@codacy/verity-cli 0.34.0-experimental.421a631 → 0.34.0-experimental.53caba1

package/bin/verity.js

@@ -10435,13 +10435,13 @@ var require_web_tree_sitter2 = __commonJS2({
                 }
                 readAsync = /* @__PURE__ */ __name(async (url) => {
                   if (isFileURI(url)) {
-                    return new Promise((resolve8, reject) => {
+                    return new Promise((resolve9, reject) => {
                       var xhr = new XMLHttpRequest();
                       xhr.open("GET", url, true);
                       xhr.responseType = "arraybuffer";
                       xhr.onload = () => {
                         if (xhr.status == 200 || xhr.status == 0 && xhr.response) {
-                          resolve8(xhr.response);
+                          resolve9(xhr.response);
                           return;
                         }
                         reject(xhr.status);
@@ -10634,9 +10634,9 @@ var require_web_tree_sitter2 = __commonJS2({
               __name(receiveInstantiationResult, "receiveInstantiationResult");
               var info2 = getWasmImports();
               if (Module["instantiateWasm"]) {
-                return new Promise((resolve8, reject) => {
+                return new Promise((resolve9, reject) => {
                   Module["instantiateWasm"](info2, (mod, inst) => {
-                    resolve8(receiveInstance(mod, inst));
+                    resolve9(receiveInstance(mod, inst));
                   });
                 });
               }
@@ -11969,8 +11969,8 @@ var require_web_tree_sitter2 = __commonJS2({
             if (runtimeInitialized) {
               moduleRtn = Module;
             } else {
-              moduleRtn = new Promise((resolve8, reject) => {
-                readyPromiseResolve = resolve8;
+              moduleRtn = new Promise((resolve9, reject) => {
+                readyPromiseResolve = resolve9;
                 readyPromiseReject = reject;
               });
             }
@@ -14447,8 +14447,87 @@ var import_node_child_process4 = require("node:child_process");
 
 // src/constants.ts
 var import_node_child_process = require("node:child_process");
+var import_node_fs2 = require("node:fs");
+var import_node_path2 = require("node:path");
+
+// src/lib/context-identity.ts
+var import_node_crypto = require("node:crypto");
 var import_node_fs = require("node:fs");
+var import_node_os = require("node:os");
 var import_node_path = require("node:path");
+var SHARED_SENTINELS = /* @__PURE__ */ new Set([
+  "",
+  "-",
+  "n/a",
+  "na",
+  "none",
+  "null",
+  "undefined",
+  "unknown",
+  "anon",
+  "anonymous",
+  "default",
+  "_default"
+]);
+function isSharedSentinel(value) {
+  if (value == null) return true;
+  return SHARED_SENTINELS.has(value.trim().toLowerCase());
+}
+var ephemeral = /* @__PURE__ */ new Map();
+function ephemeralId(slot, width) {
+  let id = ephemeral.get(slot);
+  if (!id) {
+    id = `eph-${(0, import_node_crypto.randomBytes)(Math.ceil(width / 2)).toString("hex").slice(0, width - 4)}`;
+    ephemeral.set(slot, id);
+  }
+  return id;
+}
+function contextIdentity(input) {
+  const tokenUsable = !isSharedSentinel(input.token ?? null);
+  const sessionUsable = !isSharedSentinel(input.sessionId ?? null);
+  const userKey = tokenUsable ? (0, import_node_crypto.createHash)("sha256").update(String(input.token)).digest("hex").slice(0, 12) : ephemeralId("user", 12);
+  const sessionKey2 = sessionUsable ? (0, import_node_crypto.createHash)("sha256").update(String(input.sessionId)).digest("hex").slice(0, 16) : ephemeralId("session", 16);
+  let treeKey = "no-tree";
+  const rawTree = input.treeRoot;
+  if (rawTree && !isSharedSentinel(rawTree)) {
+    let resolved = rawTree;
+    try {
+      resolved = import_node_fs.realpathSync.native(rawTree);
+    } catch {
+    }
+    treeKey = (0, import_node_crypto.createHash)("sha256").update(resolved).digest("hex").slice(0, 12);
+  }
+  return {
+    userKey,
+    treeKey,
+    sessionKey: sessionKey2,
+    userKeySource: tokenUsable ? "token" : "ephemeral",
+    sessionKeySource: sessionUsable ? "session_id" : "ephemeral",
+    ephemeral: !tokenUsable || !sessionUsable
+  };
+}
+function verityHome() {
+  const override = process.env.VERITY_HOME;
+  return override && override.trim() ? (0, import_node_path.resolve)(override) : (0, import_node_path.join)((0, import_node_os.homedir)(), ".verity");
+}
+function dossierDir(identity) {
+  return (0, import_node_path.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
+}
+function treeDir(identity) {
+  return (0, import_node_path.join)(verityHome(), "sessions", identity.userKey, identity.treeKey);
+}
+function scopeIdentity(token, sessionId) {
+  const t = (token ?? "").trim();
+  const s = (sessionId ?? "").trim();
+  const userKey = t.length > 0 ? (0, import_node_crypto.createHash)("sha256").update(t).digest("hex").slice(0, 12) : "anon";
+  const sessionKey2 = s.length > 0 ? (0, import_node_crypto.createHash)("sha256").update(s).digest("hex").slice(0, 16) : "_default";
+  return { userKey, sessionKey: sessionKey2, bucket: `${userKey}/${sessionKey2}` };
+}
+function sessionScopeKey(token, sessionId) {
+  return scopeIdentity(token, sessionId).bucket;
+}
+
+// src/constants.ts
 var _repoRoot = null;
 function repoRoot() {
   if (_repoRoot === null) {
@@ -14476,17 +14555,36 @@ function mainWorktreeRoot() {
       _mainRoot = null;
       return _mainRoot;
     }
-    const abs = common.startsWith("/") ? common : (0, import_node_path.join)(repoRoot(), common);
-    _mainRoot = (0, import_node_path.dirname)(abs);
+    const abs = common.startsWith("/") ? common : (0, import_node_path2.join)(repoRoot(), common);
+    _mainRoot = (0, import_node_path2.dirname)(abs);
   } catch {
     _mainRoot = null;
   }
   return _mainRoot;
 }
 function verityConfigured() {
-  if ((0, import_node_fs.existsSync)((0, import_node_path.join)(repoRoot(), VERITY_DIR))) return true;
+  if (isProjectVerityDir((0, import_node_path2.join)(repoRoot(), VERITY_DIR))) return true;
   const main = mainWorktreeRoot();
-  return !!main && (0, import_node_fs.existsSync)((0, import_node_path.join)(main, VERITY_DIR));
+  return !!main && isProjectVerityDir((0, import_node_path2.join)(main, VERITY_DIR));
+}
+function isProjectVerityDir(dir) {
+  return (0, import_node_fs2.existsSync)(dir) && !isMachineStore(dir);
+}
+function isMachineStore(dir) {
+  const here = canonicalPath(dir);
+  const stores = [process.env.HOME ? (0, import_node_path2.join)(process.env.HOME, VERITY_DIR) : null, verityHome()];
+  return stores.some((s) => s !== null && canonicalPath(s) === here);
+}
+function canonicalPath(p) {
+  try {
+    return import_node_fs2.realpathSync.native(p);
+  } catch {
+  }
+  try {
+    return (0, import_node_path2.join)(import_node_fs2.realpathSync.native((0, import_node_path2.dirname)(p)), (0, import_node_path2.basename)(p));
+  } catch {
+    return (0, import_node_path2.resolve)(p);
+  }
 }
 var VERITY_DIR = ".verity";
 var CREDENTIALS_FILE = `${VERITY_DIR}/credentials`;
@@ -14507,7 +14605,7 @@ var MEMORY_DIR = `${VERITY_DIR}/memory`;
 var CODACY_CONFIG_FILE = ".codacy/codacy.config.json";
 var VERITYIGNORE_FILE = ".verityignore";
 function projectPath(relativePath) {
-  return (0, import_node_path.join)(repoRoot(), relativePath);
+  return (0, import_node_path2.join)(repoRoot(), relativePath);
 }
 var MAX_DELTA_BYTES = 194560;
 var MAX_FILES = 40;
@@ -14681,7 +14779,7 @@ function printVerbose(msg, verbose) {
 }
 
 // src/lib/debug-log.ts
-var import_node_fs2 = require("node:fs");
+var import_node_fs3 = require("node:fs");
 function isDebugEnabled() {
   const v = process.env.VERITY_DEBUG;
   if (v === "0" || v === "false" || v === "off") return false;
@@ -14699,24 +14797,24 @@ function writeLine(obj) {
   try {
     const dir = projectPath(DEBUG_LOG_DIR);
     const file = projectPath(DEBUG_LOG_FILE);
-    (0, import_node_fs2.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs3.mkdirSync)(dir, { recursive: true });
     rotateIfNeeded(file);
-    (0, import_node_fs2.appendFileSync)(file, JSON.stringify(obj) + "\n");
+    (0, import_node_fs3.appendFileSync)(file, JSON.stringify(obj) + "\n");
   } catch {
   }
 }
 function rotateIfNeeded(file) {
   try {
-    const s = (0, import_node_fs2.statSync)(file);
+    const s = (0, import_node_fs3.statSync)(file);
     if (s.size < DEBUG_LOG_MAX_BYTES) return;
-    (0, import_node_fs2.renameSync)(file, `${file}.1`);
+    (0, import_node_fs3.renameSync)(file, `${file}.1`);
   } catch {
   }
 }
 
 // src/lib/credentials.ts
 var import_promises = require("node:fs/promises");
-var import_node_path2 = require("node:path");
+var import_node_path3 = require("node:path");
 var import_node_child_process2 = require("node:child_process");
 function globalCredentialsPath() {
   return `${process.env.HOME}/.verity/credentials`;
@@ -14791,7 +14889,7 @@ async function readGlobalCredential(remote) {
 }
 async function upsertGlobalCredential(remote, rec) {
   const path = globalCredentialsPath();
-  await (0, import_promises.mkdir)((0, import_node_path2.dirname)(path), { recursive: true });
+  await (0, import_promises.mkdir)((0, import_node_path3.dirname)(path), { recursive: true });
   let content = "";
   try {
     content = await (0, import_promises.readFile)(path, "utf-8");
@@ -14935,10 +15033,10 @@ async function foldLegacyLocalCredential(remoteArg) {
 
 // src/lib/git.ts
 var import_node_child_process3 = require("node:child_process");
-var import_node_fs3 = require("node:fs");
-var import_node_path3 = require("node:path");
+var import_node_fs4 = require("node:fs");
+var import_node_path4 = require("node:path");
 function resolveFile(relpath) {
-  return (0, import_node_fs3.existsSync)(relpath) ? relpath : null;
+  return (0, import_node_fs4.existsSync)(relpath) ? relpath : null;
 }
 function execGit(cmd) {
   try {
@@ -14956,7 +15054,7 @@ function readBaselineSha() {
   if (sha === null) return null;
   if (!commitResolves(sha)) {
     try {
-      (0, import_node_fs3.unlinkSync)(BASELINE_SHA_FILE);
+      (0, import_node_fs4.unlinkSync)(BASELINE_SHA_FILE);
     } catch {
     }
     return null;
@@ -14964,10 +15062,10 @@ function readBaselineSha() {
   return sha;
 }
 function readRawBaselineSha() {
-  if (!(0, import_node_fs3.existsSync)(BASELINE_SHA_FILE)) return null;
+  if (!(0, import_node_fs4.existsSync)(BASELINE_SHA_FILE)) return null;
   let sha;
   try {
-    sha = (0, import_node_fs3.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
+    sha = (0, import_node_fs4.readFileSync)(BASELINE_SHA_FILE, "utf-8").trim();
   } catch {
     return null;
   }
@@ -14976,8 +15074,8 @@ function readRawBaselineSha() {
 function writeBaselineSha(sha) {
   if (!SHA_RE.test(sha)) return;
   try {
-    (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(BASELINE_SHA_FILE), { recursive: true });
-    (0, import_node_fs3.writeFileSync)(BASELINE_SHA_FILE, sha);
+    (0, import_node_fs4.mkdirSync)((0, import_node_path4.dirname)(BASELINE_SHA_FILE), { recursive: true });
+    (0, import_node_fs4.writeFileSync)(BASELINE_SHA_FILE, sha);
   } catch {
   }
 }
@@ -15065,17 +15163,17 @@ function showContentAtRef(ref, repoRelPath) {
 }
 function filterAnalyzable(files) {
   return files.filter((f) => {
-    const ext = (0, import_node_path3.extname)(f).slice(1);
+    const ext = (0, import_node_path4.extname)(f).slice(1);
     return ANALYZABLE_EXTENSIONS.has(ext);
   });
 }
 function filterReviewable(files) {
   return files.filter((f) => {
-    const ext = (0, import_node_path3.extname)(f).slice(1);
+    const ext = (0, import_node_path4.extname)(f).slice(1);
     if (ANALYZABLE_EXTENSIONS.has(ext)) return false;
     if (REVIEWABLE_EXTENSIONS.has(ext)) return true;
-    const basename8 = f.split("/").pop() ?? "";
-    if (REVIEWABLE_FILENAMES.has(basename8)) return true;
+    const basename9 = f.split("/").pop() ?? "";
+    if (REVIEWABLE_FILENAMES.has(basename9)) return true;
     if (REVIEWABLE_PATH_PATTERNS.some((p) => p.test(f))) return true;
     return false;
   });
@@ -15550,7 +15648,7 @@ async function maybeHealServiceUrl(resolution, verbose) {
 
 // src/lib/register.ts
 var readline = __toESM2(require("node:readline/promises"));
-var import_node_os = require("node:os");
+var import_node_os2 = require("node:os");
 
 // src/lib/spinner.ts
 var FRAMES = ["\u280B", "\u2819", "\u2839", "\u2838", "\u283C", "\u2834", "\u2826", "\u2827", "\u2807", "\u280F"];
@@ -15638,7 +15736,7 @@ function startSpinner(label2, opts = {}) {
 }
 
 // src/lib/provider-auth.ts
-var sleep = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
+var sleep = (ms) => new Promise((resolve9) => setTimeout(resolve9, ms));
 var form = (fields) => new URLSearchParams(fields).toString();
 async function githubAccountId(owner) {
   try {
@@ -15903,7 +16001,7 @@ function deviceLabel() {
   const override = process.env.VERITY_DEVICE_LABEL?.trim();
   if (override) return override;
   try {
-    return (0, import_node_os.hostname)() || void 0;
+    return (0, import_node_os2.hostname)() || void 0;
   } catch {
     return void 0;
   }
@@ -16061,8 +16159,8 @@ function registerAuthCommands(program2) {
 }
 
 // src/lib/pending-login.ts
-var import_node_fs4 = require("node:fs");
-var import_node_path4 = require("node:path");
+var import_node_fs5 = require("node:fs");
+var import_node_path5 = require("node:path");
 function pendingLoginPath() {
   return `${process.env.HOME}/.verity/pending-login.json`;
 }
@@ -16078,26 +16176,26 @@ function savePendingLogin(dc, serviceUrl, now = Date.now()) {
     created_at: new Date(now).toISOString()
   };
   const path = pendingLoginPath();
-  (0, import_node_fs4.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true });
+  (0, import_node_fs5.mkdirSync)((0, import_node_path5.dirname)(path), { recursive: true });
   clearPendingLogin();
-  (0, import_node_fs4.writeFileSync)(path, JSON.stringify(record, null, 2) + "\n", { mode: 384, flag: "wx" });
+  (0, import_node_fs5.writeFileSync)(path, JSON.stringify(record, null, 2) + "\n", { mode: 384, flag: "wx" });
   try {
-    (0, import_node_fs4.chmodSync)(path, 384);
+    (0, import_node_fs5.chmodSync)(path, 384);
   } catch {
   }
   return record;
 }
 function readPendingLogin(now = Date.now()) {
   const path = pendingLoginPath();
-  if (!(0, import_node_fs4.existsSync)(path)) return { status: "none" };
+  if (!(0, import_node_fs5.existsSync)(path)) return { status: "none" };
   try {
-    if ((0, import_node_fs4.lstatSync)(path).isSymbolicLink()) return { status: "invalid", reason: "it is a symlink" };
+    if ((0, import_node_fs5.lstatSync)(path).isSymbolicLink()) return { status: "invalid", reason: "it is a symlink" };
   } catch {
     return { status: "none" };
   }
   let parsed;
   try {
-    parsed = JSON.parse((0, import_node_fs4.readFileSync)(path, "utf-8"));
+    parsed = JSON.parse((0, import_node_fs5.readFileSync)(path, "utf-8"));
   } catch {
     return { status: "invalid", reason: "it is not valid JSON" };
   }
@@ -16118,7 +16216,7 @@ function readPendingLogin(now = Date.now()) {
 }
 function clearPendingLogin() {
   try {
-    (0, import_node_fs4.unlinkSync)(pendingLoginPath());
+    (0, import_node_fs5.unlinkSync)(pendingLoginPath());
     return true;
   } catch {
     return false;
@@ -16674,11 +16772,11 @@ function registerLogoutCommand(program2) {
 
 // src/lib/hooks.ts
 var import_promises4 = require("node:fs/promises");
-var import_node_path6 = require("node:path");
+var import_node_path7 = require("node:path");
 
 // src/lib/json-file.ts
 var import_promises3 = require("node:fs/promises");
-var import_node_path5 = require("node:path");
+var import_node_path6 = require("node:path");
 function jsonSemanticEqual(a, b) {
   if (a === b) return true;
   if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) {
@@ -16724,7 +16822,7 @@ async function writeJsonFilePreservingStyle(file, value) {
   const indent = currentRaw !== null ? detectJsonIndent(currentRaw) : 2;
   const next = JSON.stringify(value, null, indent) + "\n";
   if (next === currentRaw) return false;
-  await (0, import_promises3.mkdir)((0, import_node_path5.dirname)(file), { recursive: true });
+  await (0, import_promises3.mkdir)((0, import_node_path6.dirname)(file), { recursive: true });
   await (0, import_promises3.writeFile)(file, next);
   return true;
 }
@@ -16909,13 +17007,13 @@ async function writeSettings(settings) {
 }
 async function readSettingsAt(root) {
   try {
-    return JSON.parse(await (0, import_promises4.readFile)((0, import_node_path6.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
+    return JSON.parse(await (0, import_promises4.readFile)((0, import_node_path7.join)(root, CLAUDE_SETTINGS_FILE), "utf-8"));
   } catch {
     return {};
   }
 }
 async function writeSettingsAt(root, settings) {
-  await writeJsonFilePreservingStyle((0, import_node_path6.join)(root, CLAUDE_SETTINGS_FILE), settings);
+  await writeJsonFilePreservingStyle((0, import_node_path7.join)(root, CLAUDE_SETTINGS_FILE), settings);
 }
 async function hasLegacyHooksAt(root) {
   const settings = await readSettingsAt(root);
@@ -17104,12 +17202,12 @@ async function applyMomentSelection(moments) {
 }
 
 // src/lib/project-config.ts
-var import_node_fs6 = require("node:fs");
-var import_node_path8 = require("node:path");
+var import_node_fs7 = require("node:fs");
+var import_node_path9 = require("node:path");
 
 // src/lib/repo-controlled.ts
-var import_node_fs5 = require("node:fs");
-var import_node_path7 = require("node:path");
+var import_node_fs6 = require("node:fs");
+var import_node_path8 = require("node:path");
 
 // src/lib/hardened-git.ts
 var import_node_child_process5 = require("node:child_process");
@@ -17190,7 +17288,7 @@ function repoControlled(worktree, rel) {
   for (let i2 = 1; i2 <= parts2.length; i2++) {
     let st;
     try {
-      st = (0, import_node_fs5.lstatSync)((0, import_node_path7.join)(worktree, ...parts2.slice(0, i2)));
+      st = (0, import_node_fs6.lstatSync)((0, import_node_path8.join)(worktree, ...parts2.slice(0, i2)));
     } catch (err2) {
       const code = err2?.code;
       if (code === "ENOENT" || code === "ENOTDIR") return null;
@@ -17214,14 +17312,14 @@ function parseMoments(raw) {
 }
 function readConfigFile(path) {
   try {
-    if (!(0, import_node_fs6.existsSync)(path)) return null;
-    const raw = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf-8"));
+    if (!(0, import_node_fs7.existsSync)(path)) return null;
+    const raw = JSON.parse((0, import_node_fs7.readFileSync)(path, "utf-8"));
     const moments = Array.isArray(raw.git_moments) ? raw.git_moments.filter(isMoment) : [];
     const source2 = raw.git_moments_source === "user" || raw.git_moments_source === "init" ? raw.git_moments_source : void 0;
     return {
       git_moments: [...new Set(moments)],
       ...source2 ? { git_moments_source: source2 } : {},
-      ...raw.formal === "push" ? { formal: "push" } : {}
+      ...raw.formal === "push" || raw.formal === "off" ? { formal: raw.formal } : {}
     };
   } catch {
     return DEFAULTS;
@@ -17232,13 +17330,13 @@ function candidates() {
   const out2 = [{ path: local, source: "local" }];
   const main = mainWorktreeRoot();
   if (main) {
-    const inherited = (0, import_node_path8.join)(main, PROJECT_CONFIG_FILE);
+    const inherited = (0, import_node_path9.join)(main, PROJECT_CONFIG_FILE);
     if (inherited !== local) out2.push({ path: inherited, source: "main-worktree" });
   }
   return out2;
 }
 function formalRefusal(path) {
-  return repoControlled((0, import_node_path8.dirname)((0, import_node_path8.dirname)(path)), PROJECT_CONFIG_FILE);
+  return repoControlled((0, import_node_path9.dirname)((0, import_node_path9.dirname)(path)), PROJECT_CONFIG_FILE);
 }
 function readProjectConfigRaw() {
   for (const { path, source: source2 } of candidates()) {
@@ -17250,10 +17348,10 @@ function readProjectConfigRaw() {
 function readProjectConfig() {
   const cfg = readProjectConfigRaw();
   if (cfg.formal !== "push" || !cfg.path) return cfg;
-  const refused = formalRefusal(cfg.path);
-  if (!refused) return cfg;
+  const refused2 = formalRefusal(cfg.path);
+  if (!refused2) return cfg;
   const { formal: _dropped, ...rest } = cfg;
-  return { ...rest, formal_refused: refused };
+  return { ...rest, formal_refused: refused2 };
 }
 function formalRefusalMessage(reason) {
   switch (reason) {
@@ -17274,8 +17372,8 @@ function writeProjectConfig(patch) {
     ...patch
   };
   const target = projectPath(PROJECT_CONFIG_FILE);
-  (0, import_node_fs6.mkdirSync)((0, import_node_path8.dirname)(target), { recursive: true });
-  (0, import_node_fs6.writeFileSync)(target, JSON.stringify(next, null, 2) + "\n");
+  (0, import_node_fs7.mkdirSync)((0, import_node_path9.dirname)(target), { recursive: true });
+  (0, import_node_fs7.writeFileSync)(target, JSON.stringify(next, null, 2) + "\n");
   return next;
 }
 function resolveGuardMoments(explicit) {
@@ -17284,11 +17382,11 @@ function resolveGuardMoments(explicit) {
 }
 
 // src/lib/plugin-ownership.ts
-var import_node_fs9 = require("node:fs");
+var import_node_fs10 = require("node:fs");
 
 // src/lib/which.ts
-var import_node_fs7 = require("node:fs");
-var import_node_path9 = require("node:path");
+var import_node_fs8 = require("node:fs");
+var import_node_path10 = require("node:path");
 function executableExtensions(platform4, pathext) {
   if (platform4 !== "win32") return [""];
   const raw = (pathext ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean);
@@ -17306,14 +17404,14 @@ function whichSync(bin, opts = {}) {
   if (!rawPath) return null;
   const exts = executableExtensions(platform4, opts.pathext ?? process.env.PATHEXT);
   const real = opts.real ?? true;
-  for (const dir of rawPath.split(import_node_path9.delimiter)) {
+  for (const dir of rawPath.split(import_node_path10.delimiter)) {
     if (!dir) continue;
     for (const ext of exts) {
-      const candidate = (0, import_node_path9.join)(dir, bin + ext);
+      const candidate = (0, import_node_path10.join)(dir, bin + ext);
       try {
-        if (!(0, import_node_fs7.statSync)(candidate).isFile()) continue;
-        if (platform4 !== "win32") (0, import_node_fs7.accessSync)(candidate, import_node_fs7.constants.X_OK);
-        return real ? (0, import_node_fs7.realpathSync)(candidate) : candidate;
+        if (!(0, import_node_fs8.statSync)(candidate).isFile()) continue;
+        if (platform4 !== "win32") (0, import_node_fs8.accessSync)(candidate, import_node_fs8.constants.X_OK);
+        return real ? (0, import_node_fs8.realpathSync)(candidate) : candidate;
       } catch {
         continue;
       }
@@ -17323,11 +17421,11 @@ function whichSync(bin, opts = {}) {
 }
 
 // src/lib/plugin-ownership.ts
-var import_node_os2 = require("node:os");
-var import_node_path10 = require("node:path");
+var import_node_os3 = require("node:os");
+var import_node_path11 = require("node:path");
 
