff", `${base}...${head}`, "--shortstat"]);
   } catch {
     return "";
   }
 }
 function defaultFlushOutbox(task) {
   try {
-    const cliEntry = join18(packageRoot(import.meta.url), "src", "index.ts");
-    execFileSync17("bun", [cliEntry, "log", "flush", "--issue", String(task)], {
+    const cliEntry = join17(packageRoot(import.meta.url), "src", "index.ts");
+    execFileSync16("bun", [cliEntry, "log", "flush", "--issue", String(task)], {
       stdio: ["ignore", "pipe", "pipe"]
     });
   } catch (err) {
@@ -13122,16 +13429,27 @@ function defaultFlushOutbox(task) {
 function defaultSleep2(ms) {
   return new Promise((resolve3) => setTimeout(resolve3, ms));
 }
-function defaultDeps3() {
+function gatePollEnvOverride(name, fallback) {
+  const raw = process.env[name];
+  if (!raw)
+    return fallback;
+  const n = Number(raw);
+  return Number.isFinite(n) && n > 0 ? n : fallback;
+}
+function defaultDeps2() {
   return {
     dispatchRole,
     resolveHead,
     fetchCiConclusion,
+    fetchFailingCheckNames,
     fetchRulings,
+    fetchNewestRulingOrdinal,
     fetchFrozenBrief,
-    fetchIssueObjectives,
+    resolveIssueObjectives,
+    fetchSourceRevision,
     developerBranchFor: (n) => developerBranchFor(n),
     findOpenPrForBranch,
+    readResumeRecord: (task, agent, repo) => readResumeRecord("developer", agent, repo, task),
     outboxRoot,
     repoRoot: defaultRepoRoot,
     gitRevParseOriginMain: defaultGitRevParseOriginMain,
@@ -13142,8 +13460,8 @@ function defaultDeps3() {
     now: () => Date.now(),
     prPollMaxAttempts: 120,
     prPollIntervalMs: 15000,
-    gatePollMaxAttempts: 120,
-    gatePollIntervalMs: 15000
+    gatePollMaxAttempts: gatePollEnvOverride("VINAYA_DEV_REVIEW_LOOP_GATE_POLL_MAX_ATTEMPTS", 120),
+    gatePollIntervalMs: gatePollEnvOverride("VINAYA_DEV_REVIEW_LOOP_GATE_POLL_INTERVAL_MS", 15000)
   };
 }
 function parseShortstat(stat) {
@@ -13219,8 +13537,8 @@ async function waitForOwnLoopLine(path, priorSize, runId, event, sleep, timeoutM
     await sleep(5);
   }
 }
-function buildVerdictFromReport(role, workDir, headSha, agent, taskId, handle) {
-  const reportRaw = readIfExists(join18(workDir, "report.txt")) ?? "";
+function buildVerdictFromReport(role, workDir, headSha, agent, taskId, handle, objectivesVersionAtDispatch, rulingOrdinalAtDispatch) {
+  const reportRaw = readIfExists(join17(workDir, "report.txt")) ?? "";
   const report = parseReport(reportRaw);
   const sessionId = handle.resumeId ?? "(unknown)";
   const tokensIn = handle.usage ? String(handle.usage.input) : "—";
@@ -13237,7 +13555,8 @@ function buildVerdictFromReport(role, workDir, headSha, agent, taskId, handle) {
       summary: report.SUMMARY ?? "(no summary given)",
       role: role === "reviewer" ? "review" : "security",
       roleLabel,
-      objectivesVersion: null,
+      objectivesVersion: objectivesVersionAtDispatch,
+      rulingOrdinal: rulingOrdinalAtDispatch,
       taskId: String(taskId),
       model: agent,
       tokensIn,
@@ -13247,12 +13566,13 @@ function buildVerdictFromReport(role, workDir, headSha, agent, taskId, handle) {
     });
     return { observation: { role, verdict: "ESCALATE", objectives: [], findings: [] }, rendered: rendered2 };
   }
-  const findingsRaw = readIfExists(join18(workDir, "findings.txt")) ?? "";
+  const findingsRaw = readIfExists(join17(workDir, "findings.txt")) ?? "";
   const allowedSeverities = role === "reviewer" ? ["BLOCKER", "MAJOR", "MINOR"] : ["CRITICAL", "HIGH", "MEDIUM", "LOW"];
   const findings = findingsRaw.trim() ? parseFindingsFile(findingsRaw, allowedSeverities) : [];
-  const objectivesRaw = readIfExists(join18(workDir, "objectives.txt"));
+  const objectivesRaw = readIfExists(join17(workDir, "objectives.txt"));
   const objectiveResults = objectivesRaw?.trim() ? parseObjectivesFile(objectivesRaw) : [];
   const objectives = objectiveResults.map((o) => ({ id: o.id, met: o.status === "MET" }));
+  const renderedObjectiveResults = objectivesVersionAtDispatch !== null ? objectiveResults : null;
   const findingObservations = findings.map((f, i) => ({ id: `F${i + 1}`, severity: f.severity, state: null }));
   if (role === "reviewer") {
     const verdict2 = deriveCodeReviewVerdict(findings);
@@ -13266,8 +13586,9 @@ function buildVerdictFromReport(role, workDir, headSha, agent, taskId, handle) {
       scopeEvidence: null,
       tests: report.TESTS ?? "(not reported)",
       docs: report.DOCS ?? "(not reported)",
-      objectivesVersion: null,
-      objectiveResults: null,
+      objectivesVersion: objectivesVersionAtDispatch,
+      objectiveResults: renderedObjectiveResults,
+      rulingOrdinal: rulingOrdinalAtDispatch,
       taskId: String(taskId),
       model: agent,
       tokensIn,
@@ -13293,8 +13614,9 @@ function buildVerdictFromReport(role, workDir, headSha, agent, taskId, handle) {
     configScan: report.CONFIG_SCAN ?? "(not reported)",
     secrets: report.SECRETS ?? "none found",
     secretsEvidence: null,
-    objectivesVersion: null,
-    objectiveResults: null,
+    objectivesVersion: objectivesVersionAtDispatch,
+    objectiveResults: renderedObjectiveResults,
+    rulingOrdinal: rulingOrdinalAtDispatch,
     taskId: String(taskId),
     model: agent,
     tokensIn,
@@ -13304,6 +13626,9 @@ function buildVerdictFromReport(role, workDir, headSha, agent, taskId, handle) {
   });
   return { observation: { role, verdict, objectives, findings: findingObservations }, rendered };
 }
+function hasObjectivesFacts(facts) {
+  return facts.objectives.trim().length > 0;
+}
 function renderReviewerDispatchPrompt(role, facts, workDir) {
   const base = renderReviewerPrompt(facts);
   const lint = lintReviewerPrompt(base);
@@ -13314,9 +13639,12 @@ function renderReviewerDispatchPrompt(role, facts, workDir) {
   const instructions = [
     roleLine,
     "Review the PR at the HEAD above against the OBJECTIVES and RULINGS above.",
-    `Write your findings to ${join18(workDir, "findings.txt")}, one per line: SEVERITY|file:line|description`,
+    `Write your findings to ${join17(workDir, "findings.txt")}, one per line: SEVERITY|file:line|description`,
     role === "reviewer" ? "(severities: BLOCKER, MAJOR, MINOR — leave the file empty if there are none)." : "(severities: CRITICAL, HIGH, MEDIUM, LOW — leave the file empty if there are none).",
-    `Write a short report to ${join18(workDir, "report.txt")} as one \`KEY: value\` line per field:`,
+    ...hasObjectivesFacts(facts) ? [
+      `Write one line per objective listed above to ${join17(workDir, "objectives.txt")}: O<n>|MET|<evidence> or O<n>|NOT MET|<evidence>.`
+    ] : [],
+    `Write a short report to ${join17(workDir, "report.txt")} as one \`KEY: value\` line per field:`,
     role === "reviewer" ? "  BRIEF_CONFORMANCE, SPEC_CONFORMANCE, SCOPE, TESTS, DOCS" : "  CONFIG_SCAN, SECRETS",
     "To escalate instead of casting a verdict, write only `ESCALATE: authority|strategy|product` and `SUMMARY: <text>` to report.txt."
   ].join(`
@@ -13330,7 +13658,7 @@ function taskFromPrBody(body) {
   return m ? Number(m[1]) : null;
 }
 function fetchPrBody2(pr) {
-  const out = sh4("gh", ["pr", "view", String(pr), "--json", "body"]);
+  const out = sh3("gh", ["pr", "view", String(pr), "--json", "body"]);
   return JSON.parse(out).body;
 }
 function routeCompletionEvents(events, decisionType) {
@@ -13341,8 +13669,40 @@ function routeCompletionEvents(events, decisionType) {
     toDeferUntilPublish: events.filter((e) => e.event === "journal_finalized")
   };
 }
+var MAX_GATE_STALLED_TURNS = 2;
+function driverDecidedPauseEvents(loopId, state, round, stats) {
+  const envelope = { kind: "dev_review_loop", payload: {} };
+  return [
+    { ...envelope, loop_id: loopId, event: "stop_condition_met", round, condition: "principal_stop" },
+    { ...envelope, loop_id: loopId, event: "paused", round, reason: "principal_item" },
+    {
+      ...envelope,
+      loop_id: loopId,
+      event: "round_ended",
+      round,
+      base_head: stats.baseHead,
+      head: stats.head,
+      files_changed: stats.filesChanged,
+      insertions: stats.insertions,
+      deletions: stats.deletions,
+      wall_ms: stats.wallMs,
+      outcome: "changes_requested"
+    },
+    {
+      ...envelope,
+      loop_id: loopId,
+      event: "journal_finalized",
+      rounds: state.rounds.length + 1,
+      total_wall_ms: state.totalWallMs + stats.wallMs,
+      time_to_green_ms: null,
+      files_changed_total: state.totalFilesChanged + stats.filesChanged,
+      final_head: stats.head,
+      result: "stopped"
+    }
+  ];
+}
 async function devReviewLoop(input, deps = {}) {
-  const d = { ...defaultDeps3(), ...deps };
+  const d = { ...defaultDeps2(), ...deps };
   const root = d.outboxRoot();
   let task;
   let branch;
@@ -13383,7 +13743,7 @@ async function devReviewLoop(input, deps = {}) {
   process.env.VINAYA_TASK = String(task);
   const repo = await resolveRepo().catch(() => null);
   const repoRoot2 = d.repoRoot();
-  const confidenceFilePath = join18(repoRoot2, ".worktrees", branch, CONFIDENCE_FILE_NAME);
+  const confidenceFilePath = join17(repoRoot2, ".worktrees", branch, CONFIDENCE_FILE_NAME);
   const loopOutboxPath = outboxPathFor({ outboxRoot: () => root }, repo, task);
   async function logEvents(events) {
     for (const e of events) {
@@ -13404,9 +13764,12 @@ async function devReviewLoop(input, deps = {}) {
   let devDispatchSucceededBefore = false;
   let lastReviewContext = null;
   let resumedDispatch = resumeFrom !== null;
+  let lastFailingChecks = [];
+  let pendingGateRedRetry = false;
+  let gateStalledStreak = 0;
   async function dispatchDeveloper(prompt2, roundNum) {
     const isResume = devResumeId !== null;
-    const handle = await withPromptFile2(prompt2, (promptFile) => d.dispatchRole("developer", input.agent, prompt2, {
+    const handle = await withPromptFile(prompt2, (promptFile) => d.dispatchRole("developer", input.agent, prompt2, {
       task,
       round: roundNum,
       resumeId: devResumeId ?? undefined,
@@ -13421,15 +13784,23 @@ async function devReviewLoop(input, deps = {}) {
     return handle;
   }
   async function dispatchReviewer(role, roundNum, facts) {
-    const workDir = reviewerWorkDir(root, task, roundNum, role);
-    mkdirSync5(workDir, { recursive: true });
+    const hasObjectives = hasObjectivesFacts(facts);
     const dispatchRoleName = role === "reviewer" ? "code-reviewer" : "security";
-    const prompt2 = renderReviewerDispatchPrompt(role, facts, workDir);
-    const handle = await withPromptFile2(prompt2, (promptFile) => d.dispatchRole(dispatchRoleName, input.agent, prompt2, { task, round: roundNum, promptFile }));
-    await assertDispatchOrEscalate(handle, input.agent, false, false);
-    const parsed = buildVerdictFromReport(role, workDir, facts.head, input.agent, task, handle);
-    writeHeldVerdict(root, task, roundNum, role, parsed.rendered);
-    return parsed;
+    let lastMissing = [];
+    for (let attempt = 1;attempt <= 2; attempt++) {
+      const workDir = reviewerWorkDir(root, task, roundNum, role, attempt);
+      mkdirSync5(workDir, { recursive: true });
+      const prompt2 = renderReviewerDispatchPrompt(role, facts, workDir);
+      const handle = await withPromptFile(prompt2, (promptFile) => d.dispatchRole(dispatchRoleName, input.agent, prompt2, { task, round: roundNum, promptFile }));
+      await assertDispatchOrEscalate(handle, input.agent, false, false);
+      const missing = missingReviewerArtifacts(workDir, hasObjectives);
+      if (missing.length > 0) {
+        lastMissing = missing;
+        continue;
+      }
+      return buildVerdictFromReport(role, workDir, facts.head, input.agent, task, handle, facts.objectivesVersion, facts.rulingOrdinal);
+    }
+    throw new ReviewerInfrastructureFailure(role, lastMissing);
   }
   function computeStats(head, roundStartMs2) {
     const baseHead = d.gitRevParseOriginMain();
@@ -13443,7 +13814,13 @@ async function devReviewLoop(input, deps = {}) {
       const c = d.fetchCiConclusion(head);
       return c === "pending" ? null : c;
     }, d.gatePollMaxAttempts, d.gatePollIntervalMs, d.sleep, `devReviewLoop: CI never resolved off 'pending' for head ${head} within the poll budget.`).catch(() => "red");
-    return { green: conclusion === "green", stats: computeStats(head, roundStartMs2), ciConclusion: conclusion };
+    const failingChecks = conclusion === "red" ? d.fetchFailingCheckNames(head) : [];
+    return {
+      green: conclusion === "green",
+      stats: computeStats(head, roundStartMs2),
+      ciConclusion: conclusion,
+      failingChecks
+    };
   }
   function readAndClearConfidence() {
     const content = readIfExists(confidenceFilePath);
@@ -13458,35 +13835,88 @@ async function devReviewLoop(input, deps = {}) {
     lastReviewContext = rulings.map((r, i) => `${i + 1}. ${r}`).join(`
 `);
   } else {
-    const brief = d.fetchFrozenBrief(task);
-    await dispatchDeveloper(brief, round);
-    prNumber = await pollUntil(() => d.findOpenPrForBranch(branch), d.prPollMaxAttempts, d.prPollIntervalMs, d.sleep, `devReviewLoop: no open PR appeared for branch \`${branch}\` within the poll budget.`).then((pr) => pr.number);
+    const existingPr = d.findOpenPrForBranch(branch);
+    if (existingPr) {
+      prNumber = existingPr.number;
+      const rec = d.readResumeRecord(task, input.agent, repo);
+      if (rec)
+        devResumeId = rec.resumeId;
+    } else {
+      let branchExists2 = true;
+      try {
+        d.resolveHead(branch);
+      } catch {
+        branchExists2 = false;
+      }
+      if (branchExists2) {
+        const rec = d.readResumeRecord(task, input.agent, repo);
+        if (rec)
+          devResumeId = rec.resumeId;
+        const openPrPrompt = [
+          "This branch already exists with no open pull request for it.",
+          "Open the pull request through the validated path per aeg-root/roles/developer.md:",
+          '`bun apps/cli/src/index.ts pr create --body-file <path> --title "<title>"`.'
+        ].join(`
+
+`);
+        await dispatchDeveloper(openPrPrompt, round);
+        prNumber = await pollUntil(() => d.findOpenPrForBranch(branch), d.prPollMaxAttempts, d.prPollIntervalMs, d.sleep, `devReviewLoop: no open PR appeared for branch \`${branch}\` within the poll budget after resuming to open one.`).then((pr) => pr.number);
+      } else {
+        const brief = d.fetchFrozenBrief(task);
+        await dispatchDeveloper(brief, round);
+        prNumber = await pollUntil(() => d.findOpenPrForBranch(branch), d.prPollMaxAttempts, d.prPollIntervalMs, d.sleep, `devReviewLoop: no open PR appeared for branch \`${branch}\` within the poll budget.`).then((pr) => pr.number);
+      }
+    }
   }
   let decision = { type: "dispatch_developer" };
   let firstPass = !resumeFrom;
   let pendingCompletionEvents = [];
   while (true) {
     if (decision.type === "dispatch_developer") {
+      const isGateRedRetry = pendingGateRedRetry;
       if (!firstPass) {
         const prompt2 = [
           resumedDispatch ? `Principal ruling on this pause:
 
