@davesheffer/hunch 1.18.1 → 1.19.0

package/dist/core/pipeline.js

@@ -25,14 +25,735 @@
 import { mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
+export const EXECUTION_OBLIGATION_CATEGORIES = [
+    "evidence",
+    "behavior",
+    "types",
+    "serialization",
+    "compatibility",
+    "other",
+];
+export const CONTRACT_AXES = ["runtime", "static", "serialization", "compatibility"];
 export const emptyState = () => ({
     turn: 0,
     soulInjected: false,
     blocks: 0,
+    probeBlocks: 0,
     domains: {},
     editedFiles: [],
     verifyAfterEdit: true,
+    editGeneration: 0,
+    obligations: [],
+    proofActivity: 0,
+    proofReminderActivity: 0,
+    proofReminders: 0,
 });
+const MAX_OBLIGATIONS = 12;
+const MAX_ALTERNATIVES = 6;
+const MAX_TOKENS = 8;
+const MAX_OUTPUT_MARKERS = 8;
+const MAX_PROBES = 3;
+function boundedText(value, max) {
+    if (typeof value !== "string")
+        return null;
+    const text = value.replace(/\s+/g, " ").trim();
+    return text && text.length <= max ? text : null;
+}
+function normalizeAlternatives(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.slice(0, MAX_ALTERNATIVES)
+        .filter(Array.isArray)
+        .map((alternative) => alternative.slice(0, MAX_TOKENS).map((token) => boundedText(token, 120)).filter((token) => !!token))
+        .filter((alternative) => alternative.length > 0);
+}
+function normalizeExpectation(value) {
+    const raw = value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+    if (!raw || typeof raw.success !== "boolean")
+        return null;
+    const normalizeMarkers = (markers) => {
+        if (markers === undefined)
+            return undefined;
+        if (!Array.isArray(markers))
+            return [];
+        return markers.slice(0, MAX_OUTPUT_MARKERS)
+            .map((marker) => boundedText(marker, 160))
+            .filter((marker) => !!marker);
+    };
+    const outputIncludes = normalizeMarkers(raw.output_includes);
+    const outputExcludes = normalizeMarkers(raw.output_excludes);
+    if (outputIncludes?.length === 0 || outputExcludes?.length === 0)
+        return null;
+    return {
+        success: raw.success,
+        ...(outputIncludes ? { output_includes: outputIncludes } : {}),
+        ...(outputExcludes ? { output_excludes: outputExcludes } : {}),
+    };
+}
+/** Validate untrusted MCP/env episode data. Invalid entries are ignored so the
+ * hook's fail-open safety posture remains intact. */
+export function normalizeExecutionObligations(value) {
+    if (!Array.isArray(value))
+        return [];
+    const out = [];
+    const seen = new Set();
+    for (const raw of value.slice(0, MAX_OBLIGATIONS)) {
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            continue;
+        const item = raw;
+        const id = boundedText(item.id, 100);
+        const description = boundedText(item.description, 320);
+        const origin = item.origin;
+        const category = item.category;
+        const phase = item.phase;
+        if (!id || !/^[A-Za-z0-9._:-]+$/.test(id) || seen.has(id) || !description)
+            continue;
+        if (origin !== "memory" && origin !== "episode" && origin !== "manual")
+            continue;
+        if (!EXECUTION_OBLIGATION_CATEGORIES.includes(category))
+            continue;
+        if (phase !== "before-edit" && phase !== "session" && phase !== "after-edit")
+            continue;
+        const alternatives = normalizeAlternatives(item.command_alternatives);
+        if (!alternatives.length)
+            continue;
+        const expected = normalizeExpectation(item.expected);
+        if (!expected)
+            continue;
+        const rawProbe = item.probe && typeof item.probe === "object" && !Array.isArray(item.probe)
+            ? item.probe
+            : null;
+        const probeId = boundedText(rawProbe?.id, 100);
+        const probeStage = rawProbe?.stage;
+        const probeClaim = boundedText(rawProbe?.claim, 480);
+        const probeFalsifier = boundedText(rawProbe?.falsifier, 480);
+        const probeCommand = boundedText(rawProbe?.command, 1_600);
+        const probe = probeId && /^[A-Za-z0-9._:-]+$/.test(probeId)
+            && (probeStage === "baseline" || probeStage === "validation")
+            && probeClaim && probeFalsifier && probeCommand
+            ? { id: probeId, stage: probeStage, claim: probeClaim, falsifier: probeFalsifier, command: probeCommand }
+            : undefined;
+        seen.add(id);
+        out.push({
+            id,
+            origin,
+            category: category,
+            phase,
+            description,
+            command_alternatives: alternatives,
+            expected,
+            ...(probe ? { probe } : {}),
+        });
+    }
+    return out;
+}
+/** Validate untrusted probe specs. Probes are declarative data; only the agent
+ * sees the bounded command, and ordinary tool hooks observe its result. */
+export function normalizeExecutableProbes(value) {
+    if (!Array.isArray(value))
+        return [];
+    const probes = [];
+    const seen = new Set();
+    for (const raw of value.slice(0, MAX_PROBES)) {
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            continue;
+        const item = raw;
+        const id = boundedText(item.id, 100);
+        const claim = boundedText(item.claim, 480);
+        const falsifier = boundedText(item.falsifier, 480);
+        const command = boundedText(item.command, 1_600);
+        const origin = item.origin;
+        const category = item.category;
+        const alternatives = normalizeAlternatives(item.command_alternatives);
+        const expectedBefore = normalizeExpectation(item.expected_before);
+        const expectedAfter = normalizeExpectation(item.expected_after);
+        const rawArtifact = item.artifact && typeof item.artifact === "object" && !Array.isArray(item.artifact)
+            ? item.artifact
+            : null;
+        const artifactPath = boundedText(rawArtifact?.path, 200);
+        const artifactContent = typeof rawArtifact?.content === "string" && rawArtifact.content.length > 0 && rawArtifact.content.length <= 4_000
+            ? rawArtifact.content
+            : null;
+        const artifact = artifactPath && /^\.hunch-probes\/[A-Za-z0-9._/-]+$/.test(artifactPath)
+            && !artifactPath.split("/").includes("..") && artifactContent
+            ? { path: artifactPath, content: artifactContent }
+            : undefined;
+        if (rawArtifact && !artifact)
+            continue;
+        if (!id || !/^[A-Za-z0-9._:-]+$/.test(id) || seen.has(id) || !claim || !falsifier || !command)
+            continue;
+        if (origin !== "memory" && origin !== "episode" && origin !== "manual")
+            continue;
+        if (!EXECUTION_OBLIGATION_CATEGORIES.includes(category))
+            continue;
+        if (!alternatives.length || !expectedBefore || !expectedAfter)
+            continue;
+        seen.add(id);
+        probes.push({
+            id,
+            origin,
+            category: category,
+            claim,
+            falsifier,
+            command,
+            ...(artifact ? { artifact } : {}),
+            command_alternatives: alternatives,
+            expected_before: expectedBefore,
+            expected_after: expectedAfter,
+        });
+    }
+    return probes;
+}
+const CONTRACT_AXIS_BY_CATEGORY = {
+    behavior: "runtime",
+    types: "static",
+    serialization: "serialization",
+    compatibility: "compatibility",
+};
+function markerAssignments(expectation) {
+    const assignments = new Map();
