@nathapp/nax 0.83.6 → 0.83.7

package/dist/nax.js

@@ -322,6 +322,31 @@ var init_approval_audit = __esm(() => {
   init_secret_spans();
 });
 
+// ../nax-agent/src/internal/atomic-write.ts
+import { randomUUID } from "crypto";
+import { rename, rm, writeFile } from "fs/promises";
+async function writeFileAtomic(path, content, options = {}) {
+  const staged = `${path}.${randomUUID()}.tmp`;
+  try {
+    await _atomicWriteDeps.writeFile(staged, content, {
+      encoding: "utf8",
+      ...options.mode !== undefined ? { mode: options.mode } : {}
+    });
+    await _atomicWriteDeps.rename(staged, path);
+  } catch (error) {
+    await _atomicWriteDeps.rm(staged, { force: true });
+    throw error;
+  }
+}
+var _atomicWriteDeps;
+var init_atomic_write = __esm(() => {
+  _atomicWriteDeps = {
+    writeFile: (path, content, options) => writeFile(path, content, options),
+    rename,
+    rm
+  };
+});
+
 // ../nax-agent/src/internal/process-alive.ts
 function isProcessAlive(pid) {
   if (!Number.isInteger(pid) || pid <= 0)
@@ -335,7 +360,7 @@ function isProcessAlive(pid) {
 }
 
 // ../nax-agent/src/internal/file-lock.ts
-import { readFile, stat, unlink, writeFile } from "fs/promises";
+import { readFile, stat, unlink, writeFile as writeFile2 } from "fs/promises";
 function unlinkQuiet(path) {
   return _fileLockDeps.unlink(path).catch(() => {});
 }
@@ -428,7 +453,7 @@ var DEFAULT_RETRY_MS = 10, DEFAULT_TIMEOUT_MS = 5000, EMPTY_LOCK_EVICT_AGE_MS =
 var init_file_lock = __esm(() => {
   init_infra();
   _fileLockDeps = {
-    writeFile,
+    writeFile: writeFile2,
     readFile,
     stat,
     unlink,
@@ -453,7 +478,7 @@ var init_path_file_lock = __esm(() => {
 
 // ../nax-agent/src/permissions/approvals-store.ts
 import { createHash } from "crypto";
-import { mkdir as mkdir2, readFile as readFile2, stat as stat2, writeFile as writeFile2 } from "fs/promises";
+import { mkdir as mkdir2, readFile as readFile2, stat as stat2 } from "fs/promises";
 import { dirname, isAbsolute, join as join2, relative, resolve } from "path";
 function approvalsPath(outputDir) {
   return join2(outputDir, "approvals.json");
@@ -529,14 +554,20 @@ async function readApprovals(path) {
 async function writeApprovalsFile(path, file) {
   const body = file.taint === undefined ? { entries: file.entries } : { taint: file.taint, entries: file.entries };
   await mkdir2(dirname(path), { recursive: true });
-  await writeFile2(path, `${JSON.stringify(body, null, 2)}
-`, "utf8");
+  await writeFileAtomic(path, `${JSON.stringify(body, null, 2)}
+`);
 }
 async function appendApproval(path, entry) {
   await mkdir2(dirname(path), { recursive: true });
   await withPathFileLock(path, async () => {
-    const existing = await readApprovalsFile(path);
-    await writeApprovalsFile(path, { taint: existing.taint, entries: [...existing.entries, entry] });
+    const read = await readApprovalsFileDetailed(path);
+    if (read.state === "unparseable") {
+      throw new NaxError("approvals.json could not be parsed; not rewriting it", "APPROVALS_STORE_UNPARSEABLE", {
+        stage: "permissions",
+        path
+      });
+    }
+    await writeApprovalsFile(path, { taint: read.file.taint, entries: [...read.file.entries, entry] });
   });
 }
 async function applyRemoval(path, decide) {
@@ -587,6 +618,8 @@ function isWithin(projectRoot, root) {
 }
 var EMPTY_FILE;
 var init_approvals_store = __esm(() => {
+  init_infra();
+  init_atomic_write();
   init_path_file_lock();
   EMPTY_FILE = { entries: [], taint: undefined };
 });
@@ -2212,8 +2245,8 @@ var init_chained_store = __esm(() => {
 });
 
 // ../nax-agent/src/native/credentials/fingerprint.ts
-import { createHmac, randomBytes, randomUUID } from "crypto";
-import { link, mkdir as mkdir4, readFile as readFile3, rm, writeFile as writeFile3 } from "fs/promises";
+import { createHmac, randomBytes, randomUUID as randomUUID2 } from "crypto";
+import { link, mkdir as mkdir4, readFile as readFile3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
 import { dirname as dirname2, join as join5 } from "path";
 function _resetFingerprintSalt() {
   memoPath = undefined;
@@ -2235,7 +2268,7 @@ async function readSaltFile(path) {
 async function createSaltFile(path) {
   await mkdir4(dirname2(path), { recursive: true });
   const candidate = randomBytes(SALT_BYTES);
-  const staged = `${path}.${randomUUID()}.staged`;
+  const staged = `${path}.${randomUUID2()}.staged`;
   try {
     await writeFile3(staged, candidate, { mode: 384 });
     try {
@@ -2247,7 +2280,7 @@ async function createSaltFile(path) {
     }
     return candidate;
   } finally {
-    await rm(staged, { force: true });
+    await rm2(staged, { force: true });
   }
 }
 async function loadSalt(path) {
@@ -3170,11 +3203,16 @@ async function importPiCredentials(options) {
       cause: error
     });
   }
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    throw new NaxError(`The file at ${path} is not a provider credential map.`, "AUTH_IMPORT_SOURCE_UNREADABLE", {
+      path
+    });
+  }
   const store = naxCredentialStore();
   const outcomes = [];
   for (const providerId of Object.keys(parsed).sort()) {
     const entry = parsed[providerId];
-    const credential = entry === undefined ? undefined : fromPiEntry(entry);
+    const credential = typeof entry === "object" && entry !== null ? fromPiEntry(entry) : undefined;
     if (credential === undefined) {
       outcomes.push({ providerId, status: "unsupported" });
       continue;
@@ -3543,12 +3581,12 @@ var init_errors = __esm(() => {
 });
 
 // ../nax-agent/src/native/session-affinity.ts
-import { createHash as createHash3, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID3 } from "crypto";
 function nativeSessionId(sessionKey) {
   return createHash3("sha256").update(sessionKey).digest("hex").slice(0, ID_LENGTH);
 }
 function newSessionKey() {
-  return randomUUID2();
+  return randomUUID3();
 }
 var ID_LENGTH = 32;
 var init_session_affinity = () => {};
@@ -3728,7 +3766,7 @@ __export(exports_transcript_store, {
   transcriptModelIdentity: () => transcriptModelIdentity,
   transcriptPath: () => transcriptPath
 });
-import { mkdir as mkdir5, readdir, readFile as readFile6, rename, rm as rm2, stat as stat3, writeFile as writeFile4 } from "fs/promises";
+import { mkdir as mkdir5, readdir, readFile as readFile6, rename as rename2, rm as rm3, stat as stat3 } from "fs/promises";
 import { join as join9 } from "path";
 function transcriptPath(dir, sessionName) {
   return join9(dir, `${sessionName}.transcript.json`);
@@ -3762,7 +3800,7 @@ async function readTranscriptDoc(dir, sessionName) {
 }
 async function writeTranscriptDoc(dir, sessionName, doc) {
   await mkdir5(dir, { recursive: true });
-  await writeFile4(transcriptPath(dir, sessionName), JSON.stringify(doc, null, 2), "utf8");
+  await writeFileAtomic(transcriptPath(dir, sessionName), JSON.stringify(doc, null, 2));
 }
 function createFileTranscriptStore(dir) {
   return {
@@ -3789,7 +3827,7 @@ async function saveTranscript(dir, sessionName, messages, identity = {}) {
 async function retainTranscript(dir, sessionName) {
   const stamp = new Date().toISOString().replace(/[:.]/g, "-");
   try {
-    await rename(transcriptPath(dir, sessionName), join9(dir, `${sessionName}.transcript.failed-${stamp}.json`));
+    await rename2(transcriptPath(dir, sessionName), join9(dir, `${sessionName}.transcript.failed-${stamp}.json`));
   } catch (err) {
     if (err.code === "ENOENT")
       return;
@@ -3797,7 +3835,7 @@ async function retainTranscript(dir, sessionName) {
   }
 }
 async function deleteTranscript(dir, sessionName) {
-  await rm2(transcriptPath(dir, sessionName), { force: true });
+  await rm3(transcriptPath(dir, sessionName), { force: true });
 }
 function _resetTranscriptTruncationWarningForTests() {
   hasWarnedAboutTranscriptTruncation = false;
@@ -3821,7 +3859,7 @@ async function pruneRetainedTranscripts(dir, maxRetained = MAX_RETAINED_TRANSCRI
   }));
   withMtimes.sort((a, b) => a.mtimeMs - b.mtimeMs);
   const toDelete = withMtimes.slice(0, withMtimes.length - maxRetained);
-  await Promise.all(toDelete.map((f) => rm2(f.path, { force: true })));
+  await Promise.all(toDelete.map((f) => rm3(f.path, { force: true })));
   if (!hasWarnedAboutTranscriptTruncation) {
     hasWarnedAboutTranscriptTruncation = true;
     getLogger().warn("native-session", "Transcript retention cap reached \u2014 oldest kept-on-failure transcripts pruned", {
@@ -3835,6 +3873,7 @@ async function pruneRetainedTranscripts(dir, maxRetained = MAX_RETAINED_TRANSCRI
 var LEGACY_SAVED_AT, MAX_RETAINED_TRANSCRIPTS = 50, hasWarnedAboutTranscriptTruncation = false;
 var init_transcript_store = __esm(() => {
   init_infra();
+  init_atomic_write();
   init_transcript_identity();
   init_transcript_identity();
   LEGACY_SAVED_AT = new Date(0).toISOString();
@@ -19554,7 +19593,7 @@ var init_schemas_sandbox = __esm(() => {
 });
 
