@event4u/agent-config 16.0.0 → 16.2.0

package/dist/cli-delegate/cmd_conformance.js

@@ -1,16 +1,25 @@
 import { createRequire as __acCreateRequire } from 'node:module'; const require = globalThis.require ?? __acCreateRequire(import.meta.url);
 import {
+  NO_RED_EVIDENCE_REASON,
   deriveSessionKey,
+  describeRecordFinding,
   foldRefusal,
+  foldShadow,
+  hasRedThenGreen,
   isCiPoll,
   isVacuousOutput,
+  isVerificationCommand,
   parseRecord,
+  parseShadowRecord,
   pendingCount,
   readInstallBoundary,
+  readRunEvidence,
+  readTurnRunState,
   sessionRefusalFile,
+  sessionShadowFile,
   statePathFor,
   validateAssumption
-} from "./chunk-QJWAUMJW.js";
+} from "./chunk-YJ72UIAK.js";
 import {
   readHookStdin
 } from "./chunk-F7DQWYR5.js";
@@ -36,14 +45,15 @@ import {
   frontmatterPaths,
   proseEqual,
   splitFrontmatter
-} from "./chunk-55ACLDUE.js";
+} from "./chunk-FP36SWJD.js";
 import "./chunk-FTAISGDQ.js";
 import "./chunk-M2DPGFZ4.js";
+import "./chunk-ROYYTEZU.js";
 import "./chunk-BTWUYDGN.js";
 import {
   projectStoreSlug,
   resolveSessionRole
-} from "./chunk-GYC3VRYN.js";
+} from "./chunk-JNMVLWLR.js";
 import {
   atomic_write_json,
   atomic_write_text,
@@ -57,18 +67,23 @@ import {
 import {
   artefact_roots
 } from "./chunk-NUHLI2RX.js";
+import {
+  readRecentEntries
+} from "./chunk-5R7HOLAF.js";
 import {
   detectToolPresence
 } from "./chunk-A4QJ6ENT.js";
 import {
   atomicAppendLine,
+  probeHostCapabilities
+} from "./chunk-6KM6ORRY.js";
+import "./chunk-T7L2QK3K.js";
+import "./chunk-DMSZHXZS.js";
+import {
   manifest_path,
-  probeHostCapabilities,
   read_manifest
-} from "./chunk-2TAQ2K4V.js";
+} from "./chunk-4E2W63DA.js";
 import "./chunk-MWRD5YOH.js";
-import "./chunk-T7L2QK3K.js";
-import "./chunk-DMSZHXZS.js";
 import {
   require_dist
 } from "./chunk-OY53J6II.js";
@@ -77,7 +92,7 @@ import {
 } from "./chunk-MCJYCQPF.js";
 import {
   load_agent_settings
-} from "./chunk-2XY7ILBT.js";
+} from "./chunk-FC75PGJE.js";
 import "./chunk-NDJLNC6Q.js";
 import {
   __toESM
@@ -85,46 +100,13 @@ import {
 
 // src/scripts/_cli/cmd_conformance.ts
 var YAML = __toESM(require_dist(), 1);
-import * as fs15 from "node:fs";
+import * as fs16 from "node:fs";
 import * as os7 from "node:os";
 import * as path15 from "node:path";
 import process5 from "node:process";
-import { spawnSync as spawnSync3 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 import { fileURLToPath as fileURLToPath14, pathToFileURL as pathToFileURL14 } from "node:url";
 
-// src/install/txlog.ts
-import { createReadStream, createWriteStream, existsSync, readFileSync, renameSync, statSync, unlinkSync } from "node:fs";
-var ROTATION_MAX_BYTES = 10 * 1024 * 1024;
-var ROTATION_MAX_AGE_MS = 30 * 24 * 60 * 60 * 1e3;
-var RECOVERY_DEPTH_CAP = 500;
-function readRecentEntries(logPath) {
-  if (!existsSync(logPath)) {
-    return [];
-  }
-  const raw = readFileSync(logPath, "utf8");
-  const lines = raw.split("\n").filter((l) => l.length > 0);
-  const tail = lines.slice(-RECOVERY_DEPTH_CAP);
-  const out = [];
-  for (const line of tail) {
-    const parsed = tryParseEntry(line);
-    if (parsed !== null) {
-      out.push(parsed);
-    }
-  }
-  return out;
-}
-function tryParseEntry(line) {
-  try {
-    const obj = JSON.parse(line);
-    if (typeof obj.ts !== "string" || typeof obj.kind !== "string" || typeof obj.path !== "string") {
-      return null;
-    }
-    return obj;
-  } catch {
-    return null;
-  }
-}
-
 // src/scripts/router_target_paths.mjs
 var ROUTE_TARGET_TEMPLATES = Object.freeze({
   skill: Object.freeze(["dist/agent-src/skills/{id}/SKILL.md"]),
@@ -151,7 +133,7 @@ function routeTargetPathsPosix(target) {
 }
 
 // src/scripts/report_conformance_funnel.ts
-import * as fs14 from "node:fs";
+import * as fs15 from "node:fs";
 import * as os6 from "node:os";
 import * as path14 from "node:path";
 import process4 from "node:process";
@@ -159,7 +141,7 @@ import { fileURLToPath as fileURLToPath13, pathToFileURL as pathToFileURL13 } fr
 
 // src/scripts/conformance_scan.ts
 import { createHash as createHash3 } from "node:crypto";
-import fs10 from "node:fs";
+import fs11 from "node:fs";
 import os2 from "node:os";
 import path10 from "node:path";
 import { fileURLToPath as fileURLToPath9, pathToFileURL as pathToFileURL9 } from "node:url";
@@ -1945,7 +1927,7 @@ var COMMAND_OBJECTS = {
 };
 
 // src/scripts/hooks/turn_end_gate_hook.ts
-import * as fs7 from "node:fs";
+import * as fs8 from "node:fs";
 import * as path7 from "node:path";
 import { fileURLToPath as fileURLToPath6, pathToFileURL as pathToFileURL6 } from "node:url";
 
@@ -2325,162 +2307,6 @@ function detectDroppedDecision(assistantTurnTexts, closingFromPayload = false) {
   return null;
 }
 
-// src/scripts/hooks/end_review_nudge_hook.ts
-import { spawnSync as spawnSync2 } from "node:child_process";
-import * as crypto from "node:crypto";
-import * as fs5 from "node:fs";
-import * as os from "node:os";
-import * as path5 from "node:path";
-import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL4 } from "node:url";
-
-// src/scripts/_lib/review_baseline.ts
-import { spawnSync } from "node:child_process";
-import * as fs4 from "node:fs";
-import * as path4 from "node:path";
-function currentHeadSha(cwd) {
-  try {
-    const r = spawnSync("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8" });
-    if (r.status !== 0) return null;
-    const out = (r.stdout ?? "").trim();
-    return out === "" ? null : out;
-  } catch {
-    return null;
-  }
-}
-var BASELINE_STATE_REL = path4.join("agents", "runtime", "state", "review-baseline");
-function baselineStateDir(workspaceRoot) {
-  return path4.join(workspaceRoot, BASELINE_STATE_REL);
-}
-function baselineStateFile(workspaceRoot, sessionKey) {
-  return path4.join(baselineStateDir(workspaceRoot), `${sessionKey}.json`);
-}
-function parseBaseline(raw) {
-  let decoded;
-  try {
-    decoded = JSON.parse(raw);
-  } catch {
-    return null;
-  }
-  if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) return null;
-  const o = decoded;
-  const lines = o["baseline_lines"];
-  if (typeof lines !== "number" || !Number.isFinite(lines) || lines < 0) return null;
-  const written = o["written_at"];
-  if (typeof written !== "string") return null;
-  const head = o["head_sha"];
-  const measure = o["measure"];
-  return {
-    head_sha: typeof head === "string" && head !== "" ? head : null,
-    baseline_lines: lines,
-    ...measure === "exact" || measure === "capped_approximation" ? { measure } : {},
-    written_at: written
-  };
-}
-function readBaseline(workspaceRoot, sessionKey) {
-  const file = baselineStateFile(workspaceRoot, sessionKey);
-  let raw;
-  try {
-    raw = fs4.readFileSync(file, "utf-8");
-  } catch (exc) {
-    const code = exc?.code;
-    return code === "ENOENT" ? "absent" : "unreadable";
-  }
-  return parseBaseline(raw) ?? "unreadable";
-}
-function applyBaseline(measuredLines, baseline, headSha, measuredMeasure = "exact") {
-  if (baseline === "absent" || baseline === "unreadable") {
-    return { applied: false, fallback: baseline, lines: measuredLines };
-  }
-  if (baseline.measure !== "exact" || measuredMeasure !== "exact") {
-    return { applied: false, fallback: "mixed-measure", lines: measuredLines };
-  }
-  if (baseline.head_sha !== headSha()) {
-    return { applied: false, fallback: "head-moved", lines: measuredLines };
-  }
-  return {
-    applied: true,
-    baseline,
-    lines: Math.max(0, measuredLines - baseline.baseline_lines)
-  };
-}
-
-// src/scripts/_lib/audit_field_provenance.ts
-var MAX_APPLIED_IDS = 32;
-function appliedIds(values) {
-  const out = [];
-  for (const raw of values ?? []) {
-    const v = String(raw).trim();
-    if (v === "" || out.includes(v)) continue;
-    out.push(v);
-    if (out.length >= MAX_APPLIED_IDS) break;
-  }
-  return out;
-}
-
-// src/scripts/_lib/review_skipped_record.ts
-var BASELINE_APPLICATIONS = [
-  "applied",
-  "absent",
-  "unreadable",
-  "head_moved",
-  "mixed_measure"
-];
-var PRODUCER_PRIVACY_CLASS = "ids-only";
-function isNonNegInt(n) {
-  return typeof n === "number" && Number.isFinite(n) && Number.isInteger(n) && n >= 0;
-}
-var HIGH_RISK_DIFF_LINES = 200;
-function buildReviewSkippedLine(input) {
-  const errors = [];
-  if (!isNonNegInt(input.diff_lines)) {
-    errors.push("diff_lines must be a non-negative integer");
-  }
-  if (input.mutation_measure !== "exact" && input.mutation_measure !== "capped_approximation") {
-    errors.push('mutation_measure must be "exact" or "capped_approximation"');
-  }
-  if (!input.ts) errors.push("ts (ISO-8601 UTC) is required");
-  if (!input.id) errors.push("id (ULID, UUID, or content hash) is required");
-  if (input.baseline !== void 0 && !BASELINE_APPLICATIONS.includes(input.baseline)) {
-    errors.push(`baseline must be one of ${BASELINE_APPLICATIONS.join(", ")}`);
-  }
-  if (errors.length) return { line: null, errors };
-  const line = {
-    schema_version: 1,
-    id: input.id,
-    ts: input.ts,
-    work_id: input.work_id ?? `review-skipped-${input.ts}`,
-    phase: "report",
-    outcome: "skipped",
-    confidence_band: "medium",
-    risk_class: input.diff_lines >= HIGH_RISK_DIFF_LINES ? "high" : "medium",
-    memory: { asks: 0, hits: 0 },
-    verify: { claims: 0, first_try_passes: 0 },
-    // COMPUTED, never a producer constant.
-    rules_applied: appliedIds(input.rules_applied),
-    // MANDATORY on every audit line, same as the orchestration producer.
-    privacy_class: PRODUCER_PRIVACY_CLASS,
-    // `skills_applied` is OMITTED here, deliberately and not by oversight.
-    // audit-log-v1 distinguishes an absent key ("not recorded") from `[]`
-    // ("recorded, none applied"), and this writer observes a review that
-    // did not happen -- it has no skill observation to offer in either
-    // direction. Emitting `[]` would assert "no skills applied" on evidence
-    // this producer never gathered, which is the exact fabrication the
-    // absent/empty split exists to make impossible.
-    persona: null,
-    input_kind: "prompt",
-    type: "note",
-    review_skipped: {
-      diff_lines: input.diff_lines,
-      mutation_measure: input.mutation_measure,
-      // Omitted, not defaulted, when the producer recorded nothing —
-      // audit-log-v1's absent-versus-present split is the same one
-      // `skills_applied` uses above, for the same reason.
-      ...input.baseline === void 0 ? {} : { baseline: input.baseline }
-    }
-  };
-  return { line, errors: [] };
-}
-
 // src/scripts/hooks/envelope.ts
 var ENVELOPE_KEYS = [
   "schema_version",
@@ -2535,340 +2361,35 @@ function unwrap(stdin_text, default_platform = "generic") {
   ];
 }
 