 ${lastReviewContext}
-` : lastReviewContext ? `Round ${round} review findings:
+` : isGateRedRetry ? `CI is red on the last head. Failing check-run(s): ${lastFailingChecks.length > 0 ? lastFailingChecks.join(", ") : "(unknown)"}. Fix and push.` : `Round ${round} review findings:
 
 ${lastReviewContext}
-` : "CI was red on the last head — fix and push.",
+`,
           "Address the findings above per aeg-root/roles/developer.md. Push fixes as new commits on the SAME branch; do not open a new PR.",
           round >= 2 ? CONFIDENCE_PROMPT_LINE : ""
         ].filter(Boolean).join(`
 
 `);
+        const headBeforeDispatch = isGateRedRetry ? d.resolveHead(branch) : null;
         roundStartMs = d.now();
         await dispatchDeveloper(prompt2, round);
         resumedDispatch = false;
+        if (headBeforeDispatch !== null) {
+          const changedHead = await pollUntil(() => {
+            const h = d.resolveHead(branch);
+            return h !== headBeforeDispatch ? h : null;
+          }, d.gatePollMaxAttempts, d.gatePollIntervalMs, d.sleep, "devReviewLoop: head-change wait timed out").catch(() => null);
+          if (changedHead === null) {
+            gateStalledStreak += 1;
+            const stats = computeStats(headBeforeDispatch, roundStartMs);
+            const detail = `head ${headBeforeDispatch} unchanged after dispatch; failing check-run(s): ${lastFailingChecks.length > 0 ? lastFailingChecks.join(", ") : "(unknown)"}`;
+            if (gateStalledStreak < MAX_GATE_STALLED_TURNS) {
+              d.flushOutbox(task);
+              continue;
+            }
+            await logEvents(driverDecidedPauseEvents(config.loopId, state, round, stats));
+            decision = { type: "pause", reason: "infrastructure", detail };
+            d.flushOutbox(task);
+            continue;
+          }
+        }
       }
       firstPass = false;
       const gate = await waitForGreenGate(roundStartMs);
+      lastFailingChecks = gate.failingChecks;
+      pendingGateRedRetry = !gate.green;
+      gateStalledStreak = 0;
       const confidence = round >= 2 && gate.green ? readAndClearConfidence() : undefined;
       const obs = { kind: "gate", round, green: gate.green, confidence, stats: gate.stats };
       const result = assessRound(state, obs);
@@ -13506,33 +13936,78 @@ ${CONFIDENCE_PROMPT_LINE}`;
       const result = assessRound(state, obs);
       state = result.state;
       decision = result.decision;
+      pendingGateRedRetry = false;
+      gateStalledStreak = 0;
       await logEvents(result.events);
       d.flushOutbox(task);
     } else if (decision.type === "dispatch_reviewers") {
       const head = d.resolveHead(branch);
       const ciConclusion = d.fetchCiConclusion(head);
-      const objectives = d.fetchIssueObjectives(task);
+      const resolvedObjectives = d.resolveIssueObjectives(task);
       const rulings = d.fetchRulings(prNumber);
-      const facts = { objectives, rulings, head, ciConclusion };
-      const [reviewer, security] = await Promise.all([
-        dispatchReviewer("reviewer", round, facts),
-        dispatchReviewer("security", round, facts)
-      ]);
-      lastReviewContext = `${reviewer.rendered}
+      const rulingOrdinal = d.fetchNewestRulingOrdinal(prNumber);
+      const revision = d.fetchSourceRevision(task);
+      const facts = {
+        objectives: resolvedObjectives.text,
+        objectivesVersion: resolvedObjectives.version,
+        rulings,
+        rulingOrdinal,
+        head,
+        ciConclusion,
+        revision
+      };
+      let verdicts = null;
+      try {
+        verdicts = await Promise.all([
+          dispatchReviewer("reviewer", round, facts),
+          dispatchReviewer("security", round, facts)
+        ]);
+      } catch (err) {
+        if (!(err instanceof ReviewerInfrastructureFailure))
+          throw err;
+        const stats = computeStats(head, roundStartMs);
+        await logEvents(driverDecidedPauseEvents(config.loopId, state, round, stats));
+        decision = { type: "pause", reason: "infrastructure", detail: err.message };
+      }
+      if (verdicts) {
+        const reassessedObjectives = d.resolveIssueObjectives(task);
+        const reassessedRulingOrdinal = d.fetchNewestRulingOrdinal(prNumber);
+        if (reassessedObjectives.version !== facts.objectivesVersion) {
+          const command = reassessedObjectives.edit ? describeObjectivesEdit(task, reassessedObjectives.edit) : `vinaya issue objectives edit ${task} ... (edit comment not found on re-read)`;
+          const detail = `objectives moved from ${facts.objectivesVersion ?? "none"} to ${reassessedObjectives.version ?? "none"} between reviewer dispatch and assessment — superseded by \`${command}\``;
+          const stats = computeStats(head, roundStartMs);
+          await logEvents(driverDecidedPauseEvents(config.loopId, state, round, stats));
+          decision = { type: "pause", reason: "objectives_changed", detail };
+          d.flushOutbox(task);
+        } else if (reassessedRulingOrdinal !== facts.rulingOrdinal) {
+          const detail = `a new ruling landed between reviewer dispatch and assessment — ruling ordinal moved from ${facts.rulingOrdinal} to ${reassessedRulingOrdinal} — superseded by ruling ${prNumber}-${reassessedRulingOrdinal}`;
+          const stats = computeStats(head, roundStartMs);
+          await logEvents(driverDecidedPauseEvents(config.loopId, state, round, stats));
+          decision = { type: "pause", reason: "ruling_posted", detail };
+          d.flushOutbox(task);
+        } else {
+          const [reviewer, security] = verdicts;
+          writeHeldVerdict(root, task, round, "reviewer", reviewer.rendered);
+          writeHeldVerdict(root, task, round, "security", security.rendered);
+          lastReviewContext = `${reviewer.rendered}
 
 ---
 
 ${security.rendered}`;
-      const obs = { kind: "verdicts", round, verdicts: [reviewer.observation, security.observation] };
-      const result = assessRound(state, obs);
-      state = result.state;
-      decision = result.decision;
-      const routed = routeCompletionEvents(result.events, decision.type);
-      pendingCompletionEvents = routed.toDeferUntilPublish;
-      await logEvents(routed.toLogNow);
-      d.flushOutbox(task);
-      if (decision.type === "dispatch_developer")
-        round += 1;
+          const obs = { kind: "verdicts", round, verdicts: [reviewer.observation, security.observation] };
+          const result = assessRound(state, obs);
+          state = result.state;
+          decision = result.decision;
+          const routed = routeCompletionEvents(result.events, decision.type);
+          pendingCompletionEvents = routed.toDeferUntilPublish;
+          await logEvents(routed.toLogNow);
+          d.flushOutbox(task);
+          if (decision.type === "dispatch_developer")
+            round += 1;
+        }
+      } else {
+        d.flushOutbox(task);
+      }
     }
     if (decision.type === "publish") {
       publishRound(root, {
@@ -13555,9 +14030,10 @@ ${security.rendered}`;
         branch,
         prNumber,
         reason: decision.reason,
+        detail: decision.detail,
         pausedAt: new Date().toISOString()
       });
-      postPauseComment(root, task, round, pauseHead, prNumber, decision.reason);
+      postPauseComment(root, task, round, pauseHead, prNumber, decision.reason, decision.detail);
       d.flushOutbox(task);
       return { finalDecision: decision, prNumber, task };
     }
@@ -13617,10 +14093,10 @@ async function devReviewLoopCommand(args) {
   if (parsed.json) {
     printJson({ finalDecision: result.finalDecision, prNumber: result.prNumber, task: result.task });
   } else if (result.finalDecision.type === "publish") {
-    process.stdout.write(`vinaya dev-review-loop: task ${result.task}, PR #${result.prNumber} — publish
+    process.stdout.write(`${colourLoopLine(`vinaya dev-review-loop: task ${result.task}, PR #${result.prNumber} — publish`, process.stdout)}
 `);
   } else if (result.finalDecision.type === "pause") {
-    process.stdout.write(`vinaya dev-review-loop: task ${result.task}, PR #${result.prNumber} — paused (${result.finalDecision.reason})
+    process.stdout.write(`${colourLoopLine(`vinaya dev-review-loop: task ${result.task}, PR #${result.prNumber} — paused (${result.finalDecision.reason})`, process.stdout)}
 `);
   }
   if (result.finalDecision.type === "pause")
@@ -13631,10 +14107,10 @@ async function devReviewLoopCommand(args) {
 import { readFileSync as readFileSync19 } from "node:fs";
 
 // src/commands/log.ts
-import { execFileSync as execFileSync18 } from "node:child_process";
-import { lstatSync, readFileSync as readFileSync18, statSync as statSync2, writeFileSync as writeFileSync10, rmSync as rmSync7 } from "node:fs";
-import { homedir as homedir4, tmpdir as tmpdir5 } from "node:os";
-import { join as join19 } from "node:path";
+import { execFileSync as execFileSync17 } from "node:child_process";
+import { lstatSync, readFileSync as readFileSync18, statSync as statSync2, writeFileSync as writeFileSync9, rmSync as rmSync6 } from "node:fs";
+import { homedir as homedir4, tmpdir as tmpdir4 } from "node:os";
+import { join as join18 } from "node:path";
 var FORGE_COMMENT_MAX_CHARS = 65536;
 function isEnoent2(err) {
   return typeof err === "object" && err !== null && err.code === "ENOENT";
@@ -13794,7 +14270,7 @@ function planFlush(lines, maxChars) {
 }
 function gh2(args) {
   try {
-    return execFileSync18("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync17("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new Error(String(stderr ?? err.message).trim() || "gh command failed");
@@ -13809,8 +14285,8 @@ function issueFromPr(prNumber) {
   return issue;
 }
 function postChunk(op, targetId, body, index) {
-  const tmp = join19(tmpdir5(), `vinaya-log-flush-${process.pid}-${Date.now()}-${index}.md`);
-  writeFileSync10(tmp, body, { flag: "wx" });
+  const tmp = join18(tmpdir4(), `vinaya-log-flush-${process.pid}-${Date.now()}-${index}.md`);
+  writeFileSync9(tmp, body, { flag: "wx" });
   try {
     const out = op === "pr.comment" ? gh2(["pr", "comment", targetId, "--body-file", tmp]) : gh2(["issue", "comment", targetId, "--body-file", tmp]);
     const match = /#issuecomment-(\d+)/.exec(out);
@@ -13820,7 +14296,7 @@ function postChunk(op, targetId, body, index) {
 `);
     return `unparsed:${out.slice(0, 200)}`;
   } finally {
-    rmSync7(tmp, { force: true });
+    rmSync6(tmp, { force: true });
   }
 }
 function parseArgs3(args) {
@@ -13853,7 +14329,7 @@ async function logFlushCommand(args) {
   const forgeTargetId = parsed.pr !== undefined ? String(parsed.pr) : String(issueNumber);
   const resolved = await resolveRepo();
   const repo = resolved && isSafeRepoSegment3(resolved.owner) && isSafeRepoSegment3(resolved.repo) ? resolved : null;
-  const outboxRoot2 = () => join19(GLOBAL_VINAYA_HOME, "outbox");
+  const outboxRoot2 = () => join18(GLOBAL_VINAYA_HOME, "outbox");
   const path = outboxPathFor2({ outboxRoot: outboxRoot2, repo }, { issue: issueNumber });
   let lstat;
   try {
@@ -13933,7 +14409,7 @@ async function logFlushCommand(args) {
 `).join("");
   const liveNow = readFileSync18(path);
   const tail = liveNow.subarray(Math.min(startOffset, liveNow.byteLength));
-  writeFileSync10(path, Buffer.concat([Buffer.from(unposted, "utf8"), tail]));
+  writeFileSync9(path, Buffer.concat([Buffer.from(unposted, "utf8"), tail]));
   if (!finalLanded) {
     emitCheckError({
       schema: CHECK_SCHEMA_VERSION,
@@ -13955,6 +14431,7 @@ async function logFlushCommand(args) {
 }
 
 // src/commands/dispatch.ts
+var KNOWN_FLAGS = ["--agent", "--model", "--prompt-file", "--task", "--pr", "--round", "--resume", "--json"];
 function parseArgs4(args) {
   const role = args[0];
   let agent;
@@ -13965,6 +14442,7 @@ function parseArgs4(args) {
   let round;
   let resume;
   let json = false;
+  const unknown = [];
   for (let i = 1;i < args.length; i++) {
     const a = args[i];
     if (a === "--agent")
@@ -13983,11 +14461,18 @@ function parseArgs4(args) {
       resume = args[++i];
     else if (a === "--json")
       json = true;
+    else if (a !== undefined)
+      unknown.push(a);
   }
-  return { role, agent, model, promptFile, task, pr, round, resume, json };
+  return { role, agent, model, promptFile, task, pr, round, resume, json, unknown };
 }
 async function dispatchCommand(args) {
   const parsed = parseArgs4(args);
+  if (parsed.unknown.length > 0) {
+    process.stderr.write(`vinaya dispatch: unrecognized flag${parsed.unknown.length > 1 ? "s" : ""} ${parsed.unknown.map((f) => `'${f}'`).join(", ")} — expected one of ${KNOWN_FLAGS.join(", ")}
+`);
+    process.exit(1);
+  }
   if (!parsed.role || !ROLE_VALUES.includes(parsed.role)) {
     process.stderr.write(`vinaya dispatch: invalid role '${parsed.role ?? "(none)"}' — expected one of ${ROLE_VALUES.join(", ")}
 `);
@@ -14060,13 +14545,13 @@ async function dispatchCommand(args) {
 }
 