 // ../nax-agent/src/sandbox/git-guards.ts
-import { lstat, readdir as readdir2, readFile as readFile7, rm as rm3 } from "fs/promises";
+import { lstat, readdir as readdir2, readFile as readFile7, rm as rm4 } from "fs/promises";
 import { basename as basename2, dirname as dirname7, isAbsolute as isAbsolute3, join as join11, resolve as resolve8 } from "path";
 function commonDirOf(git) {
   if (git.kind === "none")
@@ -19640,7 +19679,7 @@ var init_git_guards = __esm(() => {
       }
     },
     readText: (p) => readFile7(p, "utf8"),
-    remove: (p) => rm3(p, { recursive: true, force: true })
+    remove: (p) => rm4(p, { recursive: true, force: true })
   };
 });
 
@@ -19671,7 +19710,7 @@ var init_messages = __esm(() => {
 });
 
 // ../nax-agent/src/sandbox/launcher.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 import { mkdir as mkdir6 } from "fs/promises";
 function logicalArgv(req) {
   return req.spec.kind === "shell" ? [req.spec.shell, "-c", req.spec.command] : req.spec.argv;
@@ -19800,7 +19839,7 @@ var init_launcher = __esm(() => {
   DISABLED_SANDBOX_STATE = { kind: "disabled" };
   _launcherDeps = {
     runArgv,
-    newCommandId: () => randomUUID3(),
+    newCommandId: () => randomUUID4(),
     mkdir: (path) => mkdir6(path, { recursive: true }).then(() => {
       return;
     })
@@ -19937,9 +19976,12 @@ function hardenedGitEnv(base) {
 function gitSpawnEnv(overlay) {
   return hardenedGitEnv(overlay === undefined ? process.env : { ...process.env, ...overlay });
 }
+function isGitProgram(token) {
+  return token === "git" || (token?.endsWith("/git") ?? false);
+}
 function hardenedGitArgv(argv) {
   const out = [...argv];
-  let i = 1;
+  let i = !isGitProgram(out[0]) && isGitProgram(out[1]) ? 2 : 1;
   while (i < out.length && out[i].startsWith("-")) {
     i += GLOBAL_OPTIONS_WITH_VALUE.has(out[i]) ? 2 : 1;
   }
@@ -20282,6 +20324,8 @@ function isUsableSharedParent() {
     const stats = _sessionTmpDeps.lstat(SHARED_TMP_PARENT);
     if (!stats.isDirectory() || stats.isSymbolicLink())
       return false;
+    if (stats.uid !== _sessionTmpDeps.uid())
+      return false;
   } catch (err) {
     return err.code === "ENOENT";
   }
@@ -20735,7 +20779,7 @@ var init_edit_region = __esm(() => {
 });
 
 // ../nax-agent/src/tools/edit.ts
-import { readFile as readFile8, stat as stat5, writeFile as writeFile5 } from "fs/promises";
+import { readFile as readFile8, stat as stat5, writeFile as writeFile4 } from "fs/promises";
 function countOccurrences(haystack, needle) {
   if (needle === "")
     return 0;
@@ -20753,7 +20797,7 @@ var init_edit = __esm(() => {
   _editDeps = {
     stat: (path) => stat5(path),
     readFile: (path, encoding) => readFile8(path, encoding),
-    writeFile: (path, data, encoding) => writeFile5(path, data, encoding)
+    writeFile: (path, data, encoding) => writeFile4(path, data, encoding)
   };
   editTool = {
     name: "Edit",
@@ -23713,7 +23757,7 @@ var init_denial_redirect = __esm(() => {
 });
 
 // ../nax-agent/src/tools/runtime-calltool.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 function resolvePolicyIdentity(name, tool, input) {
   const argvField = tool.scope.argvField;
   const hasArgv = argvField !== undefined && input[argvField] !== undefined;
@@ -23724,7 +23768,7 @@ function openCallShadowTap(p) {
   if (p.shadow === undefined)
     return;
   return openShadowTap(p.shadow, {
-    key: randomUUID4(),
+    key: randomUUID5(),
     identity: p.identity,
     command: p.tool.scope.commandField === undefined ? undefined : p.input[p.tool.scope.commandField],
     argv: p.hasArgv && p.argvField !== undefined ? p.input[p.argvField] : undefined,
@@ -23855,7 +23899,7 @@ var init_runtime_calltool = __esm(() => {
 
 // ../nax-agent/src/tools/scratchpad.ts
 import { existsSync as existsSync2 } from "fs";
-import { mkdir as mkdir8, writeFile as writeFile6 } from "fs/promises";
+import { mkdir as mkdir8, writeFile as writeFile5 } from "fs/promises";
 import { dirname as dirname8, join as join18, sep as sep10 } from "path";
 var SCRATCHPAD_DIR = ".nax/scratchpad", MAX_MATCHES2 = 500, scratchpadWriteTool, scratchpadReadTool, scratchpadListTool;
 var init_scratchpad = __esm(() => {
@@ -23893,7 +23937,7 @@ var init_scratchpad = __esm(() => {
       }
       try {
         await mkdir8(dirname8(target), { recursive: true });
-        await writeFile6(target, content, "utf8");
+        await writeFile5(target, content, "utf8");
         return { content: `wrote ${size} bytes` };
       } catch (err) {
         return { content: err instanceof Error ? err.message : String(err), isError: true };
@@ -23985,7 +24029,7 @@ ${content}`, resultBytesPreTruncation: fullBytes };
 });
 
 // ../nax-agent/src/tools/spill.ts
-import { mkdir as mkdir9, writeFile as writeFile7 } from "fs/promises";
+import { mkdir as mkdir9, writeFile as writeFile6 } from "fs/promises";
 import { dirname as dirname9, join as join19 } from "path";
 function fileSafe(value) {
   return value.replace(/[^A-Za-z0-9_-]/g, "_");
@@ -24111,14 +24155,14 @@ var init_spill = __esm(() => {
   _spillDeps = {
     mkdir: (path) => mkdir9(path, { recursive: true }),
     writeFile: async (path, data) => {
-      await writeFile7(path, data, "utf8");
+      await writeFile6(path, data, "utf8");
       return Buffer.byteLength(data);
     }
   };
 });
 
 // ../nax-agent/src/tools/tool-audit.ts
-import { mkdir as mkdir10, writeFile as writeFile8 } from "fs/promises";
+import { mkdir as mkdir10, writeFile as writeFile7 } from "fs/promises";
 import { join as join20 } from "path";
 function registerToolAuditSink(runId, sink) {
   const sinks = openToolAuditSinks.get(runId);
@@ -24173,7 +24217,7 @@ function createToolAuditSink(opts) {
       calls: redactRowStrings(calls)
     }, null, 2);
     const prefix = runId !== undefined ? `${runId}-` : "";
-    await writeFile8(join20(opts.dir, `${prefix}${nextFileStamp()}-${opts.sessionName}.json`), body);
+    await writeFile7(join20(opts.dir, `${prefix}${nextFileStamp()}-${opts.sessionName}.json`), body);
   };
   const sink = {
     record(entry) {
@@ -24214,7 +24258,7 @@ var init_tool_audit = __esm(() => {
 });
 
 // ../nax-agent/src/tools/write.ts
-import { mkdir as mkdir11, writeFile as writeFile9 } from "fs/promises";
+import { mkdir as mkdir11, writeFile as writeFile8 } from "fs/promises";
 import { dirname as dirname10 } from "path";
 var writeTool;
 var init_write = __esm(() => {
@@ -24246,7 +24290,7 @@ var init_write = __esm(() => {
       }
       try {
         await mkdir11(dirname10(target), { recursive: true });
-        await writeFile9(target, content, "utf8");
+        await writeFile8(target, content, "utf8");
         return { content: `wrote ${Buffer.byteLength(content, "utf8")} bytes` };
       } catch (err) {
         return { content: err instanceof Error ? err.message : String(err), isError: true };
@@ -24256,7 +24300,7 @@ var init_write = __esm(() => {
 });
 
