@iamu-dev/iamu 0.8.0-beta.5 → 0.8.0-beta.7

package/dist/index.js

@@ -6684,10 +6684,13 @@ var init_wire_compat = __esm({
 });
 
 // ../../packages/local-store/dist/sync/server-meta.js
+function cloudDistinguishesHumanEdits(capabilities) {
+  return Boolean(capabilities?.includes(SYNC_TOKEN_CAPABILITY));
+}
 function cloudSupportsGuidance(capabilities) {
   return Boolean(capabilities?.includes(GUIDANCE_CAPABILITY) || capabilities?.includes(DESIGNER_FINDINGS_CAPABILITY));
 }
-async function fetchServerCapabilities(apiUrl, apiKey, fetchFn, timeoutMs, onFailure) {
+async function fetchServerCapabilities(apiUrl, apiKey, fetchFn, timeoutMs, onFailure, onServerClock) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
@@ -6697,6 +6700,9 @@ async function fetchServerCapabilities(apiUrl, apiKey, fetchFn, timeoutMs, onFai
       signal: controller.signal
     };
     const res = await fetchFn(`${apiUrl.replace(/\/+$/, "")}/api/meta`, init2);
+    const offset = serverClockOffset(res);
+    if (offset !== null)
+      onServerClock?.(offset);
     if (res.status === 404)
       return [];
     if (!res.ok) {
@@ -6718,6 +6724,16 @@ async function fetchServerCapabilities(apiUrl, apiKey, fetchFn, timeoutMs, onFai
     clearTimeout(timer);
   }
 }
+function serverClockOffset(res) {
+  const headers = res?.headers;
+  if (!headers || typeof headers.get !== "function")
+    return null;
+  const raw = headers.get.call(headers, "date");
+  if (typeof raw !== "string")
+    return null;
+  const at = Date.parse(raw);
+  return Number.isNaN(at) ? null : at - Date.now();
+}
 function shapeForServer(pending, capabilities) {
   const knows = capabilities.includes(DESIGNER_FINDINGS_CAPABILITY);
   const knowsProvenance = capabilities.includes(FINDING_PROVENANCE_CAPABILITY);
@@ -6739,7 +6755,7 @@ function shapeForServer(pending, capabilities) {
   }
   return { pending: out2, heldDesigner };
 }
-var DESIGNER_FINDINGS_CAPABILITY, GUIDANCE_CAPABILITY, WALKTHROUGH_DELETE_CAPABILITY, FINDING_PROVENANCE_CAPABILITY, BUNDLE_FINDING_HASH_CAPABILITY, RUN_BLOCKED_CAPABILITY;
+var DESIGNER_FINDINGS_CAPABILITY, GUIDANCE_CAPABILITY, WALKTHROUGH_DELETE_CAPABILITY, FINDING_PROVENANCE_CAPABILITY, BUNDLE_FINDING_HASH_CAPABILITY, RUN_BLOCKED_CAPABILITY, SYNC_TOKEN_CAPABILITY;
 var init_server_meta = __esm({
   "../../packages/local-store/dist/sync/server-meta.js"() {
     "use strict";
@@ -6751,6 +6767,7 @@ var init_server_meta = __esm({
     FINDING_PROVENANCE_CAPABILITY = "finding-provenance";
     BUNDLE_FINDING_HASH_CAPABILITY = "bundle-finding-hash";
     RUN_BLOCKED_CAPABILITY = "run-blocked";
+    SYNC_TOKEN_CAPABILITY = "sync-token";
   }
 });
 
@@ -10687,7 +10704,7 @@ function compareIso(a, b) {
     return ta - tb;
   return String(a ?? "").localeCompare(String(b ?? ""));
 }
-async function designerFindingsOn(projectRoot, screens, before, targetUrl = null) {
+async function designerFindingsOn(projectRoot, screens, before, targetUrl = null, settled = /* @__PURE__ */ new Set()) {
   const latest = /* @__PURE__ */ new Map();
   const cache = /* @__PURE__ */ new Map();
   const wanted = new Set([...screens].map((k) => normalizeScreenKey(k, targetUrl)));
@@ -10711,7 +10728,7 @@ async function designerFindingsOn(projectRoot, screens, before, targetUrl = null
   }
   const all = [...latest.values()].sort((a, b) => compareIso(a.created_at, b.created_at));
   return {
-    open: all.filter(unsettled).map((fm, n) => ({
+    open: all.filter((fm) => unsettled(fm) && !settled.has(fm.id)).map((fm, n) => ({
       ref: `P${n + 1}`,
       id: fm.id,
       title: fm.title ?? fm.slug,
@@ -11204,6 +11221,26 @@ async function readReviewEvidence(projectRoot) {
   }
   return out2;
 }
+async function verifiedDesignerFixes(projectRoot, before) {
+  const addressed = (await listDesignerFindings(projectRoot)).map((f) => f.frontmatter).filter((fm) => fm.triage_status === "addressed" && !fm.design_cause_of);
+  const out2 = /* @__PURE__ */ new Set();
+  if (addressed.length === 0)
+    return out2;
+  const cutoff = toMillis(before);
+  const runs = (await readRunEvidence(projectRoot)).filter((r) => {
+    if (cutoff === null)
+      return true;
+    const start2 = toMillis(r.started_at);
+    return start2 !== null && start2 < cutoff;
+  });
+  const states = deriveFixStates(addressed, runs);
+  for (const fm of addressed) {
+    if (fm.fix_status === "verified_resolved" || states.get(fm.slug)?.fix_state === "verified") {
+      out2.add(fm.id);
+    }
+  }
+  return out2;
+}
 async function computeFixStates(projectRoot) {
   const { entities } = await listEntities(projectRoot, "finding");
   const findings2 = entities.map((e) => e.frontmatter);
@@ -12265,6 +12302,7 @@ async function canonicalFindingFiles(projectRoot, scenarioSlug, canonicalId) {
   return out2;
 }
 async function markAddressedResolved(files, note) {
+  const failed = [];
   const trimmedNote = note?.trim();
   for (const f of files) {
     if (f.triage_status !== "addressed")
@@ -12280,9 +12318,14 @@ async function markAddressedResolved(files, note) {
         if (updated !== raw)
           await atomicWriteFile(f.file, updated);
       });
-    } catch {
+    } catch (err) {
+      failed.push({
+        file: f.file,
+        error: err instanceof Error ? err.message : String(err)
+      });
     }
   }
+  return failed;
 }
 function originOf(url) {
   if (!url)
@@ -12465,7 +12508,9 @@ async function updateFixStatus(projectRoot, slug, status2) {
         await atomicWriteFile(filePath, updated);
       }
     });
-  } catch {
+    return null;
+  } catch (err) {
+    return err instanceof Error ? err.message : String(err);
   }
 }
 async function listRunsInternal(projectRoot) {
@@ -12915,6 +12960,7 @@ async function mirrorLocalWalkthrough(projectRoot, runId, deps) {
       body: form,
       signal: controller.signal
     });
+    const clockOffset = serverClockOffset(response);
     if (response.ok) {
       let body = null;
       try {
@@ -12960,7 +13006,8 @@ async function mirrorLocalWalkthrough(projectRoot, runId, deps) {
         runCloudId: parsed.data.cloud_walkthrough_id,
         contentHash,
         cloudOutcome: parsed.data.status,
-        ...recordedFindings.length > 0 ? { recordedFindings } : {}
+        ...recordedFindings.length > 0 ? { recordedFindings } : {},
+        ...clockOffset !== null ? { serverClockOffsetMs: clockOffset } : {}
       };
     }
     if (response.status === 409) {
@@ -13607,6 +13654,7 @@ async function drainRetryQueue(projectRoot, deps) {
   const deleteUrl = projectEndpoint(config.cloud_api_url, config.cloud_project_id, "delete");
   const remaining = [];
   const failures = [];
+  const pushedRuns = [];
   let drained = 0;
   let dropped = 0;
   let notAttempted = 0;
@@ -13718,6 +13766,8 @@ async function drainRetryQueue(projectRoot, deps) {
       });
       if (result.mirrored || result.skippedReason === "bundle_too_large") {
         drained++;
+        if (result.status === "pushed")
+          pushedRuns.push(entry.entity_id);
       } else if (result.skippedReason === "missing_run" || result.skippedReason === "unsupported") {
         drained++;
       } else if (result.skippedReason === "cloud_conflict") {
@@ -13809,7 +13859,8 @@ async function drainRetryQueue(projectRoot, deps) {
     dropped,
     remaining: after.length,
     failures,
-    warnings
+    warnings,
+    ...pushedRuns.length > 0 ? { pushedRuns } : {}
   };
 }
 function unreadableBody(text, isDelete) {
@@ -14233,6 +14284,18 @@ async function pushOneBatch(target, batch, byType, label, opts = {}) {
   out2.errors.push(failure.message);
   return out2;
 }
+function cloudTokenOrigin(hash, humanTokens) {
+  if (hash.startsWith("cloud-sync-"))
+    return "projection";
+  if (hash.startsWith("cloud-"))
+    return humanTokens ? "person" : "unknown";
+  if (hash.startsWith("cloud:"))
+    return "unknown";
+  return null;
+}
+function isCloudToken(hash) {
+  return cloudTokenOrigin(hash, false) !== null;
+}
 async function ownEarlierWrites(projectRoot, batch, conflicts) {
   if (conflicts.length === 0)
     return [];
@@ -14246,7 +14309,7 @@ async function ownEarlierWrites(projectRoot, batch, conflicts) {
     const entity = byId.get(c.entity_id);
     if (!entity || c.base_hash || bases[c.entity_id])
       continue;
-    if (!c.cloud_hash || c.cloud_hash.startsWith("cloud:"))
+    if (!c.cloud_hash || isCloudToken(c.cloud_hash))
       continue;
     if (!sent[c.entity_id]?.includes(c.cloud_hash))
       continue;
@@ -14255,10 +14318,59 @@ async function ownEarlierWrites(projectRoot, batch, conflicts) {
   }
   return out2;
 }
+function findingRuns(frontmatter) {
+  const out2 = /* @__PURE__ */ new Set();
+  if (typeof frontmatter.run === "string" && frontmatter.run) {
+    out2.add(frontmatter.run);
+  }
+  const seen = frontmatter.seen_in;
+  if (typeof seen === "string") {
+    const m = /^(?:ux|designer):(.+)$/.exec(seen);
+    if (m?.[1])
+      out2.add(m[1]);
+  }
+  return out2;
+}
+async function rowsToAdopt(projectRoot, batch, conflicts, adopt) {
+  if (!adopt || conflicts.length === 0)
+    return [];
+  const bases = await readBaseHashes(projectRoot);
+  const byId = new Map(batch.map((e) => [e.id, e]));
+  const out2 = [];
+  for (const c of conflicts) {
+    const entity = byId.get(c.entity_id);
+    if (!entity || entity.type !== "finding" || !c.cloud_hash)
+      continue;
+    const origin = cloudTokenOrigin(c.cloud_hash, adopt.humanTokens);
+    if (origin === null || origin === "person")
+      continue;
+    if (origin === "unknown" && !stampedByThisPass(c, entity, adopt)) {
+      continue;
+    }
+    await recordCloudBase(projectRoot, c.entity_id, c.cloud_hash);
+    out2.push(origin === "projection" ? { entity, restamped: false, kind: "projection" } : {
+      entity,
+      restamped: Boolean(c.base_hash || bases[c.entity_id]),
+      kind: "bundle"
+    });
+  }
+  return out2;
+}
+function stampedByThisPass(c, entity, adopt) {
+  const runs = findingRuns(entity.frontmatter);
+  if (![...runs].some((r) => adopt.runs.has(r)))
+    return false;
+  const at = c.cloud_updated_at ? Date.parse(c.cloud_updated_at) : Number.NaN;
+  const slack = adopt.serverClock ? ADOPT_CLOCK_SLACK_MS : 0;
+  if (Number.isNaN(at) || at < adopt.since - slack)
+    return false;
+  return !adopt.identity || c.cloud_changed_by === adopt.identity;
+}
 async function pushBatches(target, batches, byType, opts = {}) {
   let pushed = 0;
   let enqueued = 0;
   const selfResolved = [];
+  const adopted = [];
   const conflicts = [];
   const overwritten = [];
   const errors = [];