-// src/scripts/hooks/end_review_nudge_hook.ts
-var MUTATION_LINE_THRESHOLD = 50;
-var UNTRACKED_FILE_CAP = 20;
-var TRANSCRIPT_SCAN_MAX_BYTES = 50 * 1024 * 1024;
-function isSafeTranscriptPath(rawPath, opts = {}) {
-  if (!rawPath || !/\.jsonl$/i.test(rawPath)) return false;
-  const homeDir = opts.homeDir ?? os.homedir();
-  const maxBytes = opts.maxBytes ?? TRANSCRIPT_SCAN_MAX_BYTES;
-  try {
-    const realHome = fs5.realpathSync(homeDir);
-    const realPath = fs5.realpathSync(rawPath);
-    const relative3 = path5.relative(realHome, realPath);
-    if (relative3 === "" || relative3.startsWith("..") || path5.isAbsolute(relative3)) {
-      return false;
-    }
-    const { size } = fs5.statSync(realPath);
-    return size <= maxBytes;
-  } catch {
-    return false;
-  }
-}
-var EXIT_WARN2 = 2;
-function parseNumstat(raw) {
-  const rows = [];
-  for (const line of raw.split("\n")) {
-    const m = /^(\d+|-)\t(\d+|-)\t(.+)$/.exec(line);
-    if (!m) continue;
-    const addedStr = m[1];
-    const deletedStr = m[2];
-    rows.push({
-      added: addedStr === "-" ? 0 : Number(addedStr),
-      deleted: deletedStr === "-" ? 0 : Number(deletedStr),
-      path: m[3]
-    });
-  }
-  return rows;
-}
-var DOC_PATH_RE = /\.md$/i;
-function isDocPath(p) {
-  return DOC_PATH_RE.test(p);
-}
-function nonDocMutatedLines(rows) {
-  return rows.filter((r) => !isDocPath(r.path)).reduce((sum, r) => sum + r.added + r.deleted, 0);
+// src/scripts/hooks/subagent_ledger_hook.ts
+import * as crypto from "node:crypto";
+import * as fs4 from "node:fs";
+import * as path4 from "node:path";
+import { fileURLToPath as fileURLToPath4, pathToFileURL as pathToFileURL4 } from "node:url";
+
+// src/scripts/_lib/subagent_response.ts
+var MAX_SUMMARY_CHARS = 2e3;
+var MAX_RESPONSE_LINE_CHARS = 240;
+var MAX_RESPONSE_ENTRIES = 40;
+var MAX_ARTIFACT_REF_CHARS = 200;
+var MAX_ENVELOPE_CHARS = 12e3;
+var CONFIDENCE = /* @__PURE__ */ new Set(["low", "medium", "high"]);
+var RESPONSE_REQUIRED_FIELDS = [
+  "summary",
+  "handoff",
+  "confidence",
+  "findings",
+  "risks"
+];
+function countContractFields(input) {
+  if (input === null || typeof input !== "object") return 0;
+  const r = input;
+  return RESPONSE_REQUIRED_FIELDS.filter((k) => Object.hasOwn(r, k)).length;
 }
-function gitNumstatRows(cwd) {
-  try {
-    const r = spawnSync2("git", ["diff", "--numstat", "HEAD"], {
-      cwd,
-      encoding: "utf8",
-      maxBuffer: 16 * 1024 * 1024
-    });
-    if (r.status !== 0) return [];
-    return parseNumstat(r.stdout ?? "");
-  } catch {
-    return [];
-  }
-}
-function untrackedNonDocFiles(cwd) {
-  try {
-    const r = spawnSync2("git", ["ls-files", "--others", "--exclude-standard"], {
-      cwd,
-      encoding: "utf8",
-      maxBuffer: 16 * 1024 * 1024
-    });
-    if (r.status !== 0) return [];
-    return (r.stdout ?? "").split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !isDocPath(l));
-  } catch {
-    return [];
-  }
-}
-var BINARY_PROBE_BYTES = 8e3;
-var UNTRACKED_FILE_READ_CAP_BYTES = 8 * 1024 * 1024;
-function untrackedFileLineCount(cwd, relPath) {
-  try {
-    const abs = path5.resolve(cwd, relPath);
-    const size = fs5.statSync(abs).size;
-    if (size === 0) return 0;
-    if (size > UNTRACKED_FILE_READ_CAP_BYTES) {
-      return MUTATION_LINE_THRESHOLD + 1;
-    }
-    const buf = fs5.readFileSync(abs);
-    if (buf.length === 0) return 0;
-    const probe = buf.subarray(0, Math.min(buf.length, BINARY_PROBE_BYTES));
-    if (probe.includes(0)) return 0;
-    let lines = 0;
-    for (const byte of buf) {
-      if (byte === 10) lines += 1;
-    }
-    if (buf[buf.length - 1] !== 10) lines += 1;
-    return lines;
-  } catch {
-    return 0;
-  }
-}
-function totalNonDocMutatedLinesWithMeasure(cwd) {
-  const trackedLines = nonDocMutatedLines(gitNumstatRows(cwd));
-  const untracked = untrackedNonDocFiles(cwd);
-  if (untracked.length > UNTRACKED_FILE_CAP) {
-    return { lines: MUTATION_LINE_THRESHOLD + 1 + trackedLines, measure: "capped_approximation" };
-  }
-  const untrackedLines = untracked.reduce(
-    (sum, relPath) => sum + untrackedFileLineCount(cwd, relPath),
-    0
-  );
-  return { lines: trackedLines + untrackedLines, measure: "exact" };
-}
-function isObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function str(v) {
-  return typeof v === "string" ? v : "";
-}
-var DISPATCH_TOOL_RE = /^(agent|task)$/i;
-var REVIEW_SHAPED_LABEL_RE = /\b(review|judge|adversarial|critique|second[- ]opinion|blind\s+(pass|review)|cross-model)\b/i;
-var REVIEW_SHAPED_PROMPT_RE = /\b(code\s+review|neutral\s+review|adversarial|judge|critique|second[- ]opinion|blind\s+(pass|review)|cross-model)\b/i;
-var REVIEW_SKILL_NAME_RE = /^(review[-:]changes|judge[-:][a-z0-9-]+|adversarial-review|code-review)$/i;
-function scanTranscriptForReviewer(transcriptText) {
-  for (const raw of transcriptText.split("\n")) {
-    const line = raw.trim();
-    if (!line) continue;
-    let obj;
-    try {
-      obj = JSON.parse(line);
-    } catch {
-      continue;
-    }
-    if (!isObject(obj) || obj["type"] !== "assistant") continue;
-    const msg = obj["message"];
-    if (!isObject(msg)) continue;
-    const content = msg["content"];
-    if (!Array.isArray(content)) continue;
-    for (const blk of content) {
-      if (!isObject(blk) || blk["type"] !== "tool_use") continue;
-      const name = str(blk["name"]);
-      const input = blk["input"];
-      const inputObj = isObject(input) ? input : {};
-      if (DISPATCH_TOOL_RE.test(name)) {
-        const label = [
-          str(inputObj["description"]),
-          str(inputObj["subagent_type"])
-        ].filter(Boolean).join(" ");
-        if (REVIEW_SHAPED_LABEL_RE.test(label)) return true;
-        const prompt = str(inputObj["prompt"]);
-        if (REVIEW_SHAPED_PROMPT_RE.test(prompt)) return true;
-        continue;
-      }
-      if (/^skill$/i.test(name)) {
-        const skillName = str(inputObj["skill"]) || str(inputObj["name"]) || str(inputObj["command"]);
-        if (REVIEW_SKILL_NAME_RE.test(skillName)) return true;
-        continue;
-      }
-      if (REVIEW_SKILL_NAME_RE.test(name)) return true;
-    }
-  }
-  return false;
-}
-function buildAdvisoryLine(diffLines) {
-  return `this session mutated ${diffLines} lines without a neutral review; spawn a cross-model reviewer before claiming done (delegation-policy / verify-budget)`;
-}
-function appendReviewSkippedTelemetry(workspaceRoot, diffLines, mutationMeasure, baseline) {
-  if (is_replay_mode()) return;
-  const ts = (/* @__PURE__ */ new Date()).toISOString();
-  const { line, errors } = buildReviewSkippedLine({
-    diff_lines: diffLines,
-    mutation_measure: mutationMeasure,
-    ts,
-    id: crypto.randomUUID(),
-    baseline
-  });
-  if (errors.length || line === null) return;
-  try {
-    const dir = path5.join(workspaceRoot, "agents", "runtime", "state", "audit");
-    fs5.mkdirSync(dir, { recursive: true });
-    const file = path5.join(dir, `${ts.slice(0, 7)}.jsonl`);
-    fs5.appendFileSync(file, `${JSON.stringify(line)}
-`, "utf8");
-  } catch {
-  }
-}
-function sessionStateDir(workspaceRoot) {
-  return path5.join(workspaceRoot, "agents", "runtime", "state", "end-review-nudge");
-}
-function sessionStateFile(workspaceRoot, sessionKey) {
-  return path5.join(sessionStateDir(workspaceRoot), `${sessionKey}.json`);
-}
-function deriveSessionKey2(envelope, payload) {
-  const raw = str(envelope["session_id"]) || str(payload["transcript_path"] ?? payload["transcriptPath"]);
-  const material = raw || "unknown-session";
-  return crypto.createHash("sha256").update(material).digest("hex");
-}
-function hasFiredThisSession(workspaceRoot, sessionKey) {
-  try {
-    return fs5.existsSync(sessionStateFile(workspaceRoot, sessionKey));
-  } catch {
-    return false;
-  }
-}
-function markFiredThisSession(workspaceRoot, sessionKey, ts) {
-  try {
-    atomic_write_json(sessionStateFile(workspaceRoot, sessionKey), { fired_at: ts });
-  } catch {
-  }
-}
-function _read_stdin() {
-  return readHookStdin();
-}
-var FALLBACK_TO_TELEMETRY = {
-  absent: "absent",
-  unreadable: "unreadable",
-  "head-moved": "head_moved",
-  "mixed-measure": "mixed_measure"
-};
-function main4() {
-  const [envelope, payload] = unwrap(_read_stdin(), "claude");
-  const event = String(envelope["event"] ?? "");
-  if (event !== "" && event !== "stop") {
-    return 0;
-  }
-  const workspace_root = String(envelope["workspace_root"] ?? "").trim() || process.cwd();
-  let measuredLines;
-  let mutationMeasure;
-  try {
-    const measured = totalNonDocMutatedLinesWithMeasure(workspace_root);
-    measuredLines = measured.lines;
-    mutationMeasure = measured.measure;
-  } catch {
-    return 0;
-  }
-  const sessionKey = deriveSessionKey2(envelope, payload);
-  const baselineOutcome = applyBaseline(
-    measuredLines,
-    readBaseline(workspace_root, sessionKey),
-    // A THUNK, not a value: on the `absent` and `unreadable` branches the
-    // result is discarded, and those two are the steady state on every host
-    // without this nudge and on every session before its first baseline
-    // write. Passing the value eagerly spent an 11-14 ms `git rev-parse` on
-    // each of those stops for nothing.
-    () => currentHeadSha(workspace_root),
-    mutationMeasure
-  );
-  const diffLines = baselineOutcome.lines;
-  const baselineApplication = baselineOutcome.applied ? "applied" : FALLBACK_TO_TELEMETRY[baselineOutcome.fallback];
-  if (diffLines <= MUTATION_LINE_THRESHOLD) {
-    return 0;
-  }
-  if (hasFiredThisSession(workspace_root, sessionKey)) {
-    return 0;
-  }
-  const transcriptPath = str(
-    payload["transcript_path"] ?? payload["transcriptPath"]
-  ).trim();
-  let reviewerRan = false;
-  if (transcriptPath && isSafeTranscriptPath(transcriptPath)) {
-    try {
-      reviewerRan = scanTranscriptForReviewer(fs5.readFileSync(transcriptPath, "utf-8"));
-    } catch {
-      reviewerRan = false;
-    }
-  }
-  if (reviewerRan) {
-    return 0;
-  }
-  markFiredThisSession(workspace_root, sessionKey, (/* @__PURE__ */ new Date()).toISOString());
-  try {
-    appendReviewSkippedTelemetry(
-      workspace_root,
-      diffLines,
-      mutationMeasure,
-      baselineApplication
-    );
-  } catch {
-  }
-  process.stdout.write(
-    `${JSON.stringify({
-      decision: "warn",
-      reason: `end-review-nudge: session mutated ${diffLines} non-doc lines without a neutral review`,
-      additional_context: buildAdvisoryLine(diffLines)
-    })}
-`
-  );
-  return EXIT_WARN2;
-}
-function _isCliEntry4() {
-  if (true) {
-    return false;
-  }
-  if (process.argv[1] === void 0) {
-    return false;
-  }
-  const argvUrl = pathToFileURL4(path5.resolve(process.argv[1])).href;
-  if (import.meta.url === argvUrl) {
-    return true;
-  }
-  try {
-    const here = fs5.realpathSync(fileURLToPath4(import.meta.url));
-    const argv = fs5.realpathSync(path5.resolve(process.argv[1]));
-    return here === argv;
-  } catch {
-    return false;
-  }
-}
-if (_isCliEntry4()) {
-  process.exit(main4());
-}
-
-// src/scripts/hooks/subagent_ledger_hook.ts
-import * as crypto2 from "node:crypto";
-import * as fs6 from "node:fs";
-import * as path6 from "node:path";
-import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL5 } from "node:url";
-
-// src/scripts/_lib/subagent_response.ts
-var MAX_SUMMARY_CHARS = 2e3;
-var MAX_RESPONSE_LINE_CHARS = 240;
-var MAX_RESPONSE_ENTRIES = 40;
-var MAX_ARTIFACT_REF_CHARS = 200;
-var MAX_ENVELOPE_CHARS = 12e3;
-var CONFIDENCE = /* @__PURE__ */ new Set(["low", "medium", "high"]);
-var RESPONSE_REQUIRED_FIELDS = [
-  "summary",
-  "handoff",
-  "confidence",
-  "findings",
-  "risks"
-];
-function countContractFields(input) {
-  if (input === null || typeof input !== "object") return 0;
-  const r = input;
-  return RESPONSE_REQUIRED_FIELDS.filter((k) => Object.hasOwn(r, k)).length;
-}
-function validateResponse(input) {
-  const errors = [];
-  if (input === null || typeof input !== "object") {
-    return { valid: false, errors: ["response is not an object"] };
+function validateResponse(input) {
+  const errors = [];
+  if (input === null || typeof input !== "object") {
+    return { valid: false, errors: ["response is not an object"] };
   }
   const r = input;
   if (typeof r.summary !== "string") errors.push("summary missing or not a string");
@@ -2945,22 +2466,57 @@ function validateResponse(input) {
   return { valid: errors.length === 0, errors };
 }
 