 // ../nax-agent/src/tools/runtime.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 function registerBuiltinCodingTools() {
   if (builtinsRegistered)
     return;
@@ -24340,7 +24384,7 @@ function createCodingToolRuntime(opts) {
       return body;
     return applyModelTruncationPolicy(body, {
       toolName,
-      callId: context?.toolCallId ?? randomUUID5(),
+      callId: context?.toolCallId ?? randomUUID6(),
       root: opts.policy.root,
       maxBytes
     });
@@ -25516,7 +25560,6 @@ async function runModelRoundTrip(state, params, summarizeFailed) {
   }
   state.roundTrips += 1;
   params.usage.add(res.usage, res.costUsd, res.rates);
-  state.output = res.text;
   const promptTokens = inputClassTokens(res.usage);
   state.lastUsage = { promptTokens };
   state.anchorIndex = state.messages.length - 1;
@@ -25544,6 +25587,7 @@ async function runModelRoundTrip(state, params, summarizeFailed) {
     roundTrip: state.roundTrips
   });
   const assistantText = afterResponse.text ?? res.text;
+  state.output = assistantText;
   const assistantToolCalls = afterResponse.toolCalls ?? res.toolCalls;
   const assistantThinking = afterResponse.thinking ?? res.thinking;
   state.messages.push({
@@ -25910,7 +25954,7 @@ async function streamComplete(client, model, req, onDelta) {
 var init_stream_complete = () => {};
 
 // ../nax-agent/src/native/session-adapter.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 function summaryPrompt(previousSummary) {
   const base = "Summarize the conversation above so it can be dropped from context. " + "Record what was attempted, what was rejected and why, any decisions that still bind, " + "and list the files read and the files modified. Be specific: this summary is the only " + "memory of this work that survives.";
   if (previousSummary === undefined)
@@ -25998,7 +26042,7 @@ class NativeSessionAdapter {
     const instructionInteraction = createInstructionInteraction(this.state.repositoryInstructions.get(handle.id), opts.interactionHandler);
     const deadline = createTurnDeadline(timeoutSeconds);
     const hooks = this.state.streamHooks.get(handle.id);
-    const callId = randomUUID6();
+    const callId = randomUUID7();
     const owner = this.state.transcriptOwners.get(handle.id);
     const eventBase = {
       callId,
@@ -26194,8 +26238,8 @@ var init_native = __esm(() => {
 });
 
 // ../nax-agent/src/session/agent-session-deps.ts
-import { randomUUID as randomUUID7 } from "crypto";
-import { mkdtemp, rm as rm4, stat as stat6 } from "fs/promises";
+import { randomUUID as randomUUID8 } from "crypto";
+import { mkdtemp, rm as rm5, stat as stat6 } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
 import { join as join21 } from "path";
 var MAX_UNDELIVERED_CONTROL_EVENTS = 1000, _agentSessionDeps;
@@ -26204,7 +26248,7 @@ var init_agent_session_deps = __esm(() => {
     now: () => Date.now(),
     setTimeout: (fn, ms) => setTimeout(fn, ms),
     clearTimeout: (handle) => clearTimeout(handle),
-    randomUUID: () => randomUUID7(),
+    randomUUID: () => randomUUID8(),
     isDirectory: async (path) => {
       try {
         return (await stat6(path)).isDirectory();
@@ -26213,7 +26257,7 @@ var init_agent_session_deps = __esm(() => {
       }
     },
     makeScratchRoot: () => mkdtemp(join21(tmpdir4(), "nax-agent-session-")),
-    removeScratchRoot: (dir) => rm4(dir, { recursive: true, force: true }),
+    removeScratchRoot: (dir) => rm5(dir, { recursive: true, force: true }),
     controlEventCap: MAX_UNDELIVERED_CONTROL_EVENTS
   };
 });
@@ -29273,7 +29317,7 @@ function commandSpecIncludes(spec, fragment) {
   return normalizeCommandSpec(spec).some((entry) => entry.includes(fragment));
 }
 function replaceInCommandSpec(spec, searchValue, replacement) {
-  const replace = (command) => command.replaceAll(searchValue, replacement);
+  const replace = (command) => command.replaceAll(searchValue, () => replacement);
   return typeof spec === "string" ? replace(spec) : spec.map(replace);
 }
 function renderCommandSpec(spec) {
@@ -29352,6 +29396,7 @@ __export(exports_internal, {
   _agentSessionDeps: () => _agentSessionDeps,
   _approvalsTaintDeps: () => _approvalsTaintDeps,
   _argvExecDeps: () => _argvExecDeps,
+  _atomicWriteDeps: () => _atomicWriteDeps,
   _authDeps: () => _authDeps,
   _bashToolDeps: () => _bashToolDeps,
   _clientDeps: () => _clientDeps,
@@ -29632,6 +29677,7 @@ __export(exports_internal, {
   withPathFileLock: () => withPathFileLock,
   wrapExternalHandler: () => wrapExternalHandler,
   writeApprovalsFile: () => writeApprovalsFile,
+  writeFileAtomic: () => writeFileAtomic,
   writeSpill: () => writeSpill,
   writeTool: () => writeTool
 });
@@ -29662,6 +29708,7 @@ var init_internal = __esm(() => {
   init_spin_breaker();
   init_agent_output_env();
   init_argv_exec();
+  init_atomic_write();
   init_file_lock();
   init_git_env();
   init_git_exec();
@@ -31022,7 +31069,7 @@ var init_inert_bash_stages = __esm(() => {
 
