@nathapp/nax 0.82.1 → 0.82.2

package/dist/nax.js

@@ -2668,7 +2668,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@nathapp/nax",
-    version: "0.82.1",
+    version: "0.82.2",
     description: "AI Coding Agent Orchestrator \u2014 loops until done",
     type: "module",
     bin: {
@@ -18398,10 +18398,26 @@ function isNaxConfigFile(root, resolved) {
   return segments.length === 2 || segments.length >= 4 && segments[1] === "mono";
 }
 function isNaxOwnedWritePath(rel) {
+  return naxOwnedKind(rel) !== undefined;
+}
+function naxOwnedKind(rel) {
   const segments = rel.split("/");
   if (segments.length === 1 && QUEUE_CONTROL_FILES.has(segments[0] ?? ""))
-    return true;
-  return segments[0] === ".nax" && segments[1] === "features" && segments[segments.length - 1] === "prd.json";
+    return "queue";
+  if (segments[0] === ".nax" && segments[1] === "features" && segments[segments.length - 1] === "prd.json") {
+    return "prd";
+  }
+  return;
+}
+function naxOwnedBashRefusal(tool, kind, hit, verb) {
+  switch (kind) {
+    case "prd":
+      return `${tool} command ${verb} "${hit}", which holds this story's acceptance criteria. ` + "nax updates it itself during the run, so it shows as modified. " + "Bash commands naming it are refused, reads included -- leave it as is. " + "To view it, use the `Read` tool.";
+    case "queue":
+      return `${tool} command ${verb} "${hit}", which is nax's run-control queue. ` + "Bash commands naming it are refused, reads included -- change the run through the queue command.";
+    case "config":
+      return `${tool} command ${verb} "${hit}", which is nax configuration. ` + "Bash commands naming it are refused, reads included -- nax configuration is not changed from inside a run.";
+  }
 }
 function naxOwnedWriteRefusal(tool, rel, exemptRel) {
   if (!NAX_OWNED_WRITE_TOOLS.has(tool))
@@ -19566,7 +19582,7 @@ function capitalize(text) {
   return text.charAt(0).toUpperCase() + text.slice(1);
 }
 function escalateDescription(shell, patterns) {
-  return `Run one shell command string under ${shell}. ${PREFER_STRUCTURED_TOOLS_SENTENCE}` + `${capitalize(describeGrants(patterns))}. A command whose every segment matches a granted form is checked further: paths ` + "and redirect targets must stay inside the repository root, and `.git/` access, denied flags, unexpanded " + "`$VAR`, glob or brace characters, `~`, and a bare or option-shaped `cd` are refused without asking. A command " + "outside the granted forms, or one using a construct that cannot be analysed (e.g. command or process " + "substitution, backticks, here-documents, subshells, `2>&1`, `#` comments), is not refused: it is sent to a " + "human for approval (unless an identical command was already approved and remembered) and, if they allow it, " + "runs exactly as written; it is refused if they deny it or do not answer in time, so prefer the granted forms. A command matching a deny rule is refused without asking unless it cannot " + "be analysed. Each segment of a `&&`/`||`/`;`/`|` chain is checked separately. " + BACKGROUND_PROCESSES_KILLED_SENTENCE;
+  return `Run one shell command string under ${shell}. ${PREFER_STRUCTURED_TOOLS_SENTENCE}` + `${capitalize(describeGrants(patterns))}. Every command, granted or not, is checked first: paths ` + "and redirect targets must stay inside the repository root, and `.git/` access, denied flags, unexpanded " + "`$VAR`, glob or brace characters, `~`, a bare `cd`, and a command matching a deny rule are " + "refused without asking. For a command using a construct that cannot be analysed (e.g. command or process " + "substitution, backticks, here-documents, subshells, `2>&1`, `#` comments, an option-shaped `cd`), these " + "checks cover the part before that construct. A command outside the granted forms, or one using a construct " + "that cannot be analysed, is not refused: it is sent to a human for approval (unless an identical command " + "was already approved and remembered) and, if they allow it, runs exactly as written; it is refused if they " + "deny it or do not answer in time, so prefer the granted forms. Each segment of a `&&`/`||`/`;`/`|` chain is " + "checked separately. " + BACKGROUND_PROCESSES_KILLED_SENTENCE;
 }
 function rawDescription(shell, containment = RAW_UNCONTAINED) {
   return `Run one shell command string under ${shell}. ${PREFER_STRUCTURED_TOOLS_SENTENCE}` + "This stage runs under raw mode (ADR-030): pipes, redirects, command substitution ($(...), backticks), " + "process substitution, here-documents and subshells all work here -- nothing is refused for being unparseable, " + "and Bash allow/deny/ask rules configured for this stage are NOT consulted. " + containment + "The only refusal is a command the lexer CAN parse that names or redirects into one of the exact file " + "paths nax owns -- .nax/config.json, .nax/mono/*/config.json, " + ".nax/features/**/prd.json, or the root queue-control files -- change those through nax rather than by " + "writing them directly. That screen is advisory, not a boundary: it matches exact file paths only, so a " + "command using command substitution, a directory target (cp x .nax/), a glob, a nested shell (sh -c '...'), " + "tar -C or dd of=, or a symlink alias all skip it; use the sandbox for a boundary. " + BACKGROUND_PROCESSES_KILLED_SENTENCE;
@@ -19779,6 +19795,46 @@ var init_delete = __esm(() => {
   };
 });
 
+// src/tools/edit-region.ts
+function countNewlines(text) {
+  let count = 0;
+  for (let i = 0;i < text.length; i += 1) {
+    if (text[i] === `
+`)
+      count += 1;
+  }
+  return count;
+}
+function composeEditRegion({ updated, matchIndex, newStringLength }) {
+  const lines = splitModelLines(updated);
+  const total = lines.length;
+  if (total === 0)
+    return "[file is now empty]";
+  const start = Math.min(total, 1 + countNewlines(updated.slice(0, matchIndex)));
+  const end = newStringLength > 0 ? Math.min(total, 1 + countNewlines(updated.slice(0, matchIndex + newStringLength - 1))) : start;
+  const a = Math.max(1, start - CONTEXT_LINES);
+  const b = Math.min(total, end + CONTEXT_LINES);
+  const header = `[lines ${a}-${b} of ${total}]`;
+  const selected = end - start + 1 > MAX_REGION_LINES_SHOWN ? [
+    ...lines.slice(a - 1, start + 2),
+    `[... lines ${start + 3}-${end - 3} not shown ...]`,
+    ...lines.slice(end - 3, b)
+  ] : lines.slice(a - 1, b);
+  let view = [header, ...selected].join(`
+`);
+  while (view.endsWith(`
+`))
+    view = view.slice(0, -1);
+  return view;
+}
+function replaceUniqueLiteral(source, oldString, newString, matchIndex) {
+  return source.slice(0, matchIndex) + newString + source.slice(matchIndex + oldString.length);
+}
+var CONTEXT_LINES = 3, MAX_REGION_LINES_SHOWN = 8;
+var init_edit_region = __esm(() => {
+  init_truncate();
+});
+
 // src/tools/edit.ts
 import { readFile, stat, writeFile } from "fs/promises";
 function countOccurrences(haystack, needle) {
@@ -19792,11 +19848,17 @@ function countOccurrences(haystack, needle) {
   }
   return count;
 }
-var editTool;
+var _editDeps, editTool;
 var init_edit = __esm(() => {
+  init_edit_region();
+  _editDeps = {
+    stat: (path) => stat(path),
+    readFile: (path, encoding) => readFile(path, encoding),
+    writeFile: (path, data, encoding) => writeFile(path, data, encoding)
+  };
   editTool = {
     name: "Edit",
-    description: "Replace one exact occurrence of old_string with new_string in a repository file. Fails if the match is absent or ambiguous.",
+    description: "Replace one exact occurrence of old_string with new_string in a repository file. Fails if the match is absent or ambiguous. On success the result shows the edited lines with up to 3 lines of context and their line range, so you do not need to Read the file again to check the edit.",
     inputSchema: {
       type: "object",
       properties: {
@@ -19817,7 +19879,7 @@ var init_edit = __esm(() => {
         return { content: "old_string and new_string must be strings", isError: true };
       }
       try {
-        const { size } = await stat(target);
+        const { size } = await _editDeps.stat(target);
         if (size > ctx.maxFileBytes) {
           return {
             content: `the file is ${size} bytes, which exceeds the ${ctx.maxFileBytes}-byte file ceiling -- refusing to edit ${target}`,
@@ -19829,7 +19891,7 @@ var init_edit = __esm(() => {
       }
       let source;
       try {
-        source = await readFile(target, "utf8");
+        source = await _editDeps.readFile(target, "utf8");
       } catch (err) {
         return { content: err instanceof Error ? err.message : String(err), isError: true };
       }
@@ -19844,8 +19906,12 @@ var init_edit = __esm(() => {
         };
       }
       try {
-        await writeFile(target, source.replace(oldString, newString), "utf8");
-        return { content: `edited ${target}` };
+        const matchIndex = source.indexOf(oldString);
+        const updated = replaceUniqueLiteral(source, oldString, newString, matchIndex);
+        await _editDeps.writeFile(target, updated, "utf8");
+        const region = composeEditRegion({ updated, matchIndex, newStringLength: newString.length });
+        return { content: `edited ${target}
+${region}` };
       } catch (err) {
         return { content: err instanceof Error ? err.message : String(err), isError: true };
       }
@@ -20927,9 +20993,6 @@ var ASK_NO_CHANNEL_REASON = "matched an ask rule requiring human approval; no ap
 var init_ask = () => {};
 
 // src/permissions/bash-lex.ts
-function refused(construct) {
-  return { kind: "refused", construct };
-}
 function doubleQuoteEnd(command, from) {
   for (let i = from;i < command.length; i += 1) {
     const char = command[i];
@@ -20944,7 +21007,7 @@ function doubleQuoteEnd(command, from) {
 }
 function lexBashCommand(command) {
   if (command.trim() === "")
-    return refused("an empty command");
+    return { kind: "refused", construct: "an empty command", prefix: [] };
   const segments = [];
   let tokens = [];
   let redirects = [];
@@ -20952,6 +21015,10 @@ function lexBashCommand(command) {
   let opaque = false;
   let started = false;
   let pendingRedirect;
+  function refusedHere(construct) {
+    const prefix = tokens.length === 0 && redirects.length === 0 ? [...segments] : [...segments, { tokens, redirects }];
+    return { kind: "refused", construct, prefix };
+  }
   function flushWord() {
     if (!started)
       return;
@@ -20983,7 +21050,7 @@ function lexBashCommand(command) {
     if (char === "'") {
       const end = command.indexOf("'", i + 1);
       if (end === -1)
-        return refused("an unbalanced single quote");
+        return refusedHere("an unbalanced single quote");
       word += command.slice(i + 1, end);
       started = true;
       i = end + 1;
@@ -20992,12 +21059,12 @@ function lexBashCommand(command) {
     if (char === '"') {
       const end = doubleQuoteEnd(command, i + 1);
       if (end === -1)
-        return refused("an unbalanced double quote");
+        return refusedHere("an unbalanced double quote");
       const inner = command.slice(i + 1, end);
       if (inner.includes("$("))
-        return refused("a command substitution `$(...)`");
+        return refusedHere("a command substitution `$(...)`");
       if (inner.includes("`"))
-        return refused("a backtick command substitution");
+        return refusedHere("a backtick command substitution");
       if (inner.includes("$"))
         opaque = true;
       word += inner;
@@ -21007,32 +21074,32 @@ function lexBashCommand(command) {
     }
     if (char === "\\") {
       if (next === undefined)
-        return refused("a trailing backslash");
+        return refusedHere("a trailing backslash");
       word += next;
       started = true;
       i += 2;
       continue;
     }
     if (char === "(" || char === ")")
-      return refused("a subshell `( ... )`");
+      return refusedHere("a subshell `( ... )`");
     if (char === "!" && !started)
-      return refused("a `!` negation");
+      return refusedHere("a `!` negation");
     if (char === "#" && !started)
-      return refused("a `#` comment");
+      return refusedHere("a `#` comment");
     if (char === "$" && next === "(")
-      return refused("a command substitution `$(...)`");
+      return refusedHere("a command substitution `$(...)`");
     if (char === "`")
-      return refused("a backtick command substitution");
+      return refusedHere("a backtick command substitution");
     if ((char === "<" || char === ">") && next === "(") {
-      return refused("a process substitution `<(...)` / `>(...)`");
+      return refusedHere("a process substitution `<(...)` / `>(...)`");
     }
     if (char === "<" && next === "<")
-      return refused("a here-document `<<`");
+      return refusedHere("a here-document `<<`");
     if ((char === "<" || char === ">") && next === "&") {
-      return refused("file-descriptor duplication (`2>&1`)");
+      return refusedHere("file-descriptor duplication (`2>&1`)");
     }
     if (char === "&" && next === ">")
-      return refused("the `&>` redirection form");
+      return refusedHere("the `&>` redirection form");
     if (char === "$") {
       opaque = true;
       word += char;
@@ -21049,21 +21116,21 @@ function lexBashCommand(command) {
 ` || char === ";") {
       const error49 = flushSegment(";");
       if (error49 !== undefined)
-        return refused(error49);
+        return refusedHere(error49);
       i += 1;
       continue;
     }
     if (char === "&" && next === "&" || char === "|" && next === "|") {
       const error49 = flushSegment(char === "&" ? "&&" : "||");
       if (error49 !== undefined)
-        return refused(error49);
+        return refusedHere(error49);
       i += 2;
       continue;
     }
     if (char === "|" || char === "&") {
       const error49 = flushSegment(char);
       if (error49 !== undefined)
-        return refused(error49);
+        return refusedHere(error49);
       i += 1;
       continue;
     }
@@ -21088,7 +21155,7 @@ function lexBashCommand(command) {
   }
   const error48 = flushSegment();
   if (error48 !== undefined)
-    return refused(error48);
+    return refusedHere(error48);
   return { kind: "ok", segments };
 }
 
@@ -21219,7 +21286,9 @@ function checkPayload(args, segment, cwd) {
     case "no-target":
       return { refusal: deny("`cd` with no target is refused") };
     case "option-shaped":
-      return { refusal: deny(`cd target "${cdResult.text}" is option-shaped, and this gate does not model it`) };
+      return {
+        refusal: deny(`cd target "${cdResult.text}" is option-shaped, and this gate does not model it`, false, true)
+      };
     case "opaque":
     case "unresolved":
       return { refusal: deny(`cd target "${cdResult.text}" is not inside the permitted root`, true) };
@@ -21256,29 +21325,30 @@ function checkBashCommand(args) {
   if (command.trim() === "")
     return deny(`"command" must not be empty`);
   const lexed = lexBashCommand(command);
-  if (lexed.kind === "refused") {
-    return deny(`command contains ${lexed.construct}, which cannot be analysed and is therefore refused -- ` + "rewrite it without that construct, or use a structured tool", false, true);
-  }
-  for (const segment of lexed.segments) {
+  const segments = lexed.kind === "ok" ? lexed.segments : lexed.prefix;
+  for (const segment of segments) {
     if (args.denyEntry !== undefined && matchesSegment(args.denyEntry, segment)) {
       return deny(`${tool} segment "${render(segment)}" is denied for this stage by rule ${ruleExpr(tool, args.denyEntry, segment)}`);
     }
   }
-  for (const segment of lexed.segments) {
-    if (args.grant.unconditional || matchesSegment(args.grant, segment))
-      continue;
-    const granted = args.grant.raw.filter((pattern) => pattern !== "*").join(", ");
-    const alternatives = granted === "" ? "no command forms are granted for this stage" : `granted forms: ${granted}`;
-    return deny(`${tool} is not granted "${render(segment)}" -- ${alternatives}`, false, true);
-  }
   let cwd = [args.initialPath];
-  for (const segment of lexed.segments) {
+  for (const segment of segments) {
     const result = checkPayload(args, segment, cwd);
     if (result.refusal !== undefined)
       return result.refusal;
     cwd = nextWorkingDirectories(segment, cwd, result.cdTargets);
   }
-  for (const segment of lexed.segments) {
+  if (lexed.kind === "refused") {
+    return deny(`command contains ${lexed.construct}, which cannot be analysed and is therefore refused -- ` + "rewrite it without that construct, or use a structured tool", false, true);
+  }
+  for (const segment of segments) {
+    if (args.grant.unconditional || matchesSegment(args.grant, segment))
+      continue;
+    const granted = args.grant.raw.filter((pattern) => pattern !== "*").join(", ");
+    const alternatives = granted === "" ? "no command forms are granted for this stage" : `granted forms: ${granted}`;
+    return deny(`${tool} is not granted "${render(segment)}" -- ${alternatives}`, false, true);
+  }
+  for (const segment of segments) {
     if (args.askEntry !== undefined && matchesSegment(args.askEntry, segment)) {
       return { kind: "ask", rule: ruleExpr(tool, args.askEntry, segment) };
     }
@@ -21299,15 +21369,16 @@ function protectedHit(args, candidate, cwd) {
   for (const directory of cwd) {
     const lexical = realOrRaw(resolve10(directory, candidate));
     if (isNaxConfigFile(args.root, lexical))
-      return candidate;
+      return { kind: "config", hit: candidate };
     const resolved = args.resolvePath(candidate, directory);
     if (resolved === null)
       continue;
     const rel = relative5(args.root, resolved).split(sep4).join("/");
     if (rel.startsWith(".."))
       continue;
-    if (isNaxOwnedWritePath(rel))
-      return candidate;
+    const kind = naxOwnedKind(rel);
+    if (kind !== undefined)
+      return { kind, hit: candidate };
   }
   return;
 }
@@ -21327,7 +21398,7 @@ function screenRawBashCommand(args) {
         continue;
       const hit = protectedHit(args, token.text, cwd);
       if (hit !== undefined) {
-        return deny2(`${tool} command names "${hit}", which nax owns and no tool may modify -- ` + "change it through nax rather than by writing its file");
+        return deny2(naxOwnedBashRefusal(tool, hit.kind, hit.hit, "names"));
       }
     }
     for (const redirect of segment.redirects) {
@@ -21335,7 +21406,7 @@ function screenRawBashCommand(args) {
         continue;
       const hit = protectedHit(args, redirect.target, cwd);
       if (hit !== undefined) {
-        return deny2(`${tool} command redirects into "${hit}", which nax owns and no tool may modify -- ` + "change it through nax rather than by writing its file");
+        return deny2(naxOwnedBashRefusal(tool, hit.kind, hit.hit, "redirects into"));
       }
     }
     const cdResult = cdTargetsFor(segment, cwd, args.resolvePath);
@@ -22593,6 +22664,47 @@ var init_provider_advertise = __esm(() => {
   init_provider_types();
 });
 