 // src/commands/doctor.ts
-import { execFileSync as execFileSync19 } from "node:child_process";
-import { existsSync as existsSync15, readdirSync as readdirSync8, readFileSync as readFileSync23, statSync as statSync3 } from "node:fs";
-import { delimiter, join as join22 } from "node:path";
+import { execFileSync as execFileSync18 } from "node:child_process";
+import { existsSync as existsSync17, readdirSync as readdirSync8, readFileSync as readFileSync23, statSync as statSync3 } from "node:fs";
+import { delimiter, join as join21 } from "node:path";
 
 // src/lib/self-host.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync20, realpathSync as realpathSync2 } from "node:fs";
-import { join as join20, sep as sep3 } from "node:path";
+import { existsSync as existsSync14, readdirSync as readdirSync7, readFileSync as readFileSync20, realpathSync as realpathSync2 } from "node:fs";
+import { dirname as dirname9, join as join19, sep as sep3 } from "node:path";
 var VINAYA_PACKAGE_NAME = "@attalabs/vinaya";
 var DEFAULT_BIN = "dist/index.js";
 var MAX_CANDIDATE_DIRS = 2000;
@@ -14124,7 +14609,7 @@ function expandPattern(repoRoot2, pattern) {
     for (const dir of dirs) {
       if (segment.includes("*")) {
         const matches = segmentMatcher(segment);
-        for (const name of childDirs(join20(repoRoot2, dir))) {
+        for (const name of childDirs(join19(repoRoot2, dir))) {
           if (matches(name))
             next.push(dir ? `${dir}/${name}` : name);
         }
@@ -14139,7 +14624,7 @@ function expandPattern(repoRoot2, pattern) {
 function resolvesInsideRepo(repoRoot2, rel) {
   try {
     const root = realpathSync2(repoRoot2);
-    const target = realpathSync2(join20(repoRoot2, rel));
+    const target = realpathSync2(join19(repoRoot2, rel));
     return target === root || target.startsWith(`${root}${sep3}`);
   } catch {
     return false;
@@ -14157,14 +14642,14 @@ function binPath(pkg) {
   return DEFAULT_BIN;
 }
 function detectVendoredVinaya(repoRoot2) {
-  const patterns = workspacePatterns(readPackageJson(join20(repoRoot2, "package.json")));
+  const patterns = workspacePatterns(readPackageJson(join19(repoRoot2, "package.json")));
   const seen = new Set;
   for (const pattern of patterns) {
     for (const dir of expandPattern(repoRoot2, pattern)) {
       if (seen.has(dir))
         continue;
       seen.add(dir);
-      const member = readPackageJson(join20(repoRoot2, dir, "package.json"));
+      const member = readPackageJson(join19(repoRoot2, dir, "package.json"));
       if (member?.name === VINAYA_PACKAGE_NAME) {
         const bin2 = `${dir}/${binPath(member)}`;
         if (!isSafeRelPath(dir) || !isSafeRelPath(bin2))
@@ -14177,16 +14662,29 @@ function detectVendoredVinaya(repoRoot2) {
   }
   return null;
 }
+function resolveAuthorRepoSourceEntry(ownPackageRoot, cwd = process.cwd()) {
+  if (!ownPackageRoot.split(sep3).includes("node_modules"))
+    return null;
+  const info = resolveDoctrineRootInfo(undefined, cwd);
+  if (info?.source !== "tree")
+    return null;
+  const toplevel = dirname9(info.root);
+  const cliPkg = readPackageJson(join19(toplevel, "apps", "cli", "package.json"));
+  if (cliPkg?.name !== VINAYA_PACKAGE_NAME)
+    return null;
+  const sourceEntry = join19(toplevel, "apps", "cli", "src", "index.ts");
+  return existsSync14(sourceEntry) ? sourceEntry : null;
+}
 
 // src/lib/env-lint.ts
-import { existsSync as existsSync13, readFileSync as readFileSync21 } from "node:fs";
+import { existsSync as existsSync15, readFileSync as readFileSync21 } from "node:fs";
 var ENV_READ_PATTERN = /\b(?:process\.env|Bun\.env|Deno\.env)\b/;
 function checksMissingEnvDeclaration(specs) {
   const names = [];
   for (const spec of specs) {
     if (spec.env)
       continue;
-    if (!existsSync13(spec.run))
+    if (!existsSync15(spec.run))
       continue;
     let source;
     try {
@@ -14204,8 +14702,8 @@ function envDeclarationWarning(name) {
 }
 
 // src/lib/registry-write.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync6, readFileSync as readFileSync22, writeFileSync as writeFileSync11 } from "node:fs";
-import { dirname as dirname9, join as join21 } from "node:path";
+import { existsSync as existsSync16, mkdirSync as mkdirSync6, readFileSync as readFileSync22, writeFileSync as writeFileSync10 } from "node:fs";
+import { dirname as dirname10, join as join20 } from "node:path";
 var PROJECTS_REGISTRY_PATH = ".vinaya/projects.md";
 var CONFIG_FILE_PATH = "vinaya.config.json";
 function rowLine(name, path, specsPath) {
@@ -14271,9 +14769,9 @@ ${newRow}
 `);
 }
 function planRegistryRow(repoRoot2, name, path, specsPath) {
-  const abs2 = join21(repoRoot2, PROJECTS_REGISTRY_PATH);
+  const abs2 = join20(repoRoot2, PROJECTS_REGISTRY_PATH);
   const line = rowLine(name, path, specsPath);
-  if (!existsSync14(abs2)) {
+  if (!existsSync16(abs2)) {
     return { action: "create-host", rowLine: line, path: PROJECTS_REGISTRY_PATH };
   }
   const existing = readFileSync22(abs2, "utf-8");
@@ -14281,13 +14779,13 @@ function planRegistryRow(repoRoot2, name, path, specsPath) {
   return { action: already ? "skip-present" : "append-row", rowLine: line, path: PROJECTS_REGISTRY_PATH };
 }
 function applyRegistryRow(repoRoot2, plan, name, path, specsPath) {
-  const abs2 = join21(repoRoot2, PROJECTS_REGISTRY_PATH);
+  const abs2 = join20(repoRoot2, PROJECTS_REGISTRY_PATH);
   if (plan.action === "create-host") {
-    mkdirSync6(dirname9(abs2), { recursive: true });
-    writeFileSync11(abs2, freshProjectsRegistry(name, path, specsPath), "utf-8");
+    mkdirSync6(dirname10(abs2), { recursive: true });
+    writeFileSync10(abs2, freshProjectsRegistry(name, path, specsPath), "utf-8");
   } else if (plan.action === "append-row") {
     const existing = readFileSync22(abs2, "utf-8");
-    writeFileSync11(abs2, appendRegistryRow(existing, name, path, specsPath), "utf-8");
+    writeFileSync10(abs2, appendRegistryRow(existing, name, path, specsPath), "utf-8");
   }
 }
 function renderRegistryRowDiffLine(plan) {
@@ -14300,8 +14798,8 @@ function renderRegistryRowDiffLine(plan) {
     ${plan.rowLine}`;
 }
 function readProjectEntries(repoRoot2) {
-  const abs2 = join21(repoRoot2, CONFIG_FILE_PATH);
-  if (!existsSync14(abs2))
+  const abs2 = join20(repoRoot2, CONFIG_FILE_PATH);
+  if (!existsSync16(abs2))
     return [];
   try {
     return VinayaConfigSchema.parse(JSON.parse(readFileSync22(abs2, "utf-8"))).projects ?? [];
@@ -14316,10 +14814,10 @@ function planConfigProjectEntry(repoRoot2, entry2) {
 function applyConfigProjectEntry(repoRoot2, plan) {
   if (plan.action === "skip-present")
     return;
-  const abs2 = join21(repoRoot2, CONFIG_FILE_PATH);
+  const abs2 = join20(repoRoot2, CONFIG_FILE_PATH);
   const seed = JSON.parse(readFileSync22(abs2, "utf-8"));
   const projects = Array.isArray(seed.projects) ? seed.projects : [];
-  writeFileSync11(abs2, `${JSON.stringify({ ...seed, projects: [...projects, plan.entry] }, null, 2)}
+  writeFileSync10(abs2, `${JSON.stringify({ ...seed, projects: [...projects, plan.entry] }, null, 2)}
 `, "utf-8");
 }
 function renderConfigProjectEntryDiffLine(plan) {
@@ -14336,7 +14834,7 @@ function renderConfigProjectEntryDiffLine(plan) {
 
 // src/commands/doctor.ts
 function readVersion() {
-  const pkg = JSON.parse(readFileSync23(join22(packageRoot(import.meta.url), "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync23(join21(packageRoot(import.meta.url), "package.json"), "utf-8"));
   return pkg.version;
 }
 function realDeps4() {
@@ -14357,8 +14855,8 @@ var info = (check, message) => ({ check, severity: "info", message });
 var warn = (check, message) => ({ check, severity: "warn", message });
 var error = (check, message) => ({ check, severity: "error", message });
 function readConfig(repoRoot2) {
-  const p = join22(repoRoot2, CONFIG_PATH);
-  if (!existsSync15(p))
+  const p = join21(repoRoot2, CONFIG_PATH);
+  if (!existsSync17(p))
     return { kind: "missing" };
   let raw;
   try {
@@ -14401,8 +14899,8 @@ function diagnoseInstall(repoRoot2, ctx, manifest) {
   for (const op of buildInitOps(ctx)) {
     if (op.kind === "create-file") {
       const check = labelForPath(op.path);
-      const abs2 = join22(repoRoot2, op.path);
-      const exists = existsSync15(abs2);
+      const abs2 = join21(repoRoot2, op.path);
+      const exists = existsSync17(abs2);
       const owned = ownedFiles.has(op.path) || isDefaultedAgentVendorPath(op.path, manifest);
       if (!exists) {
         findings.push(owned ? error(check, `${op.path} is recorded as vinaya-managed but missing on disk — run \`vinaya upgrade\`.`) : error(check, `${op.path} is not installed — run \`vinaya init\`.`));
@@ -14427,7 +14925,7 @@ function diagnoseInstall(repoRoot2, ctx, manifest) {
       const check = "hooks";
       const abs2 = resolveManagedBlockPath(repoRoot2, op.path);
       const owned = ownedBlocks.has(blockKey(op.path, op.marker));
-      if (!existsSync15(abs2)) {
+      if (!existsSync17(abs2)) {
         findings.push(owned ? error(check, `${op.path} is missing — likely a fresh clone (raw git hooks aren't tracked by git). Run \`vinaya upgrade\` to restore it.`) : info(check, `${op.path} is not installed.`));
         continue;
       }
@@ -14479,22 +14977,22 @@ async function diagnoseHookRouting(repoRoot2, hookDir, readHooksPath) {
 function diagnoseCustomChecks(repoRoot2, config) {
   const findings = [];
   for (const [name, entry2] of Object.entries(config.checks ?? {})) {
-    const scriptAbs = join22(repoRoot2, entry2.run);
-    findings.push(existsSync15(scriptAbs) ? ok("checks", `custom check '${name}' → ${entry2.run}`) : error("checks", `custom check '${name}' points at a missing script: ${entry2.run}`));
+    const scriptAbs = join21(repoRoot2, entry2.run);
+    findings.push(existsSync17(scriptAbs) ? ok("checks", `custom check '${name}' → ${entry2.run}`) : error("checks", `custom check '${name}' points at a missing script: ${entry2.run}`));
   }
   return findings;
 }
 function listTrackedFiles(repoRoot2) {
   try {
-    return execFileSync19("git", ["ls-files"], { cwd: repoRoot2, encoding: "utf-8" }).split(`
+    return execFileSync18("git", ["ls-files"], { cwd: repoRoot2, encoding: "utf-8" }).split(`
 `).map((s) => s.trim()).filter(Boolean);
   } catch {
     return [];
   }
 }
 function diagnoseDocOwnersHealth(repoRoot2) {
-  const path = join22(repoRoot2, DOC_OWNERS_PATH);
-  const content = existsSync15(path) ? readFileSync23(path, "utf-8") : null;
+  const path = join21(repoRoot2, DOC_OWNERS_PATH);
+  const content = existsSync17(path) ? readFileSync23(path, "utf-8") : null;
   const state = classifyDocOwnersManifest(content);
   if (state === "absent" || state === "empty")
     return [];
@@ -14511,8 +15009,8 @@ function diagnoseDocOwnersHealth(repoRoot2) {
       findings.push(warn("doc-owners", `${DOC_OWNERS_PATH}:${b.lineNum} binds glob '${b.glob}', which matches none of the ${codeFiles.length} ` + "tracked code file(s) in this repo — the code it names may have been deleted, renamed, or never " + "existed. Repoint the binding to the code's new location, or remove it."));
     }
     if (!isUrlPointer(b.pointer)) {
-      const pointerPath = join22(repoRoot2, pointerToPath(b.pointer));
-      if (!existsSync15(pointerPath)) {
+      const pointerPath = join21(repoRoot2, pointerToPath(b.pointer));
+      if (!existsSync17(pointerPath)) {
         flagged = true;
         findings.push(warn("doc-owners", `${DOC_OWNERS_PATH}:${b.lineNum} points to ${b.pointer}, which does not exist on disk. Repoint the ` + "binding, or add the missing doc."));
       }
@@ -14527,7 +15025,7 @@ var LEGACY_AEG_PACKAGES_PATH = ".aeg/packages";
 function readWorkspacesForDoctor(repoRoot2) {
   const fromPackageJson = () => {
     try {
-      const pkg = JSON.parse(readFileSync23(join22(repoRoot2, "package.json"), "utf-8"));
+      const pkg = JSON.parse(readFileSync23(join21(repoRoot2, "package.json"), "utf-8"));
       return Array.isArray(pkg.workspaces) ? pkg.workspaces.filter((w) => typeof w === "string") : [];
     } catch {
       return [];
@@ -14535,7 +15033,7 @@ function readWorkspacesForDoctor(repoRoot2) {
   };
   const fromPnpmWorkspaceYaml = () => {
     try {
-      return parsePnpmWorkspaceYaml(readFileSync23(join22(repoRoot2, "pnpm-workspace.yaml"), "utf-8"));
+      return parsePnpmWorkspaceYaml(readFileSync23(join21(repoRoot2, "pnpm-workspace.yaml"), "utf-8"));
     } catch {
       return [];
     }
@@ -14544,18 +15042,18 @@ function readWorkspacesForDoctor(repoRoot2) {
 }
 function listChildDirsForDoctor(dir, repoRoot2) {
   try {
-    return readdirSync8(join22(repoRoot2, dir), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
+    return readdirSync8(join21(repoRoot2, dir), { withFileTypes: true }).filter((e) => e.isDirectory()).map((e) => e.name);
   } catch {
     return [];
   }
 }
 function diagnoseBlastRadiusDeprecation(repoRoot2, config) {
   const derived = deriveWorkspacePackageDomains(readWorkspacesForDoctor(repoRoot2), (dir) => listChildDirsForDoctor(dir, repoRoot2));
-  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync15(join22(repoRoot2, p)));
+  const defaults = deriveBuiltinCrossCuttingDefaults((p) => existsSync17(join21(repoRoot2, p)));
   const covered = new Set([...derived, ...defaults]);
   const configExtra = new Set(config?.blastRadius?.extraDomains ?? []);
-  const legacyPath = join22(repoRoot2, LEGACY_AEG_PACKAGES_PATH);
-  if (!existsSync15(legacyPath)) {
+  const legacyPath = join21(repoRoot2, LEGACY_AEG_PACKAGES_PATH);
+  if (!existsSync17(legacyPath)) {
     return [
       info("blast-radius", `checkBlastRadiusScope is active via live derivation (${derived.length} packages/* domain(s)) + built-in defaults (${defaults.length} present) — no ${LEGACY_AEG_PACKAGES_PATH}, and the check is not dormant.`)
     ];
@@ -14595,7 +15093,7 @@ function diagnoseBriefSchemaDrift(config) {
 }
 function diagnoseEnvDeclarations(repoRoot2, config) {
   const resolved = resolveChecks(coreCheckRegistry(), config?.checks).resolved;
-  const specs = resolved.map((entry2) => entry2.source === "config" ? { ...entry2.spec, run: join22(repoRoot2, entry2.spec.run) } : entry2.spec);
+  const specs = resolved.map((entry2) => entry2.source === "config" ? { ...entry2.spec, run: join21(repoRoot2, entry2.spec.run) } : entry2.spec);
   const missing = checksMissingEnvDeclaration(specs);
   const findings = missing.map((name) => info("env", envDeclarationWarning(name)));
   for (const message of lintEnvDeclarations(config?.checks)) {
@@ -14616,7 +15114,7 @@ function diagnoseCheckClassification(config) {
   return findings;
 }
 function diagnoseGlobalConfigChecks() {
-  if (!existsSync15(GLOBAL_CONFIG_PATH))
+  if (!existsSync17(GLOBAL_CONFIG_PATH))
     return [];
   let raw;
   try {
@@ -14669,8 +15167,8 @@ function coversWorkflowsDir(pattern) {
   return bare === ".github/workflows" || bare === "/.github/workflows";
 }
 function diagnoseCodeowners(repoRoot2) {
-  const path = join22(repoRoot2, ".github", "CODEOWNERS");
-  if (!existsSync15(path)) {
+  const path = join21(repoRoot2, ".github", "CODEOWNERS");
+  if (!existsSync17(path)) {
     return info("codeowners", "no .github/CODEOWNERS — vinaya's workflow files have no required-review protection; see `vinaya init`'s printed recommendation.");
   }
   let body;
@@ -14688,7 +15186,7 @@ function diagnoseVinayaOnPath(agents) {
     return [];
   const names = process.platform === "win32" ? ["vinaya.cmd", "vinaya.exe", "vinaya.bat"] : ["vinaya"];
   const dirs = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
-  const onPath = dirs.some((dir) => names.some((name) => existsSync15(join22(dir, name))));
+  const onPath = dirs.some((dir) => names.some((name) => existsSync17(join21(dir, name))));
   return [
     onPath ? ok("vinaya-on-path", "`vinaya` resolves on PATH — agent-native commands will work.") : info("vinaya-on-path", "`vinaya` is not resolvable on PATH — `/vinaya <role>` and the .agents/skills/vinaya-*/SKILL.md files " + 'installed here will fail "command not found" on first use. Run `npm install -g @attalabs/vinaya`.')
   ];
@@ -14700,8 +15198,8 @@ function diagnosePrincipals(config) {
   return info("principals", 'vinaya.config.json has no "principals" — review-gate and the waiver-label actor check both fall back to a ' + "hardcoded placeholder allowlist that will not include anyone on this repo. Every reviewer's verdict is " + 'silently ignored (DANGLING) until you add `"principals": ["<your-github-login>", ...]` to vinaya.config.json.');
 }
 function diagnoseProjectsCoherence(repoRoot2, config) {
-  const registryAbs = join22(repoRoot2, PROJECTS_REGISTRY_PATH);
-  const registryNames = existsSync15(registryAbs) ? new Set(parseRegistry(readFileSync23(registryAbs, "utf-8")).map((p) => p.name)) : new Set;
+  const registryAbs = join21(repoRoot2, PROJECTS_REGISTRY_PATH);
+  const registryNames = existsSync17(registryAbs) ? new Set(parseRegistry(readFileSync23(registryAbs, "utf-8")).map((p) => p.name)) : new Set;
   const configNames = new Set((config?.projects ?? []).map((p) => p.name));
   if (registryNames.size === 0 && configNames.size === 0)
     return [];
@@ -14720,17 +15218,17 @@ var TEST_INVOCATION_SUBSTRINGS = ["npm test", "npm run test", "bun test", "bunx
 function diagnoseTestCi(repoRoot2) {
   let pkg;
   try {
-    pkg = JSON.parse(readFileSync23(join22(repoRoot2, "package.json"), "utf-8"));
+    pkg = JSON.parse(readFileSync23(join21(repoRoot2, "package.json"), "utf-8"));
   } catch {
     return [];
   }
   const testScript = pkg?.scripts?.test;
   if (typeof testScript !== "string" || testScript.trim() === "")
     return [];
-  const workflowsDir = join22(repoRoot2, ".github/workflows");
-  const files = existsSync15(workflowsDir) ? readdirSync8(workflowsDir).filter((name) => statSync3(join22(workflowsDir, name)).isFile()) : [];
+  const workflowsDir = join21(repoRoot2, ".github/workflows");
+  const files = existsSync17(workflowsDir) ? readdirSync8(workflowsDir).filter((name) => statSync3(join21(workflowsDir, name)).isFile()) : [];
   const invoked = files.some((name) => {
-    const content = readFileSync23(join22(workflowsDir, name), "utf-8");
+    const content = readFileSync23(join21(workflowsDir, name), "utf-8");
     return TEST_INVOCATION_SUBSTRINGS.some((s) => content.includes(s));
   });
   if (invoked)
@@ -14827,8 +15325,8 @@ async function doctorCommand(args) {
 }
 