 // src/utils/json-file.ts
 import { existsSync as existsSync5 } from "fs";
-import { rename as rename2, unlink as unlink3 } from "fs/promises";
+import { rename as rename3, unlink as unlink3 } from "fs/promises";
 async function loadJsonFile(path, context = "json-file") {
   if (!existsSync5(path)) {
     return null;
@@ -31057,7 +31104,7 @@ async function atomicWriteText(path, content, context = "json-file") {
   const tmpPath = `${path}.tmp-${crypto.randomUUID()}`;
   try {
     await Bun.write(tmpPath, content);
-    await rename2(tmpPath, path);
+    await rename3(tmpPath, path);
   } catch (err) {
     await unlink3(tmpPath).catch(() => {});
     const logger = getLogger2();
@@ -31370,6 +31417,12 @@ function _applyFinishAutoFlowShim(conf, warn = defaultConfigWarn) {
   }
   return { ...conf, finish: { ...lifted, ...explicitFinish } };
 }
+function _applyTddStrategyAliasShim(conf) {
+  const tdd = conf.tdd;
+  if (!tdd || typeof tdd !== "object" || tdd.strategy !== "tdd-simple")
+    return conf;
+  return { ...conf, tdd: { ...tdd, strategy: "simple" } };
+}
 function applyConfigCompatShims(conf, logger, dedupe) {
   const log = dedupe.wrapLogger(logger);
   const warn = dedupe.warn;
@@ -31386,6 +31439,7 @@ function applyConfigCompatShims(conf, logger, dedupe) {
   out = _applyFinishAutoFlowShim(out, warn);
   out = _applyRemovedOptimizerKeysShim(out, warn);
   out = _applyRemovedCrossPackageDepthShim(out, warn);
+  out = _applyTddStrategyAliasShim(out);
   return out;
 }
 var SECURITY_SENSITIVE_KEY_PATHS, REMOVED_FINISH_KEYS;
@@ -32913,7 +32967,7 @@ var init_schemas_execution = __esm(() => {
   });
   TddConfigSchema = exports_external.object({
     maxRetries: exports_external.number().int().nonnegative(),
-    strategy: exports_external.enum(["auto", "strict", "lite", "off"]).default("auto"),
+    strategy: exports_external.enum(["auto", "strict", "lite", "simple", "off"]).default("auto"),
     sessionTiers: exports_external.object({
       testWriter: ConfiguredModelSchema.default("fast"),
       verifier: ConfiguredModelSchema.default("fast"),
@@ -36201,18 +36255,20 @@ var init_spec_structure_grammar = __esm(() => {
 function declaredStoryIds(lines) {
   const ids = new Set;
   let inScope = false;
-  let inSkippedSubsection = false;
+  let skipLevel = 0;
   for (const line of lines) {
     if (/^##\s/.test(line)) {
       inScope = /^##\s+(Stories|Acceptance Criteria)\b/i.test(line);
-      inSkippedSubsection = false;
+      skipLevel = 0;
       continue;
     }
     if (!inScope)
       continue;
-    if (/^#{3,6}\s/.test(line))
-      inSkippedSubsection = GROUPED_PATH_SUBSECTION.test(line);
-    if (inSkippedSubsection)
+    const level = /^(#{3,6})\s/.exec(line)?.[1]?.length;
+    if (level !== undefined && (skipLevel === 0 || level <= skipLevel)) {
+      skipLevel = GROUPED_PATH_SUBSECTION.test(line) ? level : 0;
+    }
+    if (skipLevel > 0)
       continue;
     const heading = /^#{1,6}\s+(US-\d+)\b/i.exec(line);
     if (heading?.[1]) {
@@ -38089,11 +38145,15 @@ import path2 from "path";
 async function acceptCommand(options) {
   const logger = getLogger2();
   const { feature, override, reason } = options;
-  if (!override.match(/^AC-\d+$/i)) {
-    logger.error("cli", "Invalid AC ID format", { override, expected: "AC-1, AC-2, etc." });
-    throw new NaxError("Invalid AC ID format", "INVALID_AC_ID", { override, expected: "AC-1, AC-2, etc." });
-  }
-  const acId = override.toUpperCase();
+  const expected = "AC-1, or <package>::AC-1 (package path relative to the repo root)";
+  const match = /^(?:(.+)::)?(AC-\d+)$/i.exec(override);
+  const pkg = match?.[1];
+  const ac = match?.[2];
+  if (!ac || pkg === "") {
+    logger.error("cli", "Invalid AC ID format", { override, expected });
+    throw new NaxError("Invalid AC ID format", "INVALID_AC_ID", { override, expected });
+  }
+  const acId = pkg === undefined ? ac.toUpperCase() : `${pkg}::${ac.toUpperCase()}`;
   const projectDirResult = findProjectDir(process.cwd());
   if (!projectDirResult) {
     logger.error("cli", "Not in a nax project directory", { hint: "Run 'nax init' first" });
@@ -38494,7 +38554,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@nathapp/nax",
-    version: "0.83.6",
+    version: "0.83.7",
     description: "AI Coding Agent Orchestrator \u2014 loops until done",
     type: "module",
     bin: {
@@ -38552,7 +38612,7 @@ var init_package = __esm(() => {
       "test:unit": "bun test ./test/unit/ --timeout=60000",
       "test:integration": "bun test ./test/integration/ --timeout=60000",
       "test:ui": "bun test ./test/ui/ --timeout=60000",
-      "test:e2e": "timeout -k 5s 180s bun test test/e2e/ --timeout=60000",
+      "test:e2e": "bun run scripts/run-tests.ts --e2e",
       "test:coverage": "bun run ../repo-tooling/scripts/check-coverage.ts --require-all-files",
       "test:coverage:report": "bun run ../repo-tooling/scripts/check-coverage.ts --require-all-files --report",
       "test:coverage:update": "bun run ../repo-tooling/scripts/check-coverage.ts --require-all-files --update-baseline",
@@ -39781,19 +39841,24 @@ function isTestFileByPatterns(filePath2, patterns) {
 }
 function globsToPathspec(patterns) {
   const result = [];
-  const seen = new Set;
+  const add = (pathspec) => {
+    if (!result.includes(pathspec))
+      result.push(pathspec);
+  };
   for (const pattern of patterns) {
-    const lastStar = pattern.lastIndexOf("*");
-    if (lastStar === -1)
+    const segment = pattern.slice(pattern.lastIndexOf("/") + 1);
+    const firstStar = segment.indexOf("*");
+    if (firstStar === -1)
       continue;
-    const suffix = pattern.slice(lastStar + 1);
-    if (suffix.length === 0)
+    if (firstStar > 0) {
+      add(`:!${segment}`);
+      add(`:!*/${segment}`);
       continue;
-    const pathspec = `:!*${suffix}`;
-    if (!seen.has(pathspec)) {
-      result.push(pathspec);
-      seen.add(pathspec);
     }
+    const suffix = segment.slice(segment.lastIndexOf("*") + 1);
+    if (suffix.length === 0 || BARE_EXTENSION.test(suffix))
+      continue;
+    add(`:!*${suffix}`);
   }
   return result;
 }
@@ -39807,9 +39872,24 @@ function extractTestDirs(globs) {
   }
   return [...dirs];
 }
-var DEFAULT_TEST_FILE_PATTERNS, DEFAULT_SCAN_TEST_DIRS, DEFAULT_TS_DERIVE_SUFFIXES, DEFAULT_SEPARATED_TEST_DIRS;
+function extractWholeTestDirs(globs) {
+  const dirs = new Set;
+  for (const glob2 of globs) {
+    const segments = glob2.split("/");
+    const first = segments[0];
+    if (!first || first.includes("*") || segments.length < 2)
+      continue;
+    const filename = segments[segments.length - 1] ?? "";
+    const coversEverything = filename === "*" || filename === "**" || filename.startsWith("*") && BARE_EXTENSION.test(filename.slice(1));
+    if (coversEverything)
+      dirs.add(first);
+  }
+  return [...dirs];
+}
+var DEFAULT_TEST_FILE_PATTERNS, BARE_EXTENSION, DEFAULT_SCAN_TEST_DIRS, DEFAULT_TS_DERIVE_SUFFIXES, DEFAULT_SEPARATED_TEST_DIRS;
 var init_conventions = __esm(() => {
   DEFAULT_TEST_FILE_PATTERNS = Object.freeze(["test/**/*.test.ts"]);
+  BARE_EXTENSION = /^\.[A-Za-z0-9]+$/;
   DEFAULT_SCAN_TEST_DIRS = Object.freeze([
     "test",
     "tests",
@@ -40292,29 +40372,11 @@ async function detectFromFileScan(workdir) {
   const filtered = files.filter((f) => !isExcluded(f));
   if (filtered.length === 0)
     return null;
-  const counts = {};
-  for (const suffix of CANDIDATE_SUFFIXES) {
-    counts[suffix] = 0;
-  }
-  for (const file2 of filtered) {
-    for (const suffix of CANDIDATE_SUFFIXES) {
-      if (file2.endsWith(suffix)) {
-        counts[suffix] = (counts[suffix] ?? 0) + 1;
-      }
-    }
-  }
   const totalFiles = filtered.length;
-  const patterns = [];
-  for (const suffix of CANDIDATE_SUFFIXES) {
-    const count = counts[suffix] ?? 0;
-    if (count === 0)
-      continue;
-    if (count >= MIN_COUNT_THRESHOLD || count / totalFiles >= MIN_FRACTION_THRESHOLD) {
-      const glob2 = SUFFIX_TO_GLOB[suffix];
-      if (glob2)
-        patterns.push(glob2);
-    }
-  }
+  const patterns = CANDIDATES.filter((candidate) => {
+    const count = filtered.filter((file2) => candidate.matches(file2)).length;
+    return count > 0 && (count >= MIN_COUNT_THRESHOLD || count / totalFiles >= MIN_FRACTION_THRESHOLD);
+  }).map((candidate) => candidate.glob);
   if (patterns.length === 0)
     return null;
   return {
@@ -40323,41 +40385,35 @@ async function detectFromFileScan(workdir) {
     patterns
   };
 }
-var DRAIN_TIMEOUT2, EXCLUDED_DIR_PREFIXES, MIN_COUNT_THRESHOLD = 5, MIN_FRACTION_THRESHOLD = 0.1, FILE_SCAN_GIT_TIMEOUT_MS = 4000, FILE_SCAN_DRAIN_TIMEOUT_MS = 2000, CANDIDATE_SUFFIXES, SUFFIX_TO_GLOB, _fileScanDeps;
+var DRAIN_TIMEOUT2, EXCLUDED_DIR_PREFIXES, MIN_COUNT_THRESHOLD = 5, MIN_FRACTION_THRESHOLD = 0.1, FILE_SCAN_GIT_TIMEOUT_MS = 4000, FILE_SCAN_DRAIN_TIMEOUT_MS = 2000, bySuffix = (suffix) => ({
+  glob: `**/*${suffix}`,
+  matches: (path3) => path3.endsWith(suffix)
+}), byBasenamePrefix = (prefix, extension) => ({
+  glob: `**/${prefix}*${extension}`,
+  matches: (path3) => {
+    const base = path3.slice(path3.lastIndexOf("/") + 1);
+    return base.startsWith(prefix) && base.endsWith(extension) && base.length > prefix.length + extension.length;
+  }
+}), CANDIDATES, _fileScanDeps;
 var init_file_scan = __esm(() => {
   init_internal();
   DRAIN_TIMEOUT2 = Symbol("drain-timeout");
   EXCLUDED_DIR_PREFIXES = ["node_modules/", "dist/", "build/", ".nax/", "coverage/", ".git/"];
-  CANDIDATE_SUFFIXES = [
-    ".test.ts",
-    ".test.tsx",
-    ".test.js",
-    ".test.jsx",
-    ".spec.ts",
-    ".spec.tsx",
-    ".spec.js",
-    ".spec.jsx",
-    ".e2e-spec.ts",
-    ".e2e-spec.js",
-    "_test.go",
-    "_test.py",
-    "test_.py"
+  CANDIDATES = [
+    bySuffix(".test.ts"),
+    bySuffix(".test.tsx"),
+    bySuffix(".test.js"),
+    bySuffix(".test.jsx"),
+    bySuffix(".spec.ts"),
+    bySuffix(".spec.tsx"),
+    bySuffix(".spec.js"),
+    bySuffix(".spec.jsx"),
+    bySuffix(".e2e-spec.ts"),
+    bySuffix(".e2e-spec.js"),
+    bySuffix("_test.go"),
+    bySuffix("_test.py"),
+    byBasenamePrefix("test_", ".py")
   ];
-  SUFFIX_TO_GLOB = {
-    ".test.ts": "**/*.test.ts",
-    ".test.tsx": "**/*.test.tsx",
-    ".test.js": "**/*.test.js",
-    ".test.jsx": "**/*.test.jsx",
-    ".spec.ts": "**/*.spec.ts",
-    ".spec.tsx": "**/*.spec.tsx",
-    ".spec.js": "**/*.spec.js",
-    ".spec.jsx": "**/*.spec.jsx",
-    ".e2e-spec.ts": "**/*.e2e-spec.ts",
-    ".e2e-spec.js": "**/*.e2e-spec.js",
-    "_test.go": "**/*_test.go",
-    "_test.py": "**/*_test.py",
-    "test_.py": "**/test_*.py"
-  };
   _fileScanDeps = {
     spawn: Bun.spawn,
     killProcessGroup,
@@ -40839,7 +40895,7 @@ async function detectFromCargoToml(workdir) {
   const path3 = `${workdir}/Cargo.toml`;
   if (!await _frameworkDefaultsDeps.fileExists(path3))
     return null;
-  return { type: "manifest", framework: "rust", path: path3, patterns: ["tests/**/*.rs", "src/**/*.rs"] };
+  return { type: "manifest", framework: "rust", path: path3, patterns: ["tests/**/*.rs"] };
 }
 async function detectFromPyprojectDeps(workdir) {
   const path3 = `${workdir}/pyproject.toml`;
@@ -41751,7 +41807,7 @@ function resolveReviewExcludePatterns(userExplicit, resolved) {
   const result = new Set;
   for (const p of resolved.pathspec)
     result.add(p);
-  for (const d of resolved.testDirs)
+  for (const d of extractWholeTestDirs(resolved.globs))
     result.add(`:!${d}/`);
   for (const d of WELL_KNOWN_TEST_DIRS2)
     result.add(`:!${d}/`);
@@ -42371,6 +42427,7 @@ __export(exports_test_runners, {
   detectTestFilePatterns: () => detectTestFilePatterns,
   discoverWorkspacePackages: () => discoverWorkspacePackages,
   extractTestDirs: () => extractTestDirs,
+  extractWholeTestDirs: () => extractWholeTestDirs,
   findPackageDir: () => findPackageDir,
   formatFailureSummary: () => formatFailureSummary,
   globsToPathspec: () => globsToPathspec,
@@ -44648,7 +44705,7 @@ var init_hermetic = __esm(() => {
 });
 