+// src/tools/read-continuation.ts
+function limitStopFooter(input) {
+  const { nextOffset, totalIsFloor, endLine, totalLines } = input;
+  const remaining = Math.max(0, totalLines - endLine);
+  const countLabel = totalIsFloor ? `${remaining}+` : `${remaining}`;
+  return `[${countLabel} more lines in file. Use offset=${nextOffset} to continue.]`;
+}
+function shouldAppendLimitStopFooter(hasLimit, endLine, totalLines) {
+  return hasLimit && endLine < totalLines;
+}
+function capFooter(input) {
+  const { firstLine: firstLine2, lastLine, totalLabel } = input;
+  return `[Showing lines ${firstLine2}-${lastLine} of ${totalLabel}. Use offset=${lastLine + 1} to continue.]`;
+}
+function applyCapCut(input) {
+  const { header, lines, firstLine: firstLine2, totalLabel, limitStopFooter: limitStopFooter2, unshapedBody, maxBytes, maxLines } = input;
+  const candidate = limitStopFooter2 === "" ? unshapedBody : `${unshapedBody}
+${limitStopFooter2}`;
+  if (splitModelLines(candidate).length <= maxLines && Buffer.byteLength(candidate, "utf8") <= maxBytes) {
+    return { content: candidate };
+  }
+  for (let k = Math.min(lines.length, maxLines - 2);k >= 1; k -= 1) {
+    if (1 + k + 1 > maxLines)
+      continue;
+    const lastLine = firstLine2 + k - 1;
+    const footer = capFooter({ firstLine: firstLine2, lastLine, totalLabel });
+    const bodyJoined = lines.slice(0, k).join(`
+`);
+    const cut = `${header}
+${bodyJoined}
+${footer}`;
+    if (Buffer.byteLength(cut, "utf8") <= maxBytes) {
+      return { content: cut };
+    }
+  }
+  return { content: candidate };
+}
+var init_read_continuation = __esm(() => {
+  init_truncate();
+});
+
 // src/tools/read.ts
 function parsePositiveInt(value, field) {
   if (typeof value !== "number" || !Number.isInteger(value))
@@ -22612,11 +22724,12 @@ function countLines(prefix) {
 var UNSUPPORTED_RANGE_ALIASES, readTool;
 var init_read = __esm(() => {
   init_bounded_io();
+  init_read_continuation();
   init_truncate();
   UNSUPPORTED_RANGE_ALIASES = ["start_line", "end_line", "start", "end", "line", "lineEnd", "size"];
   readTool = {
     name: "Read",
-    description: "Read a UTF-8 text file from the repository. Paths are relative to the repository root. " + "Optionally pass offset (1-based line number to start from) and/or limit (maximum number of " + "lines to return) to read a slice instead of the whole file.",
+    description: "Read a UTF-8 text file from the repository. Paths are relative to the repository root. " + "Optionally pass offset (1-based line number to start from) and/or limit (maximum number of " + "lines to return) to read a slice instead of the whole file. " + "Use Read to examine files instead of cat, sed, head, tail or awk in Bash. " + "A read that stops before the end of the file ends with a line naming the offset to continue from. " + "For a large file, read the part you need with offset/limit; when you need the whole file, continue with offset until complete. " + `Output is capped at ${MODEL_MAX_LINES} lines or ${MODEL_MAX_BYTES} bytes.`,
     inputSchema: {
       type: "object",
       properties: {
@@ -22646,9 +22759,21 @@ var init_read = __esm(() => {
           const prefix = await readPrefix(target, readCeiling);
           const bounded2 = Buffer.byteLength(prefix, "utf8") > readCeiling;
           const lineCount = countLines(prefix);
-          const header2 = `[${bounded2 ? `${lineCount}+` : `${lineCount}`} lines]`;
-          return { content: prefix === "" ? header2 : `${header2}
-${prefix}` };
+          const totalLabel2 = bounded2 ? `${lineCount}+` : `${lineCount}`;
+          const header = `[${totalLabel2} lines]`;
+          const unshaped = prefix === "" ? header : `${header}
+${prefix}`;
+          const result2 = applyCapCut({
+            header,
+            lines: splitModelLines(prefix),
+            firstLine: 1,
+            totalLabel: totalLabel2,
+            limitStopFooter: "",
+            unshapedBody: unshaped,
+            maxBytes: ctx.maxBytes,
+            maxLines: MODEL_MAX_LINES
+          });
+          return { content: result2.content };
         }
         let offset = 1;
         if (hasOffset) {
@@ -22666,25 +22791,38 @@ ${prefix}` };
         }
         const body = await readPrefix(target, ctx.maxFileBytes);
         const bounded = Buffer.byteLength(body, "utf8") > ctx.maxFileBytes;
-        const trailingNewline = body.endsWith(`
-`);
-        const lines = trailingNewline ? body.slice(0, -1).split(`
-`) : body.split(`
-`);
-        const totalLines = lines.length;
+        const totalLines = countLines(body);
         const totalLabel = bounded ? `${totalLines}+` : `${totalLines}`;
         if (offset > totalLines) {
           return {
             content: bounded ? `offset ${offset} is past the first ${totalLines} lines, which is all that could be read within the ${ctx.maxFileBytes}-byte ceiling` : `offset ${offset} is past the end of the file -- it has ${totalLines} lines`
           };
         }
+        const lines = splitModelLines(body);
         const startIndex = offset - 1;
         const endLine = limit === undefined ? totalLines : Math.min(startIndex + limit, totalLines);
         const selected = lines.slice(startIndex, endLine).join(`
 `);
-        const header = `[lines ${offset}-${endLine} of ${totalLabel}]
-`;
-        return { content: `${header}${selected}` };
+        const headerLine = `[lines ${offset}-${endLine} of ${totalLabel}]`;
+        const limitStop = shouldAppendLimitStopFooter(limit !== undefined, endLine, totalLines) ? limitStopFooter({
+          nextOffset: endLine + 1,
+          totalIsFloor: bounded,
+          endLine,
+          totalLines
+        }) : "";
+        const unshapedBody = `${headerLine}
+${selected}`;
+        const result = applyCapCut({
+          header: headerLine,
+          lines: lines.slice(startIndex, endLine),
+          firstLine: offset,
+          totalLabel,
+          limitStopFooter: limitStop,
+          unshapedBody,
+          maxBytes: ctx.maxBytes,
+          maxLines: MODEL_MAX_LINES
+        });
+        return { content: result.content };
       } catch (err) {
         return { content: err instanceof Error ? err.message : String(err), isError: true };
       }
@@ -24199,7 +24337,7 @@ var init_scratchpad = __esm(() => {
   init_truncate();
   scratchpadWriteTool = {
     name: "ScratchpadWrite",
-    description: "Write a throwaway file to your scratchpad at .nax/scratchpad/. Use it for notes to yourself, command output you want to re-read, or intermediate lists. It is never committed and is wiped when a run finishes (a failed run's scratchpad is retained for inspection until the next run starts and clears it). Paths are relative to the scratchpad and cannot reach the repository.",
+    description: "Write a throwaway file to your scratchpad at .nax/scratchpad/. Use it for notes to yourself, command output you want to re-read, intermediate lists, or a probe script to run against the project's code. It is never committed and is wiped when a run finishes (a failed run's scratchpad is retained for inspection until the next run starts and clears it). Paths are relative to the scratchpad and cannot reach the repository.",
     inputSchema: {
       type: "object",
       properties: {
@@ -24441,33 +24579,97 @@ var init_spill = __esm(() => {
 // src/tools/tool-audit.ts
 import { mkdir as mkdir7, writeFile as writeFile5 } from "fs/promises";
 import { join as join15 } from "path";
+function registerToolAuditSink(runId, sink) {
+  const sinks = openToolAuditSinks.get(runId);
+  if (sinks === undefined) {
+    openToolAuditSinks.set(runId, new Set([sink]));
+    return;
+  }
+  sinks.add(sink);
+}
+function unregisterToolAuditSink(runId, sink) {
+  const sinks = openToolAuditSinks.get(runId);
+  if (sinks === undefined)
+    return;
+  sinks.delete(sink);
+  if (sinks.size === 0)
+    openToolAuditSinks.delete(runId);
+}
+async function flushOpenToolAuditSinks(runId) {
+  const sinks = openToolAuditSinks.get(runId);
+  if (sinks === undefined)
+    return;
+  openToolAuditSinks.delete(runId);
+  await Promise.all([...sinks].map(async (sink) => {
+    try {
+      await sink.flushPartial();
+    } catch (error48) {
+      getSafeLogger()?.warn("tools", "tool-audit partial flush failed", { runId, error: errorMessage(error48) });
+    }
+  }));
+}
 function createNoOpToolAuditSink() {
   return { record() {}, async flush() {} };
 }
+function nextFileStamp() {
+  const now = Date.now();
+  lastFileStamp = now > lastFileStamp ? now : lastFileStamp + 1;
+  return lastFileStamp;
+}
 function createToolAuditSink(opts) {
   const calls = [];
-  return {
+  const runId = opts.header?.runId;
+  let partialFlushed = false;
+  const write = async (partial2) => {
+    if (calls.length === 0)
+      return;
+    await mkdir7(opts.dir, { recursive: true });
+    const body = JSON.stringify({
+      schemaVersion: TOOL_AUDIT_SCHEMA_VERSION,
+      ...opts.header ?? {},
+      sessionName: opts.sessionName,
+      ...partial2 ? { partial: true } : {},
+      calls: redactRowStrings(calls)
+    }, null, 2);
+    const prefix = runId !== undefined ? `${runId}-` : "";
+    await writeFile5(join15(opts.dir, `${prefix}${nextFileStamp()}-${opts.sessionName}.json`), body);
+  };
+  const sink = {
     record(entry) {
+      if (partialFlushed) {
+        getSafeLogger()?.warn("tools", "tool-audit row recorded after the partial flush was dropped", {
+          runId,
+          tool: entry.tool
+        });
+        return;
+      }
       calls.push(entry);
     },
+    async flushPartial() {
+      if (partialFlushed)
+        return;
+      await write(true);
+      partialFlushed = true;
+      if (runId !== undefined)
+        unregisterToolAuditSink(runId, sink);
+    },
     async flush() {
-      if (calls.length === 0)
+      if (partialFlushed)
         return;
-      await mkdir7(opts.dir, { recursive: true });
-      const body = JSON.stringify({
-        schemaVersion: TOOL_AUDIT_SCHEMA_VERSION,
-        ...opts.header ?? {},
-        sessionName: opts.sessionName,
-        calls: redactRowStrings(calls)
-      }, null, 2);
-      const prefix = opts.header?.runId !== undefined ? `${opts.header.runId}-` : "";
-      await writeFile5(join15(opts.dir, `${prefix}${Date.now()}-${opts.sessionName}.json`), body);
+      if (runId !== undefined)
+        unregisterToolAuditSink(runId, sink);
+      await write(false);
     }
   };
+  if (runId !== undefined)
+    registerToolAuditSink(runId, sink);
+  return sink;
 }
-var TOOL_AUDIT_SCHEMA_VERSION = 1;
+var openToolAuditSinks, TOOL_AUDIT_SCHEMA_VERSION = 1, lastFileStamp = 0;
 var init_tool_audit = __esm(() => {
+  init_logger2();
   init_permissions();
+  openToolAuditSinks = new Map;
 });
 
 // src/tools/write.ts
@@ -24677,6 +24879,7 @@ function createCodingToolRuntime(opts) {
             tool: policyIdentity,
             stage: opts.pipelineStage ?? "unknown",
             rule: verdict.rule ?? verdict.reason,
+            ...verdict.rule !== undefined ? { matchedRule: verdict.rule } : {},
             summary: ask.summary,
             ...ask.unshowable ? { unshowable: true } : {},
             ...typeof input[tool.scope.commandField ?? ""] === "string" ? { command: input[tool.scope.commandField] } : {},
@@ -25605,7 +25808,9 @@ var init_config_guards = __esm(() => {
     "review.gateLLMChecksOnMechanicalPass": "LLM review checks are sequenced by the story orchestrator; this key never had an effect after #1859",
     debate: "the multi-agent debate subsystem was removed; a config that enabled debate.stages.plan without setting plan.mode was resolving to the debate plan strategy and now plans with `single` \u2014 set plan.mode explicitly to `single` or `refine`",
     "plan.citationThreshold": "this key only fed the removed pipeline plan mode",
-    "plan.criticModel": "this key only fed the removed pipeline plan mode"
+    "plan.criticModel": "this key only fed the removed pipeline plan mode",
+    "quality.autofix.enforceTestWriterIsolation": "the mock-structure handoff path this key guarded was removed in #1084; the key has had no effect since",
+    "prompts.overrides.single-session": "the single-session prompt role is not used by any run since fb3cfad3e; test-after stories use the tdd-simple role, so override tdd-simple instead"
   };
 });
 
@@ -26775,12 +26980,10 @@ var init_schemas_execution = __esm(() => {
     }).default({ format: "auto" }),
     autofix: exports_external.object({
       enabled: exports_external.boolean().default(true),
-      maxAttempts: exports_external.number().int().min(1).default(3),
-      enforceTestWriterIsolation: exports_external.boolean().default(true)
+      maxAttempts: exports_external.number().int().min(1).default(3)
     }).default({
       enabled: true,
-      maxAttempts: 3,
-      enforceTestWriterIsolation: true
+      maxAttempts: 3
     }),
     forceExit: exports_external.boolean().default(false),
     detectOpenHandles: exports_external.boolean().default(true),
@@ -26847,7 +27050,7 @@ var init_schemas_execution = __esm(() => {
 });
 
 // src/config/schemas-infra.ts
-var PlanConfigSchema, AcceptanceFixConfigSchema, AcceptanceConfigSchema, LlmRoutingConfigSchema, AgentRoutingProfileSchema, AgentRoutingConfigSchema, RoutingConfigSchema, OptimizerConfigSchema, PluginConfigEntrySchema, HooksConfigSchema, InteractionConfigSchema, StorySizeGateConfigSchema, PromptAuditConfigSchema, UsageAuditConfigSchema, FallbackTargetSchema, AgentFallbackConfigSchema, DEFAULT_AGENT_IDLE_WATCHDOG_CONFIG, AgentIdleWatchdogConfigSchema, DEFAULT_AGENT_SPIN_BREAKER_CONFIG, AgentSpinBreakerConfigSchema, AgentAcpConfigSchema, AgentNativeTransportRetryConfigSchema, AgentNativeConfigSchema, AgentTimeoutRetryConfigSchema, DEFAULT_AGENT_TIMEOUT_RETRY_CONFIG, AgentConfigSchema, PrecheckConfigSchema, PromptsConfigSchema, ProjectProfileSchema, VALID_AGENT_TYPES, GenerateConfigSchema, CuratorThresholdsSchema, CuratorRetentionConfigSchema, CuratorConfigSchema;
+var PlanConfigSchema, AcceptanceFixConfigSchema, AcceptanceConfigSchema, LlmRoutingConfigSchema, AgentRoutingProfileSchema, AgentRoutingConfigSchema, RoutingConfigSchema, OptimizerConfigSchema, PluginConfigEntrySchema, HooksConfigSchema, InteractionConfigSchema, StorySizeGateConfigSchema, PromptAuditConfigSchema, UsageAuditConfigSchema, FallbackTargetSchema, AgentFallbackConfigSchema, DEFAULT_AGENT_IDLE_WATCHDOG_CONFIG, AgentIdleWatchdogConfigSchema, DEFAULT_AGENT_SPIN_BREAKER_CONFIG, AgentSpinBreakerConfigSchema, AgentAcpConfigSchema, AgentNativeTransportRetryConfigSchema, AgentNativeConfigSchema, AgentTimeoutRetryConfigSchema, DEFAULT_AGENT_TIMEOUT_RETRY_CONFIG, AgentConfigSchema, PrecheckConfigSchema, PROMPT_OVERRIDE_ROLES, PromptsConfigSchema, ProjectProfileSchema, VALID_AGENT_TYPES, GenerateConfigSchema, CuratorThresholdsSchema, CuratorRetentionConfigSchema, CuratorConfigSchema;
 var init_schemas_infra = __esm(() => {
   init_zod();
   init_agent_defaults();
@@ -27098,10 +27301,19 @@ var init_schemas_infra = __esm(() => {
   PrecheckConfigSchema = exports_external.object({
     storySizeGate: StorySizeGateConfigSchema
   });
+  PROMPT_OVERRIDE_ROLES = ["no-test", "test-writer", "implementer", "verifier", "tdd-simple"];
   PromptsConfigSchema = exports_external.object({
-    overrides: exports_external.record(exports_external.string().refine((key) => ["no-test", "test-writer", "implementer", "verifier", "single-session", "tdd-simple"].includes(key), {
-      message: "Role must be one of: no-test, test-writer, implementer, verifier, single-session, tdd-simple"
-    }), exports_external.string().min(1, "Override path must be non-empty")).optional(),
+    overrides: exports_external.record(exports_external.string(), exports_external.string().min(1, "Override path must be non-empty")).superRefine((overrides, ctx) => {
+      for (const key of Object.keys(overrides)) {
+        if (!PROMPT_OVERRIDE_ROLES.includes(key)) {
+          ctx.addIssue({
+            code: "custom",
+            message: `Role must be one of: ${PROMPT_OVERRIDE_ROLES.join(", ")}`,
+            path: [key]
+          });
+        }
+      }
+    }).optional(),
     behavioralGuardrails: exports_external.enum(["off", "lite", "strict"]).default("lite")
   });
   ProjectProfileSchema = exports_external.object({
@@ -27477,7 +27689,7 @@ var init_schemas3 = __esm(() => {
       agents: { enabled: true, strategy: "off", profiles: [] }
     }),
     execution: ExecutionConfigSchema.default({
-      maxIterations: 10,
+      maxIterations: 20,
       iterationDelayMs: 2000,
       costLimit: 30,
       sessionTimeoutSeconds: 3600,
@@ -27522,8 +27734,7 @@ var init_schemas3 = __esm(() => {
       },
       autofix: {
         enabled: true,
-        maxAttempts: 3,
-        enforceTestWriterIsolation: true
+        maxAttempts: 3
       },
       forceExit: false,
       detectOpenHandles: true,
@@ -40501,23 +40712,6 @@ function lintDiagnosticToFinding(d, workdir, tool) {
 var init_lint = __esm(() => {
   init_path_utils();
 });
-// src/findings/adapters/semantic-review.ts
-function reviewFindingToFinding(f) {
-  return {
-    source: "semantic-review",
-    severity: f.severity,
-    category: f.category ?? "",
-    rule: f.ruleId,
-    file: f.file,
-    line: f.line,
-    column: f.column,
-    endLine: f.endLine,
-    endColumn: f.endColumn,
-    message: f.message,
-    fixTarget: "source"
-  };
-}
-
 // src/findings/adapters/test-failure.ts
 function testFailureToFinding(failure) {
   const frames = (failure.stackTrace ?? []).slice(0, MAX_FRAMES_IN_MESSAGE);
@@ -41362,7 +41556,7 @@ function buildBehavioralGuardrailsSection(role, level, _variant, _isolation) {
   if (role === "test-writer") {
     return buildTestWriterGuardrails(level);
   }
-  if (role === "single-session" || role === "tdd-simple" || role === "batch") {
+  if (role === "tdd-simple" || role === "batch") {
     return buildCombinedGuardrails(level);
   }
   return buildImplementerGuardrails(level);
@@ -41486,7 +41680,7 @@ ${body}`;
 }
 var HERMETIC_ROLES, LANGUAGE_GUIDANCE;
 var init_hermetic = __esm(() => {
-  HERMETIC_ROLES = new Set(["test-writer", "implementer", "tdd-simple", "batch", "single-session"]);
+  HERMETIC_ROLES = new Set(["test-writer", "implementer", "tdd-simple", "batch"]);
   LANGUAGE_GUIDANCE = {
     go: "Define interfaces for external dependencies. Use constructor injection. Test with interface mocks \u2014 no real I/O in tests.",
     rust: "Use trait objects or generics for external deps. Mock with the mockall crate. Use #[cfg(test)] modules.",
@@ -41682,11 +41876,6 @@ isolation scope: Implement source code in src/ to make tests pass. Do not modify
     return `${header}
 
 isolation scope: Read-only TDD integrity inspection. Review story-scoped test results and test-file modifications. Do NOT apply source or test fixes. You MAY write only the verdict file (.nax-verifier-verdict.json).${footer}`;
-  }
-  if (role === "single-session") {
-    return `${header}
-
-isolation scope: Create test files in test/ directory, then implement source code in src/ to make tests pass. Both directories are in scope for this session.${footer}`;
   }
   return `${header}
 
@@ -41727,7 +41916,11 @@ freely. Every other path under \`.nax/\` stays off limits.
 - A test under \`.nax/\` is NOT a reason to skip writing source-tree tests. \`.nax/\` is generated
   scaffolding, not real coverage of the package's code.
 - A source-tree test is NOT a reason to remove a test under \`.nax/\`. The two serve different
-  purposes and must coexist.`;
+  purposes and must coexist.
+
+nax updates \`.nax/features/<feature>/prd.json\` itself during a run, so it shows as modified in
+\`git status\` \u2014 do not diff or revert it: this story's criteria are already in this prompt, and if you
+need its contents, read it with the \`Read\` tool; shell commands that name it may be refused.`;
 }
 
 // src/prompts/sections/out-of-scope.ts
@@ -41891,25 +42084,6 @@ Instructions:
 - Do NOT perform semantic acceptance review; semantic/adversarial review stages own acceptance criteria and broad code-quality findings
 - Write a detailed verdict with reasoning
 - Goal: verify story-scoped tests pass and test integrity was preserved`;
-  }
-  if (role === "single-session") {
-    return `# Role: Single-Session
-
-Your task: write tests AND implement the feature in one session.
-
-Workflow:
-1. Read the acceptance criteria. For each AC, plan one success-path test and one boundary/failure test.
-2. Create test files in the location the project uses for tests. Cover every AC.
-3. Run the tests to confirm they fail with ASSERTION failures \u2014 NOT import errors or compile errors. A test that errors before reaching its assertion does not prove the behavior is missing.
-4. Implement source code in the package's source location to make the tests pass.
-5. After each meaningful change, re-run only the scoped test files \u2014 never the full suite.
-6. When all scoped tests pass, stage and commit ALL changed files: \`${gitCommitInstruction(commitMsg)}\`.
-
-Rules:
-- Each test name describes ONE behavior; use AC IDs when available.
-- Assert on observable outputs.
-- ${frameworkHint}
-- Goal: every AC has at least one passing test; all changes committed.`;
   }
   if (role === "batch") {
     const verifyCmdLine = testCmd ? `  - Re-run only the scoped test files after each meaningful change: ${testCmd}` : "  - Re-run only the scoped test files after each meaningful change";
@@ -41969,6 +42143,11 @@ or is read by another step. A failed run's scratchpad is retained for inspection
 before failing outlive that run, and are cleared at the next run's start. Treat every file as disposable,
 and overwrite freely.
 