-// src/scripts/hooks/subagent_ledger_hook.ts
+// src/scripts/hooks/exit_codes.ts
 var EXIT_ALLOW3 = 0;
-function isObject2(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-var LEDGER_DIR = path6.join("agents", "runtime", "state", "subagent-ledger");
-var OPEN_SUBDIR = "open";
-var OPEN_RECORD_TTL_MS = 24 * 60 * 60 * 1e3;
-function refFor(agentId) {
-  return crypto2.createHash("sha256").update(agentId, "utf8").digest("hex").slice(0, 12);
+var EXIT_BLOCK = 1;
+var EXIT_WARN2 = 2;
+var EXIT_ERROR = 3;
+var EXIT_CODES = Object.freeze([
+  Object.freeze({
+    code: EXIT_ALLOW3,
+    name: "allow",
+    meaning: "no objection; the dispatcher passes the call through",
+    owner: "every concern \u2014 the default verdict",
+    authorizedBy: "nothing; allowing needs no authority"
+  }),
+  Object.freeze({
+    code: EXIT_BLOCK,
+    name: "block",
+    meaning: "refuse the call; the dispatcher lowers this onto the host deny channel",
+    owner: "a concern declared `severity: blocking` in hook_manifest.yaml",
+    authorizedBy: "the manifest entry plus its row in the BLOCKING_ALLOWLIST of tests/hooks/concern_severity.test.ts \u2014 an advisory concern emitting this is downgraded to warn by dispatch_hook._is_advisory"
+  }),
+  Object.freeze({
+    code: EXIT_WARN2,
+    name: "warn",
+    meaning: "advisory; the dispatcher exits 0 and surfaces the reason",
+    owner: "any concern",
+    authorizedBy: "nothing; warning is the ceiling for an advisory concern and is always available to a blocking one"
+  }),
+  Object.freeze({
+    code: EXIT_ERROR,
+    name: "error",
+    meaning: "the concern crashed, timed out, or could not decide \u2014 any rc >= 3. The dispatcher resolves it by the concern`s declared severity, never by the number itself",
+    owner: "no concern emits this on purpose; the runtime does",
+    authorizedBy: "hook_manifest.yaml `fail_closed` and `severity` together \u2014 see docs/contracts/hook-architecture-v1.md \xA7 Exit-code semantics"
+  })
+]);
+
+// src/scripts/hooks/subagent_ledger_hook.ts
+function isObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+var LEDGER_DIR = path4.join("agents", "runtime", "state", "subagent-ledger");
+var OPEN_SUBDIR = "open";
+var OPEN_RECORD_TTL_MS = 24 * 60 * 60 * 1e3;
+function refFor(agentId) {
+  return crypto.createHash("sha256").update(agentId, "utf8").digest("hex").slice(0, 12);
 }
 function unwrapPayload(envelope) {
   const inner = envelope["payload"];
-  return isObject2(inner) ? inner : envelope;
+  return isObject(inner) ? inner : envelope;
 }
-function str2(payload, ...keys) {
+function str(payload, ...keys) {
   for (const k of keys) {
     const v = payload[k];
     if (typeof v === "string" && v) return v;
@@ -2968,11 +2524,11 @@ function str2(payload, ...keys) {
   return null;
 }
 function extractParentId(payload, ownId) {
-  const explicit = str2(payload, "parent_agent_id", "parentAgentId");
+  const explicit = str(payload, "parent_agent_id", "parentAgentId");
   if (explicit) return explicit;
   const session = payload["session"];
-  if (isObject2(session)) {
-    const sessionAgent = str2(session, "agent_id", "agentId");
+  if (isObject(session)) {
+    const sessionAgent = str(session, "agent_id", "agentId");
     if (sessionAgent && sessionAgent !== ownId) return sessionAgent;
   }
   return null;
@@ -3040,14 +2596,14 @@ function _jsonObjectCandidates(message) {
   return out;
 }
 function openDir(root) {
-  return path6.join(root, LEDGER_DIR, OPEN_SUBDIR);
+  return path4.join(root, LEDGER_DIR, OPEN_SUBDIR);
 }
 function openFile(root, ref) {
-  return path6.join(openDir(root), `${ref}.json`);
+  return path4.join(openDir(root), `${ref}.json`);
 }
 var DEPTH_BASES = /* @__PURE__ */ new Set(["observed", "asserted-parent", "assumed-root"]);
 function _asOpenRecord(value, expectedRef) {
-  if (!isObject2(value)) return null;
+  if (!isObject(value)) return null;
   const ref = value["ref"];
   if (typeof ref !== "string" || ref !== expectedRef) return null;
   if (typeof value["started_at"] !== "string") return null;
@@ -3070,7 +2626,7 @@ function readOpenRecords(root) {
   const out = /* @__PURE__ */ new Map();
   let names;
   try {
-    names = fs6.readdirSync(openDir(root));
+    names = fs4.readdirSync(openDir(root));
   } catch {
     return out;
   }
@@ -3078,7 +2634,7 @@ function readOpenRecords(root) {
     if (!name.endsWith(".json")) continue;
     const expectedRef = name.slice(0, -".json".length);
     try {
-      const raw = fs6.readFileSync(path6.join(openDir(root), name), "utf8");
+      const raw = fs4.readFileSync(path4.join(openDir(root), name), "utf8");
       const rec = _asOpenRecord(JSON.parse(raw), expectedRef);
       if (rec) out.set(rec.ref, rec);
     } catch {
@@ -3093,13 +2649,13 @@ function resolveDepth(parentRef, open) {
   return { depth: parent.depth + 1, depth_basis: "observed" };
 }
 function ledgerFileFor2(root, ts) {
-  return path6.join(root, LEDGER_DIR, `${ts.slice(0, 7)}.jsonl`);
+  return path4.join(root, LEDGER_DIR, `${ts.slice(0, 7)}.jsonl`);
 }
 function appendLedgerLine(root, ts, line) {
   if (is_replay_mode()) return;
   const file = ledgerFileFor2(root, ts);
-  fs6.mkdirSync(path6.dirname(file), { recursive: true });
-  fs6.appendFileSync(file, `${JSON.stringify(line)}
+  fs4.mkdirSync(path4.dirname(file), { recursive: true });
+  fs4.appendFileSync(file, `${JSON.stringify(line)}
 `, "utf8");
 }
 var WALL_CLOCK_ARMS_MS = [
@@ -3113,7 +2669,7 @@ function armsExceeded(elapsedMs) {
   return WALL_CLOCK_ARMS_MS.filter((a) => elapsedMs >= a.ms).map((a) => a.label);
 }
 function openRecordStats(root, nowMs = Date.now()) {
-  const ledgerPresent = fs6.existsSync(path6.join(root, LEDGER_DIR));
+  const ledgerPresent = fs4.existsSync(path4.join(root, LEDGER_DIR));
   const open = readOpenRecords(root);
   let maxDepth = 0;
   let counted = 0;
@@ -3141,13 +2697,13 @@ function writeOpenRecord(root, rec) {
 function removeOpenRecord(root, ref) {
   if (is_replay_mode()) return;
   try {
-    fs6.unlinkSync(openFile(root, ref));
+    fs4.unlinkSync(openFile(root, ref));
   } catch {
   }
 }
 function countOpen(root) {
   try {
-    return fs6.readdirSync(openDir(root)).filter((n) => n.endsWith(".json")).length;
+    return fs4.readdirSync(openDir(root)).filter((n) => n.endsWith(".json")).length;
   } catch {
     return 0;
   }
@@ -3188,12 +2744,12 @@ function appendUnidentified(root, event, nowIso, payload) {
     unidentified: true,
     // The agent TYPE is an id-shaped enum and may still be present; it is
     // the only thing salvageable from a payload with no id.
-    agent_type: str2(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
+    agent_type: str(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
     reason: "payload carried no agent id \u2014 nothing to correlate start with stop"
   });
 }
 function handleStart(root, payload, nowIso, sessionId) {
-  const agentId = str2(payload, "agent_id", "agentId");
+  const agentId = str(payload, "agent_id", "agentId");
   if (agentId === null) {
     appendUnidentified(root, "subagent_start", nowIso, payload);
     return;
@@ -3204,7 +2760,7 @@ function handleStart(root, payload, nowIso, sessionId) {
   const { depth, depth_basis } = resolveDepth(parentRef, readOpenRecords(root));
   const rec = {
     ref,
-    agent_type: str2(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
+    agent_type: str(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
     started_at: nowIso,
     parent_ref: parentRef,
     depth,
@@ -3231,7 +2787,7 @@ function handleStart(root, payload, nowIso, sessionId) {
   });
 }
 function handleStop(root, payload, nowIso, sessionId) {
-  const agentId = str2(payload, "agent_id", "agentId");
+  const agentId = str(payload, "agent_id", "agentId");
   if (agentId === null) {
     appendUnidentified(root, "subagent_stop", nowIso, payload);
     return;
@@ -3243,7 +2799,7 @@ function handleStop(root, payload, nowIso, sessionId) {
     const started = Date.parse(rec.started_at);
     if (Number.isFinite(started)) durationMs = Math.max(0, Date.parse(nowIso) - started);
   }
-  const parse2 = classifyEnvelope(str2(payload, "last_assistant_message", "lastAssistantMessage"));
+  const parse2 = classifyEnvelope(str(payload, "last_assistant_message", "lastAssistantMessage"));
   removeOpenRecord(root, ref);
   appendLedgerLine(root, nowIso, {
     event: "subagent_stop",
@@ -3254,7 +2810,7 @@ function handleStop(root, payload, nowIso, sessionId) {
     // relabel a cross-session stop as belonging to the dispatching session
     // and hide exactly the mismatch this field exists to expose.
     session_id: sessionId,
-    agent_type: rec?.agent_type ?? str2(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
+    agent_type: rec?.agent_type ?? str(payload, "agent_type", "agentType", "subagent_type", "subagentType"),
     depth: rec?.depth ?? null,
     depth_basis: rec?.depth_basis ?? null,
     // `null` = the matching start was never seen. That is a finding about
@@ -3274,12 +2830,12 @@ function handleStop(root, payload, nowIso, sessionId) {
 }
 function processEnvelope(envelope, consumerRoot) {
   try {
-    if (!isObject2(envelope)) return EXIT_ALLOW3;
+    if (!isObject(envelope)) return EXIT_ALLOW3;
     const event = envelope["event"];
     if (event !== "subagent_start" && event !== "subagent_stop") return EXIT_ALLOW3;
     const payload = unwrapPayload(envelope);
     const nowIso = (/* @__PURE__ */ new Date()).toISOString();
-    const sessionId = str2(payload, "session_id", "sessionId") ?? str2(envelope, "session_id", "sessionId");
+    const sessionId = str(payload, "session_id", "sessionId") ?? str(envelope, "session_id", "sessionId");
     reapStaleOpenRecords(consumerRoot, nowIso);
     if (event === "subagent_start") handleStart(consumerRoot, payload, nowIso, sessionId);
     else handleStop(consumerRoot, payload, nowIso, sessionId);
@@ -3289,43 +2845,600 @@ function processEnvelope(envelope, consumerRoot) {
   return EXIT_ALLOW3;
 }
 function resolveConsumerRoot(envelope) {
-  if (isObject2(envelope)) {
-    const pr = str2(envelope, "workspace_root", "project_root");
+  if (isObject(envelope)) {
+    const pr = str(envelope, "workspace_root", "project_root");
     if (pr) return pr;
     const payload = unwrapPayload(envelope);
-    const cwd = str2(payload, "cwd");
+    const cwd = str(payload, "cwd");
     if (cwd) return cwd;
   }
-  return process.cwd();
+  return process.cwd();
+}
+function main4() {
+  const raw = readHookStdin();
+  let envelope = {};
+  try {
+    envelope = raw.trim() ? JSON.parse(raw) : {};
+  } catch {
+    return EXIT_ALLOW3;
+  }
+  return processEnvelope(envelope, resolveConsumerRoot(envelope));
+}
+function _isCliEntry4() {
+  if (true) {
+    return false;
+  }
+  if (process.argv[1] === void 0) return false;
+  const argvUrl = pathToFileURL4(path4.resolve(process.argv[1])).href;
+  if (import.meta.url === argvUrl) return true;
+  try {
+    return fs4.realpathSync(fileURLToPath4(import.meta.url)) === fs4.realpathSync(path4.resolve(process.argv[1]));
+  } catch {
+    return false;
+  }
+}
+if (_isCliEntry4()) process.exit(main4());
+
+// src/scripts/_lib/turn_end_transcript.ts
+import * as fs7 from "node:fs";
+
+// src/scripts/hooks/end_review_nudge_hook.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import * as crypto2 from "node:crypto";
+import * as fs6 from "node:fs";
+import * as os from "node:os";
+import * as path6 from "node:path";
+import { fileURLToPath as fileURLToPath5, pathToFileURL as pathToFileURL5 } from "node:url";
+
+// src/scripts/_lib/review_baseline.ts
+import { spawnSync } from "node:child_process";
+import * as fs5 from "node:fs";
+import * as path5 from "node:path";
+function currentHeadSha(cwd) {
+  try {
+    const r = spawnSync("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8" });
+    if (r.status !== 0) return null;
+    const out = (r.stdout ?? "").trim();
+    return out === "" ? null : out;
+  } catch {
+    return null;
+  }
+}
+var BASELINE_STATE_REL = path5.join("agents", "runtime", "state", "review-baseline");
+function baselineStateDir(workspaceRoot) {
+  return path5.join(workspaceRoot, BASELINE_STATE_REL);
+}
+function baselineStateFile(workspaceRoot, sessionKey) {
+  return path5.join(baselineStateDir(workspaceRoot), `${sessionKey}.json`);
+}
+function parseBaseline(raw) {
+  let decoded;
+  try {
+    decoded = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof decoded !== "object" || decoded === null || Array.isArray(decoded)) return null;
+  const o = decoded;
+  const lines = o["baseline_lines"];
+  if (typeof lines !== "number" || !Number.isFinite(lines) || lines < 0) return null;
+  const written = o["written_at"];
+  if (typeof written !== "string") return null;
+  const head = o["head_sha"];
+  const measure = o["measure"];
+  return {
+    head_sha: typeof head === "string" && head !== "" ? head : null,
+    baseline_lines: lines,
+    ...measure === "exact" || measure === "capped_approximation" ? { measure } : {},
+    written_at: written
+  };
+}
+function readBaseline(workspaceRoot, sessionKey) {
+  const file = baselineStateFile(workspaceRoot, sessionKey);
+  let raw;
+  try {
+    raw = fs5.readFileSync(file, "utf-8");
+  } catch (exc) {
+    const code = exc?.code;
+    return code === "ENOENT" ? "absent" : "unreadable";
+  }
+  return parseBaseline(raw) ?? "unreadable";
+}
+function applyBaseline(measuredLines, baseline, headSha, measuredMeasure = "exact") {
+  if (baseline === "absent" || baseline === "unreadable") {
+    return { applied: false, fallback: baseline, lines: measuredLines };
+  }
+  if (baseline.measure !== "exact" || measuredMeasure !== "exact") {
+    return { applied: false, fallback: "mixed-measure", lines: measuredLines };
+  }
+  if (baseline.head_sha !== headSha()) {
+    return { applied: false, fallback: "head-moved", lines: measuredLines };
+  }
+  return {
+    applied: true,
+    baseline,
+    lines: Math.max(0, measuredLines - baseline.baseline_lines)
+  };
+}
+
+// src/scripts/_lib/audit_field_provenance.ts
+var MAX_APPLIED_IDS = 32;
+function appliedIds(values) {
+  const out = [];
+  for (const raw of values ?? []) {
+    const v = String(raw).trim();
+    if (v === "" || out.includes(v)) continue;
+    out.push(v);
+    if (out.length >= MAX_APPLIED_IDS) break;
+  }
+  return out;
+}
+
+// src/scripts/_lib/review_skipped_record.ts
+var BASELINE_APPLICATIONS = [
+  "applied",
+  "absent",
+  "unreadable",
+  "head_moved",
+  "mixed_measure"
+];
+var PRODUCER_PRIVACY_CLASS = "ids-only";
+function isNonNegInt(n) {
+  return typeof n === "number" && Number.isFinite(n) && Number.isInteger(n) && n >= 0;
+}
+var HIGH_RISK_DIFF_LINES = 200;
+function buildReviewSkippedLine(input) {
+  const errors = [];
+  if (!isNonNegInt(input.diff_lines)) {
+    errors.push("diff_lines must be a non-negative integer");
+  }
+  if (input.mutation_measure !== "exact" && input.mutation_measure !== "capped_approximation") {
+    errors.push('mutation_measure must be "exact" or "capped_approximation"');
+  }
+  if (!input.ts) errors.push("ts (ISO-8601 UTC) is required");
+  if (!input.id) errors.push("id (ULID, UUID, or content hash) is required");
+  if (input.baseline !== void 0 && !BASELINE_APPLICATIONS.includes(input.baseline)) {
+    errors.push(`baseline must be one of ${BASELINE_APPLICATIONS.join(", ")}`);
+  }
+  if (errors.length) return { line: null, errors };
+  const line = {
+    schema_version: 1,