 // src/prompts/sections/protocol-region.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 function call(tool, input) {
   return `${tool} ${JSON.stringify(input)}`;
 }
@@ -44765,7 +44822,7 @@ var KIND_PATTERN, NONCE, PROTOCOL_REGION_MARKER_PREFIX = "<!--nax:", REGION, OWN
 var init_protocol_region = __esm(() => {
   init_errors4();
   KIND_PATTERN = /^[a-z][a-z-]*$/;
-  NONCE = randomUUID8().slice(0, 8);
+  NONCE = randomUUID9().slice(0, 8);
   REGION = new RegExp(`<!--nax:([a-z][a-z-]*):([a-f0-9]+) (\\{.*?\\})-->\\n` + `((?:(?!<!--nax:[a-z][a-z-]*:[a-f0-9]+ )[\\s\\S])*?)` + `<!--\\/nax:\\1-->\\n?`, "g");
   OWN_OPEN = new RegExp(`<!--nax:[a-z][a-z-]*:${NONCE} `, "g");
   REGISTRY = {
@@ -47324,7 +47381,7 @@ ${section}`);
     const failingFiles = Array.from(new Set(findings.map((f) => f.file).filter((f) => !!f)));
     if (failingFiles.length > 0) {
       const perFileLines = failingFiles.map((file2) => {
-        const scopedCmd = opts.testScopedTemplate ? opts.testScopedTemplate.replace("{{files}}", file2) : `${opts.testCommand} ${file2}`;
+        const scopedCmd = opts.testScopedTemplate ? opts.testScopedTemplate.replaceAll("{{files}}", () => file2) : `${opts.testCommand} ${file2}`;
         if (opts.testScopedTemplate && opts.fileScopeCommandName) {
           return `  ${wrapAffordance("run-test", { command: opts.fileScopeCommandName, files: file2 }, scopedCmd)}`;
         }
@@ -47754,7 +47811,7 @@ ${output}
     const cmd = testCommand ?? "";
     const failingFiles = Array.from(new Set(failures.map((f) => f.file)));
     const testCommands = failingFiles.map((file2) => {
-      const scopedCmd = testScopedTemplate ? testScopedTemplate.replace("{{files}}", file2) : cmd ? `${cmd} ${file2}` : file2;
+      const scopedCmd = testScopedTemplate ? testScopedTemplate.replaceAll("{{files}}", () => file2) : cmd ? `${cmd} ${file2}` : file2;
       return `  ${scopedCmd}`;
     }).join(`
 `);
@@ -49845,7 +49902,7 @@ async function loadCanonicalRules(workdir, options = {}) {
   if (allViolations.length > 0) {
     throw new NeutralityLintError(allViolations);
   }
-  rules.sort((a, b) => (a.priority ?? FRONTMATTER_PRIORITY_DEFAULT) - (b.priority ?? FRONTMATTER_PRIORITY_DEFAULT) || (a.id ?? a.fileName).localeCompare(b.id ?? b.fileName));
+  rules.sort((a, b) => (a.priority ?? FRONTMATTER_PRIORITY_DEFAULT) - (b.priority ?? FRONTMATTER_PRIORITY_DEFAULT) || byCodePoint(a.id ?? a.fileName, b.id ?? b.fileName));
   logger.debug("canonical-loader", "Scanned canonical rules store", {
     fileCount: rules.length,
     files: rules.map((r) => r.path)
@@ -49879,6 +49936,7 @@ async function loadCanonicalRules(workdir, options = {}) {
 }
 var CANONICAL_RULES_DIR = ".nax/rules", _canonicalLoaderDeps, NEUTRALITY_RULES, DEFAULT_CANONICAL_RULES_BUDGET_TOKENS = 8192, RULES_BUDGET_WARNING_RATIO = 0.75, RULE_ALLOW_MARKER, NeutralityLintError, RulesFrontmatterLintError;
 var init_canonical_loader = __esm(() => {
+  init_internal();
   init_errors4();
   init_logger2();
   init_rules_frontmatter();
@@ -50557,7 +50615,7 @@ function applySectionBudget(sections2, budgetTokens) {
       overageTokens: totalTokens
     };
   }
-  const sorted = [...sections2].sort((a, b) => (a.priority ?? FRONTMATTER_PRIORITY_DEFAULT) - (b.priority ?? FRONTMATTER_PRIORITY_DEFAULT) || ownerIdentifier(a).localeCompare(ownerIdentifier(b)) || a.ordinal - b.ordinal);
+  const sorted = [...sections2].sort((a, b) => (a.priority ?? FRONTMATTER_PRIORITY_DEFAULT) - (b.priority ?? FRONTMATTER_PRIORITY_DEFAULT) || byCodePoint(ownerIdentifier(a), ownerIdentifier(b)) || a.ordinal - b.ordinal);
   const kept = [];
   const droppedIds = [];
   const closedOwners = new Set;
@@ -50589,6 +50647,7 @@ function applySectionBudget(sections2, budgetTokens) {
   };
 }
 var init_rule_budget = __esm(() => {
+  init_internal();
   init_rules_frontmatter();
 });
 
@@ -51687,7 +51746,7 @@ var init_loop_handler_forwarding = __esm(() => {
 });
 
 // src/session/manager-deps.ts
-import { randomUUID as randomUUID9 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 import { mkdir as mkdir14 } from "fs/promises";
 import { isAbsolute as isAbsolute13, join as join39, relative as relative18, sep as sep13 } from "path";
 function resolveProjectDirFromScratchDir(scratchDir) {
@@ -51729,7 +51788,7 @@ var init_manager_deps = __esm(() => {
   _sessionManagerDeps = {
     now: () => new Date().toISOString(),
     nowMs: () => Date.now(),
-    uuid: () => randomUUID9(),
+    uuid: () => randomUUID10(),
     sessionScratchDir: (projectDir, featureName, sessionId) => join39(featureDir(projectDir, featureName), "sessions", sessionId),
     writeDescriptor: async (scratchDir, descriptor, projectDir) => {
       await mkdir14(scratchDir, { recursive: true });
@@ -52220,10 +52279,9 @@ class SessionManager {
     const reuse = decideReuse(liveHandle, this._findByName(name), opts);
     if (liveHandle && reuse === "reuse")
       return liveHandle;
-    if (liveHandle && reuse === "close-then-reopen") {
-      await this.closeSession(liveHandle);
-      this._busySessions.add(name);
-    } else if (liveHandle)
+    if (liveHandle && reuse === "close-then-reopen")
+      await this.closeSession(liveHandle, true);
+    else if (liveHandle)
       this._liveHandles.delete(name);
     const adapter = this._getAdapter(opts.agentName);
     if (!adapter) {
@@ -52252,6 +52310,7 @@ class SessionManager {
     this._liveHandles.set(name, handle);
     const protocolIds = handle.protocolIds ?? NULL_PROTOCOL_IDS;
     if (!existingDescriptor) {
+      this._cancelledSessions.delete(name);
       const created = this.create({
         role: opts.role ?? "main",
         agent: opts.agentName,
@@ -52287,7 +52346,7 @@ class SessionManager {
     });
     return handle;
   }
-  async closeSession(handle) {
+  async closeSession(handle, keepOpenGuard = false) {
     const desc = this._findByName(handle.id);
     const adapter = this._getAdapter(handle.agentName);
     this._liveHandles.delete(handle.id);
@@ -52305,7 +52364,8 @@ class SessionManager {
     if (desc && desc.state === "RUNNING") {
       this.transition(desc.id, "COMPLETED");
     }
-    this._busySessions.delete(handle.id);
+    if (!keepOpenGuard)
+      this._busySessions.delete(handle.id);
     this._cancelledSessions.delete(handle.id);
     this._watchdogCancels.clear(handle.id);
   }
@@ -52414,7 +52474,7 @@ function recordAgentHandoff(sessionManager, sessionName, newAgent, reason) {
 }
 