 // src/commands/eject.ts
-import { existsSync as existsSync16, readFileSync as readFileSync24 } from "node:fs";
-import { join as join23 } from "node:path";
+import { existsSync as existsSync18, readFileSync as readFileSync24 } from "node:fs";
+import { join as join22 } from "node:path";
 function realDeps5() {
   return {
     detectRepo: detectGitRepo,
@@ -14845,8 +15343,8 @@ function parse2(args) {
   return { dryRun: args.includes("--dry-run"), yes: args.includes("--yes") };
 }
 function readManifest2(repoRoot2) {
-  const p = join23(repoRoot2, CONFIG_PATH);
-  if (!existsSync16(p))
+  const p = join22(repoRoot2, CONFIG_PATH);
+  if (!existsSync18(p))
     return { kind: "none" };
   let raw;
   try {
@@ -14940,8 +15438,8 @@ async function ejectCommand(args) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync17, readFileSync as readFileSync25, writeFileSync as writeFileSync12 } from "node:fs";
-import { join as join24 } from "node:path";
+import { existsSync as existsSync19, readFileSync as readFileSync25, writeFileSync as writeFileSync11 } from "node:fs";
+import { join as join23 } from "node:path";
 function realDeps6() {
   return {
     detectRepo: detectGitRepo,
@@ -14981,8 +15479,8 @@ function parseAgentsFlag(args) {
 }
 var PRODUCT_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
 function readManifest3(repoRoot2) {
-  const p = join24(repoRoot2, CONFIG_PATH);
-  if (!existsSync17(p))
+  const p = join23(repoRoot2, CONFIG_PATH);
+  if (!existsSync19(p))
     return null;
   try {
     return VinayaConfigSchema.parse(JSON.parse(readFileSync25(p, "utf-8"))).managed ?? null;
@@ -14991,9 +15489,9 @@ function readManifest3(repoRoot2) {
   }
 }
 function writeManifest(repoRoot2, manifest) {
-  const configAbs = join24(repoRoot2, CONFIG_PATH);
+  const configAbs = join23(repoRoot2, CONFIG_PATH);
   const seed = JSON.parse(readFileSync25(configAbs, "utf-8"));
-  writeFileSync12(configAbs, `${JSON.stringify({ ...seed, managed: manifest }, null, 2)}
+  writeFileSync11(configAbs, `${JSON.stringify({ ...seed, managed: manifest }, null, 2)}
 `, "utf-8");
 }
 async function runInit(args, deps) {
@@ -15208,10 +15706,10 @@ function issueEditCommand(args) {
 }
 
 // src/commands/issue-objectives.ts
-import { execFileSync as execFileSync20 } from "node:child_process";
-import { mkdtempSync as mkdtempSync4, rmSync as rmSync8, writeFileSync as writeFileSync13 } from "node:fs";
-import { tmpdir as tmpdir6 } from "node:os";
-import { join as join25 } from "node:path";
+import { execFileSync as execFileSync19 } from "node:child_process";
+import { mkdtempSync as mkdtempSync3, rmSync as rmSync7, writeFileSync as writeFileSync12 } from "node:fs";
+import { tmpdir as tmpdir5 } from "node:os";
+import { join as join24 } from "node:path";
 var RETRY = 'vinaya issue objectives edit <n> --add "<sentence>" | --drop O<k> | --replace O<k> "<sentence>" --reason "<text>"';
 var MARKER_PREFIX = "<!-- aeg:objectives:v";
 var HEADING_RE2 = /^##[ \t]*Objectives[ \t]*$/im;
@@ -15278,7 +15776,7 @@ function parseArgs5(args) {
 function fetchIssueBodyAndComments(issueRef) {
   let out;
   try {
-    out = execFileSync20("gh", ["issue", "view", issueRef, "--json", "body,comments"], {
+    out = execFileSync19("gh", ["issue", "view", issueRef, "--json", "body,comments"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -15342,9 +15840,9 @@ function issueObjectivesEditCommand(args) {
   const previous = parsed.objectives;
   const updated = applyOp(previous, op);
   const newBody = spliceObjectivesSection(body, renderObjectives(updated));
-  const dir = mkdtempSync4(join25(tmpdir6(), "vinaya-objectives-edit-"));
-  const tmp = join25(dir, "body.md");
-  writeFileSync13(tmp, newBody, "utf8");
+  const dir = mkdtempSync3(join24(tmpdir5(), "vinaya-objectives-edit-"));
+  const tmp = join24(dir, "body.md");
+  writeFileSync12(tmp, newBody, "utf8");
   try {
     const ghArgs = ["--body-file", tmp];
     writeValidatedIssueEdit({
@@ -15356,7 +15854,7 @@ function issueObjectivesEditCommand(args) {
       quiet: true
     });
   } finally {
-    rmSync8(dir, { recursive: true, force: true });
+    rmSync7(dir, { recursive: true, force: true });
   }
   const newVersion = objectivesVersion(updated);
   const k = countMarkerComments(comments, MARKER_PREFIX) + 1;
@@ -15381,13 +15879,14 @@ function issueObjectivesEditCommand(args) {
 }
 