+    id: input.id,
+    ts: input.ts,
+    work_id: input.work_id ?? `review-skipped-${input.ts}`,
+    phase: "report",
+    outcome: "skipped",
+    confidence_band: "medium",
+    risk_class: input.diff_lines >= HIGH_RISK_DIFF_LINES ? "high" : "medium",
+    memory: { asks: 0, hits: 0 },
+    verify: { claims: 0, first_try_passes: 0 },
+    // COMPUTED, never a producer constant.
+    rules_applied: appliedIds(input.rules_applied),
+    // MANDATORY on every audit line, same as the orchestration producer.
+    privacy_class: PRODUCER_PRIVACY_CLASS,
+    // `skills_applied` is OMITTED here, deliberately and not by oversight.
+    // audit-log-v1 distinguishes an absent key ("not recorded") from `[]`
+    // ("recorded, none applied"), and this writer observes a review that
+    // did not happen -- it has no skill observation to offer in either
+    // direction. Emitting `[]` would assert "no skills applied" on evidence
+    // this producer never gathered, which is the exact fabrication the
+    // absent/empty split exists to make impossible.
+    persona: null,
+    input_kind: "prompt",
+    type: "note",
+    review_skipped: {
+      diff_lines: input.diff_lines,
+      mutation_measure: input.mutation_measure,
+      // Omitted, not defaulted, when the producer recorded nothing —
+      // audit-log-v1's absent-versus-present split is the same one
+      // `skills_applied` uses above, for the same reason.
+      ...input.baseline === void 0 ? {} : { baseline: input.baseline }
+    }
+  };
+  return { line, errors: [] };
+}
+
+// src/scripts/hooks/end_review_nudge_hook.ts
+var MUTATION_LINE_THRESHOLD = 50;
+var UNTRACKED_FILE_CAP = 20;
+var TRANSCRIPT_SCAN_MAX_BYTES = 50 * 1024 * 1024;
+function isSafeTranscriptPath(rawPath, opts = {}) {
+  if (!rawPath || !/\.jsonl$/i.test(rawPath)) return false;
+  const homeDir = opts.homeDir ?? os.homedir();
+  const maxBytes = opts.maxBytes ?? TRANSCRIPT_SCAN_MAX_BYTES;
+  try {
+    const realHome = fs6.realpathSync(homeDir);
+    const realPath = fs6.realpathSync(rawPath);
+    const relative3 = path6.relative(realHome, realPath);
+    if (relative3 === "" || relative3.startsWith("..") || path6.isAbsolute(relative3)) {
+      return false;
+    }
+    const { size } = fs6.statSync(realPath);
+    return size <= maxBytes;
+  } catch {
+    return false;
+  }
+}
+function parseNumstat(raw) {
+  const rows = [];
+  for (const line of raw.split("\n")) {
+    const m = /^(\d+|-)\t(\d+|-)\t(.+)$/.exec(line);
+    if (!m) continue;
+    const addedStr = m[1];
+    const deletedStr = m[2];
+    rows.push({
+      added: addedStr === "-" ? 0 : Number(addedStr),
+      deleted: deletedStr === "-" ? 0 : Number(deletedStr),
+      path: m[3]
+    });
+  }
+  return rows;
+}
+var DOC_PATH_RE = /\.md$/i;
+function isDocPath(p) {
+  return DOC_PATH_RE.test(p);
+}
+function nonDocMutatedLines(rows) {
+  return rows.filter((r) => !isDocPath(r.path)).reduce((sum, r) => sum + r.added + r.deleted, 0);
+}
+function gitNumstatRows(cwd) {
+  try {
+    const r = spawnSync2("git", ["diff", "--numstat", "HEAD"], {
+      cwd,
+      encoding: "utf8",
+      maxBuffer: 16 * 1024 * 1024
+    });
+    if (r.status !== 0) return [];
+    return parseNumstat(r.stdout ?? "");
+  } catch {
+    return [];
+  }
+}
+function untrackedNonDocFiles(cwd) {
+  try {
+    const r = spawnSync2("git", ["ls-files", "--others", "--exclude-standard"], {
+      cwd,
+      encoding: "utf8",
+      maxBuffer: 16 * 1024 * 1024
+    });
+    if (r.status !== 0) return [];
+    return (r.stdout ?? "").split("\n").map((l) => l.trim()).filter((l) => l.length > 0 && !isDocPath(l));
+  } catch {
+    return [];
+  }
+}
+var BINARY_PROBE_BYTES = 8e3;
+var UNTRACKED_FILE_READ_CAP_BYTES = 8 * 1024 * 1024;
+function untrackedFileLineCount(cwd, relPath) {
+  try {
+    const abs = path6.resolve(cwd, relPath);
+    const size = fs6.statSync(abs).size;
+    if (size === 0) return 0;
+    if (size > UNTRACKED_FILE_READ_CAP_BYTES) {
+      return MUTATION_LINE_THRESHOLD + 1;
+    }
+    const buf = fs6.readFileSync(abs);
+    if (buf.length === 0) return 0;
+    const probe = buf.subarray(0, Math.min(buf.length, BINARY_PROBE_BYTES));
+    if (probe.includes(0)) return 0;
+    let lines = 0;
+    for (const byte of buf) {
+      if (byte === 10) lines += 1;
+    }
+    if (buf[buf.length - 1] !== 10) lines += 1;
+    return lines;
+  } catch {
+    return 0;
+  }
+}
+function totalNonDocMutatedLinesWithMeasure(cwd) {
+  const trackedLines = nonDocMutatedLines(gitNumstatRows(cwd));
+  const untracked = untrackedNonDocFiles(cwd);
+  if (untracked.length > UNTRACKED_FILE_CAP) {
+    return { lines: MUTATION_LINE_THRESHOLD + 1 + trackedLines, measure: "capped_approximation" };
+  }
+  const untrackedLines = untracked.reduce(
+    (sum, relPath) => sum + untrackedFileLineCount(cwd, relPath),
+    0
+  );
+  return { lines: trackedLines + untrackedLines, measure: "exact" };
+}
+function isObject2(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function str2(v) {
+  return typeof v === "string" ? v : "";
+}
+var DISPATCH_TOOL_RE = /^(agent|task)$/i;
+var REVIEW_SHAPED_LABEL_RE = /\b(review|judge|adversarial|critique|second[- ]opinion|blind\s+(pass|review)|cross-model)\b/i;
+var REVIEW_SHAPED_PROMPT_RE = /\b(code\s+review|neutral\s+review|adversarial|judge|critique|second[- ]opinion|blind\s+(pass|review)|cross-model)\b/i;
+var REVIEW_SKILL_NAME_RE = /^(review[-:]changes|judge[-:][a-z0-9-]+|adversarial-review|code-review)$/i;
+function scanTranscriptForReviewer(transcriptText) {
+  for (const raw of transcriptText.split("\n")) {
+    const line = raw.trim();
+    if (!line) continue;
+    let obj;
+    try {
+      obj = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (!isObject2(obj) || obj["type"] !== "assistant") continue;
+    const msg = obj["message"];
+    if (!isObject2(msg)) continue;
+    const content = msg["content"];
+    if (!Array.isArray(content)) continue;
+    for (const blk of content) {
+      if (!isObject2(blk) || blk["type"] !== "tool_use") continue;
+      const name = str2(blk["name"]);
+      const input = blk["input"];
+      const inputObj = isObject2(input) ? input : {};
+      if (DISPATCH_TOOL_RE.test(name)) {
+        const label = [
+          str2(inputObj["description"]),
+          str2(inputObj["subagent_type"])
+        ].filter(Boolean).join(" ");
+        if (REVIEW_SHAPED_LABEL_RE.test(label)) return true;
+        const prompt = str2(inputObj["prompt"]);
+        if (REVIEW_SHAPED_PROMPT_RE.test(prompt)) return true;
+        continue;
+      }
+      if (/^skill$/i.test(name)) {
+        const skillName = str2(inputObj["skill"]) || str2(inputObj["name"]) || str2(inputObj["command"]);
+        if (REVIEW_SKILL_NAME_RE.test(skillName)) return true;
+        continue;
+      }
+      if (REVIEW_SKILL_NAME_RE.test(name)) return true;
+    }
+  }
+  return false;
+}
+function buildAdvisoryLine(diffLines) {
+  return `this session mutated ${diffLines} lines without a neutral review; spawn a cross-model reviewer before claiming done (delegation-policy / verify-budget)`;
+}
+function appendReviewSkippedTelemetry(workspaceRoot, diffLines, mutationMeasure, baseline) {
+  if (is_replay_mode()) return;
+  const ts = (/* @__PURE__ */ new Date()).toISOString();
+  const { line, errors } = buildReviewSkippedLine({
+    diff_lines: diffLines,
+    mutation_measure: mutationMeasure,
+    ts,
+    id: crypto2.randomUUID(),
+    baseline
+  });
+  if (errors.length || line === null) return;
+  try {
+    const dir = path6.join(workspaceRoot, "agents", "runtime", "state", "audit");
+    fs6.mkdirSync(dir, { recursive: true });
+    const file = path6.join(dir, `${ts.slice(0, 7)}.jsonl`);
+    fs6.appendFileSync(file, `${JSON.stringify(line)}
+`, "utf8");
+  } catch {
+  }
+}
+function sessionStateDir(workspaceRoot) {
+  return path6.join(workspaceRoot, "agents", "runtime", "state", "end-review-nudge");
+}
+function sessionStateFile(workspaceRoot, sessionKey) {
+  return path6.join(sessionStateDir(workspaceRoot), `${sessionKey}.json`);
+}
+function deriveSessionKey2(envelope, payload) {
+  const raw = str2(envelope["session_id"]) || str2(payload["transcript_path"] ?? payload["transcriptPath"]);
+  const material = raw || "unknown-session";
+  return crypto2.createHash("sha256").update(material).digest("hex");
+}
+function hasFiredThisSession(workspaceRoot, sessionKey) {
+  try {
+    return fs6.existsSync(sessionStateFile(workspaceRoot, sessionKey));
+  } catch {
+    return false;
+  }
+}
+function markFiredThisSession(workspaceRoot, sessionKey, ts) {
+  try {
+    atomic_write_json(sessionStateFile(workspaceRoot, sessionKey), { fired_at: ts });
+  } catch {
+  }
+}
+function _read_stdin() {
+  return readHookStdin();
+}
+var FALLBACK_TO_TELEMETRY = {
+  absent: "absent",
+  unreadable: "unreadable",
+  "head-moved": "head_moved",
+  "mixed-measure": "mixed_measure"
+};
+function main5() {
+  const [envelope, payload] = unwrap(_read_stdin(), "claude");
+  const event = String(envelope["event"] ?? "");
+  if (event !== "" && event !== "stop") {
+    return 0;
+  }
+  const workspace_root = String(envelope["workspace_root"] ?? "").trim() || process.cwd();
+  let measuredLines;
+  let mutationMeasure;
+  try {
+    const measured = totalNonDocMutatedLinesWithMeasure(workspace_root);
+    measuredLines = measured.lines;
+    mutationMeasure = measured.measure;
+  } catch {
+    return 0;
+  }
+  const sessionKey = deriveSessionKey2(envelope, payload);
+  const baselineOutcome = applyBaseline(
+    measuredLines,
+    readBaseline(workspace_root, sessionKey),
+    // A THUNK, not a value: on the `absent` and `unreadable` branches the
+    // result is discarded, and those two are the steady state on every host
+    // without this nudge and on every session before its first baseline
+    // write. Passing the value eagerly spent an 11-14 ms `git rev-parse` on
+    // each of those stops for nothing.
+    () => currentHeadSha(workspace_root),
+    mutationMeasure
+  );
+  const diffLines = baselineOutcome.lines;
+  const baselineApplication = baselineOutcome.applied ? "applied" : FALLBACK_TO_TELEMETRY[baselineOutcome.fallback];
+  if (diffLines <= MUTATION_LINE_THRESHOLD) {
+    return 0;
+  }
+  if (hasFiredThisSession(workspace_root, sessionKey)) {
+    return 0;
+  }
+  const transcriptPath = str2(
+    payload["transcript_path"] ?? payload["transcriptPath"]
+  ).trim();
+  let reviewerRan = false;
+  if (transcriptPath && isSafeTranscriptPath(transcriptPath)) {
+    try {
+      reviewerRan = scanTranscriptForReviewer(fs6.readFileSync(transcriptPath, "utf-8"));
+    } catch {
+      reviewerRan = false;
+    }
+  }
+  if (reviewerRan) {
+    return 0;
+  }
+  markFiredThisSession(workspace_root, sessionKey, (/* @__PURE__ */ new Date()).toISOString());
+  try {
+    appendReviewSkippedTelemetry(
+      workspace_root,
+      diffLines,
+      mutationMeasure,
+      baselineApplication
+    );
+  } catch {
+  }
+  process.stdout.write(
+    `${JSON.stringify({
+      decision: "warn",
+      reason: `end-review-nudge: session mutated ${diffLines} non-doc lines without a neutral review`,
+      additional_context: buildAdvisoryLine(diffLines)
+    })}
+`
+  );
+  return EXIT_WARN2;
+}
+function _isCliEntry5() {
+  if (true) {
+    return false;
+  }
+  if (process.argv[1] === void 0) {
+    return false;
+  }
+  const argvUrl = pathToFileURL5(path6.resolve(process.argv[1])).href;
+  if (import.meta.url === argvUrl) {
+    return true;
+  }
+  try {
+    const here = fs6.realpathSync(fileURLToPath5(import.meta.url));
+    const argv = fs6.realpathSync(path6.resolve(process.argv[1]));
+    return here === argv;
+  } catch {
+    return false;
+  }
+}
+if (_isCliEntry5()) {
+  process.exit(main5());
+}
+
+// src/scripts/_lib/turn_end_transcript.ts
+function readTranscriptTail(transcriptPath, opts = {}) {
+  const empty = {
+    lastAssistant: "",
+    turnOrdinal: 0,
+    toolCalls: [],
+    assistantTurnTexts: []
+  };
+  if (!transcriptPath || !isSafeTranscriptPath(transcriptPath, opts)) return empty;
+  let lines;
+  try {
+    if (opts.maxBytes !== void 0 && fs7.statSync(transcriptPath).size > opts.maxBytes) {
+      return empty;
+    }
+    lines = fs7.readFileSync(transcriptPath, "utf-8").split("\n");
+  } catch {
+    return empty;
+  }
+  let lastAssistant = "";
+  let turnOrdinal = 0;
+  let toolCalls = [];
+  let assistantTurnTexts = [];
+  for (const rawLine of lines) {
+    const line = rawLine.trim();
+    if (!line) continue;
+    let obj;
+    try {
+      obj = JSON.parse(line);
+    } catch {
+      continue;
+    }
+    if (typeof obj !== "object" || obj === null || Array.isArray(obj)) continue;
+    const entry = obj;
+    if (entry["isSidechain"] === true) continue;
+    const role = entry["type"];
+    if (role !== "assistant" && role !== "user") continue;
+    const msg = entry["message"];
+    if (typeof msg !== "object" || msg === null || Array.isArray(msg)) continue;
+    const content = msg["content"];
+    if (role === "assistant") {
+      toolCalls.push(...extractToolCalls(content));
+    }
+    const text = _messageText(content);
+    if (text === null) continue;
+    if (role === "assistant") {
+      lastAssistant = text;
+      assistantTurnTexts.push(text);
+    } else if (!isSyntheticPrompt(text)) {
+      turnOrdinal += 1;
+      toolCalls = [];
+      assistantTurnTexts = [];
+    }
+  }
+  return {
+    lastAssistant: lastAssistant.trim(),
+    turnOrdinal,
+    toolCalls,
+    assistantTurnTexts
+  };
 }
-function main5() {
-  const raw = readHookStdin();
-  let envelope = {};
-  try {
-    envelope = raw.trim() ? JSON.parse(raw) : {};
-  } catch {
-    return EXIT_ALLOW3;
+function extractToolCalls(content) {
+  if (!Array.isArray(content)) return [];
+  const out = [];
+  for (const blk of content) {
+    if (typeof blk !== "object" || blk === null || Array.isArray(blk)) continue;
+    const b = blk;
+    if (b["type"] !== "tool_use") continue;
+    const name = b["name"];
+    if (typeof name !== "string") continue;
+    const input = b["input"];
+    const call = { name };
+    if (typeof input === "object" && input !== null && !Array.isArray(input)) {
+      const inp = input;
+      const cmd = inp["command"];
+      if (typeof cmd === "string") call.command = cmd;
+      const p = inp["file_path"] ?? inp["path"] ?? inp["notebook_path"];
+      if (typeof p === "string") call.path = p;
+    }
+    out.push(call);
   }
-  return processEnvelope(envelope, resolveConsumerRoot(envelope));
+  return out;
 }
-function _isCliEntry5() {
-  if (true) {
-    return false;
-  }
-  if (process.argv[1] === void 0) return false;
-  const argvUrl = pathToFileURL5(path6.resolve(process.argv[1])).href;
-  if (import.meta.url === argvUrl) return true;
-  try {
-    return fs6.realpathSync(fileURLToPath5(import.meta.url)) === fs6.realpathSync(path6.resolve(process.argv[1]));
-  } catch {
-    return false;
+function _messageText(content) {
+  if (typeof content === "string") return content;
+  if (!Array.isArray(content)) return null;
+  const parts = [];
+  for (const blk of content) {
+    if (typeof blk !== "object" || blk === null || Array.isArray(blk)) continue;
+    const b = blk;
+    if (b["type"] !== "text") continue;
+    const t = b["text"];
+    if (typeof t === "string") parts.push(t);
   }
+  return parts.length > 0 ? parts.join("\n") : null;
 }
-if (_isCliEntry5()) process.exit(main5());
 