 // src/session/scratch-purge.ts
-import { mkdir as mkdir15, rename as rename3, rm as rm5 } from "fs/promises";
+import { mkdir as mkdir15, rename as rename4, rm as rm6 } from "fs/promises";
 import { dirname as dirname15, join as join40 } from "path";
 async function purgeStaleScratch(projectDir, featureName, retentionDays, archiveInsteadOfDelete = false) {
   const sessionsDir = join40(featureDir(projectDir, featureName), "sessions");
@@ -52466,10 +52526,10 @@ var init_scratch_purge = __esm(() => {
     },
     fileExists: (path5) => Bun.file(path5).exists(),
     readFile: (path5) => Bun.file(path5).text(),
-    remove: (path5) => rm5(path5, { recursive: true, force: true }),
+    remove: (path5) => rm6(path5, { recursive: true, force: true }),
     move: async (src, dest) => {
       await mkdir15(dirname15(dest), { recursive: true });
-      await rename3(src, dest);
+      await rename4(src, dest);
     },
     now: () => Date.now()
   };
@@ -52557,7 +52617,7 @@ var init_session2 = __esm(() => {
 var DEFAULT_MAX_TOKENS_PER_CALL = 2048;
 
 // src/context/fragments/store.ts
-import { mkdir as mkdir17, rm as rm6, stat as stat7 } from "fs/promises";
+import { mkdir as mkdir17, rm as rm7, stat as stat7 } from "fs/promises";
 import { dirname as dirname17, join as join41 } from "path";
 function fragmentPath(projectDir, featureId, storyId) {
   validatePathSegment(storyId, "storyId");
@@ -52671,7 +52731,7 @@ var init_store = __esm(() => {
       return files.sort(byCodePoint);
     },
     removeFile: async (path5) => {
-      await rm6(path5, { force: true });
+      await rm7(path5, { force: true });
     }
   };
 });
@@ -54335,6 +54395,27 @@ var init_manifest_purge = __esm(() => {
   };
 });
 
+// src/context/engine/digest-carrier.ts
+function boostedDigestChunk(request) {
+  const digest = request.priorStageDigest?.trim();
+  return digest && (request.planDigestBoost ?? 1) > 1 ? request.priorStageDigest : undefined;
+}
+function resolveDigestCarrier(request, boostedDigest, packed) {
+  if (boostedDigest === undefined) {
+    return { digestAsChunk: false, renderPriorDigest: request.priorStageDigest, manifestRequest: request };
+  }
+  const landed = packed.some((c) => c.providerId === PLAN_DIGEST_PROVIDER_ID);
+  if (landed) {
+    return {
+      digestAsChunk: true,
+      renderPriorDigest: undefined,
+      manifestRequest: { ...request, priorStageDigest: undefined }
+    };
+  }
+  return { digestAsChunk: false, renderPriorDigest: request.priorStageDigest, manifestRequest: request };
+}
+var PLAN_DIGEST_PROVIDER_ID = "plan-digest";
+
 // src/context/engine/orchestrator-rebuild-helpers.ts
 function toContextChunk(packed) {
   const providerId = packed.providerId ?? packed.id.split(":")[0] ?? "unknown";
@@ -54538,7 +54619,7 @@ var init_render = __esm(() => {
 });
 
 // src/context/engine/rebuild.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID11 } from "crypto";
 function toPackedChunks(prior, newAgentId, targetAgentId) {
   const priorAgentForNeutralize = prior.agentId ?? "";
   return prior.chunks.map((c) => {
@@ -54665,7 +54746,7 @@ var init_rebuild = __esm(() => {
   init_render();
   init_scratch_neutralizer();
   DEFAULT_REBUILD_DEPS = {
-    uuid: () => randomUUID10(),
+    uuid: () => randomUUID11(),
     getLogger: () => getLogger2()
   };
 });
@@ -54679,13 +54760,13 @@ function roleMultiplier(chunkRoles, callerRole) {
   return ROLE_MISMATCH_WEIGHT;
 }
 function scoreChunk(chunk, callerRole, minScore = MIN_SCORE, stale = false, providerWeights) {
-  const rm7 = roleMultiplier(chunk.role, callerRole);
-  const roleFiltered = rm7 === 0;
+  const rm8 = roleMultiplier(chunk.role, callerRole);
+  const roleFiltered = rm8 === 0;
   const kindWeight = KIND_WEIGHTS[chunk.kind] ?? 0.5;
   const isStale = chunk.staleCandidate === true || stale;
   const freshnessMultiplier = isStale ? chunk.scoreMultiplier ?? STALENESS_PENALTY : 1;
   const effectivenessMultiplier = chunk.providerId !== undefined ? providerWeights?.[chunk.providerId] ?? 1 : 1;
-  const score = chunk.rawScore * rm7 * kindWeight * freshnessMultiplier * effectivenessMultiplier;
+  const score = chunk.rawScore * rm8 * kindWeight * freshnessMultiplier * effectivenessMultiplier;
   const belowMinScore = !roleFiltered && score < minScore;
   return { ...chunk, score, roleFiltered, belowMinScore };
 }
@@ -54711,7 +54792,7 @@ var init_scoring = __esm(() => {
 });
 
 // src/context/engine/orchestrator.ts
-import { createHash as createHash10, randomUUID as randomUUID11 } from "crypto";
+import { createHash as createHash10, randomUUID as randomUUID12 } from "crypto";
 function buildPullToolDescriptors(stageToolNames, pullConfig) {
   if (!pullConfig?.enabled || stageToolNames.length === 0)
     return [];
@@ -54720,6 +54801,28 @@ function buildPullToolDescriptors(stageToolNames, pullConfig) {
   const override = configured2 !== undefined && configured2 !== DEFAULT_MAX_CALLS_PER_SESSION ? configured2 : undefined;
   return stageToolNames.filter((name) => allowed.length === 0 || allowed.includes(name)).map((name) => PULL_TOOL_REGISTRY[name]).filter((d) => d !== undefined).map((d) => ({ ...d, maxCallsPerSession: override ?? d.maxCallsPerSession }));
 }
+function appendPlanDigestChunk(raw, results, digest, boost) {
+  const hash2 = createHash10("sha256").update(digest).digest("hex").slice(0, 8);
+  const tokens = Math.ceil(digest.length / 4);
+  raw.push({
+    id: `${PLAN_DIGEST_PROVIDER_ID}:${hash2}`,
+    providerId: PLAN_DIGEST_PROVIDER_ID,
+    kind: "session",
+    scope: "session",
+    role: ["all"],
+    content: digest,
+    tokens,
+    rawScore: 0.9 * boost
+  });
+  results.push({
+    providerId: PLAN_DIGEST_PROVIDER_ID,
+    status: "ok",
+    source: undefined,
+    chunkCount: 1,
+    durationMs: 0,
+    tokensProduced: tokens
+  });
+}
 async function fetchWithTimeout(provider, request, timeoutMs = PROVIDER_FETCH_TIMEOUT_MS) {
   const controller = new AbortController;
   let handle;
@@ -54731,7 +54834,7 @@ async function fetchWithTimeout(provider, request, timeoutMs = PROVIDER_FETCH_TI
       reject(new Error(`Provider "${provider.id}" timed out`));
     }, timeoutMs);
   });
-  const fetchPromise = provider.fetch(request, controller.signal).then((result) => result, (err) => {
+  const fetchPromise = (async () => provider.fetch(request, controller.signal))().then((result) => result, (err) => {
     if (timedOut) {
       return new Promise(() => {});
     }
@@ -54797,8 +54900,9 @@ class ContextOrchestrator {
     }
     const profileBudget = agentProfile.caps.preferredPromptTokens;
     const stageCeiling = Math.min(request.budgetTokens, profileBudget, request.availableBudgetTokens ?? Number.POSITIVE_INFINITY);
+    const boostedDigest = boostedDigestChunk(request);
     const trimmedPriorDigest = request.priorStageDigest?.trim();
-    const priorDigestTokens = trimmedPriorDigest ? Math.ceil(trimmedPriorDigest.length / 4) : 0;
+    const priorDigestTokens = boostedDigest === undefined && trimmedPriorDigest ? Math.ceil(trimmedPriorDigest.length / 4) : 0;
     let effectiveBudgetTokens = Math.max(0, stageCeiling - DIGEST_RESERVE_TOKENS - priorDigestTokens - FIXED_RENDER_OVERHEAD_TOKENS);
     const providerSourceMap = request.providerIds === undefined ? buildProviderSourceMap(stageConfig.providerIds, request.extraProviderIds ?? []) : new Map;
     const allowedIds = request.providerIds ?? [...providerSourceMap.keys()];
@@ -54876,28 +54980,8 @@ class ContextOrchestrator {
     }));
     const allRaw = fetchResults.flatMap(({ provider, result }) => result.chunks.map((c) => enrichRaw(c, provider.id)));
     const providerResults = fetchResults.map(({ providerStatus }) => providerStatus);
-    if (request.priorStageDigest && (request.planDigestBoost ?? 1) > 1) {
-      const boost = request.planDigestBoost ?? 1;
-      const hash2 = createHash10("sha256").update(request.priorStageDigest).digest("hex").slice(0, 8);
-      const tokens = Math.ceil(request.priorStageDigest.length / 4);
-      allRaw.push({
-        id: `plan-digest:${hash2}`,
-        providerId: "plan-digest",
-        kind: "session",
-        scope: "session",
-        role: ["all"],
-        content: request.priorStageDigest,
-        tokens,
-        rawScore: 0.9 * boost
-      });
-      providerResults.push({
-        providerId: "plan-digest",
-        status: "ok",
-        source: undefined,
-        chunkCount: 1,
-        durationMs: 0,
-        tokensProduced: tokens
-      });
+    if (boostedDigest !== undefined) {
+      appendPlanDigestChunk(allRaw, providerResults, boostedDigest, request.planDigestBoost ?? 1);
     }
     assertUniqueChunkIds(allRaw, request);
     const allPullTools = agentProfile.caps.supportsToolCalls ? buildPullToolDescriptors(stageConfig.pullToolNames ?? [], request.pullConfig) : [];
@@ -54929,7 +55013,10 @@ class ContextOrchestrator {
         excludedNonFloorChunkCount: budgetExcludedIds.length
       });
     }
-    const renderOptions = { priorStageDigest: request.priorStageDigest };
+    const digestCarrier = resolveDigestCarrier(request, boostedDigest, packed);
+    const renderOptions = {
+      priorStageDigest: digestCarrier.renderPriorDigest
+    };
     const pushMarkdown = request.agentId !== undefined ? renderForAgent(packed, request.agentId, renderOptions) : renderChunks(packed, renderOptions);
     const digest = buildDigest(packed);
     const dTokens = digestTokens(digest);
@@ -54939,7 +55026,7 @@ class ContextOrchestrator {
     const staleIds = new Set(scored.filter((c) => c.staleCandidate === true).map((c) => c.id));
     const manifest = buildManifest({
       requestId,
-      request,
+      request: digestCarrier.manifestRequest,
       packed,
       usedTokens,
       digestTokens: dTokens,
@@ -55014,7 +55101,7 @@ var init_orchestrator = __esm(() => {
   init_stage_config();
   _orchestratorDeps = {
     now: () => Date.now(),
-    uuid: () => randomUUID11(),
+    uuid: () => randomUUID12(),
     getLogger: getLogger2,
     rebuild
   };
@@ -55607,7 +55694,7 @@ __export(exports_tracker, {
   saveRunMetrics: () => saveRunMetrics,
   toFallbackHops: () => toFallbackHops
 });
-import { rename as rename4 } from "fs/promises";
+import { rename as rename5 } from "fs/promises";
 import path5 from "path";
 function tokensFromSnapshot(snapshot, divisor = 1) {
   if (!snapshot || snapshot.tokenUsageCount !== snapshot.callCount)
@@ -55829,7 +55916,7 @@ async function loadExistingMetricsOrQuarantine(metricsPath) {
   } catch (err) {
     const quarantinePath = `${metricsPath}.corrupt-${new Date().toISOString().replace(/[:.]/g, "-")}`;
     try {
-      await rename4(metricsPath, quarantinePath);
+      await rename5(metricsPath, quarantinePath);
     } catch (renameErr) {
       getLogger2().warn("metrics", "Failed to quarantine corrupt metrics.json \u2014 leaving in place", {
         metricsPath,
@@ -56597,8 +56684,8 @@ var init_registry4 = __esm(() => {
 });
 