+To try a snippet that imports project code or dependencies, write it under \`${dir}\` with
+\`ScratchpadWrite\` and run it from there: relative imports resolve from \`${dir}\`, so prefer the
+project's package names or path aliases where it has them. A script written outside the repository,
+such as in \`/tmp\`, cannot resolve the project's modules, and the file tools cannot write there.
+
 \`${dir}\` is the one directory under \`.nax/\` you may write to. Every other path under \`.nax/\`
 must still never be moved, renamed, or deleted.`;
 }
@@ -42199,7 +42378,7 @@ An adversarial reviewer will audit your tests after implementation and BLOCK the
 }
 var AUTHORING_ROLES;
 var init_test_quality = __esm(() => {
-  AUTHORING_ROLES = new Set(["test-writer", "single-session", "tdd-simple", "batch"]);
+  AUTHORING_ROLES = new Set(["test-writer", "tdd-simple", "batch"]);
 });
 
 // src/prompts/sections/verdict.ts
@@ -42399,7 +42578,7 @@ ACCEPTANCE TEST FILE: ${p.acceptanceTestPath}
 
 SOURCE FILES (auto-detected from imports, up to ${p.maxFileLines} lines each):
 ${p.sourceFilesSection}
-${p.verdictSection}
+
 Respond with ONLY a JSON object in this exact format (no markdown, no extra text):
 ${responseSchema}`;
   }
@@ -42478,16 +42657,10 @@ ${f.content}
 \`\`\``).join(`
 
 `) : "(No source files could be resolved from imports)";
-    const verdictSection = p.semanticVerdicts && p.semanticVerdicts.length > 0 ? `
-SEMANTIC VERDICTS:
-${p.semanticVerdicts.map((v) => `- ${v.storyId}: ${v.passed ? "likely test bug (semantic review confirmed AC implementation)" : "unconfirmed"}`).join(`
-`)}
-` : "";
     return this.buildDiagnosisPromptTemplate({
       truncatedOutput,
       acceptanceTestPath: p.acceptanceTestPath ?? "(path unavailable \u2014 inspect test output for file references)",
       sourceFilesSection,
-      verdictSection,
       maxFileLines: MAX_FILE_LINES
     });
   }
@@ -53204,8 +53377,8 @@ var init_version = __esm(() => {
   NAX_AI_VERSION = CATALOG_VERSION;
   NAX_COMMIT = (() => {
     try {
-      if (/^[0-9a-f]{6,10}$/.test("3e4ec026"))
-        return "3e4ec026";
+      if (/^[0-9a-f]{6,10}$/.test("7c21771a"))
+        return "7c21771a";
     } catch {}
     try {
       const result = Bun.spawnSync(["git", "rev-parse", "--short", "HEAD"], {
@@ -53764,7 +53937,7 @@ function attachCostSubscriber(bus, aggregator, runId, projectKey) {
     offCompleted();
   };
 }
-var _costSubscriberDeps, COST_ROW_SCHEMA_VERSION = 6;
+var _costSubscriberDeps, COST_ROW_SCHEMA_VERSION = 7;
 var init_cost2 = __esm(() => {
   init_agents();
   init_version();
@@ -53886,8 +54059,33 @@ function toUsageEntry(event, runId) {
     costUsd: event.costUsd
   };
 }
-function attachUsageAuditSubscriber(bus, auditor, runId) {
-  return bus.onAgentStream((event) => {
+function toOneShotEntry(event, runId) {
+  if (event.kind !== "complete")
+    return null;
+  const tu = event.tokenUsage;
+  const wireExact = event.exactCostUsd;
+  const costUsd = typeof wireExact === "number" && Number.isFinite(wireExact) ? wireExact : event.estimatedCostUsd;
+  if (!tu && (costUsd ?? 0) === 0)
+    return null;
+  return {
+    ts: event.timestamp,
+    runId,
+    scopeId: event.scopeId,
+    streamCallId: event.callId ?? "one-shot",
+    sessionName: event.sessionName,
+    storyId: event.storyId,
+    stage: event.stage,
+    agentName: event.agentName,
+    cadence: "one-shot",
+    input: tu?.inputTokens,
+    output: tu?.outputTokens,
+    cacheRead: tu?.cacheReadInputTokens,
+    cacheWrite: tu?.cacheCreationInputTokens,
+    costUsd
+  };
+}
+function attachUsageAuditSubscriber(bus, dispatchEvents, auditor, runId) {
+  const offStream = bus.onAgentStream((event) => {
     switch (event.kind) {
       case "agent.usage_update":
         auditor.record(toUsageEntry(event, runId));
@@ -53896,6 +54094,15 @@ function attachUsageAuditSubscriber(bus, auditor, runId) {
         break;
     }
   });
+  const offDispatch = dispatchEvents.onDispatch((event) => {
+    const entry = toOneShotEntry(event, runId);
+    if (entry)
+      auditor.record(entry);
+  });
+  return () => {
+    offStream();
+    offDispatch();
+  };
 }
 
 // src/runtime/middleware/index.ts
@@ -53907,15 +54114,255 @@ var init_middleware = __esm(() => {
   init_logging();
 });
 
+// src/runtime/usage-auditor.ts
+import { appendFileSync as appendFileSync2 } from "fs";
+import { mkdir as mkdir16 } from "fs/promises";
+import { join as join45 } from "path";
+function createNoOpUsageAuditor() {
+  return {
+    record() {},
+    async flush() {}
+  };
+}
+function deriveSessionRole(sessionName) {
+  for (const role of ROLES_BY_DESCENDING_LENGTH) {
+    if (sessionName === role || sessionName.endsWith(`-${role}`))
+      return role;
+  }
+  return;
+}
+
+class UsageAuditor {
+  _queue = Promise.resolve();
+  _dirCreated = false;
+  _dir;
+  _jsonlPath;
+  constructor(runId, dir) {
+    this._dir = dir;
+    this._jsonlPath = join45(dir, `${runId}.jsonl`);
+  }
+  record(entry) {
+    this._queue = this._queue.then(() => this._writeEntry(entry)).catch((err) => {
+      const sysErr = err;
+      getSafeLogger()?.warn("audit", "usage-audit write failed", {
+        path: this._jsonlPath,
+        error: errorMessage(err),
+        code: sysErr?.code,
+        errno: sysErr?.errno,
+        syscall: sysErr?.syscall,
+        ts: entry.ts,
+        storyId: entry.storyId,
+        sessionName: entry.sessionName,
+        agentName: entry.agentName,
+        stage: entry.stage,
+        streamCallId: entry.streamCallId
+      });
+    });
+  }
+  async _writeEntry(entry) {
+    if (!this._dirCreated) {
+      await mkdir16(this._dir, { recursive: true });
+      this._dirCreated = true;
+    }
+    const row = { ...entry, sessionRole: deriveSessionRole(entry.sessionName) };
+    await _usageAuditorDeps.appendLine(this._jsonlPath, `${JSON.stringify(row)}
+`);
+  }
+  async flush() {
+    await this._queue;
+  }
+}
+var _usageAuditorDeps, ROLES_BY_DESCENDING_LENGTH;
+var init_usage_auditor = __esm(() => {
+  init_logger2();
+  init_session_role();
+  _usageAuditorDeps = {
+    appendLine: async (path6, data) => {
+      appendFileSync2(path6, data, "utf8");
+    }
+  };
+  ROLES_BY_DESCENDING_LENGTH = [...KNOWN_SESSION_ROLES].sort((a, b) => b.length - a.length);
+});
+
+// src/runtime/in-flight-usage.ts
+function hasSpend(entry) {
+  const { input, output, cacheRead, cacheWrite } = entry.tokens;
+  return entry.costUsd > 0 || input + output + cacheRead + cacheWrite > 0;
+}
+function attachInFlightUsageTracker(streamBus, dispatchEvents) {
+  const entries = new Map;
+  const latestEndedBySession = new Map;
+  let endedSeq = 0;
+  const entryFor = (event) => {
+    let entry = entries.get(event.callId);
+    if (entry === undefined) {
+      entry = {
+        streamCallId: event.callId,
+        agentName: event.agentName,
+        model: "unknown",
+        sessionName: event.sessionName,
+        tokens: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+        costUsd: 0,
+        roundTrips: 0
+      };
+      entries.set(event.callId, entry);
+    }
+    entry.agentName = event.agentName;
+    entry.sessionName = event.sessionName;
+    if (event.storyId !== undefined)
+      entry.storyId = event.storyId;
+    if (event.stage !== undefined)
+      entry.stage = event.stage;
+    if (event.scopeId !== undefined)
+      entry.scopeId = event.scopeId;
+    return entry;
+  };
+  const onUsageUpdate = (event) => {
+    if (event.cadence !== "round-trip")
+      return;
+    const entry = entryFor(event);
+    entry.tokens.input += event.inputTokens ?? 0;
+    entry.tokens.output += event.outputTokens ?? 0;
+    entry.tokens.cacheRead += event.cacheRead ?? 0;
+    entry.tokens.cacheWrite += event.cacheWrite ?? 0;
+    entry.costUsd += event.costUsd ?? 0;
+    if (event.roundTrip !== undefined)
+      entry.roundTrips += 1;
+  };
+  const onCallStarted = (event) => {
+    const entry = entryFor(event);
+    entry.model = event.model === "" ? "unknown" : event.model;
+  };
+  const forget = (callId) => {
+    entries.delete(callId);
+    for (const [sessionName, remembered] of latestEndedBySession) {
+      if (remembered === callId)
+        latestEndedBySession.delete(sessionName);
+    }
+  };
+  const onCallEnded = (event) => {
+    latestEndedBySession.set(event.sessionName, event.callId);
+    if (event.status === "success" || event.status === "timeout") {
+      forget(event.callId);
+      return;
+    }
+    const existing2 = entries.get(event.callId);
+    if (existing2 === undefined)
+      return;
+    const entry = entryFor(event);
+    entry.endedStatus = event.status;
+    endedSeq += 1;
+    entry.endedSeq = endedSeq;
+  };
+  const onDispatch = (event) => {
+    if (event.kind !== "session-turn")
+      return;
+    const callId = latestEndedBySession.get(event.sessionName);
+    if (callId === undefined)
+      return;
+    const entry = entries.get(callId);
+    if (entry !== undefined && entry.endedStatus === "cancelled")
+      forget(callId);
+  };
+  const matchesScope = (entry, event) => {
+    if (entry.scopeId === undefined)
+      return false;
+    return entry.scopeId === event.scopeId || entry.scopeId === event.callId;
+  };
+  const onDispatchError = (event) => {
+    const hasUsage = event.tokenUsage !== undefined;
+    const costUsd = event.exactCostUsd ?? event.estimatedCostUsd ?? 0;
+    if (!hasUsage && !(Number.isFinite(costUsd) && costUsd > 0))
+      return;
+    let target;
+    for (const entry of entries.values()) {
+      if (entry.endedStatus === undefined || !matchesScope(entry, event))
+        continue;
+      if (target === undefined || (entry.endedSeq ?? 0) > (target.endedSeq ?? 0))
+        target = entry;
+    }
+    if (target !== undefined)
+      forget(target.streamCallId);
+  };
+  const onStream = (event) => {
+    if (event.kind === "agent.usage_update")
+      onUsageUpdate(event);
+    else if (event.kind === "agent.call_started")
+      onCallStarted(event);
+    else if (event.kind === "agent.call_ended")
+      onCallEnded(event);
+  };
+  const residuals = () => {
+    const out = [];
+    for (const entry of entries.values()) {
+      if (!hasSpend(entry))
+        continue;
+      out.push({
+        streamCallId: entry.streamCallId,
+        agentName: entry.agentName,
+        model: entry.model,
+        sessionName: entry.sessionName,
+        ...entry.storyId !== undefined ? { storyId: entry.storyId } : {},
+        ...entry.stage !== undefined ? { stage: entry.stage } : {},
+        ...entry.scopeId !== undefined ? { scopeId: entry.scopeId } : {},
+        tokens: { ...entry.tokens },
+        costUsd: entry.costUsd,
+        roundTrips: entry.roundTrips
+      });
+    }
+    return out;
+  };
+  const offStream = streamBus.onAgentStream(onStream);
+  const offDispatch = dispatchEvents.onDispatch(onDispatch);
+  const offError = dispatchEvents.onDispatchError(onDispatchError);
+  return {
+    tracker: { residuals },
+    off: () => {
+      offStream();
+      offDispatch();
+      offError();
+    }
+  };
+}
+function toPartialCostEvent(residual, runId, projectKey) {
+  const sessionRole = deriveSessionRole(residual.sessionName);
+  return {
+    ts: Date.now(),
+    runId,
+    ...projectKey !== undefined ? { projectKey } : {},
+    schemaVersion: COST_ROW_SCHEMA_VERSION,
+    partial: true,
+    agentName: residual.agentName,
+    model: residual.model,
+    ...sessionRole !== undefined ? { sessionRole } : {},
+    ...residual.stage !== undefined ? { stage: residual.stage } : {},
+    ...residual.storyId !== undefined ? { storyId: residual.storyId } : {},
+    ...residual.scopeId !== undefined ? { scopeId: residual.scopeId } : {},
+    callId: residual.streamCallId,
+    tokens: { ...residual.tokens },
+    roundTrips: residual.roundTrips,
+    roundTripUnit: "model-call",
+    costUsd: residual.costUsd,
+    estimatedCostUsd: residual.costUsd,
+    exactCostUsd: residual.costUsd,
+    confidence: "estimated",
+    durationMs: 0
+  };
+}
+var init_in_flight_usage = __esm(() => {
+  init_middleware();
+  init_usage_auditor();
+});
+
 // src/runtime/packages.ts
-import { isAbsolute as isAbsolute15, join as join45, relative as relative17 } from "path";
+import { isAbsolute as isAbsolute15, join as join46, relative as relative17 } from "path";
 function packageWorkdir(view) {
   const { packageDir, repoRoot } = view;
   if (!packageDir)
     return repoRoot;
   if (!repoRoot || isAbsolute15(packageDir))
     return packageDir;
-  return join45(repoRoot, packageDir);
+  return join46(repoRoot, packageDir);
 }
 function createPackageView(config2, packageDir, repoRoot, hasOverride, overlay) {
   const memo = new Map;
@@ -54028,7 +54475,7 @@ function storyExecRoot(view) {
   const segments = packageDir.split("/");
   if (segments[0] !== ".nax-wt" || segments.length < 2)
     return repoRoot;
-  return join45(repoRoot, segments[0], segments[1]);
+  return join46(repoRoot, segments[0], segments[1]);
 }
 var _packagesDeps;
 var init_packages = __esm(() => {
@@ -54161,9 +54608,9 @@ var init_paths2 = __esm(() => {
 });
 
 // src/runtime/prompt-auditor.ts
-import { appendFileSync as appendFileSync2 } from "fs";
-import { mkdir as mkdir16 } from "fs/promises";
-import { join as join46 } from "path";
+import { appendFileSync as appendFileSync3 } from "fs";
+import { mkdir as mkdir17 } from "fs/promises";
+import { join as join47 } from "path";
 function createNoOpPromptAuditor() {
   return {
     record() {},
@@ -54243,8 +54690,8 @@ class PromptAuditor {
   _featureDir;
   _turnOrdinals = new Map;
   constructor(runId, flushDir, featureName) {
-    this._featureDir = join46(flushDir, featureName);
-    this._jsonlPath = join46(this._featureDir, `${runId}.jsonl`);
+    this._featureDir = join47(flushDir, featureName);
+    this._jsonlPath = join47(this._featureDir, `${runId}.jsonl`);
   }
   record(entry) {
     this._enqueue(entry.callType === "run" ? { ...entry, turn: this._nextTurn(entry) } : entry);
@@ -54282,7 +54729,7 @@ class PromptAuditor {
   async _writeEntry(entry) {
     if (!this._dirCreated) {
       try {
-        await mkdir16(this._featureDir, { recursive: true });
+        await mkdir17(this._featureDir, { recursive: true });
       } catch (err) {
         throw tagAuditError(err, "jsonl");
       }
@@ -54299,7 +54746,7 @@ class PromptAuditor {
       return;
     const filename = deriveTxtFilename(entry);
     try {
-      await _promptAuditorDeps.write(join46(this._featureDir, filename), buildTxtContent(safeEntry));
+      await _promptAuditorDeps.write(join47(this._featureDir, filename), buildTxtContent(safeEntry));
     } catch (err) {
       throw tagAuditError(err, "txt");
     }
@@ -54313,80 +54760,10 @@ var init_prompt_auditor = __esm(() => {
   init_logger2();
   _promptAuditorDeps = {
     write: (path7, data) => Bun.write(path7, data),
-    appendLine: async (path7, data) => {
-      appendFileSync2(path7, data, "utf8");
-    }
-  };
-});
-
-// src/runtime/usage-auditor.ts
-import { appendFileSync as appendFileSync3 } from "fs";
-import { mkdir as mkdir17 } from "fs/promises";
-import { join as join47 } from "path";
-function createNoOpUsageAuditor() {
-  return {
-    record() {},
-    async flush() {}
-  };
-}
-function deriveSessionRole(sessionName) {
-  for (const role of ROLES_BY_DESCENDING_LENGTH) {
-    if (sessionName === role || sessionName.endsWith(`-${role}`))
-      return role;
-  }
-  return;
-}
-
-class UsageAuditor {
-  _queue = Promise.resolve();
-  _dirCreated = false;
-  _dir;
-  _jsonlPath;
-  constructor(runId, dir) {
-    this._dir = dir;
-    this._jsonlPath = join47(dir, `${runId}.jsonl`);
-  }
-  record(entry) {
-    this._queue = this._queue.then(() => this._writeEntry(entry)).catch((err) => {
-      const sysErr = err;
-      getSafeLogger()?.warn("audit", "usage-audit write failed", {
-        path: this._jsonlPath,
-        error: errorMessage(err),
-        code: sysErr?.code,
-        errno: sysErr?.errno,
-        syscall: sysErr?.syscall,
-        ts: entry.ts,
-        storyId: entry.storyId,
-        sessionName: entry.sessionName,
-        agentName: entry.agentName,
-        stage: entry.stage,
-        streamCallId: entry.streamCallId
-      });
-    });
-  }
-  async _writeEntry(entry) {
-    if (!this._dirCreated) {
-      await mkdir17(this._dir, { recursive: true });
-      this._dirCreated = true;
-    }
-    const row = { ...entry, sessionRole: deriveSessionRole(entry.sessionName) };
-    await _usageAuditorDeps.appendLine(this._jsonlPath, `${JSON.stringify(row)}
-`);
-  }
-  async flush() {
-    await this._queue;
-  }
-}
-var _usageAuditorDeps, ROLES_BY_DESCENDING_LENGTH;
-var init_usage_auditor = __esm(() => {
-  init_logger2();
-  init_session_role();
-  _usageAuditorDeps = {
     appendLine: async (path7, data) => {
       appendFileSync3(path7, data, "utf8");
     }
   };
-  ROLES_BY_DESCENDING_LENGTH = [...KNOWN_SESSION_ROLES].sort((a, b) => b.length - a.length);
 });
 
