@codacy/verity-cli 0.34.0-experimental.37a6dcf → 0.34.0-experimental.3d4888f

package/bin/verity.js

@@ -10435,13 +10435,13 @@ var require_web_tree_sitter2 = __commonJS2({
                 }
                 readAsync = /* @__PURE__ */ __name(async (url) => {
                   if (isFileURI(url)) {
-                    return new Promise((resolve8, reject) => {
+                    return new Promise((resolve9, reject) => {
                       var xhr = new XMLHttpRequest();
                       xhr.open("GET", url, true);
                       xhr.responseType = "arraybuffer";
                       xhr.onload = () => {
                         if (xhr.status == 200 || xhr.status == 0 && xhr.response) {
-                          resolve8(xhr.response);
+                          resolve9(xhr.response);
                           return;
                         }
                         reject(xhr.status);
@@ -10634,9 +10634,9 @@ var require_web_tree_sitter2 = __commonJS2({
               __name(receiveInstantiationResult, "receiveInstantiationResult");
               var info2 = getWasmImports();
               if (Module["instantiateWasm"]) {
-                return new Promise((resolve8, reject) => {
+                return new Promise((resolve9, reject) => {
                   Module["instantiateWasm"](info2, (mod, inst) => {
-                    resolve8(receiveInstance(mod, inst));
+                    resolve9(receiveInstance(mod, inst));
                   });
                 });
               }
@@ -11969,8 +11969,8 @@ var require_web_tree_sitter2 = __commonJS2({
             if (runtimeInitialized) {
               moduleRtn = Module;
             } else {
-              moduleRtn = new Promise((resolve8, reject) => {
-                readyPromiseResolve = resolve8;
+              moduleRtn = new Promise((resolve9, reject) => {
+                readyPromiseResolve = resolve9;
                 readyPromiseReject = reject;
               });
             }
@@ -14447,8 +14447,87 @@ var import_node_child_process4 = require("node:child_process");
 
 // src/constants.ts
 var import_node_child_process = require("node:child_process");
+var import_node_fs2 = require("node:fs");
+var import_node_path2 = require("node:path");
+
+// src/lib/context-identity.ts
+var import_node_crypto = require("node:crypto");
 var import_node_fs = require("node:fs");
+var import_node_os = require("node:os");
 var import_node_path = require("node:path");
+var SHARED_SENTINELS = /* @__PURE__ */ new Set([
+  "",
+  "-",
+  "n/a",
+  "na",
+  "none",
+  "null",
+  "undefined",
+  "unknown",
+  "anon",
+  "anonymous",
+  "default",
+  "_default"
+]);
+function isSharedSentinel(value) {
+  if (value == null) return true;
+  return SHARED_SENTINELS.has(value.trim().toLowerCase());
+}
+var ephemeral = /* @__PURE__ */ new Map();
+function ephemeralId(slot, width) {
+  let id = ephemeral.get(slot);
+  if (!id) {
+    id = `eph-${(0, import_node_crypto.randomBytes)(Math.ceil(width / 2)).toString("hex").slice(0, width - 4)}`;
+    ephemeral.set(slot, id);
+  }
+  return id;
+}
+function contextIdentity(input) {
+  const tokenUsable = !isSharedSentinel(input.token ?? null);
+  const sessionUsable = !isSharedSentinel(input.sessionId ?? null);
+  const userKey = tokenUsable ? (0, import_node_crypto.createHash)("sha256").update(String(input.token)).digest("hex").slice(0, 12) : ephemeralId("user", 12);
+  const sessionKey2 = sessionUsable ? (0, import_node_crypto.createHash)("sha256").update(String(input.sessionId)).digest("hex").slice(0, 16) : ephemeralId("session", 16);
+  let treeKey = "no-tree";
+  const rawTree = input.treeRoot;
+  if (rawTree && !isSharedSentinel(rawTree)) {
+    let resolved = rawTree;
+    try {
+      resolved = import_node_fs.realpathSync.native(rawTree);
+    } catch {
+    }
+    treeKey = (0, import_node_crypto.createHash)("sha256").update(resolved).digest("hex").slice(0, 12);
+  }
+  return {
+    userKey,
+    treeKey,
+    sessionKey: sessionKey2,
+    userKeySource: tokenUsable ? "token" : "ephemeral",
+    sessionKeySource: sessionUsable ? "session_id" : "ephemeral",
+    ephemeral: !tokenUsable || !sessionUsable
+  };
+}
+function verityHome() {
+  const override = process.env.VERITY_HOME;
+  return override && override.trim() ? (0, import_node_path.resolve)(override) : (0, import_node_path.join)((0, import_node_os.homedir)(), ".verity");
+}
+function dossierDir(identity) {
+  return (0, import_node_path.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
+}
+function treeDir(identity) {
+  return (0, import_node_path.join)(verityHome(), "sessions", identity.userKey, identity.treeKey);
+}
+function scopeIdentity(token, sessionId) {
+  const t = (token ?? "").trim();
+  const s = (sessionId ?? "").trim();
+  const userKey = t.length > 0 ? (0, import_node_crypto.createHash)("sha256").update(t).digest("hex").slice(0, 12) : "anon";
+  const sessionKey2 = s.length > 0 ? (0, import_node_crypto.createHash)("sha256").update(s).digest("hex").slice(0, 16) : "_default";
+  return { userKey, sessionKey: sessionKey2, bucket: `${userKey}/${sessionKey2}` };
+}
+function sessionScopeKey(token, sessionId) {
+  return scopeIdentity(token, sessionId).bucket;
+}
+
+// src/constants.ts
 var _repoRoot = null;
 function repoRoot() {
   if (_repoRoot === null) {
@@ -14476,17 +14555,36 @@ function mainWorktreeRoot() {
       _mainRoot = null;
       return _mainRoot;
     }
-    const abs = common.startsWith("/") ? common : (0, import_node_path.join)(repoRoot(), common);
-    _mainRoot = (0, import_node_path.dirname)(abs);
+    const abs = common.startsWith("/") ? common : (0, import_node_path2.join)(repoRoot(), common);
+    _mainRoot = (0, import_node_path2.dirname)(abs);
   } catch {
     _mainRoot = null;
   }
   return _mainRoot;
 }
 function verityConfigured() {
-  if ((0, import_node_fs.existsSync)((0, import_node_path.join)(repoRoot(), VERITY_DIR))) return true;
+  if (isProjectVerityDir((0, import_node_path2.join)(repoRoot(), VERITY_DIR))) return true;
   const main = mainWorktreeRoot();
-  return !!main && (0, import_node_fs.existsSync)((0, import_node_path.join)(main, VERITY_DIR));
+  return !!main && isProjectVerityDir((0, import_node_path2.join)(main, VERITY_DIR));
+}
+function isProjectVerityDir(dir) {
+  return (0, import_node_fs2.existsSync)(dir) && !isMachineStore(dir);
+}
+function isMachineStore(dir) {
+  const here = canonicalPath(dir);
+  const stores = [process.env.HOME ? (0, import_node_path2.join)(process.env.HOME, VERITY_DIR) : null, verityHome()];
+  return stores.some((s) => s !== null && canonicalPath(s) === here);
+}
+function canonicalPath(p) {
+  try {
+    return import_node_fs2.realpathSync.native(p);
+  } catch {
+  }
+  try {
+    return (0, import_node_path2.join)(import_node_fs2.realpathSync.native((0, import_node_path2.dirname)(p)), (0, import_node_path2.basename)(p));
+  } catch {
+    return (0, import_node_path2.resolve)(p);
+  }
 }
 var VERITY_DIR = ".verity";
 var CREDENTIALS_FILE = `${VERITY_DIR}/credentials`;
@@ -14507,7 +14605,7 @@ var MEMORY_DIR = `${VERITY_DIR}/memory`;
 var CODACY_CONFIG_FILE = ".codacy/codacy.config.json";
 var VERITYIGNORE_FILE = ".verityignore";
 function projectPath(relativePath) {
-  return (0, import_node_path.join)(repoRoot(), relativePath);
+  return (0, import_node_path2.join)(repoRoot(), relativePath);
 }
 var MAX_DELTA_BYTES = 194560;
 var MAX_FILES = 40;
@@ -14681,7 +14779,7 @@ function printVerbose(msg, verbose) {
 }
 
 // src/lib/debug-log.ts
-var import_node_fs2 = require("node:fs");
+var import_node_fs3 = require("node:fs");
 function isDebugEnabled() {
   const v = process.env.VERITY_DEBUG;
   if (v === "0" || v === "false" || v === "off") return false;
@@ -14699,24 +14797,24 @@ function writeLine(obj) {
   try {
     const dir = projectPath(DEBUG_LOG_DIR);
     const file = projectPath(DEBUG_LOG_FILE);
-    (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs3.mkdirSync)(dir, { recursive: true });
     rotateIfNeeded(file);
-    (0, import_node_fs2.appendFileSync)(file, JSON.stringify(obj) + "\n");
+    (0, import_node_fs3.appendFileSync)(file, JSON.stringify(obj) + "\n");
   } catch {
   }
 }
 function rotateIfNeeded(file) {
   try {
-    const s = (0, import_node_fs2.statSync)(file);
+    const s = (0, import_node_fs3.statSync)(file);
     if (s.size < DEBUG_LOG_MAX_BYTES) return;
-    (0, import_node_fs2.renameSync)(file, `${file}.1`);
+    (0, import_node_fs3.renameSync)(file, `${file}.1`);
   } catch {
   }
 }
 
 // src/lib/credentials.ts
 var import_promises = require("node:fs/promises");
-var import_node_path2 = require("node:path");
+var import_node_path3 = require("node:path");
 var import_node_child_process2 = require("node:child_process");
 function globalCredentialsPath() {
   return `${process.env.HOME}/.verity/credentials`;
@@ -14791,7 +14889,7 @@ async function readGlobalCredential(remote) {
 }
 async function upsertGlobalCredential(remote, rec) {
   const path = globalCredentialsPath();
-  await (0, import_promises.mkdir)((0, import_node_path2.dirname)(path), { recursive: true });
+  await (0, import_promises.mkdir)((0, import_node_path3.dirname)(path), { recursive: true });
   let content = "";
   try {
     content = await (0, import_promises.readFile)(path, "utf-8");
@@ -14935,10 +15033,10 @@ async function foldLegacyLocalCredential(remoteArg) {
 
 // src/lib/git.ts
 var import_node_child_process3 = require("node:child_process");
-var import_node_fs3 = require("node:fs");
-var import_node_path3 = require("node:path");
+var import_node_fs4 = require("node:fs");
+var import_node_path4 = require("node:path");
 function resolveFile(relpath) {
-  return (0, import_node_fs3.existsSync)(relpath) ? relpath : null;
+  return (0, import_node_fs4.existsSync)(relpath) ? relpath : null;
 }
 function execGit(cmd) {
   try {
@@ -14956,7 +15054,7 @@ function readBaselineSha() {
   if (sha === null) return null;
   if (!commitResolves(sha)) {
     try {
-      (0, import_node_fs3.unlinkSync)(BASELINE_SHA_FILE);
+      (0, import_node_fs4.unlinkSync)(BASELINE_SHA_FILE);
     } catch {
     }
     return null;
@@ -14964,10 +15062,10 @@ function readBaselineSha() {
   return sha;
 }
 function readRawBaselineSha() {
-  if (!(0, import_node_fs3.existsSync)(BASELINE_SHA_FILE)) return null;
+  if (!(0, import_node_fs4.existsSync)(BASELINE_SHA_FILE)) return null;
   let sha;
   try {
-    sha = (0, import_node_fs3.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
+    sha = (0, import_node_fs4.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
   } catch {
     return null;
   }
@@ -14976,8 +15074,8 @@ function readRawBaselineSha() {
 function writeBaselineSha(sha) {
   if (!SHA_RE.test(sha)) return;
   try {
-    (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(BASELINE_SHA_FILE), { recursive: true });
-    (0, import_node_fs3.writeFileSync)(BASELINE_SHA_FILE, sha);
+    (0, import_node_fs4.mkdirSync)((0, import_node_path4.dirname)(BASELINE_SHA_FILE), { recursive: true });
+    (0, import_node_fs4.writeFileSync)(BASELINE_SHA_FILE, sha);
   } catch {
   }
 }
@@ -15065,17 +15163,17 @@ function showContentAtRef(ref, repoRelPath) {
 }
 function filterAnalyzable(files) {
   return files.filter((f) => {
-    const ext = (0, import_node_path3.extname)(f).slice(1);
+    const ext = (0, import_node_path4.extname)(f).slice(1);
     return ANALYZABLE_EXTENSIONS.has(ext);
   });
 }
 function filterReviewable(files) {
   return files.filter((f) => {
-    const ext = (0, import_node_path3.extname)(f).slice(1);
+    const ext = (0, import_node_path4.extname)(f).slice(1);
     if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
     if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
-    const basename8 = f.split("/").pop() ?? "";
-    if (REVIEWABLE_FILENAMES.has(basename8)) return true;
+    const basename9 = f.split("/").pop() ?? "";
+    if (REVIEWABLE_FILENAMES.has(basename9)) return true;
     if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
     return false;
   });
@@ -15550,7 +15648,7 @@ async function maybeHealServiceUrl(resolution, verbose) {
 
 // src/lib/register.ts
 var readline = __toESM2(require("node:readline/promises"));
-var import_node_os = require("node:os");
+var import_node_os2 = require("node:os");
 
 // src/lib/spinner.ts
 var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
@@ -15638,7 +15736,7 @@ function startSpinner(label2, opts = {}) {
 }
 
 // src/lib/provider-auth.ts
-var sleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
+var sleep = (ms) => new Promise((resolve9) => setTimeout(resolve9, ms));
 var form = (fields) => new URLSearchParams(fields).toString();
 async function githubAccountId(owner) {
   try {
@@ -15903,7 +16001,7 @@ function deviceLabel() {
   const override = process.env.VERITY_DEVICE_LABEL?.trim();
   if (override) return override;
   try {
-    return (0, import_node_os.hostname)() || void 0;
+    return (0, import_node_os2.hostname)() || void 0;
   } catch {
     return void 0;
   }
@@ -16061,8 +16159,8 @@ function registerAuthCommands(program2) {
 }
 