 // src/trust/store.ts
-import { randomUUID as randomUUID12 } from "crypto";
-import { mkdir as mkdir18, rename as rename5, stat as stat8, unlink as unlink4, writeFile as writeFile10 } from "fs/promises";
+import { randomUUID as randomUUID13 } from "crypto";
+import { mkdir as mkdir18, rename as rename6, stat as stat8, unlink as unlink4, writeFile as writeFile9 } from "fs/promises";
 import { dirname as dirname20, isAbsolute as isAbsolute15, join as join48 } from "path";
 function trustStorePath() {
   return join48(globalConfigDir(), "trust.json");
@@ -56670,11 +56757,11 @@ async function readFoldersForWrite(storePath) {
   return read.state === "ok" ? read.file.folders : [];
 }
 async function writeTrustStore(storePath, file2) {
-  const tempPath = `${storePath}.${process.pid}.${randomUUID12()}.tmp`;
+  const tempPath = `${storePath}.${process.pid}.${randomUUID13()}.tmp`;
   try {
-    await writeFile10(tempPath, `${JSON.stringify(file2, null, 2)}
+    await writeFile9(tempPath, `${JSON.stringify(file2, null, 2)}
 `, { mode: 384 });
-    await rename5(tempPath, storePath);
+    await rename6(tempPath, storePath);
   } finally {
     await unlink4(tempPath).catch(() => {});
   }
@@ -56970,8 +57057,8 @@ var init_version = __esm(() => {
   NAX_AI_VERSION = CATALOG_VERSION;
   NAX_COMMIT = (() => {
     try {
-      if (/^[0-9a-f]{6,10}$/.test("eab634ebe"))
-        return "eab634ebe";
+      if (/^[0-9a-f]{6,10}$/.test("cfab34e07"))
+        return "cfab34e07";
     } catch {}
     try {
       const result = Bun.spawnSync(["git", "rev-parse", "--short", "HEAD"], {
@@ -69061,7 +69148,7 @@ var init_client4 = __esm(() => {
 
 // src/mcp/lock.ts
 import { createHash as createHash17 } from "crypto";
-import { mkdir as mkdir22, readFile as readFile9, writeFile as writeFile11 } from "fs/promises";
+import { mkdir as mkdir22, readFile as readFile9, writeFile as writeFile10 } from "fs/promises";
 import { join as join55 } from "path";
 function mcpLockPath(projectRoot) {
   return join55(projectRoot, PROJECT_NAX_DIR, MCP_LOCK_FILENAME);
@@ -69093,7 +69180,7 @@ async function writeMcpLock(projectRoot, lock) {
     Object.fromEntries(Object.entries(tools2).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0))
   ]));
   await mkdir22(join55(projectRoot, PROJECT_NAX_DIR), { recursive: true });
-  await writeFile11(mcpLockPath(projectRoot), `${JSON.stringify({ version: 1, servers }, null, 2)}
+  await writeFile10(mcpLockPath(projectRoot), `${JSON.stringify({ version: 1, servers }, null, 2)}
 `);
 }
 function applyLock(locked, discovered) {
@@ -69314,7 +69401,7 @@ var init_provider = __esm(() => {
 });
 
 // src/mcp/rollup.ts
-import { mkdir as mkdir23, writeFile as writeFile12 } from "fs/promises";
+import { mkdir as mkdir23, writeFile as writeFile11 } from "fs/promises";
 import { join as join56 } from "path";
 function buildMcpRollup(args) {
   const byServer = new Map;
@@ -69347,7 +69434,7 @@ async function writeMcpRollup(outputDir, rollup) {
     return;
   const dir = join56(outputDir, "mcp");
   await mkdir23(dir, { recursive: true });
-  await writeFile12(join56(dir, `${rollup.runId}-servers.json`), `${JSON.stringify(rollup, null, 2)}
+  await writeFile11(join56(dir, `${rollup.runId}-servers.json`), `${JSON.stringify(rollup, null, 2)}
 `);
 }
 var init_rollup = () => {};
@@ -73076,7 +73163,7 @@ var init_runners = __esm(() => {
 
 // src/verification/test-baseline.ts
 import { existsSync as existsSync10 } from "fs";
-import { mkdir as mkdir24, readdir as readdir6, rm as rm7 } from "fs/promises";
+import { mkdir as mkdir24, readdir as readdir6, rm as rm8 } from "fs/promises";
 import { join as join65 } from "path";
 function runBaselinePath(root, featureId) {
   return join65(featureDir(root, featureId), RUN_BASELINE_FILENAME);
@@ -73106,7 +73193,7 @@ async function clearStoryBaselines(root, featureId) {
       return [];
     throw err;
   });
-  await Promise.all(entries.filter((entry) => entry.isDirectory()).map((entry) => rm7(join65(storiesDir, entry.name, STORY_BASELINE_FILENAME), { force: true })));
+  await Promise.all(entries.filter((entry) => entry.isDirectory()).map((entry) => rm8(join65(storiesDir, entry.name, STORY_BASELINE_FILENAME), { force: true })));
 }
 async function resolveStoryBaseline(root, featureId, storyId, executionMode) {
   if (executionMode === "parallel") {
@@ -74378,12 +74465,13 @@ async function performAdversarialReground(turn, firstParsed, drops, ctx) {
   const secondParsed = validateAdversarialShape(tryParseLLMJson(secondTurn.output));
   const costUsd = (turn.estimatedCostUsd ?? 0) + (secondTurn.estimatedCostUsd ?? 0);
   const dropCount = drops.length;
-  if (!secondParsed) {
-    return {
-      ...turn,
-      output: withRepromptMarker(turn.output, { dropCount, outcome: "parse-failed", costUsd })
-    };
-  }
+  const keepFirstTurn = (outcome) => ({
+    ...turn,
+    output: withRepromptMarker(turn.output, { dropCount, outcome, costUsd }),
+    estimatedCostUsd: costUsd
+  });
+  if (!secondParsed)
+    return keepFirstTurn("parse-failed");
   const { accepted: secondAccepted } = filterByAcQuote(secondParsed.findings, acceptanceCriteria);
   const secondBlocking = secondAccepted.filter((f) => isBlockingSeverity(f.severity, threshold));
   if (secondBlocking.length > 0) {
@@ -74411,10 +74499,7 @@ async function performAdversarialReground(turn, firstParsed, drops, ctx) {
       estimatedCostUsd: costUsd
     };
   }
-  return {
-    ...turn,
-    output: withRepromptMarker(turn.output, { dropCount, outcome: "still-dropped", costUsd })
-  };
+  return keepFirstTurn("still-dropped");
 }
 async function maybeRepromptForInspection(turn, parsed, rawObject, ctx) {
   if (ctx.input.adversarialConfig.demandInspectionTrail === false)
@@ -77943,7 +78028,7 @@ var init_scope = __esm(() => {
 });
 