@@ -14280,19 +14392,42 @@ async function pushBatches(target, batches, byType, opts = {}) {
         conflicts,
         overwritten,
         errors,
-        selfResolved
+        selfResolved,
+        adopted
       };
     }
     absorb(first);
     let unresolved = first.conflicts;
     const own = await ownEarlierWrites(target.projectRoot, batch, unresolved);
-    if (own.length > 0) {
-      const ownIds = new Set(own.map((e) => e.id));
-      unresolved = unresolved.filter((c) => !ownIds.has(c.entity_id));
-      const again = await pushOneBatch(target, own, byType, `batch ${i} own-version retry`);
+    const ownIds = new Set(own.map((e) => e.id));
+    const basesBefore = opts.adopt ? await readCloudBase(target.projectRoot) : {};
+    const fromBundles = await rowsToAdopt(target.projectRoot, batch, unresolved.filter((c) => !ownIds.has(c.entity_id)), opts.adopt);
+    const resend = [...own, ...fromBundles.map((a) => a.entity)];
+    if (resend.length > 0) {
+      const resendIds = new Set(resend.map((e) => e.id));
+      unresolved = unresolved.filter((c) => !resendIds.has(c.entity_id));
+      const again = await pushOneBatch(target, resend, byType, `batch ${i} own-version retry`);
       absorb(again);
       conflicts.push(...again.conflicts);
-      selfResolved.push(...again.landed);
+      const landed2 = new Set(again.landed);
+      selfResolved.push(...own.filter((e) => landed2.has(e.id)).map((e) => e.id));
+      for (const a of fromBundles) {
+        if (landed2.has(a.entity.id)) {
+          adopted.push({
+            slug: a.entity.slug,
+            kind: a.kind,
+            restamped: a.restamped,
+            serverClock: opts.adopt?.serverClock ?? false
+          });
+          continue;
+        }
+        const prior = basesBefore[a.entity.id];
+        if (prior === void 0) {
+          await forgetCloudBase(target.projectRoot, a.entity.id);
+        } else {
+          await recordCloudBase(target.projectRoot, a.entity.id, prior);
+        }
+      }
     }
     if (!opts.keepMine || unresolved.length === 0) {
       conflicts.push(...unresolved);
@@ -14345,8 +14480,17 @@ async function pushBatches(target, batches, byType, opts = {}) {
     }
     await forgetQueuedUpserts(target.projectRoot, revoked);
   }
-  return { pushed, enqueued, conflicts, overwritten, errors, selfResolved };
+  return {
+    pushed,
+    enqueued,
+    conflicts,
+    overwritten,
+    errors,
+    selfResolved,
+    adopted
+  };
 }
+var ADOPT_CLOCK_SLACK_MS;
 var init_push = __esm({
   "../../packages/local-store/dist/sync/push.js"() {
     "use strict";
@@ -14354,6 +14498,7 @@ var init_push = __esm({
     init_server_reason();
     init_sync_tracking();
     init_types();
+    ADOPT_CLOCK_SLACK_MS = 5e3;
   }
 });
 
@@ -14748,15 +14893,33 @@ async function syncWalkthroughs(projectRoot, deps, unpushableScenarios = /* @__P
   const hold = deps.capabilities === null;
   let held = 0;
   const recordedFindings = /* @__PURE__ */ new Set();
+  const pushedRuns = /* @__PURE__ */ new Set();
+  let serverClockOffsetMs = null;
   let runIds;
   try {
     runIds = await listRuns(projectRoot);
   } catch (err) {
     errors.push(`walkthrough scan failed: ${err instanceof Error ? err.message : String(err)} \u2014 check that iamu/.runs/ exists and is readable`);
-    return { summary, errors, withheldRuns, held, recordedFindings };
+    return {
+      summary,
+      errors,
+      withheldRuns,
+      held,
+      recordedFindings,
+      pushedRuns,
+      serverClockOffsetMs
+    };
   }
   if (runIds.length === 0)
-    return { summary, errors, withheldRuns, held, recordedFindings };
+    return {
+      summary,
+      errors,
+      withheldRuns,
+      held,
+      recordedFindings,
+      pushedRuns,
+      serverClockOffsetMs
+    };
   const lastPush = await readLastPush(projectRoot);
   const pendingWalkthroughQueueEntries = /* @__PURE__ */ new Set();
   const retryQueue = await readRetryQueue(projectRoot);
@@ -14823,6 +14986,9 @@ async function syncWalkthroughs(projectRoot, deps, unpushableScenarios = /* @__P
     });
     if (result.status === "pushed" || result.status === "already_pushed") {
       summary.pushed++;
+      if (result.status === "pushed")
+        pushedRuns.add(runId);
+      serverClockOffsetMs ??= result.serverClockOffsetMs ?? null;
       for (const id of result.recordedFindings ?? [])
         recordedFindings.add(id);
     } else if (result.skippedReason === "bundle_too_large" || result.skippedReason === "unsupported" || result.skippedReason === "missing_run" || result.skippedReason === "cloud_conflict") {
@@ -14845,7 +15011,15 @@ async function syncWalkthroughs(projectRoot, deps, unpushableScenarios = /* @__P
       }
     }
   }
-  return { summary, errors, withheldRuns, held, recordedFindings };
+  return {
+    summary,
+    errors,
+    withheldRuns,
+    held,
+    recordedFindings,
+    pushedRuns,
+    serverClockOffsetMs
+  };
 }
 var HOLD_SHAPES, WALKTHROUGH_SKIP_HINTS;
 var init_walkthroughs = __esm({
@@ -14895,6 +15069,7 @@ function mergePushProgress(target, outcome) {
   if (!outcome)
     return;
   target.selfResolved.push(...outcome.selfResolved ?? []);
+  target.adopted.push(...outcome.adopted ?? []);
   target.pushed += outcome.pushed;
   target.enqueued += outcome.enqueued;
   target.conflicts.push(...outcome.conflicts);
@@ -14941,6 +15116,7 @@ async function pushDeferredFindings(projectRoot, capabilities, deferredFindings,
   return pushBatches(target, toBatches(retryFindings, batchSize), byType, pushOpts);
 }
 async function runSync(projectRoot, deps) {
+  const startedAt = Date.now();
   const config = await readConfig(projectRoot);
   if (!config.cloud_linked) {
     return emptySyncResult([
@@ -14955,11 +15131,21 @@ async function runSync(projectRoot, deps) {
   const apiKey = deps.apiKey;
   const fetchFn = deps.fetch ?? globalThis.fetch;
   let capabilitiesFailure = "";
+  let serverClockOffsetMs = null;
   const capabilities = deps.capabilities !== void 0 ? deps.capabilities : await fetchServerCapabilities(config.cloud_api_url, apiKey, fetchFn, deps.timeoutMs ?? DEFAULT_TIMEOUT_MS4, (detail) => {
     capabilitiesFailure = detail;
+  }, (offset) => {
+    serverClockOffsetMs = offset;
   });
   deps = { ...deps, capabilities };
-  const drain = await drainRetryQueue(projectRoot, deps);
+  const { pushedRuns: drainedRuns = [], ...drain } = await drainRetryQueue(projectRoot, deps);
+  const adoptFrom = (runs) => ({
+    runs: /* @__PURE__ */ new Set([...drainedRuns, ...runs]),
+    since: startedAt + (serverClockOffsetMs ?? 0),
+    serverClock: serverClockOffsetMs !== null,
+    humanTokens: cloudDistinguishesHumanEdits(capabilities),
+    identity: deps.identity ?? null
+  });
   const scanned = await scanPending(projectRoot);
   if (scanned.errors.length === 0) {
     await pruneSentHashes(projectRoot, scanned.seenIds);
@@ -14983,14 +15169,15 @@ async function runSync(projectRoot, deps) {
   const pushOpts = { keepMine: deps.keepMine };
   const guidance = scan.pending.filter((e) => e.type === "guidance");
   const nonGuidance = scan.pending.filter((e) => e.type !== "guidance");
-  const phase1 = await pushBatches(target, toBatches(nonGuidance, batchSize), byType, pushOpts);
+  const phase1 = await pushBatches(target, toBatches(nonGuidance, batchSize), byType, { ...pushOpts, adopt: adoptFrom([]) });
   const progress = {
     pushed: phase1.pushed,
     enqueued: phase1.enqueued,
     conflicts: [...phase1.conflicts],
     overwritten: [...phase1.overwritten],
     errors,
-    selfResolved: [...phase1.selfResolved]
+    selfResolved: [...phase1.selfResolved],
+    adopted: [...phase1.adopted]
   };
   progress.errors.push(...phase1.errors);
   const notices = [];
@@ -15000,10 +15187,11 @@ async function runSync(projectRoot, deps) {
   const guidanceResult = await pushGuidanceBatch(target, guidance, batchSize, byType, { ...pushOpts, detectUnsupported: !cloudSupportsGuidance(capabilities) }, notices);
   mergePushProgress(progress, guidanceResult);
   const walkthroughs = await syncWalkthroughs(projectRoot, deps, scan.unpushableScenarios);
+  serverClockOffsetMs ??= walkthroughs.serverClockOffsetMs;
   if (walkthroughs.errors.length > 0) {
     progress.errors.push(...walkthroughs.errors);
   }
-  const phase3 = capabilities === null ? null : await pushDeferredFindings(projectRoot, capabilities, deferredFindings, walkthroughs, target, batchSize, byType, pushOpts, reportedRefErrors, progress.errors);
+  const phase3 = capabilities === null ? null : await pushDeferredFindings(projectRoot, capabilities, deferredFindings, walkthroughs, target, batchSize, byType, { ...pushOpts, adopt: adoptFrom(walkthroughs.pushedRuns) }, reportedRefErrors, progress.errors);
   mergePushProgress(progress, phase3);
   if (capabilities === null) {
     const heldFindings = shaped.heldFindings + deferredFindings.size;
@@ -15024,6 +15212,15 @@ async function runSync(projectRoot, deps) {
   const deletion = await syncDeletions(projectRoot, config, deps);
   progress.errors.push(...deletion.errors);
   notices.push(...deletion.notices);
+  for (const a of progress.adopted) {
+    if (a.kind === "projection") {
+      notices.push(`${a.slug}: kept the local version over the cloud's projected triage (automated, from a run's outcome)`);
+      continue;
+    }
+    const what = a.restamped ? "overwrote the cloud row re-stamped during this sync (its version token came from this sync's own bundle of the finding's run)" : "overwrote the cloud row stamped during this sync (its version token came from this sync's own bundle)";
+    const clock = a.serverClock ? "" : "; the server sent no clock, so only rows stamped after this sync began by this machine's clock counted";
+    notices.push(`${a.slug}: ${what}${clock}`);
+  }
   if (progress.selfResolved.length > 0) {
     const n = progress.selfResolved.length;
     notices.push(`${n} conflict${n === 1 ? " was" : "s were"} this machine's own earlier push (it reached the cloud without being recorded); re-sent against it`);
@@ -19273,7 +19470,14 @@ async function buildRunDesignerInput(projectRoot, runId) {
   await chooseKeyFrames(rd, grouped.candidates);
   const screens = grouped.screens;
   const screenKeys = new Set(screens.map((s) => s.key));
-  const earlier = await designerFindingsOn(projectRoot, screenKeys, manifest?.created_at ?? null, target);
+  const earlier = await designerFindingsOn(
+    projectRoot,
+    screenKeys,
+    manifest?.created_at ?? null,
+    target,
+    // A fix a designer's review already verified is not asked about again.