 // src/lib/pending-login.ts
-var import_node_fs4 = require("node:fs");
-var import_node_path4 = require("node:path");
+var import_node_fs5 = require("node:fs");
+var import_node_path5 = require("node:path");
 function pendingLoginPath() {
   return `${process.env.HOME}/.verity/pending-login.json`;
 }
@@ -16078,26 +16176,26 @@ function savePendingLogin(dc, serviceUrl, now = Date.now()) {
     created_at: new Date(now).toISOString()
   };
   const path = pendingLoginPath();
-  (0, import_node_fs4.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true });
+  (0, import_node_fs5.mkdirSync)((0, import_node_path5.dirname)(path), { recursive: true });
   clearPendingLogin();
-  (0, import_node_fs4.writeFileSync)(path, JSON.stringify(record, null, 2) + "\n", { mode: 384, flag: "wx" });
+  (0, import_node_fs5.writeFileSync)(path, JSON.stringify(record, null, 2) + "\n", { mode: 384, flag: "wx" });
   try {
-    (0, import_node_fs4.chmodSync)(path, 384);
+    (0, import_node_fs5.chmodSync)(path, 384);
   } catch {
   }
   return record;
 }
 function readPendingLogin(now = Date.now()) {
   const path = pendingLoginPath();
-  if (!(0, import_node_fs4.existsSync)(path)) return { status: "none" };
+  if (!(0, import_node_fs5.existsSync)(path)) return { status: "none" };
   try {
-    if ((0, import_node_fs4.lstatSync)(path).isSymbolicLink()) return { status: "invalid", reason: "it is a symlink" };
+    if ((0, import_node_fs5.lstatSync)(path).isSymbolicLink()) return { status: "invalid", reason: "it is a symlink" };
   } catch {
     return { status: "none" };
   }
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs4.readFileSync)(path, "utf-8"));
+    parsed = JSON.parse((0, import_node_fs5.readFileSync)(path, "utf-8"));
   } catch {
     return { status: "invalid", reason: "it is not valid JSON" };
   }
@@ -16118,7 +16216,7 @@ function readPendingLogin(now = Date.now()) {
 }
 function clearPendingLogin() {
   try {
-    (0, import_node_fs4.unlinkSync)(pendingLoginPath());
+    (0, import_node_fs5.unlinkSync)(pendingLoginPath());
     return true;
   } catch {
     return false;
@@ -16674,11 +16772,11 @@ function registerLogoutCommand(program2) {
 
 // src/lib/hooks.ts
 var import_promises4 = require("node:fs/promises");
-var import_node_path6 = require("node:path");
+var import_node_path7 = require("node:path");
 
 // src/lib/json-file.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_path5 = require("node:path");
+var import_node_path6 = require("node:path");
 function jsonSemanticEqual(a, b) {
   if (a === b) return true;
   if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) {
@@ -16724,7 +16822,7 @@ async function writeJsonFilePreservingStyle(file, value) {
   const indent = currentRaw !== null ? detectJsonIndent(currentRaw) : 2;
   const next = JSON.stringify(value, null, indent) + "\n";
   if (next === currentRaw) return false;
-  await (0, import_promises3.mkdir)((0, import_node_path5.dirname)(file), { recursive: true });
+  await (0, import_promises3.mkdir)((0, import_node_path6.dirname)(file), { recursive: true });
   await (0, import_promises3.writeFile)(file, next);
   return true;
 }
@@ -16909,13 +17007,13 @@ async function writeSettings(settings) {
 }
 async function readSettingsAt(root) {
   try {
-    return JSON.parse(await (0, import_promises4.readFile)((0, import_node_path6.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
+    return JSON.parse(await (0, import_promises4.readFile)((0, import_node_path7.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
   } catch {
     return {};
   }
 }
 async function writeSettingsAt(root, settings) {
-  await writeJsonFilePreservingStyle((0, import_node_path6.join)(root, CLAUDE_SETTINGS_FILE), settings);
+  await writeJsonFilePreservingStyle((0, import_node_path7.join)(root, CLAUDE_SETTINGS_FILE), settings);
 }
 async function hasLegacyHooksAt(root) {
   const settings = await readSettingsAt(root);
@@ -17104,12 +17202,12 @@ async function applyMomentSelection(moments) {
 }
 
 // src/lib/project-config.ts
-var import_node_fs6 = require("node:fs");
-var import_node_path8 = require("node:path");
+var import_node_fs7 = require("node:fs");
+var import_node_path9 = require("node:path");
 
 // src/lib/repo-controlled.ts
-var import_node_fs5 = require("node:fs");
-var import_node_path7 = require("node:path");
+var import_node_fs6 = require("node:fs");
+var import_node_path8 = require("node:path");
 
 // src/lib/hardened-git.ts
 var import_node_child_process5 = require("node:child_process");
@@ -17190,7 +17288,7 @@ function repoControlled(worktree, rel) {
   for (let i2 = 1; i2 <= parts2.length; i2++) {
     let st;
     try {
-      st = (0, import_node_fs5.lstatSync)((0, import_node_path7.join)(worktree, ...parts2.slice(0, i2)));
+      st = (0, import_node_fs6.lstatSync)((0, import_node_path8.join)(worktree, ...parts2.slice(0, i2)));
     } catch (err2) {
       const code = err2?.code;
       if (code === "ENOENT" || code === "ENOTDIR") return null;
@@ -17214,8 +17312,8 @@ function parseMoments(raw) {
 }
 function readConfigFile(path) {
   try {
-    if (!(0, import_node_fs6.existsSync)(path)) return null;
-    const raw = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf-8"));
+    if (!(0, import_node_fs7.existsSync)(path)) return null;
+    const raw = JSON.parse((0, import_node_fs7.readFileSync)(path, "utf-8"));
     const moments = Array.isArray(raw.git_moments) ? raw.git_moments.filter(isMoment) : [];
     const source2 = raw.git_moments_source === "user" || raw.git_moments_source === "init" ? raw.git_moments_source : void 0;
     return {
@@ -17232,13 +17330,13 @@ function candidates() {
   const out2 = [{ path: local, source: "local" }];
   const main = mainWorktreeRoot();
   if (main) {
-    const inherited = (0, import_node_path8.join)(main, PROJECT_CONFIG_FILE);
+    const inherited = (0, import_node_path9.join)(main, PROJECT_CONFIG_FILE);
     if (inherited !== local) out2.push({ path: inherited, source: "main-worktree" });
   }
   return out2;
 }
 function formalRefusal(path) {
-  return repoControlled((0, import_node_path8.dirname)((0, import_node_path8.dirname)(path)), PROJECT_CONFIG_FILE);
+  return repoControlled((0, import_node_path9.dirname)((0, import_node_path9.dirname)(path)), PROJECT_CONFIG_FILE);
 }
 function readProjectConfigRaw() {
   for (const { path, source: source2 } of candidates()) {
@@ -17274,8 +17372,8 @@ function writeProjectConfig(patch) {
     ...patch
   };
   const target = projectPath(PROJECT_CONFIG_FILE);
-  (0, import_node_fs6.mkdirSync)((0, import_node_path8.dirname)(target), { recursive: true });
-  (0, import_node_fs6.writeFileSync)(target, JSON.stringify(next, null, 2) + "\n");
+  (0, import_node_fs7.mkdirSync)((0, import_node_path9.dirname)(target), { recursive: true });
+  (0, import_node_fs7.writeFileSync)(target, JSON.stringify(next, null, 2) + "\n");
   return next;
 }
 function resolveGuardMoments(explicit) {
@@ -17284,11 +17382,11 @@ function resolveGuardMoments(explicit) {
 }
 
 // src/lib/plugin-ownership.ts
-var import_node_fs9 = require("node:fs");
+var import_node_fs10 = require("node:fs");
 
 // src/lib/which.ts
-var import_node_fs7 = require("node:fs");
-var import_node_path9 = require("node:path");
+var import_node_fs8 = require("node:fs");
+var import_node_path10 = require("node:path");
 function executableExtensions(platform4, pathext) {
   if (platform4 !== "win32") return [""];
   const raw = (pathext ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
@@ -17306,14 +17404,14 @@ function whichSync(bin, opts = {}) {
   if (!rawPath) return null;
   const exts = executableExtensions(platform4, opts.pathext ?? process.env.PATHEXT);
   const real = opts.real ?? true;
-  for (const dir of rawPath.split(import_node_path9.delimiter)) {
+  for (const dir of rawPath.split(import_node_path10.delimiter)) {
     if (!dir) continue;
     for (const ext of exts) {
-      const candidate = (0, import_node_path9.join)(dir, bin + ext);
+      const candidate = (0, import_node_path10.join)(dir, bin + ext);
       try {
-        if (!(0, import_node_fs7.statSync)(candidate).isFile()) continue;
-        if (platform4 !== "win32") (0, import_node_fs7.accessSync)(candidate, import_node_fs7.constants.X_OK);
-        return real ? (0, import_node_fs7.realpathSync)(candidate) : candidate;
+        if (!(0, import_node_fs8.statSync)(candidate).isFile()) continue;
+        if (platform4 !== "win32") (0, import_node_fs8.accessSync)(candidate, import_node_fs8.constants.X_OK);
+        return real ? (0, import_node_fs8.realpathSync)(candidate) : candidate;
       } catch {
         continue;
       }
@@ -17323,11 +17421,11 @@ function whichSync(bin, opts = {}) {
 }
 
 // src/lib/plugin-ownership.ts
-var import_node_os2 = require("node:os");
-var import_node_path10 = require("node:path");
+var import_node_os3 = require("node:os");
+var import_node_path11 = require("node:path");
 
 // src/lib/stderr-log.ts
-var import_node_fs8 = require("node:fs");
+var import_node_fs9 = require("node:fs");
 var TOKEN_RE2 = /verity_[0-9a-f]{16,}/g;
 var ANSI_RE = /\u001b\[[0-?]*[ -/]*[@-~]/g;
 function scrub(s) {
@@ -17340,9 +17438,9 @@ function append(text) {
   try {
     const dir = projectPath(DEBUG_LOG_DIR);
     const file = projectPath(STDERR_LOG_FILE);
-    (0, import_node_fs8.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs9.mkdirSync)(dir, { recursive: true });
     rotateIfNeeded(file);
-    (0, import_node_fs8.appendFileSync)(file, text);
+    (0, import_node_fs9.appendFileSync)(file, text);
   } catch {
   }
 }
@@ -17390,8 +17488,8 @@ function markerPath() {
 }
 function readMarker() {
   try {
-    if (!(0, import_node_fs9.existsSync)(markerPath())) return null;
-    const raw = JSON.parse((0, import_node_fs9.readFileSync)(markerPath(), "utf-8"));
+    if (!(0, import_node_fs10.existsSync)(markerPath())) return null;
+    const raw = JSON.parse((0, import_node_fs10.readFileSync)(markerPath(), "utf-8"));
     const pluginRoot = typeof raw.plugin_root === "string" ? raw.plugin_root : "";
     if (!pluginRoot || CONTROL_CHARS2.test(pluginRoot)) return null;
     const version = typeof raw.version === "string" && !CONTROL_CHARS2.test(raw.version) ? raw.version : null;
@@ -17409,23 +17507,23 @@ function recordPluginOwnership(sessionId) {
   const pluginRoot = process.env.VERITY_PLUGIN_ROOT;
   if (!pluginRoot) return;
   try {
-    (0, import_node_fs9.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
+    (0, import_node_fs10.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
     const marker = {
       session_id: sessionId,
       plugin_root: pluginRoot,
       version: process.env.VERITY_PLUGIN_VERSION || null,
       ts: Math.floor(Date.now() / 1e3)
     };
-    (0, import_node_fs9.writeFileSync)(markerPath(), JSON.stringify(marker));
+    (0, import_node_fs10.writeFileSync)(markerPath(), JSON.stringify(marker));
   } catch {
   }
 }
 function claudeConfigDir() {
-  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path10.join)((0, import_node_os2.homedir)(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path11.join)((0, import_node_os3.homedir)(), ".claude");
 }
 function readJsonFile(path) {
   try {
-    const parsed = JSON.parse((0, import_node_fs9.readFileSync)(path, "utf-8"));
+    const parsed = JSON.parse((0, import_node_fs10.readFileSync)(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
@@ -17433,9 +17531,9 @@ function readJsonFile(path) {
 }
 function enabledPluginSetting(key) {
   const files = [
-    projectPath((0, import_node_path10.join)(".claude", "settings.local.json")),
-    projectPath((0, import_node_path10.join)(".claude", "settings.json")),
-    (0, import_node_path10.join)(claudeConfigDir(), "settings.json")
+    projectPath((0, import_node_path11.join)(".claude", "settings.local.json")),
+    projectPath((0, import_node_path11.join)(".claude", "settings.json")),
+    (0, import_node_path11.join)(claudeConfigDir(), "settings.json")
   ];
   for (const file of files) {
     const map = readJsonFile(file)?.enabledPlugins;
@@ -17447,11 +17545,11 @@ function enabledPluginSetting(key) {
 }
 function marketplaceLocations() {
   const out2 = /* @__PURE__ */ new Map();
-  const known = readJsonFile((0, import_node_path10.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
+  const known = readJsonFile((0, import_node_path11.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
   if (!known) return out2;
   for (const [name2, entry] of Object.entries(known)) {
     const loc2 = entry?.installLocation;
-    if (typeof loc2 === "string" && loc2) out2.set(name2, (0, import_node_path10.resolve)(loc2));
+    if (typeof loc2 === "string" && loc2) out2.set(name2, (0, import_node_path11.resolve)(loc2));
   }
   return out2;
 }
@@ -17465,7 +17563,7 @@ function globalVerityVersion() {
   const entry = verityPathEntry();
   if (!entry) return null;
   try {
-    const pkg = readJsonFile((0, import_node_path10.join)((0, import_node_path10.dirname)((0, import_node_fs9.realpathSync)(entry)), "..", "package.json"));
+    const pkg = readJsonFile((0, import_node_path11.join)((0, import_node_path11.dirname)((0, import_node_fs10.realpathSync)(entry)), "..", "package.json"));
     if (pkg?.name !== "@codacy/verity-cli" || typeof pkg.version !== "string") return null;
     return pkg.version;
   } catch {
@@ -17482,7 +17580,7 @@ var VERITY_MARKETPLACE_REPO = "codacy/verity";
 function marketplaceConflict() {
   const wanted = VERITY_MARKETPLACE;
   for (const file of ["settings.json", "settings.local.json"]) {
-    const path = (0, import_node_path10.join)(claudeConfigDir(), file);
+    const path = (0, import_node_path11.join)(claudeConfigDir(), file);
     const declared = readJsonFile(path)?.extraKnownMarketplaces ?? null;
     const entry2 = declared && typeof declared === "object" ? declared[wanted] : void 0;
     if (entry2 && typeof entry2 === "object") {
@@ -17492,7 +17590,7 @@ function marketplaceConflict() {
       }
     }
   }
-  const known = readJsonFile((0, import_node_path10.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
+  const known = readJsonFile((0, import_node_path11.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
   const entry = known?.[wanted];
   if (entry && typeof entry === "object" && !pointsAtVerity(entry.source)) {
     return { name: wanted, declaredAs: describeSource(entry.source) };
@@ -17513,7 +17611,7 @@ function describeSource(src) {
   return target ? `${kind} \u2192 ${target}` : kind;
 }
 function legacyMarketplaceInstall() {
-  const plugins = readJsonFile((0, import_node_path10.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path11.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return null;
   for (const key of Object.keys(plugins)) {
     const at = key.lastIndexOf("@");
@@ -17525,13 +17623,13 @@ function legacyMarketplaceInstall() {
 }
 function realpathOr(p) {
   try {
-    return import_node_fs9.realpathSync.native(p);
+    return import_node_fs10.realpathSync.native(p);
   } catch {
-    return (0, import_node_path10.resolve)(p);
+    return (0, import_node_path11.resolve)(p);
   }
 }
 function isWithin(want, dir) {
-  return want === dir || want.startsWith(dir + import_node_path10.sep);
+  return want === dir || want.startsWith(dir + import_node_path11.sep);
 }
 function entryAppliesHere(entry, here) {
   const e = entry;
@@ -17541,9 +17639,9 @@ function entryAppliesHere(entry, here) {
   return forProject === here;
 }
 function registrySays(pluginRoot) {
-  const plugins = readJsonFile((0, import_node_path10.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path11.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return "unverified";
-  const want = (0, import_node_path10.resolve)(pluginRoot);
+  const want = (0, import_node_path11.resolve)(pluginRoot);
   const here = realpathOr(repoRoot());
   const markets = marketplaceLocations();
   for (const [key, value] of Object.entries(plugins)) {
@@ -17552,15 +17650,15 @@ function registrySays(pluginRoot) {
     const applicable = (Array.isArray(value) ? value : []).filter((entry) => entryAppliesHere(entry, here));
     const claims = applicable.some((entry) => {
       const installPath = entry?.installPath;
-      return typeof installPath === "string" && (0, import_node_path10.resolve)(installPath) === want;
+      return typeof installPath === "string" && (0, import_node_path11.resolve)(installPath) === want;
     }) || source2 !== void 0 && applicable.length > 0 && isWithin(want, source2);
     if (claims) {
       if (enabledPluginSetting(key) === false) return "gone";
-      return (0, import_node_fs9.existsSync)(pluginRoot) ? "live" : "gone";
+      return (0, import_node_fs10.existsSync)(pluginRoot) ? "live" : "gone";
     }
   }
-  const managed = (0, import_node_path10.resolve)((0, import_node_path10.join)(claudeConfigDir(), "plugins", "cache"));
-  return want === managed || want.startsWith(managed + import_node_path10.sep) ? "gone" : "unverified";
+  const managed = (0, import_node_path11.resolve)((0, import_node_path11.join)(claudeConfigDir(), "plugins", "cache"));
+  return want === managed || want.startsWith(managed + import_node_path11.sep) ? "gone" : "unverified";
 }
 var _live = /* @__PURE__ */ new Map();
 function pluginLiveness(pluginRoot) {
@@ -17574,7 +17672,7 @@ function clearStalePluginMarker() {
   const marker = readMarker();
   if (!marker || pluginLiveness(marker.plugin_root) !== "gone") return null;
   try {
-    (0, import_node_fs9.rmSync)(markerPath(), { force: true });
+    (0, import_node_fs10.rmSync)(markerPath(), { force: true });
   } catch {
     return null;
   }
@@ -17602,7 +17700,7 @@ function pluginActiveHere() {
   return activePluginInstall() !== null;
 }
 function registeredVerityPlugin() {
-  const plugins = readJsonFile((0, import_node_path10.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path11.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return null;
   const here = realpathOr(repoRoot());
   for (const [key, value] of Object.entries(plugins)) {
@@ -17612,7 +17710,7 @@ function registeredVerityPlugin() {
     for (const entry of Array.isArray(value) ? value : []) {
       const e = entry;
       const installPath = typeof e.installPath === "string" ? e.installPath : "";
-      if (!installPath || !(0, import_node_fs9.existsSync)(installPath)) continue;
+      if (!installPath || !(0, import_node_fs10.existsSync)(installPath)) continue;
       if (!entryAppliesHere(entry, here)) continue;
       return { pluginRoot: installPath, version: typeof e.version === "string" ? e.version : null };
     }
@@ -17664,28 +17762,28 @@ async function resolveHookWiring() {
 }
 