 // src/lib/stderr-log.ts
-var import_node_fs8 = require("node:fs");
+var import_node_fs9 = require("node:fs");
 var TOKEN_RE2 = /verity_[0-9a-f]{16,}/g;
 var ANSI_RE = /\u001b\[[0-?]*[ -/]*[@-~]/g;
 function scrub(s) {
@@ -17340,9 +17438,9 @@ function append(text) {
   try {
     const dir = projectPath(DEBUG_LOG_DIR);
     const file = projectPath(STDERR_LOG_FILE);
-    (0, import_node_fs8.mkdirSync)(dir, { recursive: true });
+    (0, import_node_fs9.mkdirSync)(dir, { recursive: true });
     rotateIfNeeded(file);
-    (0, import_node_fs8.appendFileSync)(file, text);
+    (0, import_node_fs9.appendFileSync)(file, text);
   } catch {
   }
 }
@@ -17390,8 +17488,8 @@ function markerPath() {
 }
 function readMarker() {
   try {
-    if (!(0, import_node_fs9.existsSync)(markerPath())) return null;
-    const raw = JSON.parse((0, import_node_fs9.readFileSync)(markerPath(), "utf-8"));
+    if (!(0, import_node_fs10.existsSync)(markerPath())) return null;
+    const raw = JSON.parse((0, import_node_fs10.readFileSync)(markerPath(), "utf-8"));
     const pluginRoot = typeof raw.plugin_root === "string" ? raw.plugin_root : "";
     if (!pluginRoot || CONTROL_CHARS2.test(pluginRoot)) return null;
     const version = typeof raw.version === "string" && !CONTROL_CHARS2.test(raw.version) ? raw.version : null;
@@ -17409,23 +17507,23 @@ function recordPluginOwnership(sessionId) {
   const pluginRoot = process.env.VERITY_PLUGIN_ROOT;
   if (!pluginRoot) return;
   try {
-    (0, import_node_fs9.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
+    (0, import_node_fs10.mkdirSync)(projectPath(VERITY_DIR), { recursive: true });
     const marker = {
       session_id: sessionId,
       plugin_root: pluginRoot,
       version: process.env.VERITY_PLUGIN_VERSION || null,
       ts: Math.floor(Date.now() / 1e3)
     };
-    (0, import_node_fs9.writeFileSync)(markerPath(), JSON.stringify(marker));
+    (0, import_node_fs10.writeFileSync)(markerPath(), JSON.stringify(marker));
   } catch {
   }
 }
 function claudeConfigDir() {
-  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path10.join)((0, import_node_os2.homedir)(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR || (0, import_node_path11.join)((0, import_node_os3.homedir)(), ".claude");
 }
 function readJsonFile(path) {
   try {
-    const parsed = JSON.parse((0, import_node_fs9.readFileSync)(path, "utf-8"));
+    const parsed = JSON.parse((0, import_node_fs10.readFileSync)(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
@@ -17433,9 +17531,9 @@ function readJsonFile(path) {
 }
 function enabledPluginSetting(key) {
   const files = [
-    projectPath((0, import_node_path10.join)(".claude", "settings.local.json")),
-    projectPath((0, import_node_path10.join)(".claude", "settings.json")),
-    (0, import_node_path10.join)(claudeConfigDir(), "settings.json")
+    projectPath((0, import_node_path11.join)(".claude", "settings.local.json")),
+    projectPath((0, import_node_path11.join)(".claude", "settings.json")),
+    (0, import_node_path11.join)(claudeConfigDir(), "settings.json")
   ];
   for (const file of files) {
     const map = readJsonFile(file)?.enabledPlugins;
@@ -17447,11 +17545,11 @@ function enabledPluginSetting(key) {
 }
 function marketplaceLocations() {
   const out2 = /* @__PURE__ */ new Map();
-  const known = readJsonFile((0, import_node_path10.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
+  const known = readJsonFile((0, import_node_path11.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
   if (!known) return out2;
   for (const [name2, entry] of Object.entries(known)) {
     const loc2 = entry?.installLocation;
-    if (typeof loc2 === "string" && loc2) out2.set(name2, (0, import_node_path10.resolve)(loc2));
+    if (typeof loc2 === "string" && loc2) out2.set(name2, (0, import_node_path11.resolve)(loc2));
   }
   return out2;
 }
@@ -17465,7 +17563,7 @@ function globalVerityVersion() {
   const entry = verityPathEntry();
   if (!entry) return null;
   try {
-    const pkg = readJsonFile((0, import_node_path10.join)((0, import_node_path10.dirname)((0, import_node_fs9.realpathSync)(entry)), "..", "package.json"));
+    const pkg = readJsonFile((0, import_node_path11.join)((0, import_node_path11.dirname)((0, import_node_fs10.realpathSync)(entry)), "..", "package.json"));
     if (pkg?.name !== "@codacy/verity-cli" || typeof pkg.version !== "string") return null;
     return pkg.version;
   } catch {
@@ -17482,7 +17580,7 @@ var VERITY_MARKETPLACE_REPO = "codacy/verity";
 function marketplaceConflict() {
   const wanted = VERITY_MARKETPLACE;
   for (const file of ["settings.json", "settings.local.json"]) {
-    const path = (0, import_node_path10.join)(claudeConfigDir(), file);
+    const path = (0, import_node_path11.join)(claudeConfigDir(), file);
     const declared = readJsonFile(path)?.extraKnownMarketplaces ?? null;
     const entry2 = declared && typeof declared === "object" ? declared[wanted] : void 0;
     if (entry2 && typeof entry2 === "object") {
@@ -17492,7 +17590,7 @@ function marketplaceConflict() {
       }
     }
   }
-  const known = readJsonFile((0, import_node_path10.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
+  const known = readJsonFile((0, import_node_path11.join)(claudeConfigDir(), "plugins", "known_marketplaces.json"));
   const entry = known?.[wanted];
   if (entry && typeof entry === "object" && !pointsAtVerity(entry.source)) {
     return { name: wanted, declaredAs: describeSource(entry.source) };
@@ -17513,7 +17611,7 @@ function describeSource(src) {
   return target ? `${kind} \u2192 ${target}` : kind;
 }
 function legacyMarketplaceInstall() {
-  const plugins = readJsonFile((0, import_node_path10.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path11.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return null;
   for (const key of Object.keys(plugins)) {
     const at = key.lastIndexOf("@");
@@ -17525,13 +17623,13 @@ function legacyMarketplaceInstall() {
 }
 function realpathOr(p) {
   try {
-    return import_node_fs9.realpathSync.native(p);
+    return import_node_fs10.realpathSync.native(p);
   } catch {
-    return (0, import_node_path10.resolve)(p);
+    return (0, import_node_path11.resolve)(p);
   }
 }
 function isWithin(want, dir) {
-  return want === dir || want.startsWith(dir + import_node_path10.sep);
+  return want === dir || want.startsWith(dir + import_node_path11.sep);
 }
 function entryAppliesHere(entry, here) {
   const e = entry;
@@ -17541,9 +17639,9 @@ function entryAppliesHere(entry, here) {
   return forProject === here;
 }
 function registrySays(pluginRoot) {
-  const plugins = readJsonFile((0, import_node_path10.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path11.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return "unverified";
-  const want = (0, import_node_path10.resolve)(pluginRoot);
+  const want = (0, import_node_path11.resolve)(pluginRoot);
   const here = realpathOr(repoRoot());
   const markets = marketplaceLocations();
   for (const [key, value] of Object.entries(plugins)) {
@@ -17552,15 +17650,15 @@ function registrySays(pluginRoot) {
     const applicable = (Array.isArray(value) ? value : []).filter((entry) => entryAppliesHere(entry, here));
     const claims = applicable.some((entry) => {
       const installPath = entry?.installPath;
-      return typeof installPath === "string" && (0, import_node_path10.resolve)(installPath) === want;
+      return typeof installPath === "string" && (0, import_node_path11.resolve)(installPath) === want;
     }) || source2 !== void 0 && applicable.length > 0 && isWithin(want, source2);
     if (claims) {
       if (enabledPluginSetting(key) === false) return "gone";
-      return (0, import_node_fs9.existsSync)(pluginRoot) ? "live" : "gone";
+      return (0, import_node_fs10.existsSync)(pluginRoot) ? "live" : "gone";
     }
   }
-  const managed = (0, import_node_path10.resolve)((0, import_node_path10.join)(claudeConfigDir(), "plugins", "cache"));
-  return want === managed || want.startsWith(managed + import_node_path10.sep) ? "gone" : "unverified";
+  const managed = (0, import_node_path11.resolve)((0, import_node_path11.join)(claudeConfigDir(), "plugins", "cache"));
+  return want === managed || want.startsWith(managed + import_node_path11.sep) ? "gone" : "unverified";
 }
 var _live = /* @__PURE__ */ new Map();
 function pluginLiveness(pluginRoot) {
@@ -17574,7 +17672,7 @@ function clearStalePluginMarker() {
   const marker = readMarker();
   if (!marker || pluginLiveness(marker.plugin_root) !== "gone") return null;
   try {
-    (0, import_node_fs9.rmSync)(markerPath(), { force: true });
+    (0, import_node_fs10.rmSync)(markerPath(), { force: true });
   } catch {
     return null;
   }
@@ -17602,7 +17700,7 @@ function pluginActiveHere() {
   return activePluginInstall() !== null;
 }
 function registeredVerityPlugin() {
-  const plugins = readJsonFile((0, import_node_path10.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
+  const plugins = readJsonFile((0, import_node_path11.join)(claudeConfigDir(), "plugins", "installed_plugins.json"))?.plugins;
   if (!plugins || typeof plugins !== "object") return null;
   const here = realpathOr(repoRoot());
   for (const [key, value] of Object.entries(plugins)) {
@@ -17612,7 +17710,7 @@ function registeredVerityPlugin() {
     for (const entry of Array.isArray(value) ? value : []) {
       const e = entry;
       const installPath = typeof e.installPath === "string" ? e.installPath : "";
-      if (!installPath || !(0, import_node_fs9.existsSync)(installPath)) continue;
+      if (!installPath || !(0, import_node_fs10.existsSync)(installPath)) continue;
       if (!entryAppliesHere(entry, here)) continue;
       return { pluginRoot: installPath, version: typeof e.version === "string" ? e.version : null };
     }
@@ -17664,28 +17762,28 @@ async function resolveHookWiring() {
 }
 
 // src/lib/cli-provenance.ts
-var import_node_fs10 = require("node:fs");
-var import_node_os3 = require("node:os");
-var import_node_path11 = require("node:path");
+var import_node_fs11 = require("node:fs");
+var import_node_os4 = require("node:os");
+var import_node_path12 = require("node:path");
 var CLI_PACKAGE = "@codacy/verity-cli";
-var CLI_ENTRY = (0, import_node_path11.join)("node_modules", CLI_PACKAGE, "bin", "verity.js");
+var CLI_ENTRY = (0, import_node_path12.join)("node_modules", CLI_PACKAGE, "bin", "verity.js");
 function readJson(path) {
   try {
-    const parsed = JSON.parse((0, import_node_fs10.readFileSync)(path, "utf-8"));
+    const parsed = JSON.parse((0, import_node_fs11.readFileSync)(path, "utf-8"));
     return parsed && typeof parsed === "object" ? parsed : null;
   } catch {
     return null;
   }
 }
 function versionUnder(base) {
-  const entry = (0, import_node_path11.join)(base, CLI_ENTRY);
-  if (!(0, import_node_fs10.existsSync)(entry)) return null;
-  const pkg = readJson((0, import_node_path11.join)(base, "node_modules", CLI_PACKAGE, "package.json"));
+  const entry = (0, import_node_path12.join)(base, CLI_ENTRY);
+  if (!(0, import_node_fs11.existsSync)(entry)) return null;
+  const pkg = readJson((0, import_node_path12.join)(base, "node_modules", CLI_PACKAGE, "package.json"));
   return typeof pkg?.version === "string" ? pkg.version : null;
 }
 function versionForEntry(entry) {
   try {
-    const pkg = readJson((0, import_node_path11.join)((0, import_node_path11.dirname)((0, import_node_fs10.realpathSync)(entry)), "..", "package.json"));
+    const pkg = readJson((0, import_node_path12.join)((0, import_node_path12.dirname)((0, import_node_fs11.realpathSync)(entry)), "..", "package.json"));
     return typeof pkg?.version === "string" ? pkg.version : null;
   } catch {
     return null;
@@ -17693,16 +17791,16 @@ function versionForEntry(entry) {
 }
 function resolveHooksCli(pluginRoot) {
   const override = process.env.VERITY_CLI_PATH;
-  if (override && (0, import_node_fs10.existsSync)(override)) {
+  if (override && (0, import_node_fs11.existsSync)(override)) {
     return { version: versionForEntry(override), rung: "override" };
   }
   const fromPlugin = versionUnder(pluginRoot);
   if (fromPlugin !== null) return { version: fromPlugin, rung: "plugin" };
-  if ((0, import_node_fs10.existsSync)((0, import_node_path11.join)(pluginRoot, CLI_ENTRY))) return { version: null, rung: "plugin" };
-  const dataDir = process.env.CLAUDE_PLUGIN_DATA || (0, import_node_path11.join)((0, import_node_os3.homedir)(), ".verity", "plugin-cli");
+  if ((0, import_node_fs11.existsSync)((0, import_node_path12.join)(pluginRoot, CLI_ENTRY))) return { version: null, rung: "plugin" };
+  const dataDir = process.env.CLAUDE_PLUGIN_DATA || (0, import_node_path12.join)((0, import_node_os4.homedir)(), ".verity", "plugin-cli");
   const fromData = versionUnder(dataDir);
   if (fromData !== null) return { version: fromData, rung: "plugin-data" };
-  if ((0, import_node_fs10.existsSync)((0, import_node_path11.join)(dataDir, CLI_ENTRY))) return { version: null, rung: "plugin-data" };
+  if ((0, import_node_fs11.existsSync)((0, import_node_path12.join)(dataDir, CLI_ENTRY))) return { version: null, rung: "plugin-data" };
   const global = globalVerityVersion();
   if (global !== null) return { version: global, rung: "global" };
   return null;
@@ -17804,7 +17902,7 @@ function pluginCliInvocation() {
   return resolverCommand(root);
 }
 function resolverCommand(root) {
-  return `node ${JSON.stringify((0, import_node_path11.join)(root, "scripts", "verity.mjs"))}`;
+  return `node ${JSON.stringify((0, import_node_path12.join)(root, "scripts", "verity.mjs"))}`;
 }
 
 // src/commands/hooks.ts
@@ -17940,18 +18038,18 @@ function registerHooksCommands(program2) {
 }
 
 // src/commands/intent.ts
-var import_node_crypto9 = require("node:crypto");
+var import_node_crypto10 = require("node:crypto");
 
 // src/lib/conversation-buffer.ts
 var import_promises5 = require("node:fs/promises");
-var import_node_fs11 = require("node:fs");
+var import_node_fs12 = require("node:fs");
 var import_node_child_process6 = require("node:child_process");
-var import_node_crypto = require("node:crypto");
+var import_node_crypto2 = require("node:crypto");
 function stripImageReferences(text) {
   return text.replace(/\[Image #\d+\]/g, "[screenshot \u2014 not available for review]");
 }
 function bufferTmpPath() {
-  return `${CONVERSATION_BUFFER_FILE}.${process.pid}.${(0, import_node_crypto.randomBytes)(4).toString("hex")}.tmp`;
+  return `${CONVERSATION_BUFFER_FILE}.${process.pid}.${(0, import_node_crypto2.randomBytes)(4).toString("hex")}.tmp`;
 }
 async function appendToConversationBuffer(prompt, sessionId) {
   try {
@@ -17980,7 +18078,7 @@ async function appendToConversationBuffer(prompt, sessionId) {
 }
 async function readAndClearConversationBuffer(currentSessionId) {
   try {
-    if ((0, import_node_fs11.existsSync)(CONVERSATION_BUFFER_FILE)) {
+    if ((0, import_node_fs12.existsSync)(CONVERSATION_BUFFER_FILE)) {
       const entries = await readBufferEntries();
       let mine = entries;
       let others = [];
@@ -18004,7 +18102,7 @@ async function readAndClearConversationBuffer(currentSessionId) {
         };
       }
     }
-    if ((0, import_node_fs11.existsSync)(INTENT_FILE)) {
+    if ((0, import_node_fs12.existsSync)(INTENT_FILE)) {
       try {
         const content = await (0, import_promises5.readFile)(INTENT_FILE, "utf-8");
         await (0, import_promises5.unlink)(INTENT_FILE).catch(() => {
@@ -18295,83 +18393,6 @@ function isCommandOnlyTurn(input) {
   return commands.every(isNonAuthoringCommand);
 }
 
-// src/lib/context-identity.ts
-var import_node_crypto2 = require("node:crypto");
-var import_node_fs12 = require("node:fs");
-var import_node_os4 = require("node:os");
-var import_node_path12 = require("node:path");
-var SHARED_SENTINELS = /* @__PURE__ */ new Set([
-  "",
-  "-",
-  "n/a",
-  "na",
-  "none",
-  "null",
-  "undefined",
-  "unknown",
-  "anon",
-  "anonymous",
-  "default",
-  "_default"
-]);
-function isSharedSentinel(value) {
-  if (value == null) return true;
-  return SHARED_SENTINELS.has(value.trim().toLowerCase());
-}
-var ephemeral = /* @__PURE__ */ new Map();
-function ephemeralId(slot, width) {
-  let id = ephemeral.get(slot);
-  if (!id) {
-    id = `eph-${(0, import_node_crypto2.randomBytes)(Math.ceil(width / 2)).toString("hex").slice(0, width - 4)}`;
-    ephemeral.set(slot, id);
-  }
-  return id;
-}
-function contextIdentity(input) {
-  const tokenUsable = !isSharedSentinel(input.token ?? null);
-  const sessionUsable = !isSharedSentinel(input.sessionId ?? null);
-  const userKey = tokenUsable ? (0, import_node_crypto2.createHash)("sha256").update(String(input.token)).digest("hex").slice(0, 12) : ephemeralId("user", 12);
-  const sessionKey2 = sessionUsable ? (0, import_node_crypto2.createHash)("sha256").update(String(input.sessionId)).digest("hex").slice(0, 16) : ephemeralId("session", 16);
-  let treeKey = "no-tree";
-  const rawTree = input.treeRoot;
-  if (rawTree && !isSharedSentinel(rawTree)) {
-    let resolved = rawTree;
-    try {
-      resolved = import_node_fs12.realpathSync.native(rawTree);
-    } catch {
-    }
-    treeKey = (0, import_node_crypto2.createHash)("sha256").update(resolved).digest("hex").slice(0, 12);
-  }
-  return {
-    userKey,
-    treeKey,
-    sessionKey: sessionKey2,
-    userKeySource: tokenUsable ? "token" : "ephemeral",
-    sessionKeySource: sessionUsable ? "session_id" : "ephemeral",
-    ephemeral: !tokenUsable || !sessionUsable
-  };
-}
-function verityHome() {
-  const override = process.env.VERITY_HOME;
-  return override && override.trim() ? (0, import_node_path12.resolve)(override) : (0, import_node_path12.join)((0, import_node_os4.homedir)(), ".verity");
-}
-function dossierDir(identity) {
-  return (0, import_node_path12.join)(verityHome(), "sessions", identity.userKey, identity.treeKey, identity.sessionKey);
-}
-function treeDir(identity) {
-  return (0, import_node_path12.join)(verityHome(), "sessions", identity.userKey, identity.treeKey);
-}
-function scopeIdentity(token, sessionId) {
-  const t = (token ?? "").trim();
-  const s = (sessionId ?? "").trim();
-  const userKey = t.length > 0 ? (0, import_node_crypto2.createHash)("sha256").update(t).digest("hex").slice(0, 12) : "anon";
-  const sessionKey2 = s.length > 0 ? (0, import_node_crypto2.createHash)("sha256").update(s).digest("hex").slice(0, 16) : "_default";
-  return { userKey, sessionKey: sessionKey2, bucket: `${userKey}/${sessionKey2}` };
-}
-function sessionScopeKey(token, sessionId) {
-  return scopeIdentity(token, sessionId).bucket;
-}
-
 // src/lib/task-context-buffer.ts
 var import_promises6 = require("node:fs/promises");
 var import_node_fs13 = require("node:fs");
@@ -20037,6 +20058,97 @@ var LEGACY_MD_END = "<!-- gate-memory:end -->";
 var LEGACY_PRESERVE_START = "<!-- gate-memory:preserve -->";
 var LEGACY_PRESERVE_END = "<!-- /gate-memory:preserve -->";
 var CLAUDE_MD_PROSE = [
+  "## Project Memory",
+  "",
+  "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
+  "non-trivial work, scan `.verity/memory/index.md` for decisions, gotchas, and patterns",
+  "that may apply to the change you are about to make. Open specific node files via",
+  "the Read tool when the title or scope suggests relevance.",
+  "",
+  "The graph is auto-maintained by Verity. Files at `.verity/memory/_archive/` are",
+  "superseded \u2014 ignore them unless investigating history.",
+  "",
+  "Knowledge the organization's other repositories learned is mirrored outside the",
+  "repo at `~/.verity/orgs/<host>/<owner>/memory/` (`verity memory org` lists it).",
+  "Each claim says where it came from; one that is wrong here is demoted for",
+  'everyone with `verity memory demote <id> --reason "\u2026"`.',
+  "",
+  "## Quality gate: accepted risks",
+  "",
+  "When the Verity pre-commit/pre-push gate FAILs, fix the findings \u2014 that is the",
+  'default. Use `verity waive <pattern-id> --file <path> --reason "\u2026"` ONLY to relay',
+  "a risk a human has explicitly accepted: a named code-review finding, an ADR, or",
+  "the user saying so in this conversation. The --reason must cite that source.",
+  "",
+  "Never waive on your own judgment, to get past a block, or pre-emptively. A waive",
+  "binds to the file's current bytes and voids automatically when the file changes,",
+  "and every waive is recorded in the run ledger. For a pattern-level false positive",
+  "use `verity feedback finding <run-id> <pattern-id> false_positive` instead.",
+  "",
+  "## Post-task reflection",
+  "",
+  `When a task is complete (you've created a PR, the user says "done" or "ship it",`,
+  "or the work is clearly finished), **draft the reflection yourself** \u2014 1\u20133",
+  "concrete things worth remembering (a decision, a gotcha, or a pattern), each",
+  "cited with the files / PR / commands / error-signatures it came from. Skip",
+  "entirely if nothing non-obvious happened \u2014 that judgement is the ONLY filter,",
+  "because nothing reviews the reflection before it lands.",
+  "",
+  "Then record it straight away. There is no confirm step, in any environment:",
+  "",
+  "```bash",
+  "verity reflect --user-input - --kind <kind> <<'VERITY_EOF_<random>'",
+  "<your draft>",
+  "VERITY_EOF_<random>",
+  "```",
+  "",
+  'The draft goes through the quoted heredoc, never inside `"\u2026"` on the command',
+  'line, where a `"` or `$(\u2026)` in it would run in the shell. Replace `<random>`',
+  "with 8 random letters and digits that you pick for this call, the same at both",
+  "ends. Text written before you picked them cannot end the heredoc early.",
+  "",
+  "Add `--confirmed` ONLY when the user authored or dictated the words. Without",
+  "it the node is stored as `source: agent` \u2014 Verity thought this, nobody checked",
+  "it. With it, `source: user` at full confidence \u2014 a person stands behind this.",
+  "Never claim the second for your own draft, however good it is.",
+  "",
+  "**Name the files in the text.** Verity scopes the reflection to the paths it",
+  "cites, and a reflection that names no file in this repo is never retrieved for",
+  "a later review \u2014 it is recorded and then invisible. The command says so when it",
+  "happens; `--file-globs '<path or glob>'` is the fix when the prose cannot carry",
+  "the paths.",
+  "",
+  "Then tell the user, in one line, what you recorded and where: the command",
+  "prints the node id, the path under `.verity/memory/`, and a dashboard link.",
+  "They did not agree to it in advance, so say it happened \u2014 editing or deleting",
+  "that file is how they correct it.",
+  "",
+  "> Durable, hand-curated guidance goes in the preserve region below (it survives",
+  "> regeneration) or anywhere OUTSIDE these markers. Everything else between the",
+  "> markers is tool-owned and overwritten on each run.",
+  "",
+  "## Housekeeping Turns",
+  "",
+  "When a turn will be pure housekeeping \u2014 pulling, installing dependencies,",
+  "rebasing, a formatting sweep you are not authoring \u2014 declare it BEFORE doing it:",
+  "",
+  "```bash",
+  'verity ignore --turn --agent --reason "pulling latest before starting"',
+  "```",
+  "",
+  "This skips the review for that turn, which saves the turn Verity would",
+  "otherwise spend saying it had nothing to say. Use `--for 30m` instead of",
+  "`--turn` when a single piece of housekeeping spans several turns.",
+  "",
+  "**It is a claim about the turn, not a way to silence review.** The declaration",
+  "is checked against what the turn actually did: if anything is authored \u2014 by you,",
+  "by a subagent, or by a shell command that can write files \u2014 it voids, the review",
+  "runs anyway, and the broken declaration is reported. So declare housekeeping you",
+  "are about to do, never work you have already done, and never as a way to get past",
+  "a finding. Declarations are budgeted per session and every one is recorded with",
+  "its reason."
+].join("\n");
+var CLAUDE_MD_PROSE_PRE_STDIN = [
   "## Project Memory",
   "",
   "This project has a knowledge graph maintained at `.verity/memory/`. Before starting",
@@ -20478,6 +20590,7 @@ function stripKnownProse(interior) {
   const trimmed = interior.replace(/^\n+/, "");
   for (const prose of [
     CLAUDE_MD_PROSE,
+    CLAUDE_MD_PROSE_PRE_STDIN,
     CLAUDE_MD_PROSE_PRE_ORG,
     CLAUDE_MD_PROSE_PRE_AUTORECORD,
     CLAUDE_MD_PROSE_PRE_REFLECT,
@@ -20544,7 +20657,7 @@ Body content (\u22648KB). Use [[node-id]] wikilinks for cross-references.
 
 // src/lib/dossier-session.ts
 var import_node_fs26 = require("node:fs");
-var import_node_crypto8 = require("node:crypto");
+var import_node_crypto9 = require("node:crypto");
 var import_node_path22 = require("node:path");
 
 // src/lib/pending-repeat.ts
@@ -20621,6 +20734,7 @@ function isRepeatOfAny(text, priorFingerprints, threshold = REPEAT_THRESHOLD) {
 }
 
 // src/lib/dossier/bounds.ts
+var import_node_crypto5 = require("node:crypto");
 var MAX_LINE_BYTES = 4096;
 var MAX_GOAL_CHARS = 2e3;
 var GOAL_KEEP = 8;
@@ -20632,10 +20746,17 @@ var NOT_MINE_CAP = 300;
 var STATEMENTS_OPEN_CAP = 40;
 var COMMANDS_CAP = 12;
 var DIVERGENCE_CAP = 10;
-var DIVERGENCE_SEEN_CAP = 300;
+var DIVERGENCE_BULK_AT = 300;
+var DIVERGENCE_KEYS_PER_LINE = 200;
 function divergenceKey(path, hash) {
   return `${path}@${hash ?? "unknown"}`;
 }
+function packedDivergenceDigest(key) {
+  return (0, import_node_crypto5.createHash)("sha256").update(key).digest("hex").slice(0, 12);
+}
+function packedDivergenceKey(digest) {
+  return `#${digest}`;
+}
 var MARKS_CAP = 50;
 var ROTATE_BYTES = 1048576;
 var ROTATE_KEEP = 2;
@@ -20649,7 +20770,7 @@ function statementAnchorKey(file, patternId) {
 }
 
 // src/lib/dossier/log.ts
-var import_node_crypto5 = require("node:crypto");
+var import_node_crypto6 = require("node:crypto");
 var import_node_fs22 = require("node:fs");
 var import_node_path20 = require("node:path");
 var CRC_TABLE = (() => {
@@ -20691,7 +20812,7 @@ function nextSeq() {
 function encodeEvent(ev) {
   const full = {
     v: 1,
-    id: (0, import_node_crypto5.randomBytes)(4).toString("hex"),
+    id: (0, import_node_crypto6.randomBytes)(4).toString("hex"),
     ...ev
   };
   let body2 = JSON.stringify(full);
@@ -20762,7 +20883,7 @@ function rotateIfNeeded2(d) {
 }
 
 // src/lib/dossier/fold-dossier.ts
-var import_node_crypto6 = require("node:crypto");
+var import_node_crypto7 = require("node:crypto");
 var import_node_fs23 = require("node:fs");
 var import_node_path21 = require("node:path");
 var EMPTY_CAPABILITIES = () => ({
@@ -20854,7 +20975,7 @@ function reduce(state, events, now) {
     state.meta.seq = Math.max(state.meta.seq, ev.seq);
     switch (ev.k) {
       case "goal": {
-        const hash = (0, import_node_crypto6.createHash)("sha256").update(ev.text).digest("hex").slice(0, 16);
+        const hash = (0, import_node_crypto7.createHash)("sha256").update(ev.text).digest("hex").slice(0, 16);
         const prev = state.goal[state.goal.length - 1];
         if (prev && prev.hash === hash) {
           prev.repeats = (prev.repeats ?? 0) + 1;
@@ -20982,12 +21103,13 @@ function reduce(state, events, now) {
         break;
       }
       case "divergence": {
-        state.divergence.counts[ev.kind] = (state.divergence.counts[ev.kind] ?? 0) + 1;
         state.divergence.events.push({ kind: ev.kind, path: ev.path, at: ev.at });
-        const key = divergenceKey(ev.path, ev.hash ?? null);
-        if (!seenDivergence.has(key)) {
+        const keys = Array.isArray(ev.keys) ? ev.keys.filter((k) => typeof k === "string").map(packedDivergenceKey) : [divergenceKey(ev.path, ev.hash ?? null)];
+        for (const key of keys) {
+          if (seenDivergence.has(key)) continue;
           seenDivergence.add(key);
-          if (state.divergence.seen.length < DIVERGENCE_SEEN_CAP) state.divergence.seen.push(key);
+          state.divergence.seen.push(key);
+          state.divergence.counts[ev.kind] = (state.divergence.counts[ev.kind] ?? 0) + 1;
         }
         break;
       }
@@ -21294,14 +21416,14 @@ function assessContinuity(i2) {
 }
 