+    await verifiedDesignerFixes(projectRoot, manifest?.created_at ?? null)
+  );
   for (const o of earlier.open)
     refs2[o.ref] = o.id;
   const fullFrameScreens = new Set(screens.filter((s) => s.visits.some((v) => v.steps.some((st) => existsSync4(path34.join(rd, "screenshots", `step-${st.step}.full.png`))))).map((s) => s.key));
@@ -19429,6 +19633,7 @@ var init_designer_input = __esm({
     init_designer_files();
     init_designer_ignored();
     init_designer_ledger();
+    init_fix_state();
     init_walkthrough_canonical2();
     init_dist();
     LONG_VISIT = 6;
@@ -22381,6 +22586,69 @@ function stepNumberOf(s) {
   const m = /^(?:step-)?(\d+)$/i.exec(s.trim());
   return m ? Number(m[1]) : null;
 }
+async function writeDesignerFixStatus(projectRoot, runId, verification, checks) {
+  const verified = [];
+  const untriaged = [];
+  const warnings = [];
+  const out2 = { verified, untriaged, warnings };
+  const resolved = new Set(verification.resolved);
+  const persists = new Set(verification.persists);
+  if (resolved.size + persists.size === 0)
+    return out2;
+  const notWritten = (what, err) => warnings.push(`could not update ${what}: ${err instanceof Error ? err.message : String(err)}; designer.json holds the verification`);
+  let files;
+  try {
+    files = (await listDesignerFindings(projectRoot)).map((f) => f.frontmatter).filter((fm) => !fm.design_cause_of && fm.canonical_id && (resolved.has(fm.canonical_id) || persists.has(fm.canonical_id)));
+  } catch (err) {
+    notWritten("the checked findings' fix_status", err);
+    return out2;
+  }
+  const checkOf = new Map(checks.map((c) => [c.canonical_id, c]));
+  for (const cid of verification.resolved) {
+    const mine = files.filter((fm) => fm.canonical_id === cid);
+    if (mine.some((fm) => fm.triage_status === "addressed"))
+      continue;
+    const latest = mine.filter((fm) => fm.triage_status !== "dismissed").sort((a, b) => String(a.created_at ?? "").localeCompare(String(b.created_at ?? ""))).at(-1);
+    if (latest) {
+      untriaged.push({
+        ref: checkOf.get(cid)?.ref ?? null,
+        finding: latest.slug
+      });
+    }
+  }
+  let states;
+  try {
+    states = deriveFixStates(files, await readRunEvidence(projectRoot));
+  } catch (err) {
+    notWritten("the checked findings' fix_status", err);
+    return out2;
+  }
+  const decidedHere = (slug, state) => {
+    const s = states.get(slug);
+    return s?.fix_state === state && s.decided_by === runId;
+  };
+  for (const fm of files) {
+    if (fm.triage_status !== "addressed" || !fm.canonical_id)
+      continue;
+    if (resolved.has(fm.canonical_id) && decidedHere(fm.slug, "verified")) {
+      const [failed] = await markAddressedResolved([
+        {
+          file: entityFilePath(projectRoot, "finding", fm.slug),
+          triage_status: fm.triage_status
+        }
+      ], checkOf.get(fm.canonical_id)?.note ?? void 0);
+      if (failed)
+        notWritten(fm.slug, failed.error);
+      else
+        verified.push(fm.slug);
+    } else if (persists.has(fm.canonical_id) && decidedHere(fm.slug, "recurred")) {
+      const error = await updateFixStatus(projectRoot, fm.slug, "verified_persists");
+      if (error)
+        notWritten(fm.slug, error);
+    }
+  }
+  return out2;
+}
 async function readRefs2(rd) {
   try {
     return JSON.parse(await fs49.readFile(designerRefsFile(rd), "utf8"));
@@ -22701,6 +22969,11 @@ async function recordDesigner(projectRoot, runId, answer, opts) {
   };
   await atomicWriteFile(file, `${JSON.stringify(record, null, 2)}
 `);
+  const fixes = await writeDesignerFixStatus(projectRoot, runId, verification, checks);
+  warnings.push(...fixes.warnings);
+  for (const u of fixes.untriaged) {
+    warnings.push(`checked ${u.ref ?? "?"}: ${u.finding} is gone but was never marked addressed; its fix_status is left alone (checked_but_untriaged)`);
+  }
   const bySeverity = {};
   const ruleCount = groupDesignerRules(rules);
   for (const i of issues)
@@ -22714,7 +22987,9 @@ async function recordDesigner(projectRoot, runId, answer, opts) {
     proposals: proposals.written,
     rejected,
     warnings,
-    ...invalidChecked.length > 0 ? { invalid_checked: invalidChecked } : {}
+    ...invalidChecked.length > 0 ? { invalid_checked: invalidChecked } : {},
+    ...fixes.verified.length > 0 ? { verified: fixes.verified } : {},
+    ...fixes.untriaged.length > 0 ? { checked_but_untriaged: fixes.untriaged } : {}
   };
 }
 var DESIGNER_CATEGORIES, steps, refs, designerAnswerSchema;
@@ -22724,13 +22999,14 @@ var init_designer_record = __esm({
     init_atomic();
     init_design_proposals();
     init_design_review();
-    init_paths();
     init_url_path();
     init_review_issues();
     init_designer_files();
     init_designer_input();
     init_designer_ledger();
     init_entity();
+    init_fix_state();
+    init_paths();
     init_walkthrough_canonical2();
     DESIGNER_CATEGORIES = [
       "hierarchy",
@@ -23847,15 +24123,15 @@ function resolveApiUrl(configured) {
   assertSecureApiUrl(url, configured ? "API URL" : "IAMU_API_URL");
   return url;
 }
-function parseStore(raw, path77) {
+function parseStore(raw, path78) {
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch (err) {
-    throw new CredentialsFileError(path77, "not valid JSON", err);
+    throw new CredentialsFileError(path78, "not valid JSON", err);
   }
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new CredentialsFileError(path77, "expected a JSON object");
+    throw new CredentialsFileError(path78, "expected a JSON object");
   }
   return parsed;
 }
@@ -23863,26 +24139,26 @@ function isNotFound(err) {
   return typeof err === "object" && err !== null && err.code === "ENOENT";
 }
 async function readCredentialsStore() {
-  const path77 = getCredentialsPath();
+  const path78 = getCredentialsPath();
   let raw;
   try {
-    raw = await readFile(path77, "utf-8");
+    raw = await readFile(path78, "utf-8");
   } catch (err) {
     if (isNotFound(err)) return {};
     warnUnreadableStoreOnce(err);
     throw err;
   }
   try {
-    return parseStore(raw, path77);
+    return parseStore(raw, path78);
   } catch (err) {
     warnUnreadableStoreOnce(err);
     throw err;
   }
 }
 async function writeCredentialsStore(store) {
-  const path77 = getCredentialsPath();
-  await mkdir(dirname(path77), { recursive: true, mode: 448 });
-  await atomicWriteFile(path77, `${JSON.stringify(store, null, 2)}
+  const path78 = getCredentialsPath();
+  await mkdir(dirname(path78), { recursive: true, mode: 448 });
+  await atomicWriteFile(path78, `${JSON.stringify(store, null, 2)}
 `, {
     mode: 384
   });
@@ -23910,16 +24186,16 @@ function resolveApiKey(apiUrl) {
     }
   }
   const normalized = url.replace(/\/+$/, "");
-  for (const path77 of candidatePaths) {
+  for (const path78 of candidatePaths) {
     let raw;
     try {
-      raw = readFileSync3(path77, "utf-8");
+      raw = readFileSync3(path78, "utf-8");
     } catch (err) {
       if (!isNotFound(err)) warnUnreadableStoreOnce(err);
       continue;
     }
     try {
-      const store = parseStore(raw, path77);
+      const store = parseStore(raw, path78);
       const entry = store[url] ?? store[normalized] ?? store[`${normalized}/`];
       if (typeof entry !== "object" || entry === null) continue;
       const token = entry.token;
@@ -23960,12 +24236,12 @@ var init_credentials = __esm({
        * @param reason - What is wrong with it.
        * @param cause - Underlying parse error, if any.