 // src/lib/cli-provenance.ts
-var import_node_fs10 = require("node:fs");
-var import_node_os3 = require("node:os");
-var import_node_path11 = require("node:path");
+var import_node_fs11 = require("node:fs");
+var import_node_os4 = require("node:os");
+var import_node_path12 = require("node:path");
 var CLI_PACKAGE = "@codacy/verity-cli";
-var CLI_ENTRY = (0, import_node_path11.join)("node_modules", CLI_PACKAGE, "bin", "verity.js");
+var CLI_ENTRY = (0, import_node_path12.join)("node_modules", CLI_PACKAGE, "bin", "verity.js");
 function readJson(path) {
   try {
-    const parsed = JSON.parse((0, import_node_fs10.readFileSync)(path, "utf-8"));
+    const parsed = JSON.parse((0, import_node_fs11.readFileSync)(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
   }
 }
 function versionUnder(base) {
-  const entry = (0, import_node_path11.join)(base, CLI_ENTRY);
-  if (!(0, import_node_fs10.existsSync)(entry)) return null;
-  const pkg = readJson((0, import_node_path11.join)(base, "node_modules", CLI_PACKAGE, "package.json"));
+  const entry = (0, import_node_path12.join)(base, CLI_ENTRY);
+  if (!(0, import_node_fs11.existsSync)(entry)) return null;
+  const pkg = readJson((0, import_node_path12.join)(base, "node_modules", CLI_PACKAGE, "package.json"));
   return typeof pkg?.version === "string" ? pkg.version : null;
 }
 function versionForEntry(entry) {
   try {
-    const pkg = readJson((0, import_node_path11.join)((0, import_node_path11.dirname)((0, import_node_fs10.realpathSync)(entry)), "..", "package.json"));
+    const pkg = readJson((0, import_node_path12.join)((0, import_node_path12.dirname)((0, import_node_fs11.realpathSync)(entry)), "..", "package.json"));
     return typeof pkg?.version === "string" ? pkg.version : null;
   } catch {
     return null;
@@ -17693,16 +17791,16 @@ function versionForEntry(entry) {
 }
 function resolveHooksCli(pluginRoot) {
   const override = process.env.VERITY_CLI_PATH;
-  if (override && (0, import_node_fs10.existsSync)(override)) {
+  if (override && (0, import_node_fs11.existsSync)(override)) {
     return { version: versionForEntry(override), rung: "override" };
   }
   const fromPlugin = versionUnder(pluginRoot);
   if (fromPlugin !== null) return { version: fromPlugin, rung: "plugin" };
-  if ((0, import_node_fs10.existsSync)((0, import_node_path11.join)(pluginRoot, CLI_ENTRY))) return { version: null, rung: "plugin" };
-  const dataDir = process.env.CLAUDE_PLUGIN_DATA || (0, import_node_path11.join)((0, import_node_os3.homedir)(), ".verity", "plugin-cli");
+  if ((0, import_node_fs11.existsSync)((0, import_node_path12.join)(pluginRoot, CLI_ENTRY))) return { version: null, rung: "plugin" };
+  const dataDir = process.env.CLAUDE_PLUGIN_DATA || (0, import_node_path12.join)((0, import_node_os4.homedir)(), ".verity", "plugin-cli");
   const fromData = versionUnder(dataDir);
   if (fromData !== null) return { version: fromData, rung: "plugin-data" };
-  if ((0, import_node_fs10.existsSync)((0, import_node_path11.join)(dataDir, CLI_ENTRY))) return { version: null, rung: "plugin-data" };
+  if ((0, import_node_fs11.existsSync)((0, import_node_path12.join)(dataDir, CLI_ENTRY))) return { version: null, rung: "plugin-data" };
   const global = globalVerityVersion();
   if (global !== null) return { version: global, rung: "global" };
   return null;
@@ -17804,7 +17902,7 @@ function pluginCliInvocation() {
   return resolverCommand(root);
 }
 function resolverCommand(root) {
-  return `node ${JSON.stringify((0, import_node_path11.join)(root, "scripts", "verity.mjs"))}`;
+  return `node ${JSON.stringify((0, import_node_path12.join)(root, "scripts", "verity.mjs"))}`;
 }
 
 // src/commands/hooks.ts
@@ -17940,18 +18038,18 @@ function registerHooksCommands(program2) {
 }
 
 // src/commands/intent.ts
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 
 // src/lib/conversation-buffer.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_fs11 = require("node:fs");
+var import_node_fs12 = require("node:fs");
 var import_node_child_process6 = require("node:child_process");
-var import_node_crypto = require("node:crypto");
+var import_node_crypto2 = require("node:crypto");
 function stripImageReferences(text) {
   return text.replace(/\[Image #\d+\]/g, "[screenshot \u2014 not available for review]");
 }
 function bufferTmpPath() {
-  return `${CONVERSATION_BUFFER_FILE}.${process.pid}.${(0, import_node_crypto.randomBytes)(4).toString("hex")}.tmp`;
+  return `${CONVERSATION_BUFFER_FILE}.${process.pid}.${(0, import_node_crypto2.randomBytes)(4).toString("hex")}.tmp`;
 }
 async function appendToConversationBuffer(prompt, sessionId) {
   try {
@@ -17980,7 +18078,7 @@ async function appendToConversationBuffer(prompt, sessionId) {
 }
 async function readAndClearConversationBuffer(currentSessionId) {
   try {
-    if ((0, import_node_fs11.existsSync)(CONVERSATION_BUFFER_FILE)) {
+    if ((0, import_node_fs12.existsSync)(CONVERSATION_BUFFER_FILE)) {
       const entries = await readBufferEntries();
       let mine = entries;
       let others = [];
@@ -18004,7 +18102,7 @@ async function readAndClearConversationBuffer(currentSessionId) {
         };
       }
     }
-    if ((0, import_node_fs11.existsSync)(INTENT_FILE)) {
+    if ((0, import_node_fs12.existsSync)(INTENT_FILE)) {
       try {
         const content = await (0, import_promises5.readFile)(INTENT_FILE, "utf-8");
         await (0, import_promises5.unlink)(INTENT_FILE).catch(() => {
@@ -18295,83 +18393,6 @@ function isCommandOnlyTurn(input) {
   return commands.every(isNonAuthoringCommand);
 }
 
-// src/lib/context-identity.ts
-var import_node_crypto2 = require("node:crypto");
-var import_node_fs12 = require("node:fs");
-var import_node_os4 = require("node:os");
-var import_node_path12 = require("node:path");
-var SHARED_SENTINELS = /* @__PURE__ */ new Set([
-  "",
-  "-",
-  "n/a",
-  "na",
-  "none",
-  "null",
-  "undefined",
-  "unknown",
-  "anon",
-  "anonymous",
-  "default",
-  "_default"
-]);
-function isSharedSentinel(value) {
-  if (value == null) return true;
-  return SHARED_SENTINELS.has(value.trim().toLowerCase());
-}
-var ephemeral = /* @__PURE__ */ new Map();
-function ephemeralId(slot, width) {
-  let id = ephemeral.get(slot);
-  if (!id) {
-    id = `eph-${(0, import_node_crypto2.randomBytes)(Math.ceil(width / 2)).toString("hex").slice(0, width - 4)}`;
-    ephemeral.set(slot, id);
-  }
-  return id;
-}
-function contextIdentity(input) {
-  const tokenUsable = !isSharedSentinel(input.token ?? null);
-  const sessionUsable = !isSharedSentinel(input.sessionId ?? null);
-  const userKey = tokenUsable ? (0, import_node_crypto2.createHash)("sha256").update(String(input.token)).digest("hex").slice(0, 12) : ephemeralId("user", 12);
-  const sessionKey2 = sessionUsable ? (0, import_node_crypto2.createHash)("sha256").update(String(input.sessionId)).digest("hex").slice(0, 16) : ephemeralId("session", 16);
-  let treeKey = "no-tree";
-  const rawTree = input.treeRoot;
-  if (rawTree && !isSharedSentinel(rawTree)) {
-    let resolved = rawTree;
-    try {
-      resolved = import_node_fs12.realpathSync.native(rawTree);
-    } catch {
-    }
-    treeKey = (0, import_node_crypto2.createHash)("sha256").update(resolved).digest("hex").slice(0, 12);
-  }
-  return {
-    userKey,
-    treeKey,
-    sessionKey: sessionKey2,
-    userKeySource: tokenUsable ? "token" : "ephemeral",
-    sessionKeySource: sessionUsable ? "session_id" : "ephemeral",
-    ephemeral: !tokenUsable || !sessionUsable
-  };
-}
-function verityHome() {
-  const override = process.env.VERITY_HOME;
-  return override && override.trim() ? (0, import_node_path12.resolve)(override) : (0, import_node_path12.join)((0, import_node_os4.homedir)(), ".verity");
-}
-function dossierDir(identity) {
-  return (0, import_node_path12.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
-}
-function treeDir(identity) {
-  return (0, import_node_path12.join)(verityHome(), "sessions", identity.userKey, identity.treeKey);
-}
-function scopeIdentity(token, sessionId) {
-  const t = (token ?? "").trim();
-  const s = (sessionId ?? "").trim();
-  const userKey = t.length > 0 ? (0, import_node_crypto2.createHash)("sha256").update(t).digest("hex").slice(0, 12) : "anon";
-  const sessionKey2 = s.length > 0 ? (0, import_node_crypto2.createHash)("sha256").update(s).digest("hex").slice(0, 16) : "_default";
-  return { userKey, sessionKey: sessionKey2, bucket: `${userKey}/${sessionKey2}` };
-}
-function sessionScopeKey(token, sessionId) {
-  return scopeIdentity(token, sessionId).bucket;
-}
-
 // src/lib/task-context-buffer.ts
 var import_promises6 = require("node:fs/promises");
 var import_node_fs13 = require("node:fs");
@@ -20544,7 +20565,7 @@ Body content (\u22648KB). Use [[node-id]] wikilinks for cross-references.
 