 // src/commands/milestone.ts
-import { execFileSync as execFileSync21 } from "node:child_process";
+import { execFileSync as execFileSync20 } from "node:child_process";
 var RETRY_CREATE2 = "vinaya milestone create --title <title> --body-file <path>";
 var RETRY_ADOPT = "vinaya milestone adopt --target <title> --slug <slug> [--slug <slug> ...]";
 var RETRY_EDIT2 = "vinaya milestone edit <n> --body-file <path>";
 var RETRY_CLOSE = "vinaya milestone close --slug <slug>";
-function sh5(args, input) {
-  return execFileSync21(args[0], args.slice(1), {
+var RETRY_STATUS = "vinaya milestone status <n>";
+function sh4(args, input) {
+  return execFileSync20(args[0], args.slice(1), {
     encoding: "utf8",
     input,
     env: process.env,
@@ -15395,13 +15894,19 @@ function sh5(args, input) {
   }).trim();
 }
 function shJson2(args, input) {
-  return JSON.parse(sh5(args, input));
+  return JSON.parse(sh4(args, input));
 }
 function ghErrorDetail(e) {
   const stderr = e?.stderr;
   const text = typeof stderr === "string" ? stderr : stderr?.toString();
   return (text && text.trim().length > 0 ? text : e?.message ?? "unknown error").trim();
 }
+function is404(e) {
+  const stderr = e?.stderr;
+  const haystack = [e?.message ?? "", typeof stderr === "string" ? stderr : stderr?.toString() ?? ""].join(`
+`);
+  return /\b404\b|not found/i.test(haystack);
+}
 function locateBodyOrRefuse2(args, commandName, retryCommand) {
   let result;
   try {
@@ -15469,7 +15974,7 @@ async function milestoneCreateCommand(args) {
   const repoFlag = await resolveRepoFlagOrRefuse(RETRY_CREATE2);
   let out;
   try {
-    out = sh5(["gh", "api", `repos/${repoFlag}/milestones`, "--input", "-"], JSON.stringify({ title, description: body }));
+    out = sh4(["gh", "api", `repos/${repoFlag}/milestones`, "--input", "-"], JSON.stringify({ title, description: body }));
   } catch (e) {
     refuse2([
       makeCheckError("forge-fetch", `\`gh api repos/${repoFlag}/milestones\` failed: ${ghErrorDetail(e)}`, `Check \`gh auth status\` and network, then re-run \`${RETRY_CREATE2}\`.`)
@@ -15508,7 +16013,7 @@ async function milestoneEditCommand(args) {
   const repoFlag = await resolveRepoFlagOrRefuse(RETRY_EDIT2);
   let out;
   try {
-    out = sh5(["gh", "api", "-X", "PATCH", `repos/${repoFlag}/milestones/${number}`, "--input", "-"], JSON.stringify({ description: body }));
+    out = sh4(["gh", "api", "-X", "PATCH", `repos/${repoFlag}/milestones/${number}`, "--input", "-"], JSON.stringify({ description: body }));
   } catch (e) {
     refuse2([
       makeCheckError("forge-fetch", `\`gh api repos/${repoFlag}/milestones/${number}\` failed: ${ghErrorDetail(e)}`, `Check \`gh auth status\` and network, then re-run \`${RETRY_EDIT2}\`.`)
@@ -15635,7 +16140,7 @@ async function milestoneAdoptCommand(args) {
   for (const slugFact of facts.slugs) {
     for (const issueNumber of slugFact.issueNumbers) {
       try {
-        sh5(["gh", "issue", "edit", String(issueNumber), "-R", repoFlag, "--milestone", target]);
+        sh4(["gh", "issue", "edit", String(issueNumber), "-R", repoFlag, "--milestone", target]);
       } catch (e) {
         failMidWrite(`failed to attach Issue #${issueNumber} (tranche \`${slugFact.slug}\`) to Milestone "${target}": ` + `${ghErrorDetail(e)}. Slugs already adopted this run: ${adopted.map((a) => a.slug).join(", ") || "(none)"}.`);
       }
@@ -15646,7 +16151,7 @@ async function milestoneAdoptCommand(args) {
       closedMilestone = legacy.number;
       if (legacy.state !== "closed") {
         try {
-          sh5(["gh", "api", "-X", "PATCH", `repos/${repoFlag}/milestones/${legacy.number}`, "-f", "state=closed"]);
+          sh4(["gh", "api", "-X", "PATCH", `repos/${repoFlag}/milestones/${legacy.number}`, "-f", "state=closed"]);
         } catch (e) {
           failMidWrite(`attached tranche \`${slugFact.slug}\`'s Issue(s) to Milestone "${target}", but failed to close its old ` + `Milestone #${legacy.number}: ${ghErrorDetail(e)}. Slugs already adopted this run: ` + `${adopted.map((a) => a.slug).join(", ") || "(none)"}.`);
         }
@@ -15744,7 +16249,7 @@ async function milestoneCloseCommand(args) {
   }
   let out;
   try {
-    out = sh5(["gh", "api", "-X", "PATCH", `repos/${repoFlag}/milestones/${target.number}`, "-f", "state=closed"]);
+    out = sh4(["gh", "api", "-X", "PATCH", `repos/${repoFlag}/milestones/${target.number}`, "-f", "state=closed"]);
   } catch (e) {
     refuse2([
       makeCheckError("forge-fetch", `\`gh api repos/${repoFlag}/milestones/${target.number}\` failed: ${ghErrorDetail(e)}`, `Check \`gh auth status\` and network, then re-run \`${RETRY_CLOSE}\`.`)
@@ -15757,12 +16262,116 @@ async function milestoneCloseCommand(args) {
     process.stdout.write(`${closed.html_url}
 `);
 }
+function tallyIssueCounts(issues) {
+  const counts = { merged: 0, open: 0, notPlanned: 0 };
+  for (const issue of issues) {
+    if (issue.state === "OPEN")
+      counts.open++;
+    else if (issue.stateReason === "NOT_PLANNED")
+      counts.notPlanned++;
+    else
+      counts.merged++;
+  }
+  return counts;
+}
+function formatIssueCounts(total, counts) {
+  if (total === 0)
+    return "0 issues";
+  const parts = [];
+  if (counts.merged > 0)
+    parts.push(`${counts.merged} merged`);
+  if (counts.open > 0)
+    parts.push(`${counts.open} open`);
+  if (counts.notPlanned > 0)
+    parts.push(`${counts.notPlanned} not planned`);
+  return parts.length > 0 ? `${total} issues · ${parts.join(" · ")}` : `${total} issues`;
+}
+function extractStatusNumber(rest) {
+  const numberArg = rest[0];
+  if (!numberArg || numberArg.startsWith("-") || !/^\d+$/.test(numberArg))
+    return null;
+  return numberArg;
+}
+async function milestoneStatusCommand(args) {
+  const json = args.includes("--json");
+  const rest = args.filter((a) => a !== "--json");
+  const numberArg = extractStatusNumber(rest);
+  if (!numberArg) {
+    refuse2([
+      makeCheckError("forge-args", "`vinaya milestone status` requires the target Milestone number (digits only) as the first argument.", `Pass the Milestone number, e.g. \`${RETRY_STATUS}\`.`)
+    ]);
+  }
+  const repoFlag = await resolveRepoFlagOrRefuse(RETRY_STATUS);
+  const [owner, repo] = repoFlag.split("/");
+  let milestone;
+  try {
+    milestone = shJson2(["gh", "api", `repos/${repoFlag}/milestones/${numberArg}`]);
+  } catch (e) {
+    if (is404(e)) {
+      refuse2([
+        makeCheckError("milestone-status", `Milestone #${numberArg} is not an open-or-closed Milestone in ${repoFlag}.`, `Confirm the number with \`gh api repos/${repoFlag}/milestones\`, then re-run \`${RETRY_STATUS}\`.`)
+      ]);
+    }
+    refuse2([
+      makeCheckError("forge-fetch", `could not fetch Milestone #${numberArg} from the forge: ${ghErrorDetail(e)}`, `Check \`gh auth status\` and network, then re-run \`${RETRY_STATUS}\`.`)
+    ]);
+  }
+  const header = { number: milestone.number, title: milestone.title, state: milestone.state };
+  const intents = intentLines(milestone.description ?? "");
+  if (intents.length === 0) {
+    if (json)
+      printJson({ milestone: header, tranches: [] });
+    else {
+      process.stdout.write(`${header.title} (#${header.number}, ${header.state})
+`);
+      process.stdout.write(`no tranche intents declared
+`);
+    }
+    return;
+  }
+  const rows = [];
+  for (const intent of intents) {
+    let issues;
+    try {
+      issues = await fetchTrancheIssuesAsync(owner, repo, intent.slug);
+    } catch (e) {
+      refuse2([
+        makeCheckError("forge-fetch", `could not fetch tranche \`${intent.slug}\`'s Issues from the forge: ${ghErrorDetail(e)}`, `Check \`gh auth status\` and network, then re-run \`${RETRY_STATUS}\`.`)
+      ]);
+    }
+    let milestoneFacts;
+    try {
+      milestoneFacts = findMilestoneForSlug(owner, repo, intent.slug);
+    } catch (e) {
+      refuse2([
+        makeCheckError("forge-fetch", `could not derive tranche \`${intent.slug}\`'s Milestone facts from the forge: ${ghErrorDetail(e)}`, `Check \`gh auth status\` and network, then re-run \`${RETRY_STATUS}\`.`)
+      ]);
+    }
+    const tranche = trancheFromIssues(intent.slug, issues, milestoneFacts);
+    rows.push({
+      slug: intent.slug,
+      lifecycle: tranche.lifecycle,
+      issues: issues.length,
+      counts: tallyIssueCounts(issues)
+    });
+  }
+  if (json) {
+    printJson({ milestone: header, tranches: rows });
+  } else {
+    process.stdout.write(`${header.title} (#${header.number}, ${header.state})
+`);
+    for (const row2 of rows) {
+      process.stdout.write(`${row2.slug} ${row2.lifecycle} ${formatIssueCounts(row2.issues, row2.counts)}
+`);
+    }
+  }
+}
 
 // src/commands/new-check.ts
-import { chmodSync as chmodSync3, existsSync as existsSync18, mkdirSync as mkdirSync7, readFileSync as readFileSync26, writeFileSync as writeFileSync14 } from "node:fs";
-import { join as join26 } from "node:path";
-var TEMPLATE_PATH2 = join26(packageRoot(import.meta.url), "templates", "custom-check.template.ts");
-var CHECKS_DIR = join26("scripts", "vinaya-checks");
+import { chmodSync as chmodSync3, existsSync as existsSync20, mkdirSync as mkdirSync7, readFileSync as readFileSync26, writeFileSync as writeFileSync13 } from "node:fs";
+import { join as join25 } from "node:path";
+var TEMPLATE_PATH2 = join25(packageRoot(import.meta.url), "templates", "custom-check.template.ts");
+var CHECKS_DIR = join25("scripts", "vinaya-checks");
 var USAGE2 = "Usage: vinaya new check <yourname>/<id>  (both segments: lowercase letters, digits, hyphens; e.g. myteam/vocab-check)";
 function newCheckCommand(args) {
   const name = args[0];
@@ -15779,20 +16388,20 @@ function newCheckCommand(args) {
 \`vinaya check\` refuses the entire run over a key it cannot resolve, so a bare, un-namespaced name would brick every check invocation in this repo.`);
     process.exit(2);
   }
-  const scriptsDir = join26(process.cwd(), CHECKS_DIR);
-  if (!existsSync18(scriptsDir))
+  const scriptsDir = join25(process.cwd(), CHECKS_DIR);
+  if (!existsSync20(scriptsDir))
     mkdirSync7(scriptsDir, { recursive: true });
   const fileStem = name.slice(name.indexOf("/") + 1);
-  const targetPath = join26(scriptsDir, `${fileStem}.ts`);
-  if (existsSync18(targetPath)) {
+  const targetPath = join25(scriptsDir, `${fileStem}.ts`);
+  if (existsSync20(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
   }
   const template = readFileSync26(TEMPLATE_PATH2, "utf-8");
   const contents = template.split("{{CHECK_NAME}}").join(name);
-  writeFileSync14(targetPath, contents, "utf-8");
+  writeFileSync13(targetPath, contents, "utf-8");
   chmodSync3(targetPath, 493);
-  const relPath = join26(CHECKS_DIR, `${fileStem}.ts`);
+  const relPath = join25(CHECKS_DIR, `${fileStem}.ts`);
   const registration = JSON.stringify({ checks: { [name]: { run: `./${relPath}`, scope: "diff" } } }, null, 2);
   process.stdout.write(`Created ${relPath}
 
@@ -15802,10 +16411,10 @@ ${registration}
 }
 
 // src/commands/new-noop-check.ts
-import { chmodSync as chmodSync4, existsSync as existsSync19, mkdirSync as mkdirSync8, readFileSync as readFileSync27, writeFileSync as writeFileSync15 } from "node:fs";
-import { join as join27 } from "node:path";
-var TEMPLATE_PATH3 = join27(packageRoot(import.meta.url), "templates", "noop-check.template.ts");
-var CHECKS_DIR2 = join27("vinaya", "checks");
+import { chmodSync as chmodSync4, existsSync as existsSync21, mkdirSync as mkdirSync8, readFileSync as readFileSync27, writeFileSync as writeFileSync14 } from "node:fs";
+import { join as join26 } from "node:path";
+var TEMPLATE_PATH3 = join26(packageRoot(import.meta.url), "templates", "noop-check.template.ts");
+var CHECKS_DIR2 = join26("vinaya", "checks");
 var USAGE3 = "Usage: vinaya new noop-check <core-check-id>  (the exact id of a core check — run `vinaya check --plan` to list them)";
 function newNoopCheckCommand(args) {
   const name = args[0];
@@ -15819,19 +16428,19 @@ function newNoopCheckCommand(args) {
 \`new noop-check\` only silences a CORE check — a \`checks\` key that exactly matches a core check id REPLACES it. A namespaced or unknown name has nothing to replace; use \`vinaya new check\` to scaffold a new, additive check instead.`);
     process.exit(2);
   }
-  const checksDir = join27(process.cwd(), CHECKS_DIR2);
-  if (!existsSync19(checksDir))
+  const checksDir = join26(process.cwd(), CHECKS_DIR2);
+  if (!existsSync21(checksDir))
     mkdirSync8(checksDir, { recursive: true });
-  const targetPath = join27(checksDir, `${name}.ts`);
-  if (existsSync19(targetPath)) {
+  const targetPath = join26(checksDir, `${name}.ts`);
+  if (existsSync21(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
   }
   const template = readFileSync27(TEMPLATE_PATH3, "utf-8");
   const contents = template.split("{{CHECK_NAME}}").join(name);
-  writeFileSync15(targetPath, contents, "utf-8");
+  writeFileSync14(targetPath, contents, "utf-8");
   chmodSync4(targetPath, 493);
-  const relPath = join27(CHECKS_DIR2, `${name}.ts`);
+  const relPath = join26(CHECKS_DIR2, `${name}.ts`);
   const entry2 = {
     run: `./${relPath}`,
     scope: coreSpec.scope
@@ -15849,10 +16458,10 @@ ${registration}
 }
 
 // src/commands/new-role.ts
-import { existsSync as existsSync20, mkdirSync as mkdirSync9, readFileSync as readFileSync28, writeFileSync as writeFileSync16 } from "node:fs";
-import { join as join28 } from "node:path";
-var TEMPLATE_PATH4 = join28(packageRoot(import.meta.url), "templates", "role.template.md");
-var ROLES_DIR = join28("vinaya", "roles");
+import { existsSync as existsSync22, mkdirSync as mkdirSync9, readFileSync as readFileSync28, writeFileSync as writeFileSync15 } from "node:fs";
+import { join as join27 } from "node:path";
+var TEMPLATE_PATH4 = join27(packageRoot(import.meta.url), "templates", "role.template.md");
+var ROLES_DIR = join27("vinaya", "roles");
 var USAGE4 = "Usage: vinaya new role <yourname>/<id>  (both segments: lowercase letters, digits, hyphens; e.g. acme/qa-lead)";
 function newRoleCommand(args) {
   const name = args[0];
@@ -15865,19 +16474,19 @@ function newRoleCommand(args) {
 A bare, un-namespaced key resolves as an OVERRIDE of a core role — a complete replacement of that role's contract, and a real governance decision this scaffolder does not make for you. Pick a namespaced name, or write the override entry by hand if you really mean to replace a core role's contract.`);
     process.exit(2);
   }
-  const rolesDir = join28(process.cwd(), ROLES_DIR);
-  if (!existsSync20(rolesDir))
+  const rolesDir = join27(process.cwd(), ROLES_DIR);
+  if (!existsSync22(rolesDir))
     mkdirSync9(rolesDir, { recursive: true });
   const roleId = name.slice(name.indexOf("/") + 1);
-  const targetPath = join28(rolesDir, `${roleId}.md`);
-  if (existsSync20(targetPath)) {
+  const targetPath = join27(rolesDir, `${roleId}.md`);
+  if (existsSync22(targetPath)) {
     console.error(`Error: ${targetPath} already exists.`);
     process.exit(1);
   }
   const template = readFileSync28(TEMPLATE_PATH4, "utf-8");
   const contents = template.split("{{ROLE_ID}}").join(roleId);
-  writeFileSync16(targetPath, contents, "utf-8");
-  const relPath = join28(ROLES_DIR, `${roleId}.md`);
+  writeFileSync15(targetPath, contents, "utf-8");
+  const relPath = join27(ROLES_DIR, `${roleId}.md`);
   const registration = JSON.stringify({ roles: { [name]: { contract: `./${relPath}` } } }, null, 2);
   process.stdout.write(`Created ${relPath}
 
@@ -15887,7 +16496,7 @@ ${registration}
 }
 
 // src/commands/pr.ts
-import { execFileSync as execFileSync22 } from "node:child_process";
+import { execFileSync as execFileSync21 } from "node:child_process";
 