+    for (const marker of expectation.output_includes ?? []) {
+        const match = marker.match(/^([^=\s]+)=([^\s]+)$/);
+        if (match)
+            assignments.set(match[1].toLowerCase(), match[2].toLowerCase());
+    }
+    return assignments;
+}
+/** Infer which contract consumers an immutable executable contrast actually
+ * exercises. This is deliberately conservative: static coverage requires both
+ * type-shaped source and a typechecking command, while compatibility requires
+ * at least one key=value control that stays identical across red and green. */
+export function discoverExecutableProbeContractAxes(value) {
+    const probe = normalizeExecutableProbes([value])[0];
+    if (!probe)
+        return [];
+    const source = probe.artifact?.content ?? "";
+    const command = [probe.command, ...probe.command_alternatives.flat()].join(" ");
+    const axes = new Set();
+    if (probe.category === "behavior" || /\.(?:safeParse|parse|parseAsync)\s*\(/.test(source))
+        axes.add("runtime");
+    if (/\b(?:tsc|typecheck)\b|--typecheck\b/i.test(command)
+        && /expectTypeOf|\bz\.(?:input|output)\b|\[\s*["']_zod["']\s*\]|\b(?:Input|Output)\s*</.test(source)) {
+        axes.add("static");
+    }
+    if (/toJSONSchema|jsonSchema|serialize|deserialize|openapi/i.test(source))
+        axes.add("serialization");
+    const before = markerAssignments(probe.expected_before);
+    const after = markerAssignments(probe.expected_after);
+    const stableControls = [...before].filter(([key, result]) => key !== "state" && after.get(key) === result);
+    if (probe.category === "compatibility" || stableControls.length > 0)
+        axes.add("compatibility");
+    return CONTRACT_AXES.filter((axis) => axes.has(axis));
+}
+/** Compare a contrast with its broader proof plan. This audit is diagnostic:
+ * category-labelled regression tests are not proof that an axis is closed. */
+export function auditExecutableProbeContractAxes(probeValue, obligationValue) {
+    const obligations = normalizeExecutionObligations(obligationValue);
+    const requiredSet = new Set();
+    for (const obligation of obligations) {
+        if (obligation.phase !== "after-edit")
+            continue;
+        const axis = CONTRACT_AXIS_BY_CATEGORY[obligation.category];
+        if (axis)
+            requiredSet.add(axis);
+    }
+    const coveredSet = new Set(discoverExecutableProbeContractAxes(probeValue));
+    const required = CONTRACT_AXES.filter((axis) => requiredSet.has(axis));
+    const covered = CONTRACT_AXES.filter((axis) => coveredSet.has(axis));
+    const missing = required.filter((axis) => !coveredSet.has(axis));
+    return { required, covered, missing };
+}
+/** Promote only independently falsifiable red→green probes for uncovered axes.
+ * A passing neighboring test is intentionally ineligible: the V experiment
+ * showed that it can resolve every receipt while leaving the claimed static
+ * contract wrong. */
+export function compileContractAxisProbeClosure(contrastValue, obligationValue, candidateValue) {
+    const audit = auditExecutableProbeContractAxes(contrastValue, obligationValue);
+    const missing = new Set(audit.missing);
+    const chosen = new Map();
+    for (const probe of normalizeExecutableProbes(candidateValue)) {
+        const axis = CONTRACT_AXIS_BY_CATEGORY[probe.category];
+        if (!axis || !missing.has(axis) || chosen.has(axis))
+            continue;
+        const before = new Set((probe.expected_before.output_includes ?? []).map((marker) => marker.toLowerCase()));
+        const after = new Set((probe.expected_after.output_includes ?? []).map((marker) => marker.toLowerCase()));
+        if (!before.has("state=red") || !after.has("state=green"))
+            continue;
+        chosen.set(axis, probe);
+    }
+    return {
+        ...audit,
+        probes: CONTRACT_AXES.flatMap((axis) => {
+            const probe = chosen.get(axis);
+            return probe ? [probe] : [];
+        }),
+    };
+}
+/** Collapse a qualified axis closure into one staged red→green probe. The main
+ * contrast runs first on both passes. While it is red, consumer probes are
+ * skipped; once it turns green, only then are the independently qualified
+ * static/serialization/compatibility commands executed. This keeps the biting
+ * closure of W without forcing every baseline into the agent's pre-edit loop. */
+export function compileAdaptiveContractAxisProbeClosure(contrastValue, obligationValue, candidateValue) {
+    const closure = compileContractAxisProbeClosure(contrastValue, obligationValue, candidateValue);
+    const disclosures = closure.probes.map(({ category, claim, falsifier }) => ({ category, claim, falsifier }));
+    const contrast = normalizeExecutableProbes([contrastValue])[0];
+    if (!contrast || closure.probes.length === 0)
+        return { ...closure, probe: null, disclosures };
+    const slug = contrast.id.replace(/[^A-Za-z0-9._-]+/g, "-").slice(0, 80);
+    const artifactPath = `.hunch-probes/${slug}-adaptive.mjs`;
+    const specs = [contrast, ...closure.probes].map((probe, index) => ({
+        label: index === 0 ? "main" : probe.category,
+        command: probe.command,
+        expected: probe.expected_after,
+    }));
+    const artifactContent = [
+        `import { spawnSync } from "node:child_process";`,
+        `const specs=${JSON.stringify(specs)};`,
+        `const run=(spec)=>{const p=spawnSync(spec.command,{shell:true,encoding:"utf8",env:process.env});const output=String(p.stdout??"")+String(p.stderr??"");if(output)process.stdout.write(output.endsWith("\\n")?output:output+"\\n");const text=output.toLowerCase();const ok=((p.status===0)===spec.expected.success)&&(spec.expected.output_includes??[]).every(x=>text.includes(x.toLowerCase()))&&!(spec.expected.output_excludes??[]).some(x=>text.includes(x.toLowerCase()));return ok;};`,
+        `const main=run(specs[0]);if(!main){console.log("HUNCH_ADAPTIVE state=red stage=main axes=skipped");}else{const failed=[];for(const spec of specs.slice(1)){if(!run(spec))failed.push(spec.label);}console.log("HUNCH_ADAPTIVE state="+(failed.length?"red":"green")+" stage="+(failed.length?"axes":"closed")+" axes="+(specs.length-1)+" failed="+(failed.join(",")||"none"));}`,
+    ].join("\n");
+    const probe = {
+        id: `${contrast.id}:adaptive`,
+        origin: contrast.origin,
+        category: contrast.category,
+        claim: `Make the main contrast green, then close ${closure.probes.length} independently qualified missing consumer axis${closure.probes.length === 1 ? "" : "es"}.`,
+        falsifier: "Reject the fix if the main behavior remains red or any qualified consumer contract stays red after the main behavior turns green.",
+        command: `node ${artifactPath}`,
+        artifact: { path: artifactPath, content: artifactContent },
+        command_alternatives: [["node", artifactPath]],
+        expected_before: {
+            success: true,
+            output_includes: ["HUNCH_ADAPTIVE", "state=red", "stage=main", "axes=skipped"],
+        },
+        expected_after: {
+            success: true,
+            output_includes: ["HUNCH_ADAPTIVE", "state=green", "stage=closed", `axes=${closure.probes.length}`, "failed=none"],
+            output_excludes: ["state=red"],
+        },
+    };
+    return { ...closure, probe: normalizeExecutableProbes([probe])[0] ?? null, disclosures };
+}
+/** Compile one author-ranked consumer risk into a bounded design hint. The
+ * selected probe must already belong to the independently qualified closure.