 // src/scripts/hooks/turn_end_gate_hook.ts
-var EXIT_BLOCK = 1;
-var EXIT_ALLOW4 = 0;
 var TRANSCRIPT_READ_MAX_BYTES = 8 * 1024 * 1024;
 function stripFencedBlocks(text) {
   const out = [];
@@ -3430,7 +3543,7 @@ function detectPromissory(reply) {
 function readCiSettled(workspaceRoot, session_id) {
   if (!hasStableSessionId(session_id)) return { seen: false, settled: false };
   try {
-    const raw = fs7.readFileSync(path7.join(workspaceRoot, statePathFor(session_id)), "utf-8");
+    const raw = fs8.readFileSync(path7.join(workspaceRoot, statePathFor(session_id)), "utf-8");
     const decoded = JSON.parse(raw);
     if (!owns_session_state(decoded, session_id)) return { seen: false, settled: false };
     if (typeof decoded === "object" && decoded !== null && !Array.isArray(decoded)) {
@@ -3466,7 +3579,7 @@ function detectCompletionClaim(reply, ci) {
 function readLanguagePin(workspaceRoot, session_id) {
   if (!hasStableSessionId(session_id)) return "und";
   try {
-    const raw = fs7.readFileSync(
+    const raw = fs8.readFileSync(
       path7.join(workspaceRoot, statePathFor2(session_id)),
       "utf-8"
     );
@@ -3493,29 +3606,38 @@ function detectLanguage(reply, pinned) {
   };
 }
 var _EDIT_TOOLS = /* @__PURE__ */ new Set(["Edit", "Write", "MultiEdit", "NotebookEdit"]);
-var _VERIFY_RE = /\b(test|tests|vitest|jest|pytest|phpunit|pest|tsc|eslint|ruff|mypy|pyright|clippy|phpstan|typecheck|lint[-_:a-z]*|build|ci|preflight|smoke[-_:a-z]*|check[-_:a-z]*|validate[-_:a-z]*)\b|\b(task|npm|pnpm|yarn|composer|cargo|go|make|php artisan|bun)\s+(run\s+)?\S*(test|check|lint|build|ci|typecheck)/i;
-function isVerificationCommand(command) {
-  return _VERIFY_RE.test(command);
-}
-function detectUnverifiedEdit(toolCalls) {
+function detectUnverifiedEdit(toolCalls, runState = null) {
   let lastEdit = -1;
   for (let i = 0; i < toolCalls.length; i += 1) {
     if (_EDIT_TOOLS.has(toolCalls[i].name)) lastEdit = i;
   }
   if (lastEdit === -1) return null;
+  const edited = toolCalls[lastEdit].path ?? toolCalls[lastEdit].name;
+  if (runState !== null) {
+    const reading = readRunEvidence(runState);
+    if (reading.passed) return null;
+    if (!reading.instrumentGap) {
+      return {
+        detector: "verification",
+        evidence: edited,
+        reason: describeRecordFinding(reading.failed, reading.reasons),
+        mode: "record"
+      };
+    }
+  }
   for (let i = lastEdit + 1; i < toolCalls.length; i += 1) {
     const c = toolCalls[i];
     if (c.name === "Bash" && c.command !== void 0 && isVerificationCommand(c.command)) {
       return null;
     }
   }
-  const edited = toolCalls[lastEdit].path;
   return {
     detector: "verification",
     // The path, never the diff: the evidence span is quoted into a refusal,
     // and `ToolCall` is shaped so a file body cannot reach it.
-    evidence: edited ?? toolCalls[lastEdit].name,
-    reason: "this turn changed a file and then ran no verification command \u2014 no test, type-check, lint or build call follows the last edit (verify-before-complete: a claim without a fresh run is unverified)"
+    evidence: edited,
+    reason: "this turn changed a file and then ran no verification command \u2014 no test, type-check, lint or build call follows the last edit (verify-before-complete: a claim without a fresh run is unverified)",
+    mode: "transcript"
   };
 }
 var _SOURCE_RE = /\.(?:ts|tsx|js|jsx|mjs|cjs|vue|svelte|php|py|rb|go|rs|java|kt|swift|cs|scala|ex|exs)$/i;
@@ -3527,18 +3649,37 @@ function _isTestPath(p) {
 function _isProductionSource(p) {
   return _SOURCE_RE.test(p) && !_isTestPath(p);
 }
-function detectUntestedChange(reply, toolCalls) {
+function detectUntestedChange(reply, toolCalls, runState = null) {
   const edited = toolCalls.filter((c) => _EDIT_TOOLS.has(c.name) && c.path !== void 0).map((c) => c.path);
   const source = edited.filter(_isProductionSource);
   if (source.length === 0) return null;
-  if (edited.some(_isTestPath)) return null;
+  const wroteNewTest = toolCalls.some(
+    (c) => c.name === "Write" && c.path !== void 0 && _isTestPath(c.path)
+  );
+  let noRedEvidence = false;
+  if (edited.some(_isTestPath)) {
+    if (!wroteNewTest) return null;
+    if (runState === null) return null;
+    if (hasRedThenGreen(runState)) return null;
+    if (readRunEvidence(runState).instrumentGap) return null;
+    noRedEvidence = true;
+  }
   const prose = visibleProse(reply);
   const m = _COMPLETION_RE.exec(prose);
   if (!m) return null;
   if (_NEGATED_CLAIM_RE.test(_lineAround(prose, m.index))) return null;
   const shown = source.slice(0, 3).join(", ");
+  if (noRedEvidence) {
+    return {
+      detector: "untested",
+      evidence: shown + (source.length > 3 ? ` (+${String(source.length - 3)} more)` : ""),
+      mode: "record",
+      reason: NO_RED_EVIDENCE_REASON
+    };
+  }
   return {
     detector: "untested",
+    mode: "transcript",
     evidence: shown + (source.length > 3 ? ` (+${String(source.length - 3)} more)` : ""),
     reason: "a completion claim over production code this turn changed, with NO test file touched anywhere in the turn \u2014 running a linter is not evidence the change works. Write the test that would have caught the failure, and enumerate the states the change actually has (every view, every CRUD path, the empty and error states) rather than the happy one. If a test genuinely does not belong here, say which file carries the coverage instead"
   };
@@ -3548,7 +3689,7 @@ function sessionStateFile2(workspaceRoot, sessionKey) {
 }
 function alreadyRefusedTurn(workspaceRoot, sessionKey, turnOrdinal) {
   try {
-    const raw = fs7.readFileSync(sessionStateFile2(workspaceRoot, sessionKey), "utf-8");
+    const raw = fs8.readFileSync(sessionStateFile2(workspaceRoot, sessionKey), "utf-8");
     const decoded = JSON.parse(raw);
     if (typeof decoded === "object" && decoded !== null && !Array.isArray(decoded)) {
       return decoded["refused_turn"] === turnOrdinal;
@@ -3562,7 +3703,7 @@ function markRefusedTurn(workspaceRoot, sessionKey, turnOrdinal, detectors, prom
   const file = sessionStateFile2(workspaceRoot, sessionKey);
   let prev = null;
   try {
-    prev = parseRecord(fs7.readFileSync(file, "utf-8"));
+    prev = parseRecord(fs8.readFileSync(file, "utf-8"));
   } catch {
   }
   let version;
@@ -3585,112 +3726,10 @@ function markRefusedTurn(workspaceRoot, sessionKey, turnOrdinal, detectors, prom
   } catch {
   }
 }
-function readTranscriptTail(transcriptPath, opts = {}) {
-  const empty = {
-    lastAssistant: "",
-    turnOrdinal: 0,
-    toolCalls: [],
-    assistantTurnTexts: []
-  };
-  if (!transcriptPath || !isSafeTranscriptPath(transcriptPath, opts)) return empty;
-  let lines;
-  try {
-    if (opts.maxBytes !== void 0 && fs7.statSync(transcriptPath).size > opts.maxBytes) {
-      return empty;
-    }
-    lines = fs7.readFileSync(transcriptPath, "utf-8").split("\n");
-  } catch {
-    return empty;
-  }
-  let lastAssistant = "";
-  let turnOrdinal = 0;
-  let toolCalls = [];
-  let assistantTurnTexts = [];
-  for (const rawLine of lines) {
-    const line = rawLine.trim();
-    if (!line) continue;
-    let obj;
-    try {
-      obj = JSON.parse(line);
-    } catch {
-      continue;
-    }
-    if (typeof obj !== "object" || obj === null || Array.isArray(obj)) continue;
-    const entry = obj;
-    if (entry["isSidechain"] === true) continue;
-    const role = entry["type"];
-    if (role !== "assistant" && role !== "user") continue;
-    const msg = entry["message"];
-    if (typeof msg !== "object" || msg === null || Array.isArray(msg)) continue;
-    const content = msg["content"];
-    if (role === "assistant") {
-      toolCalls.push(...extractToolCalls(content));
-    }
-    const text = _messageText(content);
-    if (text === null) continue;
-    if (role === "assistant") {
-      lastAssistant = text;
-      assistantTurnTexts.push(text);
-    } else if (!isSyntheticPrompt(text)) {
-      turnOrdinal += 1;
-      toolCalls = [];
-      assistantTurnTexts = [];
-    }
-  }
-  return {
-    lastAssistant: lastAssistant.trim(),
-    turnOrdinal,
-    toolCalls,
-    assistantTurnTexts
-  };
-}
-function extractToolCalls(content) {
-  if (!Array.isArray(content)) return [];
-  const out = [];
-  for (const blk of content) {
-    if (typeof blk !== "object" || blk === null || Array.isArray(blk)) continue;
-    const b = blk;
-    if (b["type"] !== "tool_use") continue;
-    const name = b["name"];
-    if (typeof name !== "string") continue;
-    const input = b["input"];
-    const call = { name };
-    if (typeof input === "object" && input !== null && !Array.isArray(input)) {
-      const inp = input;
-      const cmd = inp["command"];
-      if (typeof cmd === "string") call.command = cmd;
-      const p = inp["file_path"] ?? inp["path"] ?? inp["notebook_path"];
-      if (typeof p === "string") call.path = p;
-    }
-    out.push(call);
-  }
-  return out;
-}
-function _messageText(content) {
-  if (typeof content === "string") return content;
-  if (!Array.isArray(content)) return null;
-  const parts = [];
-  for (const blk of content) {
-    if (typeof blk !== "object" || blk === null || Array.isArray(blk)) continue;
-    const b = blk;
-    if (b["type"] !== "text") continue;
-    const t = b["text"];
-    if (typeof t === "string") parts.push(t);
-  }
-  return parts.length > 0 ? parts.join("\n") : null;
-}
 function str3(v) {
   return typeof v === "string" ? v : "";
 }
-function main6() {
-  let envelope;
-  let payload;
-  try {
-    [envelope, payload] = unwrap(readHookStdin(), "claude");
-  } catch {
-    return EXIT_ALLOW4;
-  }
-  if (payload["stop_hook_active"] === true) return EXIT_ALLOW4;
+function assembleDetectorInputs(envelope, payload) {
   const workspaceRoot = str3(envelope["workspace_root"]) || process.cwd();
   let dispatchOpen = false;
   try {
@@ -3704,18 +3743,32 @@ function main6() {
     transcriptPath,
     { maxBytes: TRANSCRIPT_READ_MAX_BYTES }
   );
-  if (!lastAssistant) return EXIT_ALLOW4;
+  if (!lastAssistant) return null;
   const payloadClosing = str3(
     payload["last_assistant_message"] ?? payload["lastAssistantMessage"]
   );
   const closingFromPayload = payloadClosing !== "" && !assistantTurnTexts.includes(payloadClosing);
   const turnTexts = closingFromPayload ? [...assistantTurnTexts, payloadClosing] : assistantTurnTexts;
-  const promptId = str3(
-    payload["prompt_id"] ?? payload["promptId"]
-  );
+  const promptId = str3(payload["prompt_id"] ?? payload["promptId"]);
   const rawSessionId = str3(envelope["session_id"]) || "";
   const sessionKey = deriveSessionKey(rawSessionId || "unknown-session");
-  if (alreadyRefusedTurn(workspaceRoot, sessionKey, turnOrdinal)) return EXIT_ALLOW4;
+  const runState = readTurnRunState(workspaceRoot, rawSessionId);
+  return {
+    workspaceRoot,
+    rawSessionId,
+    sessionKey,
+    turnOrdinal,
+    promptId,
+    lastAssistant,
+    toolCalls,
+    turnTexts,
+    closingFromPayload,
+    dispatchOpen,
+    runState
+  };
+}
+function runDetectors(inputs) {
+  const { dispatchOpen, lastAssistant, workspaceRoot, rawSessionId, toolCalls, runState } = inputs;
   const findings = [];
   for (const f of [
     // A and D are the completion-adjacent pair a pending dispatch excuses
@@ -3723,17 +3776,14 @@ function main6() {
     // excused by anything about a dispatch and run unchanged.
     dispatchOpen ? null : detectPromissory(lastAssistant),
     detectLanguage(lastAssistant, readLanguagePin(workspaceRoot, rawSessionId)),
-    detectUnverifiedEdit(toolCalls),
-    // Round 7 § Phase 1 — detector D. It is NOT unconditional, and this
-    // comment said it was while sitting one line above the `dispatchOpen`
-    // ternary that conditions it: A and D are both excused by an open
-    // dispatch, per the note at the top of this loop. Corrected 2026-08-18.
-    // It shipped with its own settings flag one commit earlier
-    // and that flag is gone: `hooks.turn_end_gate.*` was deleted on
-    // 2026-08-12 because a default-off safety gate is an absent one. Its
-    // gating is where the comment above says gating belongs — inside the
-    // detector: no CI observed, or a settled read, or no completion claim
-    // ⇒ no finding.
+    detectUnverifiedEdit(toolCalls, runState),
+    // Round 7 § Phase 1 — detector D. It is NOT unconditional: A and D are
+    // both excused by an open dispatch, per the note above. It shipped with
+    // its own settings flag one commit earlier and that flag is gone:
+    // `hooks.turn_end_gate.*` was deleted on 2026-08-12 because a
+    // default-off safety gate is an absent one. Its gating is where the
+    // note above says gating belongs — inside the detector: no CI observed,
+    // or a settled read, or no completion claim ⇒ no finding.
     dispatchOpen ? null : detectCompletionClaim(lastAssistant, readCiSettled(workspaceRoot, rawSessionId)),
     // Detector E is UNCONDITIONAL, and that is the opposite choice from A
     // and D one line above rather than an oversight. An open dispatch
@@ -3743,24 +3793,71 @@ function main6() {
     // that produced the measured failure — IS the continuation that drops
     // the decision, so narrowing E the same way would silence it in exactly
     // the case it exists for.
-    detectDroppedDecision(turnTexts, closingFromPayload),
+    detectDroppedDecision(inputs.turnTexts, inputs.closingFromPayload),
     // Detector F takes the OTHER side of that same question, and the two
     // sitting adjacent is the clearest place to say why. E fires on a
     // question already asked, which an open dispatch cannot excuse. F fires
     // on a completion CLAIM, and a turn waiting on a subagent has not
     // finished — so its closing is not the claim F is about. Same slot,
     // opposite trigger, opposite treatment of `dispatchOpen`.
-    dispatchOpen ? null : detectUntestedChange(lastAssistant, toolCalls)
+    dispatchOpen ? null : detectUntestedChange(lastAssistant, toolCalls, runState)
   ]) {
     if (f) findings.push(f);
   }
-  if (findings.length === 0) return EXIT_ALLOW4;
+  return findings;
+}
+function recordShadow(inputs, layer) {
+  if (is_replay_mode()) return;
+  try {
+    const findings = runDetectors(inputs);
+    const file = sessionShadowFile(inputs.workspaceRoot, inputs.sessionKey);
+    let prev = null;
+    try {
+      prev = parseShadowRecord(fs8.readFileSync(file, "utf-8"));
+    } catch {
+    }
+    atomic_write_json(
+      file,
+      foldShadow(prev, {
+        detectors: findings.map((f) => f.detector),
+        turnOrdinal: inputs.turnOrdinal,
+        at: (/* @__PURE__ */ new Date()).toISOString(),
+        layer
+      })
+    );
+  } catch {
+  }
+}
+function main6() {
+  let envelope;
+  let payload;
+  try {
+    [envelope, payload] = unwrap(readHookStdin(), "claude");
+  } catch {
+    return EXIT_ALLOW3;
+  }
+  if (payload["stop_hook_active"] === true) {
+    try {
+      const retryInputs = assembleDetectorInputs(envelope, payload);
+      if (retryInputs !== null) recordShadow(retryInputs, "stop_hook_active");
+    } catch {
+    }
+    return EXIT_ALLOW3;
+  }
+  const inputs = assembleDetectorInputs(envelope, payload);
+  if (inputs === null) return EXIT_ALLOW3;
+  if (alreadyRefusedTurn(inputs.workspaceRoot, inputs.sessionKey, inputs.turnOrdinal)) {
+    recordShadow(inputs, "refused_turn");
+    return EXIT_ALLOW3;
+  }
+  const findings = runDetectors(inputs);
+  if (findings.length === 0) return EXIT_ALLOW3;
   markRefusedTurn(
-    workspaceRoot,
-    sessionKey,
-    turnOrdinal,
+    inputs.workspaceRoot,
+    inputs.sessionKey,
+    inputs.turnOrdinal,
     findings.map((f) => f.detector),
-    promptId
+    inputs.promptId
   );
   const lines = findings.map(
     (f) => `  \xB7 ${f.detector}: ${f.reason}
@@ -3787,8 +3884,8 @@ function _isCliEntry6() {
     return true;
   }
   try {
-    const here = fs7.realpathSync(fileURLToPath6(import.meta.url));
-    const argv = fs7.realpathSync(path7.resolve(process.argv[1]));
+    const here = fs8.realpathSync(fileURLToPath6(import.meta.url));
+    const argv = fs8.realpathSync(path7.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -3799,12 +3896,28 @@ if (_isCliEntry6()) {
 }
 