        */
-      constructor(path77, reason, cause) {
+      constructor(path78, reason, cause) {
         super(
-          `Credentials file ${path77} is corrupt (${reason}). Fix it by hand, or delete it and run \`iamu auth login\` again.`,
+          `Credentials file ${path78} is corrupt (${reason}). Fix it by hand, or delete it and run \`iamu auth login\` again.`,
           {
             cause,
-            suggestedAction: `Delete ${path77} and run \`iamu auth login\`, or set IAMU_TOKEN.`
+            suggestedAction: `Delete ${path78} and run \`iamu auth login\`, or set IAMU_TOKEN.`
           }
         );
       }
@@ -24831,8 +25107,8 @@ import { dirname as dirname3, join as join5, relative, resolve as resolve2 } fro
 import { fileURLToPath as fileURLToPath2 } from "url";
 import chalk6 from "chalk";
 function getVersion() {
-  if ("0.8.0-beta.5") {
-    return "0.8.0-beta.5";
+  if ("0.8.0-beta.7") {
+    return "0.8.0-beta.7";
   }
   try {
     const thisDir = dirname3(fileURLToPath2(import.meta.url));
@@ -24955,10 +25231,10 @@ function hasGeneratedByMarker(content) {
 function withoutMarker(content) {
   return content.replace(/^generatedBy:[^\r\n]*\r?\n/m, "");
 }
-function cliSkillState(path77, template) {
+function cliSkillState(path78, template) {
   let content;
   try {
-    content = readFileSync7(path77, "utf-8");
+    content = readFileSync7(path78, "utf-8");
   } catch {
     return null;
   }
@@ -24966,9 +25242,9 @@ function cliSkillState(path77, template) {
   if (template === void 0) return "edited";
   return withoutMarker(content) === withoutMarker(template) ? "clean" : "edited";
 }
-function isCliWrittenPrompt(path77) {
+function isCliWrittenPrompt(path78) {
   try {
-    const content = readFileSync7(path77, "utf-8");
+    const content = readFileSync7(path78, "utf-8");
     return hasGeneratedByMarker(content) || /^#\s+iamu:/m.test(content) || /^description:\s*.*iamu/im.test(content);
   } catch {
     return false;
@@ -24978,10 +25254,10 @@ function planSkillFiles(hosts, projectRoot, version) {
   const skillTemplates = loadSkillTemplates(version);
   const files = [];
   const keptEdited = [];
-  const removeIfClean = (host, path77, name) => {
-    const state = cliSkillState(path77, skillTemplates.get(name));
-    if (state === "clean") files.push({ host, path: path77, content: null });
-    else if (state === "edited") keptEdited.push({ host, path: path77 });
+  const removeIfClean = (host, path78, name) => {
+    const state = cliSkillState(path78, skillTemplates.get(name));
+    if (state === "clean") files.push({ host, path: path78, content: null });
+    else if (state === "edited") keptEdited.push({ host, path: path78 });
   };
   for (const host of hosts) {
     if (pluginProvidesSkills(host, projectRoot)) {
@@ -25078,9 +25354,9 @@ async function findStaleSkills(projectRoot) {
   }
   return stale;
 }
-async function removeSkillFile(path77) {
-  await rm(path77, { force: true });
-  await rmdir(dirname3(path77)).catch(() => {
+async function removeSkillFile(path78) {
+  await rm(path78, { force: true });
+  await rmdir(dirname3(path78)).catch(() => {
   });
 }
 async function installSkillsForHosts(hosts, projectRoot, version, opts) {
@@ -25882,29 +26158,29 @@ async function writeSyncMcpEntry(mcpPath) {
   return { removedLegacy };
 }
 async function registerSyncMcpForHost(host, projectRoot) {
-  const path77 = host.getMcpConfigPath(projectRoot);
-  if (path77 === null) {
+  const path78 = host.getMcpConfigPath(projectRoot);
+  if (path78 === null) {
     return {
       status: "manual",
       instruction: host.manualMcpSetup ?? `add an "iamu-sync" server that runs \`${SYNC_SERVER_COMMAND.join(" ")}\``
     };
   }
   try {
-    const { removedLegacy } = await writeSyncMcpEntry(path77);
-    return { status: "written", path: path77, removedLegacy };
+    const { removedLegacy } = await writeSyncMcpEntry(path78);
+    return { status: "written", path: path78, removedLegacy };
   } catch (err) {
     return {
       status: "failed",
-      path: path77,
+      path: path78,
       message: err instanceof Error ? err.message : String(err)
     };
   }
 }
 async function removeLegacyMcpForHost(host, projectRoot) {
-  const path77 = host.getMcpConfigPath(projectRoot);
-  if (path77 === null) return null;
+  const path78 = host.getMcpConfigPath(projectRoot);
+  if (path78 === null) return null;
   try {
-    return await removeLegacyIamuEntry(path77) ? { status: "legacy_removed", path: path77, removedLegacy: true } : null;
+    return await removeLegacyIamuEntry(path78) ? { status: "legacy_removed", path: path78, removedLegacy: true } : null;
   } catch {
     return null;
   }
@@ -33482,6 +33758,7 @@ __export(triage_exports, {
   triage: () => triage
 });
 import { promises as fs65 } from "fs";
+import path62 from "path";
 import chalk29 from "chalk";
 async function awaitingSteps(projectRoot, findings2) {
   const scenarios = /* @__PURE__ */ new Set();
@@ -33620,14 +33897,53 @@ async function triage(refs2, opts) {
     );
     return;
   }
+  let note = opts.note;
+  if (opts.noteFile !== void 0) {
+    if (opts.note !== void 0) {
+      commandError("Pass --note or --note-file, not both.", {
+        ...opts,
+        code: "invalid_field_combination",
+        fix: `iamu triage ${refs2.join(" ")} --status ${status2.data} --note-file <path>`
+      });
+      return;
+    }
+    try {
+      const text = opts.noteFile === "-" ? await readStdinText() : await fs65.readFile(
+        path62.resolve(process.cwd(), opts.noteFile),
+        "utf8"
+      );
+      note = text.trim();
+    } catch (err) {
+      commandError(
+        `Could not read --note-file ${opts.noteFile}: ${err instanceof Error ? err.message : String(err)}`,
+        {
+          ...opts,
+          code: "note_read_error",
+          fix: `iamu triage ${refs2.join(" ")} --status ${status2.data} --note "<what changed>"`
+        }
+      );
+      return;
+    }
+    if (!note) {
+      commandError(`--note-file ${opts.noteFile} is empty`, {
+        ...opts,
+        code: "note_empty",
+        fix: `iamu triage ${refs2.join(" ")} --status ${status2.data} --note "<what changed>"`
+      });
+      return;
+    }
+  }
   let reason = null;
   if (opts.reason !== void 0) {
     if (status2.data !== "dismissed") {
-      commandError("--reason applies only to --status dismissed", {
-        ...opts,
-        code: "invalid_reason_usage",
-        fix: `iamu triage ${refs2.join(" ")} --status dismissed --reason ${opts.reason}`
-      });
+      commandError(
+        "--reason applies only to --status dismissed \u2014 to record why or what changed, use --note",
+        {
+          ...opts,
+          code: "invalid_reason_usage",
+          fix: `iamu triage ${refs2.join(" ")} --status ${status2.data} --note "<what changed>"`
+        }
+      );
       return;
     }
     if (!DISMISS_REASONS.includes(opts.reason)) {
@@ -33819,7 +34135,7 @@ async function triage(refs2, opts) {
     const rule = await createGuidanceRule(projectRoot, {
       kind: effectiveReason,
       rule: ruleText,
-      reason: opts.note,
+      reason: note,
       scope,
       sourceCanonicalIds: allTargets.map((f) => f.frontmatter.canonical_id).filter((id) => Boolean(id && UUID_RE4.test(id)))
     });
@@ -33830,7 +34146,7 @@ async function triage(refs2, opts) {
     status: status2.data,
     reason: effectiveReason,
     duplicateOf: duplicateTarget,
-    ...opts.note !== void 0 ? { note: opts.note } : {},
+    ...note !== void 0 ? { note } : {},
     by: "triage",
     cascade: true,
     guidance: guidance ? { id: guidance.id, all: isSweep } : null,
@@ -33915,6 +34231,7 @@ var init_triage = __esm({
     init_dist2();
     init_dist();
     init_agent_commands();
+    init_answer_input();
     init_complete();
     init_context4();
     SCOPES = ["project", "outline", "capability"];
@@ -34382,7 +34699,7 @@ var init_browse_driver = __esm({
 
 // src/commands/browse-actions.ts
 import { existsSync as existsSync15 } from "fs";
-import path62 from "path";
+import path63 from "path";
 function byRole(page, role, name, opts) {
   const loc = page.getByRole(role, { name, exact: false });
   if (opts.nth !== void 0) {
@@ -34683,7 +35000,7 @@ async function fillIndexedElement(page, index, text, submit) {
   await fillOrSelect(loc.first(), text, submit);
 }
 async function setFilesOnElement(el, filePath) {
-  const resolved = path62.resolve(filePath);
+  const resolved = path63.resolve(filePath);
   if (SENSITIVE_UPLOAD_PATH.test(resolved)) {
     throw new Error(
       `Refusing to upload sensitive path: "${resolved}". Choose a test fixture file inside the project or temp directory.`
@@ -34916,7 +35233,7 @@ var init_browse_actions = __esm({
 
 // src/commands/step-numbering.ts
 import { open, readFile as readFile6, readdir, stat as stat2, unlink } from "fs/promises";
-import path63 from "path";
+import path64 from "path";
 function reservationMarker() {
   const marker = {
     reservation: { pid: process.pid, ts: Date.now() }
@@ -34958,7 +35275,7 @@ async function peekNextStepNumber(stepsDir) {
   for (const f of files) {
     const m = /^(\d+)\.json$/.exec(f);
     if (!m) continue;
-    const fullPath = path63.join(stepsDir, f);
+    const fullPath = path64.join(stepsDir, f);
     const st = await stat2(fullPath).catch(() => null);
     if (!st) continue;
     if (await isAbandonedReservation(fullPath, st)) {
@@ -34976,7 +35293,7 @@ async function reserveStepFile(stepsDir, limit) {
     if (candidate > limit.maxSteps) {
       throw new Error(stepLimitMessage(limit.maxSteps, limit.runId));
     }
-    const stepPath = path63.join(stepsDir, stepFileName(candidate));
+    const stepPath = path64.join(stepsDir, stepFileName(candidate));
     try {
       const handle = await open(stepPath, "wx");
       try {
@@ -35022,7 +35339,7 @@ __export(step_exports, {
 });
 import { existsSync as existsSync16 } from "fs";
 import { copyFile, mkdir as mkdir4, rename, stat as stat3 } from "fs/promises";
-import path64 from "path";
+import path65 from "path";
 import chalk31 from "chalk";
 function parseMaxSteps(val) {
   if (typeof val === "number" && Number.isFinite(val) && val > 0) return val;
@@ -35038,11 +35355,11 @@ function parseMaxSteps(val) {