 // src/lib/dossier-session.ts
 var import_node_fs26 = require("node:fs");
-var import_node_crypto8 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 var import_node_path22 = require("node:path");
 
 // src/lib/pending-repeat.ts
@@ -20621,6 +20642,7 @@ function isRepeatOfAny(text, priorFingerprints, threshold = REPEAT_THRESHOLD) {
 }
 
 // src/lib/dossier/bounds.ts
+var import_node_crypto5 = require("node:crypto");
 var MAX_LINE_BYTES = 4096;
 var MAX_GOAL_CHARS = 2e3;
 var GOAL_KEEP = 8;
@@ -20632,10 +20654,17 @@ var NOT_MINE_CAP = 300;
 var STATEMENTS_OPEN_CAP = 40;
 var COMMANDS_CAP = 12;
 var DIVERGENCE_CAP = 10;
-var DIVERGENCE_SEEN_CAP = 300;
+var DIVERGENCE_BULK_AT = 300;
+var DIVERGENCE_KEYS_PER_LINE = 200;
 function divergenceKey(path, hash) {
   return `${path}@${hash ?? "unknown"}`;
 }
+function packedDivergenceDigest(key) {
+  return (0, import_node_crypto5.createHash)("sha256").update(key).digest("hex").slice(0, 12);
+}
+function packedDivergenceKey(digest) {
+  return `#${digest}`;
+}
 var MARKS_CAP = 50;
 var ROTATE_BYTES = 1048576;
 var ROTATE_KEEP = 2;
@@ -20649,7 +20678,7 @@ function statementAnchorKey(file, patternId) {
 }
 
 // src/lib/dossier/log.ts
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 var import_node_fs22 = require("node:fs");
 var import_node_path20 = require("node:path");
 var CRC_TABLE = (() => {
@@ -20691,7 +20720,7 @@ function nextSeq() {
 function encodeEvent(ev) {
   const full = {
     v: 1,
-    id: (0, import_node_crypto5.randomBytes)(4).toString("hex"),
+    id: (0, import_node_crypto6.randomBytes)(4).toString("hex"),
     ...ev
   };
   let body2 = JSON.stringify(full);
@@ -20762,7 +20791,7 @@ function rotateIfNeeded2(d) {
 }
 
 // src/lib/dossier/fold-dossier.ts
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 var import_node_fs23 = require("node:fs");
 var import_node_path21 = require("node:path");
 var EMPTY_CAPABILITIES = () => ({
@@ -20854,7 +20883,7 @@ function reduce(state, events, now) {
     state.meta.seq = Math.max(state.meta.seq, ev.seq);
     switch (ev.k) {
       case "goal": {
-        const hash = (0, import_node_crypto6.createHash)("sha256").update(ev.text).digest("hex").slice(0, 16);
+        const hash = (0, import_node_crypto7.createHash)("sha256").update(ev.text).digest("hex").slice(0, 16);
         const prev = state.goal[state.goal.length - 1];
         if (prev && prev.hash === hash) {
           prev.repeats = (prev.repeats ?? 0) + 1;
@@ -20982,12 +21011,13 @@ function reduce(state, events, now) {
         break;
       }
       case "divergence": {
-        state.divergence.counts[ev.kind] = (state.divergence.counts[ev.kind] ?? 0) + 1;
         state.divergence.events.push({ kind: ev.kind, path: ev.path, at: ev.at });
-        const key = divergenceKey(ev.path, ev.hash ?? null);
-        if (!seenDivergence.has(key)) {
+        const keys = Array.isArray(ev.keys) ? ev.keys.filter((k) => typeof k === "string").map(packedDivergenceKey) : [divergenceKey(ev.path, ev.hash ?? null)];
+        for (const key of keys) {
+          if (seenDivergence.has(key)) continue;
           seenDivergence.add(key);
-          if (state.divergence.seen.length < DIVERGENCE_SEEN_CAP) state.divergence.seen.push(key);
+          state.divergence.seen.push(key);
+          state.divergence.counts[ev.kind] = (state.divergence.counts[ev.kind] ?? 0) + 1;
         }
         break;
       }
@@ -21294,14 +21324,14 @@ function assessContinuity(i2) {
 }
 
 // src/lib/dossier/reanchor.ts
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto8 = require("node:crypto");
 var import_node_fs25 = require("node:fs");
 function lineSha(text) {
-  return (0, import_node_crypto7.createHash)("sha256").update(text.trim()).digest("hex").slice(0, HASH_WIDTH);
+  return (0, import_node_crypto8.createHash)("sha256").update(text.trim()).digest("hex").slice(0, HASH_WIDTH);
 }
 function fileHash(path) {
   try {
-    return (0, import_node_crypto7.createHash)("sha256").update((0, import_node_fs25.readFileSync)(path)).digest("hex").slice(0, HASH_WIDTH);
+    return (0, import_node_crypto8.createHash)("sha256").update((0, import_node_fs25.readFileSync)(path)).digest("hex").slice(0, HASH_WIDTH);
   } catch {
     return null;
   }
@@ -21798,7 +21828,7 @@ function recordTurn(d, t) {
       // Identity is the COMMAND, not its category — otherwise `npm test -- a` and
       // `npm test -- b` are one row and the streak counts two different commands
       // as a run of one.
-      cmd_hash: (0, import_node_crypto8.createHash)("sha256").update(c.head || c.class).digest("hex").slice(0, 12),
+      cmd_hash: (0, import_node_crypto9.createHash)("sha256").update(c.head || c.class).digest("hex").slice(0, 12),
       head: c.head || c.class,
       status: toStatus(c.last_status)
     });
@@ -21816,10 +21846,23 @@ function recordTurn(d, t) {
     }
   }
   const seenDivergence = t.known?.divergence ?? /* @__PURE__ */ new Set();
+  const fresh = [];
   for (const u of t.unobserved) {
     const hash = fileHash((0, import_node_path22.join)(root, u.p));
-    if (seenDivergence.has(divergenceKey(u.p, hash))) continue;
-    appendEvent(d, { k: "divergence", kind: "external_mutation", path: u.p, hash });
+    const key = divergenceKey(u.p, hash);
+    const digest = packedDivergenceDigest(key);
+    if (seenDivergence.has(key) || seenDivergence.has(packedDivergenceKey(digest))) continue;
+    fresh.push({ path: u.p, hash, digest });
+  }
+  if (fresh.length > DIVERGENCE_BULK_AT) {
+    for (let i2 = 0; i2 < fresh.length; i2 += DIVERGENCE_KEYS_PER_LINE) {
+      const slice2 = fresh.slice(i2, i2 + DIVERGENCE_KEYS_PER_LINE);
+      appendEvent(d, { k: "divergence", kind: "external_mutation", path: slice2[0].path, keys: slice2.map((f) => f.digest) });
+    }
+  } else {
+    for (const f of fresh) {
+      appendEvent(d, { k: "divergence", kind: "external_mutation", path: f.path, hash: f.hash });
+    }
   }
   const newCompactions = (t.compactions ?? 0) - (t.known?.compactions ?? 0);
   for (let i2 = 0; i2 < newCompactions; i2++) {
@@ -22084,7 +22127,7 @@ async function fireClassify(prompt, sessionId, globals) {
     logEvent("classify_skipped", { reason: "no_service_url", detail: urlResult.error });
     return;
   }
-  const promptHash = (0, import_node_crypto9.createHash)("sha256").update(prompt).digest("hex");
+  const promptHash = (0, import_node_crypto10.createHash)("sha256").update(prompt).digest("hex");
   const result = await apiRequest({
     method: "POST",
     path: "/classify-task",
@@ -22128,7 +22171,7 @@ var import_node_path26 = require("node:path");
 // src/lib/baseline.ts
 var import_node_fs28 = require("node:fs");
 var import_node_path25 = require("node:path");
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 
 // src/lib/snapshot.ts
 var import_node_fs27 = require("node:fs");
@@ -22397,7 +22440,7 @@ var MIRROR_MAX_BYTES = 2 * 1024 * 1024;
 var DEFAULT_SESSION_KEY = "_default";
 function sessionKey(sessionId) {
   if (!sessionId) return DEFAULT_SESSION_KEY;
-  return (0, import_node_crypto10.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
+  return (0, import_node_crypto11.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
 }
 function sessionDir(key) {
   return (0, import_node_path25.join)(projectPath(BASELINE_DIR), key);
@@ -22859,17 +22902,17 @@ async function readHookStdin() {
   try {
     if (process.stdin.isTTY) return {};
     const chunks = [];
-    const timeout = new Promise((resolve8) => setTimeout(() => resolve8({}), 500));
-    const read2 = new Promise((resolve8) => {
+    const timeout = new Promise((resolve9) => setTimeout(() => resolve9({}), 500));
+    const read2 = new Promise((resolve9) => {
       process.stdin.on("data", (c) => chunks.push(c));
       process.stdin.on("end", () => {
         try {
-          resolve8(JSON.parse(Buffer.concat(chunks).toString("utf-8").trim() || "{}"));
+          resolve9(JSON.parse(Buffer.concat(chunks).toString("utf-8").trim() || "{}"));
         } catch {
-          resolve8({});
+          resolve9({});
         }
       });
-      process.stdin.on("error", () => resolve8({}));
+      process.stdin.on("error", () => resolve9({}));
       process.stdin.resume();
     });
     return await Promise.race([read2, timeout]);
@@ -24317,10 +24360,10 @@ var import_node_fs38 = require("node:fs");
 
 // src/lib/debounce.ts
 var import_node_fs37 = require("node:fs");
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 function scopedFile(base, sessionId) {
   if (!sessionId) return base;
-  return `${base}.${(0, import_node_crypto11.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
+  return `${base}.${(0, import_node_crypto12.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
 }
 function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
@@ -24361,7 +24404,7 @@ function checkMtime(files, bypassForRecentCommits, sessionId) {
   return "No files modified since last analysis";
 }
 function computeContentHash(files) {
-  const hash = (0, import_node_crypto11.createHash)("sha1");
+  const hash = (0, import_node_crypto12.createHash)("sha1");
   const sorted = [...files].sort();
   for (const f of sorted) {
     const resolved = resolveFile(f) ?? f;
@@ -24984,6 +25027,7 @@ function createRun(opts, globals) {
 
 // src/commands/analyze/index.ts
 var import_node_fs52 = require("node:fs");
+var import_node_path40 = require("node:path");
 
 // src/lib/repo-context.ts
 var import_node_child_process11 = require("node:child_process");
@@ -26786,28 +26830,28 @@ async function readStopHookStdin() {
   try {
     if (process.stdin.isTTY) return empty;
     const chunks = [];
-    const timeout = new Promise((resolve8) => setTimeout(() => resolve8(empty), 500));
-    const read2 = new Promise((resolve8) => {
+    const timeout = new Promise((resolve9) => setTimeout(() => resolve9(empty), 500));
+    const read2 = new Promise((resolve9) => {
       process.stdin.on("data", (chunk) => chunks.push(chunk));
       process.stdin.on("end", () => {
         const raw = Buffer.concat(chunks).toString("utf-8").trim();
         if (!raw) {
-          resolve8(empty);
+          resolve9(empty);
           return;
         }
         try {
           const data = JSON.parse(raw);
-          resolve8({
+          resolve9({
             assistantMessage: typeof data.last_assistant_message === "string" ? data.last_assistant_message : null,
             stopReason: typeof data.stop_reason === "string" ? data.stop_reason : null,
             transcriptPath: typeof data.transcript_path === "string" ? data.transcript_path : null,
             sessionId: typeof data.session_id === "string" ? data.session_id : null
           });
         } catch {
-          resolve8(empty);
+          resolve9(empty);
         }
       });
-      process.stdin.on("error", () => resolve8(empty));
+      process.stdin.on("error", () => resolve9(empty));
       process.stdin.resume();
     });
     return await Promise.race([read2, timeout]);
@@ -27073,7 +27117,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.34.0-experimental.37a6dcf" : "dev";
+    return true ? "0.34.0-experimental.3d4888f" : "dev";
   } catch {
     return "dev";
   }
@@ -28541,7 +28585,7 @@ async function contextFiles(run4) {
 }
 
 // src/lib/code/index.ts
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 
 // src/lib/code/languages.ts
 var JS_LIKE = {
@@ -30319,7 +30363,7 @@ function byPath(fns, name2) {
 function makeCodeMap(rt) {
   const cache = /* @__PURE__ */ new Map();
   const outline = (path, content, deadlineAt = Date.now() + DEFAULT_PARSE_MS) => {
-    const key = `${path}\0${(0, import_node_crypto12.createHash)("sha1").update(content).digest("hex")}`;
+    const key = `${path}\0${(0, import_node_crypto13.createHash)("sha1").update(content).digest("hex")}`;
     const hit = cache.get(key);
     if (hit) return { source: "tree-sitter", value: hit, elapsedMs: 0 };
     let r;
@@ -31688,6 +31732,22 @@ async function workingMemory(run4) {
   Object.assign(run4, { incrementReport, memory: memory2, memorySession, reachability });
 }
 
+// src/lib/payload-bounds.ts
+var MAX_WIRE_PATHS = 500;
+function boundPaths(paths, first, max = MAX_WIRE_PATHS) {
+  if (paths.length <= max) return [...paths];
+  const present = new Set(paths);
+  const kept = /* @__PURE__ */ new Set();
+  const out2 = [];
+  for (const p of [...first, ...paths]) {
+    if (out2.length >= max) break;
+    if (!present.has(p) || kept.has(p)) continue;
+    kept.add(p);
+    out2.push(p);
+  }
+  return out2;
+}
+
 // src/lib/note-budget.ts
 var import_node_fs49 = require("node:fs");
 var ADVISORY_BUDGET = { PASS: 1, WARN: 2 };
@@ -31802,6 +31862,7 @@ async function buildRequest(run4) {
     (conversation?.prompts?.length ?? 0) > 0
   );
   const noteConfirmation = peekNoteOutcome();
+  const unobserved = foldResult?.unobserved ?? [];
   const excludedByReason = {};
   for (const e of codeDelta.excluded ?? []) {
     excludedByReason[e.reason] = (excludedByReason[e.reason] ?? 0) + 1;
@@ -31846,7 +31907,9 @@ async function buildRequest(run4) {
     coverage_telemetry: coverageTelemetry,
     static_results: staticResults,
     code_delta: codeDelta,
-    changed_files: allForReview,
+    // Bounded, reviewed paths first — the server applies the same bound. The
+    // full count is `coverage_telemetry.for_review`. VRT-242.
+    changed_files: boundPaths(allForReview, codeDelta.files.map((f) => f.path)),
     standard_version: "latest",
     analysis_mode: analysisMode,
     plan_only: analysisMode === "plan",
@@ -31897,7 +31960,9 @@ async function buildRequest(run4) {
         // `hash_at_last_verdict` is frozen at each verdict and `hash_now` tracks
         // disk, so their inequality IS "changed since we last spoke".
         authored_since_verdict: memorySession ? foldDossier(memorySession.d).authored_all.filter((a) => a.hash_now !== a.hash_at_last_verdict).map((a) => a.path) : [],
-        unobserved: foldResult?.unobserved ?? [],
+        // The server reads only how many; a bulk change sent every path. VRT-242.
+        unobserved: unobserved.slice(0, MAX_WIRE_PATHS),
+        ...unobserved.length > MAX_WIRE_PATHS && { unobserved_total: unobserved.length },
         commands: foldResult?.commands ?? [],
         tools: foldResult?.tools ?? [],
         tasks: foldResult?.tasks ?? [],
@@ -32061,11 +32126,11 @@ async function buildRequest(run4) {
 