 // src/scripts/hooks/evidence_independence.ts
+import { spawnSync as spawnSync3 } from "node:child_process";
 import crypto3 from "node:crypto";
-import fs8 from "node:fs";
+import fs9 from "node:fs";
 import path8 from "node:path";
 import { fileURLToPath as fileURLToPath7, pathToFileURL as pathToFileURL7 } from "node:url";
-var EXIT_ALLOW5 = 0;
-var EXIT_BLOCK2 = 1;
+
+// src/scripts/_lib/test_delta.ts
+function isCodePath(p) {
+  const f = p.replace(/\\/g, "/");
+  if (isTestPath(f)) return false;
+  if (!/\.(ts|tsx|js|mjs|cjs)$/.test(f)) return false;
+  if (f.endsWith(".d.ts")) return false;
+  if (/^(dist|\.augment|\.claude|\.cursor|node_modules)\//.test(f)) return false;
+  return /^(src|scripts)\//.test(f);
+}
+function isTestPath(p) {
+  const f = p.replace(/\\/g, "/");
+  if (/^tests\//.test(f)) return true;
+  return /\.(test|spec)\.(ts|tsx|js|mjs|cjs)$/.test(f);
+}
+
+// src/scripts/hooks/evidence_independence.ts
 var STATE_FILE3 = path8.join("agents", "state", "evidence-dispatch.json");
 function _isObject5(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
@@ -3873,7 +3986,7 @@ function extractDispatch(envelope) {
 }
 function _ledgerStamp(consumer_root) {
   try {
-    const raw = fs8.readFileSync(
+    const raw = fs9.readFileSync(
       path8.join(consumer_root, "agents", "state", "git-authorization.json"),
       "utf8"
     );
@@ -3885,7 +3998,7 @@ function _ledgerStamp(consumer_root) {
 }
 function _load(target) {
   try {
-    const decoded = JSON.parse(fs8.readFileSync(target, "utf8"));
+    const decoded = JSON.parse(fs9.readFileSync(target, "utf8"));
     if (_isObject5(decoded) && Array.isArray(decoded["evaluations"])) {
       return decoded;
     }
@@ -3896,12 +4009,12 @@ function _load(target) {
 var WARN_TEXT = "First evaluation dispatch this turn. Two shapes fabricated a binding honest-null in the audited sessions \u2014 check your prompt for both before it goes out: (1) a verdict pre-loaded into the prompt, and (2) a scope narrowed to files you chose. A review you commissioned on your own work is admissible as gate evidence only when the prompt is recorded alongside the verdict.";
 function decide(tool, prompt, priorEvaluations) {
   if (!isDispatchTool(tool) || !isEvaluationPrompt(prompt)) {
-    return { exit: EXIT_ALLOW5, stdout: "", stderr: "", evaluations: priorEvaluations };
+    return { exit: EXIT_ALLOW3, stdout: "", stderr: "", evaluations: priorEvaluations };
   }
   const preloaded = preloadedVerdict(prompt);
   if (preloaded !== null) {
     return {
-      exit: EXIT_BLOCK2,
+      exit: EXIT_BLOCK,
       stdout: "",
       stderr: `Blocked: this evaluation prompt pre-loads its verdict ("${preloaded}"). That is the construct that produced a fabricated NO-FINDINGS committed as binding gate evidence, over a delta an unsteered pass then found a live critical in. Remove the expectation from the prompt and let the evaluator reach its own verdict.
 `,
@@ -3909,11 +4022,11 @@ function decide(tool, prompt, priorEvaluations) {
     };
   }
   if (!isSelfScoped(prompt)) {
-    return { exit: EXIT_ALLOW5, stdout: "", stderr: "", evaluations: priorEvaluations };
+    return { exit: EXIT_ALLOW3, stdout: "", stderr: "", evaluations: priorEvaluations };
   }
   if (priorEvaluations >= 1) {
     return {
-      exit: EXIT_ALLOW5,
+      exit: EXIT_ALLOW3,
       stdout: `${JSON.stringify({
         decision: "warn",
         reason: `Second evaluation dispatch of your own work in this turn. If both passes judge the SAME subject, that is verdict shopping \u2014 commissioning another with a different prompt or scope selects the answer instead of measuring it. Report what the first pass returned, then re-plan. If this is an implementation fan-out rather than a second review, carry on: this check reads prose and cannot tell the two apart with certainty.`
@@ -3924,13 +4037,39 @@ function decide(tool, prompt, priorEvaluations) {
     };
   }
   return {
-    exit: EXIT_ALLOW5,
+    exit: EXIT_ALLOW3,
     stdout: `${JSON.stringify({ decision: "warn", reason: WARN_TEXT })}
 `,
     stderr: "",
     evaluations: priorEvaluations + 1
   };
 }
+function sameSessionTestFlag(command) {
+  if (command === null || !/\bgit\b[^|;&]*\bcommit\b/.test(command)) return null;
+  return SAME_SESSION_TEXT;
+}
+var SAME_SESSION_TEXT = "This commit stages both a test and code it could cover \u2014 the shape L0 takes in a diff, where the implementer authored the evaluator. This check reads the staged set only: it cannot tell who wrote the test, so it is a prompt to STATE the level, not a finding that you are at L0. L0 is a permitted FALLBACK, not the default: where a second session, a second model or a second provider was available, the test should have come from one of them. Say which in the commit or the PR body \u2014 a diff looks identical either way. See evaluator-independence \xA7 Tests are evaluators.";
+function touchesTestAndCode(paths) {
+  return paths.some(isTestPath) && paths.some(isCodePath);
+}
+function _commandOf(envelope) {
+  const payload = _isObject5(envelope["payload"]) ? envelope["payload"] : envelope;
+  const input = _isObject5(payload["tool_input"]) ? payload["tool_input"] : payload;
+  for (const key of ["command", "cmd", "shell_command"]) {
+    const v = input[key];
+    if (typeof v === "string" && v !== "") return v;
+  }
+  return null;
+}
+function _stagedPaths(consumer_root) {
+  const r = spawnSync3("git", ["diff", "--cached", "--name-only"], {
+    cwd: consumer_root,
+    encoding: "utf8"
+  });
+  if (r.status !== 0) return null;
+  const out = r.stdout.split("\n").map((s) => s.trim()).filter((s) => s !== "");
+  return out.length === 0 ? null : out;
+}
 function run3(stdin_text, options) {
   let envelope = {};
   if (stdin_text.trim()) {
@@ -3940,7 +4079,7 @@ function run3(stdin_text, options) {
         envelope = decoded;
       }
     } catch {
-      return EXIT_ALLOW5;
+      return EXIT_ALLOW3;
     }
   }
   const target = path8.join(options.consumer_root, STATE_FILE3);
@@ -3953,6 +4092,15 @@ function run3(stdin_text, options) {
     state.evaluations = [];
   }
   const [tool, prompt] = extractDispatch(envelope);
+  const flag = sameSessionTestFlag(_commandOf(envelope));
+  if (flag !== null) {
+    const staged = _stagedPaths(options.consumer_root);
+    if (staged !== null && touchesTestAndCode(staged)) {
+      process.stdout.write(`${JSON.stringify({ decision: "warn", reason: flag })}
+`);
+      return EXIT_ALLOW3;
+    }
+  }
   const decision = decide(tool, prompt, state.evaluations.length);
   if (decision.evaluations > state.evaluations.length) {
     state.evaluations.push({
@@ -4007,8 +4155,8 @@ function _isCliEntry7() {
     return true;
   }
   try {
-    const here = fs8.realpathSync(fileURLToPath7(import.meta.url));
-    const argv = fs8.realpathSync(path8.resolve(process.argv[1]));
+    const here = fs9.realpathSync(fileURLToPath7(import.meta.url));
+    const argv = fs9.realpathSync(path8.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -4019,7 +4167,7 @@ if (_isCliEntry7()) {
 }
 