 // src/agents/factory.ts
@@ -66183,6 +66560,7 @@ __export(exports_runtime, {
   _usageAuditorDeps: () => _usageAuditorDeps,
   attachAgentIdleWatchdog: () => attachAgentIdleWatchdog,
   attachAgentStreamLogging: () => attachAgentStreamLogging,
+  attachInFlightUsageTracker: () => attachInFlightUsageTracker,
   attachUsageAuditSubscriber: () => attachUsageAuditSubscriber,
   claimProjectIdentity: () => claimProjectIdentity,
   createNoOpCostAggregator: () => createNoOpCostAggregator,
@@ -66205,6 +66583,7 @@ __export(exports_runtime, {
   spinTerminalNotice: () => spinTerminalNotice,
   storyExecRoot: () => storyExecRoot,
   storySpendUsd: () => storySpendUsd,
+  toPartialCostEvent: () => toPartialCostEvent,
   totalSpendUsd: () => totalSpendUsd,
   writeProjectIdentity: () => writeProjectIdentity
 });
@@ -66296,9 +66675,10 @@ function createRuntime(config2, workdir, opts) {
   const offCost = attachCostSubscriber(dispatchEvents, costAggregator, runId, getProjectKey(config2, workdir));
   const offAudit = attachAuditSubscriber(dispatchEvents, promptAuditor, runId);
   const offReviewAudit = attachReviewAuditSubscriber(dispatchEvents, reviewAuditor, runId);
-  const offUsageAudit = attachUsageAuditSubscriber(agentStreamEvents, usageAuditor, runId);
+  const offUsageAudit = attachUsageAuditSubscriber(agentStreamEvents, dispatchEvents, usageAuditor, runId);
   const offAgentStreamLogging = attachAgentStreamLogging(agentStreamEvents, runId);
   const offWatchdog = attachAgentIdleWatchdog(agentStreamEvents, watchdogControllerRegistry, config2);
+  const { tracker: inFlightTracker, off: offInFlightUsage } = attachInFlightUsageTracker(agentStreamEvents, dispatchEvents);
   const packages = createPackageRegistry(configLoader, workdir);
   const logger = getLogger();
   const quarantineMemo = createQuarantineMemo();
@@ -66366,6 +66746,7 @@ function createRuntime(config2, workdir, opts) {
       offUsageAudit();
       offAgentStreamLogging();
       offWatchdog();
+      offInFlightUsage();
       if (opts?.parentSignal && parentAbortHandler) {
         opts.parentSignal.removeEventListener("abort", parentAbortHandler);
       }
@@ -66375,6 +66756,10 @@ function createRuntime(config2, workdir, opts) {
         sessionManager.close();
       await mcpPool.close();
       await writeMcpRollup(outputDir, buildMcpRollup({ runId, events: mcpPool.events(), withheld: mcpWithheld })).catch((error48) => logger.warn("runtime", "mcp rollup write failed", { error: String(error48) }));
+      for (const residual of inFlightTracker.residuals()) {
+        costAggregator.record(toPartialCostEvent(residual, runId, projectKey));
+      }
+      await flushOpenToolAuditSinks(runId);
       const results = await Promise.allSettled([
         promptAuditor.flush(),
         usageAuditor.flush(),
@@ -66394,6 +66779,7 @@ var init_runtime2 = __esm(() => {
   init_agent_stream_events();
   init_cost_aggregator();
   init_dispatch_events();
+  init_in_flight_usage();
   init_middleware();
   init_packages();
   init_paths2();
@@ -66402,6 +66788,7 @@ var init_runtime2 = __esm(() => {
   init_session_role();
   init_spin_breaker();
   init_usage_auditor();
+  init_tools();
   init_factory();
   init_manager2();
   init_config();
@@ -66415,6 +66802,7 @@ var init_runtime2 = __esm(() => {
   init_agent_stream_events();
   init_cost_aggregator();
   init_dispatch_events();
+  init_in_flight_usage();
   init_middleware();
   init_packages();
   init_paths2();
@@ -66826,7 +67214,6 @@ var init_feature_context_filter = __esm(() => {
     implementer: ["all", "implementer"],
     "test-writer": ["all", "test-writer"],
     verifier: ["all", "verifier"],
-    "single-session": ["all", "implementer", "test-writer"],
     "tdd-simple": ["all", "implementer", "test-writer"],
     "no-test": ["all", "implementer"],
     batch: ["all", "implementer", "test-writer"]
@@ -68073,8 +68460,7 @@ var init_acceptance_diagnose = __esm(() => {
         testOutput: input.testOutput,
         testFileContent: input.testFileContent,
         acceptanceTestPath: input.acceptanceTestPath,
-        sourceFiles: input.sourceFiles,
-        semanticVerdicts: input.semanticVerdicts
+        sourceFiles: input.sourceFiles
       });
       return {
         role: { id: "role", content: "", overridable: false },
@@ -79097,7 +79483,7 @@ var init_config_descriptions = __esm(() => {
     "routing.llm.mode": "Routing mode: one-shot | per-story | hybrid",
     "routing.llm.timeoutMs": "Timeout for LLM routing call in milliseconds",
     execution: "Execution limits and timeouts",
-    "execution.maxIterations": "Max iterations per feature run (auto-calculated if not set)",
+    "execution.maxIterations": "Max iterations per feature run \u2014 each story attempt, parallel batch and the final completion pass counts one",
     "execution.iterationDelayMs": "Delay between iterations in milliseconds",
     "execution.costLimit": "Max cost in USD before pausing execution (override per run with `nax run --max-cost`)",
     "execution.sessionTimeoutSeconds": "Timeout per agent coding session in seconds",
@@ -79253,7 +79639,6 @@ var init_config_descriptions = __esm(() => {
     "prompts.overrides.test-writer": 'Path to custom test-writer prompt (e.g., ".nax/prompts/test-writer.md")',
     "prompts.overrides.implementer": 'Path to custom implementer prompt (e.g., ".nax/prompts/implementer.md")',
     "prompts.overrides.verifier": 'Path to custom verifier prompt (e.g., ".nax/prompts/verifier.md")',
-    "prompts.overrides.single-session": 'Path to custom single-session prompt (e.g., ".nax/prompts/single-session.md")',
     agent: "Agent protocol configuration (ACP-003)",
     "agent.protocol": "Protocol for agent communication: 'acp' (default) | 'native' | 'hybrid'",
     "agent.native.catalogOverrides": "Native only. Explicit catalog entries for model ids newer than the bundled pi-ai snapshot, plus optional provider-wide baseUrl/headers.",
@@ -79556,7 +79941,7 @@ function displayConfigWithDescriptions(obj, path10, sources, indent = 0) {
     if (description) {
       console.log(`${indentStr}# prompts.overrides: ${description}`);
     }
-    const roles = ["test-writer", "implementer", "verifier", "single-session"];
+    const roles = ["test-writer", "implementer", "verifier"];
     console.log(`${indentStr}overrides:`);
     for (const role of roles) {
       const roleDesc = FIELD_DESCRIPTIONS[`prompts.overrides.${role}`];
@@ -79601,7 +79986,7 @@ function displayConfigWithDescriptions(obj, path10, sources, indent = 0) {
     if (description) {
       console.log(`# prompts.overrides: ${description}`);
     }
-    const roles = ["test-writer", "implementer", "verifier", "single-session"];
+    const roles = ["test-writer", "implementer", "verifier"];
     console.log("overrides:");
     for (const role of roles) {
       const roleDesc = FIELD_DESCRIPTIONS[`prompts.overrides.${role}`];
@@ -80630,75 +81015,6 @@ var init_hardening = __esm(() => {
   };
 });
 
-// src/acceptance/semantic-verdict.ts
-import path11 from "path";
-async function persistSemanticVerdict(featureDir2, storyId, verdict) {
-  const dir = path11.join(featureDir2, "semantic-verdicts");
-  await _semanticVerdictDeps.mkdirp(dir);
-  const filePath = path11.join(dir, `${storyId}.json`);
-  await _semanticVerdictDeps.writeFile(filePath, JSON.stringify(verdict, null, 2));
-}
-function migrateSemanticVerdict(verdict) {
-  if (!verdict.findings?.length)
-    return verdict;
-  const first = verdict.findings[0];
-  if ("source" in first)
-    return verdict;
-  return {
-    ...verdict,
-    findings: verdict.findings.map((f) => reviewFindingToFinding(f))
-  };
-}
-async function loadSemanticVerdicts(featureDir2) {
-  const dir = path11.join(featureDir2, "semantic-verdicts");
-  let files;
-  try {
-    files = await _semanticVerdictDeps.readdir(dir);
-  } catch (err) {
-    if (err.code === "ENOENT")
-      return [];
-    throw err;
-  }
-  const results = [];
-  for (const file2 of files) {
-    if (!file2.endsWith(".json"))
-      continue;
-    const filePath = path11.join(dir, file2);
-    const content = await _semanticVerdictDeps.readFile(filePath);
-    try {
-      const parsed = JSON.parse(content);
-      results.push(migrateSemanticVerdict(parsed));
-    } catch {
-      _semanticVerdictDeps.logDebug(`Skipping invalid JSON in semantic-verdicts/${file2}`);
-    }
-  }
-  return results;
-}
-var _semanticVerdictDeps;
-var init_semantic_verdict = __esm(() => {
-  init_findings();
-  init_logger2();
-  _semanticVerdictDeps = {
-    mkdirp: async (dir) => {
-      const { mkdir: mkdir21 } = await import("fs/promises");
-      await mkdir21(dir, { recursive: true });
-    },
-    writeFile: async (filePath, content) => {
-      await Bun.write(filePath, content);
-    },
-    readdir: async (dir) => {
-      const { readdir: readdir7 } = await import("fs/promises");
-      return readdir7(dir);
-    },
-    readFile: async (filePath) => {
-      return Bun.file(filePath).text();
-    },
-    logDebug: (msg) => {
-      getLogger()?.debug("semantic-verdict", msg);
-    }
-  };
-});
-
 // src/acceptance/index.ts
 var exports_acceptance = {};
 __export(exports_acceptance, {
@@ -80711,11 +81027,9 @@ __export(exports_acceptance, {
   groupStoriesByPackage: () => groupStoriesByPackage,
   isStubTestContent: () => isStubTestContent,
   loadAcceptanceTestContent: () => loadAcceptanceTestContent,
-  loadSemanticVerdicts: () => loadSemanticVerdicts,
   loadSourceFilesForDiagnosis: () => loadSourceFilesForDiagnosis,
   parseAcceptanceCriteria: () => parseAcceptanceCriteria,
   parseRefinementResponse: () => parseRefinementResponse,
-  persistSemanticVerdict: () => persistSemanticVerdict,
   refinementWouldFallback: () => refinementWouldFallback,
   resolveAcceptanceFeatureTestPath: () => resolveAcceptanceFeatureTestPath,
   resolveSuggestedPackageFeatureTestPath: () => resolveSuggestedPackageFeatureTestPath,
@@ -80729,7 +81043,6 @@ var init_acceptance2 = __esm(() => {
   init_generator();
   init_hardening();
   init_refinement();
-  init_semantic_verdict();
   init_test_path();
 });
 
@@ -81725,11 +82038,11 @@ var init_generate = __esm(() => {
 // src/cli/init-context.ts
 import { mkdir as mkdir21, readdir as readdir7 } from "fs/promises";
 import { basename as basename11, join as join74, relative as relative23, sep as sep12 } from "path";
-async function bunFileExists(path12) {
-  return Bun.file(path12).exists();
+async function bunFileExists(path11) {
+  return Bun.file(path11).exists();
 }
-async function mkdirp(path12) {
-  await mkdir21(path12, { recursive: true });
+async function mkdirp(path11) {
+  await mkdir21(path11, { recursive: true });
 }
 async function findFiles(dir, maxFiles = 200) {
   const files = [];
@@ -81792,8 +82105,8 @@ async function detectEntryPoints(projectRoot) {
   const candidates = ["src/index.ts", "src/main.ts", "main.go", "src/lib.rs"];
   const found = [];
   for (const candidate of candidates) {
-    const path12 = join74(projectRoot, candidate);
-    if (await bunFileExists(path12)) {
+    const path11 = join74(projectRoot, candidate);
+    if (await bunFileExists(path11)) {
       found.push(candidate);
     }
   }
@@ -81803,8 +82116,8 @@ async function detectConfigFiles(projectRoot) {
   const candidates = ["tsconfig.json", "biome.json", "turbo.json", ".env.example"];
   const found = [];
   for (const candidate of candidates) {
-    const path12 = join74(projectRoot, candidate);
-    if (await bunFileExists(path12)) {
+    const path11 = join74(projectRoot, candidate);
+    if (await bunFileExists(path11)) {
       found.push(candidate);
     }
   }
@@ -82633,9 +82946,9 @@ var init_scanner = __esm(() => {
   _scannerDeps = {
     discoverWorkspacePackages: (workdir) => discoverWorkspacePackages2(workdir),
     detectLanguage: (pkgDir) => detectLanguage(pkgDir),
-    readPackageJson: async (path12) => {
+    readPackageJson: async (path11) => {
       try {
-        const file2 = Bun.file(path12);
+        const file2 = Bun.file(path11);
         if (!await file2.exists())
           return null;
         return await file2.json();
@@ -82656,6 +82969,7 @@ var init_analyze = __esm(() => {
 function createHumanAskLink(opts) {
   let queue = Promise.resolve();
   let activeId;
+  const canRemember = (req) => opts.onRemember !== undefined && req.command !== undefined;
   const deny3 = (decidedBy) => ({
     decision: "deny",
     decidedBy
@@ -82793,7 +83107,7 @@ function createHumanAskLink(opts) {
               `stage:   ${req.stage}`
             ].join(`
 `),
-            options: OPTIONS,
+            options: canRemember(req) ? [ALLOW_ONCE, ALLOW_REMEMBER, DENY] : [ALLOW_ONCE, DENY],
             timeout: opts.timeoutMs,
             fallback: "abort",
             createdAt: Date.now(),
@@ -82811,7 +83125,7 @@ function createHumanAskLink(opts) {
           if (!PERMITS.has(action)) {
             outcome = deny3("human");
           } else {
-            if (action === "allow-remember" && opts.onRemember) {
+            if (action === "allow-remember" && canRemember(req) && opts.onRemember) {
               try {
                 await opts.onRemember(req);
               } catch (err) {
@@ -82937,7 +83251,7 @@ function createHumanAskLink(opts) {
 async function cancelPendingAsk(link) {
   await link.cancel();
 }
-var MAX_COMMAND_CHARS = 3500, maskedFooter = (count) => `${count} secret value(s) masked; the approved command contains them`, _askLinkDeps, OPTIONS, PERMITS;
+var MAX_COMMAND_CHARS = 3500, maskedFooter = (count) => `${count} secret value(s) masked; the approved command contains them`, _askLinkDeps, ALLOW_ONCE, ALLOW_REMEMBER, DENY, PERMITS;
 var init_ask_link = __esm(() => {
   init_permissions();
   init_logger2();
@@ -82946,11 +83260,9 @@ var init_ask_link = __esm(() => {
     clearTimeout: (id) => clearTimeout(id),
     ASK_KEEPALIVE_MS: 60000
   };
-  OPTIONS = [
-    { key: "allow", label: "Allow once" },
-    { key: "allow-remember", label: "Allow + remember" },
-    { key: "deny", label: "Deny" }
-  ];
+  ALLOW_ONCE = { key: "allow", label: "Allow once" };
+  ALLOW_REMEMBER = { key: "allow-remember", label: "Allow + remember" };
+  DENY = { key: "deny", label: "Deny" };
   PERMITS = new Set(["allow", "allow-remember"]);
 });
 
@@ -83124,10 +83436,10 @@ async function buildDispatchAskWiring(opts, deps = _dispatchAskDeps) {
       stage: req.stage,
       command: req.command ?? "",
       root: req.root ?? opts.repoRoot,
-      origin: "escalate",
-      matchedRule: null,
+      origin: req.matchedRule !== undefined ? "askRule" : "escalate",
+      matchedRule: req.matchedRule ?? null,
       approvedAt: new Date().toISOString(),
-      approvedBy: "telegram",
+      approvedBy: opts.config.interaction?.plugin ?? "unknown",
       naxCommit: NAX_COMMIT
     })
   });
@@ -83205,6 +83517,25 @@ async function collectEffectiveRunStageModes(opts, deps = _dispatchAskDeps) {
   })));
   return collectRunStageModes([opts.rootConfig, ...opts.extraConfigs ?? [], ...packageConfigs]);
 }
+async function buildApprovalsSeal(opts, deps = _dispatchAskDeps) {
+  const stageModes = await collectEffectiveRunStageModes({ projectDir: opts.projectDir, rootConfig: opts.rootConfig, packageDirs: opts.packageDirs }, deps);
+  const forgeCapable = isForgeCapable(stageModes, opts.rootConfig.execution?.sandbox?.enabled === true);
+  if (!forgeCapable)
+    return async () => {};
+  const approvalsFile = approvalsPath(opts.outputDir);
+  const runId = opts.runId;
+  return async () => {
+    try {
+      await deps.prepareApprovalsStore({ approvalsFile, runId, forgeCapable: true });
+    } catch (error48) {
+      getSafeLogger()?.warn("permissions", "[approvals] could not update the store's taint marker", {
+        approvalsFile,
+        forgeCapable: true,
+        error: error48
+      });
+    }
+  };
+}
 async function buildRunDispatchAskWiring(opts, deps = _dispatchAskDeps) {
   const stageModes = await collectEffectiveRunStageModes({
     projectDir: opts.projectDir,
@@ -83218,6 +83549,7 @@ var DEFAULT_APPROVAL_TIMEOUT_MS = 600000, APPROVAL_AUDIT_DIR = "approval-audit",
 var init_dispatch_ask = __esm(() => {
   init_command_safety();
   init_config();
+  init_logger2();
   init_permissions();
   init_version();
   init_ask_link();
@@ -88334,6 +88666,11 @@ async function performTeardown(ctx) {
   if (ctx.pidRegistry) {
     await ctx.pidRegistry.killAll();
   }
+  if (ctx.sealApprovals) {
+    await ctx.sealApprovals().catch(() => {
+      return;
+    });
+  }
 }
 function getSignalNumber(signal) {
   const signalMap = {
@@ -88490,7 +88827,7 @@ var init_crash_recovery = __esm(() => {
 });
 