+ * Commands, claims, and falsifiers are deliberately excluded: this hint names
+ * where to leave design room without turning the deferred consumer into work. */
+export function compileContractAxisRiskHint(closure, value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const raw = value;
+    const probeId = boundedText(raw.probe_id, 100);
+    const owner = boundedText(raw.owner, 240);
+    if (!probeId || !owner || owner.startsWith("/") || owner.split("::")[0].split("/").includes(".."))
+        return null;
+    if (!/^[A-Za-z0-9._/-]+(?:::[A-Za-z0-9_$.-]+)?$/.test(owner))
+        return null;
+    const selected = closure.probes.find((probe) => probe.id === probeId);
+    return selected ? { probe_id: selected.id, category: selected.category, owner } : null;
+}
+const OWNER_ANCHOR_STOP_WORDS = new Set([
+    "array", "classic", "core", "decode", "encode", "false", "input", "mini", "number", "object", "optional",
+    "output", "parse", "required", "safeparse", "schema", "string", "tostring", "true",
+    "type", "undefined", "unknown", "value",
+]);
+/** Infer one bounded risk owner using only qualified probes and pre-edit source
+ * text supplied by the caller. Compatibility is ranked ahead of static and
+ * serialization because it most often crosses a public-surface owner. Within
+ * the chosen probe, public identifiers nominate existing declarations; an
+ * explicit package surface in the probe breaks ties without reading future
+ * changes. */
+export function rankContractAxisRiskOwners(closure, sourceValue) {
+    if (!Array.isArray(sourceValue) || closure.probes.length === 0)
+        return null;
+    const categoryRisk = {
+        compatibility: 30,
+        types: 20,
+        serialization: 10,
+        behavior: 5,
+    };
+    const probe = closure.probes
+        .map((candidate, index) => ({ candidate, index, risk: categoryRisk[candidate.category] ?? 0 }))
+        .sort((a, b) => b.risk - a.risk || a.index - b.index)[0]?.candidate;
+    if (!probe)
+        return null;
+    const artifact = probe.artifact?.content ?? "";
+    const words = `${probe.id} ${probe.claim} ${probe.falsifier}`.match(/[A-Za-z_$][A-Za-z0-9_$-]{3,}/g) ?? [];
+    const publicMembers = [...artifact.matchAll(/(?:\bz|\bvalue|\boriginal|\bcodec)\.([A-Za-z_$][A-Za-z0-9_$]*)/g)].map((match) => match[1]);
+    const calledMembers = [...artifact.matchAll(/(?:\bz|\bvalue|\boriginal|\bcodec)\.([A-Za-z_$][A-Za-z0-9_$]*)\s*\(/g)]
+        .map((match) => match[1]);
+    const calledAnchors = new Set(calledMembers.map((member) => member.toLowerCase().replace(/[^a-z0-9]/g, "")));
+    const candidates = new Map();
+    for (const [raw, weight] of [
+        ...words.map((word) => [word, 1]),
+        ...publicMembers.map((member) => [member, 4]),
+        ...calledMembers.map((member) => [member, 12]),
+    ]) {
+        const token = raw.replace(/-/g, "").toLowerCase();
+        if (token.length < 4 || OWNER_ANCHOR_STOP_WORDS.has(token))
+            continue;
+        candidates.set(token, (candidates.get(token) ?? 0) + weight);
+    }
+    if (candidates.size === 0)
+        return null;
+    const scope = artifact.match(/packages\/[A-Za-z0-9._-]+\/src\/(?:v\d+\/)?(classic|mini|core)\//)?.[1] ?? null;
+    const sources = [];
+    const seen = new Set();
+    for (const raw of sourceValue.slice(0, 4_000)) {
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            continue;
+        const item = raw;
+        const path = boundedText(item.path, 240);
+        const content = typeof item.content === "string" && item.content.length <= 1_000_000 ? item.content : null;
+        if (!path || !content || seen.has(path) || path.startsWith("/") || path.split("/").includes(".."))