 }
 async function recordStep(input) {
   const runDirPath = runDir(input.projectRoot, input.runId);
-  if (!existsSync16(path64.join(runDirPath, "walkthrough.json"))) {
+  if (!existsSync16(path65.join(runDirPath, "walkthrough.json"))) {
     throw new Error(`Run not found: ${input.runId}`);
   }
-  const stepsDir = path64.join(runDirPath, "steps");
-  const screenshotsDir = path64.join(runDirPath, "screenshots");
+  const stepsDir = path65.join(runDirPath, "steps");
+  const screenshotsDir = path65.join(runDirPath, "screenshots");
   await mkdir4(stepsDir, { recursive: true });
   await mkdir4(screenshotsDir, { recursive: true });
   const shotSource = input.shot ? await existingShot(input.shot) : null;
@@ -35057,9 +35374,9 @@ async function recordStep(input) {
     let screenshotRef = null;
     if (shotSource) {
       const destName = `step-${stepNumber2}.png`;
-      const destPath = path64.join(screenshotsDir, destName);
+      const destPath = path65.join(screenshotsDir, destName);
       finalScreenshotPath = destPath;
-      if (path64.resolve(destPath) !== shotSource) {
+      if (path65.resolve(destPath) !== shotSource) {
         if (input.moveShot) {
           await rename(shotSource, destPath).catch(
             () => copyFile(shotSource, destPath)
@@ -35068,16 +35385,16 @@ async function recordStep(input) {
           await copyFile(shotSource, destPath);
         }
       }
-      screenshotRef = path64.posix.join("screenshots", destName);
+      screenshotRef = path65.posix.join("screenshots", destName);
     }
     let fullRef = null;
     if (input.fullShot && existsSync16(input.fullShot)) {
       const fullName = `step-${stepNumber2}.full.png`;
       const moved = await rename(
         input.fullShot,
-        path64.join(screenshotsDir, fullName)
+        path65.join(screenshotsDir, fullName)
       ).then(() => true).catch(() => false);
-      if (moved) fullRef = path64.posix.join("screenshots", fullName);
+      if (moved) fullRef = path65.posix.join("screenshots", fullName);
     }
     parsedStep = runStepSchema.parse({
       step_number: stepNumber2,
@@ -35124,7 +35441,7 @@ async function recordStep(input) {
   };
 }
 async function existingShot(shot) {
-  const resolved = path64.resolve(shot);
+  const resolved = path65.resolve(shot);
   const isFile = await stat3(resolved).then((s) => s.isFile()).catch(() => false);
   if (!isFile) {
     throw new Error(
@@ -35185,7 +35502,7 @@ async function stepCommand(runArg, opts) {
             {
               step_number: res.step.step_number,
               cancelled: true,
-              path: path64.relative(projectRoot, res.stepPath).split(path64.sep).join("/"),
+              path: path65.relative(projectRoot, res.stepPath).split(path65.sep).join("/"),
               action: res.step.action,
               note: res.step.note,
               url: res.step.url,
@@ -35213,7 +35530,7 @@ async function stepCommand(runArg, opts) {
         JSON.stringify(
           {
             step_number: res.step.step_number,
-            path: path64.relative(projectRoot, res.stepPath).split(path64.sep).join("/"),
+            path: path65.relative(projectRoot, res.stepPath).split(path65.sep).join("/"),
             action: res.step.action,
             note: res.step.note,
             url: res.step.url,
@@ -35242,7 +35559,7 @@ async function stepCommand(runArg, opts) {
         console.log(`  ${chalk31.dim("shot:")}       ${res.step.screenshot}`);
       }
       console.log(
-        `  ${chalk31.dim("file:")}       ${path64.relative(projectRoot, res.stepPath)}`
+        `  ${chalk31.dim("file:")}       ${path65.relative(projectRoot, res.stepPath)}`
       );
       console.log();
     } else {
@@ -35314,16 +35631,16 @@ import {
 import { rm as rm2 } from "fs/promises";
 import { createServer } from "net";
 import { homedir as homedir3 } from "os";
-import path65 from "path";
+import path66 from "path";
 import chalk32 from "chalk";
 function stateDir() {
-  return path65.join(
-    process.env.IAMU_HOME ?? path65.join(homedir3(), ".iamu"),
+  return path66.join(
+    process.env.IAMU_HOME ?? path66.join(homedir3(), ".iamu"),
     "browse"
   );
 }
 function profileDir() {
-  return path65.join(stateDir(), "profile");
+  return path66.join(stateDir(), "profile");
 }
 function privateDir(dir) {
   mkdirSync3(dir, { recursive: true, mode: 448 });
@@ -35334,7 +35651,7 @@ function privateDir(dir) {
 }
 function stateFile(run) {
   const key = run && STATE_KEY.test(run) && `${run}.json` !== SHARED_STATE ? `${run}.json` : SHARED_STATE;
-  return path65.join(stateDir(), key);
+  return path66.join(stateDir(), key);
 }
 function loadState(file) {
   try {
@@ -35375,7 +35692,7 @@ function storedStates() {
   }
   const out2 = [];
   for (const name of names2.sort()) {
-    const file = path65.join(stateDir(), name);
+    const file = path66.join(stateDir(), name);
     const state = loadState(file);
     if (state) out2.push({ state, file });
   }
@@ -35393,16 +35710,16 @@ function removeState(file) {
 }
 function runStillOpen(state, now = Date.now()) {
   if (!state.run || !state.project) return false;
-  const dir = path65.join(state.project, "iamu", ".runs", state.run);
+  const dir = path66.join(state.project, "iamu", ".runs", state.run);
   try {
-    const manifestPath = path65.join(dir, "walkthrough.json");
+    const manifestPath = path66.join(dir, "walkthrough.json");
     const manifest = JSON.parse(readFileSync10(manifestPath, "utf8"));
     if (typeof manifest.status !== "string" || !OPEN_RUN_STATUSES.has(manifest.status)) {
       return false;
     }
     let last = statSync3(manifestPath).mtimeMs;
     try {
-      last = Math.max(last, statSync3(path65.join(dir, "steps")).mtimeMs);
+      last = Math.max(last, statSync3(path66.join(dir, "steps")).mtimeMs);
     } catch {
     }
     return now - last < RUN_IDLE_MS;
@@ -35501,7 +35818,7 @@ async function requestedViewport(opts) {
   let manifest;
   try {
     manifest = JSON.parse(
-      readFileSync10(path65.join(dir, "walkthrough.json"), "utf8")
+      readFileSync10(path66.join(dir, "walkthrough.json"), "utf8")
     );
   } catch {
     fail(
@@ -35680,7 +35997,7 @@ function computePageFingerprint(url, bodySnippet) {
   return createHash6("sha256").update(`${url}|${bodySnippet.trim().replace(/\s+/g, " ")}`).digest("hex").slice(0, 16);
 }
 function checkAndRecordStagnation(runDirPath, fingerprint, action) {
-  const cacheFile = path65.join(runDirPath, ".stagnation.json");
+  const cacheFile = path66.join(runDirPath, ".stagnation.json");
   let previous = null;
   try {
     if (existsSync17(cacheFile)) {
@@ -35961,8 +36278,8 @@ async function actOnPage(opts, attached, state, fn, onPostShot) {
   let contentSnippet;
   if (opts.shot) {
     await waitForVisualStability(page);
-    screenshot = path65.resolve(opts.shot);
-    mkdirSync3(path65.dirname(screenshot), { recursive: true });
+    screenshot = path66.resolve(opts.shot);
+    mkdirSync3(path66.dirname(screenshot), { recursive: true });
     await page.screenshot({
       path: screenshot,
       fullPage: Boolean(opts.full),
@@ -36172,7 +36489,7 @@ function httpOrigin(raw) {
 function readTargetUrl(runDirPath) {
   try {
     const m = JSON.parse(
-      readFileSync10(path65.join(runDirPath, "walkthrough.json"), "utf8")
+      readFileSync10(path66.join(runDirPath, "walkthrough.json"), "utf8")
     );
     return typeof m.target_url === "string" ? m.target_url : null;
   } catch {
@@ -36184,7 +36501,7 @@ function fullFramePlan(runDirPath, url, scrolled) {
   let manifest = {};
   try {
     manifest = JSON.parse(
-      readFileSync10(path65.join(runDirPath, "walkthrough.json"), "utf8")
+      readFileSync10(path66.join(runDirPath, "walkthrough.json"), "utf8")
     );
   } catch {
   }
@@ -36195,7 +36512,7 @@ function fullFramePlan(runDirPath, url, scrolled) {
   if (designer2.includes(key) || scrolled) {
     return { take: true, lastHeight: null };
   }
-  const stepsDir = path65.join(runDirPath, "steps");
+  const stepsDir = path66.join(runDirPath, "steps");
   let names2 = [];
   try {
     names2 = readdirSync3(stepsDir).filter((n) => /^\d+\.json$/.test(n)).sort();
@@ -36206,7 +36523,7 @@ function fullFramePlan(runDirPath, url, scrolled) {
   for (const name of names2) {
     try {
       const earlier = JSON.parse(
-        readFileSync10(path65.join(stepsDir, name), "utf8")
+        readFileSync10(path66.join(stepsDir, name), "utf8")
       );
       if (typeof earlier.url === "string" && stepScreenKey(earlier.url, target) === key) {
         seen = true;
@@ -36273,7 +36590,7 @@ function printStep(opts, record, projectRoot, stagnationWarning, challengeWarnin
   if (opts.json) {
     const doc = {
       step_number: step.step_number,
-      path: path65.relative(projectRoot, record.stepPath).split(path65.sep).join("/"),
+      path: path66.relative(projectRoot, record.stepPath).split(path66.sep).join("/"),
       action: step.action,
       note: step.note,
       url: step.url,
@@ -36391,7 +36708,7 @@ async function clearStorage(opts, driver) {
     try {
       if (dir) {
         target = JSON.parse(
-          readFileSync10(path65.join(dir, "walkthrough.json"), "utf8")
+          readFileSync10(path66.join(dir, "walkthrough.json"), "utf8")
         ).target_url;
       }
     } catch {
@@ -36578,15 +36895,15 @@ async function browseStep(args2, opts, driver) {
   ))
     return;
   const maxSteps = parseMaxSteps(opts.maxSteps);
-  if (await peekNextStepNumber(path65.join(runDirPath, "steps")) > maxSteps) {
+  if (await peekNextStepNumber(path66.join(runDirPath, "steps")) > maxSteps) {
     return fail(stepLimitMessage(maxSteps, opts.run), opts);
   }
-  const pendingShot = path65.join(
+  const pendingShot = path66.join(
     runDirPath,
     "screenshots",
     `.pending-${randomUUID11()}.png`
   );
-  const pendingFull = path65.join(
+  const pendingFull = path66.join(
     runDirPath,
     "screenshots",
     `.pending-${randomUUID11()}.full.png`
@@ -38469,18 +38786,18 @@ __export(preflight_exports, {
 });
 import { spawnSync } from "child_process";
 import { existsSync as existsSync20, promises as fs67 } from "fs";
-import path66 from "path";
+import path67 from "path";