 // src/lib/dossier/reanchor.ts
-var import_node_crypto7 = require("node:crypto");
+var import_node_crypto8 = require("node:crypto");
 var import_node_fs25 = require("node:fs");
 function lineSha(text) {
-  return (0, import_node_crypto7.createHash)("sha256").update(text.trim()).digest("hex").slice(0, HASH_WIDTH);
+  return (0, import_node_crypto8.createHash)("sha256").update(text.trim()).digest("hex").slice(0, HASH_WIDTH);
 }
 function fileHash(path) {
   try {
-    return (0, import_node_crypto7.createHash)("sha256").update((0, import_node_fs25.readFileSync)(path)).digest("hex").slice(0, HASH_WIDTH);
+    return (0, import_node_crypto8.createHash)("sha256").update((0, import_node_fs25.readFileSync)(path)).digest("hex").slice(0, HASH_WIDTH);
   } catch {
     return null;
   }
@@ -21798,7 +21920,7 @@ function recordTurn(d, t) {
       // Identity is the COMMAND, not its category — otherwise `npm test -- a` and
       // `npm test -- b` are one row and the streak counts two different commands
       // as a run of one.
-      cmd_hash: (0, import_node_crypto8.createHash)("sha256").update(c.head || c.class).digest("hex").slice(0, 12),
+      cmd_hash: (0, import_node_crypto9.createHash)("sha256").update(c.head || c.class).digest("hex").slice(0, 12),
       head: c.head || c.class,
       status: toStatus(c.last_status)
     });
@@ -21816,10 +21938,23 @@ function recordTurn(d, t) {
     }
   }
   const seenDivergence = t.known?.divergence ?? /* @__PURE__ */ new Set();
+  const fresh = [];
   for (const u of t.unobserved) {
     const hash = fileHash((0, import_node_path22.join)(root, u.p));
-    if (seenDivergence.has(divergenceKey(u.p, hash))) continue;
-    appendEvent(d, { k: "divergence", kind: "external_mutation", path: u.p, hash });
+    const key = divergenceKey(u.p, hash);
+    const digest = packedDivergenceDigest(key);
+    if (seenDivergence.has(key) || seenDivergence.has(packedDivergenceKey(digest))) continue;
+    fresh.push({ path: u.p, hash, digest });
+  }
+  if (fresh.length > DIVERGENCE_BULK_AT) {
+    for (let i2 = 0; i2 < fresh.length; i2 += DIVERGENCE_KEYS_PER_LINE) {
+      const slice2 = fresh.slice(i2, i2 + DIVERGENCE_KEYS_PER_LINE);
+      appendEvent(d, { k: "divergence", kind: "external_mutation", path: slice2[0].path, keys: slice2.map((f) => f.digest) });
+    }
+  } else {
+    for (const f of fresh) {
+      appendEvent(d, { k: "divergence", kind: "external_mutation", path: f.path, hash: f.hash });
+    }
   }
   const newCompactions = (t.compactions ?? 0) - (t.known?.compactions ?? 0);
   for (let i2 = 0; i2 < newCompactions; i2++) {
@@ -22084,7 +22219,7 @@ async function fireClassify(prompt, sessionId, globals) {
     logEvent("classify_skipped", { reason: "no_service_url", detail: urlResult.error });
     return;
   }
-  const promptHash = (0, import_node_crypto9.createHash)("sha256").update(prompt).digest("hex");
+  const promptHash = (0, import_node_crypto10.createHash)("sha256").update(prompt).digest("hex");
   const result = await apiRequest({
     method: "POST",
     path: "/classify-task",
@@ -22128,7 +22263,7 @@ var import_node_path26 = require("node:path");
 // src/lib/baseline.ts
 var import_node_fs28 = require("node:fs");
 var import_node_path25 = require("node:path");
-var import_node_crypto10 = require("node:crypto");
+var import_node_crypto11 = require("node:crypto");
 
 // src/lib/snapshot.ts
 var import_node_fs27 = require("node:fs");
@@ -22397,7 +22532,7 @@ var MIRROR_MAX_BYTES = 2 * 1024 * 1024;
 var DEFAULT_SESSION_KEY = "_default";
 function sessionKey(sessionId) {
   if (!sessionId) return DEFAULT_SESSION_KEY;
-  return (0, import_node_crypto10.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
+  return (0, import_node_crypto11.createHash)("sha256").update(sessionId).digest("hex").slice(0, 16);
 }
 function sessionDir(key) {
   return (0, import_node_path25.join)(projectPath(BASELINE_DIR), key);
@@ -22859,17 +22994,17 @@ async function readHookStdin() {
   try {
     if (process.stdin.isTTY) return {};
     const chunks = [];
-    const timeout = new Promise((resolve8) => setTimeout(() => resolve8({}), 500));
-    const read2 = new Promise((resolve8) => {
+    const timeout = new Promise((resolve9) => setTimeout(() => resolve9({}), 500));
+    const read2 = new Promise((resolve9) => {
       process.stdin.on("data", (c) => chunks.push(c));
       process.stdin.on("end", () => {
         try {
-          resolve8(JSON.parse(Buffer.concat(chunks).toString("utf-8").trim() || "{}"));
+          resolve9(JSON.parse(Buffer.concat(chunks).toString("utf-8").trim() || "{}"));
         } catch {
-          resolve8({});
+          resolve9({});
         }
       });
-      process.stdin.on("error", () => resolve8({}));
+      process.stdin.on("error", () => resolve9({}));
       process.stdin.resume();
     });
     return await Promise.race([read2, timeout]);
@@ -22965,7 +23100,7 @@ function isIgnored2(path) {
 }
 function listProjectFiles(root) {
   try {
-    const out2 = (0, import_node_child_process9.execSync)("git ls-files -z", {
+    const out2 = (0, import_node_child_process9.execSync)("git ls-files -z --cached --others --exclude-standard", {
       cwd: root,
       encoding: "utf-8",
       maxBuffer: 32 * 1024 * 1024,
@@ -24152,7 +24287,7 @@ function registerConfigCommands(program2) {
   config.command("formal [state]").description('Get or set formal verification at push: "push" or "off" (needs Lean \u2014 verity lean status)').action((state) => {
     if (state === void 0) {
       const cfg = readProjectConfig();
-      process.stdout.write((cfg.formal ?? "off") + "\n");
+      process.stdout.write((cfg.formal === "push" ? "push" : "off") + "\n");
       if (cfg.formal_refused) printWarn(formalRefusalMessage(cfg.formal_refused));
       return;
     }
@@ -24160,10 +24295,10 @@ function registerConfigCommands(program2) {
       printError(`Unrecognised state: ${state}. Use "push" or "off".`);
       process.exit(1);
     }
-    writeProjectConfig({ formal: state === "push" ? "push" : void 0 });
-    const refused = state === "push" ? readProjectConfig().formal_refused : void 0;
-    if (refused) {
-      printWarn(`Formal verification at push: still off \u2014 ${formalRefusalMessage(refused)}`);
+    writeProjectConfig({ formal: state === "push" ? "push" : "off" });
+    const refused2 = state === "push" ? readProjectConfig().formal_refused : void 0;
+    if (refused2) {
+      printWarn(`Formal verification at push: still off \u2014 ${formalRefusalMessage(refused2)}`);
       return;
     }
     printInfo(state === "push" ? "Formal verification at push: on for this checkout (Lean must be installed \u2014 verity lean status)" : "Formal verification at push: off");
@@ -24317,10 +24452,10 @@ var import_node_fs38 = require("node:fs");
 
 // src/lib/debounce.ts
 var import_node_fs37 = require("node:fs");
-var import_node_crypto11 = require("node:crypto");
+var import_node_crypto12 = require("node:crypto");
 function scopedFile(base, sessionId) {
   if (!sessionId) return base;
-  return `${base}.${(0, import_node_crypto11.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
+  return `${base}.${(0, import_node_crypto12.createHash)("sha1").update(sessionId).digest("hex").slice(0, 12)}`;
 }
 function checkDebounce(debounceSeconds = DEBOUNCE_SECONDS, sessionId) {
   const file = scopedFile(DEBOUNCE_FILE, sessionId);
@@ -24361,7 +24496,7 @@ function checkMtime(files, bypassForRecentCommits, sessionId) {
   return "No files modified since last analysis";
 }
 function computeContentHash(files) {
-  const hash = (0, import_node_crypto11.createHash)("sha1");
+  const hash = (0, import_node_crypto12.createHash)("sha1");
   const sorted = [...files].sort();
   for (const f of sorted) {
     const resolved = resolveFile(f) ?? f;
@@ -24817,20 +24952,56 @@ function registerStatusCommand(program2) {
   });
 }
 
+// src/lib/text-input.ts
+var import_node_fs39 = require("node:fs");
+var MAX_STDIN_BYTES = 64 * 1024;
+function readTextInput(value, flag, readStdin2 = () => (0, import_node_fs39.readFileSync)(0)) {
+  if (value !== "-") return { ok: true, text: value };
+  let raw;
+  try {
+    raw = readStdin2();
+  } catch (err2) {
+    return { ok: false, error: `Could not read ${flag} from stdin: ${err2.message}` };
+  }
+  if (raw.length > MAX_STDIN_BYTES) {
+    return { ok: false, error: `${flag} from stdin is ${raw.length} bytes; the limit is ${MAX_STDIN_BYTES}.` };
+  }
+  const text = raw.toString("utf8").replace(/\r?\n$/, "");
+  if (!text.trim()) return { ok: false, error: `${flag} from stdin is empty.` };
+  return { ok: true, text };
+}
+
+// src/lib/terminal-text.ts
+var CONTROL = /[\x00-\x08\x0b-\x1f\x7f-\x9f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/g;
+function terminalText(value, max = 4e3) {
+  if (typeof value !== "string") return "";
+  const clean2 = value.replace(CONTROL, "");
+  return clean2.length > max ? `${clean2.slice(0, max - 1)}\u2026` : clean2;
+}
+function terminalUrl(value) {
+  const clean2 = terminalText(value, 2e3);
+  return /^https?:\/\/\S+$/.test(clean2) ? clean2 : "";
+}
+
 // src/commands/feedback.ts
 function registerFeedbackCommand(program2) {
   const feedbackCmd = program2.command("feedback").description("Send feedback to the Verity team");
-  feedbackCmd.command("message <text>").description("Send general feedback").option("--session-id <id>", "Session identifier").option("--model <name>", "Agent model name").action(async (message, opts) => {
-    const globals = program2.opts();
-    await sendGeneralFeedback(message, opts, globals);
+  feedbackCmd.command("message <text>").description("Send general feedback (- reads the message from stdin, so the words never pass through shell quoting)").option("--session-id <id>", "Session identifier").option("--model <name>", "Agent model name").action(async (text, opts) => {
+    await sendMessageArg(text, opts, program2.opts());
   });
-  feedbackCmd.command("finding <run-id> <pattern-id> <action> [note]").description("Submit per-finding feedback (false_positive, acknowledged, useful, etc.)").option("--file <path>", "File path the finding applies to").option("--line <n>", "Line number", parseInt).action(async (runId, patternId, action, note, opts) => {
+  feedbackCmd.command("finding <run-id> <pattern-id> <action> [note]").description("Submit per-finding feedback (false_positive, acknowledged, useful, etc.); a note of - is read from stdin").option("--file <path>", "File path the finding applies to").option("--line <n>", "Line number", parseInt).action(async (runId, patternId, action, inlineNote, opts) => {
     const globals = program2.opts();
     const validActions = ["false_positive", "acknowledged", "will_fix_later", "wrong_severity", "useful"];
     if (!validActions.includes(action)) {
       printError(`Invalid action "${action}". Must be one of: ${validActions.join(", ")}`);
       process.exit(1);
     }
+    const noteInput = readTextInput(inlineNote, "the note");
+    if (!noteInput.ok) {
+      printError(noteInput.error);
+      process.exit(1);
+    }
+    const note = noteInput.text;
     const tokenResult = await resolveToken(globals.token);
     if (!tokenResult.ok) {
       printError(tokenResult.error);
@@ -24866,21 +25037,28 @@ function registerFeedbackCommand(program2) {
   });
   feedbackCmd.argument("[message]", "Feedback message (for backwards compat)").option("--session-id <id>", "Session identifier").option("--model <name>", "Agent model name").action(async (message, opts) => {
     if (!message) return;
-    const globals = program2.opts();
-    await sendGeneralFeedback(message, opts, globals);
+    await sendMessageArg(message, opts, program2.opts());
   });
 }
+async function sendMessageArg(arg, opts, globals) {
+  const input = readTextInput(arg, "the message");
+  if (!input.ok || !input.text) {
+    printError(input.ok ? "Nothing to send." : input.error);
+    process.exit(1);
+  }
+  await sendGeneralFeedback(input.text, opts, globals);
+}
 async function sendGeneralFeedback(message, opts, globals) {
   const tokenResult = await resolveToken(globals.token);
   if (!tokenResult.ok) {
     printError(tokenResult.error);
-    printInfo(`Your message: ${message}`);
+    printInfo(`Your message: ${terminalText(message, message.length)}`);
     process.exit(1);
   }
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
   if (!urlResult.ok) {
     printError(urlResult.error);
-    printInfo(`Your message: ${message}`);
+    printInfo(`Your message: ${terminalText(message, message.length)}`);
     process.exit(1);
   }
   const body2 = { message };
@@ -24898,7 +25076,7 @@ async function sendGeneralFeedback(message, opts, globals) {
   });
   if (!result.ok) {
     printError(`Couldn't send feedback: ${result.error}`);
-    printInfo(`Your message: ${message}`);
+    printInfo(`Your message: ${terminalText(message, message.length)}`);
     process.exit(1);
   }
   printInfo("Thanks, feedback sent!");
@@ -24983,7 +25161,8 @@ function createRun(opts, globals) {
 }
 
 // src/commands/analyze/index.ts
-var import_node_fs52 = require("node:fs");
+var import_node_fs53 = require("node:fs");
+var import_node_path40 = require("node:path");
 
 // src/lib/repo-context.ts
 var import_node_child_process11 = require("node:child_process");
@@ -25947,7 +26126,7 @@ function installRunEvidence(run4) {
 }
 
 // src/lib/git-frame.ts
-var import_node_fs39 = require("node:fs");
+var import_node_fs40 = require("node:fs");
 var import_node_os6 = require("node:os");
 var import_node_path30 = require("node:path");
 var import_node_path31 = require("node:path");
@@ -26117,14 +26296,14 @@ function gitAt(dir, args2) {
 }
 function realpathOr2(p) {
   try {
-    return import_node_fs39.realpathSync.native(p);
+    return import_node_fs40.realpathSync.native(p);
   } catch {
     return (0, import_node_path30.resolve)(p);
   }
 }
 function resolveFrame(input) {
   const found = findMomentSegment(input.command, input.on);
-  const hookDirUsable = !!input.hookCwd && (0, import_node_fs39.existsSync)(input.hookCwd);
+  const hookDirUsable = !!input.hookCwd && (0, import_node_fs40.existsSync)(input.hookCwd);
   const baseDir = hookDirUsable ? input.hookCwd : process.cwd();
   let anchor = hookDirUsable ? "hook-cwd" : "process-cwd";
   const refuse = (refusal) => ({
@@ -26147,7 +26326,7 @@ function resolveFrame(input) {
     if (dirs.size > 1) return refuse(`target:multiple ${found.moment} targets in one command`);
     const targetDir = dirs.size === 1 ? [...dirs][0] : baseDir;
     if (targetDir !== baseDir) {
-      if (!(0, import_node_fs39.existsSync)(targetDir)) return refuse(`target:directory does not exist: ${targetDir}`);
+      if (!(0, import_node_fs40.existsSync)(targetDir)) return refuse(`target:directory does not exist: ${targetDir}`);
       dir = targetDir;
     }
   }
@@ -26334,7 +26513,7 @@ function stagedRange(frame, command) {
     return { kind: "staged", base: "HEAD", head: "INDEX", via: "staged-in-command", refusal: plan.reason };
   }
   const mergeHead = frame.gitDir ? (0, import_node_path31.join)(frame.gitDir, "MERGE_HEAD") : null;
-  if (mergeHead && (0, import_node_fs39.existsSync)(mergeHead)) {
+  if (mergeHead && (0, import_node_fs40.existsSync)(mergeHead)) {
     const vsHead = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "HEAD"]).split("\n").filter(Boolean));
     const vsMerge = new Set(frameGit(frame, ["diff", "--cached", "--name-only", "MERGE_HEAD"]).split("\n").filter(Boolean));
     const resolutions = new Set([...vsHead].filter((f) => vsMerge.has(f) && !isVerityOwnedPath(f)));
@@ -26468,7 +26647,7 @@ function truthy(v) {
 }
 
 // src/lib/transcript.ts
-var import_node_fs40 = require("node:fs");
+var import_node_fs41 = require("node:fs");
 var MAX_READ_BYTES = 256 * 1024;
 var SMALL_FILE_BYTES = 64 * 1024;
 var MAX_FILES_LIST = 20;
@@ -26495,7 +26674,7 @@ async function extractActionSummary(transcriptPath) {
 function readTurnLines(transcriptPath) {
   let size;
   try {
-    size = (0, import_node_fs40.statSync)(transcriptPath).size;
+    size = (0, import_node_fs41.statSync)(transcriptPath).size;
   } catch {
     return null;
   }
@@ -26503,7 +26682,7 @@ function readTurnLines(transcriptPath) {
   let raw;
   let windowed = false;
   if (size <= SMALL_FILE_BYTES) {
-    raw = (0, import_node_fs40.readFileSync)(transcriptPath, "utf-8");
+    raw = (0, import_node_fs41.readFileSync)(transcriptPath, "utf-8");
   } else {
     windowed = true;
     const buf = Buffer.alloc(Math.min(MAX_READ_BYTES, size));
@@ -26786,28 +26965,28 @@ async function readStopHookStdin() {
   try {
     if (process.stdin.isTTY) return empty;
     const chunks = [];
-    const timeout = new Promise((resolve8) => setTimeout(() => resolve8(empty), 500));
-    const read2 = new Promise((resolve8) => {
+    const timeout = new Promise((resolve9) => setTimeout(() => resolve9(empty), 500));
+    const read2 = new Promise((resolve9) => {
       process.stdin.on("data", (chunk) => chunks.push(chunk));
       process.stdin.on("end", () => {
         const raw = Buffer.concat(chunks).toString("utf-8").trim();
         if (!raw) {
-          resolve8(empty);
+          resolve9(empty);
           return;
         }
         try {
           const data = JSON.parse(raw);
-          resolve8({
+          resolve9({
             assistantMessage: typeof data.last_assistant_message === "string" ? data.last_assistant_message : null,
             stopReason: typeof data.stop_reason === "string" ? data.stop_reason : null,
             transcriptPath: typeof data.transcript_path === "string" ? data.transcript_path : null,
             sessionId: typeof data.session_id === "string" ? data.session_id : null
           });
         } catch {
-          resolve8(empty);
+          resolve9(empty);
         }
       });
-      process.stdin.on("error", () => resolve8(empty));
+      process.stdin.on("error", () => resolve9(empty));
       process.stdin.resume();
     });
     return await Promise.race([read2, timeout]);
@@ -27073,7 +27252,7 @@ function channelSilence(input) {
 // src/lib/cli-version.ts
 function cliVersion() {
   try {
-    return true ? "0.34.0-experimental.421a631" : "dev";
+    return true ? "0.34.0-experimental.53caba1" : "dev";
   } catch {
     return "dev";
   }
@@ -27114,7 +27293,171 @@ async function sendSkipBeacon(ctx, reason) {
 
 // src/lib/static-analysis.ts
 var import_node_child_process12 = require("node:child_process");
-var import_node_fs41 = require("node:fs");
+var import_node_fs42 = require("node:fs");
+
+// src/lib/environment-globals.ts
+var NODE = [
+  "process",
+  "Buffer",
+  "global",
+  "require",
+  "module",
+  "exports",
+  "__dirname",
+  "__filename",
+  "console",
+  "setTimeout",
+  "clearTimeout",
+  "setInterval",
+  "clearInterval",
+  "setImmediate",
+  "clearImmediate",
+  "queueMicrotask",
+  "structuredClone",
+  "performance",
+  "fetch",
+  "Request",
+  "Response",
+  "Headers",
+  "FormData",
+  "Blob",
+  "File",
+  "URL",
+  "URLSearchParams",
+  "TextEncoder",
+  "TextDecoder",
+  "TextEncoderStream",
+  "TextDecoderStream",
+  "AbortController",
+  "AbortSignal",
+  "Event",
+  "EventTarget",
+  "CustomEvent",
+  "MessageChannel",
+  "MessagePort",
+  "MessageEvent",
+  "BroadcastChannel",
+  "WebSocket",
+  "WebAssembly",
+  "crypto",
+  "Crypto",
+  "CryptoKey",
+  "SubtleCrypto",
+  "atob",
+  "btoa",
+  "navigator",
+  "DOMException",
+  "ReadableStream",
+  "WritableStream",
+  "TransformStream",
+  "CompressionStream",
+  "DecompressionStream",
+  "ByteLengthQueuingStrategy",
+  "CountQueuingStrategy",
+  "PerformanceObserver",
+  "PerformanceEntry",
+  "PerformanceMark",
+  "PerformanceMeasure"
+];
+var BROWSER = [
+  "window",
+  "self",
+  "document",
+  "location",
+  "history",
+  "localStorage",
+  "sessionStorage",
+  "screen",
+  "alert",
+  "confirm",
+  "prompt",
+  "requestAnimationFrame",
+  "cancelAnimationFrame",
+  "requestIdleCallback",
+  "cancelIdleCallback",
+  "getComputedStyle",
+  "matchMedia",
+  "getSelection",
+  "scrollTo",
+  "scrollBy",
+  "innerWidth",
+  "innerHeight",
+  "outerWidth",
+  "outerHeight",
+  "devicePixelRatio",
+  "visualViewport",
+  "postMessage",
+  "addEventListener",
+  "removeEventListener",
+  "dispatchEvent",
+  "customElements",
+  "indexedDB",
+  "IDBKeyRange",
+  "caches",
+  "XMLHttpRequest",
+  "EventSource",
+  "FileReader",
+  "Image",
+  "Audio",
+  "Worker",
+  "SharedWorker",
+  "Notification",
+  "MutationObserver",
+  "IntersectionObserver",
+  "ResizeObserver",
+  "DOMParser",
+  "XMLSerializer",
+  "Node",
+  "Element",
+  "HTMLElement",
+  "SVGElement",
+  "NodeList",
+  "HTMLCollection",
+  "DocumentFragment",
+  "ShadowRoot",
+  "Range",
+  "Selection",
+  "KeyboardEvent",
+  "MouseEvent",
+  "PointerEvent",
+  "FocusEvent",
+  "InputEvent",
+  "TouchEvent",
+  "UIEvent",
+  "ErrorEvent",
+  "ProgressEvent",
+  "StorageEvent",
+  "CloseEvent",
+  "CSS",
+  "CSSStyleSheet",
+  "FontFace",
+  "ImageData",
+  "ImageBitmap",
+  "createImageBitmap",
+  "OffscreenCanvas",
+  "Path2D",
+  "CanvasRenderingContext2D",
+  "AudioContext",
+  "MediaStream",
+  "MediaRecorder",
+  "RTCPeerConnection",
+  "ClipboardItem",
+  "isSecureContext",
+  "crossOriginIsolated",
+  "reportError",
+  "speechSynthesis"
+];
+var ENVIRONMENT_GLOBALS = /* @__PURE__ */ new Set([...NODE, ...BROWSER]);
+var NOT_DEFINED = /^'([^']+)' is not defined\.?$/;
+var COMMONJS_ONLY = /* @__PURE__ */ new Set(["require", "module", "exports", "__dirname", "__filename"]);
+function isEnvironmentGlobalNoUndef(ruleId, message, filePath = "") {
+  if (!/(^|_)no-undef$/.test(ruleId)) return false;
+  const name2 = message.trim().match(NOT_DEFINED)?.[1];
+  if (name2 === void 0 || !ENVIRONMENT_GLOBALS.has(name2)) return false;
+  return !(COMMONJS_ONLY.has(name2) && /\.m[jt]s$/.test(filePath));
+}
+
+// src/lib/static-analysis.ts
 var SEVERITY_ORDER = {
   Error: 0,
   Critical: 0,
@@ -27170,7 +27513,7 @@ function runCodacyAnalysis(files) {
   if (files.length === 0) return empty;
   const existingFiles = files.filter((f) => {
     try {
-      return (0, import_node_fs41.existsSync)(f);
+      return (0, import_node_fs42.existsSync)(f);
     } catch {
       return false;
     }
@@ -27202,7 +27545,10 @@ function interpretAnalyzerRun(run4) {
   } catch {
     return withFailure("unparseable_output", output);
   }
-  const issues = parsed.issues ?? [];
+  const reported = parsed.issues ?? [];
+  const issues = reported.filter(
+    (i2) => !isEnvironmentGlobalNoUndef(i2.patternId ?? "", i2.message ?? "", i2.filePath ?? "")
+  );
   const findings = issues.map((issue) => ({
     rule_id: issue.patternId ?? "",
     tool: issue.toolId ?? "",
@@ -27225,7 +27571,7 @@ function interpretAnalyzerRun(run4) {
   );
   const analyzerErrors = parsed.errors ?? [];
   let failure;
-  if (findings.length === 0) {
+  if (reported.length === 0) {
     if (analyzerErrors.length > 0) {
       const first = analyzerErrors[0];
       failure = {
@@ -27439,7 +27785,7 @@ async function scope(run4) {
 }
 
 // src/lib/specs.ts
-var import_node_fs42 = require("node:fs");
+var import_node_fs43 = require("node:fs");
 var import_node_path32 = require("node:path");
 var SPEC_CANDIDATES = [
   "CLAUDE.md",
@@ -27481,7 +27827,7 @@ function discoverSpecs(consulted = []) {
     const totalCap = relevant ? MAX_TOTAL_SPEC_BYTES : UNCONSULTED_TOTAL_BYTES;
     if (totalBytes >= totalCap) return false;
     if (seen.has(specPath)) return true;
-    if (!(0, import_node_fs42.existsSync)(specPath)) return true;
+    if (!(0, import_node_fs43.existsSync)(specPath)) return true;
     seen.add(specPath);
     const remaining = totalCap - totalBytes;
     const fileCap = relevant ? MAX_SPEC_FILE_BYTES : UNCONSULTED_FILE_BYTES;
@@ -27504,7 +27850,7 @@ function discoverSpecs(consulted = []) {
     if (!addSpec(candidate)) break;
   }
   for (const dir of ["spec", "docs"]) {
-    if (!(0, import_node_fs42.existsSync)(dir)) continue;
+    if (!(0, import_node_fs43.existsSync)(dir)) continue;
     try {
       const mdFiles = findMdFiles(dir, 2).sort();
       for (const mdFile of mdFiles) {
@@ -27519,7 +27865,7 @@ function findMdFiles(dir, maxDepth, depth = 0) {
   if (depth >= maxDepth) return [];
   const result = [];
   try {
-    const entries = (0, import_node_fs42.readdirSync)(dir, { withFileTypes: true });
+    const entries = (0, import_node_fs43.readdirSync)(dir, { withFileTypes: true });
     for (const entry of entries) {
       const fullPath = (0, import_node_path32.join)(dir, entry.name);
       if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -27539,13 +27885,13 @@ function discoverPlans() {
   if (isRealDirectoryChain(process.cwd(), [".claude", "plans"])) {
     sources.push({ root: process.cwd(), prefix: (0, import_node_path32.join)(".claude", "plans") });
   }
-  if (home && (0, import_node_fs42.existsSync)(homePlansDir)) sources.push({ root: homePlansDir, prefix: "" });
+  if (home && (0, import_node_fs43.existsSync)(homePlansDir)) sources.push({ root: homePlansDir, prefix: "" });
   const candidates2 = [];
   const seen = /* @__PURE__ */ new Set();
   for (const source2 of sources) {
     let names2;
     try {
-      names2 = (0, import_node_fs42.readdirSync)(source2.prefix ? (0, import_node_path32.join)(source2.root, source2.prefix) : source2.root);
+      names2 = (0, import_node_fs43.readdirSync)(source2.prefix ? (0, import_node_path32.join)(source2.root, source2.prefix) : source2.root);
     } catch {
       continue;
     }
@@ -27572,7 +27918,7 @@ function isRealDirectoryChain(root, parts2) {
   for (const part of parts2) {
     current = (0, import_node_path32.join)(current, part);
     try {
-      if (!(0, import_node_fs42.lstatSync)(current).isDirectory()) return false;
+      if (!(0, import_node_fs43.lstatSync)(current).isDirectory()) return false;
     } catch {
       return false;
     }
@@ -27587,7 +27933,7 @@ function discoverGuardDocs(rangeFiles2) {
     if (result.length >= MAX_SPEC_FILES) break;
     if (!GUARD_DOC_EXT.test(path)) continue;
     if (path.startsWith("/") || path.includes("..")) continue;
-    if (!(0, import_node_fs42.existsSync)(path)) continue;
+    if (!(0, import_node_fs43.existsSync)(path)) continue;
     const opened = openRegularInRoot(process.cwd(), path);
     if (!opened.ok) continue;
     if (opened.size > MAX_PLAN_FILE_BYTES || totalBytes + opened.size > MAX_TOTAL_SPEC_BYTES) {
@@ -27773,7 +28119,7 @@ async function mode(run4) {
 }
 