+            continue;
+        if (!/^[A-Za-z0-9._/-]+\.tsx?$/.test(path) || /(?:^|\/)(?:tests?|__tests__)(?:\/|$)|\.test\.tsx?$/.test(path))
+            continue;
+        seen.add(path);
+        sources.push({ path, content });
+    }
+    const ranked = [];
+    const declaration = /(?:^|\n)\s*(?:export\s+)?(?:declare\s+)?(interface|class|function|const|type)\s+([$A-Za-z_][$\w]*)/g;
+    for (const source of sources) {
+        for (const match of source.content.matchAll(declaration)) {
+            const kind = match[1];
+            const symbol = match[2];
+            const normalized = symbol.toLowerCase().replace(/[^a-z0-9]/g, "");
+            for (const [anchor, evidenceWeight] of candidates) {
+                if (!normalized.includes(anchor))
+                    continue;
+                let score = normalized === anchor
+                    ? probe.category === "compatibility" ? 120 : 130
+                    : 90;
+                if (kind === "interface" || kind === "class")
+                    score += probe.category === "compatibility" ? 55 : 35;
+                else
+                    score += 10;
+                if (scope && source.path.includes(`/${scope}/`))
+                    score += 50;
+                if (source.path.endsWith("/schemas.ts") || source.path.endsWith("/schema.ts"))
+                    score += 20;
+                if (probe.category === "compatibility" && scope && source.path.includes(`/${scope}/`))
+                    score += 20;
+                if (probe.category === "types" && /\/(?:classic|mini)\//.test(source.path))
+                    score += 10;
+                if (calledAnchors.has(anchor))
+                    score += 45;
+                score += Math.min(10, Math.floor(normalized.length / 4));
+                score += Math.min(40, evidenceWeight * 5);
+                ranked.push({ owner: `${source.path}::${symbol}`, anchor, score });
+            }
+        }
+    }
+    ranked.sort((a, b) => b.score - a.score || a.owner.localeCompare(b.owner));
+    const ownerScores = new Map();
+    for (const item of ranked) {
+        if (!ownerScores.has(item.owner))
+            ownerScores.set(item.owner, item);
+    }
+    const uniqueOwners = [...ownerScores.values()];
+    return {
+        probe_id: probe.id,
+        category: probe.category,
+        candidates: uniqueOwners.slice(0, 20),
+    };
+}
+export function inferContractAxisRiskHint(closure, sourceValue) {
+    const ranking = rankContractAxisRiskOwners(closure, sourceValue);
+    if (!ranking)
+        return null;
+    const uniqueOwners = ranking.candidates;
+    const best = uniqueOwners[0];
+    if (!best || best.score < 120)
+        return null;
+    const runnerUp = uniqueOwners[1];
+    if (!runnerUp || best.score - runnerUp.score >= 5) {
+        return {
+            hint: { probe_id: ranking.probe_id, category: ranking.category, owner: best.owner },
+            level: "symbol",
+            anchor: best.anchor,
+            score: best.score,
+            runner_up_score: runnerUp?.score ?? null,
+        };
+    }
+    const fileScores = new Map();
+    for (const item of uniqueOwners) {
+        const path = item.owner.split("::")[0];
+        if (!fileScores.has(path))
+            fileScores.set(path, { ...item, owner: path });
+    }
+    const files = [...fileScores.values()];
+    const bestFile = files[0];
+    const runnerUpFile = files[1];
+    if (!bestFile || (runnerUpFile && bestFile.score - runnerUpFile.score < 5))
+        return null;
+    return {
+        hint: { probe_id: ranking.probe_id, category: ranking.category, owner: bestFile.owner },
+        level: "file",
+        anchor: bestFile.anchor,
+        score: bestFile.score,
+        runner_up_score: runnerUpFile?.score ?? null,
+    };
+}
+const IMPLEMENTATION_OWNER_STOP_WORDS = new Set([
+    "about", "after", "again", "also", "because", "before", "being", "classic", "could", "does", "error", "expected",
+    "from", "have", "input", "into", "issue", "json", "mini", "object", "output", "parse", "result", "safe", "schema",
+    "should", "string", "that", "their", "there", "these", "this", "type", "typescript", "using", "value", "version", "when",
+    "where", "which", "with", "would", "zod",
+]);
+function implementationOwnerTokens(value) {
+    const expanded = value.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z])([A-Z][a-z])/g, "$1 $2");
+    return (expanded.toLowerCase().match(/[a-z_$][a-z0-9_$-]{2,}/g) ?? [])
+        .map((token) => token.replace(/^[$_-]+|[$_-]+$/g, ""))
+        .filter((token) => token.length >= 3 && !IMPLEMENTATION_OWNER_STOP_WORDS.has(token));
+}
+/** Rank likely implementation declarations from issue/reproduction prose. This
+ * is deliberately separate from contract-axis owner inference: a public API
+ * can own a deferred consumer contract while an internal declaration owns the
+ * smallest patch. The ranker is deterministic BM25 over bounded pre-edit
+ * declaration text, with literal path/symbol disclosure recorded separately. */
+export function rankIssueImplementationOwners(issueValue, sourceValue, candidateLimit = 20) {
+    const issue = boundedText(issueValue, 100_000);
+    if (!issue || !Array.isArray(sourceValue))
+        return null;
+    const issueLower = issue.toLowerCase();
+    const queryTokens = implementationOwnerTokens(issue);
+    if (queryTokens.length === 0)
+        return null;
+    const queryCounts = new Map();
+    for (const token of queryTokens)
+        queryCounts.set(token, (queryCounts.get(token) ?? 0) + 1);
+    const sources = [];
+    const seen = new Set();
+    for (const raw of sourceValue.slice(0, 4_000)) {
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            continue;
+        const item = raw;
+        const path = boundedText(item.path, 240);
+        const content = typeof item.content === "string" && item.content.length <= 1_000_000 ? item.content : null;
+        if (!path || !content || seen.has(path) || path.startsWith("/") || path.split("/").includes(".."))
+            continue;
+        if (!/^[A-Za-z0-9._/-]+\.tsx?$/.test(path) || /(?:^|\/)(?:tests?|__tests__)(?:\/|$)|\.test\.tsx?$/.test(path))
+            continue;
+        seen.add(path);
+        sources.push({ path, content });
+    }
+    const declarations = [];
+    const declaration = /^(?:export\s+)?(?:declare\s+)?(?:interface|class|function|const|type)\s+([$A-Za-z_][$\w]*)/gm;
+    for (const source of sources) {
+        const matches = [...source.content.matchAll(declaration)];
+        for (let index = 0; index < matches.length; index++) {
+            const match = matches[index];
+            const symbol = match[1];
+            const start = match.index ?? 0;
+            const end = matches[index + 1]?.index ?? source.content.length;
+            const text = `${symbol} ${symbol} ${source.content.slice(start, end)}`.slice(0, 80_000);
+            const tokens = implementationOwnerTokens(text);
+            const counts = new Map();