 // src/lib/offline.ts
 var import_node_fs50 = require("node:fs");
-var import_node_crypto13 = require("node:crypto");
+var import_node_crypto14 = require("node:crypto");
 function cacheRequest(body2) {
   try {
     (0, import_node_fs50.mkdirSync)(CACHE_DIR, { recursive: true });
-    const suffix = (0, import_node_crypto13.randomBytes)(4).toString("hex");
+    const suffix = (0, import_node_crypto14.randomBytes)(4).toString("hex");
     const filename = `pending-${Math.floor(Date.now() / 1e3)}-${suffix}.json`;
     (0, import_node_fs50.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(redactRequest(body2)));
   } catch {
@@ -32108,8 +32173,10 @@ function buildOfflineFallback(reason, staticResults) {
 }
 
 // src/lib/retry.ts
+var WORKER_RESOURCE_LIMIT = 546;
 function shouldWarmRetryAnalyze(result) {
   if (result.ok) return false;
+  if (result.http_status === WORKER_RESOURCE_LIMIT) return false;
   if (result.category === "network" || result.category === "timeout") return true;
   if (result.category === "http_5xx") return true;
   if (result.category === "invalid_json" && (result.http_status ?? 0) >= 500) return true;
@@ -32119,7 +32186,7 @@ function shouldWarmRetryAnalyze(result) {
 // src/commands/analyze/phases/12-transmit.ts
 async function transmit(run4) {
   const { globals } = run4;
-  const { codeDelta, requestBody, serviceUrl, staticResults, token } = run4;
+  const { requestBody, serviceUrl, staticResults, token } = run4;
   const ANALYZE_TIMEOUT_MS = 1e5;
   let result = await analyzeRequest({
     serviceUrl,
@@ -32156,11 +32223,12 @@ async function transmit(run4) {
   }
   if (!result.ok) {
     cacheRequest(requestBody);
+    const sentKb = () => Math.round(Buffer.byteLength(JSON.stringify(requestBody)) / 1024);
     let message;
     if (result.http_status === 413) {
-      const totalBytes = codeDelta.files.reduce((sum, f) => sum + f.content.length, 0);
-      const kb = Math.round(totalBytes / 1024);
-      message = `Verity: request rejected \u2014 payload too large (${kb}KB over the 190KB cap). Commit or stash pre-existing changes, or run with --mode skip if you didn't intend to submit code this turn.`;
+      message = `Verity: request rejected \u2014 payload too large (${sentKb()} KB sent: ${result.error}). Commit or stash pre-existing changes, or run with --mode skip if you didn't intend to submit code this turn.`;
+    } else if (result.http_status === WORKER_RESOURCE_LIMIT) {
+      message = `Verity: the service ran out of CPU or memory on this request (HTTP 546, ${sentKb()} KB sent). This is not a cold start: the same change fails the same way, so it was not retried. Commit or stash unrelated changes to shrink the request (local analysis this run).`;
     } else if (result.category === "network" || result.category === "timeout") {
       message = `Verity offline \u2014 ${result.error}`;
     } else if (result.error.startsWith("STALE_VERIFICATION")) {
@@ -33038,7 +33106,7 @@ function registerAnalyzeCommand(program2) {
 var tracing = () => process.env.VERITY_TRACE_PHASES === "1";
 async function runAnalyze(opts, globals) {
   if (!verityConfigured()) {
-    (0, import_node_fs52.writeSync)(2, '[verity] not set up in this project \u2014 run "verity init" first.\n');
+    (0, import_node_fs52.writeSync)(2, isMachineStore((0, import_node_path40.join)(repoRoot(), VERITY_DIR)) ? "[verity] nothing to review in your home directory \u2014 run Verity inside a project.\n" : '[verity] not set up in this project \u2014 run "verity init" first.\n');
     process.exit(0);
   }
   const run4 = createRun(opts, globals);
@@ -33060,10 +33128,11 @@ async function runAnalyze(opts, globals) {
 
 // src/commands/baseline.ts
 var import_node_fs54 = require("node:fs");
+var import_node_path42 = require("node:path");
 
 // src/lib/project-skills.ts
 var import_node_fs53 = require("node:fs");
-var import_node_path40 = require("node:path");
+var import_node_path41 = require("node:path");
 var PROJECT_SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -33090,13 +33159,13 @@ var ALL = [...PROJECT_SKILL_NAMES, ...LEGACY_SKILL_NAMES];
 function staleProjectSkills() {
   const root = projectPath(".claude/skills");
   if (!(0, import_node_fs53.existsSync)(root)) return [];
-  return ALL.filter((name2) => (0, import_node_fs53.existsSync)((0, import_node_path40.join)(root, name2)));
+  return ALL.filter((name2) => (0, import_node_fs53.existsSync)((0, import_node_path41.join)(root, name2)));
 }
 function removeProjectSkills() {
   const root = projectPath(".claude/skills");
   const removed = [];
   for (const name2 of staleProjectSkills()) {
-    (0, import_node_fs53.rmSync)((0, import_node_path40.join)(root, name2), { recursive: true, force: true });
+    (0, import_node_fs53.rmSync)((0, import_node_path41.join)(root, name2), { recursive: true, force: true });
     removed.push(name2);
   }
   return removed;
@@ -33129,6 +33198,7 @@ function registerBaselineCommands(program2) {
       const skewMsg = skew ? `Verity: your global \`verity\` CLI is ${skew.global} but the hooks run ${skew.hooks}. Fix it before using \`verity\` in a terminal: ${skew.remedy}` : null;
       const skewNote = skew ? `Before anything else, including /verity:init's questions, tell the user their global \`verity\` is ${skew.global}, the hooks run ${skew.hooks}, and \`${skew.remedy}\` fixes it. Until they have, do not send them to run \`verity login\` in a terminal: that runs the global one, which can sign this machine in to a different server.` : null;
       if (!verityConfigured()) {
+        if (isMachineStore((0, import_node_path42.join)(repoRoot(), VERITY_DIR))) process.exit(0);
         const how = isPluginInvocation() ? "Tell the user to run /verity:init \u2014 they type it; you cannot invoke it." : "Tell the user to run `verity init` in their terminal.";
         const lines = [
           `Verity is installed but this project is not set up yet, so the quality gate will not review anything here. ${how}`
@@ -33352,7 +33422,7 @@ async function runReview(opts, globals) {
 
 // src/commands/guard.ts
 var import_node_fs59 = require("node:fs");
-var import_node_path45 = require("node:path");
+var import_node_path47 = require("node:path");
 
 // src/lib/terminal-text.ts
 var CONTROL = /[\x00-\x08\x0b-\x1f\x7f-\x9f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/g;
@@ -33445,7 +33515,7 @@ async function runAgentReview(options) {
   }
   if (!settled) {
     const wait = Math.max(0, remaining() - FINISH_TIMEOUT_MS);
-    await Promise.race([oneShotDone, new Promise((resolve8) => setTimeout(resolve8, wait))]);
+    await Promise.race([oneShotDone, new Promise((resolve9) => setTimeout(resolve9, wait))]);
   }
   const finished = await options.http.post(
     "/agent-review/finish",
@@ -33460,8 +33530,8 @@ async function runAgentReview(options) {
 }
 
 // src/lib/prove/auto.ts
-var import_node_path44 = require("node:path");
-var import_node_crypto18 = require("node:crypto");
+var import_node_path46 = require("node:path");
+var import_node_crypto19 = require("node:crypto");
 
 // src/lib/prove/signals.ts
 var DEFAULT_SINCE = "180 days ago";
@@ -35189,16 +35259,16 @@ var import_node_child_process15 = require("node:child_process");
 var import_node_os8 = require("node:os");
 var import_node_fs58 = require("node:fs");
 var import_node_os9 = require("node:os");
-var import_node_path43 = require("node:path");
+var import_node_path45 = require("node:path");
 
 // src/lib/prove/scaffold.ts
 var import_node_fs57 = require("node:fs");
-var import_node_path42 = require("node:path");
+var import_node_path44 = require("node:path");
 
 // src/lib/prove/safe-write.ts
 var import_node_fs56 = require("node:fs");
-var import_node_crypto14 = require("node:crypto");
-var import_node_path41 = require("node:path");
+var import_node_crypto15 = require("node:crypto");
+var import_node_path43 = require("node:path");
 var SafeWriteError = class extends Error {
   constructor(reason, path) {
     super(`refusing to write ${path}: ${reason}`);
@@ -35210,7 +35280,7 @@ var SafeWriteError = class extends Error {
 var FLAGS3 = import_node_fs56.constants;
 var NOFOLLOW2 = FLAGS3.O_NOFOLLOW ?? 0;
 function assertPlainRelative(rel) {
-  if (!rel || (0, import_node_path41.isAbsolute)(rel)) throw new SafeWriteError("bad-path", rel);
+  if (!rel || (0, import_node_path43.isAbsolute)(rel)) throw new SafeWriteError("bad-path", rel);
   for (const part of rel.split(/[\\/]/)) {
     if (part === ".." || part === "" || part === ".") throw new SafeWriteError("bad-path", rel);
   }
@@ -35219,7 +35289,7 @@ function ensureDirsNoFollow(root, rel) {
   const parts2 = rel.split(/[\\/]/);
   let cur = root;
   for (const part of parts2.slice(0, -1)) {
-    cur = (0, import_node_path41.join)(cur, part);
+    cur = (0, import_node_path43.join)(cur, part);
     let st;
     try {
       st = (0, import_node_fs56.lstatSync)(cur);
@@ -35230,10 +35300,10 @@ function ensureDirsNoFollow(root, rel) {
     if (st.isSymbolicLink()) throw new SafeWriteError("symlink", cur);
     if (!st.isDirectory()) throw new SafeWriteError("not-regular", cur);
   }
-  return (0, import_node_path41.join)(root, rel);
+  return (0, import_node_path43.join)(root, rel);
 }
 function insideRoot(realRoot, realPath) {
-  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path41.sep) ? realRoot : realRoot + import_node_path41.sep);
+  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path43.sep) ? realRoot : realRoot + import_node_path43.sep);
 }
 function removeQuietly(path) {
   try {
@@ -35244,7 +35314,7 @@ function removeQuietly(path) {
 function writeFileInRootNoFollow(root, rel, content) {
   assertPlainRelative(rel);
   const dest = ensureDirsNoFollow(root, rel);
-  const dir = (0, import_node_path41.dirname)(dest);
+  const dir = (0, import_node_path43.dirname)(dest);
   try {
     const st = (0, import_node_fs56.lstatSync)(dest);
     if (st.isSymbolicLink()) throw new SafeWriteError("symlink", dest);
@@ -35258,7 +35328,7 @@ function writeFileInRootNoFollow(root, rel, content) {
   } catch {
     throw new SafeWriteError("unwritable", root);
   }
-  const tmp = (0, import_node_path41.join)(dir, `.${(0, import_node_path41.basename)(dest)}.${(0, import_node_crypto14.randomBytes)(6).toString("hex")}.tmp`);
+  const tmp = (0, import_node_path43.join)(dir, `.${(0, import_node_path43.basename)(dest)}.${(0, import_node_crypto15.randomBytes)(6).toString("hex")}.tmp`);
   let fd;
   try {
     fd = (0, import_node_fs56.openSync)(tmp, import_node_fs56.constants.O_WRONLY | import_node_fs56.constants.O_CREAT | import_node_fs56.constants.O_EXCL | NOFOLLOW2, 420);
@@ -35302,7 +35372,7 @@ function pathHasNoLink(root, rel) {
   }
   let cur = root;
   for (const part of rel.split(/[\\/]/)) {
-    cur = cur + import_node_path41.sep + part;
+    cur = cur + import_node_path43.sep + part;
     try {
       if ((0, import_node_fs56.lstatSync)(cur).isSymbolicLink()) return false;
     } catch {
@@ -35614,20 +35684,20 @@ This directory is machine-local and gitignored (see ../.gitignore). Models are
 never committed; what reaches the team is the bug report and the fix.
 `;
 function scaffoldProofs(root) {
-  const proofsDir = (0, import_node_path42.join)(root, PROOFS_DIR);
+  const proofsDir = (0, import_node_path44.join)(root, PROOFS_DIR);
   const written = [];
   const kept = [];
   for (const stray of ["lakefile.lean"]) {
     const rel = `${PROOFS_DIR}/${stray}`;
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path42.join)(root, rel));
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path44.join)(root, rel));
     try {
-      (0, import_node_fs57.rmSync)((0, import_node_path42.join)(root, rel), { force: true });
+      (0, import_node_fs57.rmSync)((0, import_node_path44.join)(root, rel), { force: true });
     } catch {
     }
   }
   for (const f of PROOFS_TEMPLATE_FILES) {
     const rel = `${PROOFS_DIR}/${f.path}`;
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path42.join)(root, rel));
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path44.join)(root, rel));
     const current = readRegularFileInRoot(root, rel, 4 * 1024 * 1024);
     if (current.ok && current.content === f.content) {
       kept.push(rel);
@@ -35640,8 +35710,8 @@ function scaffoldProofs(root) {
     [`${PROOFS_DIR}/.gitignore`, LOCAL_GITIGNORE],
     [`${MODELS_DIR}/README.md`, MODELS_README]
   ]) {
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path42.join)(root, rel));
-    if (existsNoFollow((0, import_node_path42.join)(root, rel))) {
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path44.join)(root, rel));
+    if (existsNoFollow((0, import_node_path44.join)(root, rel))) {
       kept.push(rel);
       continue;
     }
@@ -35660,7 +35730,7 @@ function existsNoFollow(abs) {
 }
 
 // src/lib/prove/report.ts
-var import_node_crypto15 = require("node:crypto");
+var import_node_crypto16 = require("node:crypto");
 var IDENT2 = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,63}$/;
 var SHA256 = /^(sha256:)?[0-9a-f]{64}$/;
 var KINDS2 = /* @__PURE__ */ new Set(["structural", "intent"]);
@@ -35808,7 +35878,7 @@ function sha256InRoot(root, file) {
   const opened = openRegularInRoot(root, file);
   if (!opened.ok) return null;
   try {
-    return (0, import_node_crypto15.createHash)("sha256").update(readOpened(opened.fd, opened.size)).digest("hex");
+    return (0, import_node_crypto16.createHash)("sha256").update(readOpened(opened.fd, opened.size)).digest("hex");
   } catch {
     return null;
   }
@@ -35910,17 +35980,17 @@ function renderReport(r) {
 