 // src/lib/numstat.ts
 function summariseNumstat(numstat) {
@@ -16113,6 +16722,23 @@ function blankUnanchoredStructuralFields(body) {
 `).map((l) => blankProjectField(blankTierField(l))).join(`
 `);
 }
+var OBJECTIVE_MARKER_LINE = /^ {0,3}O\d{1,9}\./;
+function blankObjectiveMarkerLine(line) {
+  const m = OBJECTIVE_MARKER_LINE.exec(line);
+  if (!m)
+    return line;
+  return " ".repeat(m[0].length) + line.slice(m[0].length);
+}
+function blankObjectiveMarkers(body) {
+  const bounds = objectivesSectionBounds(body);
+  if (!bounds)
+    return body;
+  const section = body.slice(bounds.start, bounds.end);
+  const blanked = section.split(`
+`).map(blankObjectiveMarkerLine).join(`
+`);
+  return body.slice(0, bounds.start) + blanked + body.slice(bounds.end);
+}
 var CLOSES_REF = /Closes\s*#\d+/i;
 var EVIDENCE_HEADING = /^#{1,6}\s/;
 var EVIDENCE_HEAD_LINE = /^Head:\s*\S+$/i;
@@ -16140,6 +16766,7 @@ function buildScanMask(ctx) {
   masked = blankPremiseValues(masked);
   masked = blankTokenReportSection(masked);
   masked = blankUnanchoredStructuralFields(masked);
+  masked = blankObjectiveMarkers(masked);
   return masked;
 }
 var TOKEN_WITH_DIGIT = /\S*\p{Nd}\S*/gu;
@@ -16179,7 +16806,7 @@ var RETRY_CREATE3 = "vinaya pr create --validate-only …";
 var RETRY_EDIT3 = "vinaya pr edit <n> --validate-only …";
 function git4(args) {
   try {
-    return execFileSync22("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync21("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
@@ -16213,7 +16840,7 @@ function reportPass2(json, command) {
 function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
   const { finalArgs, cleanup: cleanup2 } = resolveShippableArgs(ghArgs, bodyResult);
   try {
-    const out = execFileSync22("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
+    const out = execFileSync21("gh", [...ghCmd, ...finalArgs], { encoding: "utf8", stdio: ["ignore", "pipe", "inherit"] });
     const url = out.trim();
     if (json)
       printJson({ validated: true, written: true, url });
@@ -16228,7 +16855,7 @@ function runGhWrite2(ghCmd, ghArgs, bodyResult, json) {
 function fetchPrForgeContext(prRef) {
   let viewOut;
   try {
-    viewOut = execFileSync22("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
+    viewOut = execFileSync21("gh", ["pr", "view", prRef, "--json", "headRefName,files"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -16375,7 +17002,7 @@ function prEditCommand(args) {
 }
 
 // src/commands/pr-rule.ts
-import { execFileSync as execFileSync23 } from "node:child_process";
+import { execFileSync as execFileSync22 } from "node:child_process";
 import { readFileSync as readFileSync29 } from "node:fs";
 var RETRY2 = "vinaya pr rule <pr> --file <ruling.md>";
 var NO_CODE_REVIEW_CANDIDATE = "no code-reviewer verdict comment found on this PR";
@@ -16400,7 +17027,7 @@ function refuseIfCastsAVerdict(body, filePath) {
 function fetchPrCommentBodies(prRef) {
   let out;
   try {
-    out = execFileSync23("gh", ["pr", "view", prRef, "--json", "comments"], {
+    out = execFileSync22("gh", ["pr", "view", prRef, "--json", "comments"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -16460,22 +17087,22 @@ function prRuleCommand(args) {
 }
 
 // src/commands/pr-report.ts
-import { execFileSync as execFileSync24, spawnSync as spawnSync2 } from "node:child_process";
-import { existsSync as existsSync21, mkdtempSync as mkdtempSync5, readFileSync as readFileSync30, rmSync as rmSync9, writeFileSync as writeFileSync17 } from "node:fs";
-import { tmpdir as tmpdir7 } from "node:os";
-import { join as join29 } from "node:path";
+import { execFileSync as execFileSync23, spawnSync as spawnSync2 } from "node:child_process";
+import { existsSync as existsSync23, mkdtempSync as mkdtempSync4, readFileSync as readFileSync30, rmSync as rmSync8, writeFileSync as writeFileSync16 } from "node:fs";
+import { tmpdir as tmpdir6 } from "node:os";
+import { join as join28 } from "node:path";
 var EVIDENCE_START = "<!-- AEG:EVIDENCE:START -->";
 var EVIDENCE_END = "<!-- AEG:EVIDENCE:END -->";
 function git5(args) {
   try {
-    return execFileSync24("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+    return execFileSync23("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   } catch {
     return "";
   }
 }
 function gh3(args) {
   try {
-    return execFileSync24("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync23("gh", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new Error(String(stderr ?? err.message).trim() || "gh command failed");
@@ -16494,7 +17121,7 @@ class GitCommandError extends Error {
 }
 function gitStrict(args) {
   try {
-    return execFileSync24("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+    return execFileSync23("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
   } catch (err) {
     const stderr = err.stderr;
     throw new GitCommandError(args, String(stderr ?? err.message).trim() || "non-zero exit");
@@ -16527,10 +17154,27 @@ function computeGroupA() {
   const numstat = gitStrict(["diff", `${base}...${head}`, "--numstat"]);
   return { head, base, numstat };
 }
+function describeGradedBodySource(source) {
+  switch (source) {
+    case "write":
+      return "the drafted body file (`--write`)";
+    case "push":
+      return "the live pull-request body (`--push`)";
+    case "ambient":
+      return "the ambient `PR_BODY` environment (no `--write`/`--push`)";
+  }
+}
+var BODY_READING_CHECK_NAMES = new Set(coreCheckRegistry().filter((spec) => {
+  const decl = spec.env?.PR_BODY;
+  return decl === true || typeof decl === "object" && decl !== null && "optional" in decl;
+}).map((spec) => spec.name));
+function shouldRenderAsSkipped(outcome, gradedBody) {
+  return gradedBody === "" && outcome.status === "pass" && outcome.errors.length === 0 && BODY_READING_CHECK_NAMES.has(outcome.name);
+}
 function resolveSelfEntry() {
   const root = packageRoot(import.meta.url);
-  const dist = join29(root, "dist", "index.js");
-  return existsSync21(dist) ? dist : join29(root, "src", "index.ts");
+  const dist = join28(root, "dist", "index.js");
+  return existsSync23(dist) ? dist : join28(root, "src", "index.ts");
 }
 var FAILING_STATUSES = new Set(["fail", "error", "timeout"]);
 function anyGateFailed(outcomes) {
@@ -16577,7 +17221,7 @@ function renderGroupA(groupA) {
   ].join(`
 `);
 }
-function renderGroupB(outcomes) {
+function renderGroupB(outcomes, gradedBodySource) {
   const sorted = [...outcomes].sort((a, b) => a.name.localeCompare(b.name));
   const lines = sorted.flatMap((o) => {
     const rows = [`${o.name}: ${o.status}`];
@@ -16585,8 +17229,18 @@ function renderGroupB(outcomes) {
       rows.push(`  ${e.severity}: ${e.message}`);
     return rows;
   });
-  return ["### Group B — attested", "", "`vinaya check --all --diff-only`", "", "```", lines.join(`
-`), "```"].join(`
+  return [
+    "### Group B — attested",
+    "",
+    "`vinaya check --all --diff-only`",
+    "",
+    `Graded body: ${describeGradedBodySource(gradedBodySource)}`,
+    "",
+    "```",
+    lines.join(`
+`),
+    "```"
+  ].join(`
 `);
 }
 var AGENT_COMMAND_TIMEOUT_MS = 30000;
@@ -16652,14 +17306,14 @@ function renderGroupC(groupC) {
 `)].join(`
 `);
 }
-function buildBlockInner(groupA, gateOutcomes, groupC) {
+function buildBlockInner(groupA, gateOutcomes, groupC, gradedBodySource) {
   return [
     `Head: ${groupA.head}`,
     `${EVIDENCE_SUMMARY_PREFIX}\`${summariseNumstat(groupA.numstat)}\``,
     "",
     renderGroupA(groupA),
     "",
-    renderGroupB(gateOutcomes),
+    renderGroupB(gateOutcomes, gradedBodySource),
     "",
     renderGroupC(groupC)
   ].join(`
@@ -16846,9 +17500,11 @@ async function buildReport(opts = {}) {
   const groupA = opts.groupA ?? computeGroupA();
   const gateRunner = opts.gateRunner ?? runRealGates;
   const gateResult = await gateRunner();
-  const outcomes = gateResult.outcomes.filter((o) => o.name !== "evidence-fresh");
-  const groupC = opts.groupC ?? computeGroupC(opts.body ?? process.env.PR_BODY ?? "");
-  const blockInner = buildBlockInner(groupA, outcomes, groupC);
+  const gradedBody = opts.body ?? process.env.PR_BODY ?? "";
+  const gradedBodySource = opts.gradedBodySource ?? "ambient";
+  const outcomes = gateResult.outcomes.filter((o) => o.name !== "evidence-fresh").map((o) => shouldRenderAsSkipped(o, gradedBody) ? { ...o, status: "skipped" } : o);
+  const groupC = opts.groupC ?? computeGroupC(gradedBody);
+  const blockInner = buildBlockInner(groupA, outcomes, groupC, gradedBodySource);
   const block = `${EVIDENCE_START}
 ${blockInner}
 ${EVIDENCE_END}`;
@@ -16862,16 +17518,16 @@ ${EVIDENCE_END}`;
 }
 var USAGE5 = "Usage: vinaya pr report [--write <body-file> | --push <pr>] [--phase <phase>] [--role <role>] " + "[--model <id>] [--transcript <path>]";
 function ghEditBody(pr, body) {
-  const dir = mkdtempSync5(join29(tmpdir7(), "vinaya-pr-report-push-"));
-  const tmp = join29(dir, "body.md");
-  writeFileSync17(tmp, body);
+  const dir = mkdtempSync4(join28(tmpdir6(), "vinaya-pr-report-push-"));
+  const tmp = join28(dir, "body.md");
+  writeFileSync16(tmp, body);
   try {
     gh3(["pr", "edit", pr, "--body-file", tmp]);
   } finally {
-    rmSync9(dir, { recursive: true, force: true });
+    rmSync8(dir, { recursive: true, force: true });
   }
 }
-async function prReportCommand(args) {
+async function prReportCommand(args, testOverrides) {
   const writeIdx = args.indexOf("--write");
   const writePath = writeIdx !== -1 ? args[writeIdx + 1] : undefined;
   const pushIdx = args.indexOf("--push");
@@ -16914,10 +17570,19 @@ ${USAGE5}`);
     process.env.PR_NUMBER = pushPr;
     process.env.BRANCH = git5(["rev-parse", "--abbrev-ref", "HEAD"]);
   }
-  const existingForWrite = writePath === undefined ? undefined : existsSync21(writePath) ? readFileSync30(writePath, "utf8") : "";
+  const existingForWrite = writePath === undefined ? undefined : existsSync23(writePath) ? readFileSync30(writePath, "utf8") : "";
+  if (writePath !== undefined) {
+    process.env.PR_BODY = existingForWrite;
+    process.env.BRANCH = git5(["rev-parse", "--abbrev-ref", "HEAD"]);
+  }
+  const gradedBodySource = pushPr ? "push" : writePath !== undefined ? "write" : "ambient";
   let result;
   try {
-    result = await buildReport({ body: preEditBody ?? existingForWrite });
+    result = await buildReport({
+      body: preEditBody ?? existingForWrite,
+      gradedBodySource,
+      gateRunner: testOverrides?.gateRunner
+    });
   } catch (err) {
     if (err instanceof UnresolvableMergeBaseError || err instanceof GitCommandError) {
       console.error(`vinaya pr report: refused — ${err.message}`);
@@ -16958,9 +17623,9 @@ ${USAGE5}`);
       try {
         ghEditBody(pushPr, preEditBody);
       } catch (err) {
-        const dir = mkdtempSync5(join29(tmpdir7(), "vinaya-pr-report-push-restore-failed-"));
-        const savePath = join29(dir, "pre-edit-body.md");
-        writeFileSync17(savePath, preEditBody);
+        const dir = mkdtempSync4(join28(tmpdir6(), "vinaya-pr-report-push-restore-failed-"));
+        const savePath = join28(dir, "pre-edit-body.md");
+        writeFileSync16(savePath, preEditBody);
         console.error(`vinaya pr report: self-verification FAILED on PR ${pushPr} AND the restore of its pre-edit body also failed: ${err instanceof Error ? err.message : String(err)}. PR ${pushPr}'s body may now be corrupted — the pre-edit body was saved to ${savePath}; restore it by hand with \`gh pr edit ${pushPr} --body-file ${savePath}\`.`);
         process.exit(1);
       }
@@ -16993,7 +17658,7 @@ The AEG:EVIDENCE block was still pushed to PR ${pushPr}.`);
       transcriptPath,
       modelOverride
     });
-    writeFileSync17(writePath, composeWrittenBody(existing, result.blockInner, tokens));
+    writeFileSync16(writePath, composeWrittenBody(existing, result.blockInner, tokens));
     if (tokens.collected) {
       process.stdout.write(`Wrote AEG:EVIDENCE and AEG:TOKENS blocks to ${writePath}
 `);
@@ -17013,7 +17678,7 @@ The AEG:EVIDENCE block was still written to ${writePath}.`);
 }
 
 // src/commands/pr-verify-evidence.ts
-import { execFileSync as execFileSync25 } from "node:child_process";
+import { execFileSync as execFileSync24 } from "node:child_process";
 
 // src/commands/pr-verify-evidence-logic.ts
 function publishedMergeBase(region) {
@@ -17100,10 +17765,10 @@ function renderVerdict(verdict) {
 
 // src/commands/pr-verify-evidence.ts
 function gh4(args) {
-  return execFileSync25("gh", args, { encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
+  return execFileSync24("gh", args, { encoding: "utf8", maxBuffer: 32 * 1024 * 1024 });
 }
 function assertCleanWorktree() {
-  const dirty = execFileSync25("git", ["status", "--porcelain"], {
+  const dirty = execFileSync24("git", ["status", "--porcelain"], {
     encoding: "utf8",
     cwd: repoRoot2()
   }).trim();
@@ -17140,7 +17805,7 @@ function assertRepoRootCwd() {
   process.exit(2);
 }
 function repoRoot2() {
-  return execFileSync25("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
+  return execFileSync24("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8" }).trim();
 }
 async function prVerifyEvidenceCommand(args) {
   const prRef = args[0] && !args[0].startsWith("-") ? args[0] : undefined;
@@ -17164,7 +17829,7 @@ async function prVerifyEvidenceCommand(args) {
     process.exit(1);
     return;
   }
-  const localHead = execFileSync25("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).trim();
+  const localHead = execFileSync24("git", ["rev-parse", "HEAD"], { encoding: "utf8" }).trim();
   if (!forgeHead) {
     process.stderr.write(`pr verify-evidence: REFUSED — could not read #${prRef}'s head from the forge, so the verdict cannot be bound to a commit.
 `);
@@ -17187,13 +17852,13 @@ async function prVerifyEvidenceCommand(args) {
 }
 
 // src/commands/quickstart.ts
-import { execFileSync as execFileSync26 } from "node:child_process";
-import { existsSync as existsSync23, readFileSync as readFileSync32 } from "node:fs";
-import { join as join31 } from "node:path";
+import { execFileSync as execFileSync25 } from "node:child_process";
+import { existsSync as existsSync25, readFileSync as readFileSync32 } from "node:fs";
+import { join as join30 } from "node:path";
 