 // src/lib/fold.ts
-var import_node_fs43 = require("node:fs");
+var import_node_fs44 = require("node:fs");
 var import_node_path33 = require("node:path");
 var KNOWN_RECORD_TYPES = /* @__PURE__ */ new Set([
   "user",
@@ -27911,7 +28257,7 @@ function candidateRoots(repoRoot2) {
   const norm2 = repoRoot2.replace(/\\/g, "/").replace(/\/+$/, "");
   const out2 = [norm2];
   try {
-    const real = import_node_fs43.realpathSync.native(norm2).replace(/\\/g, "/").replace(/\/+$/, "");
+    const real = import_node_fs44.realpathSync.native(norm2).replace(/\\/g, "/").replace(/\/+$/, "");
     if (real !== norm2) out2.push(real);
   } catch {
   }
@@ -27999,8 +28345,8 @@ function fold(transcriptPath, opts = {}) {
     }
   };
   try {
-    if (!(0, import_node_fs43.existsSync)(transcriptPath)) return result;
-    ingest((0, import_node_fs43.readFileSync)(transcriptPath, "utf8"), "agent");
+    if (!(0, import_node_fs44.existsSync)(transcriptPath)) return result;
+    ingest((0, import_node_fs44.readFileSync)(transcriptPath, "utf8"), "agent");
     result.coverage.complete = true;
   } catch {
     return result;
@@ -28011,19 +28357,19 @@ function fold(transcriptPath, opts = {}) {
       (0, import_node_path33.basename)(transcriptPath).replace(/\.jsonl$/, ""),
       "subagents"
     );
-    if ((0, import_node_fs43.existsSync)(sidecarDir)) {
+    if ((0, import_node_fs44.existsSync)(sidecarDir)) {
       const maxFiles = opts.maxSidecars ?? 200;
       const maxBytes = opts.maxSidecarBytes ?? 16 * 1024 * 1024;
       const found = [];
       const walk2 = (d, depth) => {
         if (depth > 4) return;
-        for (const e of (0, import_node_fs43.readdirSync)(d, { withFileTypes: true })) {
+        for (const e of (0, import_node_fs44.readdirSync)(d, { withFileTypes: true })) {
           const p = (0, import_node_path33.join)(d, e.name);
           if (e.isDirectory()) {
             walk2(p, depth + 1);
           } else if (e.name.startsWith("agent-") && e.name.endsWith(".jsonl")) {
             try {
-              const st = (0, import_node_fs43.statSync)(p);
+              const st = (0, import_node_fs44.statSync)(p);
               found.push({ path: p, size: st.size, mtimeMs: st.mtimeMs });
             } catch {
               result.coverage.malformed++;
@@ -28040,7 +28386,7 @@ function fold(transcriptPath, opts = {}) {
           continue;
         }
         try {
-          ingest((0, import_node_fs43.readFileSync)(f.path, "utf8"), "subagent");
+          ingest((0, import_node_fs44.readFileSync)(f.path, "utf8"), "subagent");
           bytes += f.size;
           result.coverage.subagentFiles++;
         } catch {
@@ -28075,7 +28421,7 @@ function fold(transcriptPath, opts = {}) {
 }
 function classifyUnobserved(path) {
   try {
-    const st = (0, import_node_fs43.statSync)(path);
+    const st = (0, import_node_fs44.statSync)(path);
     if (!st.isFile()) return "unreadable";
   } catch {
     return "unreadable";
@@ -28390,20 +28736,20 @@ async function evidence(run4) {
 }
 
 // src/lib/cache-cleanup.ts
-var import_node_fs44 = require("node:fs");
+var import_node_fs45 = require("node:fs");
 var import_node_path34 = require("node:path");
 var CACHE_TTL_DAYS = 7;
 function pruneStaleCache() {
   try {
     const dir = projectPath(CACHE_DIR);
     const cutoff = Date.now() - CACHE_TTL_DAYS * 24 * 3600 * 1e3;
-    for (const entry of (0, import_node_fs44.readdirSync)(dir)) {
+    for (const entry of (0, import_node_fs45.readdirSync)(dir)) {
       if (!entry.startsWith("pending-")) continue;
       const path = (0, import_node_path34.join)(dir, entry);
       try {
-        const stat3 = (0, import_node_fs44.statSync)(path);
+        const stat3 = (0, import_node_fs45.statSync)(path);
         if (stat3.mtimeMs < cutoff) {
-          (0, import_node_fs44.unlinkSync)(path);
+          (0, import_node_fs45.unlinkSync)(path);
           logEvent("cache_entry_pruned", {
             path: entry,
             age_days: Math.round((Date.now() - stat3.mtimeMs) / 864e5)
@@ -28417,7 +28763,7 @@ function pruneStaleCache() {
 }
 
 // src/lib/context-files.ts
-var import_node_fs45 = require("node:fs");
+var import_node_fs46 = require("node:fs");
 var import_node_os7 = require("node:os");
 var MAX_CONTEXT_FILES = 10;
 var MAX_CONTEXT_FILE_BYTES = 10240;
@@ -28475,7 +28821,7 @@ function gatherContextFiles(contextPaths, deltaFiles, opts) {
       continue;
     }
     try {
-      const content = (0, import_node_fs45.readFileSync)(safePath, "utf8");
+      const content = (0, import_node_fs46.readFileSync)(safePath, "utf8");
       const bytes = Buffer.byteLength(content);
       if (bytes > MAX_CONTEXT_FILE_BYTES) {
         logEvent("context_file_skipped", { path: filePath, reason: "too_large", bytes });
@@ -28541,7 +28887,7 @@ async function contextFiles(run4) {
 }
 
 // src/lib/code/index.ts
-var import_node_crypto12 = require("node:crypto");
+var import_node_crypto13 = require("node:crypto");
 
 // src/lib/code/languages.ts
 var JS_LIKE = {
@@ -28633,7 +28979,7 @@ function languageOf2(path) {
 }
 
 // src/lib/code/runtime.ts
-var import_node_fs46 = require("node:fs");
+var import_node_fs47 = require("node:fs");
 var import_node_path35 = require("node:path");
 var import_web_tree_sitter2 = __toESM2(require_web_tree_sitter2());
 
@@ -28705,7 +29051,7 @@ function grammarCandidates(file, pkg, env = process.env) {
 }
 function locateGrammar(id, env = process.env) {
   const g = grammars_default[id];
-  return grammarCandidates(g.file, g.package, env).find((p) => (0, import_node_fs46.existsSync)(p)) ?? null;
+  return grammarCandidates(g.file, g.package, env).find((p) => (0, import_node_fs47.existsSync)(p)) ?? null;
 }
 var loading = null;
 function loadRuntime(env = process.env) {
@@ -30319,7 +30665,7 @@ function byPath(fns, name2) {
 function makeCodeMap(rt) {
   const cache = /* @__PURE__ */ new Map();
   const outline = (path, content, deadlineAt = Date.now() + DEFAULT_PARSE_MS) => {
-    const key = `${path}\0${(0, import_node_crypto12.createHash)("sha1").update(content).digest("hex")}`;
+    const key = `${path}\0${(0, import_node_crypto13.createHash)("sha1").update(content).digest("hex")}`;
     const hit = cache.get(key);
     if (hit) return { source: "tree-sitter", value: hit, elapsedMs: 0 };
     let r;
@@ -31034,7 +31380,7 @@ async function repoContext(run4) {
 
 // src/lib/seed-runner.ts
 var import_promises15 = require("node:fs/promises");
-var import_node_fs47 = require("node:fs");
+var import_node_fs48 = require("node:fs");
 var import_node_path36 = require("node:path");
 var import_yaml4 = __toESM2(require_dist());
 
@@ -31259,7 +31605,7 @@ async function localSeedTitles(memoryDir3 = MEMORY_DIR) {
   const titles = /* @__PURE__ */ new Set();
   for (const dir of NODE_DIRS) {
     const full = (0, import_node_path36.join)(memoryDir3, dir);
-    if (!(0, import_node_fs47.existsSync)(full)) continue;
+    if (!(0, import_node_fs48.existsSync)(full)) continue;
     let files;
     try {
       files = await (0, import_promises15.readdir)(full);
@@ -31341,7 +31687,7 @@ function renderNodeMarkdown(candidate, nodeId, createdAt) {
   return fm;
 }
 async function runSeed(opts) {
-  if (!(0, import_node_fs47.existsSync)(STANDARD_FILE)) {
+  if (!(0, import_node_fs48.existsSync)(STANDARD_FILE)) {
     return { created: 0, existing: 0, failed: 0, skipped: "no_standard", candidates: [] };
   }
   let standardDoc;
@@ -31353,7 +31699,7 @@ async function runSeed(opts) {
   }
   const knowledgeSpec = standardDoc.knowledge_spec ?? {};
   let readmeContent;
-  if ((0, import_node_fs47.existsSync)("README.md")) {
+  if ((0, import_node_fs48.existsSync)("README.md")) {
     try {
       readmeContent = await (0, import_promises15.readFile)("README.md", "utf-8");
     } catch {
@@ -31361,7 +31707,7 @@ async function runSeed(opts) {
   }
   let claudeMdContent;
   for (const p of ["CLAUDE.md", ".claude/CLAUDE.md"]) {
-    if ((0, import_node_fs47.existsSync)(p)) {
+    if ((0, import_node_fs48.existsSync)(p)) {
       try {
         claudeMdContent = await (0, import_promises15.readFile)(p, "utf-8");
         break;
@@ -31441,7 +31787,7 @@ async function runSeed(opts) {
       continue;
     }
     const deduplicated = res.data.deduplicated === true;
-    if (deduplicated && (0, import_node_fs47.existsSync)(targetPath)) {
+    if (deduplicated && (0, import_node_fs48.existsSync)(targetPath)) {
       existing++;
       continue;
     }
@@ -31463,7 +31809,7 @@ async function runSeed(opts) {
 }
 
 // src/commands/analyze/phases/08-memory-manifest.ts
-var import_node_fs48 = require("node:fs");
+var import_node_fs49 = require("node:fs");
 var import_node_path37 = require("node:path");
 async function memoryManifest(run4) {
   const { globals } = run4;
@@ -31475,8 +31821,8 @@ async function memoryManifest(run4) {
   try {
     await ensureMemoryDir();
     const seedMarker = (0, import_node_path37.join)(VERITY_DIR, ".seeded");
-    const hasStandard = (0, import_node_fs48.existsSync)(STANDARD_FILE);
-    const alreadyTried = (0, import_node_fs48.existsSync)(seedMarker);
+    const hasStandard = (0, import_node_fs49.existsSync)(STANDARD_FILE);
+    const alreadyTried = (0, import_node_fs49.existsSync)(seedMarker);
     if (hasStandard && !alreadyTried) {
       const preManifest = await buildManifest();
       if (preManifest.nodes.length === 0) {
@@ -31489,7 +31835,7 @@ async function memoryManifest(run4) {
             dryRun: false
           });
           if (seedResult.created > 0 || seedResult.existing > 0) {
-            (0, import_node_fs48.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} created=${seedResult.created} existing=${seedResult.existing}
+            (0, import_node_fs49.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} created=${seedResult.created} existing=${seedResult.existing}
 `);
             if (seedResult.created > 0) {
               autoSeedNotice = `Seeded ${seedResult.created} knowledge node(s) from your existing Standard (one-time).`;
@@ -31500,7 +31846,7 @@ async function memoryManifest(run4) {
               failed: seedResult.failed
             });
           } else if (seedResult.skipped === "already_seeded") {
-            (0, import_node_fs48.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} skipped=already_seeded
+            (0, import_node_fs49.writeFileSync)(seedMarker, `${(/* @__PURE__ */ new Date()).toISOString()} skipped=already_seeded
 `);
           } else {
             logEvent("auto_seed_noop", {
@@ -31688,8 +32034,24 @@ async function workingMemory(run4) {
   Object.assign(run4, { incrementReport, memory: memory2, memorySession, reachability });
 }
 
+// src/lib/payload-bounds.ts
+var MAX_WIRE_PATHS = 500;
+function boundPaths(paths, first, max = MAX_WIRE_PATHS) {
+  if (paths.length <= max) return [...paths];
+  const present = new Set(paths);
+  const kept = /* @__PURE__ */ new Set();
+  const out2 = [];
+  for (const p of [...first, ...paths]) {
+    if (out2.length >= max) break;
+    if (!present.has(p) || kept.has(p)) continue;
+    kept.add(p);
+    out2.push(p);
+  }
+  return out2;
+}
+
 // src/lib/note-budget.ts
-var import_node_fs49 = require("node:fs");
+var import_node_fs50 = require("node:fs");
 var ADVISORY_BUDGET = { PASS: 1, WARN: 2 };
 var EPISODE_STALE_SECONDS = 30 * 60;
 var FRESH = { delivered: 0, tasksCompleted: 0, ts: 0 };
@@ -31711,9 +32073,9 @@ function advisoryBudgetSpent(episode, rawDecision) {
 }
 function readAdvisoryEpisode(sessionId) {
   const file = scopedFile(ADVISORY_EPISODE_FILE, sessionId);
-  if (!(0, import_node_fs49.existsSync)(file)) return null;
+  if (!(0, import_node_fs50.existsSync)(file)) return null;
   try {
-    const o = JSON.parse((0, import_node_fs49.readFileSync)(file, "utf-8")) ?? {};
+    const o = JSON.parse((0, import_node_fs50.readFileSync)(file, "utf-8")) ?? {};
     const delivered = typeof o.delivered === "number" ? o.delivered : NaN;
     if (isNaN(delivered)) return null;
     return {
@@ -31727,8 +32089,8 @@ function readAdvisoryEpisode(sessionId) {
 }
 function writeAdvisoryEpisode(episode, sessionId) {
   try {
-    (0, import_node_fs49.mkdirSync)(VERITY_DIR, { recursive: true });
-    (0, import_node_fs49.writeFileSync)(
+    (0, import_node_fs50.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs50.writeFileSync)(
       scopedFile(ADVISORY_EPISODE_FILE, sessionId),
       JSON.stringify({ v: 1, ...episode })
     );
@@ -31802,6 +32164,7 @@ async function buildRequest(run4) {
     (conversation?.prompts?.length ?? 0) > 0
   );
   const noteConfirmation = peekNoteOutcome();
+  const unobserved = foldResult?.unobserved ?? [];
   const excludedByReason = {};
   for (const e of codeDelta.excluded ?? []) {
     excludedByReason[e.reason] = (excludedByReason[e.reason] ?? 0) + 1;
@@ -31846,7 +32209,9 @@ async function buildRequest(run4) {
     coverage_telemetry: coverageTelemetry,
     static_results: staticResults,
     code_delta: codeDelta,
-    changed_files: allForReview,
+    // Bounded, reviewed paths first — the server applies the same bound. The
+    // full count is `coverage_telemetry.for_review`. VRT-242.
+    changed_files: boundPaths(allForReview, codeDelta.files.map((f) => f.path)),
     standard_version: "latest",
     analysis_mode: analysisMode,
     plan_only: analysisMode === "plan",
@@ -31897,7 +32262,9 @@ async function buildRequest(run4) {
         // `hash_at_last_verdict` is frozen at each verdict and `hash_now` tracks
         // disk, so their inequality IS "changed since we last spoke".
         authored_since_verdict: memorySession ? foldDossier(memorySession.d).authored_all.filter((a) => a.hash_now !== a.hash_at_last_verdict).map((a) => a.path) : [],
-        unobserved: foldResult?.unobserved ?? [],
+        // The server reads only how many; a bulk change sent every path. VRT-242.
+        unobserved: unobserved.slice(0, MAX_WIRE_PATHS),
+        ...unobserved.length > MAX_WIRE_PATHS && { unobserved_total: unobserved.length },
         commands: foldResult?.commands ?? [],
         tools: foldResult?.tools ?? [],
         tasks: foldResult?.tasks ?? [],
@@ -32060,14 +32427,14 @@ async function buildRequest(run4) {
 }
 
 // src/lib/offline.ts
-var import_node_fs50 = require("node:fs");
-var import_node_crypto13 = require("node:crypto");
+var import_node_fs51 = require("node:fs");
+var import_node_crypto14 = require("node:crypto");
 function cacheRequest(body2) {
   try {
-    (0, import_node_fs50.mkdirSync)(CACHE_DIR, { recursive: true });
-    const suffix = (0, import_node_crypto13.randomBytes)(4).toString("hex");
+    (0, import_node_fs51.mkdirSync)(CACHE_DIR, { recursive: true });
+    const suffix = (0, import_node_crypto14.randomBytes)(4).toString("hex");
     const filename = `pending-${Math.floor(Date.now() / 1e3)}-${suffix}.json`;
-    (0, import_node_fs50.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(redactRequest(body2)));
+    (0, import_node_fs51.writeFileSync)(`${CACHE_DIR}/${filename}`, JSON.stringify(redactRequest(body2)));
   } catch {
   }
 }
@@ -32108,8 +32475,10 @@ function buildOfflineFallback(reason, staticResults) {
 }
 
 // src/lib/retry.ts
+var WORKER_RESOURCE_LIMIT = 546;
 function shouldWarmRetryAnalyze(result) {
   if (result.ok) return false;
+  if (result.http_status === WORKER_RESOURCE_LIMIT) return false;
   if (result.category === "network" || result.category === "timeout") return true;
   if (result.category === "http_5xx") return true;
   if (result.category === "invalid_json" && (result.http_status ?? 0) >= 500) return true;
@@ -32119,7 +32488,7 @@ function shouldWarmRetryAnalyze(result) {
 // src/commands/analyze/phases/12-transmit.ts
 async function transmit(run4) {
   const { globals } = run4;
-  const { codeDelta, requestBody, serviceUrl, staticResults, token } = run4;
+  const { requestBody, serviceUrl, staticResults, token } = run4;
   const ANALYZE_TIMEOUT_MS = 1e5;
   let result = await analyzeRequest({
     serviceUrl,
@@ -32156,11 +32525,12 @@ async function transmit(run4) {
   }
   if (!result.ok) {
     cacheRequest(requestBody);
+    const sentKb = () => Math.round(Buffer.byteLength(JSON.stringify(requestBody)) / 1024);
     let message;
     if (result.http_status === 413) {
-      const totalBytes = codeDelta.files.reduce((sum, f) => sum + f.content.length, 0);
-      const kb = Math.round(totalBytes / 1024);
-      message = `Verity: request rejected \u2014 payload too large (${kb}KB over the 190KB cap). Commit or stash pre-existing changes, or run with --mode skip if you didn't intend to submit code this turn.`;
+      message = `Verity: request rejected \u2014 payload too large (${sentKb()} KB sent: ${result.error}). Commit or stash pre-existing changes, or run with --mode skip if you didn't intend to submit code this turn.`;
+    } else if (result.http_status === WORKER_RESOURCE_LIMIT) {
+      message = `Verity: the service ran out of CPU or memory on this request (HTTP 546, ${sentKb()} KB sent). This is not a cold start: the same change fails the same way, so it was not retried. Commit or stash unrelated changes to shrink the request (local analysis this run).`;
     } else if (result.category === "network" || result.category === "timeout") {
       message = `Verity offline \u2014 ${result.error}`;
     } else if (result.error.startsWith("STALE_VERIFICATION")) {
@@ -32186,7 +32556,7 @@ async function transmit(run4) {
 }
 
 // src/commands/analyze/phases/13-reconcile.ts
-var import_node_fs51 = require("node:fs");
+var import_node_fs52 = require("node:fs");
 var import_node_path39 = require("node:path");
 async function reconcile(run4) {
   const { actionSummary, allChanged, analyzable, baseline, baselineSessionId, codeDelta, contentHash, conversation, decision, foldResult, memory: memory2, memorySession, response, reviewable, securityFiles, turnId } = run4;
@@ -32216,7 +32586,7 @@ async function reconcile(run4) {
       const st = foldDossier(memorySession.d);
       openElsewhere = openBlockingElsewhere(st.statements, sentPaths, (file, line2) => {
         try {
-          const src = (0, import_node_fs51.readFileSync)((0, import_node_path39.join)(repoRoot(), file), "utf8").split("\n");
+          const src = (0, import_node_fs52.readFileSync)((0, import_node_path39.join)(repoRoot(), file), "utf8").split("\n");
           const at = src[line2 - 1];
           return at === void 0 ? null : lineSha(at);
         } catch {
@@ -33038,7 +33408,7 @@ function registerAnalyzeCommand(program2) {
 var tracing = () => process.env.VERITY_TRACE_PHASES === "1";
 async function runAnalyze(opts, globals) {
   if (!verityConfigured()) {
-    (0, import_node_fs52.writeSync)(2, '[verity] not set up in this project \u2014 run "verity init" first.\n');
+    (0, import_node_fs53.writeSync)(2, isMachineStore((0, import_node_path40.join)(repoRoot(), VERITY_DIR)) ? "[verity] nothing to review in your home directory \u2014 run Verity inside a project.\n" : '[verity] not set up in this project \u2014 run "verity init" first.\n');
     process.exit(0);
   }
   const run4 = createRun(opts, globals);
@@ -33059,11 +33429,12 @@ async function runAnalyze(opts, globals) {
 }
 
 // src/commands/baseline.ts
-var import_node_fs54 = require("node:fs");
+var import_node_fs55 = require("node:fs");
+var import_node_path42 = require("node:path");
 
 // src/lib/project-skills.ts
-var import_node_fs53 = require("node:fs");
-var import_node_path40 = require("node:path");
+var import_node_fs54 = require("node:fs");
+var import_node_path41 = require("node:path");
 var PROJECT_SKILL_NAMES = [
   "verity-setup",
   "verity-analyze",
@@ -33089,14 +33460,14 @@ var LEGACY_SKILL_NAMES = [
 var ALL = [...PROJECT_SKILL_NAMES, ...LEGACY_SKILL_NAMES];
 function staleProjectSkills() {
   const root = projectPath(".claude/skills");
-  if (!(0, import_node_fs53.existsSync)(root)) return [];
-  return ALL.filter((name2) => (0, import_node_fs53.existsSync)((0, import_node_path40.join)(root, name2)));
+  if (!(0, import_node_fs54.existsSync)(root)) return [];
+  return ALL.filter((name2) => (0, import_node_fs54.existsSync)((0, import_node_path41.join)(root, name2)));
 }
 function removeProjectSkills() {
   const root = projectPath(".claude/skills");
   const removed = [];
   for (const name2 of staleProjectSkills()) {
-    (0, import_node_fs53.rmSync)((0, import_node_path40.join)(root, name2), { recursive: true, force: true });
+    (0, import_node_fs54.rmSync)((0, import_node_path41.join)(root, name2), { recursive: true, force: true });
     removed.push(name2);
   }
   return removed;
@@ -33129,6 +33500,7 @@ function registerBaselineCommands(program2) {
       const skewMsg = skew ? `Verity: your global \`verity\` CLI is ${skew.global} but the hooks run ${skew.hooks}. Fix it before using \`verity\` in a terminal: ${skew.remedy}` : null;
       const skewNote = skew ? `Before anything else, including /verity:init's questions, tell the user their global \`verity\` is ${skew.global}, the hooks run ${skew.hooks}, and \`${skew.remedy}\` fixes it. Until they have, do not send them to run \`verity login\` in a terminal: that runs the global one, which can sign this machine in to a different server.` : null;
       if (!verityConfigured()) {
+        if (isMachineStore((0, import_node_path42.join)(repoRoot(), VERITY_DIR))) process.exit(0);
         const how = isPluginInvocation() ? "Tell the user to run /verity:init \u2014 they type it; you cannot invoke it." : "Tell the user to run `verity init` in their terminal.";
         const lines = [
           `Verity is installed but this project is not set up yet, so the quality gate will not review anything here. ${how}`
@@ -33161,13 +33533,13 @@ function registerBaselineCommands(program2) {
       let memoryMsg = null;
       let memoryAgentLine = null;
       const memoryNotice = projectPath(`${VERITY_DIR}/.memory-fence-notice`);
-      if (realStart && !(0, import_node_fs54.existsSync)(memoryNotice)) {
+      if (realStart && !(0, import_node_fs55.existsSync)(memoryNotice)) {
         const trackedGraph = memoryOptOut() ? 0 : committedMemoryFiles().length;
         if (trackedGraph > 0) {
           memoryMsg = `Verity: this project commits its knowledge base (${trackedGraph} files under .verity/memory/), so Verity's generated notes show up in every diff and pull request. Run \`verity memory untrack\` to keep them on disk but out of git, or \`verity memory track\` to keep committing them on purpose.`;
           memoryAgentLine = `This project has ${trackedGraph} knowledge-graph files tracked in git under .verity/memory/. As of Verity 0.32.6 the graph is machine-local by default \u2014 it is rebuilt from the service, and committing it puts generated notes in every pull request. If the user wants that stopped, run \`verity memory untrack\` for them: it keeps every file on disk and stages their removal from the index, so they only need to commit \u2014 and their teammates' working copies will vanish on the next pull and re-sync from the service, which is expected. If they would rather keep committing it, \`verity memory track\` records that and nothing will offer again.`;
           try {
-            (0, import_node_fs54.writeFileSync)(memoryNotice, (/* @__PURE__ */ new Date()).toISOString() + "\n");
+            (0, import_node_fs55.writeFileSync)(memoryNotice, (/* @__PURE__ */ new Date()).toISOString() + "\n");
           } catch {
           }
         }
@@ -33268,10 +33640,16 @@ function hookSource(value) {
 }
 
 // src/commands/review.ts
-var import_node_fs55 = require("node:fs");
+var import_node_fs56 = require("node:fs");
 function registerReviewCommand(program2) {
-  program2.command("review").description("Run on-demand Verity analysis (advisory, never blocks)").requiredOption("--files <paths>", "Comma-separated file list").option("--changed <paths>", "Subset of --files that were modified").option("--intent <text>", "User intent description (max 2000 chars)").option("--specs <paths>", "Comma-separated spec file paths").option("--json", "Output raw JSON response").action(async (opts) => {
+  program2.command("review").description("Run on-demand Verity analysis (advisory, never blocks)").requiredOption("--files <paths>", "Comma-separated file list").option("--changed <paths>", "Subset of --files that were modified").option("--intent <text>", "User intent description (max 2000 chars); - reads it from stdin, so the words never pass through shell quoting").option("--specs <paths>", "Comma-separated spec file paths").option("--json", "Output raw JSON response").action(async (opts) => {
     const globals = program2.opts();
+    const intent = readTextInput(opts.intent, "--intent");
+    if (!intent.ok) {
+      printError(intent.error);
+      process.exit(0);
+    }
+    opts.intent = intent.text;
     try {
       await runReview(opts, globals);
     } catch (err2) {
@@ -33285,7 +33663,7 @@ async function runReview(opts, globals) {
   const changedFiles = opts.changed ? opts.changed.split(",").map((f) => f.trim()).filter(Boolean) : allFiles;
   const analyzable = filterAnalyzable(allFiles);
   const securityFiles = filterSecurity(allFiles);
-  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs55.existsSync)(f) || resolveFile(f) !== null);
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).filter((f) => (0, import_node_fs56.existsSync)(f) || resolveFile(f) !== null);
   const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const codeDelta = collectCodeDelta(allFiles);
   const tokenResult = await resolveToken(globals.token);
@@ -33351,19 +33729,40 @@ async function runReview(opts, globals) {
 }
 
 // src/commands/guard.ts
-var import_node_fs59 = require("node:fs");
-var import_node_path45 = require("node:path");
+var import_node_fs61 = require("node:fs");
+var import_node_path48 = require("node:path");
 