+            for (const token of tokens)
+                counts.set(token, (counts.get(token) ?? 0) + 1);
+            declarations.push({ owner: `${source.path}::${symbol}`, path: source.path, symbol, tokens, counts, length: Math.max(1, tokens.length) });
+        }
+    }
+    if (declarations.length === 0)
+        return null;
+    const documentFrequency = new Map();
+    for (const item of declarations) {
+        for (const token of new Set(item.tokens))
+            documentFrequency.set(token, (documentFrequency.get(token) ?? 0) + 1);
+    }
+    const averageLength = declarations.reduce((sum, item) => sum + item.length, 0) / declarations.length;
+    const genericBasenames = new Set(["api.ts", "index.ts", "schemas.ts", "types.ts", "util.ts"]);
+    const candidates = declarations.map((item) => {
+        let lexicalScore = 0;
+        for (const [token, queryFrequency] of queryCounts) {
+            const frequency = item.counts.get(token) ?? 0;
+            if (!frequency)
+                continue;
+            const documentsWithToken = documentFrequency.get(token) ?? 0;
+            const inverseDocumentFrequency = Math.log(1 + (declarations.length - documentsWithToken + 0.5) / (documentsWithToken + 0.5));
+            const saturation = (frequency * 2.2) / (frequency + 1.2 * (0.25 + 0.75 * (item.length / averageLength)));
+            lexicalScore += inverseDocumentFrequency * saturation * Math.min(3, queryFrequency);
+        }
+        const normalizedSymbol = item.symbol.toLowerCase().replace(/^\$+/, "");
+        const symbolPattern = new RegExp(`(^|[^a-z0-9_$])\\$?${normalizedSymbol.replace(/[$]/g, "\\$")}([^a-z0-9_$]|$)`, "i");
+        const symbolDisclosed = normalizedSymbol.length >= 3 && symbolPattern.test(issue);
+        const path = item.path.toLowerCase();
+        const suffix = path.replace(/^packages\/[^/]+\//, "");
+        const file = path.split("/").at(-1);
+        const pathDisclosed = issueLower.includes(path) || issueLower.includes(suffix)
+            || (!genericBasenames.has(file) && issueLower.includes(file));
+        let score = lexicalScore;
+        if (symbolDisclosed)
+            score += 24;
+        if (pathDisclosed)
+            score += 32;
+        if (new RegExp(`(?:\\.|\\b)${normalizedSymbol.replace(/[$]/g, "\\$")}\\s*\\(`, "i").test(issue))
+            score += 8;
+        return {
+            owner: item.owner,
+            score: Math.round(score * 100) / 100,
+            lexical_score: Math.round(lexicalScore * 100) / 100,
+            symbol_disclosed: symbolDisclosed,
+            path_disclosed: pathDisclosed,
+        };
+    }).sort((a, b) => b.score - a.score || a.owner.localeCompare(b.owner));
+    const limit = Number.isSafeInteger(candidateLimit) ? Math.max(1, Math.min(4_000, candidateLimit)) : 20;
+    return { candidates: candidates.slice(0, limit) };
+}
+/** Conservative delivery gate for implementation-owner retrieval. Thresholds
+ * are intentionally exposed in the result and require an absolute score plus
+ * a stable lead; benchmark policy may impose stricter external promotion. */
+export function inferIssueImplementationOwner(issueValue, sourceValue) {
+    const ranking = rankIssueImplementationOwners(issueValue, sourceValue);
+    const best = ranking?.candidates[0];
+    const runnerUp = ranking?.candidates[1];
+    if (!best || best.score < 18 || (runnerUp && best.score - runnerUp.score < 3))
+        return null;
+    return {
+        owner: best.owner,
+        score: best.score,
+        runner_up_score: runnerUp?.score ?? null,
+        symbol_disclosed: best.symbol_disclosed,
+        path_disclosed: best.path_disclosed,
+    };
+}
+/** Compile one probe into two independently observed receipts. The baseline is
+ * eligible only before a product edit; validation is eligible only afterwards. */
+export function compileExecutableProbes(value) {
+    return normalizeExecutableProbes(value).flatMap((probe) => {
+        const binding = (stage) => ({
+            id: probe.id,
+            stage,
+            claim: probe.claim,
+            falsifier: probe.falsifier,
+            command: probe.command,
+        });
+        return [
+            {
+                id: `${probe.id}:baseline`,
+                origin: probe.origin,
+                category: probe.category,
+                phase: "before-edit",
+                description: `Establish the pre-change result for: ${probe.claim.slice(0, 260)}`,
+                command_alternatives: probe.command_alternatives,
+                expected: probe.expected_before,
+                probe: binding("baseline"),
+            },
+            {
+                id: `${probe.id}:validation`,
+                origin: probe.origin,
+                category: probe.category,
+                phase: "after-edit",
+                description: `Re-run the same falsification probe after the latest edit: ${probe.claim.slice(0, 230)}`,
+                command_alternatives: probe.command_alternatives,
+                expected: probe.expected_after,
+                probe: binding("validation"),
+            },
+        ];
+    });
+}
+function sameObligation(left, right) {
+    const shape = (item) => ({
+        id: item.id,
+        origin: item.origin,
+        category: item.category,
+        phase: item.phase,
+        description: item.description,
+        command_alternatives: item.command_alternatives,
+        expected: item.expected,
+        ...(item.probe ? { probe: item.probe } : {}),
+    });
+    return JSON.stringify(shape(left)) === JSON.stringify(shape(right));
+}
+/** Add/refresh controller obligations. Replacing an origin lets a newer
+ * hunch_context task discard stale memory obligations without disturbing a
+ * benchmark episode or a manually supplied plan. */
+export function armExecutionObligations(state, input, options = {}) {
+    const specs = normalizeExecutionObligations(input);
+    const existing = new Map(state.obligations.map((item) => [item.id, item]));
+    const retained = options.replaceOrigin
+        ? state.obligations.filter((item) => item.origin !== options.replaceOrigin)
+        : [...state.obligations];
+    const byId = new Map(retained.map((item) => [item.id, item]));
+    for (const spec of specs) {
+        const previous = existing.get(spec.id);
+        const tracked = previous && sameObligation(previous, spec)
+            ? previous
+            : { ...spec, status: "pending" };
+        byId.set(spec.id, tracked);
+    }
+    return { ...state, obligations: [...byId.values()].slice(0, MAX_OBLIGATIONS) };
+}
+export function pendingExecutionObligations(state) {
+    return state.obligations.filter((item) => item.status !== "satisfied");
+}
+/** Before-edit evidence is useful only before implementation. At firm/strict,
+ * deny at most two product edits per prompt until all such receipts exist;
+ * then fail open so a broken probe or discriminator cannot deadlock the agent. */
+export function beforeEditProbeVerdict(state) {