 // src/lib/prove/runner.ts
 function verityLeanHome(env = process.env) {
-  return env.VERITY_LEAN_HOME ?? (0, import_node_path43.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".verity", "lean");
+  return env.VERITY_LEAN_HOME ?? (0, import_node_path45.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".verity", "lean");
 }
 function findToolchain(env = process.env) {
-  const managedBin = (0, import_node_path43.join)(verityLeanHome(env), LEAN_TOOLCHAIN.replace(/^leanprover\/lean4:/, ""), "bin");
-  const elanBin = (0, import_node_path43.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "bin");
-  const elanHas = (0, import_node_fs58.existsSync)((0, import_node_path43.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "toolchains", LEAN_TOOLCHAIN.replace("/", "--").replace(":", "---")));
-  const userPath = (env.PATH ?? "").split(import_node_path43.delimiter).filter((d) => d && (elanHas || (0, import_node_path43.resolve)(d) !== (0, import_node_path43.resolve)(elanBin)));
-  const path = [managedBin, ...elanHas ? [elanBin] : [], ...userPath].join(import_node_path43.delimiter);
+  const managedBin = (0, import_node_path45.join)(verityLeanHome(env), LEAN_TOOLCHAIN.replace(/^leanprover\/lean4:/, ""), "bin");
+  const elanBin = (0, import_node_path45.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "bin");
+  const elanHas = (0, import_node_fs58.existsSync)((0, import_node_path45.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "toolchains", LEAN_TOOLCHAIN.replace("/", "--").replace(":", "---")));
+  const userPath = (env.PATH ?? "").split(import_node_path45.delimiter).filter((d) => d && (elanHas || (0, import_node_path45.resolve)(d) !== (0, import_node_path45.resolve)(elanBin)));
+  const path = [managedBin, ...elanHas ? [elanBin] : [], ...userPath].join(import_node_path45.delimiter);
   const merged = { ...env, PATH: path, ELAN_TOOLCHAIN: env.ELAN_TOOLCHAIN ?? LEAN_TOOLCHAIN };
   const exe = process.platform === "win32" ? "lake.exe" : "lake";
-  const candidates2 = [(0, import_node_path43.join)(managedBin, exe), ...elanHas ? [(0, import_node_path43.join)(elanBin, exe)] : [], exe];
+  const candidates2 = [(0, import_node_path45.join)(managedBin, exe), ...elanHas ? [(0, import_node_path45.join)(elanBin, exe)] : [], exe];
   for (const candidate of candidates2) {
     try {
       (0, import_node_child_process15.execFileSync)(candidate, ["--version"], { env: merged, stdio: ["ignore", "pipe", "pipe"], timeout: 1e4 });
@@ -35958,7 +36028,7 @@ function run2(tc, cwd, args2, timeoutMs) {
 function runAsync(tc, cwd, args2, timeoutMs) {
   const started = Date.now();
   const MAX = 16 * 1024 * 1024;
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const posix = (0, import_node_os8.platform)() !== "win32";
     const child = (0, import_node_child_process15.spawn)(tc.lake, args2, { cwd, env: tc.env, stdio: ["ignore", "pipe", "pipe"], detached: posix });
     let stdout = "";
@@ -35986,8 +36056,8 @@ function runAsync(tc, cwd, args2, timeoutMs) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      if (ok) resolve8({ ok: true, stdout, stderr: "", durationMs: Date.now() - started, timedOut: false });
-      else resolve8({ ok: false, stdout, stderr: stderr || message || "", durationMs: Date.now() - started, timedOut });
+      if (ok) resolve9({ ok: true, stdout, stderr: "", durationMs: Date.now() - started, timedOut: false });
+      else resolve9({ ok: false, stdout, stderr: stderr || message || "", durationMs: Date.now() - started, timedOut });
     };
     child.on("error", (err2) => finish(false, err2.message));
     child.on("close", (code) => finish(code === 0 && !timedOut));
@@ -35999,7 +36069,7 @@ function proofsWorkspaceProblem(root) {
   for (const rel of [".verity", PROOFS_DIR, `${PROOFS_DIR}/.lake`]) {
     let st;
     try {
-      st = (0, import_node_fs58.lstatSync)((0, import_node_path43.join)(root, rel));
+      st = (0, import_node_fs58.lstatSync)((0, import_node_path45.join)(root, rel));
     } catch {
       break;
     }
@@ -36019,44 +36089,44 @@ function refused(problem) {
 function buildLibrary(tc, root, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS) {
   const problem = proofsWorkspaceProblem(root);
   if (problem) return refused(problem);
-  return run2(tc, (0, import_node_path43.join)(root, PROOFS_DIR), ["build"], timeoutMs);
+  return run2(tc, (0, import_node_path45.join)(root, PROOFS_DIR), ["build"], timeoutMs);
 }
 async function buildLibraryAsync(tc, root, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS) {
   const problem = proofsWorkspaceProblem(root);
   if (problem) return refused(problem);
-  return runAsync(tc, (0, import_node_path43.join)(root, PROOFS_DIR), ["build"], timeoutMs);
+  return runAsync(tc, (0, import_node_path45.join)(root, PROOFS_DIR), ["build"], timeoutMs);
 }
 function isModelInRoot(modelsAbs, rel) {
-  if (!rel.endsWith(".lean") || (0, import_node_path43.isAbsolute)(rel) || rel.startsWith("..")) return false;
+  if (!rel.endsWith(".lean") || (0, import_node_path45.isAbsolute)(rel) || rel.startsWith("..")) return false;
   return statRegularInRoot(modelsAbs, rel).ok;
 }
 function resolveModelFile(root, arg) {
-  const modelsAbs = (0, import_node_path43.join)(root, MODELS_DIR);
-  const asPath = (0, import_node_path43.relative)(modelsAbs, (0, import_node_path43.isAbsolute)(arg) ? arg : (0, import_node_path43.resolve)(root, arg));
+  const modelsAbs = (0, import_node_path45.join)(root, MODELS_DIR);
+  const asPath = (0, import_node_path45.relative)(modelsAbs, (0, import_node_path45.isAbsolute)(arg) ? arg : (0, import_node_path45.resolve)(root, arg));
   const candidates2 = arg.includes("/") || arg.includes("\\") ? [asPath] : [arg, `${arg}.lean`];
   for (const rel of candidates2) {
-    if (isModelInRoot(modelsAbs, rel)) return (0, import_node_path43.join)(modelsAbs, rel);
+    if (isModelInRoot(modelsAbs, rel)) return (0, import_node_path45.join)(modelsAbs, rel);
   }
   return null;
 }
 function listModelFiles(root) {
-  const modelsAbs = (0, import_node_path43.join)(root, MODELS_DIR);
+  const modelsAbs = (0, import_node_path45.join)(root, MODELS_DIR);
   if (!(0, import_node_fs58.existsSync)(modelsAbs)) return [];
-  return (0, import_node_fs58.readdirSync)(modelsAbs).filter((f) => isModelInRoot(modelsAbs, f)).sort().map((f) => (0, import_node_path43.join)(modelsAbs, f));
+  return (0, import_node_fs58.readdirSync)(modelsAbs).filter((f) => isModelInRoot(modelsAbs, f)).sort().map((f) => (0, import_node_path45.join)(modelsAbs, f));
 }
 function trimDiagnostics(text) {
   return text.split("\n").filter((l) => !l.startsWith("trace:")).join("\n").trim().slice(0, 4e3);
 }
 function checkModel(tc, root, modelFile, opts = {}) {
-  const proofsAbs = (0, import_node_path43.join)(root, PROOFS_DIR);
-  const rel = (0, import_node_path43.relative)(proofsAbs, modelFile);
+  const proofsAbs = (0, import_node_path45.join)(root, PROOFS_DIR);
+  const rel = (0, import_node_path45.relative)(proofsAbs, modelFile);
   const problem = proofsWorkspaceProblem(root);
   const res = problem ? refused(problem) : run2(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
   return toReport(res, root, modelFile, opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
 }
 async function checkModelAsync(tc, root, modelFile, opts = {}) {
-  const proofsAbs = (0, import_node_path43.join)(root, PROOFS_DIR);
-  const rel = (0, import_node_path43.relative)(proofsAbs, modelFile);
+  const proofsAbs = (0, import_node_path45.join)(root, PROOFS_DIR);
+  const rel = (0, import_node_path45.relative)(proofsAbs, modelFile);
   const problem = proofsWorkspaceProblem(root);
   const res = problem ? refused(problem) : await runAsync(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
   return toReport(res, root, modelFile, opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
@@ -36065,10 +36135,10 @@ function toReport(res, root, modelFile, timeoutMs) {
   const parsed = parseVerityLines(res.stdout);
   const combined = `${res.stdout}
 ${res.stderr}`;
-  const name2 = parsed.header?.model ?? (0, import_node_path43.basename)(modelFile, ".lean");
+  const name2 = parsed.header?.model ?? (0, import_node_path45.basename)(modelFile, ".lean");
   const report = {
     model: name2,
-    file: (0, import_node_path43.relative)(root, modelFile),
+    file: (0, import_node_path45.relative)(root, modelFile),
     ok: res.ok,
     header: parsed.header,
     properties: parsed.properties,
@@ -36143,7 +36213,7 @@ function mergeFormalFindings(response, outcome, pushedFiles) {
 }
 
 // src/lib/prove/scalpel.ts
-var import_node_crypto16 = require("node:crypto");
+var import_node_crypto17 = require("node:crypto");
 var ARITHMETIC = /Math\.(?:round|floor|ceil|trunc)\(|\bround\(|\bdivmod\(|[\w)\]]\s*(?:\*|\/(?!\/)|%)\s*[\w(]/;
 function functionHazard(numbered2) {
   const sites = effectSites(numbered2);
@@ -36173,7 +36243,7 @@ function semanticFingerprint(numbered2) {
     if (LOG_LINE.test(t)) continue;
     kept.push(t.replace(/\s+/g, " "));
   }
-  return (0, import_node_crypto16.createHash)("sha256").update(kept.join("\n")).digest("hex");
+  return (0, import_node_crypto17.createHash)("sha256").update(kept.join("\n")).digest("hex");
 }
 function readVerified(root, now = Date.now()) {
   const read2 = readRegularFileInRoot(root, VERIFIED_FILE, 256 * 1024);
@@ -36196,9 +36266,9 @@ function recordVerified(root, rec, now = Date.now()) {
 }
 
 // src/lib/prove/context.ts
-var import_node_crypto17 = require("node:crypto");
+var import_node_crypto18 = require("node:crypto");
 var CONTEXT_BUDGET_MS = 2e3;
-var sha256 = (s) => (0, import_node_crypto17.createHash)("sha256").update(s).digest("hex");
+var sha256 = (s) => (0, import_node_crypto18.createHash)("sha256").update(s).digest("hex");
 var TEST_PATH4 = /(^|\/)(tests?|__tests__|spec)\/|\.(test|spec)\.[a-z]+$/;
 function slice(content, f, maxLines) {
   const all = content.split("\n");
@@ -36387,7 +36457,7 @@ function workingTreeReader(root) {
   };
 }
 function sha256Of(content) {
-  return (0, import_node_crypto18.createHash)("sha256").update(content).digest("hex");
+  return (0, import_node_crypto19.createHash)("sha256").update(content).digest("hex");
 }
 function defaultDeps(opts) {
   const env = opts.env ?? process.env;
@@ -36638,7 +36708,7 @@ async function runFormalPhase(input) {
     modelName = gen.name;
     const rel = `${AUTO_MODELS_DIR}/${gen.name}.lean`;
     writeFileInRootNoFollow(root, rel, gen.source);
-    const abs = resolveModelFile(root, rel) ?? (0, import_node_path44.join)(root, rel);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path46.join)(root, rel);
     progress.model = { name: gen.name, file: rel, rounds: round };
     progress.step = "check";
     report = await deps.check(root, abs);
@@ -36699,11 +36769,11 @@ async function runFormalPhase(input) {
   const budget = Math.max(2e4, timeLeft() - 5e3);
   const byId = /* @__PURE__ */ new Map();
   let stoppedEarly = false;
-  await new Promise((resolve8) => {
+  await new Promise((resolve9) => {
     let left = toReplay.length;
-    if (left === 0) return resolve8();
+    if (left === 0) return resolve9();
     const settle = () => {
-      if (--left === 0) resolve8();
+      if (--left === 0) resolve9();
     };
     for (const p of toReplay) {
       void (async () => {
@@ -36716,7 +36786,7 @@ async function runFormalPhase(input) {
         if (!stoppedEarly) byId.set(p.id, r);
         if (r.verdict === "reproduced" && !stoppedEarly && !isCrash(p)) {
           stoppedEarly = true;
-          resolve8();
+          resolve9();
         }
       })().catch(() => {
         byId.set(p.id, null);
@@ -36760,7 +36830,7 @@ async function runFormalPhase(input) {
   return done({
     status: "checked",
     target,
-    model: { name: modelName, file: (0, import_node_path44.relative)(root, (0, import_node_path44.join)(root, modelFile)), rounds },
+    model: { name: modelName, file: (0, import_node_path46.relative)(root, (0, import_node_path46.join)(root, modelFile)), rounds },
     properties: report.properties,
     findings
   });
@@ -36823,7 +36893,7 @@ async function generateAndCheck(root, req, opts) {
     }
     const rel = `${dir}/${gen.name}.lean`;
     writeFileInRootNoFollow(root, rel, gen.source);
-    const abs = resolveModelFile(root, rel) ?? (0, import_node_path44.join)(root, rel);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path46.join)(root, rel);
     const report = await opts.deps.check(root, abs);
     const abstracts = report.header?.abstracts ?? [];
     const stray = abstracts.find((a) => !headerFiles.has(a.file)) ?? (abstracts[0] && abstracts[0].file !== req.file ? abstracts[0] : void 0);
@@ -36911,10 +36981,10 @@ function runFormalPhaseWithin(input) {
   if (left <= 0) return Promise.resolve(skippedOutcome("deadline", "no time left"));
   const progress = input.progress ?? {};
   let timer = null;
-  const cutoff = new Promise((resolve8) => {
+  const cutoff = new Promise((resolve9) => {
     timer = setTimeout(() => {
       progress.cancelled = true;
-      resolve8(cutOffOutcome(progress, `hard stop after ${Math.round(left / 1e3)} s during ${progress.step ?? "setup"}`, left));
+      resolve9(cutOffOutcome(progress, `hard stop after ${Math.round(left / 1e3)} s during ${progress.step ?? "setup"}`, left));
     }, left);
   });
   return Promise.race([runFormalPhase({ ...input, progress }), cutoff]).finally(() => {
@@ -36952,12 +37022,12 @@ var EXCERPT_SOURCE_MAX_BYTES = 2 * 1024 * 1024;
 var WRITERS_BUDGET_MS = 1500;
 var EXCERPT_MAX_LINES2 = 30;
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path45.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path47.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     try {
-      if (process.stdin.isTTY) return resolve8(empty);
+      if (process.stdin.isTTY) return resolve9(empty);
       const chunks = [];
       let timer;
       let settled = false;
@@ -36970,7 +37040,7 @@ function readPreToolUseStdin() {
         process.stdin.removeListener("end", onEnd);
         process.stdin.removeListener("error", onError);
         process.stdin.pause();
-        resolve8(value);
+        resolve9(value);
       };
       const onEnd = () => {
         try {
@@ -36991,7 +37061,7 @@ function readPreToolUseStdin() {
       process.stdin.on("error", onError);
       process.stdin.resume();
     } catch {
-      resolve8(empty);
+      resolve9(empty);
     }
   });
 }
@@ -37720,7 +37790,7 @@ function registerIgnoreCommand(program2) {
 }
 