 // src/scripts/hooks/delegation_nudge_hook.ts
-import fs9 from "node:fs";
+import fs10 from "node:fs";
 import path9 from "node:path";
 import { fileURLToPath as fileURLToPath8, pathToFileURL as pathToFileURL8 } from "node:url";
 
@@ -4301,8 +4449,6 @@ function resolveSubagentRouting(inp) {
 }
 
 // src/scripts/hooks/delegation_nudge_hook.ts
-var EXIT_ALLOW6 = 0;
-var EXIT_WARN3 = 2;
 function _isObject6(v) {
   return typeof v === "object" && v !== null && !Array.isArray(v);
 }
@@ -4482,28 +4628,28 @@ function main8() {
     const raw = readHookStdin();
     envelope = raw.trim() ? JSON.parse(raw) : {};
   } catch {
-    return EXIT_ALLOW6;
+    return EXIT_ALLOW3;
   }
   const env = _isObject6(envelope) ? envelope : {};
   const event = env["event"];
   const slot = typeof event === "string" && event !== "" ? event : "user_prompt_submit";
   if (slot !== "user_prompt_submit") {
-    return EXIT_ALLOW6;
+    return EXIT_ALLOW3;
   }
   const payload = _isObject6(env["payload"]) ? env["payload"] : env;
   const prompt = _extractPrompt2(payload);
   if (!prompt) {
-    return EXIT_ALLOW6;
+    return EXIT_ALLOW3;
   }
   if (isSyntheticPrompt(prompt)) {
-    return EXIT_ALLOW6;
+    return EXIT_ALLOW3;
   }
   const root = _workspaceRoot(env);
   const platform = env["platform"];
   const hostId = typeof platform === "string" && platform ? platform : null;
   const result = classifyPrompt(prompt, root, hostId);
   if (!result) {
-    return EXIT_ALLOW6;
+    return EXIT_ALLOW3;
   }
   process.stdout.write(
     `${JSON.stringify({
@@ -4513,7 +4659,7 @@ function main8() {
     })}
 `
   );
-  return EXIT_WARN3;
+  return EXIT_WARN2;
 }
 function _isCliEntry8() {
   if (true) {
@@ -4527,8 +4673,8 @@ function _isCliEntry8() {
     return true;
   }
   try {
-    const here = fs9.realpathSync(fileURLToPath8(import.meta.url));
-    const argv = fs9.realpathSync(path9.resolve(process.argv[1]));
+    const here = fs10.realpathSync(fileURLToPath8(import.meta.url));
+    const argv = fs10.realpathSync(path9.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -4925,13 +5071,13 @@ function measureDelivered(projectRulesDir, globalRulesDir) {
   return {
     project: {
       dir: projectRulesDir,
-      present: fs10.existsSync(projectRulesDir),
+      present: fs11.existsSync(projectRulesDir),
       files: p.files,
       tokens: _tokens(p.chars)
     },
     global: {
       dir: globalRulesDir,
-      present: fs10.existsSync(globalRulesDir),
+      present: fs11.existsSync(globalRulesDir),
       files: g.files,
       tokens: _tokens(g.chars)
     },
@@ -4942,10 +5088,10 @@ function storeKey(store) {
   return createHash3("sha256").update(path10.resolve(store)).digest("hex").slice(0, 12);
 }
 function scanStore(store, limit) {
-  const files = fs10.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, m: fs10.statSync(path10.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.f);
+  const files = fs11.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ f, m: fs11.statSync(path10.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.f);
   const per_session = [];
   for (const f of files) {
-    const lines = fs10.readFileSync(path10.join(store, f), "utf8").split("\n");
+    const lines = fs11.readFileSync(path10.join(store, f), "utf8").split("\n");
     const r = scanSession(f.replace(/\.jsonl$/, "").slice(0, 8), lines);
     if (r.assistant_turns > 0) {
       per_session.push(r);
@@ -5006,8 +5152,8 @@ function scanStore(store, limit) {
   };
 }
 function recordRate(file, scanned_at, rate) {
-  fs10.mkdirSync(path10.dirname(file), { recursive: true });
-  fs10.appendFileSync(file, `${JSON.stringify({ measured_at: scanned_at, ...rate })}
+  fs11.mkdirSync(path10.dirname(file), { recursive: true });
+  fs11.appendFileSync(file, `${JSON.stringify({ measured_at: scanned_at, ...rate })}
 `, "utf8");
 }
 function render(report) {
@@ -5138,14 +5284,14 @@ function main9(argv) {
     return 2;
   }
   const resolved = store ?? defaultStore(process.cwd());
-  if (!fs10.existsSync(resolved)) {
+  if (!fs11.existsSync(resolved)) {
     process.stderr.write(`conformance:behavior: no transcript store at ${resolved}
 `);
     return 1;
   }
   const report = scanStore(resolved, Number.isFinite(limit) && limit > 0 ? limit : 30);
   if (out) {
-    fs10.writeFileSync(out, `${JSON.stringify(report, null, 2)}
+    fs11.writeFileSync(out, `${JSON.stringify(report, null, 2)}
 `, "utf8");
   }
   if (record) {
@@ -5153,7 +5299,7 @@ function main9(argv) {
   }
   if (why !== null) {
     const id = why;
-    fs10.writeSync(
+    fs11.writeSync(
       1,
       json ? `${JSON.stringify(
         {
@@ -5173,7 +5319,7 @@ function main9(argv) {
     );
     return 0;
   }
-  fs10.writeSync(1, json ? `${JSON.stringify(report, null, 2)}
+  fs11.writeSync(1, json ? `${JSON.stringify(report, null, 2)}
 ` : `${render(report)}
 `);
   return 0;
@@ -5190,8 +5336,8 @@ function _isCliEntry9() {
     return true;
   }
   try {
-    const here = fs10.realpathSync(fileURLToPath9(import.meta.url));
-    const argv = fs10.realpathSync(path10.resolve(process.argv[1]));
+    const here = fs11.realpathSync(fileURLToPath9(import.meta.url));
+    const argv = fs11.realpathSync(path10.resolve(process.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -5202,7 +5348,7 @@ if (_isCliEntry9()) {
 }
 
 // src/scripts/report_carrier_divergence.ts
-import * as fs11 from "node:fs";
+import * as fs12 from "node:fs";
 import * as os3 from "node:os";
 import * as path11 from "node:path";
 import process2 from "node:process";
@@ -5214,7 +5360,7 @@ var PROJECTION_SOURCE = path11.join("dist", "agent-src", "rules");
 var GLOBAL_RULES = path11.join(".claude", "rules");
 function _listRules(dir) {
   try {
-    return fs11.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
+    return fs12.readdirSync(dir).filter((f) => f.endsWith(".md")).sort();
   } catch {
     return [];
   }
@@ -5222,7 +5368,7 @@ function _listRules(dir) {
 function _ruleType(file) {
   let text;
   try {
-    text = fs11.readFileSync(file, "utf-8");
+    text = fs12.readFileSync(file, "utf-8");
   } catch {
     return "";
   }
@@ -5233,8 +5379,8 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
   const out = {
     projectDir,
     globalDir,
-    globalPresent: fs11.existsSync(globalDir),
-    projectPresent: fs11.existsSync(projectDir),
+    globalPresent: fs12.existsSync(globalDir),
+    projectPresent: fs12.existsSync(projectDir),
     shared: 0,
     identical: [],
     provenanceOnly: [],
@@ -5267,8 +5413,8 @@ function compareCarriers(projectDir, globalDir, sourceDir) {
     let projectCopy;
     let globalCopy;
     try {
-      projectCopy = fs11.readFileSync(path11.join(projectDir, rule));
-      globalCopy = fs11.readFileSync(path11.join(globalDir, rule));
+      projectCopy = fs12.readFileSync(path11.join(projectDir, rule));
+      globalCopy = fs12.readFileSync(path11.join(globalDir, rule));
       verdict = comparePair(projectCopy, globalCopy);
     } catch {
       out.shared -= 1;
@@ -5455,7 +5601,7 @@ function _isCliEntry10() {
   if (process2.argv[1] === void 0) return false;
   if (import.meta.url === pathToFileURL10(path11.resolve(process2.argv[1])).href) return true;
   try {
-    return fs11.realpathSync(_HERE2) === fs11.realpathSync(path11.resolve(process2.argv[1]));
+    return fs12.realpathSync(_HERE2) === fs12.realpathSync(path11.resolve(process2.argv[1]));
   } catch {
     return false;
   }
@@ -5465,7 +5611,7 @@ if (_isCliEntry10()) {
 }
 
 // src/scripts/report_skill_activation.ts
-import * as fs12 from "node:fs";
+import * as fs13 from "node:fs";
 import * as os4 from "node:os";
 import * as path12 from "node:path";
 import { fileURLToPath as fileURLToPath11, pathToFileURL as pathToFileURL11 } from "node:url";
@@ -5481,25 +5627,25 @@ function censusSkills(root) {
     withTriggerCorpus: [],
     withDeterministicObligation: []
   };
-  if (!fs12.existsSync(root)) {
+  if (!fs13.existsSync(root)) {
     return out;
   }
-  for (const entry of fs12.readdirSync(root, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+  for (const entry of fs13.readdirSync(root, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
     if (!entry.isDirectory()) {
       continue;
     }
     const file = path12.join(root, entry.name, "SKILL.md");
-    if (!fs12.existsSync(file)) {
+    if (!fs13.existsSync(file)) {
       continue;
     }
     out.total += 1;
-    const text = fs12.readFileSync(file, "utf8");
+    const text = fs13.readFileSync(file, "utf8");
     const fmEnd = text.startsWith("---") ? text.indexOf("\n---", 3) : -1;
     const fm = fmEnd === -1 ? "" : text.slice(0, fmEnd);
     if (TRIGGER_KEYS.some((k) => new RegExp(`^${k}`, "m").test(fm))) {
       out.withTriggerKey.push(entry.name);
     }
-    if (fs12.existsSync(path12.join(root, entry.name, "evals", "triggers.json"))) {
+    if (fs13.existsSync(path12.join(root, entry.name, "evals", "triggers.json"))) {
       out.withTriggerCorpus.push(entry.name);
     }
     const body = fmEnd === -1 ? text : text.slice(fmEnd + 4);
@@ -5514,13 +5660,13 @@ function defaultStore2(cwd) {
 }
 function measureUsage(store, limit) {
   const rep = { store, sessions: 0, assistantTurns: 0, invocations: 0, bySkill: {} };
-  if (!fs12.existsSync(store)) {
+  if (!fs13.existsSync(store)) {
     return rep;
   }
-  const files = fs12.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => path12.join(store, f)).sort((a, b) => fs12.statSync(b).mtimeMs - fs12.statSync(a).mtimeMs).slice(0, limit);
+  const files = fs13.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => path12.join(store, f)).sort((a, b) => fs13.statSync(b).mtimeMs - fs13.statSync(a).mtimeMs).slice(0, limit);
   rep.sessions = files.length;
   for (const file of files) {
-    for (const line of fs12.readFileSync(file, "utf8").split("\n")) {
+    for (const line of fs13.readFileSync(file, "utf8").split("\n")) {
       if (!line.trim()) {
         continue;
       }
@@ -5598,10 +5744,10 @@ function buildRecord(census, usage, today) {
 }
 function readRecord(repoRoot) {
   const file = path12.join(repoRoot, RECORD_PATH);
-  if (!fs12.existsSync(file)) {
+  if (!fs13.existsSync(file)) {
     return null;
   }
-  return JSON.parse(fs12.readFileSync(file, "utf8"));
+  return JSON.parse(fs13.readFileSync(file, "utf8"));
 }
 function render3(census, usage, published = null) {
   const lines = [];
@@ -5762,8 +5908,8 @@ function main11(argv) {
   }
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const file = path12.join(root, RECORD_PATH);
-  fs12.mkdirSync(path12.dirname(file), { recursive: true });
-  fs12.writeFileSync(file, `${JSON.stringify(buildRecord(census, usage, today), null, 2)}
+  fs13.mkdirSync(path12.dirname(file), { recursive: true });
+  fs13.writeFileSync(file, `${JSON.stringify(buildRecord(census, usage, today), null, 2)}
 `);
   process.stdout.write(`
 wrote ${RECORD_PATH} (measured ${today})
@@ -5775,7 +5921,7 @@ if (process.argv[1] !== void 0 && import.meta.url === pathToFileURL11(path12.res
 }
 