+    const pending = state.obligations.filter((item) => item.phase === "before-edit" && item.status !== "satisfied");
+    if (!pending.length || state.probeBlocks >= 2)
+        return { block: false, state };
+    const instructions = pending.slice(0, 3).map((item) => {
+        const command = item.probe?.command ?? firstCommand(item);
+        const markers = item.expected.output_includes?.length ? ` with output including ${item.expected.output_includes.join(" + ")}` : "";
+        return `[${item.category}] ${item.description}: run exactly ${command}; expect ${item.expected.success ? "success" : "failure"}${markers}`;
+    }).join(". ");
+    return {
+        block: true,
+        state: { ...state, probeBlocks: state.probeBlocks + 1 },
+        reason: `Hunch evidence gate — complete all pre-edit evidence before editing product code. ${instructions}. ` +
+            `A failed command for the wrong reason does not count.`,
+    };
+}
+export function executionObligationBrief(state) {
+    const pending = pendingExecutionObligations(state);
+    if (!pending.length)
+        return "";
+    return [
+        `Hunch Execution Controller — ${pending.length} observable obligation(s) must be evidenced before completion:`,
+        ...pending.map((item, index) => {
+            const expectation = `expected result: ${item.expected.success ? "success" : "failure"}` +
+                `${item.expected.output_includes?.length ? `; output includes ${item.expected.output_includes.join(" + ")}` : ""}` +
+                `${item.expected.output_excludes?.length ? `; output excludes ${item.expected.output_excludes.join(" + ")}` : ""}`;
+            if (item.probe?.stage === "baseline") {
+                return `${index + 1}. [probe/before-edit] BASELINE — ${item.probe.claim} ` +
+                    `(run exactly before any product edit: ${item.probe.command}; ${expectation}). ` +
+                    `Disproof condition: ${item.probe.falsifier}`;
+            }
+            if (item.probe?.stage === "validation") {
+                return `${index + 1}. [probe/after-edit] VALIDATION — re-run probe ${item.probe.id} after the final product edit (${expectation}).`;
+            }
+            return `${index + 1}. [${item.category}/${item.phase}] ${item.description} ` +
+                `(accepted command: ${item.command_alternatives.map((alternative) => alternative.join(" + ")).join(" OR ")}; ${expectation})`;
+        }),
+        "Before-edit probe baselines cannot be credited after implementation starts. After-edit obligations reset whenever product code changes again. Running a command is not enough: its observed result must satisfy the expectation.",
+    ].join("\n");
+}
+/** Harness/orchestrator injection. Malformed input returns no obligations. */
+export function environmentExecutionObligations(value = process.env.HUNCH_EXECUTION_OBLIGATIONS) {
+    if (!value)
+        return [];
+    try {
+        return normalizeExecutionObligations(JSON.parse(value));
+    }
+    catch {
+        return [];
+    }
+}
+/** Harness/orchestrator probe injection. Malformed input returns no probes. */
+export function environmentExecutableProbes(value = process.env.HUNCH_EXECUTABLE_PROBES) {
+    if (!value)
+        return [];
+    try {
+        return normalizeExecutableProbes(JSON.parse(value));
+    }
+    catch {
+        return [];
+    }
+}
 export const DEFAULT_PROFILES = {
     backend: {
         paths: /(^|\/)(src|lib|server|api|core|store|services?)\/|\.(ts|mts|cts|js|mjs|cjs|py|go|rs|java|rb|php)$/i,
@@ -75,7 +796,7 @@ function verifyPattern(state, profiles = DEFAULT_PROFILES) {
 // ------------------------------------------------------- state transitions
 /** New user prompt: fresh block budget. */
 export function onPrompt(state) {
-    return { ...state, turn: state.turn + 1, blocks: 0 };
+    return { ...state, turn: state.turn + 1, blocks: 0, probeBlocks: 0 };
 }
 /** Edit/Write/MultiEdit landed on `path`. */
 export function onEdit(state, path, profiles = DEFAULT_PROFILES) {
@@ -84,10 +805,15 @@ export function onEdit(state, path, profiles = DEFAULT_PROFILES) {
     const domains = { ...state.domains };
     for (const d of classifyDomains(path, profiles))
         domains[d] = true;
+    const editGeneration = state.editGeneration + 1;
     return {
         ...state,
         domains,
         verifyAfterEdit: false,
+        editGeneration,
+        obligations: state.obligations.map((item) => item.phase === "after-edit"
+            ? { ...item, status: "pending", satisfied_by: undefined, satisfied_at_edit: undefined, last_attempt: undefined }
+            : item),
         editedFiles: state.editedFiles.includes(path) ? state.editedFiles : [...state.editedFiles, path],
     };
 }
@@ -97,17 +823,57 @@ export function onEdit(state, path, profiles = DEFAULT_PROFILES) {
  *  thing you changed is verification, and uncredited real checks are how a
  *  gate gets disabled out of annoyance (first live false-negative: an HTML
  *  structure assertion via `node -e` was blocked on 2026-07-08). */
-export function onCommand(state, command, profiles = DEFAULT_PROFILES) {
+export function onCommand(state, command, outcome = { status: "unknown", output: "" }, profiles = DEFAULT_PROFILES) {
+    const normalizedCommand = command.replace(/\s+/g, " ").trim().toLowerCase();
+    const obligations = state.obligations.map((item) => {
+        const eligible = item.phase === "session"
+            || (item.phase === "before-edit" && state.editGeneration === 0)
+            || (item.phase === "after-edit" && state.editedFiles.length > 0);
+        const matched = eligible && item.command_alternatives.some((alternative) => alternative.every((token) => normalizedCommand.includes(token.toLowerCase())));
+        if (!matched)
+            return item;
+        const normalizedOutput = outcome.output.toLowerCase();
+        const missingOutput = (item.expected.output_includes ?? []).filter((marker) => !normalizedOutput.includes(marker.toLowerCase()));
+        const forbiddenOutput = (item.expected.output_excludes ?? []).filter((marker) => normalizedOutput.includes(marker.toLowerCase()));
+        const expectedOutcome = outcome.status !== "unknown" && (outcome.status === "success") === item.expected.success;
+        const expectationMet = expectedOutcome && missingOutput.length === 0 && forbiddenOutput.length === 0;
+        const lastAttempt = {
+            command: command.slice(0, 500),
+            outcome: outcome.status,
+            expectation_met: expectationMet,
+            ...(missingOutput.length ? { missing_output: missingOutput } : {}),
+            ...(forbiddenOutput.length ? { forbidden_output: forbiddenOutput } : {}),
+        };
+        // A probe receipt is a phase-bound observation, not the status of the last
+        // arbitrary runner experiment. Once red/green is observed, later command
+        // wrappers or infrastructure failures cannot erase it; a later product edit
+        // still resets validation through onEdit above.