 // src/lib/doc-owners-write.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync10, readFileSync as readFileSync31, writeFileSync as writeFileSync18 } from "node:fs";
-import { dirname as dirname10, join as join30 } from "node:path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync10, readFileSync as readFileSync31, writeFileSync as writeFileSync17 } from "node:fs";
+import { dirname as dirname11, join as join29 } from "node:path";
 function bindingLine(glob, pointer) {
   return `${glob}  ${pointer}`;
 }
@@ -17209,9 +17874,9 @@ function appendDocOwnersBinding(content, glob, pointer) {
 `;
 }
 function planDocOwnersBinding(repoRoot3, glob, pointer) {
-  const abs2 = join30(repoRoot3, DOC_OWNERS_PATH);
+  const abs2 = join29(repoRoot3, DOC_OWNERS_PATH);
   const line = bindingLine(glob, pointer);
-  if (!existsSync22(abs2)) {
+  if (!existsSync24(abs2)) {
     return { action: "create-host", line, path: DOC_OWNERS_PATH };
   }
   const existing = readFileSync31(abs2, "utf-8");
@@ -17219,13 +17884,13 @@ function planDocOwnersBinding(repoRoot3, glob, pointer) {
   return { action: already ? "skip-present" : "append-row", line, path: DOC_OWNERS_PATH };
 }
 function applyDocOwnersBinding(repoRoot3, plan, glob, pointer) {
-  const abs2 = join30(repoRoot3, DOC_OWNERS_PATH);
+  const abs2 = join29(repoRoot3, DOC_OWNERS_PATH);
   if (plan.action === "create-host") {
-    mkdirSync10(dirname10(abs2), { recursive: true });
-    writeFileSync18(abs2, freshDocOwners(glob, pointer), "utf-8");
+    mkdirSync10(dirname11(abs2), { recursive: true });
+    writeFileSync17(abs2, freshDocOwners(glob, pointer), "utf-8");
   } else if (plan.action === "append-row") {
     const existing = readFileSync31(abs2, "utf-8");
-    writeFileSync18(abs2, appendDocOwnersBinding(existing, glob, pointer), "utf-8");
+    writeFileSync17(abs2, appendDocOwnersBinding(existing, glob, pointer), "utf-8");
   }
 }
 function renderDocOwnersBindingDiffLine(plan) {
@@ -17288,7 +17953,7 @@ function pointerIsMissingLocalFile(repoRoot3, pointer) {
   if (/^https?:\/\//i.test(pointer))
     return false;
   const path = pointer.split("#")[0] ?? pointer;
-  return !existsSync23(join31(repoRoot3, path));
+  return !existsSync25(join30(repoRoot3, path));
 }
 async function bindDocOwnerLoop(deps, repoRoot3) {
   let any = false;
@@ -17355,7 +18020,7 @@ async function registerProjectLoop(deps) {
   }
 }
 function readPackageVersion() {
-  const pkg = JSON.parse(readFileSync32(join31(packageRoot(import.meta.url), "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync32(join30(packageRoot(import.meta.url), "package.json"), "utf-8"));
   return pkg.version;
 }
 function realDeps7() {
@@ -17387,7 +18052,7 @@ function realDeps7() {
   };
 }
 function execGit(repoRoot3, args) {
-  return execFileSync26("git", args, { cwd: repoRoot3, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+  return execFileSync25("git", args, { cwd: repoRoot3, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
 function errorDetail(err) {
   const stderr = err.stderr;
@@ -17521,11 +18186,11 @@ async function quickstartCommand(args) {
 }
 
 // src/commands/release.ts
-import { execFileSync as execFileSync27 } from "node:child_process";
+import { execFileSync as execFileSync26 } from "node:child_process";
 function realDeps8() {
   const git6 = (args) => {
     try {
-      return execFileSync27("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+      return execFileSync26("git", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
     } catch {
       return null;
     }
@@ -17544,7 +18209,7 @@ function realDeps8() {
     },
     fetchOrigin() {
       try {
-        execFileSync27("git", ["fetch", "origin"], { stdio: "inherit" });
+        execFileSync26("git", ["fetch", "origin"], { stdio: "inherit" });
         return true;
       } catch {
         return false;
@@ -17565,14 +18230,14 @@ function realDeps8() {
     },
     npmWhoami() {
       try {
-        execFileSync27("npm", ["whoami"], { stdio: "ignore" });
+        execFileSync26("npm", ["whoami"], { stdio: "ignore" });
         return true;
       } catch {
         return false;
       }
     },
     runStreamed(cmd, args) {
-      execFileSync27(cmd, args, { stdio: "inherit" });
+      execFileSync26(cmd, args, { stdio: "inherit" });
     },
     tagsAtHead() {
       const tags = git6(["tag", "--points-at", "HEAD"]);
@@ -17583,7 +18248,7 @@ function realDeps8() {
     },
     npmViewVersion(pkg) {
       try {
-        const out = execFileSync27("npm", ["view", pkg, "version"], {
+        const out = execFileSync26("npm", ["view", pkg, "version"], {
           encoding: "utf8",
           stdio: ["ignore", "pipe", "pipe"]
         }).trim();
@@ -17725,11 +18390,11 @@ async function releaseCommand(args) {
 }
 
 // src/commands/review-status.ts
-import { execFileSync as execFileSync28 } from "node:child_process";
+import { execFileSync as execFileSync27 } from "node:child_process";
 var MAX_ROUNDS2 = 3;
 function fetchPr(prNumber) {
   try {
-    const out = execFileSync28("gh", ["pr", "view", prNumber, "--json", "comments,headRefOid,baseRefName"], {
+    const out = execFileSync27("gh", ["pr", "view", prNumber, "--json", "comments,headRefOid,baseRefName"], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -17740,7 +18405,7 @@ function fetchPr(prNumber) {
 }
 function behindBy(base) {
   try {
-    const out = execFileSync28("git", ["rev-list", "--count", `HEAD..origin/${base}`], {
+    const out = execFileSync27("git", ["rev-list", "--count", `HEAD..origin/${base}`], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     }).trim();
@@ -17783,9 +18448,9 @@ async function reviewStatusCommand(args) {
 
 // src/commands/studio.ts
 import { execFile as execFile5, spawn as spawn3 } from "node:child_process";
-import { existsSync as existsSync24, readFileSync as readFileSync33, renameSync as renameSync2 } from "node:fs";
+import { existsSync as existsSync26, readFileSync as readFileSync33, renameSync as renameSync2 } from "node:fs";
 import net from "node:net";
-import { dirname as dirname11, join as join32 } from "node:path";
+import { dirname as dirname12, join as join31 } from "node:path";
 import { promisify as promisify5 } from "node:util";
 
 // src/lib/studio-bundle.ts
@@ -17838,9 +18503,9 @@ class PortFlagError extends Error {
 function resolveStudioTarget(cwd, moduleUrl = import.meta.url) {
   let dir = cwd;
   for (;; ) {
-    const webDir = join32(dir, "apps", "vinaya-studio", "web");
-    const pkgPath = join32(webDir, "package.json");
-    if (existsSync24(pkgPath)) {
+    const webDir = join31(dir, "apps", "vinaya-studio", "web");
+    const pkgPath = join31(webDir, "package.json");
+    if (existsSync26(pkgPath)) {
       try {
         const pkg = JSON.parse(readFileSync33(pkgPath, "utf-8"));
         if (pkg.name === "@atta/vinaya-studio-web") {
@@ -17848,15 +18513,15 @@ function resolveStudioTarget(cwd, moduleUrl = import.meta.url) {
         }
       } catch {}
     }
-    if (existsSync24(join32(dir, ".git")))
+    if (existsSync26(join31(dir, ".git")))
       break;
-    const parent = dirname11(dir);
+    const parent = dirname12(dir);
     if (parent === dir)
       break;
     dir = parent;
   }
-  const standaloneWebDir = join32(packageRoot(moduleUrl), "studio-standalone", "apps", "vinaya-studio", "web");
-  if (existsSync24(join32(standaloneWebDir, "server.js"))) {
+  const standaloneWebDir = join31(packageRoot(moduleUrl), "studio-standalone", "apps", "vinaya-studio", "web");
+  if (existsSync26(join31(standaloneWebDir, "server.js"))) {
     return { kind: "package", packageDir: standaloneWebDir };
   }
   return { kind: "missing" };
@@ -17876,9 +18541,9 @@ function isPortFree(port) {
   });
 }
 function ensureStudioNodeModules(bundleRoot) {
-  const real = join32(bundleRoot, "node_modules");
-  const packed = join32(bundleRoot, STUDIO_NODE_MODULES_PACKED_DIRNAME);
-  if (!existsSync24(real) && existsSync24(packed)) {
+  const real = join31(bundleRoot, "node_modules");
+  const packed = join31(bundleRoot, STUDIO_NODE_MODULES_PACKED_DIRNAME);
+  if (!existsSync26(real) && existsSync26(packed)) {
     renameSync2(packed, real);
   }
 }
@@ -17927,8 +18592,8 @@ async function runStudio(cwd, args, moduleUrl = import.meta.url) {
       }
       return spawnDev(target.webDir, args);
     case "package": {
-      const bundleRoot = join32(target.packageDir, "..", "..", "..");
-      return spawnStandalone(cwd, join32(target.packageDir, "server.js"), bundleRoot, explicitPort);
+      const bundleRoot = join31(target.packageDir, "..", "..", "..");
+      return spawnStandalone(cwd, join31(target.packageDir, "server.js"), bundleRoot, explicitPort);
     }
     case "missing":
       console.error("Vinaya Studio isn't available in this install — no published @attalabs/vinaya build bundles the Studio app yet. Inside a checkout that contains Studio's source (apps/vinaya-studio/web), `vinaya studio` runs it directly.");
@@ -17936,12 +18601,180 @@ async function runStudio(cwd, args, moduleUrl = import.meta.url) {
   }
 }
 