 // src/execution/ensure-package-dirs.ts
-import path12 from "path";
+import path11 from "path";
 async function ensureStoryPackageDirs(prd, workdir, deps = _ensurePackageDirsDeps) {
   const logger = getSafeLogger();
   const relToStoryId = new Map;
@@ -88503,8 +88840,8 @@ async function ensureStoryPackageDirs(prd, workdir, deps = _ensurePackageDirsDep
   }
   const created = [];
   for (const [rel, storyId] of relToStoryId) {
-    const abs = path12.resolve(workdir, rel);
-    const rootWithSep = workdir.endsWith(path12.sep) ? workdir : workdir + path12.sep;
+    const abs = path11.resolve(workdir, rel);
+    const rootWithSep = workdir.endsWith(path11.sep) ? workdir : workdir + path11.sep;
     if (abs !== workdir && !abs.startsWith(rootWithSep)) {
       logger?.warn("execution", "Skipping story workdir outside repo root", {
         storyId,
@@ -88655,8 +88992,8 @@ async function verifyQuoteTriple(triple, workdir, deps = _quoteIntegrityDeps) {
     return false;
   const lines = content.split(`
 `);
-  const start = Math.max(0, triple.line - 1 - CONTEXT_LINES);
-  const end = Math.min(lines.length, triple.line + CONTEXT_LINES);
+  const start = Math.max(0, triple.line - 1 - CONTEXT_LINES2);
+  const end = Math.min(lines.length, triple.line + CONTEXT_LINES2);
   const window2 = lines.slice(start, end).join(`
 `);
   return normalizeWs2(window2).toLowerCase().includes(normalizeWs2(triple.quote).toLowerCase());
@@ -88681,14 +89018,14 @@ async function verifyEscalationQuotes(reason, workdir, storyId, deps = _quoteInt
   }
   return verified;
 }
-var _quoteIntegrityDeps, CONTEXT_LINES = 3;
+var _quoteIntegrityDeps, CONTEXT_LINES2 = 3;
 var init_quote_integrity = __esm(() => {
   init_logger2();
   init_path_security2();
   _quoteIntegrityDeps = {
-    readFile: async (path13) => {
+    readFile: async (path12) => {
       try {
-        return await Bun.file(path13).text();
+        return await Bun.file(path12).text();
       } catch {
         return null;
       }
@@ -89128,7 +89465,7 @@ var init_escalation = __esm(() => {
 import { randomUUID as randomUUID10 } from "crypto";
 import { rename as rename5, unlink as unlink5 } from "fs/promises";
 import { hostname as hostname3 } from "os";
-import path13 from "path";
+import path12 from "path";
 function getSafeLogger3() {
   try {
     return getLogger();
@@ -89208,7 +89545,7 @@ async function claimReclaimableLock(lockPath, observedContent, lockData) {
   return { action: "discard" };
 }
 async function acquireLock(workdir) {
-  const lockPath = path13.join(workdir, "nax.lock");
+  const lockPath = path12.join(workdir, "nax.lock");
   const lockFile = Bun.file(lockPath);
   try {
     const exists2 = await lockFile.exists();
@@ -89261,7 +89598,7 @@ async function acquireLock(workdir) {
   }
 }
 async function releaseLock(workdir) {
-  const lockPath = path13.join(workdir, "nax.lock");
+  const lockPath = path12.join(workdir, "nax.lock");
   try {
     await unlink5(lockPath);
   } catch (error48) {
@@ -89286,7 +89623,7 @@ var init_lock2 = __esm(() => {
 // src/execution/feature-lock.ts
 import { mkdir as mkdir24, rename as rename6, unlink as unlink6 } from "fs/promises";
 import { hostname as hostname4 } from "os";
-import path14 from "path";
+import path13 from "path";
 function validateFeatureId2(featureId) {
   if (!featureId || featureId.length === 0) {
     throw new NaxError("Feature ID cannot be empty", "INVALID_FEATURE_ID", { stage: "feature-lock" });
@@ -89316,7 +89653,7 @@ function getSafeLogger4() {
 }
 function featureLockPath(outputDir, feature) {
   validateFeatureId2(feature);
-  return path14.join(outputDir, "features", feature, "nax.lock");
+  return path13.join(outputDir, "features", feature, "nax.lock");
 }
 function lockHost() {
   return _featureLockDeps.host();
@@ -89377,7 +89714,7 @@ function emptyHolder(feature) {
 }
 async function acquireFeatureLock(args) {
   const lockPath = _featureLockDeps.featureLockPath(args.outputDir, args.feature);
-  const featureDir2 = path14.dirname(lockPath);
+  const featureDir2 = path13.dirname(lockPath);
   await mkdir24(featureDir2, { recursive: true });
   const lockFile = Bun.file(lockPath);
   if (await lockFile.exists()) {
@@ -90834,7 +91171,7 @@ var init_acceptance3 = __esm(() => {
 });
 
 // src/pipeline/stages/acceptance-setup.ts
-import path15 from "path";
+import path14 from "path";
 function computeACFingerprint(criteria) {
   const sorted = [...criteria].sort().join(`
 `);
@@ -90844,7 +91181,7 @@ function computeACFingerprint(criteria) {
 }
 function computeAcceptanceLayoutFingerprint(workdir, groups) {
   const layout = groups.map(({ testPath, stories }) => ({
-    testPath: path15.relative(workdir, testPath).replaceAll(path15.sep, "/"),
+    testPath: path14.relative(workdir, testPath).replaceAll(path14.sep, "/"),
     storyIds: stories.map((story) => story.id).sort()
   })).sort((a, b) => a.testPath.localeCompare(b.testPath));
   const hasher = new Bun.CryptoHasher("sha256");
@@ -90854,14 +91191,14 @@ function computeAcceptanceLayoutFingerprint(workdir, groups) {
 async function runAcceptanceSetup(ctx, featureDir2, phaseStartTime) {
   const language = ctx.config.project?.language;
   const testPathConfig = ctx.config.acceptance.testPath;
-  const metaPath = path15.join(featureDir2, "acceptance-meta.json");
+  const metaPath = path14.join(featureDir2, "acceptance-meta.json");
   const allCriteria = ctx.prd.userStories.filter(isInAcceptanceScope).flatMap((s) => s.acceptanceCriteria);
   const featureName = ctx.prd.feature ?? ctx.prd.featureName;
   const groups = await groupStoriesByPackage(ctx.prd, ctx.workdir, featureName, testPathConfig, language);
   const nonFixStories = groups.flatMap((g) => g.stories);
   const groupConfigs = new Map;
   for (const group of groups) {
-    const relativeWorkdir = path15.relative(ctx.projectDir, group.packageDir);
+    const relativeWorkdir = path14.relative(ctx.projectDir, group.packageDir);
     let config2 = ctx.config;
     if (relativeWorkdir && relativeWorkdir !== ".") {
       try {
@@ -90906,7 +91243,6 @@ async function runAcceptanceSetup(ctx, featureDir2, phaseStartTime) {
         await _acceptanceSetupDeps.deleteFile(testPath);
       }
     }
-    await _acceptanceSetupDeps.deleteSemanticVerdicts(featureDir2);
     shouldGenerate = true;
     regenerated = true;
   } else {
@@ -91014,7 +91350,7 @@ async function runAcceptanceSetup(ctx, featureDir2, phaseStartTime) {
         testable: c.testable,
         storyId: c.storyId
       })), null, 2);
-      await _acceptanceSetupDeps.writeFile(path15.join(featureDir2, "acceptance-refined.json"), refinedJsonContent);
+      await _acceptanceSetupDeps.writeFile(path14.join(featureDir2, "acceptance-refined.json"), refinedJsonContent);
     }
     if (sawDispatchFailure) {
       getSafeLogger()?.warn("acceptance-setup", "generation dispatch failed; not recording acceptance meta so the next run regenerates", { storyId: ctx.story?.id, metaPath });
@@ -91126,21 +91462,6 @@ var init_acceptance_setup = __esm(() => {
           throw err;
       }
     },
-    deleteSemanticVerdicts: async (featureDir2) => {
-      const dir = `${featureDir2}/semantic-verdicts`;
-      const { readdir: readdir8, unlink: unlink7 } = await import("fs/promises");
-      let files;
-      try {
-        files = await readdir8(dir);
-      } catch (err) {
-        if (err.code === "ENOENT")
-          return;
-        throw err;
-      }
-      for (const file2 of files) {
-        await unlink7(`${dir}/${file2}`);
-      }
-    },
     readMeta: async (metaPath) => {
       const f = Bun.file(metaPath);
       if (!await f.exists())
@@ -91345,7 +91666,6 @@ async function getDiffFilePaths(workdir, baseRef) {
 }
 var MAX_DIFF_TEXT_CHARS = 8000, HIGH_MEMORY_TELEMETRY_BYTES, STREAM_DRAIN_DEADLINE_MS = 2000, completionStage, _completionDeps;
 var init_completion = __esm(() => {
-  init_acceptance2();
   init_config();
   init_engine();
   init_fragments();
@@ -91465,7 +91785,6 @@ var init_completion = __esm(() => {
   };
   _completionDeps = {
     checkReviewGate,
-    persistSemanticVerdict,
     savePRD,
     getDiffText,
     getDiffFilePaths,
@@ -92241,9 +92560,9 @@ var init_prompt2 = __esm(() => {
 });
 
 // src/pipeline/stages/queue-check.ts
-import path16 from "path";
+import path15 from "path";
 function resolvePrdPath(ctx) {
-  return path16.join(ctx.featureDir ?? featureDir(ctx.workdir, "unknown"), "prd.json");
+  return path15.join(ctx.featureDir ?? featureDir(ctx.workdir, "unknown"), "prd.json");
 }
 function logDroppedCommands(logger, ctx, queueCommands, currentIndex) {
   const dropped = queueCommands.slice(currentIndex + 1);
@@ -92294,10 +92613,10 @@ async function processQueueCommands(ctx, logger, queueCommands) {
     }
     if (cmd.type === "INJECT") {
       try {
-        if (path16.isAbsolute(cmd.storyFile)) {
+        if (path15.isAbsolute(cmd.storyFile)) {
           throw new NaxError(`INJECT storyFile must be a relative path within the workspace: ${cmd.storyFile}`, "INJECT_PATH_ABSOLUTE", { stage: "queue-check", storyId: ctx.story?.id ?? "unknown", storyFile: cmd.storyFile });
         }
-        const storyFilePath = validateFilePath(path16.join(ctx.workdir, cmd.storyFile), ctx.workdir);
+        const storyFilePath = validateFilePath(path15.join(ctx.workdir, cmd.storyFile), ctx.workdir);
         const raw = await Bun.file(storyFilePath).json();
         const existingIds = new Set(ctx.prd.userStories.map((s) => s.id));
         const story = validateInjectedStory(raw, existingIds);
@@ -93675,7 +93994,7 @@ var init_hooks = __esm(() => {
 });
 
 // src/execution/lifecycle/acceptance-helpers.ts
-import path17 from "path";
+import path16 from "path";
 function resolveAcceptanceFixTarget(acceptanceTestPaths, failedPackage, config2) {
   const matchedEntry = failedPackage ? acceptanceTestPaths?.find((entry) => entry.testPath === failedPackage.testPath || entry.packageDir === failedPackage.packageDir) : undefined;
   const selectedPathEntry = matchedEntry ?? acceptanceTestPaths?.[0];
@@ -93698,10 +94017,7 @@ function resolveAcceptanceFixTarget(acceptanceTestPaths, failedPackage, config2)
 function isStubTestFile(content) {
   return isStubTestContent(content);
 }
-function isTestLevelFailure(failedACs, totalACs, semanticVerdicts) {
-  if (semanticVerdicts && semanticVerdicts.length > 0 && semanticVerdicts.every((v) => v.passed)) {
-    return true;
-  }
+function isTestLevelFailure(failedACs, totalACs) {
   const failedCount = typeof failedACs === "number" ? failedACs : failedACs.length;
   const hasACError = Array.isArray(failedACs) && failedACs.includes("AC-ERROR");
   if (hasACError)
@@ -93713,7 +94029,7 @@ function isTestLevelFailure(failedACs, totalACs, semanticVerdicts) {
 async function loadSpecContent(featureDir2) {
   if (!featureDir2)
     return "";
-  const specPath = path17.join(featureDir2, "spec.md");
+  const specPath = path16.join(featureDir2, "spec.md");
   const specFile = Bun.file(specPath);
   return await specFile.exists() ? await specFile.text() : "";
 }
@@ -93733,7 +94049,7 @@ async function loadAcceptanceTestContent2(featureDir2, testPaths, configuredTest
   }
   if (!configuredTestPath)
     return [];
-  const resolvedPath = path17.join(featureDir2, configuredTestPath);
+  const resolvedPath = path16.join(featureDir2, configuredTestPath);
   const testFile = Bun.file(resolvedPath);
   const content = await testFile.exists() ? await testFile.text() : "";
   return [{ content, path: resolvedPath }];
@@ -93763,7 +94079,7 @@ async function regenerateAcceptanceTest(testPath, acceptanceContext) {
   const { unlink: unlink7 } = await import("fs/promises");
   await unlink7(testPath);
   if (acceptanceContext.featureDir) {
-    const metaPath = path17.join(acceptanceContext.featureDir, "acceptance-meta.json");
+    const metaPath = path16.join(acceptanceContext.featureDir, "acceptance-meta.json");
     try {
       await unlink7(metaPath);
     } catch {}
@@ -93779,7 +94095,7 @@ async function regenerateAcceptanceTest(testPath, acceptanceContext) {
       const diffOutput = await _regenerateDeps.spawnGitDiff(repoRoot, storyGitRef, pathspec);
       const changedFilesRaw = diffOutput.split(`
 `).map((f) => f.trim()).filter((f) => f.length > 0);
-      const packageDir = storyPkg && acceptanceContext.projectDir ? path17.join(acceptanceContext.projectDir, storyPkg) : undefined;
+      const packageDir = storyPkg && acceptanceContext.projectDir ? path16.join(acceptanceContext.projectDir, storyPkg) : undefined;
       const ignoreMatchers = acceptanceContext.naxIgnoreIndex?.getMatchers(packageDir) ?? await resolveNaxIgnorePatterns(repoRoot, packageDir);
       const changedFiles2 = filterNaxInternalPaths(changedFilesRaw, ignoreMatchers);
       const MAX_BYTES = 51200;
@@ -93791,7 +94107,7 @@ async function regenerateAcceptanceTest(testPath, acceptanceContext) {
       for (const file2 of changedFiles2) {
         if (totalBytes >= MAX_BYTES)
           break;
-        const filePath = path17.join(repoRoot, file2);
+        const filePath = path16.join(repoRoot, file2);
         try {
           const fileContent = await _regenerateDeps.readFile(filePath);
           const remaining = MAX_BYTES - totalBytes;
@@ -93878,7 +94194,7 @@ function fixCallCtx(ctx, packageDir, config2) {
 }
 async function resolveAcceptanceDiagnosis(opts) {
   const logger = getSafeLogger();
-  const { ctx, failures, totalACs, strategy, semanticVerdicts, diagnosisOpts } = opts;
+  const { ctx, failures, totalACs, strategy, diagnosisOpts } = opts;
   const storyId = diagnosisOpts.storyId;
   if (strategy === "implement-only") {
     logger?.info("acceptance.diagnosis", "Fast path: implement-only strategy \u2192 source_bug", { storyId });
@@ -93888,19 +94204,6 @@ async function resolveAcceptanceDiagnosis(opts) {
       confidence: 1
     };
   }
-  const SENTINELS = ["AC-ERROR", "AC-HOOK"];
-  const hasOnlySentinels = failures.failedACs.length > 0 && failures.failedACs.every((ac) => SENTINELS.includes(ac));
-  if (!hasOnlySentinels && semanticVerdicts.length > 0 && semanticVerdicts.every((v) => v.passed)) {
-    logger?.info("acceptance.diagnosis", "Fast path: all semantic verdicts passed \u2192 test_bug", {
-      storyId,
-      verdictCount: semanticVerdicts.length
-    });
-    return {
-      verdict: "test_bug",
-      reasoning: `Semantic review confirmed all ${semanticVerdicts.length} ACs are implemented \u2014 failure is a test generation issue`,
-      confidence: 1
-    };
-  }
   if (isTestLevelFailure(failures.failedACs, totalACs)) {
     logger?.info("acceptance.diagnosis", "Fast path: test-level failure heuristic \u2192 test_bug", {
       storyId,
@@ -93922,8 +94225,7 @@ async function resolveAcceptanceDiagnosis(opts) {
     testOutput: diagnosisOpts.testOutput,
     testFileContent: diagnosisOpts.testFileContent,
     acceptanceTestPath: diagnosisOpts.acceptanceTestPath,
-    sourceFiles,
-    semanticVerdicts
+    sourceFiles
   });
 }
 var _diagnosisDeps;
@@ -94211,7 +94513,6 @@ async function runAcceptanceLoop(ctx) {
         continue;
       }
     }
-    const semanticVerdicts = ctx.featureDir ? await _acceptanceLoopDeps.loadSemanticVerdicts(ctx.featureDir) : [];
     const totalACs = prd.userStories.filter((s) => !isLegacyFixStory(s)).flatMap((s) => s.acceptanceCriteria).length;
     if (!ctx.runtime) {
       logger?.error("acceptance", "Runtime not found for diagnosis", { storyId: firstStory?.id });
@@ -94234,7 +94535,6 @@ async function runAcceptanceLoop(ctx) {
         failures: pkgFailures,
         totalACs,
         strategy,
-        semanticVerdicts,
         diagnosisOpts: {
           testOutput: pkg.output,
           testFileContent,
@@ -94280,7 +94580,6 @@ var init_acceptance_loop = __esm(() => {
   init_acceptance_helpers();
   init_acceptance_helpers();
   _acceptanceLoopDeps = {
-    loadSemanticVerdicts,
     loadAcceptanceTestContent
   };
   _acceptanceFixCycleDeps = {
@@ -94509,7 +94808,7 @@ var init_scratchpad_wipe = __esm(() => {
   init_logger2();
   init_tools();
   _scratchpadWipeDeps = {
-    remove: (path18) => rm7(path18, { recursive: true, force: true })
+    remove: (path17) => rm7(path17, { recursive: true, force: true })
   };
 });
 
@@ -94661,6 +94960,13 @@ async function cleanupRun(options) {
   } catch (error48) {
     logger?.warn("plugins", "Plugin teardown failed", { error: error48 });
   }
+  if (options.sealApprovals) {
+    try {
+      await options.sealApprovals();
+    } catch (error48) {
+      logger?.warn("permissions", "End-of-run approvals seal failed \u2014 continuing teardown", { error: error48 });
+    }
+  }
   if (interactionChain) {
     try {
       await interactionChain.destroy();
@@ -97098,8 +97404,8 @@ async function defaultRun(cmd, opts) {
     clearTimeout(timer);
   }
 }
-async function defaultReadText(path18) {
-  const file2 = Bun.file(path18);
+async function defaultReadText(path17) {
+  const file2 = Bun.file(path17);
   if (!await file2.exists())
     return null;
   return file2.text();
@@ -97199,10 +97505,10 @@ var init_pr = __esm(() => {
 });
 