-// src/lib/terminal-text.ts
-var CONTROL = /[\x00-\x08\x0b-\x1f\x7f-\x9f\u061c\u200e\u200f\u2028-\u202e\u2066-\u2069]/g;
-function terminalText(value, max = 4e3) {
-  if (typeof value !== "string") return "";
-  const clean2 = value.replace(CONTROL, "");
-  return clean2.length > max ? `${clean2.slice(0, max - 1)}\u2026` : clean2;
+// src/lib/vendored.ts
+var import_node_fs57 = require("node:fs");
+var import_node_path43 = require("node:path");
+var INSTALLED_SKILL = /^\.claude\/skills\/(verity-[a-z0-9-]+)\/(.+)$/;
+function dataDirOrNull() {
+  try {
+    return resolveDataDir();
+  } catch {
+    return null;
+  }
 }
-function terminalUrl(value) {
-  const clean2 = terminalText(value, 2e3);
-  return /^https?:\/\/\S+$/.test(clean2) ? clean2 : "";
+function shippedSkillFile(path, dataDir = dataDirOrNull()) {
+  const m = path.replace(/\\/g, "/").match(INSTALLED_SKILL);
+  if (!m || !dataDir) return null;
+  const [, skill, rel] = m;
+  if (rel.split("/").some((seg) => seg === ".." || seg === ".")) return null;
+  try {
+    return (0, import_node_fs57.readFileSync)((0, import_node_path43.join)(dataDir, "skills", skill, rel), "utf8");
+  } catch {
+    return null;
+  }
+}
+function partitionVendored(files, read2, dataDir = dataDirOrNull()) {
+  const review = [];
+  const vendored = [];
+  for (const f of files) {
+    const shipped = shippedSkillFile(f, dataDir);
+    if (shipped !== null && read2(f) === shipped) vendored.push(f);
+    else review.push(f);
+  }
+  return { review, vendored };
 }
 
 // src/lib/agent-driver.ts
@@ -33445,7 +33844,7 @@ async function runAgentReview(options) {
   }
   if (!settled) {
     const wait = Math.max(0, remaining() - FINISH_TIMEOUT_MS);
-    await Promise.race([oneShotDone, new Promise((resolve8) => setTimeout(resolve8, wait))]);
+    await Promise.race([oneShotDone, new Promise((resolve9) => setTimeout(resolve9, wait))]);
   }
   const finished = await options.http.post(
     "/agent-review/finish",
@@ -33460,8 +33859,8 @@ async function runAgentReview(options) {
 }
 
 // src/lib/prove/auto.ts
-var import_node_path44 = require("node:path");
-var import_node_crypto18 = require("node:crypto");
+var import_node_path47 = require("node:path");
+var import_node_crypto19 = require("node:crypto");
 
 // src/lib/prove/signals.ts
 var DEFAULT_SINCE = "180 days ago";
@@ -33869,6 +34268,11 @@ async function rankViaServer(candidates2, ctx, auth2) {
     cmd: "prove-rank"
   });
   if (!res.ok) return { ok: false, ranker: "luna", error: res.error, ranked: fallback };
+  const off = res.data;
+  if (off?.enabled === false) {
+    const why = typeof off.reason === "string" ? off.reason.slice(0, 40) : "disabled";
+    return { ok: false, ranker: "luna", error: `formal is off for this project (${why})`, ranked: fallback, disabled: why };
+  }
   const items = Array.isArray(res.data?.items) ? res.data.items : [];
   return { ok: true, ranker: "luna", ranked: applyAnnotations(candidates2, items), costUsd: typeof res.data?.cost_usd === "number" ? res.data.cost_usd : null };
 }
@@ -34593,6 +34997,8 @@ async function generateModel(target, opts) {
     });
     if (!res.ok) return { ok: false, error: res.error };
     const d = res.data ?? {};
+    const off = d;
+    if (off.enabled === false) return { ok: false, error: `formal is off for this project (${typeof off.reason === "string" ? off.reason.slice(0, 40) : "disabled"})` };
     if (d.error && typeof d.error === "object") return { ok: false, error: `${d.error.code ?? "SERVICE_ERROR"}: ${d.error.message ?? "the service failed"}` };
     const usage2 = d.usage && typeof d.usage === "object" ? { inputTokens: Number(d.usage.inputTokens ?? 0), outputTokens: Number(d.usage.outputTokens ?? 0) } : null;
     return acceptAnswer(d, usage2, typeof d.cost_usd === "number" ? d.cost_usd : null);
@@ -34772,8 +35178,7 @@ Rules:
 5. Write the harness as ONE file and run it in the SAME shell call that writes it (a heredoc followed by the run). TypeScript: node --experimental-strip-types harness.ts (detect runtimes only if that fails: node --version, python3 --version); if strip-types is unavailable, remove type annotations ONLY on lines that are not part of the function under test's logic, and say so. Python: python3 harness.py.
 6. Nothing you run can reach the network. Do not try.
 7. Keep it under about eight shell calls. Output tokens are time.
-8. Answer with the JSON object only: verdict (reproduced | diverged | unreplayable), reason (2-4 sentences: what you ran, what the real code did, and how that compares to the trace's final state), harness_files (every file you wrote: path and its line count \u2014 do NOT paste contents, your shell calls already carry them), executed_output (the last relevant stdout, at most 2000 characters), impact (one word, below).
-9. impact \u2014 AFTER the verdict, and never a reason to change it: what the violation you ran costs a user of this code, the most serious one the run showed. money: a balance, charge, refund, price or stock is wrong. access: someone gets access they should not have, or an auth check is bypassed. data: a user's records are lost, corrupted or wrongly duplicated. external: an effect outside the system happens twice or never (a charge, an email, a shipment, a webhook). count: a counter, metric or statistic is off. cache: a cached or derived value is stale until it refreshes. internal: the program's own bookkeeping is off, with no effect a user would see. none: the verdict is not reproduced.
+8. Answer with the JSON object only: verdict (reproduced | diverged | unreplayable), reason (2-4 sentences: what you ran, what the real code did, and how that compares to the trace's final state), harness_files (every file you wrote: path and its line count \u2014 do NOT paste contents, your shell calls already carry them), executed_output (the last relevant stdout, at most 2000 characters).
 
 "reproduced" means the real code, driven by the trace, reached the property violation the model describes. "diverged" means it did not \u2014 the model is wrong about the code, which is a useful answer. "unreplayable" means you could not run the real function faithfully; say why.`;
 var REPLAY_SCHEMA = {
@@ -34791,10 +35196,9 @@ var REPLAY_SCHEMA = {
         required: ["path", "lines"]
       }
     },
-    executed_output: { type: "string" },
-    impact: { type: "string", enum: ["money", "access", "data", "external", "count", "cache", "internal", "none"] }
+    executed_output: { type: "string" }
   },
-  required: ["verdict", "reason", "harness_files", "executed_output", "impact"]
+  required: ["verdict", "reason", "harness_files", "executed_output"]
 };
 function renderBriefInput(brief) {
   const p = brief.property;
@@ -34821,8 +35225,6 @@ function renderBriefInput(brief) {
   }
   return parts2.join("\n");
 }
-var IMPACTS = ["money", "access", "data", "external", "count", "cache", "internal", "none"];
-var isImpact = (v) => typeof v === "string" && IMPACTS.includes(v);
 function stringsIn(value, out2 = [], depth = 0) {
   if (depth > 8) return out2;
   if (typeof value === "string") out2.push(value);
@@ -34864,8 +35266,7 @@ function parseReplayOutput(output) {
           verdict,
           reason: typeof o.reason === "string" ? o.reason.slice(0, 2e3) : "",
           harness_files: Array.isArray(o.harness_files) ? o.harness_files.filter((f) => typeof f.path === "string").map((f) => ({ path: String(f.path).slice(0, 200), lines: Number.isInteger(f.lines) ? f.lines : 0 })) : [],
-          executed_output: typeof o.executed_output === "string" ? o.executed_output.slice(0, 2e3) : "",
-          impact: isImpact(o.impact) ? o.impact : "none"
+          executed_output: typeof o.executed_output === "string" ? o.executed_output.slice(0, 2e3) : ""
         };
       }
     } catch {
@@ -34873,10 +35274,10 @@ function parseReplayOutput(output) {
   }
   return { claim, shellCalls, executedCalls, shellTexts, outputTexts };
 }
-var RESULT_LINE = /REPLAY_RESULT=(reproduced|diverged)\b/;
+var RESULT_LINE = /REPLAY_RESULT=(reproduced|diverged)\b/g;
 function printedResult(outputTexts) {
   let last = null;
-  for (const t of outputTexts) for (const m of t.matchAll(new RegExp(RESULT_LINE.source, "g"))) last = m[1];
+  for (const t of outputTexts) for (const m of t.matchAll(RESULT_LINE)) last = m[1];
   return last;
 }
 var RESULT_MISSING = "the harness never printed REPLAY_RESULT=reproduced on its own stdout \u2014 the verdict was the model's word, not the run's";
@@ -35066,7 +35467,6 @@ async function runReplayInContainer(brief, opts) {
       ...judged,
       executedCalls,
       shellCalls,
-      ...judged.verdict === "reproduced" && parsed.claim ? { impact: parsed.claim.impact } : {},
       executedOutput: parsed.claim?.executed_output ?? "",
       harnessFiles: parsed.claim?.harness_files ?? [],
       usage,
@@ -35113,6 +35513,11 @@ async function runReplayViaServer(brief, auth2, budgetMs = 24e4) {
     return { claimed: null, verdict: "unverified", reason: "", downgrade: res.error, executedCalls: 0, shellCalls: 0, verbatim: none, executedOutput: "", harnessFiles: [], usage: null, durationMs: Date.now() - started, containerId: null, error: res.error };
   }
   const d = res.data ?? {};
+  if (d.enabled === false) {
+    const why = d.reason;
+    const msg = `formal is off for this project (${typeof why === "string" ? why.slice(0, 40) : "disabled"})`;
+    return { claimed: null, verdict: "unverified", reason: "", downgrade: msg, executedCalls: 0, shellCalls: 0, verbatim: none, executedOutput: "", harnessFiles: [], usage: null, durationMs: Date.now() - started, containerId: null, error: msg };
+  }
   if (d.error && typeof d.error === "object") {
     const e = d.error;
     const msg = `${e.code ?? "SERVICE_ERROR"}: ${e.message ?? "the service failed"}`;
@@ -35125,7 +35530,6 @@ async function runReplayViaServer(brief, auth2, budgetMs = 24e4) {
     verdict: verdict === "reproduced" || verdict === "diverged" || verdict === "unreplayable" ? verdict : "unverified",
     reason: typeof d.reason === "string" ? d.reason : "",
     downgrade: typeof d.downgrade === "string" ? d.downgrade : null,
-    ...isImpact(d.impact) ? { impact: d.impact } : {},
     executedCalls: Number(d.executed_calls ?? 0),
     shellCalls: Number(d.shell_calls ?? 0),
     verbatim: { covered: Number(v.covered ?? 0), total: Number(v.total ?? 0), ratio: Number(v.ratio ?? 0), basis: v.basis === "symbol" || v.basis === "file" ? v.basis : "none" },
@@ -35182,18 +35586,18 @@ function renderReplay(model, property, r) {
 // src/lib/prove/runner.ts
 var import_node_child_process15 = require("node:child_process");
 var import_node_os8 = require("node:os");
-var import_node_fs58 = require("node:fs");
+var import_node_fs60 = require("node:fs");
 var import_node_os9 = require("node:os");
-var import_node_path43 = require("node:path");
+var import_node_path46 = require("node:path");
 
 // src/lib/prove/scaffold.ts
-var import_node_fs57 = require("node:fs");
-var import_node_path42 = require("node:path");
+var import_node_fs59 = require("node:fs");
+var import_node_path45 = require("node:path");
 
 // src/lib/prove/safe-write.ts
-var import_node_fs56 = require("node:fs");
-var import_node_crypto14 = require("node:crypto");
-var import_node_path41 = require("node:path");
+var import_node_fs58 = require("node:fs");
+var import_node_crypto15 = require("node:crypto");
+var import_node_path44 = require("node:path");
 var SafeWriteError = class extends Error {
   constructor(reason, path) {
     super(`refusing to write ${path}: ${reason}`);
@@ -35202,10 +35606,10 @@ var SafeWriteError = class extends Error {
     this.name = "SafeWriteError";
   }
 };
-var FLAGS3 = import_node_fs56.constants;
+var FLAGS3 = import_node_fs58.constants;
 var NOFOLLOW2 = FLAGS3.O_NOFOLLOW ?? 0;
 function assertPlainRelative(rel) {
-  if (!rel || (0, import_node_path41.isAbsolute)(rel)) throw new SafeWriteError("bad-path", rel);
+  if (!rel || (0, import_node_path44.isAbsolute)(rel)) throw new SafeWriteError("bad-path", rel);
   for (const part of rel.split(/[\\/]/)) {
     if (part === ".." || part === "" || part === ".") throw new SafeWriteError("bad-path", rel);
   }
@@ -35214,34 +35618,34 @@ function ensureDirsNoFollow(root, rel) {
   const parts2 = rel.split(/[\\/]/);
   let cur = root;
   for (const part of parts2.slice(0, -1)) {
-    cur = (0, import_node_path41.join)(cur, part);
+    cur = (0, import_node_path44.join)(cur, part);
     let st;
     try {
-      st = (0, import_node_fs56.lstatSync)(cur);
+      st = (0, import_node_fs58.lstatSync)(cur);
     } catch {
-      (0, import_node_fs56.mkdirSync)(cur);
+      (0, import_node_fs58.mkdirSync)(cur);
       continue;
     }
     if (st.isSymbolicLink()) throw new SafeWriteError("symlink", cur);
     if (!st.isDirectory()) throw new SafeWriteError("not-regular", cur);
   }
-  return (0, import_node_path41.join)(root, rel);
+  return (0, import_node_path44.join)(root, rel);
 }
 function insideRoot(realRoot, realPath) {
-  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path41.sep) ? realRoot : realRoot + import_node_path41.sep);
+  return realPath === realRoot || realPath.startsWith(realRoot.endsWith(import_node_path44.sep) ? realRoot : realRoot + import_node_path44.sep);
 }
 function removeQuietly(path) {
   try {
-    (0, import_node_fs56.unlinkSync)(path);
+    (0, import_node_fs58.unlinkSync)(path);
   } catch {
   }
 }
 function writeFileInRootNoFollow(root, rel, content) {
   assertPlainRelative(rel);
   const dest = ensureDirsNoFollow(root, rel);
-  const dir = (0, import_node_path41.dirname)(dest);
+  const dir = (0, import_node_path44.dirname)(dest);
   try {
-    const st = (0, import_node_fs56.lstatSync)(dest);
+    const st = (0, import_node_fs58.lstatSync)(dest);
     if (st.isSymbolicLink()) throw new SafeWriteError("symlink", dest);
     if (!st.isFile()) throw new SafeWriteError("not-regular", dest);
   } catch (err2) {
@@ -35249,41 +35653,41 @@ function writeFileInRootNoFollow(root, rel, content) {
   }
   let realRoot;
   try {
-    realRoot = (0, import_node_fs56.realpathSync)(root);
+    realRoot = (0, import_node_fs58.realpathSync)(root);
   } catch {
     throw new SafeWriteError("unwritable", root);
   }
-  const tmp = (0, import_node_path41.join)(dir, `.${(0, import_node_path41.basename)(dest)}.${(0, import_node_crypto14.randomBytes)(6).toString("hex")}.tmp`);
+  const tmp = (0, import_node_path44.join)(dir, `.${(0, import_node_path44.basename)(dest)}.${(0, import_node_crypto15.randomBytes)(6).toString("hex")}.tmp`);
   let fd;
   try {
-    fd = (0, import_node_fs56.openSync)(tmp, import_node_fs56.constants.O_WRONLY | import_node_fs56.constants.O_CREAT | import_node_fs56.constants.O_EXCL | NOFOLLOW2, 420);
+    fd = (0, import_node_fs58.openSync)(tmp, import_node_fs58.constants.O_WRONLY | import_node_fs58.constants.O_CREAT | import_node_fs58.constants.O_EXCL | NOFOLLOW2, 420);
   } catch {
     throw new SafeWriteError("unwritable", tmp);
   }
   try {
-    const opened = (0, import_node_fs56.fstatSync)(fd, { bigint: true });
+    const opened = (0, import_node_fs58.fstatSync)(fd, { bigint: true });
     let realTmp;
     try {
-      realTmp = (0, import_node_fs56.realpathSync)(tmp);
+      realTmp = (0, import_node_fs58.realpathSync)(tmp);
     } catch {
       throw new SafeWriteError("escaped", tmp);
     }
-    const there = (0, import_node_fs56.lstatSync)(realTmp, { bigint: true });
+    const there = (0, import_node_fs58.lstatSync)(realTmp, { bigint: true });
     if (!opened.isFile() || there.ino !== opened.ino || there.dev !== opened.dev || !insideRoot(realRoot, realTmp)) {
       throw new SafeWriteError("escaped", tmp);
     }
     const buf = Buffer.from(content, "utf-8");
     let off = 0;
-    while (off < buf.length) off += (0, import_node_fs56.writeSync)(fd, buf, off, buf.length - off);
+    while (off < buf.length) off += (0, import_node_fs58.writeSync)(fd, buf, off, buf.length - off);
   } catch (err2) {
-    (0, import_node_fs56.closeSync)(fd);
+    (0, import_node_fs58.closeSync)(fd);
     removeQuietly(tmp);
     throw err2 instanceof SafeWriteError ? err2 : new SafeWriteError("unwritable", tmp);
   }
-  (0, import_node_fs56.closeSync)(fd);
+  (0, import_node_fs58.closeSync)(fd);
   try {
-    if (!insideRoot(realRoot, (0, import_node_fs56.realpathSync)(dir)) || (0, import_node_fs56.lstatSync)(dir).isSymbolicLink()) throw new SafeWriteError("escaped", dir);
-    (0, import_node_fs56.renameSync)(tmp, dest);
+    if (!insideRoot(realRoot, (0, import_node_fs58.realpathSync)(dir)) || (0, import_node_fs58.lstatSync)(dir).isSymbolicLink()) throw new SafeWriteError("escaped", dir);
+    (0, import_node_fs58.renameSync)(tmp, dest);
   } catch (err2) {
     removeQuietly(tmp);
     throw err2 instanceof SafeWriteError ? err2 : new SafeWriteError("unwritable", dest);
@@ -35297,9 +35701,9 @@ function pathHasNoLink(root, rel) {
   }
   let cur = root;
   for (const part of rel.split(/[\\/]/)) {
-    cur = cur + import_node_path41.sep + part;
+    cur = cur + import_node_path44.sep + part;
     try {
-      if ((0, import_node_fs56.lstatSync)(cur).isSymbolicLink()) return false;
+      if ((0, import_node_fs58.lstatSync)(cur).isSymbolicLink()) return false;
     } catch {
       return true;
     }
@@ -35609,20 +36013,20 @@ This directory is machine-local and gitignored (see ../.gitignore). Models are
 never committed; what reaches the team is the bug report and the fix.
 `;
 function scaffoldProofs(root) {
-  const proofsDir = (0, import_node_path42.join)(root, PROOFS_DIR);
+  const proofsDir = (0, import_node_path45.join)(root, PROOFS_DIR);
   const written = [];
   const kept = [];
   for (const stray of ["lakefile.lean"]) {
     const rel = `${PROOFS_DIR}/${stray}`;
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path42.join)(root, rel));
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path45.join)(root, rel));
     try {
-      (0, import_node_fs57.rmSync)((0, import_node_path42.join)(root, rel), { force: true });
+      (0, import_node_fs59.rmSync)((0, import_node_path45.join)(root, rel), { force: true });
     } catch {
     }
   }
   for (const f of PROOFS_TEMPLATE_FILES) {
     const rel = `${PROOFS_DIR}/${f.path}`;
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path42.join)(root, rel));
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path45.join)(root, rel));
     const current = readRegularFileInRoot(root, rel, 4 * 1024 * 1024);
     if (current.ok && current.content === f.content) {
       kept.push(rel);
@@ -35635,8 +36039,8 @@ function scaffoldProofs(root) {
     [`${PROOFS_DIR}/.gitignore`, LOCAL_GITIGNORE],
     [`${MODELS_DIR}/README.md`, MODELS_README]
   ]) {
-    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path42.join)(root, rel));
-    if (existsNoFollow((0, import_node_path42.join)(root, rel))) {
+    if (!pathHasNoLink(root, rel)) throw new SafeWriteError("symlink", (0, import_node_path45.join)(root, rel));
+    if (existsNoFollow((0, import_node_path45.join)(root, rel))) {
       kept.push(rel);
       continue;
     }
@@ -35647,7 +36051,7 @@ function scaffoldProofs(root) {
 }
 function existsNoFollow(abs) {
   try {
-    (0, import_node_fs57.lstatSync)(abs);
+    (0, import_node_fs59.lstatSync)(abs);
     return true;
   } catch {
     return false;
@@ -35655,7 +36059,7 @@ function existsNoFollow(abs) {
 }
 
 // src/lib/prove/report.ts
-var import_node_crypto15 = require("node:crypto");
+var import_node_crypto16 = require("node:crypto");
 var IDENT2 = /^[A-Za-z0-9_][A-Za-z0-9_.-]{0,63}$/;
 var SHA256 = /^(sha256:)?[0-9a-f]{64}$/;
 var KINDS2 = /* @__PURE__ */ new Set(["structural", "intent"]);
@@ -35803,7 +36207,7 @@ function sha256InRoot(root, file) {
   const opened = openRegularInRoot(root, file);
   if (!opened.ok) return null;
   try {
-    return (0, import_node_crypto15.createHash)("sha256").update(readOpened(opened.fd, opened.size)).digest("hex");
+    return (0, import_node_crypto16.createHash)("sha256").update(readOpened(opened.fd, opened.size)).digest("hex");
   } catch {
     return null;
   }
@@ -35905,16 +36309,17 @@ function renderReport(r) {
 