+// src/lib/dispatch-task.ts
+import { execFileSync as execFileSync28 } from "node:child_process";
+import { createHash as createHash7 } from "node:crypto";
+import { mkdtempSync as mkdtempSync5, rmSync as rmSync9, writeFileSync as writeFileSync18 } from "node:fs";
+import { tmpdir as tmpdir7 } from "node:os";
+import { join as join32 } from "node:path";
+var DISPATCH_AGENTS = ["claude", "codex", "gemini"];
+
+class DispatchTaskError extends Error {
+}
+function sh5(cmd, args) {
+  return execFileSync28(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] }).trim();
+}
+function briefHash(brief) {
+  return createHash7("sha256").update(`${brief}
+`).digest("hex");
+}
+function fetchIssueComments2(n) {
+  let out;
+  try {
+    out = sh5("gh", ["issue", "view", String(n), "--json", "comments"]);
+  } catch (err) {
+    throw new DispatchTaskError(`could not fetch Issue #${n}'s comments (\`gh issue view\`) to check for an existing brief — refusing rather than risking a duplicate: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  try {
+    return JSON.parse(out).comments.map((c) => ({
+      body: c.body,
+      url: c.url,
+      author: c.author?.login ?? null
+    }));
+  } catch {
+    throw new DispatchTaskError(`could not parse \`gh issue view ${n} --json comments\` output.`);
+  }
+}
+function principalAllowlist2() {
+  return resolvePrincipalAllowlist(loadTrustAnchorConfig());
+}
+function fetchIssueBody(n) {
+  try {
+    return JSON.parse(sh5("gh", ["issue", "view", String(n), "--json", "body"])).body;
+  } catch (err) {
+    throw new DispatchTaskError(`could not fetch Issue #${n}'s body (\`gh issue view\`) to resolve its suggested agent-class: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+function extractAgentClass(rawRationaleField) {
+  const m = /agent-class\**\s*[—–-]\s*(\w+)/i.exec(rawRationaleField);
+  const word = m?.[1]?.toLowerCase();
+  return word !== undefined && isAgentClass(word) ? word : null;
+}
+function resolveModelFromRationale(agent, rawRationaleField, explicitModel) {
+  if (explicitModel !== undefined)
+    return explicitModel;
+  const agentClass = rawRationaleField !== undefined ? extractAgentClass(rawRationaleField) : null;
+  if (agentClass === null)
+    return;
+  return resolveClassModel(agent, agentClass) ?? undefined;
+}
+function resolveModelForDispatch(agent, issue, explicitModel) {
+  if (explicitModel !== undefined)
+    return explicitModel;
+  const raw = parseRationaleFields(fetchIssueBody(issue)).suggestedAgentClass;
+  return resolveModelFromRationale(agent, raw, undefined);
+}
+function findExistingFrozenBrief(n) {
+  return resolveNewestFrozenBrief(fetchIssueComments2(n), principalAllowlist2());
+}
+async function withPromptFile2(prompt2, fn) {
+  const dir = mkdtempSync5(join32(tmpdir7(), "vinaya-dispatch-prompt-"));
+  const promptFile = join32(dir, "prompt.md");
+  writeFileSync18(promptFile, prompt2, "utf8");
+  try {
+    return await fn(promptFile);
+  } finally {
+    rmSync9(dir, { recursive: true, force: true });
+  }
+}
+function resolveDispatchAuthorization() {
+  const login = currentGhLogin();
+  const allowlist = resolvePrincipalAllowlist(loadTrustAnchorConfig());
+  return { authorized: login !== null && isPrincipal(login, allowlist), login };
+}
+var defaultPrepareTaskDeps = {
+  assembleAndRenderBrief,
+  findExistingFrozenBrief,
+  postMarkedComment,
+  resolveDispatchAuthorization
+};
+async function prepareTask(input, deps = defaultPrepareTaskDeps) {
+  const { tranche, n, supersede } = input;
+  {
+    const { authorized, login } = deps.resolveDispatchAuthorization();
+    if (!authorized) {
+      throw new DispatchTaskError(login === null ? "could not resolve the identity `gh` is authenticated as — preparing a task is Principal-only and refuses rather than proceeding with an unverified actor." : `\`${login}\` is not on the Principal allowlist — preparing a task is Principal-only.`);
+    }
+  }
+  if (supersede && supersede.reason.trim().length === 0) {
+    throw new DispatchTaskError("--supersede requires --reason <text> — a superseding brief must name why the prior one was wrong, same authorization as a first freeze, never a silent rewrite.");
+  }
+  if (supersede && /[\r\n]/.test(supersede.reason)) {
+    throw new DispatchTaskError("--reason must be a single line — it becomes one line of the frozen comment header, and a newline in it would corrupt every reader's header-line count for this version.");
+  }
+  const result = await deps.assembleAndRenderBrief(tranche, String(n));
+  if (!result.ok) {
+    throw new DispatchTaskError(`cannot dispatch — brief render refused:
+${result.missing.map((m) => `  - ${m}`).join(`
+`)}`);
+  }
+  const issue = result.issue;
+  const existing = deps.findExistingFrozenBrief(issue);
+  const hash = briefHash(result.brief);
+  let marker;
+  let commentBody;
+  let version;
+  if (supersede) {
+    if (!existing) {
+      throw new DispatchTaskError(`Task ${n} in tranche \`${tranche}\` has no frozen brief yet — nothing to supersede. Run \`vinaya task brief ${tranche} ${n}\` without --supersede first.`);
+    }
+    version = existing.version + 1;
+    marker = briefMarkerFor(version);
+    commentBody = `Brief hash: ${hash}
+Supersedes: ${existing.url} — ${supersede.reason}
+${result.brief}`;
+  } else {
+    if (existing) {
+      throw new DispatchTaskError(`Task ${n} in tranche \`${tranche}\` is already dispatched — see ${existing.url}`);
+    }
+    version = 1;
+    marker = AEG_BRIEF_V1_MARKER;
+    commentBody = `Brief hash: ${hash}
+${result.brief}`;
+  }
+  if (deps.beforePost) {
+    await deps.beforePost(issue);
+  }
+  const url = deps.postMarkedComment("issue", String(issue), marker, commentBody);
+  return { issue, brief: result.brief, commentUrl: url, version };
+}
+var defaultDeps3 = {
+  assembleAndRenderBrief,
+  findExistingFrozenBrief,
+  postMarkedComment,
+  dispatchRole,
+  resolveDispatchAuthorization,
+  resolveModelForDispatch
+};
+async function dispatchTask(input, deps = defaultDeps3) {
+  const { tranche, n, agent, model } = input;
+  let resolvedModel;
+  const prep = await prepareTask({ tranche, n }, {
+    assembleAndRenderBrief: deps.assembleAndRenderBrief,
+    findExistingFrozenBrief: deps.findExistingFrozenBrief,
+    postMarkedComment: deps.postMarkedComment,
+    resolveDispatchAuthorization: deps.resolveDispatchAuthorization,
+    beforePost: agent ? async (issue) => {
+      resolvedModel = deps.resolveModelForDispatch(agent, issue, model);
+    } : undefined
+  });
+  if (agent) {
+    await withPromptFile2(prep.brief, (promptFile) => deps.dispatchRole("developer", agent, prep.brief, {
+      task: prep.issue,
+      promptFile,
+      model: resolvedModel
+    }));
+  }
+  return { posted: true, commentUrl: prep.commentUrl, brief: prep.brief };
+}
+
 // src/commands/task.ts
 async function taskDispatchCommand(args) {
   const trancheSlug = args[0];
   const taskIdArg = args[1];
   if (!trancheSlug || !taskIdArg || trancheSlug.startsWith("--")) {
-    console.error(`Usage: vinaya task dispatch <tranche> <n> [--agent ${DISPATCH_AGENTS.join(" | ")}] [--model <name>]`);
+    console.error(`Usage: vinaya task dispatch <tranche> <n> [--agent ${DISPATCH_AGENTS.join(" | ")}] [--model <name>]
+` + "Deprecated: prefer `vinaya task brief` (preparation only) or `vinaya task run` (the full unattended loop).");
     process.exit(2);
   }
   const n = Number.parseInt(taskIdArg, 10);
@@ -17978,9 +18811,155 @@ async function taskDispatchCommand(args) {
 Posted: ${result.commentUrl}
 `);
 }
+async function taskBriefCommand(args) {
+  const trancheSlug = args[0];
+  const taskIdArg = args[1];
+  if (!trancheSlug || !taskIdArg || trancheSlug.startsWith("--")) {
+    console.error("Usage: vinaya task brief <tranche> <n> [--supersede --reason <text>]");
+    process.exit(2);
+  }
+  const n = Number.parseInt(taskIdArg, 10);
+  if (!Number.isInteger(n) || String(n) !== taskIdArg) {
+    console.error(`vinaya task brief: task id must be numeric — got "${taskIdArg}".`);
+    process.exit(2);
+  }
+  const rest = args.slice(2);
+  const hasSupersede = rest.includes("--supersede");
+  const reasonIdx = rest.indexOf("--reason");
+  const reason = reasonIdx !== -1 ? rest[reasonIdx + 1] : undefined;
+  if (hasSupersede && !reason) {
+    console.error("vinaya task brief: --supersede requires --reason <text>.");
+    process.exit(2);
+  }
+  if (!hasSupersede && reasonIdx !== -1) {
+    console.error("vinaya task brief: --reason is only meaningful with --supersede.");
+    process.exit(2);
+  }
+  const result = await prepareTask({
+    tranche: trancheSlug,
+    n,
+    supersede: hasSupersede ? { reason } : undefined
+  });
+  process.stdout.write(`${result.brief}
+`);
+  process.stdout.write(`
+Posted (v${result.version}): ${result.commentUrl}
+`);
+}
+
+// src/lib/task-run.ts
+class RunTaskError extends Error {
+}
+var ALREADY_DISPATCHED_PATTERN = /is already dispatched/;
+function isAlreadyDispatchedError(err) {
+  return err instanceof DispatchTaskError && ALREADY_DISPATCHED_PATTERN.test(err.message);
+}
+var defaultRunTaskDeps = {
+  prepareTask,
+  assembleAndRenderBrief,
+  developerBranchFor,
+  findOpenPrForBranch,
+  devReviewLoop,
+  resolveRepo: () => resolveRepo()
+};
+async function resolvePrUrl(resolveRepo3, prNumber) {
+  const repo = await resolveRepo3().catch(() => null);
+  return repo ? `https://github.com/${repo.owner}/${repo.repo}/pull/${prNumber}` : null;
+}
+async function runTask(input, deps = defaultRunTaskDeps) {
+  const { tranche, n, agent } = input;
+  let issue;
+  try {
+    const prep = await deps.prepareTask({ tranche, n });
+    issue = prep.issue;
+  } catch (err) {
+    if (!isAlreadyDispatchedError(err))
+      throw err;
+    const rendered = await deps.assembleAndRenderBrief(tranche, String(n));
+    if (!rendered.ok) {
+      throw new RunTaskError(`runTask: task ${n} in tranche \`${tranche}\` was already dispatched, but re-resolving its Issue number failed:
+${rendered.missing.map((m) => `  - ${m}`).join(`
+`)}`);
+    }
+    issue = rendered.issue;
+  }
+  const branch = deps.developerBranchFor(issue);
+  const existingPr = deps.findOpenPrForBranch(branch);
+  if (existingPr) {
+    throw new RunTaskError(`runTask: task ${n} in tranche \`${tranche}\`'s developer branch \`${branch}\` already has an open pull request (#${existingPr.number}) — refusing to start a second developer. Resume the review loop instead: \`vinaya dev-review-loop --resume ${existingPr.number}\`.`);
+  }
+  const loopResult = await deps.devReviewLoop({ task: issue, agent });
+  const prUrl = await resolvePrUrl(deps.resolveRepo, loopResult.prNumber);
+  return { ...loopResult, prUrl };
+}
+
+// src/commands/task-run.ts
+var TASK_RUN_FAILURE_EXIT_CODE = 3;
+var KNOWN_FLAGS2 = ["--agent"];
+function parseFlags2(rest) {
+  let agent;
+  const unknown = [];
+  for (let i = 0;i < rest.length; i++) {
+    const a = rest[i];
+    if (a === "--agent")
+      agent = rest[++i];
+    else if (a !== undefined)
+      unknown.push(a);
+  }
+  return { agent, unknown };
+}
+async function taskRunCommand(args) {
+  const trancheSlug = args[0];
+  const taskIdArg = args[1];
+  if (!trancheSlug || !taskIdArg || trancheSlug.startsWith("--")) {
+    console.error(`Usage: vinaya task run <tranche> <n> --agent ${DISPATCH_AGENTS.join(" | ")}`);
+    process.exit(2);
+  }
+  const n = Number.parseInt(taskIdArg, 10);
+  if (!Number.isInteger(n) || String(n) !== taskIdArg) {
+    console.error(`vinaya task run: task id must be numeric — got "${taskIdArg}".`);
+    process.exit(2);
+  }
+  const parsed = parseFlags2(args.slice(2));
+  if (parsed.unknown.length > 0) {
+    console.error(`vinaya task run: unrecognized flag${parsed.unknown.length > 1 ? "s" : ""} ${parsed.unknown.map((f) => `'${f}'`).join(", ")} — expected one of ${KNOWN_FLAGS2.join(", ")}`);
+    process.exit(2);
+  }
+  if (!parsed.agent || !DISPATCH_AGENTS.includes(parsed.agent)) {
+    console.error(`vinaya task run: --agent <${DISPATCH_AGENTS.join("|")}> is required.`);
+    process.exit(2);
+  }
+  const agent = parsed.agent;
+  let result;
+  try {
+    result = await runTask({ tranche: trancheSlug, n, agent });
+  } catch (err) {
+    const message = err instanceof Error ? err.message : String(err);
+    process.stderr.write(`Error: ${message}
+`);
+    process.exit(TASK_RUN_FAILURE_EXIT_CODE);
+  }
+  const prRef = result.prUrl ?? `PR #${result.prNumber}`;
+  const decision = result.finalDecision;
+  if (decision.type === "publish") {
+    process.stdout.write(`${colourLoopLine(`vinaya task run: task ${result.task}, ${prRef} — published`, process.stdout)}
+`);
+    return;
+  }
+  if (decision.type !== "pause") {
+    process.stderr.write(`Error: vinaya task run: devReviewLoop returned an unexpected final decision type \`${decision.type}\`.
+`);
+    process.exit(TASK_RUN_FAILURE_EXIT_CODE);
+  }
+  process.stdout.write(`${colourLoopLine(`vinaya task run: task ${result.task}, ${prRef} — paused (${decision.reason})`, process.stdout)}
+`);
+  process.stdout.write(`Resume with: vinaya dev-review-loop --resume ${result.prNumber}
+`);
+  process.exit(1);
+}
 
 // src/commands/upgrade.ts
-import { existsSync as existsSync25, readFileSync as readFileSync34, rmSync as rmSync10, writeFileSync as writeFileSync19 } from "node:fs";
+import { existsSync as existsSync27, readFileSync as readFileSync34, rmSync as rmSync10, writeFileSync as writeFileSync19 } from "node:fs";
 import { join as join33 } from "node:path";
 function realDeps9() {
   return {
@@ -18000,7 +18979,7 @@ function flags2(args) {
 }
 function readManifest4(repoRoot3) {
   const p = join33(repoRoot3, CONFIG_PATH);
-  if (!existsSync25(p))
+  if (!existsSync27(p))
     return { kind: "missing" };
   let raw;
   try {
@@ -18028,7 +19007,7 @@ function writeManifestVersion(repoRoot3, manifest) {
 }
 function stripFor(repoRoot3, path, marker, comment) {
   const abs2 = resolveManagedBlockPath(repoRoot3, path);
-  if (!existsSync25(abs2))
+  if (!existsSync27(abs2))
     return { path, marker, comment, present: false, removesHost: false };
   const stripped = stripBlockFromContent(readFileSync34(abs2, "utf-8"), marker, comment);
   if (stripped === null)
@@ -18057,7 +19036,7 @@ function planHookRouting(repoRoot3, manifest, recorded, hooksPathValue) {
   const blocked = [];
   for (const b of legacy) {
     const abs2 = resolveManagedBlockPath(repoRoot3, b.path);
-    if (!existsSync25(abs2))
+    if (!existsSync27(abs2))
       continue;
     const stripped = stripBlockFromContent(readFileSync34(abs2, "utf-8"), b.marker, b.comment);
     if (stripped === null)
@@ -18094,7 +19073,7 @@ function planUpgrade(ops, repoRoot3, manifest, routing, staleSkillPaths = []) {
   const entries = [];
   const staleFiles = staleSkillPaths.map((path) => ({
     path,
-    present: existsSync25(join33(repoRoot3, path))
+    present: existsSync27(join33(repoRoot3, path))
   }));
   let hasChanges = routing.arm || routing.migratesManifest || routing.strips.some((s) => s.present) || staleFiles.some((f) => f.present);
   const ownedFiles = new Set(manifest.files);
@@ -18103,7 +19082,7 @@ function planUpgrade(ops, repoRoot3, manifest, routing, staleSkillPaths = []) {
   for (const op of ops) {
     if (op.kind === "create-file") {
       const abs2 = join33(repoRoot3, op.path);
-      const exists = existsSync25(abs2);
+      const exists = existsSync27(abs2);
       const owned = ownedFiles.has(op.path) || isDefaultedAgentVendorPath(op.path, manifest);
       let action;
       let triggerChange;
@@ -18140,7 +19119,7 @@ function planUpgrade(ops, repoRoot3, manifest, routing, staleSkillPaths = []) {
       let action;
       if (!owned) {
         action = "not-installed";
-      } else if (!existsSync25(abs2)) {
+      } else if (!existsSync27(abs2)) {
         action = "recreate-host";
         hasChanges = true;
       } else {
@@ -18314,7 +19293,7 @@ function applyUpgrade(plan, repoRoot3) {
     if (!s.present)
       continue;
     const abs2 = resolveManagedBlockPath(repoRoot3, s.path);
-    if (!existsSync25(abs2))
+    if (!existsSync27(abs2))
       continue;
     const stripped = stripBlockFromContent(readFileSync34(abs2, "utf-8"), s.marker, s.comment);
     if (stripped === null)
@@ -18542,7 +19521,34 @@ function printHelp() {
 }
 
 // src/index.ts
-var PACKAGE_ROOT = join34(dirname12(fileURLToPath2(import.meta.url)), "..");
+var PACKAGE_ROOT = join34(dirname13(fileURLToPath2(import.meta.url)), "..");
+function maybeDeferToAuthorRepoSource() {
+  if (process.env.VINAYA_NO_DEFER === "1")
+    return;
+  if (process.env.GITHUB_ACTIONS)
+    return;
+  const sourceEntry = resolveAuthorRepoSourceEntry(packageRoot(import.meta.url));
+  if (!sourceEntry)
+    return;
+  const bunCheck = spawnSync3("bun", ["--version"], { stdio: "ignore" });
+  if (bunCheck.error || bunCheck.status !== 0) {
+    process.stderr.write(`vinaya: author repo detected, but 'bun' is not on PATH — running the installed build instead of ${sourceEntry}
+`);
+    return;
+  }
+  process.stderr.write(`vinaya: deferring to source at ${sourceEntry}
+`);
+  const result = spawnSync3("bun", [sourceEntry, ...process.argv.slice(2)], {
+    stdio: "inherit",
+    env: process.env
+  });
+  if (result.signal) {
+    process.kill(process.pid, result.signal);
+    return;
+  }
+  process.exit(result.status ?? 1);
+}
+maybeDeferToAuthorRepoSource();
 function readVersion2() {
   const pkg = JSON.parse(readFileSync35(join34(PACKAGE_ROOT, "package.json"), "utf-8"));
   return pkg.version;
@@ -18677,8 +19683,12 @@ try {
       const [subcommand, ...rest] = args;
       if (subcommand === "dispatch") {
         await taskDispatchCommand(rest);
+      } else if (subcommand === "brief") {
+        await taskBriefCommand(rest);
+      } else if (subcommand === "run") {
+        await taskRunCommand(rest);
       } else {
-        console.error(`Unknown 'task' subcommand: ${subcommand ?? "(none)"} (expected 'dispatch')`);
+        console.error(`Unknown 'task' subcommand: ${subcommand ?? "(none)"} (expected 'dispatch', 'brief', or 'run')`);
         process.exit(2);
       }
       break;
@@ -18703,8 +19713,10 @@ try {
         await milestoneEditCommand(rest);
       } else if (subcommand === "close") {
         await milestoneCloseCommand(rest);
+      } else if (subcommand === "status") {
+        await milestoneStatusCommand(rest);
       } else {
-        console.error(`Unknown 'milestone' subcommand: ${subcommand ?? "(none)"} (expected create/adopt/edit/close)`);
+        console.error(`Unknown 'milestone' subcommand: ${subcommand ?? "(none)"} (expected create/adopt/edit/close/status)`);
         process.exit(2);
       }
       break;