 // src/forge/template.ts
-import * as path18 from "path";
+import * as path17 from "path";
 async function firstExisting(workdir, deps, paths) {
   for (const relPath of paths) {
-    const content = await deps.readText(path18.join(workdir, relPath));
+    const content = await deps.readText(path17.join(workdir, relPath));
     if (content !== null)
       return content;
   }
@@ -97417,7 +97723,7 @@ var init_pr_body = __esm(() => {
 });
 
 // src/plugins/builtin/auto-pr/index.ts
-import * as path19 from "path";
+import * as path18 from "path";
 async function defaultRun2(cmd, opts) {
   const argv = cmd[0] === "git" ? hardenedGitArgv(cmd) : cmd;
   const proc = Bun.spawn(argv, { cwd: opts.cwd, env: gitSpawnEnv(), stdout: "pipe", stderr: "pipe" });
@@ -97443,8 +97749,8 @@ async function defaultRun2(cmd, opts) {
     clearTimeout(timer);
   }
 }
-async function defaultReadText2(path20) {
-  const file2 = Bun.file(path20);
+async function defaultReadText2(path19) {
+  const file2 = Bun.file(path19);
   if (!await file2.exists())
     return null;
   return file2.text();
@@ -97474,8 +97780,8 @@ function getStorySummary(context) {
 function relativePrdPath(workdir, prdPath) {
   if (!prdPath)
     return prdPath;
-  const rel = path19.relative(workdir, prdPath);
-  return rel && !rel.startsWith("..") && !path19.isAbsolute(rel) ? rel : prdPath;
+  const rel = path18.relative(workdir, prdPath);
+  return rel && !rel.startsWith("..") && !path18.isAbsolute(rel) ? rel : prdPath;
 }
 function toPrBodyContext(context) {
   const summary = getStorySummary(context);
@@ -97764,7 +98070,7 @@ var init_auto_prune = __esm(() => {
 });
 
 // src/plugins/builtin/curator/collect.ts
-import * as path20 from "path";
+import * as path19 from "path";
 function now() {
   return new Date().toISOString();
 }
@@ -97822,7 +98128,7 @@ function tokenCount(story) {
 }
 async function collectFromMetrics(context) {
   const observations = [];
-  const metricsPath = path20.join(context.outputDir, "metrics.json");
+  const metricsPath = path19.join(context.outputDir, "metrics.json");
   try {
     const data = await readJsonFile(metricsPath);
     const runs = Array.isArray(data) ? data : [data];
@@ -97898,11 +98204,11 @@ function findingMessage(finding) {
 }
 async function collectFromReviewAudit(context) {
   const observations = [];
-  const auditDir = path20.join(context.outputDir, "review-audit");
+  const auditDir = path19.join(context.outputDir, "review-audit");
   try {
     const glob = new Bun.Glob("**/*.json");
     for await (const file2 of glob.scan({ cwd: auditDir, absolute: false })) {
-      const fullPath = path20.join(auditDir, file2);
+      const fullPath = path19.join(auditDir, file2);
       try {
         const audit = asRecord3(await readJsonFile(fullPath));
         if (!audit)
@@ -97953,7 +98259,7 @@ async function collectFromContextManifests(context) {
   try {
     const glob = new Bun.Glob("*/stories/*/context-manifest-*.json");
     for await (const file2 of glob.scan({ cwd: featuresRoot, absolute: false })) {
-      const fullPath = path20.join(featuresRoot, file2);
+      const fullPath = path19.join(featuresRoot, file2);
       try {
         const parts = file2.split("/");
         const featureId = parts[0] ?? context.feature;
@@ -98560,9 +98866,9 @@ function renderProposals(proposals, runId, observationCount, provenance) {
 
 // src/plugins/builtin/curator/rollup.ts
 import { appendFile as appendFile7, mkdir as mkdir26, writeFile as writeFile11 } from "fs/promises";
-import * as path21 from "path";
+import * as path20 from "path";
 async function appendToRollup(observations, rollupPath) {
-  const dir = path21.dirname(rollupPath);
+  const dir = path20.dirname(rollupPath);
   await mkdir26(dir, { recursive: true }).catch(() => {});
   const { withPathFileLock: withPathFileLock2 } = await Promise.resolve().then(() => (init_path_file_lock(), exports_path_file_lock));
   await withPathFileLock2(rollupPath, () => appendToRollupUnlocked(observations, rollupPath)).catch(() => {});
@@ -98651,7 +98957,7 @@ var init_rollup2 = __esm(() => {
 
 // src/plugins/builtin/curator/index.ts
 import { mkdir as mkdir27 } from "fs/promises";
-import * as path22 from "path";
+import * as path21 from "path";
 function getCuratorEnabled(context) {
   const cfg = context.config;
   if (!cfg)
@@ -98727,7 +99033,7 @@ var init_curator = __esm(() => {
         const observations = await collectObservations(curatorContext);
         if (context.outputDir) {
           const { observationsPath, rollupPath } = resolveCuratorOutputs(curatorContext);
-          const runDir = path22.dirname(observationsPath);
+          const runDir = path21.dirname(observationsPath);
           await mkdir27(runDir, { recursive: true });
           await Bun.write(observationsPath, observations.map((o) => JSON.stringify(o)).join(`
 `) + (observations.length > 0 ? `
@@ -98765,7 +99071,7 @@ var init_curator = __esm(() => {
           const windowHasObservations = window2.observations.length > 0;
           const provenance = windowHasObservations ? { runCount: window2.runIds.length, observationCount: window2.observations.length } : { runCount: 1, observationCount: observations.length };
           const markdown = renderProposals(proposals, context.runId, observations.length, provenance);
-          const proposalsMdPath = path22.join(runDir, "curator-proposals.md");
+          const proposalsMdPath = path21.join(runDir, "curator-proposals.md");
           await Bun.write(proposalsMdPath, markdown);
         }
         return {
@@ -99148,14 +99454,14 @@ var init_validator = __esm(() => {
 
 // src/plugins/loader.ts
 import * as fs from "fs/promises";
-import * as path23 from "path";
+import * as path22 from "path";
 function getSafeLogger7() {
   return getSafeLogger();
 }
 function extractPluginName(pluginPath) {
-  const basename13 = path23.basename(pluginPath);
+  const basename13 = path22.basename(pluginPath);
   if (basename13 === "index.ts" || basename13 === "index.js" || basename13 === "index.mjs") {
-    return path23.basename(path23.dirname(pluginPath));
+    return path22.basename(path22.dirname(pluginPath));
   }
   return basename13.replace(/\.(ts|js|mjs)$/, "");
 }
@@ -99302,7 +99608,7 @@ async function discoverPlugins(dir, isTestFileFn) {
   try {
     const entries = await fs.readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const fullPath = path23.join(dir, entry.name);
+      const fullPath = path22.join(dir, entry.name);
       if (entry.isFile()) {
         if (isPluginFile(entry.name, isTestFileFn)) {
           discovered.push({ path: fullPath });
@@ -99310,7 +99616,7 @@ async function discoverPlugins(dir, isTestFileFn) {
       } else if (entry.isDirectory()) {
         const indexPaths = ["index.ts", "index.js", "index.mjs"];
         for (const indexFile of indexPaths) {
-          const indexPath = path23.join(fullPath, indexFile);
+          const indexPath = path22.join(fullPath, indexFile);
           try {
             await fs.access(indexPath);
             discovered.push({ path: indexPath });
@@ -99335,13 +99641,13 @@ function isPluginFile(filename, isTestFileFn) {
   return !FALLBACK_TEST_FILE_RE.test(filename);
 }
 function resolveModulePath(modulePath, projectRoot) {
-  if (path23.isAbsolute(modulePath) || !modulePath.startsWith("./") && !modulePath.startsWith("../")) {
+  if (path22.isAbsolute(modulePath) || !modulePath.startsWith("./") && !modulePath.startsWith("../")) {
     return modulePath;
   }
   if (projectRoot) {
-    return path23.resolve(projectRoot, modulePath);
+    return path22.resolve(projectRoot, modulePath);
   }
-  return path23.resolve(modulePath);
+  return path22.resolve(modulePath);
 }
 async function loadAndValidatePlugin(initialModulePath, config2, allowedRoots, originalPath) {
   let attemptedPath = initialModulePath;
@@ -99563,8 +99869,8 @@ var init_language_commands = __esm(() => {
 
 // src/review/scoped-lint.ts
 import { join as join100, relative as relative26 } from "path";
-function normalizePath3(path24) {
-  return path24.replaceAll("\\", "/").replace(/^\.\//, "");
+function normalizePath3(path23) {
+  return path23.replaceAll("\\", "/").replace(/^\.\//, "");
 }
 function isSupportedDerivedScopedCommand(command) {
   const commands = normalizeCommandSpec(command);
@@ -99799,7 +100105,7 @@ var init_scoped_lint = __esm(() => {
     listChangedFiles,
     findPackageDir,
     runLintCommand,
-    fileExists: (path24) => Bun.file(path24).exists()
+    fileExists: (path23) => Bun.file(path23).exists()
   };
 });
 
@@ -100260,7 +100566,7 @@ var init_paused_story_prompts = __esm(() => {
 });
 
 // src/execution/lifecycle/run-setup-init.ts
-import path24 from "path";
+import path23 from "path";
 async function initializeAfterLock(options) {
   const logger = getSafeLogger();
   const { config: config2, workdir, feature, dryRun, runtime, interactionChain, runId, agentGetFn, statusWriter, deps } = options;
@@ -100292,8 +100598,8 @@ async function initializeAfterLock(options) {
       explicit: Object.fromEntries(explicitFields.map((f) => [f, existingProjectConfig[f]])),
       detected: Object.fromEntries(autodetectedFields.map((f) => [f, detectedProfile[f]]))
     });
-    const globalPluginsDir = path24.join(globalConfigDir(), "plugins");
-    const projectPluginsDir = path24.join(workdir, ".nax", "plugins");
+    const globalPluginsDir = path23.join(globalConfigDir(), "plugins");
+    const projectPluginsDir = path23.join(workdir, ".nax", "plugins");
     const configPlugins = config2.plugins || [];
     const resolvedPatterns = await resolveTestFilePatterns(config2, workdir);
     const isTestFileFn = (filename) => resolvedPatterns.regex.some((re) => re.test(filename));
@@ -101252,7 +101558,7 @@ __export(exports_migrate, {
 });
 import { existsSync as existsSync30 } from "fs";
 import { mkdir as mkdir28, readdir as readdir10, rename as rename9 } from "fs/promises";
-import path25 from "path";
+import path24 from "path";
 async function detectGeneratedContent(naxDir) {
   if (!existsSync30(naxDir))
     return [];
@@ -101265,17 +101571,17 @@ async function detectGeneratedContent(naxDir) {
   }
   for (const entry of entries) {
     if (GENERATED_NAMES.has(entry)) {
-      candidates.push({ name: entry, srcPath: path25.join(naxDir, entry) });
+      candidates.push({ name: entry, srcPath: path24.join(naxDir, entry) });
     }
   }
-  const featuresDir2 = path25.join(naxDir, "features");
+  const featuresDir2 = path24.join(naxDir, "features");
   if (existsSync30(featuresDir2)) {
     let featureDirs = [];
     try {
       featureDirs = await readdir10(featuresDir2);
     } catch {}
     for (const fid of featureDirs) {
-      const featureDir2 = path25.join(featuresDir2, fid);
+      const featureDir2 = path24.join(featuresDir2, fid);
       let subEntries = [];
       try {
         subEntries = await readdir10(featureDir2);
@@ -101285,12 +101591,12 @@ async function detectGeneratedContent(naxDir) {
       for (const sub of subEntries) {
         if (GENERATED_FEATURE_SUBNAMES.has(sub)) {
           candidates.push({
-            name: path25.join("features", fid, sub),
-            srcPath: path25.join(featureDir2, sub)
+            name: path24.join("features", fid, sub),
+            srcPath: path24.join(featureDir2, sub)
           });
         }
         if (sub === "stories") {
-          const storiesDir = path25.join(featureDir2, "stories");
+          const storiesDir = path24.join(featureDir2, "stories");
           let storyDirs = [];
           try {
             storyDirs = await readdir10(storiesDir);
@@ -101298,7 +101604,7 @@ async function detectGeneratedContent(naxDir) {
             continue;
           }
           for (const sid of storyDirs) {
-            const storyDir = path25.join(storiesDir, sid);
+            const storyDir = path24.join(storiesDir, sid);
             let storyEntries = [];
             try {
               storyEntries = await readdir10(storyDir);
@@ -101308,8 +101614,8 @@ async function detectGeneratedContent(naxDir) {
             for (const se of storyEntries) {
               if (se.startsWith("context-manifest-") && se.endsWith(".json")) {
                 candidates.push({
-                  name: path25.join("features", fid, "stories", sid, se),
-                  srcPath: path25.join(storyDir, se)
+                  name: path24.join("features", fid, "stories", sid, se),
+                  srcPath: path24.join(storyDir, se)
                 });
               }
             }
@@ -101330,15 +101636,15 @@ async function migrateCommand(options) {
         name: options.reclaim
       });
     }
-    const src = path25.join(globalConfigDir(), options.reclaim);
+    const src = path24.join(globalConfigDir(), options.reclaim);
     if (!existsSync30(src)) {
       throw new NaxError(`Nothing to reclaim: ~/.nax/${options.reclaim} does not exist`, "MIGRATE_RECLAIM_NOT_FOUND", {
         stage: "migrate",
         name: options.reclaim
       });
     }
-    const archiveBase = path25.join(globalConfigDir(), "_archive");
-    const archiveDest = path25.join(archiveBase, `${options.reclaim}-${Date.now()}`);
+    const archiveBase = path24.join(globalConfigDir(), "_archive");
+    const archiveDest = path24.join(archiveBase, `${options.reclaim}-${Date.now()}`);
     await mkdir28(archiveBase, { recursive: true });
     await rename9(src, archiveDest);
     logger.info("migrate", `Reclaimed: archived to ${archiveDest}`, { storyId: "_migrate" });
@@ -101378,8 +101684,8 @@ async function migrateCommand(options) {
     logger.info("migrate", `Merged: identity for "${options.merge}" updated`, { storyId: "_migrate" });
     return;
   }
-  const naxDir = path25.join(options.workdir, ".nax");
-  const configPath = path25.join(naxDir, "config.json");
+  const naxDir = path24.join(options.workdir, ".nax");
+  const configPath = path24.join(naxDir, "config.json");
   if (!existsSync30(configPath)) {
     throw new NaxError("No .nax/config.json found \u2014 run nax init first", "MIGRATE_NO_CONFIG", {
       stage: "migrate",
@@ -101395,7 +101701,7 @@ async function migrateCommand(options) {
       cause: e
     });
   }
-  const projectKey = config2.name?.trim() || path25.basename(options.workdir);
+  const projectKey = config2.name?.trim() || path24.basename(options.workdir);
   const destBase = projectOutputDir(projectKey, config2.outputDir);
   const candidates = await detectGeneratedContent(naxDir);
   if (candidates.length === 0) {
@@ -101404,7 +101710,7 @@ async function migrateCommand(options) {
   }
   if (options.dryRun) {
     for (const c of candidates) {
-      logger.info("migrate", `[dry-run] Would move: ${c.srcPath} -> ${path25.join(destBase, c.name)}`, {
+      logger.info("migrate", `[dry-run] Would move: ${c.srcPath} -> ${path24.join(destBase, c.name)}`, {
         storyId: "_migrate"
       });
     }
@@ -101413,8 +101719,8 @@ async function migrateCommand(options) {
   await mkdir28(destBase, { recursive: true });
   let moved = 0;
   for (const candidate of candidates) {
-    const dest = path25.join(destBase, candidate.name);
-    await mkdir28(path25.dirname(dest), { recursive: true });
+    const dest = path24.join(destBase, candidate.name);
+    await mkdir28(path24.dirname(dest), { recursive: true });
     if (existsSync30(dest)) {
       throw new NaxError(`Migration conflict: destination already exists.
   Source:      ${candidate.srcPath}
@@ -101444,7 +101750,7 @@ async function migrateCommand(options) {
     moved++;
     logger.info("migrate", `Moved: ${candidate.name}`, { storyId: "_migrate" });
   }
-  await Bun.write(path25.join(destBase, ".migrated-from"), JSON.stringify({ from: options.workdir, migratedAt: new Date().toISOString() }, null, 2));
+  await Bun.write(path24.join(destBase, ".migrated-from"), JSON.stringify({ from: options.workdir, migratedAt: new Date().toISOString() }, null, 2));
   logger.info("migrate", `Migration complete: ${moved} entries moved`, {
     storyId: "_migrate",
     destBase
@@ -101815,10 +102121,10 @@ function renderReport(timeline, options = {}) {
 // src/commands/replay.ts
 import { existsSync as existsSync32 } from "fs";
 import { dirname as dirname20 } from "path";
-async function readJsonlLenient(path26) {
-  if (!existsSync32(path26))
+async function readJsonlLenient(path25) {
+  if (!existsSync32(path25))
     return [];
-  const content = await Bun.file(path26).text();
+  const content = await Bun.file(path25).text();
   const lines = content.split(`
 `);
   const entries = [];
@@ -101832,11 +102138,11 @@ async function readJsonlLenient(path26) {
   }
   return entries;
 }
-async function readJsonOrUndefined(path26) {
-  if (!existsSync32(path26))
+async function readJsonOrUndefined(path25) {
+  if (!existsSync32(path25))
     return;
   try {
-    return await Bun.file(path26).json();
+    return await Bun.file(path25).json();
   } catch {
     return;
   }
@@ -102549,7 +102855,7 @@ __export(exports_precheck_runner, {
   runPrecheckValidation: () => runPrecheckValidation
 });
 import { mkdirSync as mkdirSync5 } from "fs";
-import path26 from "path";
+import path25 from "path";
 async function runPrecheckValidation(ctx) {
   const logger = getSafeLogger();
   if (process.env.NAX_PRECHECK !== "1") {
@@ -102558,7 +102864,7 @@ async function runPrecheckValidation(ctx) {
   }
   logger?.info("precheck", "Running precheck validations...");
   const { runPrecheck: runPrecheck3 } = await Promise.resolve().then(() => (init_precheck2(), exports_precheck));
-  const projectKey = ctx.config.name?.trim() || path26.basename(ctx.workdir);
+  const projectKey = ctx.config.name?.trim() || path25.basename(ctx.workdir);
   const outputDir = projectOutputDir(projectKey, ctx.config.outputDir);
   const featureLock = ctx.featureName !== undefined ? { outputDir, feature: ctx.featureName } : undefined;
   const precheckResult = await runPrecheck3(ctx.config, ctx.prd, {
@@ -102568,7 +102874,7 @@ async function runPrecheckValidation(ctx) {
     ...featureLock !== undefined ? { featureLock } : {}
   });
   if (ctx.logFilePath) {
-    mkdirSync5(path26.dirname(ctx.logFilePath), { recursive: true });
+    mkdirSync5(path25.dirname(ctx.logFilePath), { recursive: true });
     const precheckLog = {
       type: "precheck",
       timestamp: new Date().toISOString(),
@@ -102666,7 +102972,7 @@ __export(exports_run_setup, {
   warnInertBashStages: () => warnInertBashStages,
   warnProfileMismatch: () => warnProfileMismatch
 });
-import path27 from "path";
+import path26 from "path";
 async function setupRun(options) {
   const logger = getSafeLogger();
   warnFallbackMisconfiguration(options.config, options.agentGetFn, logger);
@@ -102731,6 +103037,7 @@ async function setupRun(options) {
   }
   await runtime.pidRegistry.cleanupStale();
   let cleanupCrashHandlers;
+  let sealApprovals;
   try {
     cleanupCrashHandlers = _runSetupDeps.installCrashHandlers({
       statusWriter,
@@ -102748,6 +103055,9 @@ async function setupRun(options) {
       emitError: (reason) => {
         pipelineEventBus.emit({ type: "run:errored", reason, feature: options.feature });
       },
+      sealApprovals: async () => {
+        await sealApprovals?.();
+      },
       onShutdown: async (abortSignal) => {
         await closeAllRunSessions(sessionManager, options.agentGetFn, { force: true, signal: abortSignal });
         await runtime.close().catch((err) => {
@@ -102760,7 +103070,7 @@ async function setupRun(options) {
     statusWriter.setPrd(prd);
     {
       const { detectGeneratedContent: detectGeneratedContent2, migrateCommand: migrateCommand2 } = await Promise.resolve().then(() => (init_commands(), exports_commands));
-      const naxDir = path27.join(workdir, ".nax");
+      const naxDir = path26.join(workdir, ".nax");
       const candidates = await detectGeneratedContent2(naxDir).catch(() => []);
       if (candidates.length > 0) {
         logger?.info("setup", "Found generated content under .nax/ \u2014 migrating to output dir", {
@@ -102787,7 +103097,7 @@ async function setupRun(options) {
           remoteUrl = new TextDecoder().decode(gitResult.stdout).trim() || null;
         }
       } catch {}
-      const projectKey = config2.name?.trim() || path27.basename(workdir);
+      const projectKey = config2.name?.trim() || path26.basename(workdir);
       await claimProjectIdentity2(projectKey, workdir, remoteUrl).catch((err) => {
         if (err instanceof NaxError && err.code === "RUN_NAME_COLLISION") {
           throw err;
@@ -102871,6 +103181,19 @@ async function setupRun(options) {
         sweepFeatureTranscripts: _runSetupDeps.sweepFeatureTranscripts
       }
     });
+    try {
+      sealApprovals = await _runSetupDeps.buildApprovalsSeal({
+        projectDir: options.workdir,
+        rootConfig: options.config,
+        packageDirs: initResult.prd.userStories.map(storyPackageDir),
+        outputDir: runtime.outputDir,
+        runId: options.runId
+      });
+    } catch (error48) {
+      await releaseFeatureLock({ outputDir: runtime.outputDir, feature, runId });
+      await releaseLock(workdir);
+      throw error48;
+    }
     return {
       statusWriter,
       sessionManager,
@@ -102880,7 +103203,8 @@ async function setupRun(options) {
       storyCounts: initResult.storyCounts,
       interactionChain: initResult.interactionChain,
       shutdownController,
-      runtime
+      runtime,
+      sealApprovals
     };
   } catch (error48) {
     cleanupCrashHandlers?.();
@@ -102909,6 +103233,7 @@ var init_run_setup = __esm(() => {
   init_test_runners();
   init_tools();
   init_git_env();
+  init_path_frame();
   init_crash_recovery();
   init_feature_lock();
   init_helpers();
@@ -102921,6 +103246,7 @@ var init_run_setup = __esm(() => {
     createRuntime,
     installCrashHandlers,
     sweepFeatureTranscripts,
+    buildApprovalsSeal,
     acquireLock,
     acquireFeatureLock
   };
@@ -104177,7 +104503,7 @@ var init_queue_file_lock = __esm(() => {
 