 // src/lib/prove/runner.ts
 function verityLeanHome(env = process.env) {
-  return env.VERITY_LEAN_HOME ?? (0, import_node_path43.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".verity", "lean");
+  return env.VERITY_LEAN_HOME ?? (0, import_node_path46.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".verity", "lean");
 }
 function findToolchain(env = process.env) {
-  const managedBin = (0, import_node_path43.join)(verityLeanHome(env), LEAN_TOOLCHAIN.replace(/^leanprover\/lean4:/, ""), "bin");
-  const elanBin = (0, import_node_path43.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "bin");
-  const path = [managedBin, elanBin, env.PATH ?? ""].filter(Boolean).join(import_node_path43.delimiter);
+  const managedBin = (0, import_node_path46.join)(verityLeanHome(env), LEAN_TOOLCHAIN.replace(/^leanprover\/lean4:/, ""), "bin");
+  const elanBin = (0, import_node_path46.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "bin");
+  const elanHas = (0, import_node_fs60.existsSync)((0, import_node_path46.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "toolchains", LEAN_TOOLCHAIN.replace("/", "--").replace(":", "---")));
+  const userPath = (env.PATH ?? "").split(import_node_path46.delimiter).filter((d) => d && (elanHas || (0, import_node_path46.resolve)(d) !== (0, import_node_path46.resolve)(elanBin)));
+  const path = [managedBin, ...elanHas ? [elanBin] : [], ...userPath].join(import_node_path46.delimiter);
   const merged = { ...env, PATH: path, ELAN_TOOLCHAIN: env.ELAN_TOOLCHAIN ?? LEAN_TOOLCHAIN };
-  const elanHas = (0, import_node_fs58.existsSync)((0, import_node_path43.join)(env.HOME ?? (0, import_node_os9.homedir)(), ".elan", "toolchains", LEAN_TOOLCHAIN.replace("/", "--").replace(":", "---")));
   const exe = process.platform === "win32" ? "lake.exe" : "lake";
-  const candidates2 = [(0, import_node_path43.join)(managedBin, exe), ...elanHas ? [(0, import_node_path43.join)(elanBin, exe)] : [], exe];
+  const candidates2 = [(0, import_node_path46.join)(managedBin, exe), ...elanHas ? [(0, import_node_path46.join)(elanBin, exe)] : [], exe];
   for (const candidate of candidates2) {
     try {
       (0, import_node_child_process15.execFileSync)(candidate, ["--version"], { env: merged, stdio: ["ignore", "pipe", "pipe"], timeout: 1e4 });
@@ -35952,7 +36357,7 @@ function run2(tc, cwd, args2, timeoutMs) {
 function runAsync(tc, cwd, args2, timeoutMs) {
   const started = Date.now();
   const MAX = 16 * 1024 * 1024;
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const posix = (0, import_node_os8.platform)() !== "win32";
     const child = (0, import_node_child_process15.spawn)(tc.lake, args2, { cwd, env: tc.env, stdio: ["ignore", "pipe", "pipe"], detached: posix });
     let stdout = "";
@@ -35980,8 +36385,8 @@ function runAsync(tc, cwd, args2, timeoutMs) {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      if (ok) resolve8({ ok: true, stdout, stderr: "", durationMs: Date.now() - started, timedOut: false });
-      else resolve8({ ok: false, stdout, stderr: stderr || message || "", durationMs: Date.now() - started, timedOut });
+      if (ok) resolve9({ ok: true, stdout, stderr: "", durationMs: Date.now() - started, timedOut: false });
+      else resolve9({ ok: false, stdout, stderr: stderr || message || "", durationMs: Date.now() - started, timedOut });
     };
     child.on("error", (err2) => finish(false, err2.message));
     child.on("close", (code) => finish(code === 0 && !timedOut));
@@ -35989,53 +36394,80 @@ function runAsync(tc, cwd, args2, timeoutMs) {
 }
 var DEFAULT_BUILD_TIMEOUT_MS = 10 * 6e4;
 var DEFAULT_CHECK_TIMEOUT_MS = 12e4;
+function proofsWorkspaceProblem(root) {
+  for (const rel of [".verity", PROOFS_DIR, `${PROOFS_DIR}/.lake`]) {
+    let st;
+    try {
+      st = (0, import_node_fs60.lstatSync)((0, import_node_path46.join)(root, rel));
+    } catch {
+      break;
+    }
+    if (st.isSymbolicLink()) return `${rel} is a symlink; Lean is not run through it`;
+  }
+  const r = runGitSync(root, ["ls-files", "-z", "--", PROOFS_DIR], { timeoutMs: 5e3 });
+  if (!r.ok) return `could not confirm with git that ${PROOFS_DIR} holds no committed files; Lean is not run`;
+  const tracked = r.stdout.split("\0").filter(Boolean);
+  if (tracked.length > 0) {
+    return `${tracked.length} file(s) under ${PROOFS_DIR} are tracked in git (e.g. ${tracked[0]}); Lean is not run on a workspace the repository supplies \u2014 untrack them with: git rm -r --cached ${PROOFS_DIR}`;
+  }
+  return null;
+}
+function refused(problem) {
+  return { ok: false, stdout: "", stderr: problem, durationMs: 0, timedOut: false };
+}
 function buildLibrary(tc, root, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS) {
-  return run2(tc, (0, import_node_path43.join)(root, PROOFS_DIR), ["build"], timeoutMs);
+  const problem = proofsWorkspaceProblem(root);
+  if (problem) return refused(problem);
+  return run2(tc, (0, import_node_path46.join)(root, PROOFS_DIR), ["build"], timeoutMs);
 }
-function buildLibraryAsync(tc, root, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS) {
-  return runAsync(tc, (0, import_node_path43.join)(root, PROOFS_DIR), ["build"], timeoutMs);
+async function buildLibraryAsync(tc, root, timeoutMs = DEFAULT_BUILD_TIMEOUT_MS) {
+  const problem = proofsWorkspaceProblem(root);
+  if (problem) return refused(problem);
+  return runAsync(tc, (0, import_node_path46.join)(root, PROOFS_DIR), ["build"], timeoutMs);
 }
 function isModelInRoot(modelsAbs, rel) {
-  if (!rel.endsWith(".lean") || (0, import_node_path43.isAbsolute)(rel) || rel.startsWith("..")) return false;
+  if (!rel.endsWith(".lean") || (0, import_node_path46.isAbsolute)(rel) || rel.startsWith("..")) return false;
   return statRegularInRoot(modelsAbs, rel).ok;
 }
 function resolveModelFile(root, arg) {
-  const modelsAbs = (0, import_node_path43.join)(root, MODELS_DIR);
-  const asPath = (0, import_node_path43.relative)(modelsAbs, (0, import_node_path43.isAbsolute)(arg) ? arg : (0, import_node_path43.resolve)(root, arg));
+  const modelsAbs = (0, import_node_path46.join)(root, MODELS_DIR);
+  const asPath = (0, import_node_path46.relative)(modelsAbs, (0, import_node_path46.isAbsolute)(arg) ? arg : (0, import_node_path46.resolve)(root, arg));
   const candidates2 = arg.includes("/") || arg.includes("\\") ? [asPath] : [arg, `${arg}.lean`];
   for (const rel of candidates2) {
-    if (isModelInRoot(modelsAbs, rel)) return (0, import_node_path43.join)(modelsAbs, rel);
+    if (isModelInRoot(modelsAbs, rel)) return (0, import_node_path46.join)(modelsAbs, rel);
   }
   return null;
 }
 function listModelFiles(root) {
-  const modelsAbs = (0, import_node_path43.join)(root, MODELS_DIR);
-  if (!(0, import_node_fs58.existsSync)(modelsAbs)) return [];
-  return (0, import_node_fs58.readdirSync)(modelsAbs).filter((f) => isModelInRoot(modelsAbs, f)).sort().map((f) => (0, import_node_path43.join)(modelsAbs, f));
+  const modelsAbs = (0, import_node_path46.join)(root, MODELS_DIR);
+  if (!(0, import_node_fs60.existsSync)(modelsAbs)) return [];
+  return (0, import_node_fs60.readdirSync)(modelsAbs).filter((f) => isModelInRoot(modelsAbs, f)).sort().map((f) => (0, import_node_path46.join)(modelsAbs, f));
 }
 function trimDiagnostics(text) {
   return text.split("\n").filter((l) => !l.startsWith("trace:")).join("\n").trim().slice(0, 4e3);
 }
 function checkModel(tc, root, modelFile, opts = {}) {
-  const proofsAbs = (0, import_node_path43.join)(root, PROOFS_DIR);
-  const rel = (0, import_node_path43.relative)(proofsAbs, modelFile);
-  const res = run2(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
+  const proofsAbs = (0, import_node_path46.join)(root, PROOFS_DIR);
+  const rel = (0, import_node_path46.relative)(proofsAbs, modelFile);
+  const problem = proofsWorkspaceProblem(root);
+  const res = problem ? refused(problem) : run2(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
   return toReport(res, root, modelFile, opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
 }
 async function checkModelAsync(tc, root, modelFile, opts = {}) {
-  const proofsAbs = (0, import_node_path43.join)(root, PROOFS_DIR);
-  const rel = (0, import_node_path43.relative)(proofsAbs, modelFile);
-  const res = await runAsync(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
+  const proofsAbs = (0, import_node_path46.join)(root, PROOFS_DIR);
+  const rel = (0, import_node_path46.relative)(proofsAbs, modelFile);
+  const problem = proofsWorkspaceProblem(root);
+  const res = problem ? refused(problem) : await runAsync(tc, proofsAbs, ["env", "lean", rel], opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
   return toReport(res, root, modelFile, opts.timeoutMs ?? DEFAULT_CHECK_TIMEOUT_MS);
 }
 function toReport(res, root, modelFile, timeoutMs) {
   const parsed = parseVerityLines(res.stdout);
   const combined = `${res.stdout}
 ${res.stderr}`;
-  const name2 = parsed.header?.model ?? (0, import_node_path43.basename)(modelFile, ".lean");
+  const name2 = parsed.header?.model ?? (0, import_node_path46.basename)(modelFile, ".lean");
   const report = {
     model: name2,
-    file: (0, import_node_path43.relative)(root, modelFile),
+    file: (0, import_node_path46.relative)(root, modelFile),
     ok: res.ok,
     header: parsed.header,
     properties: parsed.properties,
@@ -36080,33 +36512,18 @@ function writeResult(root, report) {
 function isCrashTrace(trace) {
   return trace.some((s) => /\b(crash\w*|kill\w*|restart\w*|interrupt\w*|power|abort\w*|process (dies|exit\w*)|lost (reply|response))\b/i.test(s));
 }
-var SEVERITY_BY_IMPACT = {
-  money: "high",
-  access: "high",
-  data: "high",
-  external: "high",
-  count: "medium",
-  cache: "medium",
-  internal: "medium",
-  // A reproduced finding always has a real code; 'none' here is a malformed answer, so it blocks.
-  none: "high"
-};
-function formalSeverity(f) {
-  return f.impact && SEVERITY_BY_IMPACT[f.impact] || "high";
-}
 function mergeFormalFindings(response, outcome, pushedFiles) {
-  if (!outcome) return { blocking: 0, warning: 0 };
+  if (!outcome) return { blocking: 0 };
   const norm2 = (p) => p.replace(/\\/g, "/");
   const pushed = new Set(pushedFiles.map(norm2));
-  const reproduced = outcome.findings.filter((f) => f.verdict === "reproduced" && !f.waived && pushed.has(norm2(f.file)));
-  if (reproduced.length === 0) return { blocking: 0, warning: 0 };
-  const blocking = reproduced.filter((f) => formalSeverity(f) === "high");
+  const blocking = outcome.findings.filter((f) => f.verdict === "reproduced" && !f.waived && pushed.has(norm2(f.file)));
+  if (blocking.length === 0) return { blocking: 0 };
   const existing = Array.isArray(response.findings) ? response.findings : [];
   response.findings = [
     ...existing,
-    ...reproduced.map((f) => ({
+    ...blocking.map((f) => ({
       pattern_id: "formal-counterexample",
-      severity: formalSeverity(f),
+      severity: "high",
       scope: "change",
       file: f.file,
       line: outcome.target?.lines?.from ?? null,
@@ -36114,19 +36531,18 @@ function mergeFormalFindings(response, outcome, pushedFiles) {
       // as a title it read backwards (e2e, 2026-09-26). A trace that needs a
       // crash between two writes is labelled: reproducing it means injecting
       // the crash, so it is a crash-consistency finding, not a race.
-      title: `Formal: ${terminalText(f.symbol, 128)} breaks "${terminalText(f.desc, 280)}"${isCrashTrace(f.trace) ? " after a crash (crash consistency)" : ""} \u2014 reproduced on the real code${f.impact && f.impact !== "none" ? ` (impact: ${f.impact})` : ""}`,
+      title: `Formal: ${terminalText(f.symbol, 128)} breaks "${terminalText(f.desc, 280)}"${isCrashTrace(f.trace) ? " after a crash (crash consistency)" : ""} \u2014 reproduced on the real code`,
       description: terminalText(f.reason ?? "", 2e3),
       fix: { description: `Trace: ${terminalText(f.trace.join(" \u2192 ") || "(initial state)", 2e3)}. Replay: ${terminalText(f.reason ?? "reproduced in the container", 2e3)}` },
       source: "formal"
     }))
   ];
-  if (blocking.length > 0) response.gate_decision = "FAIL";
-  else if (response.gate_decision === "PASS" || response.gate_decision == null) response.gate_decision = "WARN";
-  return { blocking: blocking.length, warning: reproduced.length - blocking.length };
+  if (response.gate_decision !== "FAIL") response.gate_decision = "FAIL";
+  return { blocking: blocking.length };
 }
 
 // src/lib/prove/scalpel.ts
-var import_node_crypto16 = require("node:crypto");
+var import_node_crypto17 = require("node:crypto");
 var ARITHMETIC = /Math\.(?:round|floor|ceil|trunc)\(|\bround\(|\bdivmod\(|[\w)\]]\s*(?:\*|\/(?!\/)|%)\s*[\w(]/;
 function functionHazard(numbered2) {
   const sites = effectSites(numbered2);
@@ -36156,7 +36572,7 @@ function semanticFingerprint(numbered2) {
     if (LOG_LINE.test(t)) continue;
     kept.push(t.replace(/\s+/g, " "));
   }
-  return (0, import_node_crypto16.createHash)("sha256").update(kept.join("\n")).digest("hex");
+  return (0, import_node_crypto17.createHash)("sha256").update(kept.join("\n")).digest("hex");
 }
 function readVerified(root, now = Date.now()) {
   const read2 = readRegularFileInRoot(root, VERIFIED_FILE, 256 * 1024);
@@ -36179,9 +36595,9 @@ function recordVerified(root, rec, now = Date.now()) {
 }
 
 // src/lib/prove/context.ts
-var import_node_crypto17 = require("node:crypto");
+var import_node_crypto18 = require("node:crypto");
 var CONTEXT_BUDGET_MS = 2e3;
-var sha256 = (s) => (0, import_node_crypto17.createHash)("sha256").update(s).digest("hex");
+var sha256 = (s) => (0, import_node_crypto18.createHash)("sha256").update(s).digest("hex");
 var TEST_PATH4 = /(^|\/)(tests?|__tests__|spec)\/|\.(test|spec)\.[a-z]+$/;
 function slice(content, f, maxLines) {
   const all = content.split("\n");
@@ -36370,7 +36786,7 @@ function workingTreeReader(root) {
   };
 }
 function sha256Of(content) {
-  return (0, import_node_crypto18.createHash)("sha256").update(content).digest("hex");
+  return (0, import_node_crypto19.createHash)("sha256").update(content).digest("hex");
 }
 function defaultDeps(opts) {
   const env = opts.env ?? process.env;
@@ -36441,9 +36857,7 @@ async function runFormalPhase(input) {
         symbol: f.symbol,
         verdict: "reproduced",
         reason: f.waived ? `waived ${f.waived.at.slice(0, 10)}: ${f.waived.reason} (standing since ${f.at.slice(0, 10)}; the file has not changed)` : `${f.reason ?? "reproduced on the real code"} (standing since ${f.at.slice(0, 10)}; the file has not changed)`,
-        ...f.waived ? { waived: true } : {},
-        // A hand-edited file cannot invent a code: unknown values read as absent (HIGH).
-        ...isImpact(f.impact) ? { impact: f.impact } : {}
+        ...f.waived ? { waived: true } : {}
       });
     }
   }
@@ -36482,6 +36896,7 @@ async function runFormalPhase(input) {
     return done({ status: "skipped", skip: "not-eligible", detail: `${best.file}: ${isEligible(best, largePush).why}` });
   }
   const ranked = await deps.rank(eligible, root, input.changedLines);
+  if (!ranked.ok && ranked.disabled) return done({ status: "skipped", skip: "disabled-by-server", detail: ranked.error });
   if (ranked.ok) spend(ranked);
   candidates2 = ranked.ranked.slice(0, 5).map((c) => ({ file: c.file, symbol: c.ai?.symbol ?? null, score: c.ai?.score ?? null, criteria: c.ai?.criteria ?? null, reasked: !!c.ai?.reasked, reasons: (c.ai?.reasons ?? []).map((r) => r.slice(0, 200)) }));
   if (cancelled()) return done({ status: "skipped", skip: "deadline", detail: "cut off after ranking" });
@@ -36622,7 +37037,7 @@ async function runFormalPhase(input) {
     modelName = gen.name;
     const rel = `${AUTO_MODELS_DIR}/${gen.name}.lean`;
     writeFileInRootNoFollow(root, rel, gen.source);
-    const abs = resolveModelFile(root, rel) ?? (0, import_node_path44.join)(root, rel);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path47.join)(root, rel);
     progress.model = { name: gen.name, file: rel, rounds: round };
     progress.step = "check";
     report = await deps.check(root, abs);
@@ -36683,11 +37098,11 @@ async function runFormalPhase(input) {
   const budget = Math.max(2e4, timeLeft() - 5e3);
   const byId = /* @__PURE__ */ new Map();
   let stoppedEarly = false;
-  await new Promise((resolve8) => {
+  await new Promise((resolve9) => {
     let left = toReplay.length;
-    if (left === 0) return resolve8();
+    if (left === 0) return resolve9();
     const settle = () => {
-      if (--left === 0) resolve8();
+      if (--left === 0) resolve9();
     };
     for (const p of toReplay) {
       void (async () => {
@@ -36700,7 +37115,7 @@ async function runFormalPhase(input) {
         if (!stoppedEarly) byId.set(p.id, r);
         if (r.verdict === "reproduced" && !stoppedEarly && !isCrash(p)) {
           stoppedEarly = true;
-          resolve8();
+          resolve9();
         }
       })().catch(() => {
         byId.set(p.id, null);
@@ -36716,7 +37131,7 @@ async function runFormalPhase(input) {
       continue;
     }
     const verdict = r.verdict === "reproduced" ? "reproduced" : r.verdict === "diverged" ? "diverged" : r.verdict === "unreplayable" ? "model-only" : "unverified";
-    findings.push({ ...baseOf(p), verdict, reason: r.reason || r.downgrade || void 0, ...verdict === "reproduced" && r.impact ? { impact: r.impact } : {} });
+    findings.push({ ...baseOf(p), verdict, reason: r.reason || r.downgrade || void 0 });
   }
   const reproduced = findings.filter((f) => f.verdict === "reproduced");
   if (reproduced.length > 0 && !cancelled()) {
@@ -36724,7 +37139,7 @@ async function runFormalPhase(input) {
     const others = readPersistedFindings(root).filter((f) => f.file !== top.file);
     writePersistedFindings(root, [
       ...others,
-      ...reproduced.map((f) => ({ file: f.file, symbol: f.symbol, sha256: sha2562, property: f.property, desc: f.desc, kind: f.kind, trace: f.trace, model: modelName, reason: f.reason, ...f.impact ? { impact: f.impact } : {}, ...lines ? { lines } : {}, at: now }))
+      ...reproduced.map((f) => ({ file: f.file, symbol: f.symbol, sha256: sha2562, property: f.property, desc: f.desc, kind: f.kind, trace: f.trace, model: modelName, reason: f.reason, ...lines ? { lines } : {}, at: now }))
     ]);
   }
   const clean2 = findings.every((f) => f.verdict === "diverged");
@@ -36744,7 +37159,7 @@ async function runFormalPhase(input) {
   return done({
     status: "checked",
     target,
-    model: { name: modelName, file: (0, import_node_path44.relative)(root, (0, import_node_path44.join)(root, modelFile)), rounds },
+    model: { name: modelName, file: (0, import_node_path47.relative)(root, (0, import_node_path47.join)(root, modelFile)), rounds },
     properties: report.properties,
     findings
   });
@@ -36807,7 +37222,7 @@ async function generateAndCheck(root, req, opts) {
     }
     const rel = `${dir}/${gen.name}.lean`;
     writeFileInRootNoFollow(root, rel, gen.source);
-    const abs = resolveModelFile(root, rel) ?? (0, import_node_path44.join)(root, rel);
+    const abs = resolveModelFile(root, rel) ?? (0, import_node_path47.join)(root, rel);
     const report = await opts.deps.check(root, abs);
     const abstracts = report.header?.abstracts ?? [];
     const stray = abstracts.find((a) => !headerFiles.has(a.file)) ?? (abstracts[0] && abstracts[0].file !== req.file ? abstracts[0] : void 0);
@@ -36845,6 +37260,8 @@ async function prepareFormalPhase(root, env = process.env, auth2, readSource, co
   const apiKey = direct ? env.OPENAI_API_KEY : void 0;
   const toolchain = findToolchain(env);
   if (!toolchain) return { ok: false, skip: "no-toolchain" };
+  const untrusted = proofsWorkspaceProblem(root);
+  if (untrusted) return { ok: false, skip: "workspace-untrusted", detail: untrusted.slice(0, 200) };
   try {
     scaffoldProofs(root);
   } catch (err2) {
@@ -36893,10 +37310,10 @@ function runFormalPhaseWithin(input) {
   if (left <= 0) return Promise.resolve(skippedOutcome("deadline", "no time left"));
   const progress = input.progress ?? {};
   let timer = null;
-  const cutoff = new Promise((resolve8) => {
+  const cutoff = new Promise((resolve9) => {
     timer = setTimeout(() => {
       progress.cancelled = true;
-      resolve8(cutOffOutcome(progress, `hard stop after ${Math.round(left / 1e3)} s during ${progress.step ?? "setup"}`, left));
+      resolve9(cutOffOutcome(progress, `hard stop after ${Math.round(left / 1e3)} s during ${progress.step ?? "setup"}`, left));
     }, left);
   });
   return Promise.race([runFormalPhase({ ...input, progress }), cutoff]).finally(() => {
@@ -36933,13 +37350,14 @@ function describeFormalOutcome(o) {
 var EXCERPT_SOURCE_MAX_BYTES = 2 * 1024 * 1024;
 var WRITERS_BUDGET_MS = 1500;
 var EXCERPT_MAX_LINES2 = 30;
+var VENDORED_READ_MAX_BYTES = 256 * 1024;
 var GUARD_BLOCK_CAP = 2;
-var GUARD_ITER_FILE = (0, import_node_path45.join)(VERITY_DIR, ".guard-iteration");
+var GUARD_ITER_FILE = (0, import_node_path48.join)(VERITY_DIR, ".guard-iteration");
 function readPreToolUseStdin() {
   const empty = { command: "", cwd: null, sessionId: null };
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     try {
-      if (process.stdin.isTTY) return resolve8(empty);
+      if (process.stdin.isTTY) return resolve9(empty);
       const chunks = [];
       let timer;
       let settled = false;
@@ -36952,7 +37370,7 @@ function readPreToolUseStdin() {
         process.stdin.removeListener("end", onEnd);
         process.stdin.removeListener("error", onError);
         process.stdin.pause();
-        resolve8(value);
+        resolve9(value);
       };
       const onEnd = () => {
         try {
@@ -36973,13 +37391,13 @@ function readPreToolUseStdin() {
       process.stdin.on("error", onError);
       process.stdin.resume();
     } catch {
-      resolve8(empty);
+      resolve9(empty);
     }
   });
 }
 function readIterMap() {
   try {
-    const raw = JSON.parse((0, import_node_fs59.readFileSync)(GUARD_ITER_FILE, "utf-8"));
+    const raw = JSON.parse((0, import_node_fs61.readFileSync)(GUARD_ITER_FILE, "utf-8"));
     if (raw && typeof raw === "object") {
       if (typeof raw.moment === "string" && typeof raw.count === "number") {
         return { [raw.moment]: raw.count };
@@ -36999,10 +37417,10 @@ function readIter(moment) {
 }
 function writeIter(moment, count) {
   try {
-    (0, import_node_fs59.mkdirSync)(VERITY_DIR, { recursive: true });
+    (0, import_node_fs61.mkdirSync)(VERITY_DIR, { recursive: true });
     const map = readIterMap();
     map[moment] = count;
-    (0, import_node_fs59.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+    (0, import_node_fs61.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
   } catch {
   }
 }
@@ -37012,10 +37430,10 @@ function resetIter(moment) {
     if (!(moment in map)) return;
     delete map[moment];
     if (Object.keys(map).length === 0) {
-      if ((0, import_node_fs59.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs59.unlinkSync)(GUARD_ITER_FILE);
+      if ((0, import_node_fs61.existsSync)(GUARD_ITER_FILE)) (0, import_node_fs61.unlinkSync)(GUARD_ITER_FILE);
     } else {
-      (0, import_node_fs59.mkdirSync)(VERITY_DIR, { recursive: true });
-      (0, import_node_fs59.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
+      (0, import_node_fs61.mkdirSync)(VERITY_DIR, { recursive: true });
+      (0, import_node_fs61.writeFileSync)(GUARD_ITER_FILE, JSON.stringify(map));
     }
   } catch {
   }
@@ -37085,7 +37503,7 @@ function hasBlockingFinding(response, sentFiles) {
 function buildGuardRequest(moment, files, codeDelta, iter, sessionId, statedIntent, coverageTelemetry) {
   const analyzable = filterAnalyzable(files);
   const securityFiles = filterSecurity(files);
-  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs59.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
+  const scannable = Array.from(/* @__PURE__ */ new Set([...analyzable, ...securityFiles])).map((f) => (0, import_node_fs61.existsSync)(f) ? f : resolveFile(f)).filter((f) => f !== null);
   const staticResults = runCodacyAnalysisIfAvailable(scannable);
   const trigger = moment === "pre-commit" ? "hook:pre-commit" : "hook:pre-push";
   const requestBody = {
@@ -37322,7 +37740,15 @@ async function runGuard(opts, globals) {
       `Verity ${moment}: this command stages files as it runs and the resulting set could not be resolved (${range.refusal}); the ${verb} was allowed WITHOUT a Verity review. Stage first (\`git add \u2026\`) and re-run the ${verb} to have it reviewed.`
     );
   }
-  const files = rangeFiles(frame, range);
+  const committed = revisionSource(
+    frame.worktreeRoot ?? process.cwd(),
+    range.kind === "push" && range.head !== "INDEX" ? range.head : null
+  );
+  const { review: files, vendored } = partitionVendored(rangeFiles(frame, range), (p) => {
+    const read2 = committed.read(p, VENDORED_READ_MAX_BYTES);
+    return read2.ok ? read2.content : null;
+  });
+  if (vendored.length > 0) logEvent("guard_vendored", { moment, n: vendored.length, paths: vendored.slice(0, 20) });
   if (files.length === 0) process.exit(0);
   const tokenResult = await resolveToken(globals.token);
   const urlResult = await resolveServiceUrl(globals.serviceUrl);
@@ -37462,8 +37888,6 @@ async function runGuard(opts, globals) {
       rounds: formalOutcome.model?.rounds ?? null,
       properties: formalOutcome.properties?.map((p) => `${p.id}:${p.result}`) ?? [],
       findings: formalOutcome.findings.map((f) => `${f.property}:${f.verdict}`),
-      // Decision 82: the replay's impact code per reproduced finding; count/cache/internal warn, the rest block.
-      impacts: formalOutcome.findings.filter((f) => f.impact).map((f) => `${f.property}:${f.impact}`),
       // Decision 81: what each property rests on (a rule, or "line"), what was
       // sent back or dropped as ungrounded, and which counterexamples lack their
       // property's trigger (shadow). Ids and rule names only, never code.
@@ -37704,8 +38128,8 @@ function registerIgnoreCommand(program2) {
 }
 
 // src/commands/waive.ts
-var import_node_crypto19 = require("node:crypto");
-var import_node_fs60 = require("node:fs");
+var import_node_crypto20 = require("node:crypto");
+var import_node_fs62 = require("node:fs");
 function registerWaiveCommand(program2) {
   program2.command("waive <pattern-id>").description("Record an accepted-risk disposition for an open finding (voids when the file changes)").option("--file <path>", "File the finding is anchored to, REPO-RELATIVE (recommended \u2014 narrows the waive)").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action(async (patternId, opts) => {
     const globals = program2.opts();
@@ -37734,7 +38158,7 @@ function registerWaiveCommand(program2) {
     if (opts.file) {
       body2.file = opts.file;
       try {
-        body2.file_sha256 = (0, import_node_crypto19.createHash)("sha256").update((0, import_node_fs60.readFileSync)(opts.file)).digest("hex");
+        body2.file_sha256 = (0, import_node_crypto20.createHash)("sha256").update((0, import_node_fs62.readFileSync)(opts.file)).digest("hex");
       } catch {
         printError(`Cannot read ${opts.file} \u2014 run from the repo root, or omit --file to waive by pattern.`);
         process.exit(1);
@@ -37759,10 +38183,10 @@ function registerWaiveCommand(program2) {
 }
 
 // src/commands/init.ts
-var import_node_fs65 = require("node:fs");
+var import_node_fs67 = require("node:fs");
 var import_promises20 = require("node:fs/promises");
 var import_yaml6 = __toESM2(require_dist());
-var import_node_path49 = require("node:path");
+var import_node_path52 = require("node:path");
 var import_node_child_process19 = require("node:child_process");
 
 // src/lib/banner.ts
@@ -37841,7 +38265,7 @@ function printPhase(n, of, title, subtitle) {
 }
 
 // src/commands/doctor.ts
-var import_node_fs61 = require("node:fs");
+var import_node_fs63 = require("node:fs");
 
 // src/lib/prereqs.ts
 var import_node_child_process16 = require("node:child_process");
@@ -37902,13 +38326,13 @@ function checkAnalysisCli() {
 }
 var INSTALL_TIMEOUT_MS = 12e4;
 function run3(command, args2, opts = {}) {
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     const child = (0, import_node_child_process16.spawn)(command, args2, {
       stdio: opts.inherit ? "inherit" : "pipe",
       timeout: INSTALL_TIMEOUT_MS
     });
-    child.on("error", () => resolve8(false));
-    child.on("close", (code) => resolve8(code === 0));
+    child.on("error", () => resolve9(false));
+    child.on("close", (code) => resolve9(code === 0));
   });
 }
 async function installAnalysisCli() {
@@ -38049,11 +38473,11 @@ async function buildReport() {
   const hooks = wiring.status;
   const provenance = cliProvenance();
   const telemetry = await checkTelemetry();
-  const hasConfig = (0, import_node_fs61.existsSync)(projectPath(CODACY_CONFIG_FILE));
+  const hasConfig = (0, import_node_fs63.existsSync)(projectPath(CODACY_CONFIG_FILE));
   const artifacts = {
-    standard: (0, import_node_fs61.existsSync)(projectPath(STANDARD_FILE)),
+    standard: (0, import_node_fs63.existsSync)(projectPath(STANDARD_FILE)),
     analysisConfig: hasConfig,
-    verityMd: (0, import_node_fs61.existsSync)(projectPath(VERITY_MD_FILE)),
+    verityMd: (0, import_node_fs63.existsSync)(projectPath(VERITY_MD_FILE)),
     analysisConfigIds: hasConfig ? validatePatternIds().status : "absent"
   };
   const next = [];
@@ -38212,8 +38636,8 @@ function registerDoctorCommand(program2) {
 }
 