 import chalk36 from "chalk";
 function detectPackageManager(targetDir) {
-  if (existsSync20(path66.join(targetDir, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync20(path66.join(targetDir, "yarn.lock"))) return "yarn";
-  if (existsSync20(path66.join(targetDir, "bun.lockb")) || existsSync20(path66.join(targetDir, "bun.lock"))) {
+  if (existsSync20(path67.join(targetDir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync20(path67.join(targetDir, "yarn.lock"))) return "yarn";
+  if (existsSync20(path67.join(targetDir, "bun.lockb")) || existsSync20(path67.join(targetDir, "bun.lock"))) {
     return "bun";
   }
   return "npm";
 }
 async function detectPreflightCommand(targetDir) {
-  const pkgPath = path66.join(targetDir, "package.json");
+  const pkgPath = path67.join(targetDir, "package.json");
   if (existsSync20(pkgPath)) {
     try {
       const raw = await fs67.readFile(pkgPath, "utf8");
@@ -38493,7 +38810,7 @@ async function detectPreflightCommand(targetDir) {
     } catch {
     }
   }
-  const tsconfigPath = path66.join(targetDir, "tsconfig.json");
+  const tsconfigPath = path67.join(targetDir, "tsconfig.json");
   if (existsSync20(tsconfigPath)) {
     return { command: "npx", args: ["--no-install", "tsc", "--noEmit"] };
   }
@@ -38532,7 +38849,7 @@ async function runPreflightCheck(targetDir) {
   };
 }
 async function preflight(opts = {}) {
-  const targetDir = opts.cwd ? path66.resolve(opts.cwd) : process.cwd();
+  const targetDir = opts.cwd ? path67.resolve(opts.cwd) : process.cwd();
   const result = await runPreflightCheck(targetDir);
   if (result.ok) {
     if (opts.json) {
@@ -39041,12 +39358,12 @@ __export(validate_exports, {
 });
 import { randomUUID as randomUUID12 } from "crypto";
 import { promises as fs68 } from "fs";
-import path67 from "path";
+import path68 from "path";
 import chalk38 from "chalk";
 function inferTypeFromPath(filePath, projectRoot) {
-  const rel = path67.relative(path67.join(projectRoot, "iamu"), filePath);
-  if (rel.startsWith("..") || path67.isAbsolute(rel)) return null;
-  const segments = rel.split(path67.sep);
+  const rel = path68.relative(path68.join(projectRoot, "iamu"), filePath);
+  if (rel.startsWith("..") || path68.isAbsolute(rel)) return null;
+  const segments = rel.split(path68.sep);
   if (segments.length < 2) return null;
   return TYPE_BY_ALIAS.get(segments[0]) ?? null;
 }
@@ -39063,7 +39380,7 @@ function applyZodValidation(schema2, data, result) {
 }
 function validateFile(filePath, raw, projectRoot) {
   const result = { path: filePath, valid: true, errors: [] };
-  if (path67.basename(filePath) === "config.json") {
+  if (path68.basename(filePath) === "config.json") {
     let parsedJson;
     try {
       parsedJson = JSON.parse(raw);
@@ -39090,11 +39407,11 @@ function validateFile(filePath, raw, projectRoot) {
     );
     return result;
   }
-  if (path67.basename(filePath) === "testability.md") {
+  if (path68.basename(filePath) === "testability.md") {
     applyZodValidation(testabilityFrontmatterSchema, frontmatter, result);
     return result;
   }
-  if (path67.basename(filePath) === "context.yml") {
+  if (path68.basename(filePath) === "context.yml") {
     applyZodValidation(contextFrontmatterSchema, frontmatter, result);
     const warnings = [];
     const hasNotes = Boolean(
@@ -39156,7 +39473,7 @@ async function buildRepairLookups(projectRoot) {
     }
   }
   const runScenario = /* @__PURE__ */ new Map();
-  const runsDir2 = path67.join(projectRoot, "iamu", ".runs");
+  const runsDir2 = path68.join(projectRoot, "iamu", ".runs");
   let runIds = [];
   try {
     runIds = await fs68.readdir(runsDir2);
@@ -39166,7 +39483,7 @@ async function buildRepairLookups(projectRoot) {
     try {
       const manifest = JSON.parse(
         await fs68.readFile(
-          path67.join(runsDir2, runId, "walkthrough.json"),
+          path68.join(runsDir2, runId, "walkthrough.json"),
           "utf8"
         )
       );
@@ -39197,7 +39514,7 @@ async function fixFindings(projectRoot, results, dryRun) {
       parsed.frontmatter,
       {
         ...lookups,
-        fileSlug: path67.basename(result.path, ".md"),
+        fileSlug: path68.basename(result.path, ".md"),
         newId: randomUUID12,
         body: parsed.body
       }
@@ -39239,7 +39556,7 @@ async function validate(filePath, opts) {
   if (process.exitCode === 1) return;
   const results = [];
   if (filePath) {
-    const abs = path67.isAbsolute(filePath) ? filePath : path67.resolve(process.cwd(), filePath);
+    const abs = path68.isAbsolute(filePath) ? filePath : path68.resolve(process.cwd(), filePath);
     try {
       const raw = await fs68.readFile(abs, "utf8");
       results.push(validateFile(abs, raw, projectRoot));
@@ -39255,7 +39572,7 @@ async function validate(filePath, opts) {
       return;
     }
   } else if (opts.run) {
-    const findingsDir = path67.join(projectRoot, "iamu", ENTITY_DIRS.finding);
+    const findingsDir = path68.join(projectRoot, "iamu", ENTITY_DIRS.finding);
     let names2 = [];
     try {
       names2 = await fs68.readdir(findingsDir);
@@ -39263,7 +39580,7 @@ async function validate(filePath, opts) {
     }
     for (const name of names2) {
       if (!name.endsWith(".md")) continue;
-      const abs = path67.join(findingsDir, name);
+      const abs = path68.join(findingsDir, name);
       try {
         const raw = await fs68.readFile(abs, "utf8");
         const { frontmatter } = parseFrontmatter(raw);
@@ -39272,7 +39589,7 @@ async function validate(filePath, opts) {
         }
       } catch {
         results.push({
-          path: path67.relative(projectRoot, abs),
+          path: path68.relative(projectRoot, abs),
           valid: false,
           errors: ["Cannot read file or parse frontmatter"]
         });
@@ -39305,7 +39622,7 @@ async function validate(filePath, opts) {
   } else {
     const typesToCheck = typeFilter ? ENTITY_TYPES.filter((t) => typeFilter.has(t)) : ENTITY_TYPES;
     for (const type2 of typesToCheck) {
-      const iamuTypeDir = path67.join(projectRoot, "iamu", ENTITY_DIRS[type2]);
+      const iamuTypeDir = path68.join(projectRoot, "iamu", ENTITY_DIRS[type2]);
       let names2;
       try {
         names2 = await fs68.readdir(iamuTypeDir);
@@ -39314,13 +39631,13 @@ async function validate(filePath, opts) {
       }
       for (const name of names2) {
         if (!name.endsWith(".md")) continue;
-        const abs = path67.join(iamuTypeDir, name);
+        const abs = path68.join(iamuTypeDir, name);
         try {
           const raw = await fs68.readFile(abs, "utf8");
           results.push(validateFile(abs, raw, projectRoot));
         } catch {
           results.push({
-            path: path67.relative(projectRoot, abs),
+            path: path68.relative(projectRoot, abs),
             valid: false,
             errors: ["Cannot read file"]
           });
@@ -39328,7 +39645,7 @@ async function validate(filePath, opts) {
       }
     }
     for (const extraFile of ["context.yml", "testability.md", "config.json"]) {
-      const extraPath = path67.join(projectRoot, "iamu", extraFile);
+      const extraPath = path68.join(projectRoot, "iamu", extraFile);
       try {
         const raw = await fs68.readFile(extraPath, "utf8");
         results.push(validateFile(extraPath, raw, projectRoot));
@@ -39354,19 +39671,19 @@ async function validate(filePath, opts) {
           valid,
           errors: results.filter((r) => !r.valid).flatMap(
             (r) => r.errors.map((e) => ({
-              path: path67.relative(projectRoot, r.path),
+              path: path68.relative(projectRoot, r.path),
               message: e
             }))
           ),
           warnings: results.filter((r) => r.warnings && r.warnings.length > 0).flatMap(
             (r) => (r.warnings ?? []).map((w) => ({
-              path: path67.relative(projectRoot, r.path),
+              path: path68.relative(projectRoot, r.path),
               message: w
             }))
           ),
           ...opts.fix ? {
             repaired: repaired.map((r) => ({
-              path: path67.relative(projectRoot, r.path),
+              path: path68.relative(projectRoot, r.path),
               changes: r.repairs,
               valid: r.valid
             }))
@@ -39388,7 +39705,7 @@ async function validate(filePath, opts) {
   }
   let hasErrors = false;
   for (const r of results) {
-    const relPath = path67.relative(projectRoot, r.path);
+    const relPath = path68.relative(projectRoot, r.path);
     if (r.valid) {
       if (r.warnings && r.warnings.length > 0) {
         console.log(`  ${symbols.warning} ` + chalk38.yellow(relPath));
@@ -39583,7 +39900,7 @@ __export(new_entity_exports, {
 });
 import { randomUUID as randomUUID13 } from "crypto";
 import { readFile as readFile8 } from "fs/promises";
-import path68 from "path";
+import path69 from "path";
 import chalk40 from "chalk";
 async function resolveBodyInput(opts, command, flag = "--body") {
   if (opts.bodyFile !== void 0) {
@@ -39596,7 +39913,7 @@ async function resolveBodyInput(opts, command, flag = "--body") {
       return null;
     }
     try {
-      const body = opts.bodyFile === "-" ? await readStdinText() : await readFile8(path68.resolve(process.cwd(), opts.bodyFile), "utf8");
+      const body = opts.bodyFile === "-" ? await readStdinText() : await readFile8(path69.resolve(process.cwd(), opts.bodyFile), "utf8");
       return { body };
     } catch (err) {
       commandError(
@@ -39846,7 +40163,7 @@ __export(set_entity_exports, {
   setEntity: () => setEntity
 });
 import { promises as fs69 } from "fs";
-import path69 from "path";
+import path70 from "path";
 import chalk41 from "chalk";
 import { ZodError as ZodError2 } from "zod";
 function normalizeAuthStrategy(raw) {
@@ -40037,7 +40354,7 @@ async function setEntity(type2, slug, opts) {
         }
         raw = Buffer.concat(chunks).toString("utf8");
       } else {
-        raw = await fs69.readFile(path69.resolve(projectRoot, opts.file), "utf8");
+        raw = await fs69.readFile(path70.resolve(projectRoot, opts.file), "utf8");
       }
     } catch (err) {
       commandError(
@@ -40623,7 +40940,7 @@ __export(edit_entity_exports, {
 });
 import { spawn as spawn2 } from "child_process";