 // src/execution/queue-handler.ts
 import { rename as rename10, unlink as unlink11 } from "fs/promises";
-import path28 from "path";
+import path27 from "path";
 function getSafeLogger8() {
   try {
     return getLogger();
@@ -104209,8 +104535,8 @@ async function claimCommandsLocked(queuePath, processingPath, logger) {
   return result.commands;
 }
 async function readQueueFile(workdir) {
-  const queuePath = path28.join(workdir, ".queue.txt");
-  const processingPath = path28.join(workdir, ".queue.txt.processing");
+  const queuePath = path27.join(workdir, ".queue.txt");
+  const processingPath = path27.join(workdir, ".queue.txt.processing");
   const logger = getSafeLogger8();
   try {
     return await withQueueFileLock(queuePath, async () => {
@@ -104225,8 +104551,8 @@ async function readQueueFile(workdir) {
   }
 }
 async function processQueueFile(workdir, processor) {
-  const queuePath = path28.join(workdir, ".queue.txt");
-  const processingPath = path28.join(workdir, ".queue.txt.processing");
+  const queuePath = path27.join(workdir, ".queue.txt");
+  const processingPath = path27.join(workdir, ".queue.txt.processing");
   const logger = getSafeLogger8();
   try {
     return await withQueueFileLock(queuePath, async () => {
@@ -104251,7 +104577,7 @@ async function processQueueFile(workdir, processor) {
   }
 }
 async function drainQueueAtBatchBoundary(workdir, prd) {
-  if (!await Bun.file(path28.join(workdir, ".queue.txt")).exists()) {
+  if (!await Bun.file(path27.join(workdir, ".queue.txt")).exists()) {
     return { paused: false };
   }
   const logger = getSafeLogger8();
@@ -104307,10 +104633,10 @@ async function applyBatchBoundaryCommands(workdir, prd, commands, logger) {
     }
     if (cmd.type === "INJECT") {
       try {
-        if (path28.isAbsolute(cmd.storyFile)) {
+        if (path27.isAbsolute(cmd.storyFile)) {
           throw new NaxError(`INJECT storyFile must be a relative path within the workspace: ${cmd.storyFile}`, "INJECT_PATH_ABSOLUTE", { stage: "queue-batch-boundary", storyFile: cmd.storyFile });
         }
-        const storyFilePath = validateFilePath(path28.join(workdir, cmd.storyFile), workdir);
+        const storyFilePath = validateFilePath(path27.join(workdir, cmd.storyFile), workdir);
         const raw = await Bun.file(storyFilePath).json();
         const existingIds = new Set(prd.userStories.map((s) => s.id));
         const story = validateInjectedStory(raw, existingIds);
@@ -104330,8 +104656,8 @@ async function applyBatchBoundaryCommands(workdir, prd, commands, logger) {
   return { paused: false };
 }
 async function clearQueueFile(workdir) {
-  const queuePath = path28.join(workdir, ".queue.txt");
-  const processingPath = path28.join(workdir, ".queue.txt.processing");
+  const queuePath = path27.join(workdir, ".queue.txt");
+  const processingPath = path27.join(workdir, ".queue.txt.processing");
   const logger = getSafeLogger8();
   try {
     await withQueueFileLock(queuePath, async () => {
@@ -105750,12 +106076,12 @@ var init_body = __esm(() => {
 // src/finish/pr/context.ts
 import { readFile as readFile8 } from "fs/promises";
 import { join as join113 } from "path";
-async function readJson(path29) {
+async function readJson(path28) {
   let text;
   try {
-    text = await _finishPrDeps.readText(path29);
+    text = await _finishPrDeps.readText(path28);
   } catch (error48) {
-    _finishPrDeps.warn("[finish-pr] Failed to read PR context artifact", { path: path29, error: error48 });
+    _finishPrDeps.warn("[finish-pr] Failed to read PR context artifact", { path: path28, error: error48 });
     return;
   }
   if (text === null)
@@ -105763,7 +106089,7 @@ async function readJson(path29) {
   try {
     return JSON.parse(text);
   } catch (error48) {
-    _finishPrDeps.warn("[finish-pr] Failed to parse PR context artifact", { path: path29, error: error48 });
+    _finishPrDeps.warn("[finish-pr] Failed to parse PR context artifact", { path: path28, error: error48 });
     return;
   }
 }
@@ -105847,9 +106173,9 @@ var init_context5 = __esm(() => {
   init_pr_title();
   _finishPrDeps = {
     run: defaultForgeDeps.run,
-    readText: async (path29) => {
+    readText: async (path28) => {
       try {
-        return await readFile8(path29, "utf8");
+        return await readFile8(path28, "utf8");
       } catch (err) {
         if (err.code === "ENOENT")
           return null;
@@ -106738,7 +107064,7 @@ var init_finish = __esm(() => {
 });
 
 // src/execution/runner-completion.ts
-import path29 from "path";
+import path28 from "path";
 async function runCompletionPhase(options) {
   const logger = getSafeLogger();
   logger?.debug("execution", "Completion phase started", {
@@ -106759,7 +107085,7 @@ async function runCompletionPhase(options) {
       const acceptanceStartTime = Date.now();
       pipelineEventBus.emit({ type: "postrun:phase:started", phase: "acceptance" });
       const acceptanceTestPaths = options.featureDir ? await Promise.all((await groupStoriesByPackage(options.prd, options.workdir, options.feature, options.config.acceptance.testPath, options.config.project?.language)).map(async (g) => {
-        const relativeWorkdir = path29.relative(options.workdir, g.packageDir);
+        const relativeWorkdir = path28.relative(options.workdir, g.packageDir);
         let groupConfig = options.config;
         if (relativeWorkdir && relativeWorkdir !== ".") {
           try {
@@ -106890,7 +107216,7 @@ async function runCompletionPhase(options) {
     exitReason: options.exitReason,
     runtime: options.runtime,
     abortSignal: options.abortSignal,
-    isSequential: options.parallel === undefined,
+    isSequential: options.parallel === undefined || !(options.parallel > 1),
     interactionChain: options.interactionChain
   });
   const { durationMs, runCompletedAt, finalCounts, reportedTotal, pluginGateFailed } = completionResult;
@@ -107496,7 +107822,7 @@ __export(exports_parallel_batch, {
   _parallelBatchDeps: () => _parallelBatchDeps,
   runParallelBatch: () => runParallelBatch
 });
-import path30 from "path";
+import path29 from "path";
 async function runParallelBatch(options) {
   const { stories, ctx, prd } = options;
   const { workdir, config: config2, maxConcurrency, pipelineContext, eventEmitter, agentGetFn, hooks, pluginRegistry } = ctx;
@@ -107531,7 +107857,7 @@ async function runParallelBatch(options) {
     }
     worktreePaths.set(story.id, storyWorktreePath(workdir, worktreeId));
   }
-  const rootConfigPath = path30.join(workdir, ".nax", "config.json");
+  const rootConfigPath = path29.join(workdir, ".nax", "config.json");
   const profileOverride = profileOverrideFromConfig(config2);
   const storyEffectiveConfigs = new Map;
   const configResults = await Promise.allSettled(stories.filter((story) => storyPackageDir(story)).map(async (story) => {
@@ -108514,7 +108840,8 @@ async function run(options) {
     pluginRegistry,
     interactionChain,
     shutdownController,
-    runtime
+    runtime,
+    sealApprovals
   } = setupResult;
   prd = setupResult.prd;
   const agentManager = runtime.agentManager;
@@ -108636,7 +108963,8 @@ async function run(options) {
         projectKey: runtime.projectKey,
         curatorRollupPath: runtime.curatorRollupPath,
         logFilePath,
-        config: config2
+        config: config2,
+        sealApprovals
       });
       logger?.debug("execution", "Runner finally \u2014 cleanupRun done, run() returning");
     } finally {
@@ -109101,12 +109429,12 @@ async function checkDependenciesInstalled(workdir) {
     { path: "vendor" }
   ];
   const found = [];
-  for (const { path: path31 } of depPaths) {
-    const fullPath = `${workdir}/${path31}`;
+  for (const { path: path30 } of depPaths) {
+    const fullPath = `${workdir}/${path30}`;
     if (existsSync36(fullPath)) {
       const stats = statSync6(fullPath);
       if (stats.isDirectory()) {
-        found.push(path31);
+        found.push(path30);
       }
     }
   }
@@ -110535,8 +110863,8 @@ var init_plan_runtime = __esm(() => {
   init_git_env();
   init_plan_helpers();
   _planDeps = {
-    readFile: (path31) => Bun.file(path31).text(),
-    writeFile: (path31, content) => Bun.write(path31, content).then(() => {}),
+    readFile: (path30) => Bun.file(path30).text(),
+    writeFile: (path30, content) => Bun.write(path30, content).then(() => {}),
     scanSourceRoots: (workdir) => scanSourceRoots(workdir),
     createRuntime: (cfg, wd, featureName) => createRuntime(cfg, wd, { featureName }),
     claimProjectIdentity,
@@ -110545,10 +110873,10 @@ var init_plan_runtime = __esm(() => {
       const result = Bun.spawnSync(cmd, opts ? { cwd: opts.cwd, ...opts.env ? { env: opts.env } : {} } : {});
       return { stdout: result.stdout, exitCode: result.exitCode };
     },
-    mkdirp: (path31) => Bun.spawn(["mkdir", "-p", path31]).exited.then(() => {}),
-    existsSync: (path31) => existsSync38(path31),
+    mkdirp: (path30) => Bun.spawn(["mkdir", "-p", path30]).exited.then(() => {}),
+    existsSync: (path30) => existsSync38(path30),
     discoverWorkspacePackages: (repoRoot) => discoverWorkspacePackages2(repoRoot),
-    readPackageJsonAt: (path31) => Bun.file(path31).json().catch(() => null),
+    readPackageJsonAt: (path30) => Bun.file(path30).json().catch(() => null),
     createInteractionBridge: () => createCliInteractionBridge(),
     initInteractionChain: (cfg, headless) => initInteractionChain(cfg, headless),
     runPrecheck: async (config2, prd, opts) => {
@@ -110569,7 +110897,7 @@ function assertSpecLintClean(specContent, options) {
     return [];
   const findings = lintSpecContent(specContent, {
     maxAcCount: options.maxAcCount,
-    fileExists: (path31) => existsSync39(join118(options.workdir, path31))
+    fileExists: (path30) => existsSync39(join118(options.workdir, path30))
   });
   const blocking = findings.filter((finding) => BLOCKING_SPEC_LINT_CODES.has(finding.code));
   if (blocking.length > 0) {
@@ -110629,7 +110957,7 @@ async function buildPlanModeContext(workdir, fullConfig, options, deps) {
   }));
   const codebaseContext = buildSourceRootsSection(normalizedRoots);
   const relativePackages = [
-    ...new Set(sourceRoots.map((root) => root.path).filter((path31) => path31 !== ".").map((path31) => path31.startsWith("/") ? path31.replace(`${workdir}/`, "") : path31))
+    ...new Set(sourceRoots.map((root) => root.path).filter((path30) => path30 !== ".").map((path30) => path30.startsWith("/") ? path30.replace(`${workdir}/`, "") : path30))
   ];
   const packageDetails = relativePackages.length === 0 ? [] : await Promise.all(relativePackages.map(async (relativePath) => {
     const packageJson = await deps.readPackageJsonAt(join119(workdir, relativePath, "package.json"));
@@ -110772,7 +111100,7 @@ var init_persist_prd = __esm(() => {
   init_prd();
   init_finalize_routing();
   _persistPrdDeps = {
-    existsSync: (path31) => defaultExistsSync(path31),
+    existsSync: (path30) => defaultExistsSync(path30),
     discoverWorkspacePackages: (repoRoot) => discoverWorkspacePackages2(repoRoot)
   };
 });
@@ -111035,10 +111363,10 @@ var init_plan2 = __esm(() => {
 });
 
 // src/cli/plugins.ts
-import * as path31 from "path";
+import * as path30 from "path";
 async function pluginsListCommand(config2, workdir, overrideGlobalPluginsDir) {
-  const globalPluginsDir = overrideGlobalPluginsDir ?? path31.join(globalConfigDir(), "plugins");
-  const projectPluginsDir = path31.join(workdir, ".nax", "plugins");
+  const globalPluginsDir = overrideGlobalPluginsDir ?? path30.join(globalConfigDir(), "plugins");
+  const projectPluginsDir = path30.join(workdir, ".nax", "plugins");
   const configPlugins = config2.plugins || [];
   const registry4 = await loadPlugins(globalPluginsDir, projectPluginsDir, configPlugins, workdir, config2.disabledPlugins);
   const plugins = registry4.plugins;
@@ -111088,10 +111416,10 @@ function formatSource(type, sourcePath) {
     return `built-in (${sourcePath})`;
   }
   if (type === "global") {
-    return `global (${path31.basename(sourcePath)})`;
+    return `global (${path30.basename(sourcePath)})`;
   }
   if (type === "project") {
-    return `project (${path31.basename(sourcePath)})`;
+    return `project (${path30.basename(sourcePath)})`;
   }
   return `config (${sourcePath})`;
 }
@@ -111133,7 +111461,7 @@ async function exportPromptCommand(options) {
 var VALID_EXPORT_ROLES;
 var init_prompts_export = __esm(() => {
   init_prompts();
-  VALID_EXPORT_ROLES = ["test-writer", "implementer", "verifier", "single-session", "tdd-simple"];
+  VALID_EXPORT_ROLES = ["test-writer", "implementer", "verifier", "tdd-simple"];
 });
 