 // src/commands/waive.ts
-var import_node_crypto19 = require("node:crypto");
+var import_node_crypto20 = require("node:crypto");
 var import_node_fs60 = require("node:fs");
 function registerWaiveCommand(program2) {
   program2.command("waive <pattern-id>").description("Record an accepted-risk disposition for an open finding (voids when the file changes)").option("--file <path>", "File the finding is anchored to, REPO-RELATIVE (recommended \u2014 narrows the waive)").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action(async (patternId, opts) => {
@@ -37750,7 +37820,7 @@ function registerWaiveCommand(program2) {
     if (opts.file) {
       body2.file = opts.file;
       try {
-        body2.file_sha256 = (0, import_node_crypto19.createHash)("sha256").update((0, import_node_fs60.readFileSync)(opts.file)).digest("hex");
+        body2.file_sha256 = (0, import_node_crypto20.createHash)("sha256").update((0, import_node_fs60.readFileSync)(opts.file)).digest("hex");
       } catch {
         printError(`Cannot read ${opts.file} \u2014 run from the repo root, or omit --file to waive by pattern.`);
         process.exit(1);
@@ -37778,7 +37848,7 @@ function registerWaiveCommand(program2) {
 var import_node_fs65 = require("node:fs");
 var import_promises20 = require("node:fs/promises");
 var import_yaml6 = __toESM2(require_dist());
-var import_node_path49 = require("node:path");
+var import_node_path51 = require("node:path");
 var import_node_child_process19 = require("node:child_process");
 
 // src/lib/banner.ts
@@ -37918,13 +37988,13 @@ function checkAnalysisCli() {
 }
 var INSTALL_TIMEOUT_MS = 12e4;
 function run3(command, args2, opts = {}) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const child = (0, import_node_child_process16.spawn)(command, args2, {
       stdio: opts.inherit ? "inherit" : "pipe",
       timeout: INSTALL_TIMEOUT_MS
     });
-    child.on("error", () => resolve8(false));
-    child.on("close", (code) => resolve8(code === 0));
+    child.on("error", () => resolve9(false));
+    child.on("close", (code) => resolve9(code === 0));
   });
 }
 async function installAnalysisCli() {
@@ -38229,7 +38299,7 @@ function registerDoctorCommand(program2) {
 
 // src/commands/migrate.ts
 var import_node_fs62 = require("node:fs");
-var import_node_path46 = require("node:path");
+var import_node_path48 = require("node:path");
 var import_node_child_process17 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
@@ -38266,8 +38336,8 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path46.join)(root, ".gate");
-  const verityDir = (0, import_node_path46.join)(root, ".verity");
+  const gateDir = (0, import_node_path48.join)(root, ".gate");
+  const verityDir = (0, import_node_path48.join)(root, ".verity");
   if ((0, import_node_fs62.existsSync)(gateDir) && !(0, import_node_fs62.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
@@ -38321,11 +38391,11 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path46.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path46.join)(home, ".verity", "credentials");
+  const gateCreds = (0, import_node_path48.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path48.join)(home, ".verity", "credentials");
   if (!(0, import_node_fs62.existsSync)(gateCreds)) return;
   if (!(0, import_node_fs62.existsSync)(verityCreds)) {
-    (0, import_node_fs62.mkdirSync)((0, import_node_path46.join)(home, ".verity"), { recursive: true });
+    (0, import_node_fs62.mkdirSync)((0, import_node_path48.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -38347,7 +38417,7 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path46.join)(root, "CLAUDE.md");
+  const claudeMd = (0, import_node_path48.join)(root, "CLAUDE.md");
   const hadLegacyBlock = (0, import_node_fs62.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
@@ -38358,8 +38428,8 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path46.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path46.join)(root, "VERITY.md");
+  const gateMd = (0, import_node_path48.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path48.join)(root, "VERITY.md");
   if (!(0, import_node_fs62.existsSync)(gateMd) || (0, import_node_fs62.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
@@ -38376,7 +38446,7 @@ function migrateStandardFile(root, actions) {
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateTelemetryHeaders(root, actions) {
-  const file = (0, import_node_path46.join)(root, ".claude", "settings.local.json");
+  const file = (0, import_node_path48.join)(root, ".claude", "settings.local.json");
   if (!(0, import_node_fs62.existsSync)(file)) return;
   let settings;
   try {
@@ -38466,15 +38536,15 @@ function moveFile(from, to) {
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk2 = (relDir) => {
-    const srcDir = (0, import_node_path46.join)(gateDir, relDir);
+    const srcDir = (0, import_node_path48.join)(gateDir, relDir);
     for (const entry of (0, import_node_fs62.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path46.join)(relDir, entry) : entry;
-      const src = (0, import_node_path46.join)(gateDir, rel);
-      const dest = (0, import_node_path46.join)(verityDir, rel);
+      const rel = relDir ? (0, import_node_path48.join)(relDir, entry) : entry;
+      const src = (0, import_node_path48.join)(gateDir, rel);
+      const dest = (0, import_node_path48.join)(verityDir, rel);
       if ((0, import_node_fs62.statSync)(src).isDirectory()) {
         walk2(rel);
       } else if (!(0, import_node_fs62.existsSync)(dest)) {
-        (0, import_node_fs62.mkdirSync)((0, import_node_path46.dirname)(dest), { recursive: true });
+        (0, import_node_fs62.mkdirSync)((0, import_node_path48.dirname)(dest), { recursive: true });
         (0, import_node_fs62.cpSync)(src, dest);
         copied++;
       }
@@ -38484,22 +38554,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path46.join)(root, ".gate");
-  const verityDir = (0, import_node_path46.join)(root, ".verity");
+  const gateDir = (0, import_node_path48.join)(root, ".gate");
+  const verityDir = (0, import_node_path48.join)(root, ".verity");
   if ((0, import_node_fs62.existsSync)(gateDir) && !(0, import_node_fs62.existsSync)(verityDir)) return true;
   if ((0, import_node_fs62.existsSync)(gateDir) && (0, import_node_fs62.existsSync)(verityDir)) {
-    if ((0, import_node_fs62.existsSync)((0, import_node_path46.join)(gateDir, "credentials")) && !(0, import_node_fs62.existsSync)((0, import_node_path46.join)(verityDir, "credentials"))) {
+    if ((0, import_node_fs62.existsSync)((0, import_node_path48.join)(gateDir, "credentials")) && !(0, import_node_fs62.existsSync)((0, import_node_path48.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs62.existsSync)((0, import_node_path46.join)(gateDir, "memory")) && !(0, import_node_fs62.existsSync)((0, import_node_path46.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs62.existsSync)((0, import_node_path48.join)(gateDir, "memory")) && !(0, import_node_fs62.existsSync)((0, import_node_path48.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path46.join)(root, "CLAUDE.md");
+  const claudeMd = (0, import_node_path48.join)(root, "CLAUDE.md");
   if ((0, import_node_fs62.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs62.existsSync)((0, import_node_path46.join)(root, "GATE.md")) && !(0, import_node_fs62.existsSync)((0, import_node_path46.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs62.existsSync)((0, import_node_path48.join)(root, "GATE.md")) && !(0, import_node_fs62.existsSync)((0, import_node_path48.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -38628,7 +38698,7 @@ function runSelect(opts) {
     cursor: initialIdx[0] ?? 0,
     chosen: new Set(mode2 === "single" ? [initialIdx[0] ?? 0] : initialIdx)
   };
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let painted = 0;
     let settled = false;
     const draw = () => {
@@ -38676,7 +38746,7 @@ function runSelect(opts) {
       if (settled) return;
       settled = true;
       restore();
-      resolve8(value);
+      resolve9(value);
     };
     readline2.emitKeypressEvents(input);
     input.setRawMode(true);
@@ -38697,9 +38767,9 @@ async function askLine(question, io = {}) {
     output: io.output ?? process.stdout
   });
   try {
-    return await new Promise((resolve8) => {
-      rl.question(question).then((a) => resolve8(a.trim())).catch(() => resolve8(null));
-      rl.once("close", () => setImmediate(() => resolve8(null)));
+    return await new Promise((resolve9) => {
+      rl.question(question).then((a) => resolve9(a.trim())).catch(() => resolve9(null));
+      rl.once("close", () => setImmediate(() => resolve9(null)));
     });
   } finally {
     rl.close();
@@ -38781,10 +38851,10 @@ async function promptMultiSelect(question, choices, fallback) {
 
 // src/lib/prove/lean-install.ts
 var import_node_fs63 = require("node:fs");
-var import_node_crypto20 = require("node:crypto");
+var import_node_crypto21 = require("node:crypto");
 var import_node_child_process18 = require("node:child_process");
 var import_node_os10 = require("node:os");
-var import_node_path47 = require("node:path");
+var import_node_path49 = require("node:path");
 var import_promises18 = require("node:stream/promises");
 var import_node_stream = require("node:stream");
 var RELEASES = "https://releases.lean-lang.org/lean4";
@@ -38798,7 +38868,7 @@ function freeBytes(dir) {
       const st = (0, import_node_fs63.statfsSync)(d);
       return Number(st.bavail) * Number(st.bsize);
     } catch {
-      const up = (0, import_node_path47.join)(d, "..");
+      const up = (0, import_node_path49.join)(d, "..");
       if (up === d) return null;
       d = up;
     }
@@ -38818,9 +38888,9 @@ function expectedSha256(asset, version = pinnedVersion()) {
   return LEAN_ASSET_SHA256[version]?.[asset] ?? null;
 }
 function sha256File(path) {
-  return new Promise((resolve8, reject) => {
-    const hash = (0, import_node_crypto20.createHash)("sha256");
-    (0, import_node_fs63.createReadStream)(path).on("data", (chunk) => hash.update(chunk)).on("end", () => resolve8(hash.digest("hex"))).on("error", reject);
+  return new Promise((resolve9, reject) => {
+    const hash = (0, import_node_crypto21.createHash)("sha256");
+    (0, import_node_fs63.createReadStream)(path).on("data", (chunk) => hash.update(chunk)).on("end", () => resolve9(hash.digest("hex"))).on("error", reject);
   });
 }
 async function verifyDownload(zip, asset, version = pinnedVersion()) {
@@ -38840,7 +38910,7 @@ function leanAssetName(version = pinnedVersion()) {
   return suffix ? `lean-${v}-${suffix}.zip` : null;
 }
 function pinnedVersionDir(env = process.env) {
-  return (0, import_node_path47.join)(verityLeanHome(env), pinnedVersion());
+  return (0, import_node_path49.join)(verityLeanHome(env), pinnedVersion());
 }
 function lakeBinary() {
   return (0, import_node_os10.platform)() === "win32" ? "lake.exe" : "lake";
@@ -38856,7 +38926,7 @@ function unzip(zip, dest) {
     } catch (err2) {
       errors.push(`${cmd}: ${String(err2.message).split("\n")[0].slice(0, 120)}`);
       try {
-        for (const e of (0, import_node_fs63.readdirSync)(dest)) (0, import_node_fs63.rmSync)((0, import_node_path47.join)(dest, e), { recursive: true, force: true });
+        for (const e of (0, import_node_fs63.readdirSync)(dest)) (0, import_node_fs63.rmSync)((0, import_node_path49.join)(dest, e), { recursive: true, force: true });
       } catch {
       }
     }
@@ -38932,10 +39002,10 @@ async function installLean(opts = {}) {
     const gb = (n) => (n / 1024 ** 3).toFixed(1);
     return { ok: false, error: `not enough disk space for Lean: ${gb(free)} GB free where ${home} lives, needs about ${gb(needed)} GB` };
   }
-  const tmp = (0, import_node_path47.join)(home, ".tmp");
+  const tmp = (0, import_node_path49.join)(home, ".tmp");
   (0, import_node_fs63.rmSync)(tmp, { recursive: true, force: true });
   (0, import_node_fs63.mkdirSync)(tmp, { recursive: true });
-  const zip = (0, import_node_path47.join)(tmp, asset);
+  const zip = (0, import_node_path49.join)(tmp, asset);
   say(`downloading ${url}`);
   let lastPct = -1;
   try {
@@ -38958,7 +39028,7 @@ async function installLean(opts = {}) {
     return { ok: false, error: verified.error };
   }
   say("unpacking (this takes a minute)");
-  const unpack = (0, import_node_path47.join)(tmp, "unpack");
+  const unpack = (0, import_node_path49.join)(tmp, "unpack");
   (0, import_node_fs63.mkdirSync)(unpack);
   const unpacked = unzip(zip, unpack);
   if (!unpacked.ok) {
@@ -38966,8 +39036,8 @@ async function installLean(opts = {}) {
     return { ok: false, error: `unpack failed: ${unpacked.error}` };
   }
   const entries = (0, import_node_fs63.readdirSync)(unpack);
-  const top = entries.length === 1 && (0, import_node_fs63.statSync)((0, import_node_path47.join)(unpack, entries[0])).isDirectory() ? (0, import_node_path47.join)(unpack, entries[0]) : unpack;
-  if (!(0, import_node_fs63.existsSync)((0, import_node_path47.join)(top, "bin", lakeBinary()))) {
+  const top = entries.length === 1 && (0, import_node_fs63.statSync)((0, import_node_path49.join)(unpack, entries[0])).isDirectory() ? (0, import_node_path49.join)(unpack, entries[0]) : unpack;
+  if (!(0, import_node_fs63.existsSync)((0, import_node_path49.join)(top, "bin", lakeBinary()))) {
     (0, import_node_fs63.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: "the archive did not contain bin/lake" };
   }
@@ -38981,7 +39051,7 @@ async function installLean(opts = {}) {
 // src/lib/remote-config.ts
 var import_node_fs64 = require("node:fs");
 var import_promises19 = require("node:fs/promises");
-var import_node_path48 = require("node:path");
+var import_node_path50 = require("node:path");
 var import_yaml5 = __toESM2(require_dist());
 var IGNORE_RIDER = "verityignore";
 async function fetchRemoteSetup(opts) {
@@ -39059,7 +39129,7 @@ async function adoptRemoteSetup(found, opts) {
 }
 async function writeOut(relative6, body2) {
   const target = projectPath(relative6);
-  await (0, import_promises19.mkdir)((0, import_node_path48.dirname)(target), { recursive: true });
+  await (0, import_promises19.mkdir)((0, import_node_path50.dirname)(target), { recursive: true });
   await (0, import_promises19.writeFile)(target, body2);
 }
 function describeRemote(found) {
@@ -39176,15 +39246,15 @@ async function runOptionalAuth(resolution, opts = {}) {
 }
 function resolveDataDir2() {
   const candidates2 = [
-    (0, import_node_path49.join)(__dirname, "..", "data"),
+    (0, import_node_path51.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path49.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path51.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path49.join)(process.cwd(), "cli", "data")
+    (0, import_node_path51.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs65.existsSync)((0, import_node_path49.join)(candidate, "skills"))) {
+    if ((0, import_node_fs65.existsSync)((0, import_node_path51.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -39202,7 +39272,7 @@ async function skillIsCurrent(src, dest) {
     const walk2 = (d, prefix) => {
       for (const e of (0, import_node_fs65.readdirSync)(d, { withFileTypes: true })) {
         const rel = prefix ? `${prefix}/${e.name}` : e.name;
-        if (e.isDirectory()) walk2((0, import_node_path49.join)(d, e.name), rel);
+        if (e.isDirectory()) walk2((0, import_node_path51.join)(d, e.name), rel);
         else if (e.isFile()) out2.push(rel);
       }
     };
@@ -39213,8 +39283,8 @@ async function skillIsCurrent(src, dest) {
     const shipped = list2(src);
     if (JSON.stringify(shipped) !== JSON.stringify(list2(dest))) return false;
     for (const rel of shipped) {
-      const a = await (0, import_promises20.readFile)((0, import_node_path49.join)(src, rel), "utf-8");
-      const b = await (0, import_promises20.readFile)((0, import_node_path49.join)(dest, rel), "utf-8");
+      const a = await (0, import_promises20.readFile)((0, import_node_path51.join)(src, rel), "utf-8");
+      const b = await (0, import_promises20.readFile)((0, import_node_path51.join)(dest, rel), "utf-8");
       if (a !== b) return false;
     }
     return true;
@@ -39514,12 +39584,12 @@ async function handoffToSetup(enabled, claudeInstalled) {
 async function installSkills(force, step) {
   step("Installing skills");
   const dataDir = resolveDataDir2();
-  const skillsSource = (0, import_node_path49.join)(dataDir, "skills");
+  const skillsSource = (0, import_node_path51.join)(dataDir, "skills");
   const skillsDest = ".claude/skills";
   let skillsInstalled = 0;
   for (const skill of SKILLS) {
-    const src = (0, import_node_path49.join)(skillsSource, skill);
-    const dest = (0, import_node_path49.join)(skillsDest, skill);
+    const src = (0, import_node_path51.join)(skillsSource, skill);
+    const dest = (0, import_node_path51.join)(skillsDest, skill);
     if (!(0, import_node_fs65.existsSync)(src)) {
       printWarn(`  Skill data not found: ${skill}`);
       continue;
@@ -39827,7 +39897,7 @@ function registerInitCommand(program2) {
       untrackMemory: opts.untrackMemory === true,
       untrackState: opts.untrackState === true
     });
-    const globalVerityDir = (0, import_node_path49.join)(process.env.HOME ?? "", ".verity");
+    const globalVerityDir = (0, import_node_path51.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises20.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
     step("Wiring Claude Code hooks");
@@ -39932,7 +40002,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.34.0-experimental.37a6dcf" : "dev"
+          cli_version: true ? "0.34.0-experimental.3d4888f" : "dev"
         }
       });
     } catch (err2) {
@@ -39983,7 +40053,7 @@ function registerInitCommand(program2) {
 