 // src/commands/migrate.ts
-var import_node_fs62 = require("node:fs");
-var import_node_path46 = require("node:path");
+var import_node_fs64 = require("node:fs");
+var import_node_path49 = require("node:path");
 var import_node_child_process17 = require("node:child_process");
 var LEGACY_NPM_PACKAGE = "@codacy/gate-cli";
 function defaultNpmRemover(pkg) {
@@ -38250,12 +38674,12 @@ async function runMigration(opts = {}) {
   return { actions, migrated: actions.length > 0 };
 }
 function migrateProjectDir(root, actions) {
-  const gateDir = (0, import_node_path46.join)(root, ".gate");
-  const verityDir = (0, import_node_path46.join)(root, ".verity");
-  if ((0, import_node_fs62.existsSync)(gateDir) && !(0, import_node_fs62.existsSync)(verityDir)) {
+  const gateDir = (0, import_node_path49.join)(root, ".gate");
+  const verityDir = (0, import_node_path49.join)(root, ".verity");
+  if ((0, import_node_fs64.existsSync)(gateDir) && !(0, import_node_fs64.existsSync)(verityDir)) {
     return migrateProjectDirRename(root, gateDir, verityDir, actions);
   }
-  if ((0, import_node_fs62.existsSync)(gateDir) && (0, import_node_fs62.existsSync)(verityDir)) {
+  if ((0, import_node_fs64.existsSync)(gateDir) && (0, import_node_fs64.existsSync)(verityDir)) {
     return migrateProjectDirCarry(gateDir, verityDir, actions);
   }
   return false;
@@ -38276,13 +38700,13 @@ function migrateProjectDirRename(root, gateDir, verityDir, actions) {
     }
   }
   if (moved) {
-    if ((0, import_node_fs62.existsSync)(gateDir)) {
+    if ((0, import_node_fs64.existsSync)(gateDir)) {
       const carried = carryLegacyContents(gateDir, verityDir);
       if (carried > 0) {
         actions.push(`Carried ${carried} untracked legacy file(s) from .gate/ into .verity/`);
       }
       try {
-        (0, import_node_fs62.rmSync)(gateDir, { recursive: true, force: true });
+        (0, import_node_fs64.rmSync)(gateDir, { recursive: true, force: true });
       } catch {
       }
     }
@@ -38298,18 +38722,18 @@ function migrateProjectDirCarry(gateDir, verityDir, actions) {
     actions.push(`Carried ${carried} legacy file(s) from .gate/ into .verity/`);
   }
   try {
-    (0, import_node_fs62.rmSync)(gateDir, { recursive: true, force: true });
+    (0, import_node_fs64.rmSync)(gateDir, { recursive: true, force: true });
   } catch {
   }
   return carried > 0;
 }
 function migrateGlobalCredentials(home, actions) {
   if (!home) return;
-  const gateCreds = (0, import_node_path46.join)(home, ".gate", "credentials");
-  const verityCreds = (0, import_node_path46.join)(home, ".verity", "credentials");
-  if (!(0, import_node_fs62.existsSync)(gateCreds)) return;
-  if (!(0, import_node_fs62.existsSync)(verityCreds)) {
-    (0, import_node_fs62.mkdirSync)((0, import_node_path46.join)(home, ".verity"), { recursive: true });
+  const gateCreds = (0, import_node_path49.join)(home, ".gate", "credentials");
+  const verityCreds = (0, import_node_path49.join)(home, ".verity", "credentials");
+  if (!(0, import_node_fs64.existsSync)(gateCreds)) return;
+  if (!(0, import_node_fs64.existsSync)(verityCreds)) {
+    (0, import_node_fs64.mkdirSync)((0, import_node_path49.join)(home, ".verity"), { recursive: true });
     moveFile(gateCreds, verityCreds);
     actions.push("Moved ~/.gate/credentials \u2192 ~/.verity/credentials");
     return;
@@ -38331,8 +38755,8 @@ async function migrateLegacyHooks(root, actions) {
   }
 }
 async function migrateClaudeMd(root, actions) {
-  const claudeMd = (0, import_node_path46.join)(root, "CLAUDE.md");
-  const hadLegacyBlock = (0, import_node_fs62.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
+  const claudeMd = (0, import_node_path49.join)(root, "CLAUDE.md");
+  const hadLegacyBlock = (0, import_node_fs64.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd));
   if (!hadLegacyBlock) return;
   try {
     await ensureClaudeMdPointer(root);
@@ -38342,9 +38766,9 @@ async function migrateClaudeMd(root, actions) {
   }
 }
 function migrateStandardFile(root, actions) {
-  const gateMd = (0, import_node_path46.join)(root, "GATE.md");
-  const verityMd = (0, import_node_path46.join)(root, "VERITY.md");
-  if (!(0, import_node_fs62.existsSync)(gateMd) || (0, import_node_fs62.existsSync)(verityMd)) return;
+  const gateMd = (0, import_node_path49.join)(root, "GATE.md");
+  const verityMd = (0, import_node_path49.join)(root, "VERITY.md");
+  if (!(0, import_node_fs64.existsSync)(gateMd) || (0, import_node_fs64.existsSync)(verityMd)) return;
   let moved = false;
   if (isGitRepo(root) && isGitTracked(root, "GATE.md")) {
     try {
@@ -38356,12 +38780,12 @@ function migrateStandardFile(root, actions) {
   if (!moved) moveFile(gateMd, verityMd);
   const content = readFileSyncSafe(verityMd);
   const refreshed = content.split("GATE.md").join("VERITY.md");
-  if (refreshed !== content) (0, import_node_fs62.writeFileSync)(verityMd, refreshed);
+  if (refreshed !== content) (0, import_node_fs64.writeFileSync)(verityMd, refreshed);
   actions.push("Renamed GATE.md \u2192 VERITY.md");
 }
 async function migrateTelemetryHeaders(root, actions) {
-  const file = (0, import_node_path46.join)(root, ".claude", "settings.local.json");
-  if (!(0, import_node_fs62.existsSync)(file)) return;
+  const file = (0, import_node_path49.join)(root, ".claude", "settings.local.json");
+  if (!(0, import_node_fs64.existsSync)(file)) return;
   let settings;
   try {
     settings = JSON.parse(readFileSyncSafe(file) || "{}");
@@ -38409,14 +38833,14 @@ function mergeGlobalCredentials(gateCreds, verityCreds) {
   }
   if (toAppend.length > 0) {
     const sep5 = verityContent.endsWith("\n") || verityContent === "" ? "" : "\n";
-    (0, import_node_fs62.writeFileSync)(verityCreds, verityContent + sep5 + toAppend.join("\n") + "\n");
+    (0, import_node_fs64.writeFileSync)(verityCreds, verityContent + sep5 + toAppend.join("\n") + "\n");
   }
-  (0, import_node_fs62.rmSync)(gateCreds, { force: true });
+  (0, import_node_fs64.rmSync)(gateCreds, { force: true });
   return toAppend.length;
 }
 function readFileSyncSafe(path) {
   try {
-    return (0, import_node_fs62.readFileSync)(path, "utf-8");
+    return (0, import_node_fs64.readFileSync)(path, "utf-8");
   } catch {
     return "";
   }
@@ -38431,35 +38855,35 @@ function hasStagedChanges(root) {
 }
 function moveDir(from, to) {
   try {
-    (0, import_node_fs62.renameSync)(from, to);
+    (0, import_node_fs64.renameSync)(from, to);
   } catch (err2) {
     if (err2.code !== "EXDEV") throw err2;
-    (0, import_node_fs62.cpSync)(from, to, { recursive: true });
-    (0, import_node_fs62.rmSync)(from, { recursive: true, force: true });
+    (0, import_node_fs64.cpSync)(from, to, { recursive: true });
+    (0, import_node_fs64.rmSync)(from, { recursive: true, force: true });
   }
 }
 function moveFile(from, to) {
   try {
-    (0, import_node_fs62.renameSync)(from, to);
+    (0, import_node_fs64.renameSync)(from, to);
   } catch (err2) {
     if (err2.code !== "EXDEV") throw err2;
-    (0, import_node_fs62.cpSync)(from, to);
-    (0, import_node_fs62.rmSync)(from, { force: true });
+    (0, import_node_fs64.cpSync)(from, to);
+    (0, import_node_fs64.rmSync)(from, { force: true });
   }
 }
 function carryLegacyContents(gateDir, verityDir) {
   let copied = 0;
   const walk2 = (relDir) => {
-    const srcDir = (0, import_node_path46.join)(gateDir, relDir);
-    for (const entry of (0, import_node_fs62.readdirSync)(srcDir)) {
-      const rel = relDir ? (0, import_node_path46.join)(relDir, entry) : entry;
-      const src = (0, import_node_path46.join)(gateDir, rel);
-      const dest = (0, import_node_path46.join)(verityDir, rel);
-      if ((0, import_node_fs62.statSync)(src).isDirectory()) {
+    const srcDir = (0, import_node_path49.join)(gateDir, relDir);
+    for (const entry of (0, import_node_fs64.readdirSync)(srcDir)) {
+      const rel = relDir ? (0, import_node_path49.join)(relDir, entry) : entry;
+      const src = (0, import_node_path49.join)(gateDir, rel);
+      const dest = (0, import_node_path49.join)(verityDir, rel);
+      if ((0, import_node_fs64.statSync)(src).isDirectory()) {
         walk2(rel);
-      } else if (!(0, import_node_fs62.existsSync)(dest)) {
-        (0, import_node_fs62.mkdirSync)((0, import_node_path46.dirname)(dest), { recursive: true });
-        (0, import_node_fs62.cpSync)(src, dest);
+      } else if (!(0, import_node_fs64.existsSync)(dest)) {
+        (0, import_node_fs64.mkdirSync)((0, import_node_path49.dirname)(dest), { recursive: true });
+        (0, import_node_fs64.cpSync)(src, dest);
         copied++;
       }
     }
@@ -38468,22 +38892,22 @@ function carryLegacyContents(gateDir, verityDir) {
   return copied;
 }
 async function needsMigration(root = repoRoot()) {
-  const gateDir = (0, import_node_path46.join)(root, ".gate");
-  const verityDir = (0, import_node_path46.join)(root, ".verity");
-  if ((0, import_node_fs62.existsSync)(gateDir) && !(0, import_node_fs62.existsSync)(verityDir)) return true;
-  if ((0, import_node_fs62.existsSync)(gateDir) && (0, import_node_fs62.existsSync)(verityDir)) {
-    if ((0, import_node_fs62.existsSync)((0, import_node_path46.join)(gateDir, "credentials")) && !(0, import_node_fs62.existsSync)((0, import_node_path46.join)(verityDir, "credentials"))) {
+  const gateDir = (0, import_node_path49.join)(root, ".gate");
+  const verityDir = (0, import_node_path49.join)(root, ".verity");
+  if ((0, import_node_fs64.existsSync)(gateDir) && !(0, import_node_fs64.existsSync)(verityDir)) return true;
+  if ((0, import_node_fs64.existsSync)(gateDir) && (0, import_node_fs64.existsSync)(verityDir)) {
+    if ((0, import_node_fs64.existsSync)((0, import_node_path49.join)(gateDir, "credentials")) && !(0, import_node_fs64.existsSync)((0, import_node_path49.join)(verityDir, "credentials"))) {
       return true;
     }
-    if ((0, import_node_fs62.existsSync)((0, import_node_path46.join)(gateDir, "memory")) && !(0, import_node_fs62.existsSync)((0, import_node_path46.join)(verityDir, "memory"))) {
+    if ((0, import_node_fs64.existsSync)((0, import_node_path49.join)(gateDir, "memory")) && !(0, import_node_fs64.existsSync)((0, import_node_path49.join)(verityDir, "memory"))) {
       return true;
     }
   }
-  const claudeMd = (0, import_node_path46.join)(root, "CLAUDE.md");
-  if ((0, import_node_fs62.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
+  const claudeMd = (0, import_node_path49.join)(root, "CLAUDE.md");
+  if ((0, import_node_fs64.existsSync)(claudeMd) && hasLegacyMemoryBlock(readFileSyncSafe(claudeMd))) {
     return true;
   }
-  if ((0, import_node_fs62.existsSync)((0, import_node_path46.join)(root, "GATE.md")) && !(0, import_node_fs62.existsSync)((0, import_node_path46.join)(root, "VERITY.md"))) {
+  if ((0, import_node_fs64.existsSync)((0, import_node_path49.join)(root, "GATE.md")) && !(0, import_node_fs64.existsSync)((0, import_node_path49.join)(root, "VERITY.md"))) {
     return true;
   }
   if (await hasLegacyHooksAt(root)) return true;
@@ -38612,7 +39036,7 @@ function runSelect(opts) {
     cursor: initialIdx[0] ?? 0,
     chosen: new Set(mode2 === "single" ? [initialIdx[0] ?? 0] : initialIdx)
   };
-  return new Promise((resolve8) => {
+  return new Promise((resolve9) => {
     let painted = 0;
     let settled = false;
     const draw = () => {
@@ -38660,7 +39084,7 @@ function runSelect(opts) {
       if (settled) return;
       settled = true;
       restore();
-      resolve8(value);
+      resolve9(value);
     };
     readline2.emitKeypressEvents(input);
     input.setRawMode(true);
@@ -38681,9 +39105,9 @@ async function askLine(question, io = {}) {
     output: io.output ?? process.stdout
   });
   try {
-    return await new Promise((resolve8) => {
-      rl.question(question).then((a) => resolve8(a.trim())).catch(() => resolve8(null));
-      rl.once("close", () => setImmediate(() => resolve8(null)));
+    return await new Promise((resolve9) => {
+      rl.question(question).then((a) => resolve9(a.trim())).catch(() => resolve9(null));
+      rl.once("close", () => setImmediate(() => resolve9(null)));
     });
   } finally {
     rl.close();
@@ -38764,15 +39188,31 @@ async function promptMultiSelect(question, choices, fallback) {
 }
 
 // src/lib/prove/lean-install.ts
-var import_node_fs63 = require("node:fs");
-var import_node_crypto20 = require("node:crypto");
+var import_node_fs65 = require("node:fs");
+var import_node_crypto21 = require("node:crypto");
 var import_node_child_process18 = require("node:child_process");
 var import_node_os10 = require("node:os");
-var import_node_path47 = require("node:path");
+var import_node_path50 = require("node:path");
 var import_promises18 = require("node:stream/promises");
 var import_node_stream = require("node:stream");
 var RELEASES = "https://releases.lean-lang.org/lean4";
 var LEAN_DOWNLOAD_SIZE = "\u2248800 MB download, 2.7 GB on disk";
+var DOWNLOAD_STALL_MS = 6e4;
+var LEAN_DISK_NEEDED_BYTES = 3.75 * 1024 ** 3;
+function freeBytes(dir) {
+  let d = dir;
+  for (let i2 = 0; i2 < 64; i2++) {
+    try {
+      const st = (0, import_node_fs65.statfsSync)(d);
+      return Number(st.bavail) * Number(st.bsize);
+    } catch {
+      const up = (0, import_node_path50.join)(d, "..");
+      if (up === d) return null;
+      d = up;
+    }
+  }
+  return null;
+}
 var LEAN_ASSET_SHA256 = {
   "v4.34.0": {
     "lean-4.34.0-darwin.zip": "75a2a4b8e3d35680e8f51fae5a42c79702f463dd73ee1520fb61e5a9143e336c",
@@ -38786,9 +39226,9 @@ function expectedSha256(asset, version = pinnedVersion()) {
   return LEAN_ASSET_SHA256[version]?.[asset] ?? null;
 }
 function sha256File(path) {
-  return new Promise((resolve8, reject) => {
-    const hash = (0, import_node_crypto20.createHash)("sha256");
-    (0, import_node_fs63.createReadStream)(path).on("data", (chunk) => hash.update(chunk)).on("end", () => resolve8(hash.digest("hex"))).on("error", reject);
+  return new Promise((resolve9, reject) => {
+    const hash = (0, import_node_crypto21.createHash)("sha256");
+    (0, import_node_fs65.createReadStream)(path).on("data", (chunk) => hash.update(chunk)).on("end", () => resolve9(hash.digest("hex"))).on("error", reject);
   });
 }
 async function verifyDownload(zip, asset, version = pinnedVersion()) {
@@ -38808,7 +39248,7 @@ function leanAssetName(version = pinnedVersion()) {
   return suffix ? `lean-${v}-${suffix}.zip` : null;
 }
 function pinnedVersionDir(env = process.env) {
-  return (0, import_node_path47.join)(verityLeanHome(env), pinnedVersion());
+  return (0, import_node_path50.join)(verityLeanHome(env), pinnedVersion());
 }
 function lakeBinary() {
   return (0, import_node_os10.platform)() === "win32" ? "lake.exe" : "lake";
@@ -38819,29 +39259,44 @@ function unzip(zip, dest) {
   for (const [cmd, args2] of attempts) {
     try {
       (0, import_node_child_process18.execFileSync)(cmd, args2, { stdio: ["ignore", "ignore", "pipe"], timeout: 15 * 6e4 });
-      if ((0, import_node_fs63.readdirSync)(dest).length > 0) return { ok: true, via: cmd };
+      if ((0, import_node_fs65.readdirSync)(dest).length > 0) return { ok: true, via: cmd };
       errors.push(`${cmd}: produced nothing`);
     } catch (err2) {
       errors.push(`${cmd}: ${String(err2.message).split("\n")[0].slice(0, 120)}`);
       try {
-        for (const e of (0, import_node_fs63.readdirSync)(dest)) (0, import_node_fs63.rmSync)((0, import_node_path47.join)(dest, e), { recursive: true, force: true });
+        for (const e of (0, import_node_fs65.readdirSync)(dest)) (0, import_node_fs65.rmSync)((0, import_node_path50.join)(dest, e), { recursive: true, force: true });
       } catch {
       }
     }
   }
   return { ok: false, error: errors.join("; ") };
 }
-async function download(url, dest, onProgress) {
-  const res = await fetch(url, { redirect: "follow" });
-  if (!res.ok || !res.body) throw new Error(`download failed: HTTP ${res.status}`);
-  const total = Number(res.headers.get("content-length")) || null;
-  let seen = 0;
-  const stream = import_node_stream.Readable.fromWeb(res.body);
-  stream.on("data", (chunk) => {
-    seen += chunk.length;
-    onProgress(seen, total);
-  });
-  await (0, import_promises18.pipeline)(stream, (0, import_node_fs63.createWriteStream)(dest));
+async function download(url, dest, onProgress, stallMs = DOWNLOAD_STALL_MS) {
+  const ctrl = new AbortController();
+  let timer;
+  const arm = () => {
+    clearTimeout(timer);
+    timer = setTimeout(() => ctrl.abort(), stallMs);
+  };
+  arm();
+  try {
+    const res = await fetch(url, { redirect: "follow", signal: ctrl.signal });
+    if (!res.ok || !res.body) throw new Error(`download failed: HTTP ${res.status}`);
+    const total = Number(res.headers.get("content-length")) || null;
+    let seen = 0;
+    const stream = import_node_stream.Readable.fromWeb(res.body);
+    stream.on("data", (chunk) => {
+      arm();
+      seen += chunk.length;
+      onProgress(seen, total);
+    });
+    await (0, import_promises18.pipeline)(stream, (0, import_node_fs65.createWriteStream)(dest), { signal: ctrl.signal });
+  } catch (err2) {
+    if (ctrl.signal.aborted) throw new Error(`download stalled: nothing received for ${Math.round(stallMs / 1e3)} s`);
+    throw err2;
+  } finally {
+    clearTimeout(timer);
+  }
 }
 function inPlaceProgress(label2, write = (s) => process.stderr.write(s)) {
   let active = false;
@@ -38879,10 +39334,16 @@ async function installLean(opts = {}) {
   const dir = pinnedVersionDir(env);
   const url = `${RELEASES}/${pinnedVersion()}/${asset}`;
   const home = verityLeanHome(env);
-  const tmp = (0, import_node_path47.join)(home, ".tmp");
-  (0, import_node_fs63.rmSync)(tmp, { recursive: true, force: true });
-  (0, import_node_fs63.mkdirSync)(tmp, { recursive: true });
-  const zip = (0, import_node_path47.join)(tmp, asset);
+  const free = freeBytes(home);
+  const needed = opts.minFreeBytes ?? LEAN_DISK_NEEDED_BYTES;
+  if (free !== null && free < needed) {
+    const gb = (n) => (n / 1024 ** 3).toFixed(1);
+    return { ok: false, error: `not enough disk space for Lean: ${gb(free)} GB free where ${home} lives, needs about ${gb(needed)} GB` };
+  }
+  const tmp = (0, import_node_path50.join)(home, ".tmp");
+  (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
+  (0, import_node_fs65.mkdirSync)(tmp, { recursive: true });
+  const zip = (0, import_node_path50.join)(tmp, asset);
   say(`downloading ${url}`);
   let lastPct = -1;
   try {
@@ -38895,40 +39356,40 @@ async function installLean(opts = {}) {
       }
     });
   } catch (err2) {
-    (0, import_node_fs63.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: err2.message };
   }
   say("verifying checksum");
   const verified = await verifyDownload(zip, asset);
   if (!verified.ok) {
-    (0, import_node_fs63.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: verified.error };
   }
   say("unpacking (this takes a minute)");
-  const unpack = (0, import_node_path47.join)(tmp, "unpack");
-  (0, import_node_fs63.mkdirSync)(unpack);
+  const unpack = (0, import_node_path50.join)(tmp, "unpack");
+  (0, import_node_fs65.mkdirSync)(unpack);
   const unpacked = unzip(zip, unpack);
   if (!unpacked.ok) {
-    (0, import_node_fs63.rmSync)(tmp, { recursive: true, force: true });
+    (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: `unpack failed: ${unpacked.error}` };
   }
-  const entries = (0, import_node_fs63.readdirSync)(unpack);
-  const top = entries.length === 1 && (0, import_node_fs63.statSync)((0, import_node_path47.join)(unpack, entries[0])).isDirectory() ? (0, import_node_path47.join)(unpack, entries[0]) : unpack;
-  if (!(0, import_node_fs63.existsSync)((0, import_node_path47.join)(top, "bin", lakeBinary()))) {
-    (0, import_node_fs63.rmSync)(tmp, { recursive: true, force: true });
+  const entries = (0, import_node_fs65.readdirSync)(unpack);
+  const top = entries.length === 1 && (0, import_node_fs65.statSync)((0, import_node_path50.join)(unpack, entries[0])).isDirectory() ? (0, import_node_path50.join)(unpack, entries[0]) : unpack;
+  if (!(0, import_node_fs65.existsSync)((0, import_node_path50.join)(top, "bin", lakeBinary()))) {
+    (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
     return { ok: false, error: "the archive did not contain bin/lake" };
   }
-  (0, import_node_fs63.rmSync)(dir, { recursive: true, force: true });
-  (0, import_node_fs63.mkdirSync)(home, { recursive: true });
-  (0, import_node_fs63.renameSync)(top, dir);
-  (0, import_node_fs63.rmSync)(tmp, { recursive: true, force: true });
+  (0, import_node_fs65.rmSync)(dir, { recursive: true, force: true });
+  (0, import_node_fs65.mkdirSync)(home, { recursive: true });
+  (0, import_node_fs65.renameSync)(top, dir);
+  (0, import_node_fs65.rmSync)(tmp, { recursive: true, force: true });
   return { ok: true, dir };
 }
 
 // src/lib/remote-config.ts
-var import_node_fs64 = require("node:fs");
+var import_node_fs66 = require("node:fs");
 var import_promises19 = require("node:fs/promises");
-var import_node_path48 = require("node:path");
+var import_node_path51 = require("node:path");
 var import_yaml5 = __toESM2(require_dist());
 var IGNORE_RIDER = "verityignore";
 async function fetchRemoteSetup(opts) {
@@ -38973,7 +39434,7 @@ async function adoptRemoteSetup(found, opts) {
   written.push(STANDARD_FILE);
   if (rider !== null) {
     const localIgnore = projectPath(VERITYIGNORE_FILE);
-    if (!(0, import_node_fs64.existsSync)(localIgnore)) {
+    if (!(0, import_node_fs66.existsSync)(localIgnore)) {
       await writeOut(VERITYIGNORE_FILE, rider);
       written.push(VERITYIGNORE_FILE);
     } else {
@@ -39006,7 +39467,7 @@ async function adoptRemoteSetup(found, opts) {
 }
 async function writeOut(relative6, body2) {
   const target = projectPath(relative6);
-  await (0, import_promises19.mkdir)((0, import_node_path48.dirname)(target), { recursive: true });
+  await (0, import_promises19.mkdir)((0, import_node_path51.dirname)(target), { recursive: true });
   await (0, import_promises19.writeFile)(target, body2);
 }
 function describeRemote(found) {
@@ -39123,15 +39584,15 @@ async function runOptionalAuth(resolution, opts = {}) {
 }
 function resolveDataDir2() {
   const candidates2 = [
-    (0, import_node_path49.join)(__dirname, "..", "data"),
+    (0, import_node_path52.join)(__dirname, "..", "data"),
     // installed: node_modules/@codacy/verity-cli/data
-    (0, import_node_path49.join)(__dirname, "..", "..", "data"),
+    (0, import_node_path52.join)(__dirname, "..", "..", "data"),
     // edge case: nested resolution
-    (0, import_node_path49.join)(process.cwd(), "cli", "data")
+    (0, import_node_path52.join)(process.cwd(), "cli", "data")
     // local dev: running from repo root
   ];
   for (const candidate of candidates2) {
-    if ((0, import_node_fs65.existsSync)((0, import_node_path49.join)(candidate, "skills"))) {
+    if ((0, import_node_fs67.existsSync)((0, import_node_path52.join)(candidate, "skills"))) {
       return candidate;
     }
   }
@@ -39147,9 +39608,9 @@ async function skillIsCurrent(src, dest) {
   const list2 = (dir) => {
     const out2 = [];
     const walk2 = (d, prefix) => {
-      for (const e of (0, import_node_fs65.readdirSync)(d, { withFileTypes: true })) {
+      for (const e of (0, import_node_fs67.readdirSync)(d, { withFileTypes: true })) {
         const rel = prefix ? `${prefix}/${e.name}` : e.name;
-        if (e.isDirectory()) walk2((0, import_node_path49.join)(d, e.name), rel);
+        if (e.isDirectory()) walk2((0, import_node_path52.join)(d, e.name), rel);
         else if (e.isFile()) out2.push(rel);
       }
     };
@@ -39160,8 +39621,8 @@ async function skillIsCurrent(src, dest) {
     const shipped = list2(src);
     if (JSON.stringify(shipped) !== JSON.stringify(list2(dest))) return false;
     for (const rel of shipped) {
-      const a = await (0, import_promises20.readFile)((0, import_node_path49.join)(src, rel), "utf-8");
-      const b = await (0, import_promises20.readFile)((0, import_node_path49.join)(dest, rel), "utf-8");
+      const a = await (0, import_promises20.readFile)((0, import_node_path52.join)(src, rel), "utf-8");
+      const b = await (0, import_promises20.readFile)((0, import_node_path52.join)(dest, rel), "utf-8");
       if (a !== b) return false;
     }
     return true;
@@ -39187,8 +39648,10 @@ var INTENSITY_CHOICES = [
   { id: "thorough", label: "thorough", hint: "all tools, all rules (~15s)" }
 ];
 var FORMAL_CHOICES = [
-  { id: "yes", label: "yes", hint: "a Lean model of the riskiest changed function; blocks only on a REPRODUCED counterexample", recommended: true },
-  { id: "no", label: "no", hint: "enable later with: verity config formal push" }
+  { id: "yes", label: "yes", hint: "a Lean model of the riskiest changed function; blocks only on a REPRODUCED counterexample" },
+  // No is the default (review of #255): "yes" downloads ≈800 MB and unpacks
+  // 2.7 GB, and a bare Enter must never do that.
+  { id: "no", label: "no", hint: "enable later with: verity config formal push", recommended: true }
 ];
 var MOMENT_CHOICES = [
   { id: "stop", label: "On stop", hint: "after every agent turn \u2014 fast feedback while you work", recommended: true },
@@ -39362,7 +39825,7 @@ async function synthesizeLocally(opts) {
 async function healStaleAnalysisConfig(globals) {
   const configPath = projectPath(CODACY_CONFIG_FILE);
   const standardPath = projectPath(STANDARD_FILE);
-  if (!(0, import_node_fs65.existsSync)(configPath) || !(0, import_node_fs65.existsSync)(standardPath)) return;
+  if (!(0, import_node_fs67.existsSync)(configPath) || !(0, import_node_fs67.existsSync)(standardPath)) return;
   const validation = validatePatternIds();
   if (validation.status !== "invalid") return;
   printWarn("  Your analysis config names pattern ids that no longer resolve \u2014 those tools were");
@@ -39459,17 +39922,17 @@ async function handoffToSetup(enabled, claudeInstalled) {
 async function installSkills(force, step) {
   step("Installing skills");
   const dataDir = resolveDataDir2();
-  const skillsSource = (0, import_node_path49.join)(dataDir, "skills");
+  const skillsSource = (0, import_node_path52.join)(dataDir, "skills");
   const skillsDest = ".claude/skills";
   let skillsInstalled = 0;
   for (const skill of SKILLS) {
-    const src = (0, import_node_path49.join)(skillsSource, skill);
-    const dest = (0, import_node_path49.join)(skillsDest, skill);
-    if (!(0, import_node_fs65.existsSync)(src)) {
+    const src = (0, import_node_path52.join)(skillsSource, skill);
+    const dest = (0, import_node_path52.join)(skillsDest, skill);
+    if (!(0, import_node_fs67.existsSync)(src)) {
       printWarn(`  Skill data not found: ${skill}`);
       continue;
     }
-    if ((0, import_node_fs65.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) {
+    if ((0, import_node_fs67.existsSync)(dest) && !force && await skillIsCurrent(src, dest)) {
       skillsInstalled++;
       continue;
     }
@@ -39594,16 +40057,20 @@ async function offerFormalVerification(defaultsOnly, pluginMode) {
     printWarn(`  Formal verification: off \u2014 ${formalRefusalMessage(cfg.formal_refused)}`);
     return;
   }
-  const toolchain = findToolchain();
   if (cfg.formal === "push") {
-    if (toolchain) printInfo("  Formal verification at push \u2713");
+    if (findToolchain()) printInfo("  Formal verification at push \u2713");
     else printWarn("  Formal verification is on but Lean is missing \u2014 run: verity lean install");
     return;
   }
+  if (cfg.formal === "off") {
+    printInfo("  Formal verification: off (enable with: verity config formal push)");
+    return;
+  }
   if (defaultsOnly || !interactive()) {
     printInfo("  Formal verification (a model-based bug finder at push): off \u2014 enable with: verity config formal push");
     return;
   }
+  const toolchain = findToolchain();
   console.log("");
   console.log("  Formal verification review \u2014 a model-based bug finder for your riskiest code.");
   console.log("    At push, Verity picks the riskiest changed function, checks a small model of");
@@ -39611,9 +40078,10 @@ async function offerFormalVerification(defaultsOnly, pluginMode) {
   console.log("    Verity for that). Only a reproduced bug can block; most pushes get no model.");
   console.log(`    Adds /verity-prove <worry> to check any code on demand.${toolchain ? "" : ` Needs to install Lean 4 (${LEAN_DOWNLOAD_SIZE}) on "yes".`}`);
   console.log("");
-  const wants = await promptChoice("Formal verification at push?", FORMAL_CHOICES, "yes");
+  const wants = await promptChoice("Formal verification at push?", FORMAL_CHOICES, "no");
   if (wants === "yes" && pluginMode) printInfo("  Plugin: the push check works now; /verity:verity-prove arrives with the plugin's next release.");
   if (wants !== "yes") {
+    writeProjectConfig({ formal: "off" });
     printInfo("  Formal verification: off (enable later with: verity config formal push)");
     return;
   }
@@ -39664,7 +40132,7 @@ function registerInitCommand(program2) {
     const staleMarker = clearStalePluginMarker();
     const pluginMode = opts.plugin === false ? false : opts.pluginMode ?? pluginActiveHere();
     const projectMarkers = [".git", "package.json", "pyproject.toml", "go.mod", "Cargo.toml", "Gemfile", "pom.xml", "build.gradle"];
-    const isProject = projectMarkers.some((m) => (0, import_node_fs65.existsSync)(m));
+    const isProject = projectMarkers.some((m) => (0, import_node_fs67.existsSync)(m));
     if (!isProject) {
       printError("No project detected in the current directory.");
       printInfo('Run "verity init" from your project root.');
@@ -39767,7 +40235,7 @@ function registerInitCommand(program2) {
       untrackMemory: opts.untrackMemory === true,
       untrackState: opts.untrackState === true
     });
-    const globalVerityDir = (0, import_node_path49.join)(process.env.HOME ?? "", ".verity");
+    const globalVerityDir = (0, import_node_path52.join)(process.env.HOME ?? "", ".verity");
     await (0, import_promises20.mkdir)(globalVerityDir, { recursive: true });
     console.log("");
     step("Wiring Claude Code hooks");
@@ -39842,7 +40310,7 @@ function registerInitCommand(program2) {
     }
     step("Your project's Standard");
     let haveStandard = false;
-    if ((0, import_node_fs65.existsSync)(projectPath(STANDARD_FILE))) {
+    if ((0, import_node_fs67.existsSync)(projectPath(STANDARD_FILE))) {
       printInfo("  This project already has .verity/standard.yaml \u2014 keeping it.");
       haveStandard = true;
     } else {
@@ -39872,7 +40340,7 @@ function registerInitCommand(program2) {
         ...telemetryChoice ? { telemetry: telemetryChoice } : {},
         init: {
           completed_at: (/* @__PURE__ */ new Date()).toISOString(),
-          cli_version: true ? "0.34.0-experimental.421a631" : "dev"
+          cli_version: true ? "0.34.0-experimental.53caba1" : "dev"
         }
       });
     } catch (err2) {
@@ -39922,8 +40390,8 @@ function registerInitCommand(program2) {
 }
 