 // src/cli/prompts-init.ts
@@ -111175,7 +111503,6 @@ async function autoWirePromptsConfig(workdir) {
           "test-writer": ".nax/templates/test-writer.md",
           implementer: ".nax/templates/implementer.md",
           verifier: ".nax/templates/verifier.md",
-          "single-session": ".nax/templates/single-session.md",
           "tdd-simple": ".nax/templates/tdd-simple.md"
         }
       }
@@ -111196,7 +111523,6 @@ ${exampleConfig}`);
     "test-writer": ".nax/templates/test-writer.md",
     implementer: ".nax/templates/implementer.md",
     verifier: ".nax/templates/verifier.md",
-    "single-session": ".nax/templates/single-session.md",
     "tdd-simple": ".nax/templates/tdd-simple.md"
   };
   prompts.overrides = overrides;
@@ -111255,7 +111581,6 @@ var init_prompts_init = __esm(() => {
     { file: "test-writer.md", role: "test-writer" },
     { file: "implementer.md", role: "implementer", variant: "standard" },
     { file: "verifier.md", role: "verifier" },
-    { file: "single-session.md", role: "single-session" },
     { file: "tdd-simple.md", role: "tdd-simple" }
   ];
 });
@@ -111493,8 +111818,8 @@ async function resolveRunProfileOverride(opts) {
     return cliChain;
   if (opts.envProfile)
     return;
-  const readJson2 = opts._readJson ?? (async (path32) => {
-    const file2 = Bun.file(path32);
+  const readJson2 = opts._readJson ?? (async (path31) => {
+    const file2 = Bun.file(path31);
     if (!await file2.exists())
       return;
     return file2.json();
@@ -111874,11 +112199,11 @@ var init_rules_cli_deps = __esm(() => {
   init_logger2();
   init_rules_lint();
   _rulesCLIDeps = {
-    readFile: async (path32) => Bun.file(path32).text(),
-    writeFile: async (path32, content) => {
-      await Bun.write(path32, content);
+    readFile: async (path31) => Bun.file(path31).text(),
+    writeFile: async (path31, content) => {
+      await Bun.write(path31, content);
     },
-    fileExists: async (path32) => Bun.file(path32).exists(),
+    fileExists: async (path31) => Bun.file(path31).exists(),
     globInDir: (dir) => {
       try {
         return [...new Bun.Glob("*.md").scanSync({ cwd: dir })].sort().map((f) => join127(dir, f));
@@ -111886,8 +112211,8 @@ var init_rules_cli_deps = __esm(() => {
         return [];
       }
     },
-    mkdir: async (path32) => {
-      await mkdir33(path32, { recursive: true });
+    mkdir: async (path31) => {
+      await mkdir33(path31, { recursive: true });
     },
     globCanonicalRuleFiles: (workdir) => _rulesLintDeps.globCanonicalRuleFiles(workdir),
     globHasMatch: (pattern, cwd) => _rulesLintDeps.globHasMatch(pattern, cwd),
@@ -112404,10 +112729,10 @@ var init_setup_analyze = __esm(() => {
   init_detect();
   CANONICAL_SCRIPTS = ["build", "test", "lint", "type-check", "lint:fix"];
   _analyzeRepoDeps = {
-    fileExists: async (path32) => Bun.file(path32).exists(),
-    readJson: async (path32) => {
+    fileExists: async (path31) => Bun.file(path31).exists(),
+    readJson: async (path31) => {
       try {
-        const f = Bun.file(path32);
+        const f = Bun.file(path31);
         if (!await f.exists())
           return null;
         return JSON.parse(await f.text());
@@ -112462,9 +112787,9 @@ async function fillScripts(workdir, analysis) {
 var TYPE_CHECK_KEY = "type-check", TYPE_CHECK_SCRIPT = "tsc --noEmit -p tsconfig.json", TYPE_CHECK_TURBO_PASSTHROUGH = "turbo run type-check", _fillScriptsDeps;
 var init_setup_fill = __esm(() => {
   _fillScriptsDeps = {
-    readJson: async (path32) => {
+    readJson: async (path31) => {
       try {
-        const f = Bun.file(path32);
+        const f = Bun.file(path31);
         if (!await f.exists())
           return null;
         return JSON.parse(await f.text());
@@ -112472,8 +112797,8 @@ var init_setup_fill = __esm(() => {
         return null;
       }
     },
-    writeFile: async (path32, content) => {
-      await Bun.write(path32, content);
+    writeFile: async (path31, content) => {
+      await Bun.write(path31, content);
     }
   };
 });
@@ -112531,9 +112856,9 @@ async function writeSetupConfig(workdir, config2, monoConfigs, _opts, deps = _wr
 var _writeSetupDeps;
 var init_setup_write = __esm(() => {
   _writeSetupDeps = {
-    writeFile: (path32, content) => Bun.write(path32, content).then(() => {}),
-    mkdir: async (path32) => {
-      const proc = Bun.spawn(["mkdir", "-p", path32]);
+    writeFile: (path31, content) => Bun.write(path31, content).then(() => {}),
+    mkdir: async (path31) => {
+      const proc = Bun.spawn(["mkdir", "-p", path31]);
       await proc.exited;
     }
   };
@@ -112617,7 +112942,7 @@ var init_setup = __esm(() => {
     },
     generateSetupPlan: (ctx, analysis) => generateSetupPlan(ctx, analysis),
     runGate: (workdir, config2) => runSetupGate(workdir, config2),
-    fileExists: (path32) => Bun.file(path32).exists(),
+    fileExists: (path31) => Bun.file(path31).exists(),
     writeSetupConfig: (workdir, config2, monoConfigs, opts) => writeSetupConfig(workdir, config2, monoConfigs, opts),
     stdout: (msg) => {
       process.stdout.write(`${msg}
@@ -112634,7 +112959,7 @@ var init_setup = __esm(() => {
 import { existsSync as existsSync43 } from "fs";
 import { join as join135 } from "path";
 async function resolveSpecPaths(options, deps) {
-  const explicit = (options.paths ?? []).filter((path32) => path32.trim().length > 0);
+  const explicit = (options.paths ?? []).filter((path31) => path31.trim().length > 0);
   if (explicit.length > 0)
     return [...explicit];
   if (!options.feature)
@@ -112662,7 +112987,7 @@ async function lintOne(specPath, options, deps) {
   }
   const findings = lintSpecContent(content, {
     maxAcCount: options.maxAcCount,
-    fileExists: (path32) => deps.fileExists(join135(options.dir, path32))
+    fileExists: (path31) => deps.fileExists(join135(options.dir, path31))
   });
   return {
     specPath,
@@ -112728,7 +113053,7 @@ var init_spec_lint_command = __esm(() => {
   init_prd();
   init_features_resolve();
   _specLintCommandDeps = {
-    readFile: async (path32) => Bun.file(path32).text(),
+    readFile: async (path31) => Bun.file(path31).text(),
     fileExists: existsSync43,
     write: (line) => {
       console.log(line);
@@ -114648,11 +114973,11 @@ var require_react_reconciler_development = __commonJS(function(exports, module)
         fiber = fiber.next, id--;
       return fiber;
     }
-    function copyWithSetImpl(obj, path32, index, value) {
-      if (index >= path32.length)
+    function copyWithSetImpl(obj, path31, index, value) {
+      if (index >= path31.length)
         return value;
-      var key = path32[index], updated = isArrayImpl(obj) ? obj.slice() : assign2({}, obj);
-      updated[key] = copyWithSetImpl(obj[key], path32, index + 1, value);
+      var key = path31[index], updated = isArrayImpl(obj) ? obj.slice() : assign2({}, obj);
+      updated[key] = copyWithSetImpl(obj[key], path31, index + 1, value);
       return updated;
     }
     function copyWithRename(obj, oldPath, newPath) {
@@ -114672,11 +114997,11 @@ var require_react_reconciler_development = __commonJS(function(exports, module)
       index + 1 === oldPath.length ? (updated[newPath[index]] = updated[oldKey], isArrayImpl(updated) ? updated.splice(oldKey, 1) : delete updated[oldKey]) : updated[oldKey] = copyWithRenameImpl(obj[oldKey], oldPath, newPath, index + 1);
       return updated;
     }
-    function copyWithDeleteImpl(obj, path32, index) {
-      var key = path32[index], updated = isArrayImpl(obj) ? obj.slice() : assign2({}, obj);
-      if (index + 1 === path32.length)
+    function copyWithDeleteImpl(obj, path31, index) {
+      var key = path31[index], updated = isArrayImpl(obj) ? obj.slice() : assign2({}, obj);
+      if (index + 1 === path31.length)
         return isArrayImpl(updated) ? updated.splice(key, 1) : delete updated[key], updated;
-      updated[key] = copyWithDeleteImpl(obj[key], path32, index + 1);
+      updated[key] = copyWithDeleteImpl(obj[key], path31, index + 1);
       return updated;
     }
     function shouldSuspendImpl() {
@@ -124700,29 +125025,29 @@ Check the top-level render call using <` + componentName2 + ">.");
     var didWarnAboutNestedUpdates = false;
     var didWarnAboutFindNodeInStrictMode = {};
     var overrideHookState = null, overrideHookStateDeletePath = null, overrideHookStateRenamePath = null, overrideProps = null, overridePropsDeletePath = null, overridePropsRenamePath = null, scheduleUpdate = null, scheduleRetry = null, setErrorHandler = null, setSuspenseHandler = null;
-    overrideHookState = function(fiber, id, path32, value) {
+    overrideHookState = function(fiber, id, path31, value) {
       id = findHook(fiber, id);
-      id !== null && (path32 = copyWithSetImpl(id.memoizedState, path32, 0, value), id.memoizedState = path32, id.baseState = path32, fiber.memoizedProps = assign2({}, fiber.memoizedProps), path32 = enqueueConcurrentRenderForLane(fiber, 2), path32 !== null && scheduleUpdateOnFiber(path32, fiber, 2));
+      id !== null && (path31 = copyWithSetImpl(id.memoizedState, path31, 0, value), id.memoizedState = path31, id.baseState = path31, fiber.memoizedProps = assign2({}, fiber.memoizedProps), path31 = enqueueConcurrentRenderForLane(fiber, 2), path31 !== null && scheduleUpdateOnFiber(path31, fiber, 2));
     };
-    overrideHookStateDeletePath = function(fiber, id, path32) {
+    overrideHookStateDeletePath = function(fiber, id, path31) {
       id = findHook(fiber, id);
-      id !== null && (path32 = copyWithDeleteImpl(id.memoizedState, path32, 0), id.memoizedState = path32, id.baseState = path32, fiber.memoizedProps = assign2({}, fiber.memoizedProps), path32 = enqueueConcurrentRenderForLane(fiber, 2), path32 !== null && scheduleUpdateOnFiber(path32, fiber, 2));
+      id !== null && (path31 = copyWithDeleteImpl(id.memoizedState, path31, 0), id.memoizedState = path31, id.baseState = path31, fiber.memoizedProps = assign2({}, fiber.memoizedProps), path31 = enqueueConcurrentRenderForLane(fiber, 2), path31 !== null && scheduleUpdateOnFiber(path31, fiber, 2));
     };
     overrideHookStateRenamePath = function(fiber, id, oldPath, newPath) {
       id = findHook(fiber, id);
       id !== null && (oldPath = copyWithRename(id.memoizedState, oldPath, newPath), id.memoizedState = oldPath, id.baseState = oldPath, fiber.memoizedProps = assign2({}, fiber.memoizedProps), oldPath = enqueueConcurrentRenderForLane(fiber, 2), oldPath !== null && scheduleUpdateOnFiber(oldPath, fiber, 2));
     };
-    overrideProps = function(fiber, path32, value) {
-      fiber.pendingProps = copyWithSetImpl(fiber.memoizedProps, path32, 0, value);
+    overrideProps = function(fiber, path31, value) {
+      fiber.pendingProps = copyWithSetImpl(fiber.memoizedProps, path31, 0, value);
       fiber.alternate && (fiber.alternate.pendingProps = fiber.pendingProps);
-      path32 = enqueueConcurrentRenderForLane(fiber, 2);
-      path32 !== null && scheduleUpdateOnFiber(path32, fiber, 2);
+      path31 = enqueueConcurrentRenderForLane(fiber, 2);
+      path31 !== null && scheduleUpdateOnFiber(path31, fiber, 2);
     };
-    overridePropsDeletePath = function(fiber, path32) {
-      fiber.pendingProps = copyWithDeleteImpl(fiber.memoizedProps, path32, 0);
+    overridePropsDeletePath = function(fiber, path31) {
+      fiber.pendingProps = copyWithDeleteImpl(fiber.memoizedProps, path31, 0);
       fiber.alternate && (fiber.alternate.pendingProps = fiber.pendingProps);
-      path32 = enqueueConcurrentRenderForLane(fiber, 2);
-      path32 !== null && scheduleUpdateOnFiber(path32, fiber, 2);
+      path31 = enqueueConcurrentRenderForLane(fiber, 2);
+      path31 !== null && scheduleUpdateOnFiber(path31, fiber, 2);
     };
     overridePropsRenamePath = function(fiber, oldPath, newPath) {
       fiber.pendingProps = copyWithRename(fiber.memoizedProps, oldPath, newPath);
@@ -126361,11 +126686,38 @@ init_config_profile();
 init_features_resolve();
 init_generate();
 
+// src/cli/run-max-iterations.ts
+function parseMaxIterationsFlag(raw) {
+  if (raw === undefined)
+    return { ok: true, value: undefined };
+  const value = Number.parseInt(raw, 10);
+  if (!Number.isFinite(value) || value < 1) {
+    return { ok: false, message: "--max-iterations must be a positive integer" };
+  }
+  return { ok: true, value };
+}
+function applyMaxIterationsFlag(config2, flag) {
+  if (flag === undefined)
+    return { ...config2, execution: { ...config2.execution } };
+  return { ...config2, execution: { ...config2.execution, maxIterations: flag } };
+}
+
 // src/cli/run-mode.ts
 function resolveUseHeadless(input) {
   return !input.isTTY || input.headlessFlag || input.headlessEnv || input.formatterMode === "json";
 }
 
+// src/cli/run-parallel.ts
+function parseParallelFlag(raw) {
+  if (raw === undefined)
+    return { ok: true, value: undefined };
+  const value = Number.parseInt(raw, 10);
+  if (!Number.isFinite(value) || value < 1) {
+    return { ok: false, message: "--parallel must be a positive integer (omit it to run sequentially)" };
+  }
+  return { ok: true, value };
+}
+
 // bin/nax.ts
 init_status_dispatch();
 
@@ -126384,14 +126736,14 @@ function resolveEffective(detected, configPatterns) {
     return "detected";
   return "none";
 }
-async function loadRawConfig(path32) {
-  const f = Bun.file(path32);
+async function loadRawConfig(path31) {
+  const f = Bun.file(path31);
   if (!await f.exists())
     return {};
   return JSON.parse(await f.text());
 }
-async function writeRawConfig(path32, data) {
-  await Bun.write(path32, `${JSON.stringify(data, null, 2)}
+async function writeRawConfig(path31, data) {
+  await Bun.write(path31, `${JSON.stringify(data, null, 2)}
 `);
 }
 function deepSet(obj, keyPath, value) {
@@ -131475,8 +131827,8 @@ function Text({ color, backgroundColor, dimColor = false, bold = false, italic =
 }
 
 // node_modules/ink/build/components/ErrorOverview.js
-var cleanupPath = (path32) => {
-  return path32?.replace(`file://${cwd()}/`, "");
+var cleanupPath = (path31) => {
+  return path31?.replace(`file://${cwd()}/`, "");
 };
 var stackUtils = new import_stack_utils.default({
   cwd: cwd(),
@@ -134517,7 +134869,7 @@ program2.command("setup").description("Analyze repo and generate .nax/config.jso
   });
   process.exit(exitCode);
 });
-program2.command("run").description("Run the orchestration loop for a feature").requiredOption("-f, --feature <name>", "Feature name").option("-a, --agent <name>", "Force a specific agent").option("-m, --max-iterations <n>", "Max iterations", "20").option("--max-cost <usd>", "Override cost limit (USD) for this run \u2014 aborts execution when exceeded").option("--dry-run", "Show plan without executing", false).option("--no-context", "Disable context builder (skip file context in prompts)").option("--no-batch", "Disable story batching (execute all stories individually)").option("--parallel <n>", "Max parallel sessions (0=auto, omit=sequential)").option("--plan", "Run plan phase first before execution", false).option("--from <spec-path>", "Path to spec file (required when --plan is used)").option("--no-spec-lint", "Plan even when the spec declares sections that extract to nothing").option("--one-shot", "Skip interactive planning Q&A, use single LLM call (ACP only)", false).option("--force", "Force overwrite existing prd.json when using --plan", false).option("--headless", "Force headless mode (disable TUI, use pipe mode)", false).option("--verbose", "Enable verbose logging (debug level)", false).option("--quiet", "Quiet mode (warnings and errors only)", false).option("--silent", "Silent mode (errors only)", false).option("--json", "JSON mode (raw JSONL output to stdout)", false).option("-d, --dir <path>", "Working directory", process.cwd()).option("--skip-precheck", "Skip precheck validations (advanced users only)", false).option("--profile <name>", "Profile(s) to overlay (comma-separated or repeated; later overrides earlier)", collectProfile, []).option("--schedule <when>", "Defer run start until <when> (e.g. 30m, 1h30m, 17:00, 2026-07-02T02:00)").option("--compare <agents>", "Bake-off mode: comma-separated list of contestant agents (e.g. claude,codex)").option("--fresh", "Ignore any existing checkpoint.jsonl and re-run every incomplete story from scratch", false).addOption(new Option("--no-resume", "Alias for --fresh: never auto-resume from a prior checkpoint").default("__UNSET__")).action(async (options) => {
+program2.command("run").description("Run the orchestration loop for a feature").requiredOption("-f, --feature <name>", "Feature name").option("-a, --agent <name>", "Force a specific agent").option("-m, --max-iterations <n>", "Max iterations").option("--max-cost <usd>", "Override cost limit (USD) for this run \u2014 aborts execution when exceeded").option("--dry-run", "Show plan without executing", false).option("--no-context", "Disable context builder (skip file context in prompts)").option("--no-batch", "Disable story batching (execute all stories individually)").option("--parallel <n>", "Max parallel sessions (omit = sequential)").option("--plan", "Run plan phase first before execution", false).option("--from <spec-path>", "Path to spec file (required when --plan is used)").option("--no-spec-lint", "Plan even when the spec declares sections that extract to nothing").option("--one-shot", "Skip interactive planning Q&A, use single LLM call (ACP only)", false).option("--force", "Force overwrite existing prd.json when using --plan", false).option("--headless", "Force headless mode (disable TUI, use pipe mode)", false).option("--verbose", "Enable verbose logging (debug level)", false).option("--quiet", "Quiet mode (warnings and errors only)", false).option("--silent", "Silent mode (errors only)", false).option("--json", "JSON mode (raw JSONL output to stdout)", false).option("-d, --dir <path>", "Working directory", process.cwd()).option("--skip-precheck", "Skip precheck validations (advanced users only)", false).option("--profile <name>", "Profile(s) to overlay (comma-separated or repeated; later overrides earlier)", collectProfile, []).option("--schedule <when>", "Defer run start until <when> (e.g. 30m, 1h30m, 17:00, 2026-07-02T02:00)").option("--compare <agents>", "Bake-off mode: comma-separated list of contestant agents (e.g. claude,codex)").option("--fresh", "Ignore any existing checkpoint.jsonl and re-run every incomplete story from scratch", false).addOption(new Option("--no-resume", "Alias for --fresh: never auto-resume from a prior checkpoint").default("__UNSET__")).action(async (options) => {
   try {
     validateFeatureName(options.feature);
   } catch (err) {
@@ -134531,6 +134883,17 @@ program2.command("run").description("Run the orchestration loop for a feature").
     console.error(source_default.red(`Invalid directory: ${err.message}`));
     process.exit(1);
   }
+  const maxIterationsFlag = parseMaxIterationsFlag(options.maxIterations);
+  if (!maxIterationsFlag.ok) {
+    console.error(source_default.red(maxIterationsFlag.message));
+    process.exit(1);
+  }
+  const parallelFlag = parseParallelFlag(options.parallel);
+  if (!parallelFlag.ok) {
+    console.error(source_default.red(parallelFlag.message));
+    process.exit(1);
+  }
+  const parallel = parallelFlag.value;
   try {
     const { assertCompareAgentExclusive: assertCompareAgentExclusive2 } = await Promise.resolve().then(() => (init_preflight(), exports_preflight));
     assertCompareAgentExclusive2({ compare: options.compare, agent: options.agent });
@@ -134720,12 +135083,7 @@ program2.command("run").description("Run the orchestration loop for a feature").
     config2.agent ??= {};
     config2.agent.default = options.agent;
   }
-  const maxIterations = Number.parseInt(options.maxIterations, 10);
-  if (!Number.isFinite(maxIterations) || maxIterations < 1) {
-    console.error(source_default.red("--max-iterations must be a positive integer"));
-    process.exit(1);
-  }
-  config2.execution.maxIterations = maxIterations;
+  config2 = applyMaxIterationsFlag(config2, maxIterationsFlag.value);
   if (options.maxCost !== undefined) {
     const maxCost = Number(options.maxCost);
     if (!Number.isFinite(maxCost) || maxCost <= 0) {
@@ -134765,15 +135123,6 @@ program2.command("run").description("Run the orchestration loop for a feature").
     console.log(source_default.dim("   [Headless mode \u2014 pipe output]"));
   }
   const statusFilePath = join142(outputDir, "status.json");
-  let parallel;
-  if (options.parallel !== undefined) {
-    parallel = Number.parseInt(options.parallel, 10);
-    if (Number.isNaN(parallel) || parallel < 0) {
-      tuiInstance?.unmount();
-      console.error(source_default.red("--parallel must be a non-negative integer"));
-      process.exit(1);
-    }
-  }
   if (scheduleGate.target) {
     const scheduleController = new AbortController;
     const onSigint = () => scheduleController.abort();
@@ -135205,8 +135554,8 @@ configProfileCmd.command("current").description("Show the currently active profi
 });
 configProfileCmd.command("create <name>").description("Create a new empty profile").option("-d, --dir <path>", "Project directory", process.cwd()).action(async (name, options) => {
   try {
-    const path32 = await profileCreateCommand(name, options.dir);
-    console.log(`Created profile at: ${path32}`);
+    const path31 = await profileCreateCommand(name, options.dir);
+    console.log(`Created profile at: ${path31}`);
   } catch (err) {
     console.error(source_default.red(`Error: ${err.message}`));
     process.exit(1);