 // src/scripts/report_skill_obligation_violations.ts
-import * as fs13 from "node:fs";
+import * as fs14 from "node:fs";
 import * as os5 from "node:os";
 import * as path13 from "node:path";
 import process3 from "node:process";
@@ -5833,7 +5979,7 @@ function extractObligations(repoRoot) {
   for (const skill of census.withDeterministicObligation) {
     let text;
     try {
-      text = fs13.readFileSync(path13.join(skillsRoot, skill, "SKILL.md"), "utf-8");
+      text = fs14.readFileSync(path13.join(skillsRoot, skill, "SKILL.md"), "utf-8");
     } catch {
       continue;
     }
@@ -5962,13 +6108,13 @@ function scanStore2(repoRoot, store, limit) {
   };
   let files;
   try {
-    files = fs13.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ p: path13.join(store, f), m: fs13.statSync(path13.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.p);
+    files = fs14.readdirSync(store).filter((f) => f.endsWith(".jsonl")).map((f) => ({ p: path13.join(store, f), m: fs14.statSync(path13.join(store, f)).mtimeMs })).sort((a, b) => b.m - a.m).slice(0, limit).map((x) => x.p);
   } catch {
     return report;
   }
   report.sessions = files.length;
   for (const file of files) {
-    const lines = fs13.readFileSync(file, "utf-8").split("\n");
+    const lines = fs14.readFileSync(file, "utf-8").split("\n");
     const id = path13.basename(file).replace(/\.jsonl$/, "").slice(0, 8);
     const entries = _parseSession(lines);
     if (loadedSkillsFrom(entries).size > 0) report.sessionsWithASkill += 1;
@@ -6096,7 +6242,7 @@ function _isCliEntry11() {
   if (process3.argv[1] === void 0) return false;
   if (import.meta.url === pathToFileURL12(path13.resolve(process3.argv[1])).href) return true;
   try {
-    return fs13.realpathSync(_HERE4) === fs13.realpathSync(path13.resolve(process3.argv[1]));
+    return fs14.realpathSync(_HERE4) === fs14.realpathSync(path13.resolve(process3.argv[1]));
   } catch {
     return false;
   }
@@ -6120,7 +6266,7 @@ function buildFunnel(opts = {}) {
     divergence: compareCarriers(projectRulesDir, globalRulesDir, sourceDir),
     skills: censusSkills(path14.join(repoRoot, SKILLS_ROOT)),
     usage: measureUsage(store, limit),
-    storePresent: fs14.existsSync(store),
+    storePresent: fs15.existsSync(store),
     sk2: scanStore2(repoRoot, store, limit)
   };
 }
@@ -6295,7 +6441,7 @@ function _isCliEntry12() {
   if (process4.argv[1] === void 0) return false;
   if (import.meta.url === pathToFileURL13(path14.resolve(process4.argv[1])).href) return true;
   try {
-    return fs14.realpathSync(_HERE5) === fs14.realpathSync(path14.resolve(process4.argv[1]));
+    return fs15.realpathSync(_HERE5) === fs15.realpathSync(path14.resolve(process4.argv[1]));
   } catch {
     return false;
   }
@@ -6315,6 +6461,10 @@ var CONFORMANCE_CHECK_IDS = [
   "host-manifest"
 ];
 var THIN_STUB_MARKER = "Routed rule \u2014 load the body on trigger-match";
+var CONFORMANCE_STATUS_SYMBOLS = {
+  ...STATUS_SYMBOLS,
+  unknown: "\u2754"
+};
 function print(s = "") {
   process5.stdout.write(`${s}
 `);
@@ -6337,21 +6487,24 @@ function installLogPath() {
   }
   return path15.join(os7.homedir(), ".event4u", "agent-config", "install-log.jsonl");
 }
-function _check_txlog_clean(logPath = installLogPath()) {
-  if (!fs15.existsSync(logPath)) {
-    return {
-      id: "txlog-clean",
-      status: "ok",
-      message: "no install transaction log \u2014 nothing to recover",
-      remedy: ""
-    };
-  }
-  const entries = readRecentEntries(logPath);
+function _installLogExpected(projectRoot) {
+  return fs16.existsSync(manifest_path(projectRoot));
+}
+function _check_txlog_clean(logPath = installLogPath(), projectRoot = null) {
+  const entries = fs16.existsSync(logPath) ? readRecentEntries(logPath) : [];
   if (entries.length === 0) {
+    if (projectRoot !== null && _installLogExpected(projectRoot)) {
+      return {
+        id: "txlog-clean",
+        status: "unknown",
+        message: "install manifest present, no usable install transaction log \u2014 nothing recorded this install, so the last run cannot be confirmed complete",
+        remedy: "no install path writes this log today; run `agent-config doctor` for the drift answer this check cannot give"
+      };
+    }
     return {
       id: "txlog-clean",
       status: "ok",
-      message: "install transaction log is empty",
+      message: "no usable install transaction log and no install manifest \u2014 nothing was installed here",
       remedy: ""
     };
   }
@@ -6361,7 +6514,7 @@ function _check_txlog_clean(logPath = installLogPath()) {
       id: "txlog-clean",
       status: "fail",
       message: `install log tail is an abandoned run (abort at ${last.ts}${last.note ? `: ${last.note}` : ""})`,
-      remedy: "re-run `agent-config init` (recovery reverse-applies the aborted tail)"
+      remedy: "re-run `agent-config init` \u2014 it re-applies the plan over the partial tail; the aborted run's writes stay on disk and are replaced only where the plan covers them"
     };
   }
   return {
@@ -6376,7 +6529,7 @@ function routeTargetPaths(target) {
 }
 function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
   const routerPath = path15.join(packageRoot, "dist", "router.json");
-  if (!fs15.existsSync(routerPath)) {
+  if (!fs16.existsSync(routerPath)) {
     return {
       id: "router-pointers",
       status: "fail",
@@ -6386,7 +6539,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
   }
   let router;
   try {
-    router = JSON.parse(fs15.readFileSync(routerPath, "utf8"));
+    router = JSON.parse(fs16.readFileSync(routerPath, "utf8"));
   } catch (exc) {
     return {
       id: "router-pointers",
@@ -6401,7 +6554,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
   let targets = 0;
   for (const kernelId of router["kernel"] ?? []) {
     ids += 1;
-    if (!fs15.existsSync(path15.join(rulesDir, `${kernelId}.md`))) {
+    if (!fs16.existsSync(path15.join(rulesDir, `${kernelId}.md`))) {
       broken.push(`kernel:${kernelId} \u2192 rules/${kernelId}.md missing`);
     }
   }
@@ -6409,7 +6562,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
     for (const entry of router[tier] ?? []) {
       const ruleId = String(entry["id"] ?? "");
       ids += 1;
-      if (!fs15.existsSync(path15.join(rulesDir, `${ruleId}.md`))) {
+      if (!fs16.existsSync(path15.join(rulesDir, `${ruleId}.md`))) {
         broken.push(`${tier}:${ruleId} \u2192 rules/${ruleId}.md missing`);
       }
       for (const target of entry["routes_to"] ?? []) {
@@ -6419,7 +6572,7 @@ function _check_router_pointers(packageRoot = PACKAGE_ROOT) {
           broken.push(`${ruleId} \u2192 unparseable routes_to ${JSON.stringify(target)}`);
           continue;
         }
-        if (!candidates.some((rel) => fs15.existsSync(path15.join(packageRoot, rel)))) {
+        if (!candidates.some((rel) => fs16.existsSync(path15.join(packageRoot, rel)))) {
           broken.push(`${ruleId} \u2192 ${target} (${candidates[0]} missing)`);
         }
       }
@@ -6453,7 +6606,7 @@ function detectSmokePlatform(projectRoot) {
 function dispatcherRunner(packageRoot) {
   const localTsx = path15.join(packageRoot, "node_modules", ".bin", "tsx");
   const script = path15.join(packageRoot, "src", "scripts", "hooks", "dispatch_hook.ts");
-  if (fs15.existsSync(localTsx)) {
+  if (fs16.existsSync(localTsx)) {
     return [localTsx, script];
   }
   return ["npx", "tsx", script];
@@ -6470,7 +6623,7 @@ function _check_hook_dispatcher(projectRoot, packageRoot = PACKAGE_ROOT, opts =
       ...event === "stop" ? { stop_reason: "conformance-smoke" } : { source: "startup" }
     });
     const argv = [...runner, "--platform", platform, "--event", event];
-    const proc = spawnSync3(argv[0], argv.slice(1), {
+    const proc = spawnSync4(argv[0], argv.slice(1), {
       input: payload,
       cwd: projectRoot,
       encoding: "utf8",
@@ -6504,11 +6657,11 @@ function _check_hook_dispatcher(projectRoot, packageRoot = PACKAGE_ROOT, opts =
 }
 function readSettingsMode(projectRoot) {
   const settingsPath = path15.join(projectRoot, ".agent-settings.yml");
-  if (!fs15.existsSync(settingsPath)) {
+  if (!fs16.existsSync(settingsPath)) {
     return "eager-all";
   }
   try {
-    const parsed = YAML.parse(fs15.readFileSync(settingsPath, "utf8"));
+    const parsed = YAML.parse(fs16.readFileSync(settingsPath, "utf8"));
     const lean = parsed?.["lean_projection"] ?? null;
     const mode = lean?.["mode"];
     return typeof mode === "string" && mode.length > 0 ? mode : "eager-all";
@@ -6519,7 +6672,7 @@ function readSettingsMode(projectRoot) {
 function kernelIdsFromRouter(packageRoot) {
   try {
     const router = JSON.parse(
-      fs15.readFileSync(path15.join(packageRoot, "dist", "router.json"), "utf8")
+      fs16.readFileSync(path15.join(packageRoot, "dist", "router.json"), "utf8")
     );
     return new Set((router["kernel"] ?? []).map(String));
   } catch {
@@ -6537,7 +6690,7 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
     };
   }
   const rulesDir = projectedRulesDir ?? path15.join(projectRoot, ".augment", "rules");
-  if (!fs15.existsSync(rulesDir)) {
+  if (!fs16.existsSync(rulesDir)) {
     return {
       id: "lean-projection",
       status: "skipped",
@@ -6546,7 +6699,7 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
     };
   }
   const kernel = kernelIdsFromRouter(packageRoot);
-  const files = fs15.readdirSync(rulesDir).filter((f) => f.endsWith(".md") && f !== "INDEX.md").sort();
+  const files = fs16.readdirSync(rulesDir).filter((f) => f.endsWith(".md") && f !== "INDEX.md").sort();
   const nonKernel = files.filter((f) => !kernel.has(f.replace(/\.md$/, "")));
   if (nonKernel.length === 0) {
     return {
@@ -6560,7 +6713,7 @@ function _check_lean_projection(projectRoot, packageRoot = PACKAGE_ROOT, project
   for (const f of nonKernel) {
     let text = "";
     try {
-      text = fs15.readFileSync(path15.join(rulesDir, f), "utf8");
+      text = fs16.readFileSync(path15.join(rulesDir, f), "utf8");
     } catch {
       continue;
     }
@@ -6592,7 +6745,7 @@ function _check_host_manifest(projectRoot) {
   const detected = Object.entries(detectToolPresence(projectRoot)).filter(([, v]) => v === true).map(([k]) => k);
   const detectedNote = detected.length > 0 ? `detected surfaces: ${detected.join(", ")}` : "no surfaces detected";
   const settingsPath = path15.join(projectRoot, ".agent-settings.yml");
-  if (!fs15.existsSync(settingsPath)) {
+  if (!fs16.existsSync(settingsPath)) {
     return {
       id: "host-manifest",
       status: "ok",
@@ -6602,7 +6755,7 @@ function _check_host_manifest(projectRoot) {
   }
   let parsed = null;
   try {
-    parsed = YAML.parse(fs15.readFileSync(settingsPath, "utf8"));
+    parsed = YAML.parse(fs16.readFileSync(settingsPath, "utf8"));
   } catch (exc) {
     return {
       id: "host-manifest",
@@ -6632,7 +6785,7 @@ function runConformanceChecks(opts = {}) {
   const projectRoot = opts.projectRoot ?? process5.cwd();
   const packageRoot = opts.packageRoot ?? PACKAGE_ROOT;
   const checks = [];
-  checks.push(_check_txlog_clean());
+  checks.push(_check_txlog_clean(installLogPath(), projectRoot));
   checks.push(_check_router_pointers(packageRoot));
   if (opts.skipDispatcher === true) {
     checks.push({
@@ -6756,7 +6909,7 @@ function main14(argv = null) {
     print(`  \u{1F4CD}  project_root: ${project_root}`);
     print("conformance:");
     for (const c of allChecks) {
-      const sym = STATUS_SYMBOLS[c["status"]] ?? "?";
+      const sym = CONFORMANCE_STATUS_SYMBOLS[c["status"]] ?? "?";
       print(`  ${sym} ${c["id"]}: ${c["message"]}`);
       if (c["status"] !== "ok" && c["remedy"]) {
         print(`      fix: ${c["remedy"]}`);
@@ -6781,8 +6934,8 @@ function _isCliEntry13() {
     return true;
   }
   try {
-    const here = fs15.realpathSync(fileURLToPath14(import.meta.url));
-    const argv = fs15.realpathSync(path15.resolve(process5.argv[1]));
+    const here = fs16.realpathSync(fileURLToPath14(import.meta.url));
+    const argv = fs16.realpathSync(path15.resolve(process5.argv[1]));
     return here === argv;
   } catch {
     return false;
@@ -6808,6 +6961,7 @@ export {
   _check_lean_projection,
   _check_router_pointers,
   _check_txlog_clean,
+  _installLogExpected,
   _parse,
   appendConformanceReport,
   conformanceLogPath,