+        if (!expectationMet && item.status === "satisfied" && item.probe)
+            return item;
+        return expectationMet ? {
+            ...item,
+            status: "satisfied",
+            satisfied_by: command.slice(0, 500),
+            satisfied_at_edit: state.editGeneration,
+            last_attempt: lastAttempt,
+        } : {
+            ...item,
+            status: "pending",
+            satisfied_by: undefined,
+            satisfied_at_edit: undefined,
+            last_attempt: lastAttempt,
+        };
+    });
     if (!state.editedFiles.length)
-        return state;
+        return { ...state, obligations };
     const editedFileNamed = state.editedFiles.some((f) => {
         const base = f.replace(/\\/g, "/").split("/").pop();
         return !!base && command.includes(base);
     });
     const verifyShaped = verifyPattern(state, profiles).test(command) || /node (--test|-e\b)/.test(command);
-    if (verifyShaped || editedFileNamed)
-        return { ...state, verifyAfterEdit: true };
-    return state;
+    if ((verifyShaped || editedFileNamed) && outcome.status !== "failure")
+        return { ...state, obligations, verifyAfterEdit: true };
+    return { ...state, obligations };
 }
 /** A verification-class skill ran (/verify, /code-review) — counts as coverage. */
 export function onSkill(state, skill) {
@@ -115,6 +881,128 @@ export function onSkill(state, skill) {
         return { ...state, verifyAfterEdit: true };
     return state;
 }
+const PROOF_CHECKPOINT_INTERVAL = 6;
+const MAX_PROOF_REMINDERS = 8;
+function firstCommand(item) {
+    return item.probe?.command ?? item.command_alternatives[0]?.join(" ") ?? "the supplied proof command";
+}
+/** Schedule bounded proof reminders while work is still happening. Stop is too
+ * late for clients that terminate at a hard turn budget, so the controller also
+ * injects checkpoints at the evidence→implementation handoff, after the first
+ * product edit, invalidated proof receipts, mismatched proof attempts, and a
+ * small activity cadence. */
+export function proofCheckpoint(before, after, activity) {
+    if (!after.obligations.length)
+        return { state: after };
+    const proofActivity = Math.max(0, after.proofActivity) + 1;
+    let state = { ...after, proofActivity };
+    const pending = pendingExecutionObligations(state);
+    if (!pending.length || state.proofReminders >= MAX_PROOF_REMINDERS)
+        return { state };
+    const attempted = activity.kind === "command"
+        ? pending.find((item) => item.last_attempt?.command === activity.command.slice(0, 500) && !item.last_attempt.expectation_met)
+        : undefined;
+    const attemptedProbe = attempted?.probe;
+    const attempt = attempted?.last_attempt;
+    const baseline = attemptedProbe?.stage === "validation"
+        ? after.obligations.find((item) => item.probe?.id === attemptedProbe.id && item.probe?.stage === "baseline")
+        : undefined;
+    const baselineMarkers = new Set((baseline?.expected.output_includes ?? []).map((marker) => marker.toLowerCase()));
+    const changedMarkers = (attempted?.expected.output_includes ?? [])
+        .filter((marker) => !baselineMarkers.has(marker.toLowerCase()));
+    const missingMarkers = new Set((attempted?.last_attempt?.missing_output ?? []).map((marker) => marker.toLowerCase()));
+    const observedChanges = changedMarkers.filter((marker) => !missingMarkers.has(marker.toLowerCase()));
+    const survivingFailures = changedMarkers.filter((marker) => missingMarkers.has(marker.toLowerCase()));
+    const markerKey = (marker) => marker.match(/^([^=\s]+)=/)?.[1]?.toLowerCase();
+    const forbiddenMarkers = attempt?.forbidden_output ?? [];
+    const regressedControls = (attempt?.missing_output ?? []).flatMap((missing) => {
+        if (!baselineMarkers.has(missing.toLowerCase()))
+            return [];
+        const key = markerKey(missing);
+        const observed = key ? forbiddenMarkers.find((marker) => markerKey(marker) === key) : undefined;
+        return observed ? [`${missing} → ${observed}`] : [];
+    });
+    const expectedOutcomeObserved = !!attempt && attempt.outcome !== "unknown"
+        && (attempt.outcome === "success") === attempted?.expected.success;
+    const falsifierPivot = attemptedProbe?.stage === "validation"
+        && baseline?.status === "satisfied"
+        && expectedOutcomeObserved
+        && observedChanges.length > 0
+        && survivingFailures.length > 0;
+    const invalidated = activity.kind === "edit"
+        ? before.obligations.filter((item) => item.phase === "after-edit" && item.status === "satisfied").length
+        : 0;
+    const firstEdit = activity.kind === "edit" && before.editGeneration === 0 && after.editGeneration > 0;
+    const pendingBeforeEdit = after.editGeneration === 0 && pending.some((item) => item.phase === "before-edit");
+    const evidenceHandoff = after.editGeneration === 0
+        && before.obligations.some((item) => item.phase === "before-edit" && item.status === "pending")
+        && !after.obligations.some((item) => item.phase === "before-edit" && item.status === "pending")
+        && pending.some((item) => item.phase === "after-edit");
+    const cadenceDue = (after.editGeneration > 0 || pendingBeforeEdit)
+        && proofActivity - Math.max(0, after.proofReminderActivity) >= PROOF_CHECKPOINT_INTERVAL;
+    const reason = falsifierPivot
+        ? "falsifier-pivot"
+        : attempted
+            ? "attempt-mismatch"
+            : invalidated > 0
+                ? "proof-invalidated"
+                : firstEdit
+                    ? "first-edit"
+                    : evidenceHandoff
+                        ? "evidence-handoff"
+                        : cadenceDue
+                            ? "cadence"
+                            : undefined;
+    if (!reason)
+        return { state };
+    const completed = state.obligations.length - pending.length;
+    const ordered = [...pending].sort((left, right) => Number(right.phase === "after-edit") - Number(left.phase === "after-edit"));
+    const next = ordered.slice(0, 3)
+        .map((item) => `[${item.category}] ${item.description} — run: ${firstCommand(item)}`)
+        .join("; ");
+    let headline;
+    if (falsifierPivot && attempted?.probe) {
+        const regression = regressedControls.length
+            ? ` A baseline control regressed (${regressedControls.join(" + ")}).`
+            : "";
+        headline = `Hunch falsifier pivot: this edit made part of the contrast newly green (${observedChanges.join(" + ")}), while the result is still missing ${survivingFailures.join(" + ")}.${regression} Preserve the newly green behavior and inspect the first mechanism or ownership boundary unique to the surviving control. Do not rerun unchanged, broaden the same fix, or revert to baseline unless you can name a replacement mechanism and test it in the next edit. If another check conflicts, classify it against the current task and provenance as an invariant or a stale expectation; a pre-fix snapshot is not an automatic veto. Make one targeted edit, then rerun the exact probe. Falsifier: ${attempted.probe.falsifier}`;
+    }
+    else if (attempted?.last_attempt) {
+        const attempt = attempted.last_attempt;
+        const mismatch = [
+            `observed ${attempt.outcome}`,
+            ...(attempt.missing_output?.length ? [`missing output: ${attempt.missing_output.join(" + ")}`] : []),
+            ...(attempt.forbidden_output?.length ? [`forbidden output present: ${attempt.forbidden_output.join(" + ")}`] : []),