 // src/commands/uninstall.ts
 var import_node_fs66 = require("node:fs");
-var import_node_path50 = require("node:path");
+var import_node_path52 = require("node:path");
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("Remove Verity from this project (skills, hooks, .verity/, VERITY.md)").option("--dry-run", "Show what would be removed without doing it").option("--purge-global", "Also remove ~/.verity/ (deletes saved tokens \u2014 reconnect requires re-registration)").option("--keep-verity-md", "Keep the project root VERITY.md file").action(async (opts) => {
     const dryRun = opts.dryRun ?? false;
@@ -39992,7 +40062,7 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name2 of PROJECT_SKILL_NAMES) {
-      const dir = (0, import_node_path50.join)(skillsRoot, name2);
+      const dir = (0, import_node_path52.join)(skillsRoot, name2);
       if ((0, import_node_fs66.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name2}/`,
@@ -40038,7 +40108,7 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path50.join)(home, ".verity");
+    const globalVerityDir = (0, import_node_path52.join)(home, ".verity");
     if (purgeGlobal && (0, import_node_fs66.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
@@ -40237,7 +40307,7 @@ function registerTaskCommands(program2) {
 
 // src/commands/reset.ts
 var import_node_fs67 = require("node:fs");
-var import_node_path51 = require("node:path");
+var import_node_path53 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -40278,7 +40348,7 @@ function registerResetCommand(program2) {
       for (const entry of (0, import_node_fs67.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs67.unlinkSync)((0, import_node_path51.join)(cacheDir, entry));
+            (0, import_node_fs67.unlinkSync)((0, import_node_path53.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -40305,7 +40375,7 @@ function registerResetCommand(program2) {
       if ((0, import_node_fs67.existsSync)(logsDir)) {
         for (const entry of (0, import_node_fs67.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs67.unlinkSync)((0, import_node_path51.join)(logsDir, entry));
+            (0, import_node_fs67.unlinkSync)((0, import_node_path53.join)(logsDir, entry));
           } catch {
           }
         }
@@ -40325,7 +40395,7 @@ var PATH_TOKEN = /[A-Za-z0-9_./-]*[A-Za-z0-9_-]\.[A-Za-z0-9]{1,8}(?::\d+(?::\d+)
 function clean(token) {
   return token.replace(/:\d+(?::\d+)?$/, "").replace(/^[`'"(\[]+/, "").replace(/[`'"),\].;!?]+$/, "").replace(/^\.\//, "");
 }
-function resolve6(token, treePaths) {
+function resolve7(token, treePaths) {
   if (treePaths.includes(token)) return token;
   const suffix = token.startsWith("/") ? token : `/${token}`;
   const matches = treePaths.filter((p) => p.endsWith(suffix));
@@ -40338,7 +40408,7 @@ function deriveFileGlobs(text, treePaths) {
   for (const raw of text.match(PATH_TOKEN) ?? []) {
     const token = clean(raw);
     if (!token) continue;
-    const path = resolve6(token, treePaths);
+    const path = resolve7(token, treePaths);
     if (!path || seen.has(path)) continue;
     seen.add(path);
     out2.push(path);
@@ -40867,7 +40937,7 @@ function registerTelemetryCommands(program2) {
 
 // src/commands/prove.ts
 var import_node_fs70 = require("node:fs");
-var import_node_path52 = require("node:path");
+var import_node_path54 = require("node:path");
 
 // src/lib/prove/hint-pool.ts
 var STOP2 = /* @__PURE__ */ new Set([
@@ -41003,7 +41073,7 @@ function registerProveCommand(program2) {
       process.exit(2);
     }
     const limit = Math.max(1, Math.min(50, Number(opts.limit) || 10));
-    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path52.relative)(root, (0, import_node_path52.resolve)(p)) || ".") });
+    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path54.relative)(root, (0, import_node_path54.resolve)(p)) || ".") });
     if (opts.hint && paths.length === 0) {
       const hit = hintMatches(root, opts.hint);
       if (hit.files.length > 0) {
@@ -41057,7 +41127,7 @@ function registerProveCommand(program2) {
   });
   prove.command("check [model]").description("Elaborate a model (or every model) with the local Lean toolchain and report each property").option("--timeout <ms>", "Per-model timeout in ms", "120000").option("--json", "Machine-readable output").action((model, opts) => {
     const root = repoRoot();
-    if (!(0, import_node_fs70.existsSync)((0, import_node_path52.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs70.existsSync)((0, import_node_path54.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -41081,7 +41151,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
     const reports = [];
     for (const f of files) {
       const report = checkModel(tc, root, f, { timeoutMs: Math.max(1e3, Number(opts.timeout) || 12e4) });
-      report.file = (0, import_node_path52.relative)(root, f);
+      report.file = (0, import_node_path54.relative)(root, f);
       reports.push(report);
       try {
         writeResult(root, report);
@@ -41119,7 +41189,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
       printError("Not logged in \u2014 replays run on the Verity service. Run `verity login` first.");
       process.exit(2);
     }
-    if (!(0, import_node_fs70.existsSync)((0, import_node_path52.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs70.existsSync)((0, import_node_path54.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -41150,7 +41220,7 @@ ${report.error ?? ""}`);
       printInfo(opts.property ? `${model} ${opts.property} has no counterexample to replay` : `${model} has no counterexample to replay`);
       return;
     }
-    const modelSource = readRegularFileInRoot(root, (0, import_node_path52.relative)(root, file), 512 * 1024);
+    const modelSource = readRegularFileInRoot(root, (0, import_node_path54.relative)(root, file), 512 * 1024);
     if (!opts.json) printInfo(`replaying ${targets.length} counterexample(s) of ${model} in network-less containers (${Math.min(targets.length, REPLAY_CONCURRENCY)} at a time)\u2026`);
     const outcomes = await mapPool(targets, REPLAY_CONCURRENCY, async (p) => {
       const brief = buildReplayBrief(root, report, p, modelSource.ok ? modelSource.content : "");
@@ -41170,7 +41240,7 @@ ${report.error ?? ""}`);
   });
   prove.command("auto [files...]").description("The formal phase the pre-push guard runs: select one risky symbol among changed files, generate a model, check it, replay counterexamples (default files: the commits ahead of upstream)").option("--deadline <ms>", "Budget for the whole phase", "170000").option("--json", "Machine-readable output").action(async (paths, opts) => {
     const root = repoRoot();
-    let files = paths.map((p) => (0, import_node_path52.relative)(root, (0, import_node_path52.resolve)(p)));
+    let files = paths.map((p) => (0, import_node_path54.relative)(root, (0, import_node_path54.resolve)(p)));
     if (files.length === 0) {
       const ahead = runGitSync(root, ["diff", "--name-only", "@{upstream}...HEAD"]);
       const fallback = ahead.ok ? ahead : runGitSync(root, ["diff", "--name-only", "HEAD~1..HEAD"]);
@@ -41230,7 +41300,7 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
     let revise;
     if (opts.revise) {
       const existing = resolveModelFile(root, opts.revise);
-      const src = existing ? readRegularFileInRoot(root, (0, import_node_path52.relative)(root, existing), 64 * 1024) : null;
+      const src = existing ? readRegularFileInRoot(root, (0, import_node_path54.relative)(root, existing), 64 * 1024) : null;
       if (!src || !src.ok || !opts.note) {
         printError('--revise needs an existing model under Models/ and --note "<what the replay showed>"');
         process.exit(2);
@@ -41269,8 +41339,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("waive <file>").description("Dismiss the remembered formal finding(s) on a file for its current bytes \u2014 the accepted-risk path for a formal block").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action((file, opts) => {
     const root = repoRoot();
-    const rel0 = (0, import_node_path52.relative)(root, (0, import_node_path52.isAbsolute)(file) ? file : (0, import_node_path52.join)(root, file)).replace(/\\/g, "/");
-    const rel = rel0.startsWith("..") || (0, import_node_path52.isAbsolute)(rel0) ? null : rel0;
+    const rel0 = (0, import_node_path54.relative)(root, (0, import_node_path54.isAbsolute)(file) ? file : (0, import_node_path54.join)(root, file)).replace(/\\/g, "/");
+    const rel = rel0.startsWith("..") || (0, import_node_path54.isAbsolute)(rel0) ? null : rel0;
     if (!rel) {
       printError(`${file} is not inside this repository`);
       process.exit(2);
@@ -41286,8 +41356,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("hash <file>").description("Print the sha256 of a file, for a model header (Verity.model \u2026 sha256). Path is REPO-relative, as in the header").action((file) => {
     const root = repoRoot();
-    const rel = (0, import_node_path52.relative)(root, (0, import_node_path52.isAbsolute)(file) ? file : (0, import_node_path52.join)(root, file));
-    const digest = rel.startsWith("..") || (0, import_node_path52.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
+    const rel = (0, import_node_path54.relative)(root, (0, import_node_path54.isAbsolute)(file) ? file : (0, import_node_path54.join)(root, file));
+    const digest = rel.startsWith("..") || (0, import_node_path54.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
     if (!digest) {
       printError(`Cannot hash ${file}: it must be a regular file inside this repository (not a symlink)`);
       process.exit(2);
@@ -41324,7 +41394,7 @@ function refreshScaffold(root) {
 var import_node_fs71 = require("node:fs");
 var import_node_child_process20 = require("node:child_process");
 var import_node_os11 = require("node:os");
-var import_node_path53 = require("node:path");
+var import_node_path55 = require("node:path");
 function registerLeanCommand(program2) {
   const lean = program2.command("lean").description("The Lean 4 toolchain formal verification needs (managed download, pinned by this CLI)");
   lean.command("status").option("--json", "Machine-readable output").description("Which toolchain would run, and whether it matches the pinned version").action((opts) => {
@@ -41341,7 +41411,7 @@ function registerLeanCommand(program2) {
     const managed = pinnedVersionDir();
     const matches = version ? version.includes(pin) : false;
     if (opts.json) {
-      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs71.existsSync)((0, import_node_path53.join)(managed, "bin")), asset: leanAssetName() });
+      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs71.existsSync)((0, import_node_path55.join)(managed, "bin")), asset: leanAssetName() });
       return;
     }
     printInfo(`pinned: ${LEAN_TOOLCHAIN}`);
@@ -41359,7 +41429,7 @@ function registerLeanCommand(program2) {
       process.exit(2);
     }
     const dir = pinnedVersionDir();
-    if ((0, import_node_fs71.existsSync)((0, import_node_path53.join)(dir, "bin", "lake")) && !opts.force) {
+    if ((0, import_node_fs71.existsSync)((0, import_node_path55.join)(dir, "bin", "lake")) && !opts.force) {
       printInfo(`already installed at ${dir}`);
       return;
     }
@@ -41405,8 +41475,8 @@ function registerLeanCommand(program2) {
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.34.0-experimental.37a6dcf").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.0-experimental.37a6dcf");
+program.name("verity").description("CLI for Verity quality gate service").version("0.34.0-experimental.3d4888f").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.0-experimental.3d4888f");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();