 // src/commands/uninstall.ts
-var import_node_fs66 = require("node:fs");
-var import_node_path50 = require("node:path");
+var import_node_fs68 = require("node:fs");
+var import_node_path53 = require("node:path");
 function registerUninstallCommand(program2) {
   program2.command("uninstall").description("Remove Verity from this project (skills, hooks, .verity/, VERITY.md)").option("--dry-run", "Show what would be removed without doing it").option("--purge-global", "Also remove ~/.verity/ (deletes saved tokens \u2014 reconnect requires re-registration)").option("--keep-verity-md", "Keep the project root VERITY.md file").action(async (opts) => {
     const dryRun = opts.dryRun ?? false;
@@ -39932,11 +40400,11 @@ function registerUninstallCommand(program2) {
     const actions = [];
     const skillsRoot = projectPath(".claude/skills");
     for (const name2 of PROJECT_SKILL_NAMES) {
-      const dir = (0, import_node_path50.join)(skillsRoot, name2);
-      if ((0, import_node_fs66.existsSync)(dir)) {
+      const dir = (0, import_node_path53.join)(skillsRoot, name2);
+      if ((0, import_node_fs68.existsSync)(dir)) {
         actions.push({
           label: `Remove .claude/skills/${name2}/`,
-          apply: () => (0, import_node_fs66.rmSync)(dir, { recursive: true, force: true })
+          apply: () => (0, import_node_fs68.rmSync)(dir, { recursive: true, force: true })
         });
       }
     }
@@ -39950,24 +40418,24 @@ function registerUninstallCommand(program2) {
       });
     }
     const verityDir = projectPath(VERITY_DIR);
-    if ((0, import_node_fs66.existsSync)(verityDir)) {
+    if ((0, import_node_fs68.existsSync)(verityDir)) {
       actions.push({
         label: `Remove ${VERITY_DIR}/`,
-        apply: () => (0, import_node_fs66.rmSync)(verityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs68.rmSync)(verityDir, { recursive: true, force: true })
       });
     }
     if (!keepVerityMd) {
       const verityMd = projectPath(VERITY_MD_FILE);
-      if ((0, import_node_fs66.existsSync)(verityMd)) {
+      if ((0, import_node_fs68.existsSync)(verityMd)) {
         actions.push({
           label: `Remove ${VERITY_MD_FILE}`,
-          apply: () => (0, import_node_fs66.rmSync)(verityMd, { force: true })
+          apply: () => (0, import_node_fs68.rmSync)(verityMd, { force: true })
         });
       }
     }
     const cleanupEmptyDir = (path) => {
-      if ((0, import_node_fs66.existsSync)(path) && (0, import_node_fs66.statSync)(path).isDirectory() && (0, import_node_fs66.readdirSync)(path).length === 0) {
-        (0, import_node_fs66.rmdirSync)(path);
+      if ((0, import_node_fs68.existsSync)(path) && (0, import_node_fs68.statSync)(path).isDirectory() && (0, import_node_fs68.readdirSync)(path).length === 0) {
+        (0, import_node_fs68.rmdirSync)(path);
       }
     };
     actions.push({
@@ -39978,11 +40446,11 @@ function registerUninstallCommand(program2) {
       }
     });
     const home = process.env.HOME ?? "";
-    const globalVerityDir = (0, import_node_path50.join)(home, ".verity");
-    if (purgeGlobal && (0, import_node_fs66.existsSync)(globalVerityDir)) {
+    const globalVerityDir = (0, import_node_path53.join)(home, ".verity");
+    if (purgeGlobal && (0, import_node_fs68.existsSync)(globalVerityDir)) {
       actions.push({
         label: `Remove ~/.verity/ (global credentials \u2014 reconnect requires re-registration)`,
-        apply: () => (0, import_node_fs66.rmSync)(globalVerityDir, { recursive: true, force: true })
+        apply: () => (0, import_node_fs68.rmSync)(globalVerityDir, { recursive: true, force: true })
       });
     }
     if (actions.length === 0) {
@@ -40176,8 +40644,8 @@ function registerTaskCommands(program2) {
 }
 
 // src/commands/reset.ts
-var import_node_fs67 = require("node:fs");
-var import_node_path51 = require("node:path");
+var import_node_fs69 = require("node:fs");
+var import_node_path54 = require("node:path");
 function registerResetCommand(program2) {
   program2.command("reset").description("Close the current task and clear transient state").option("--keep-task", "Only purge caches; leave the current task open").option("--all", "Also purge diagnostic logs (.verity/.logs/)").action(async (opts) => {
     const globals = program2.opts();
@@ -40214,11 +40682,11 @@ function registerResetCommand(program2) {
     }
     const cacheDir = projectPath(CACHE_DIR);
     let purged = 0;
-    if ((0, import_node_fs67.existsSync)(cacheDir)) {
-      for (const entry of (0, import_node_fs67.readdirSync)(cacheDir)) {
+    if ((0, import_node_fs69.existsSync)(cacheDir)) {
+      for (const entry of (0, import_node_fs69.readdirSync)(cacheDir)) {
         if (entry.startsWith("pending-")) {
           try {
-            (0, import_node_fs67.unlinkSync)((0, import_node_path51.join)(cacheDir, entry));
+            (0, import_node_fs69.unlinkSync)((0, import_node_path54.join)(cacheDir, entry));
             purged++;
           } catch {
           }
@@ -40233,19 +40701,19 @@ function registerResetCommand(program2) {
       projectPath(`${VERITY_DIR}/.last-analysis`)
     ];
     for (const file of filesToClear) {
-      if ((0, import_node_fs67.existsSync)(file)) {
+      if ((0, import_node_fs69.existsSync)(file)) {
         try {
-          (0, import_node_fs67.writeFileSync)(file, "");
+          (0, import_node_fs69.writeFileSync)(file, "");
         } catch {
         }
       }
     }
     if (opts.all) {
       const logsDir = projectPath(`${VERITY_DIR}/.logs`);
-      if ((0, import_node_fs67.existsSync)(logsDir)) {
-        for (const entry of (0, import_node_fs67.readdirSync)(logsDir)) {
+      if ((0, import_node_fs69.existsSync)(logsDir)) {
+        for (const entry of (0, import_node_fs69.readdirSync)(logsDir)) {
           try {
-            (0, import_node_fs67.unlinkSync)((0, import_node_path51.join)(logsDir, entry));
+            (0, import_node_fs69.unlinkSync)((0, import_node_path54.join)(logsDir, entry));
           } catch {
           }
         }
@@ -40257,7 +40725,7 @@ function registerResetCommand(program2) {
 }
 
 // src/commands/reflect.ts
-var import_node_fs68 = require("node:fs");
+var import_node_fs70 = require("node:fs");
 
 // src/lib/reflection-globs.ts
 var MAX_GLOBS = 6;
@@ -40265,7 +40733,7 @@ var PATH_TOKEN = /[A-Za-z0-9_./-]*[A-Za-z0-9_-]\.[A-Za-z0-9]{1,8}(?::\d+(?::\d+)
 function clean(token) {
   return token.replace(/:\d+(?::\d+)?$/, "").replace(/^[`'"(\[]+/, "").replace(/[`'"),\].;!?]+$/, "").replace(/^\.\//, "");
 }
-function resolve6(token, treePaths) {
+function resolve7(token, treePaths) {
   if (treePaths.includes(token)) return token;
   const suffix = token.startsWith("/") ? token : `/${token}`;
   const matches = treePaths.filter((p) => p.endsWith(suffix));
@@ -40278,7 +40746,7 @@ function deriveFileGlobs(text, treePaths) {
   for (const raw of text.match(PATH_TOKEN) ?? []) {
     const token = clean(raw);
     if (!token) continue;
-    const path = resolve6(token, treePaths);
+    const path = resolve7(token, treePaths);
     if (!path || seen.has(path)) continue;
     seen.add(path);
     out2.push(path);
@@ -40295,14 +40763,19 @@ async function writeNodeToDisk(args2) {
       { treePaths: listTrackedFiles(), recordBaseline: false }
     );
     if (written === 0) return false;
-    return (0, import_node_fs68.existsSync)(projectPath(`${VERITY_DIR}/memory/${args2.filePath}`));
+    return (0, import_node_fs70.existsSync)(projectPath(`${VERITY_DIR}/memory/${args2.filePath}`));
   } catch {
     return false;
   }
 }
 function registerReflectCommand(program2) {
-  program2.command("reflect").description("Capture learnings \u2014 auto-extract or record a reflection").option("--user-input <text>", "The reflection to record (the agent-drafted or user-dictated text)").option("--kind <kind>", "Node kind (decision, gotcha, pattern, security, quality, intent, domain, integration)", "gotcha").option("--task-id <id>", "Task to reflect on (defaults to current task)").option("--confirmed", "The USER authored or confirmed these exact words \u2014 records as human-authored (source: user, confidence 1.0)").option("--file-globs <glob...>", "Files this reflection is about. Without any, the paths cited in the text are used; a reflection matching no file never surfaces in a review").option("--autonomous", "(deprecated, ignored) reflections are always recorded without a confirm step").action(async (opts) => {
+  program2.command("reflect").description("Capture learnings \u2014 auto-extract or record a reflection").option("--user-input <text>", "The reflection to record (the agent-drafted or user-dictated text); - reads it from stdin, so the words never pass through shell quoting").option("--kind <kind>", "Node kind (decision, gotcha, pattern, security, quality, intent, domain, integration)", "gotcha").option("--task-id <id>", "Task to reflect on (defaults to current task)").option("--confirmed", "The USER authored or confirmed these exact words \u2014 records as human-authored (source: user, confidence 1.0)").option("--file-globs <glob...>", "Files this reflection is about. Without any, the paths cited in the text are used; a reflection matching no file never surfaces in a review").option("--autonomous", "(deprecated, ignored) reflections are always recorded without a confirm step").action(async (opts) => {
     const globals = program2.opts();
+    const input = readTextInput(opts.userInput, "--user-input");
+    if (!input.ok) {
+      printError(input.error);
+      process.exit(1);
+    }
     await ensureMemoryDir();
     const tokenResult = await resolveToken(globals.token);
     if (!tokenResult.ok) {
@@ -40363,7 +40836,7 @@ function registerReflectCommand(program2) {
       taskResolution = "none";
       printWarn("No active task found \u2014 saving as an unattached reflection.");
     }
-    const userInput = opts.userInput;
+    const userInput = input.text;
     if (userInput) {
       const validKinds = ["decision", "gotcha", "pattern", "security", "quality", "intent", "domain", "integration"];
       const kind = validKinds.includes(opts.kind) ? opts.kind : "gotcha";
@@ -40727,9 +41200,9 @@ function registerRunCommand(program2) {
 }
 
 // src/commands/telemetry.ts
-var import_node_fs69 = require("node:fs");
+var import_node_fs71 = require("node:fs");
 async function recordTelemetryChoice(choice) {
-  if (!(0, import_node_fs69.existsSync)(projectPath(SETUP_STATE_FILE))) return;
+  if (!(0, import_node_fs71.existsSync)(projectPath(SETUP_STATE_FILE))) return;
   try {
     if ((await readSetupState())?.telemetry === choice) return;
     await writeSetupState({ telemetry: choice });
@@ -40806,8 +41279,8 @@ function registerTelemetryCommands(program2) {
 }
 
 // src/commands/prove.ts
-var import_node_fs70 = require("node:fs");
-var import_node_path52 = require("node:path");
+var import_node_fs72 = require("node:fs");
+var import_node_path55 = require("node:path");
 
 // src/lib/prove/hint-pool.ts
 var STOP2 = /* @__PURE__ */ new Set([
@@ -40934,7 +41407,13 @@ async function proveAuth(program2) {
 }
 function registerProveCommand(program2) {
   const prove = program2.command("prove").description("Formal verification (Lean 4) of small, risky pieces of code \u2014 on demand");
-  prove.command("candidates [paths...]").description("Rank code worth a formal model, from git history and risk signals").option("--since <when>", `git --since window (default: "${DEFAULT_SINCE}")`).option("--limit <n>", "Candidates to show", "10").option("--rank <ranker>", "deterministic | luna | jev (luna and jev need an API key)", "deterministic").option("--hint <text>", "What the user wants checked, in their words (biases the rank; implies --rank luna)").option("--json", "Machine-readable output").action(async (paths, opts) => {
+  prove.command("candidates [paths...]").description("Rank code worth a formal model, from git history and risk signals").option("--since <when>", `git --since window (default: "${DEFAULT_SINCE}")`).option("--limit <n>", "Candidates to show", "10").option("--rank <ranker>", "deterministic | luna | jev (luna and jev need an API key)", "deterministic").option("--hint <text>", "What the user wants checked, in their words (biases the rank; implies --rank luna); - reads it from stdin, so the words never pass through shell quoting").option("--json", "Machine-readable output").action(async (paths, opts) => {
+    const hint = readTextInput(opts.hint, "--hint");
+    if (!hint.ok) {
+      printError(hint.error);
+      process.exit(2);
+    }
+    opts.hint = hint.text;
     if (opts.hint && opts.rank === "deterministic") opts.rank = "luna";
     const root = repoRoot();
     const ranker = RANKERS[opts.rank];
@@ -40943,7 +41422,7 @@ function registerProveCommand(program2) {
       process.exit(2);
     }
     const limit = Math.max(1, Math.min(50, Number(opts.limit) || 10));
-    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path52.relative)(root, (0, import_node_path52.resolve)(p)) || ".") });
+    let signals = collectRiskSignals(root, { since: opts.since, limit, paths: paths.map((p) => (0, import_node_path55.relative)(root, (0, import_node_path55.resolve)(p)) || ".") });
     if (opts.hint && paths.length === 0) {
       const hit = hintMatches(root, opts.hint);
       if (hit.files.length > 0) {
@@ -40997,7 +41476,7 @@ function registerProveCommand(program2) {
   });
   prove.command("check [model]").description("Elaborate a model (or every model) with the local Lean toolchain and report each property").option("--timeout <ms>", "Per-model timeout in ms", "120000").option("--json", "Machine-readable output").action((model, opts) => {
     const root = repoRoot();
-    if (!(0, import_node_fs70.existsSync)((0, import_node_path52.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs72.existsSync)((0, import_node_path55.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -41021,7 +41500,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
     const reports = [];
     for (const f of files) {
       const report = checkModel(tc, root, f, { timeoutMs: Math.max(1e3, Number(opts.timeout) || 12e4) });
-      report.file = (0, import_node_path52.relative)(root, f);
+      report.file = (0, import_node_path55.relative)(root, f);
       reports.push(report);
       try {
         writeResult(root, report);
@@ -41059,7 +41538,7 @@ ${build.stderr.split("\n").filter((l) => !l.startsWith("trace:")).slice(0, 20).j
       printError("Not logged in \u2014 replays run on the Verity service. Run `verity login` first.");
       process.exit(2);
     }
-    if (!(0, import_node_fs70.existsSync)((0, import_node_path52.join)(root, PROOFS_DIR, "lakefile.toml"))) {
+    if (!(0, import_node_fs72.existsSync)((0, import_node_path55.join)(root, PROOFS_DIR, "lakefile.toml"))) {
       printError(`No ${PROOFS_DIR}/ project here. Run \`verity prove init\` first.`);
       process.exit(2);
     }
@@ -41090,7 +41569,7 @@ ${report.error ?? ""}`);
       printInfo(opts.property ? `${model} ${opts.property} has no counterexample to replay` : `${model} has no counterexample to replay`);
       return;
     }
-    const modelSource = readRegularFileInRoot(root, (0, import_node_path52.relative)(root, file), 512 * 1024);
+    const modelSource = readRegularFileInRoot(root, (0, import_node_path55.relative)(root, file), 512 * 1024);
     if (!opts.json) printInfo(`replaying ${targets.length} counterexample(s) of ${model} in network-less containers (${Math.min(targets.length, REPLAY_CONCURRENCY)} at a time)\u2026`);
     const outcomes = await mapPool(targets, REPLAY_CONCURRENCY, async (p) => {
       const brief = buildReplayBrief(root, report, p, modelSource.ok ? modelSource.content : "");
@@ -41110,7 +41589,7 @@ ${report.error ?? ""}`);
   });
   prove.command("auto [files...]").description("The formal phase the pre-push guard runs: select one risky symbol among changed files, generate a model, check it, replay counterexamples (default files: the commits ahead of upstream)").option("--deadline <ms>", "Budget for the whole phase", "170000").option("--json", "Machine-readable output").action(async (paths, opts) => {
     const root = repoRoot();
-    let files = paths.map((p) => (0, import_node_path52.relative)(root, (0, import_node_path52.resolve)(p)));
+    let files = paths.map((p) => (0, import_node_path55.relative)(root, (0, import_node_path55.resolve)(p)));
     if (files.length === 0) {
       const ahead = runGitSync(root, ["diff", "--name-only", "@{upstream}...HEAD"]);
       const fallback = ahead.ok ? ahead : runGitSync(root, ["diff", "--name-only", "HEAD~1..HEAD"]);
@@ -41139,7 +41618,19 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
     }
     process.exit(outcome.findings.some((f) => f.verdict === "reproduced") ? 1 : 0);
   });
-  prove.command("generate <target>").description("Have the Verity service write a Lean model of one symbol (file#symbol), lint it, and check it here \u2014 up to 3 rounds").option("--lines <a-b>", "Model a region of the file (1-based, inclusive) instead of a named symbol").option("--hint <text>", "The user's worry, in their words (may become an intent property)").option("--revise <model>", "Revise this existing model after a diverged replay (with --note)").option("--note <text>", "What the replay showed was different (with --revise)").option("--json", "Machine-readable output").action(async (targetArg, opts) => {
+  prove.command("generate <target>").description("Have the Verity service write a Lean model of one symbol (file#symbol), lint it, and check it here \u2014 up to 3 rounds").option("--lines <a-b>", "Model a region of the file (1-based, inclusive) instead of a named symbol").option("--hint <text>", "The user's worry, in their words (may become an intent property); - reads it from stdin").option("--revise <model>", "Revise this existing model after a diverged replay (with --note)").option("--note <text>", "What the replay showed was different (with --revise); - reads it from stdin").option("--json", "Machine-readable output").action(async (targetArg, opts) => {
+    if (opts.hint === "-" && opts.note === "-") {
+      printError("Only one of --hint and --note can read stdin (-).");
+      process.exit(2);
+    }
+    for (const flag of ["hint", "note"]) {
+      const input = readTextInput(opts[flag], `--${flag}`);
+      if (!input.ok) {
+        printError(input.error);
+        process.exit(2);
+      }
+      opts[flag] = input.text;
+    }
     const root = repoRoot();
     const auth2 = await proveAuth(program2);
     if (!auth2 && !(process.env.VERITY_PROVE_DIRECT === "1" && process.env.OPENAI_API_KEY)) {
@@ -41170,9 +41661,9 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
     let revise;
     if (opts.revise) {
       const existing = resolveModelFile(root, opts.revise);
-      const src = existing ? readRegularFileInRoot(root, (0, import_node_path52.relative)(root, existing), 64 * 1024) : null;
+      const src = existing ? readRegularFileInRoot(root, (0, import_node_path55.relative)(root, existing), 64 * 1024) : null;
       if (!src || !src.ok || !opts.note) {
-        printError('--revise needs an existing model under Models/ and --note "<what the replay showed>"');
+        printError("--revise needs an existing model under Models/ and --note - with what the replay showed on stdin");
         process.exit(2);
       }
       revise = { source: src.content, note: opts.note };
@@ -41209,8 +41700,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("waive <file>").description("Dismiss the remembered formal finding(s) on a file for its current bytes \u2014 the accepted-risk path for a formal block").requiredOption("--reason <text>", "The human disposition this records (reviewer finding, ADR, \u2026)").action((file, opts) => {
     const root = repoRoot();
-    const rel0 = (0, import_node_path52.relative)(root, (0, import_node_path52.isAbsolute)(file) ? file : (0, import_node_path52.join)(root, file)).replace(/\\/g, "/");
-    const rel = rel0.startsWith("..") || (0, import_node_path52.isAbsolute)(rel0) ? null : rel0;
+    const rel0 = (0, import_node_path55.relative)(root, (0, import_node_path55.isAbsolute)(file) ? file : (0, import_node_path55.join)(root, file)).replace(/\\/g, "/");
+    const rel = rel0.startsWith("..") || (0, import_node_path55.isAbsolute)(rel0) ? null : rel0;
     if (!rel) {
       printError(`${file} is not inside this repository`);
       process.exit(2);
@@ -41226,8 +41717,8 @@ ${f.reason ? `      ${terminalText(f.reason, 2e3)}
   });
   prove.command("hash <file>").description("Print the sha256 of a file, for a model header (Verity.model \u2026 sha256). Path is REPO-relative, as in the header").action((file) => {
     const root = repoRoot();
-    const rel = (0, import_node_path52.relative)(root, (0, import_node_path52.isAbsolute)(file) ? file : (0, import_node_path52.join)(root, file));
-    const digest = rel.startsWith("..") || (0, import_node_path52.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
+    const rel = (0, import_node_path55.relative)(root, (0, import_node_path55.isAbsolute)(file) ? file : (0, import_node_path55.join)(root, file));
+    const digest = rel.startsWith("..") || (0, import_node_path55.isAbsolute)(rel) ? null : sha256InRoot(root, rel);
     if (!digest) {
       printError(`Cannot hash ${file}: it must be a regular file inside this repository (not a symlink)`);
       process.exit(2);
@@ -41261,10 +41752,10 @@ function refreshScaffold(root) {
 }
 
 // src/commands/lean.ts
-var import_node_fs71 = require("node:fs");
+var import_node_fs73 = require("node:fs");
 var import_node_child_process20 = require("node:child_process");
 var import_node_os11 = require("node:os");
-var import_node_path53 = require("node:path");
+var import_node_path56 = require("node:path");
 function registerLeanCommand(program2) {
   const lean = program2.command("lean").description("The Lean 4 toolchain formal verification needs (managed download, pinned by this CLI)");
   lean.command("status").option("--json", "Machine-readable output").description("Which toolchain would run, and whether it matches the pinned version").action((opts) => {
@@ -41281,7 +41772,7 @@ function registerLeanCommand(program2) {
     const managed = pinnedVersionDir();
     const matches = version ? version.includes(pin) : false;
     if (opts.json) {
-      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs71.existsSync)((0, import_node_path53.join)(managed, "bin")), asset: leanAssetName() });
+      printJson({ pinned: LEAN_TOOLCHAIN, found: tc?.lake ?? null, version, matches_pin: matches, managed_dir: managed, managed_installed: (0, import_node_fs73.existsSync)((0, import_node_path56.join)(managed, "bin")), asset: leanAssetName() });
       return;
     }
     printInfo(`pinned: ${LEAN_TOOLCHAIN}`);
@@ -41299,7 +41790,7 @@ function registerLeanCommand(program2) {
       process.exit(2);
     }
     const dir = pinnedVersionDir();
-    if ((0, import_node_fs71.existsSync)((0, import_node_path53.join)(dir, "bin", "lake")) && !opts.force) {
+    if ((0, import_node_fs73.existsSync)((0, import_node_path56.join)(dir, "bin", "lake")) && !opts.force) {
       printInfo(`already installed at ${dir}`);
       return;
     }
@@ -41335,18 +41826,18 @@ function registerLeanCommand(program2) {
   });
   lean.command("remove").description("Delete the Verity-managed toolchain for the pinned version").action(() => {
     const dir = pinnedVersionDir();
-    if (!(0, import_node_fs71.existsSync)(dir)) {
+    if (!(0, import_node_fs73.existsSync)(dir)) {
       printInfo("nothing to remove");
       return;
     }
-    (0, import_node_fs71.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs73.rmSync)(dir, { recursive: true, force: true });
     printInfo(`removed ${dir}`);
   });
 }
 
 // src/cli.ts
-program.name("verity").description("CLI for Verity quality gate service").version("0.34.0-experimental.421a631").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
-  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.0-experimental.421a631");
+program.name("verity").description("CLI for Verity quality gate service").version("0.34.0-experimental.53caba1").option("--token <token>", "Override authentication token").option("--service-url <url>", "Override service URL").option("--verbose", "Log HTTP requests/responses to stderr").hook("preAction", async (_thisCommand, actionCommand) => {
+  installStderrLog(actionCommand.name(), process.argv.slice(2), "0.34.0-experimental.53caba1");
   setUserNamedServiceUrl(program.opts().serviceUrl);
   try {
     await foldLegacyLocalCredential();