 import { promises as fs70 } from "fs";
-import path70 from "path";
+import path71 from "path";
 import chalk42 from "chalk";
 async function editEntity(type2, slug, opts = {}) {
   const ctx = await resolveProject(opts);
@@ -40647,7 +40964,7 @@ async function editEntity(type2, slug, opts = {}) {
   }
   const effectiveSlug = isSpecial ? type2 : slug;
   const resolvedPath = isSpecial ? type2 === "testability" ? testabilityPath(projectRoot) : contextPath(projectRoot) : await resolveEntityPath(projectRoot, type2, effectiveSlug);
-  const filePath = resolvedPath ?? path70.join(
+  const filePath = resolvedPath ?? path71.join(
     projectRoot,
     "iamu",
     ENTITY_DIRS[type2],
@@ -40658,7 +40975,7 @@ async function editEntity(type2, slug, opts = {}) {
     await fs70.access(filePath);
   } catch {
     commandError(
-      `${type2}${isSpecial ? "" : ` "${effectiveSlug}"`} not found at ${path70.relative(projectRoot, filePath)}.`,
+      `${type2}${isSpecial ? "" : ` "${effectiveSlug}"`} not found at ${path71.relative(projectRoot, filePath)}.`,
       {
         ...opts,
         code: "entity_not_found",
@@ -40669,7 +40986,7 @@ async function editEntity(type2, slug, opts = {}) {
   }
   if (!process.stdin.isTTY || process.env.CI) {
     commandError(
-      `Cannot open editor in a non-interactive environment. Edit the file directly: ${path70.relative(projectRoot, filePath)}`,
+      `Cannot open editor in a non-interactive environment. Edit the file directly: ${path71.relative(projectRoot, filePath)}`,
       {
         ...opts,
         code: "non_interactive_environment",
@@ -40745,7 +41062,7 @@ async function editEntity(type2, slug, opts = {}) {
         console.log();
         console.log(
           chalk42.dim(
-            `  Fix the file and run: iamu validate ${path70.relative(projectRoot, filePath)}`
+            `  Fix the file and run: iamu validate ${path71.relative(projectRoot, filePath)}`
           )
         );
         console.log();
@@ -40775,7 +41092,7 @@ async function editEntity(type2, slug, opts = {}) {
       {
         ...opts,
         code: "validation_error",
-        fix: `iamu validate ${path70.relative(projectRoot, filePath)}`
+        fix: `iamu validate ${path71.relative(projectRoot, filePath)}`
       }
     );
   }
@@ -40944,7 +41261,7 @@ async function crawlFrom(page, opts, origin, takeBlocked) {
   const byKey = /* @__PURE__ */ new Map();
   const byPlaceView = /* @__PURE__ */ new Map();
   const signatureOf = (s) => exploreSignature(s.headings, s.title);
-  function addSurface(state, place, view, path77, depth) {
+  function addSurface(state, place, view, path78, depth) {
     const key = exploreSurfaceKey(place, view);
     const surface = {
       key,
@@ -40956,7 +41273,7 @@ async function crawlFrom(page, opts, origin, takeBlocked) {
       headings: state.headings,
       fields: state.fields,
       depth,
-      path: path77,
+      path: path78,
       actions: []
     };
     surfaces.push(surface);
@@ -40974,9 +41291,9 @@ ${surface.signature}`, key);
     });
     await settle(page, settleMs);
   }
-  async function replay(path77) {
-    if (!("goto" in (path77[0] ?? {}))) await goto(opts.startUrl);
-    for (const step of path77) {
+  async function replay(path78) {
+    if (!("goto" in (path78[0] ?? {}))) await goto(opts.startUrl);
+    for (const step of path78) {
       if ("goto" in step) {
         await goto(step.goto);
       } else {
@@ -41103,8 +41420,8 @@ ${sig}`, key);
                 if (stats.surfaces >= budget.max_surfaces) {
                   stats.truncated = true;
                 } else {
-                  const path77 = !sameDoc && view === null ? [{ goto: after.url }] : [...surface.path, ...via, click];
-                  addSurface(after, place, view, path77, surface.depth + 1);
+                  const path78 = !sameDoc && view === null ? [{ goto: after.url }] : [...surface.path, ...via, click];
+                  addSurface(after, place, view, path78, surface.depth + 1);
                 }
               }
             }
@@ -41374,7 +41691,7 @@ __export(explore_exports, {
   exploreList: () => exploreList,
   exploreRun: () => exploreRun
 });
-import path71 from "path";
+import path72 from "path";
 import chalk43 from "chalk";
 function fail2(message, json2) {
   if (json2) console.error(JSON.stringify({ error: message }));
@@ -41514,7 +41831,7 @@ async function exploreRun(url, opts) {
     surfaces: result.surfaces
   };
   const file = await writeExploreMap(ctx.projectRoot, map2);
-  const rel = path71.relative(process.cwd(), file);
+  const rel = path72.relative(process.cwd(), file);
   if (opts.json) {
     console.log(JSON.stringify({ id: map2.id, path: rel, stats: map2.stats }));
     return;
@@ -42710,7 +43027,7 @@ __export(new_finding_exports, {
 });
 import { randomUUID as randomUUID14 } from "crypto";
 import { access, readFile as readFile9 } from "fs/promises";
-import path72 from "path";
+import path73 from "path";
 import chalk46 from "chalk";
 async function newFinding(opts) {
   const ctx = await resolveProject(opts);
@@ -42798,7 +43115,7 @@ async function newFinding(opts) {
     }
     try {
       await access(
-        path72.join(runDirPath, "steps", `${String(n).padStart(3, "0")}.json`)
+        path73.join(runDirPath, "steps", `${String(n).padStart(3, "0")}.json`)
       );
     } catch {
       commandError(
@@ -42817,7 +43134,7 @@ async function newFinding(opts) {
   if (!scenarioSlug) {
     try {
       const manifestRaw = await readFile9(
-        path72.join(runDirPath, "walkthrough.json"),
+        path73.join(runDirPath, "walkthrough.json"),
         "utf8"
       );
       const manifest = JSON.parse(manifestRaw);
@@ -42964,7 +43281,7 @@ __export(summary_exports, {
   summaryCommand: () => summaryCommand
 });
 import { promises as fs71 } from "fs";
-import path73 from "path";
+import path74 from "path";
 import chalk47 from "chalk";
 function endedFrom(value) {
   if (!value || typeof value !== "object") return void 0;
@@ -42995,7 +43312,7 @@ async function summaryCommand(runIdArg, opts) {
   let openQuestions = [];
   let setupNotes = [];
   let model = opts.model?.trim() || void 0;
-  const summaryPath = path73.join(runDirPath, "summary.json");
+  const summaryPath = path74.join(runDirPath, "summary.json");
   let blocked;
   let ended;
   try {
@@ -43015,7 +43332,7 @@ async function summaryCommand(runIdArg, opts) {
       if (opts.file === "-") {
         raw = await readStdinText();
       } else {
-        raw = await fs71.readFile(path73.resolve(projectRoot, opts.file), "utf8");
+        raw = await fs71.readFile(path74.resolve(projectRoot, opts.file), "utf8");
       }
       const parsed = JSON.parse(raw);
       if (Array.isArray(parsed.what_worked)) {
@@ -43092,7 +43409,7 @@ async function summaryCommand(runIdArg, opts) {
       JSON.stringify(
         {
           run_id: runId,
-          path: path73.relative(projectRoot, summaryPath),
+          path: path74.relative(projectRoot, summaryPath),
           summary: data
         },
         null,
@@ -43154,7 +43471,7 @@ __export(advise_exports, {
   readAdvisePrompt: () => readAdvisePrompt
 });
 import { existsSync as existsSync23, promises as fs72 } from "fs";
-import path74 from "path";
+import path75 from "path";
 import chalk48 from "chalk";
 function readAdvisePrompt(projectRoot) {
   return readInstalledPrompt(projectRoot, "advise.md");
@@ -43212,7 +43529,7 @@ async function advise(runIdArg, opts = {}) {
     findings2 = input.findings.length;
     needed = findings2 >= 2;
     if (!needed) reason = "fewer than two open findings in the project";
-    promptPath = opts.promptFile ?? path74.join(analysisDir(projectRoot), "advise_prompt.md");
+    promptPath = opts.promptFile ?? path75.join(analysisDir(projectRoot), "advise_prompt.md");
   } else {
     const runId = resolveRunId(projectRoot, runIdArg ?? opts.run);
     if (!requireRunId(runId, opts, "iamu advise <run-id>")) return;
@@ -43223,12 +43540,12 @@ async function advise(runIdArg, opts = {}) {
     input = await buildAdviseInput(projectRoot, runId, manifest.scenario_slug);
     refsDir = runDirPath;
     findings2 = input.findings.length;
-    const advised = existsSync23(path74.join(runDirPath, ADVICE_FILE));
+    const advised = existsSync23(path75.join(runDirPath, ADVICE_FILE));
     needed = !manifest.blocked && findings2 > 0 && !advised;
     if (manifest.blocked) reason = "the run was blocked";
     else if (advised) reason = "the run is already advised";
     else if (findings2 === 0) reason = "no open findings to advise";
-    promptPath = opts.promptFile ?? path74.join(runDirPath, "advise_prompt.md");
+    promptPath = opts.promptFile ?? path75.join(runDirPath, "advise_prompt.md");
   }
   if (needed) input = await withCodeIndex(projectRoot, input);
   const { bundle, refs: refs2 } = promptBundle(input);
@@ -43238,11 +43555,11 @@ async function advise(runIdArg, opts = {}) {
     promptSizeWarning(prompt)
   ].filter((w) => w !== null) : [];
   if (prompt) {
-    await fs72.mkdir(path74.dirname(promptPath), { recursive: true });
+    await fs72.mkdir(path75.dirname(promptPath), { recursive: true });
     await fs72.writeFile(promptPath, prompt, "utf8");
     await fs72.mkdir(refsDir, { recursive: true });
     await fs72.writeFile(
-      path74.join(refsDir, ADVISE_REFS_FILE),
+      path75.join(refsDir, ADVISE_REFS_FILE),
       `${JSON.stringify(refs2, null, 2)}
 `,
       "utf8"
@@ -43257,8 +43574,8 @@ async function advise(runIdArg, opts = {}) {
           ...reason ? { reason } : {},
           mode: opts.project ? "project" : "run",
           findings: findings2,
-          prompt_file: prompt ? path74.relative(projectRoot, promptPath).split(path74.sep).join("/") : null,
-          prompt_file_abs: prompt ? path74.resolve(promptPath) : null,
+          prompt_file: prompt ? path75.relative(projectRoot, promptPath).split(path75.sep).join("/") : null,
+          prompt_file_abs: prompt ? path75.resolve(promptPath) : null,
           prompt_chars: prompt?.length ?? 0,
           warnings,
           advise_prompt: prompt
@@ -43334,7 +43651,7 @@ async function adviseRecord(runIdArg, opts) {
   const { projectRoot } = ctx;
   if (opts.project) {