+        ].join("; ");
+        headline = `Hunch proof attempt did not satisfy [${attempted.category}] ${attempted.description} (${mismatch}).`;
+    }
+    else if (invalidated > 0) {
+        headline = `Hunch proof checkpoint: the latest product edit invalidated ${invalidated} after-edit receipt(s).`;
+    }
+    else if (firstEdit) {
+        headline = "Hunch proof checkpoint: product implementation has started; reserve a verification block before the turn ends.";
+    }
+    else if (evidenceHandoff) {
+        headline = "Hunch phase handoff: pre-edit evidence is complete. Stop expanding the diagnosis; make the smallest chosen product edit now, then prove the pending contract.";
+    }
+    else if (pendingBeforeEdit) {
+        headline = "Hunch evidence checkpoint: investigation is consuming the pre-edit budget; finish the narrowest prerequisite before changing product code.";
+    }
+    else {
+        headline = "Hunch proof checkpoint: investigation is consuming the work budget; run the narrowest pending proof now.";
+    }
+    state = {
+        ...state,
+        proofReminderActivity: proofActivity,
+        proofReminders: state.proofReminders + 1,
+    };
+    return {
+        state,
+        reason,
+        reminder: `${headline} ${completed}/${state.obligations.length} expected result(s) proved. Pending: ${next}. ` +
+            "A matching command alone does not count, and turn-budget exhaustion is unresolved—not completion.",
+    };
+}
 // ------------------------------------------------------------------- gates
 export const PIPELINE_LOOP = [
     "Hunch pipeline — operating loop (enforced on observable facts, not claims):",
@@ -126,18 +1014,30 @@ export const PIPELINE_LOOP = [
     "6. REPORT — what ran, what passed, what stays unverified. Failures verbatim.",
 ].join("\n");
 export const UNVERIFIED_NAG = "Hunch pipeline: earlier product edits are still UNVERIFIED — run the relevant test/build/typecheck before claiming anything about them.";
+export function unverifiedNag(state) {
+    const pending = pendingExecutionObligations(state);
+    const generic = !state.verifyAfterEdit ? UNVERIFIED_NAG : "Hunch Execution Controller: completion evidence is still incomplete.";
+    if (!pending.length)
+        return generic;
+    return `${generic} Controller obligations still pending: ${pending.slice(0, 4).map((item) => `[${item.category}] ${item.description}`).join("; ")}.`;
+}
 /** Stop-gate verdict. Blocks only at firm/strict, only with unverified product
  *  edits, and at most twice per turn. */
 export function stopVerdict(state, firmness) {
     const gated = firmness === "firm" || firmness === "strict";
-    if (!gated || state.verifyAfterEdit || state.editedFiles.length === 0 || state.blocks >= 2)
+    const pending = pendingExecutionObligations(state);
+    const genericPending = !state.verifyAfterEdit && state.editedFiles.length > 0;
+    if (!gated || (!genericPending && !pending.length) || state.blocks >= 2)
         return { block: false };
     const domains = Object.keys(state.domains).join(", ") || "generic";
+    const obligationReason = pending.length
+        ? ` Specific obligations still pending: ${pending.slice(0, 6).map((item) => `[${item.category}/${item.phase}] ${item.description}`).join("; ")}. Run command evidence matching the supplied alternatives after the latest edit where required.`
+        : "";
     return {
         block: true,
         state: { ...state, blocks: state.blocks + 1 },
-        reason: `Hunch pipeline gate — VERIFY unsatisfied. Product files were edited (${state.editedFiles.slice(-5).join(", ")}) ` +
-            `but no verifying command ran afterwards (domain: ${domains}). Do now, in order: ` +
+        reason: `Hunch pipeline gate — VERIFY unsatisfied.${genericPending ? ` Product files were edited (${state.editedFiles.slice(-5).join(", ")}) but no verifying command ran afterwards (domain: ${domains}).` : ""}` +
+            obligationReason.replace("Run command evidence matching the supplied alternatives", "Run a supplied command and obtain its expected result") + ` Do now, in order: ` +
             `(1) run the relevant test/build/typecheck for those files; ` +
             `(2) one honest paragraph attacking your own conclusion — what would make it wrong; ` +
             `(3) report what ran, what passed, what stays unverified. ` +
@@ -154,7 +1054,50 @@ export function pipelineEnabled() {
 export function loadPipelineState(sessionId) {
     try {
         const raw = JSON.parse(readFileSync(stateFile(sessionId), "utf8"));
-        return { ...emptyState(), ...raw };
+        const state = { ...emptyState(), ...raw };
+        state.proofActivity = Number.isSafeInteger(raw.proofActivity) && raw.proofActivity >= 0 ? raw.proofActivity : 0;
+        state.proofReminderActivity = Number.isSafeInteger(raw.proofReminderActivity) && raw.proofReminderActivity >= 0 ? raw.proofReminderActivity : 0;
+        state.proofReminders = Number.isSafeInteger(raw.proofReminders) && raw.proofReminders >= 0 ? raw.proofReminders : 0;
+        state.probeBlocks = Number.isSafeInteger(raw.probeBlocks) && raw.probeBlocks >= 0 ? raw.probeBlocks : 0;
+        const specs = normalizeExecutionObligations(raw.obligations);
+        const tracked = new Map((Array.isArray(raw.obligations) ? raw.obligations : []).map((item) => {
+            const candidate = item;
+            return [candidate.id, candidate];
+        }));
+        state.obligations = specs.map((spec) => {
+            const previous = tracked.get(spec.id);
+            const rawAttempt = previous?.last_attempt && typeof previous.last_attempt === "object"
+                ? previous.last_attempt
+                : null;
+            const attempt = rawAttempt
+                && typeof rawAttempt.command === "string"
+                && (rawAttempt.outcome === "success" || rawAttempt.outcome === "failure" || rawAttempt.outcome === "unknown")
+                && typeof rawAttempt.expectation_met === "boolean"
+                ? {
+                    command: rawAttempt.command.slice(0, 500),
+                    outcome: rawAttempt.outcome,
+                    expectation_met: rawAttempt.expectation_met,
+                    ...(Array.isArray(rawAttempt.missing_output)
+                        ? { missing_output: rawAttempt.missing_output.filter((item) => typeof item === "string").slice(0, MAX_OUTPUT_MARKERS) }
+                        : {}),
+                    ...(Array.isArray(rawAttempt.forbidden_output)
+                        ? { forbidden_output: rawAttempt.forbidden_output.filter((item) => typeof item === "string").slice(0, MAX_OUTPUT_MARKERS) }
+                        : {}),
+                }
+                : null;
+            return {
+                ...spec,
+                status: previous?.status === "satisfied" && attempt?.expectation_met ? "satisfied" : "pending",
+                ...(previous?.status === "satisfied" && attempt?.expectation_met && typeof previous.satisfied_by === "string"
+                    ? { satisfied_by: previous.satisfied_by.slice(0, 500) }
+                    : {}),
+                ...(previous?.status === "satisfied" && attempt?.expectation_met && Number.isSafeInteger(previous.satisfied_at_edit)
+                    ? { satisfied_at_edit: previous.satisfied_at_edit }
+                    : {}),
+                ...(attempt ? { last_attempt: attempt } : {}),
+            };
+        });
+        return state;
     }
     catch {
         return emptyState();