     const input2 = await readAnswerInput(opts, "advice", {
-      defaultPath: path74.join(analysisDir(projectRoot), "answer.json"),
+      defaultPath: path75.join(analysisDir(projectRoot), "answer.json"),
       code: "missing_advice_input",
       fix: "iamu advise-record --project --data '<json>'"
     });
@@ -43366,7 +43683,7 @@ async function adviseRecord(runIdArg, opts) {
   if (!manifest) return;
   await logTiming(runDirPath, "advise-record", "start");
   const input = await readAnswerInput(opts, "advice", {
-    defaultPath: path74.join(runDir(projectRoot, runId), "advise_answer.json"),
+    defaultPath: path75.join(runDir(projectRoot, runId), "advise_answer.json"),
     code: "missing_advice_input",
     fix: `iamu advise-record ${runId} --data '<json>'`
   });
@@ -43416,7 +43733,7 @@ async function directionsList(opts) {
           problem: d.texts.problem,
           change: d.texts.change,
           leading_practice: d.texts.leading_practice,
-          path: path74.relative(ctx.projectRoot, d.path)
+          path: path75.relative(ctx.projectRoot, d.path)
         })),
         null,
         2
@@ -43565,7 +43882,7 @@ __export(designer_exports, {
   designerRecord: () => designerRecord
 });
 import { promises as fs73 } from "fs";
-import path75 from "path";
+import path76 from "path";
 import chalk49 from "chalk";
 import { ZodError as ZodError3 } from "zod";
 function describeError(err) {
@@ -43585,7 +43902,7 @@ async function designer(runId, opts = {}) {
   const { projectRoot, runDirPath } = ctx;
   if (!await completedManifest2(runDirPath, runId, opts)) return;
   const input = await buildRunDesignerInput(projectRoot, runId);
-  const promptPath = path75.join(runDirPath, DESIGNER_PROMPT_FILE);
+  const promptPath = path76.join(runDirPath, DESIGNER_PROMPT_FILE);
   const prompt = input.needed ? composeDesignPrompt(
     projectRoot,
     "designer.md",
@@ -43594,7 +43911,7 @@ async function designer(runId, opts = {}) {
   if (prompt) {
     await fs73.writeFile(promptPath, prompt, "utf8");
     await fs73.writeFile(
-      path75.join(runDirPath, DESIGNER_REFS_FILE),
+      path76.join(runDirPath, DESIGNER_REFS_FILE),
       `${JSON.stringify(input.refs, null, 2)}
 `,
       "utf8"
@@ -43605,7 +43922,7 @@ async function designer(runId, opts = {}) {
     installedPromptWarning(projectRoot, "designer.md"),
     ...input.warnings
   ].filter((w) => w !== null) : [];
-  const answer = path75.join(runDirPath, DESIGNER_ANSWER_FILE);
+  const answer = path76.join(runDirPath, DESIGNER_ANSWER_FILE);
   const result = {
     needed: input.needed,
     reason: input.reason,
@@ -43621,11 +43938,11 @@ async function designer(runId, opts = {}) {
       title: f.title
     })),
     design_files: (input.bundle.design?.files ?? []).map((f) => f.entry),
-    prompt_file: prompt ? path75.relative(projectRoot, promptPath).split(path75.sep).join("/") : null,
+    prompt_file: prompt ? path76.relative(projectRoot, promptPath).split(path76.sep).join("/") : null,
     prompt_file_abs: prompt ? promptPath : null,
     prompt_chars: prompt?.length ?? 0,
     answer_file_abs: prompt ? answer : null,
-    next: prompt ? `Give a fresh agent ${path75.relative(projectRoot, promptPath)} as its only context, then record its answer: iamu designer-record ${runId} --data '<answer JSON>' (or --file <path>)` : null,
+    next: prompt ? `Give a fresh agent ${path76.relative(projectRoot, promptPath)} as its only context, then record its answer: iamu designer-record ${runId} --data '<answer JSON>' (or --file <path>)` : null,
     hint: input.judged_against === "general-craft" ? await designDocsHint(projectRoot) : null,
     // No design doc recorded or found, and the template not declined:
     // the run summary offers to start one (iamu-design).
@@ -43671,6 +43988,9 @@ function printDesignerRecord(res) {
       `  ${chalk49.cyan("\u25C6")} Proposed doc edit ${p.outcome}: ${p.slug} (iamu design proposals)`
     );
   }
+  for (const slug of res.verified ?? []) {
+    console.log(`  ${chalk49.green("\u2713")} Fix verified: ${slug}`);
+  }
   for (const r of res.rejected) {
     console.log(`  ${chalk49.yellow("!")} Dropped ${r.id}: ${r.reason}`);
   }
@@ -43756,7 +44076,7 @@ async function designerRecordLocked(projectRoot, runDirPath, runId, manifest, op
     return;
   }
   const input = await readAnswerInput(opts, "designer's review", {
-    defaultPath: path75.join(runDirPath, DESIGNER_ANSWER_FILE),
+    defaultPath: path76.join(runDirPath, DESIGNER_ANSWER_FILE),
     code: "missing_designer_answer",
     fix: `iamu designer-record ${runId} --data '<json>'`
   });
@@ -43888,7 +44208,7 @@ __export(post_walk_exports, {
   postWalk: () => postWalk
 });
 import { existsSync as existsSync24, promises as fs74 } from "fs";
-import path76 from "path";
+import path77 from "path";
 import chalk50 from "chalk";
 async function captureStageJson(fn) {
   const captured = [];
@@ -43931,7 +44251,7 @@ async function postWalk(runIdArg, opts = {}) {
   }
   const runDirPath = requireRun(projectRoot, runId, opts);
   if (!runDirPath) return;
-  const manifestPath = path76.join(runDirPath, "walkthrough.json");
+  const manifestPath = path77.join(runDirPath, "walkthrough.json");
   let manifest;
   try {
     manifest = JSON.parse(
@@ -43972,7 +44292,7 @@ async function postWalk(runIdArg, opts = {}) {
     return;
   }
   const recordedNow = [];
-  const matchesAnswerPath = path76.join(runDirPath, MATCH_ANSWER_FILE);
+  const matchesAnswerPath = path77.join(runDirPath, MATCH_ANSWER_FILE);
   if (existsSync24(matchesAnswerPath)) {
     const res = await captureStageJson(
       () => matchRecord(runId, { file: matchesAnswerPath, json: true })
@@ -43983,7 +44303,7 @@ async function postWalk(runIdArg, opts = {}) {
       });
     }
   }
-  const judgeAnswerPath = path76.join(runDirPath, "judge_answer.json");
+  const judgeAnswerPath = path77.join(runDirPath, "judge_answer.json");
   if (existsSync24(judgeAnswerPath)) {
     const res = await captureStageJson(
       () => evaluateRecord(runId, { file: judgeAnswerPath, json: true })
@@ -43994,8 +44314,8 @@ async function postWalk(runIdArg, opts = {}) {
       });
     }
   }
-  const adviseAnswerPath = path76.join(runDirPath, "advise_answer.json");
-  if (!opts.critic && !existsSync24(path76.join(runDirPath, ADVICE_FILE)) && existsSync24(adviseAnswerPath)) {
+  const adviseAnswerPath = path77.join(runDirPath, "advise_answer.json");
+  if (!opts.critic && !existsSync24(path77.join(runDirPath, ADVICE_FILE)) && existsSync24(adviseAnswerPath)) {
     const res = await captureStageJson(
       () => adviseRecord(runId, { file: adviseAnswerPath, json: true })
     );
@@ -44005,7 +44325,7 @@ async function postWalk(runIdArg, opts = {}) {
       });
     }
   }
-  const designerAnswerPath = path76.join(runDirPath, DESIGNER_ANSWER_FILE);
+  const designerAnswerPath = path77.join(runDirPath, DESIGNER_ANSWER_FILE);
   let designerWarnings = [];
   let designerInvalidChecked = [];
   if (!existingDesignerFile(runDirPath)) {
@@ -44037,9 +44357,9 @@ async function postWalk(runIdArg, opts = {}) {
     }
   }
   const matchInfo = await captureStageJson(() => match(runId, { json: true }));
-  const evalRecorded = existsSync24(path76.join(runDirPath, "verdicts.json"));
+  const evalRecorded = existsSync24(path77.join(runDirPath, "verdicts.json"));
   const evalInfo = evalRecorded ? null : await captureStageJson(() => evaluate(runId, { json: true }));
-  const adviseRecorded = existsSync24(path76.join(runDirPath, ADVICE_FILE));
+  const adviseRecorded = existsSync24(path77.join(runDirPath, ADVICE_FILE));
   const awaitingJudge = !opts.critic && !adviseRecorded && !evalRecorded;
   const adviseInfo = opts.critic || adviseRecorded || awaitingJudge ? null : await captureStageJson(() => advise(runId, { json: true }));
   const designerRecorded = Boolean(existingDesignerFile(runDirPath));
@@ -44538,7 +44858,10 @@ function registerFindingsCommands(program) {
   program.command("triage [findings...]").helpGroup("Findings:").description("Set findings' triage status").requiredOption(
     "--status <status>",
     "open, addressed, dismissed, deferred or wont_fix"
-  ).option("--note <text>", "Optional triage note or reason").option(
+  ).option(
+    "--note <text>",
+    "Triage note, any status. For addressed: one line on what changed on screen, so the next run's matcher can confirm the fix"
+  ).option("--note-file <path>", "Read the note from a file (- reads stdin)").option(
     "--reason <reason>",
     "Dismiss reason: not_relevant (default), walker_error, out_of_scope or duplicate"
   ).option(
@@ -44555,7 +44878,7 @@ function registerFindingsCommands(program) {
     "Project-wide sweep ('we never want X'): dismiss all matching open persona & designer findings across every scenario/surface and record a project-wide guidance rule"
   ).option("--no-guidance", "Dismiss without writing a tester guidance rule").option("--json", "Output as JSON").addHelpText(
     "after",
-    "\nDismissing as not_relevant, walker_error, or out_of_scope teaches the walker: it writes a\ntester guidance rule (skip it with --no-guidance)."
+    '\nDismissing as not_relevant, walker_error, or out_of_scope teaches the walker: it writes a\ntester guidance rule (skip it with --no-guidance).\n\nExamples:\n  $ iamu triage <finding> --status addressed --note "Icons on /orders now carry text labels"\n  $ iamu triage <finding> --status dismissed --reason walker_error --note "<why>"'
   ).action(
     async (refs2, opts) => {
       const { triage: triage2 } = await Promise.resolve().then(() => (init_triage(), triage_exports));
@@ -44654,9 +44977,9 @@ function registerProjectCommands(program) {
     "after",
     "\nExamples:\n  $ iamu validate --all\n  $ iamu validate --all --fix --dry-run\n  $ iamu validate iamu/personas/maria.md"
   ).action(
-    async (path77, opts) => {
+    async (path78, opts) => {
       const { validate: validate2 } = await Promise.resolve().then(() => (init_validate(), validate_exports));
-      await validate2(path77, opts);
+      await validate2(path78, opts);
     }
   );
   program.command("update").helpGroup("Project:").description("Update and repair agent skills and prompts to latest version").option(