 // src/review/fix-review/tree-snapshot/index.ts
-import { mkdtemp as mkdtemp2, rm as rm8 } from "fs/promises";
+import { mkdtemp as mkdtemp2, rm as rm9 } from "fs/promises";
 import { tmpdir as tmpdir6 } from "os";
 import { join as join69 } from "path";
 async function runGit(args, cwd, indexOverlay, timeoutMs = _treeSnapshotDeps.gitTimeoutMs) {
@@ -78030,7 +78115,7 @@ var init_tree_snapshot = __esm(() => {
     spawn: typedSpawn,
     gitTimeoutMs: TREE_SNAPSHOT_GIT_TIMEOUT_MS,
     mkdtemp: mkdtemp2,
-    rm: rm8,
+    rm: rm9,
     tmpdir: tmpdir6
   };
 });
@@ -79147,33 +79232,62 @@ function parseHeaderPath(rawLine, precededByMinusHeader) {
 function isMinusHeader(rawLine) {
   return rawLine.startsWith("--- ");
 }
-function extractDiffLineRanges(diff) {
-  const ranges = new Map;
-  if (!diff)
-    return ranges;
-  let currentPath = null;
+function bodyLineCost(line) {
+  if (line === "" || line.startsWith(" "))
+    return { old: 1, new: 1 };
+  if (line.startsWith("-"))
+    return { old: 1, new: 0 };
+  if (line.startsWith("+"))
+    return { old: 0, new: 1 };
+  if (line.startsWith("\\"))
+    return { old: 0, new: 0 };
+  return null;
+}
+function* scanDiff(diff) {
+  let oldLeft = 0;
+  let newLeft = 0;
   let prevWasMinusHeader = false;
   for (const rawLine of diff.split(/\r?\n/)) {
+    if (oldLeft > 0 || newLeft > 0) {
+      const cost = bodyLineCost(rawLine);
+      if (cost !== null) {
+        oldLeft = Math.max(0, oldLeft - cost.old);
+        newLeft = Math.max(0, newLeft - cost.new);
+        continue;
+      }
+      oldLeft = 0;
+      newLeft = 0;
+    }
     const wasMinusHeader = prevWasMinusHeader;
     prevWasMinusHeader = isMinusHeader(rawLine);
     if (rawLine.startsWith(HEADER_PREFIX_NOPREFIX)) {
       const path9 = parseHeaderPath(rawLine, wasMinusHeader);
       if (path9 !== null || rawLine.startsWith(HEADER_PREFIX) || wasMinusHeader)
-        currentPath = path9;
+        yield { kind: "header", path: path9 };
       continue;
     }
-    if (!currentPath)
-      continue;
     const match = HUNK_REGEX.exec(rawLine);
     if (!match)
       continue;
-    const newStart = Number(match[3]);
-    const newCount = match[4] === undefined ? 1 : Number(match[4]);
-    if (newCount <= 0)
+    oldLeft = match[2] === undefined ? 1 : Number(match[2]);
+    newLeft = match[4] === undefined ? 1 : Number(match[4]);
+    yield { kind: "hunk", start: Number(match[3]), count: newLeft };
+  }
+}
+function extractDiffLineRanges(diff) {
+  const ranges = new Map;
+  if (!diff)
+    return ranges;
+  let currentPath = null;
+  for (const event of scanDiff(diff)) {
+    if (event.kind === "header") {
+      currentPath = event.path;
+      continue;
+    }
+    if (!currentPath || event.count <= 0)
       continue;
     const entry = ranges.get(currentPath) ?? [];
-    entry.push({ start: newStart, end: newStart + newCount - 1 });
-    ranges.set(currentPath, entry);
+    ranges.set(currentPath, [...entry, { start: event.start, end: event.start + event.count - 1 }]);
   }
   return ranges;
 }
@@ -80108,12 +80222,13 @@ async function performSemanticReground(turn, firstParsed, drops, ctx) {
   const secondParsed = validateLLMShape(tryParseLLMJson(secondTurn.output));
   const costUsd = (turn.estimatedCostUsd ?? 0) + (secondTurn.estimatedCostUsd ?? 0);
   const dropCount = drops.length;
-  if (!secondParsed) {
-    return {
-      ...turn,
-      output: withRepromptMarker2(turn.output, { dropCount, outcome: "parse-failed", costUsd })
-    };
-  }
+  const keepFirstTurn = (outcome) => ({
+    ...turn,
+    output: withRepromptMarker2(turn.output, { dropCount, outcome, costUsd }),
+    estimatedCostUsd: costUsd
+  });
+  if (!secondParsed)
+    return keepFirstTurn("parse-failed");
   const { accepted: secondAccepted } = filterByAcGroundingMinimal(secondParsed.findings, acceptanceCriteria);
   const secondBlocking = secondAccepted.filter((f) => isBlockingSeverity(f.severity, threshold));
   if (secondBlocking.length > 0) {
@@ -80141,10 +80256,7 @@ async function performSemanticReground(turn, firstParsed, drops, ctx) {
       estimatedCostUsd: costUsd
     };
   }
-  return {
-    ...turn,
-    output: withRepromptMarker2(turn.output, { dropCount, outcome: "still-dropped", costUsd })
-  };
+  return keepFirstTurn("still-dropped");
 }
 async function requoteBlockingFindings(findings, ctx) {
   const threshold = ctx.input.blockingThreshold ?? "error";
@@ -82313,9 +82425,10 @@ function resolveHopCompleteOptions(options, currentAgent, primaryAgent, tier, mo
     return { ...options, modelDef: resolveModel(model) };
   return { ...options, modelDef: options.modelDefFor?.(currentAgent, tier) ?? options.modelDef };
 }
-function resolveFinalDispatch(options, primaryAgent, fallbacks, finalTier) {
+function resolveFinalDispatch(options, primaryAgent, outcome) {
+  const { fallbacks, finalTier, finalTarget } = outcome;
   const agentName = fallbacks.at(-1)?.newAgent ?? primaryAgent;
-  const hopOptions = resolveHopCompleteOptions(options, agentName, primaryAgent, finalTier);
+  const hopOptions = resolveHopCompleteOptions(options, agentName, primaryAgent, finalTier, finalTarget?.model);
   return { agentName, options: finalTier !== undefined ? { ...hopOptions, modelTier: finalTier } : hopOptions };
 }
 function buildFallbackRecord(input) {
@@ -83102,8 +83215,15 @@ function parseForm(request) {
   const fields = entries.map(([key, property]) => fieldOf(key, property, required2.has(key)));
   return fields.every((field) => field !== undefined) ? { ok: true, fields: withCompanions(fields) } : REFUSED;
 }
+function ownAnswerHint(field) {
+  if (field.companion === undefined)
+    return "";
+  if (!field.required)
+    return ", or type your own answer";
+  return field.kind === "multi" ? "; you may add your own after at least one choice" : "";
+}
 function instruction(field) {
-  const own = field.companion === undefined ? "" : ", or type your own answer";
+  const own = ownAnswerHint(field);
   const skip = field.required ? "" : " Leave empty to skip.";
   if (field.kind === "single")
     return `Reply with one number or choice${own}.${skip}`;
@@ -92762,7 +92882,7 @@ var init_prompt_retry = __esm(() => {
 });
 
 // src/agents/acp/stream-bridge.ts
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 function toolUpdate(toolName) {
   return toolName === undefined ? { kind: "agent.tool_call_update" } : { kind: "agent.tool_call_update", toolName };
 }
@@ -92815,7 +92935,7 @@ function sender(ctx) {
   };
 }
 function startCall(ctx, now = Date.now) {
-  const callId = randomUUID13();
+  const callId = randomUUID14();
   const send = sender(ctx);
   const base = {
     callId,
@@ -92864,7 +92984,7 @@ var init_stream_bridge = __esm(() => {
 });
 
 // src/agents/acp/turn-loop.ts
-import { randomUUID as randomUUID14 } from "crypto";
+import { randomUUID as randomUUID15 } from "crypto";
 function used(state) {
   return state.turnCount + state.asked;
 }
@@ -92955,7 +93075,7 @@ async function runIteration(loop) {
   }
   const timer = armDeadline(controller, loop.deadline.remainingMs());
   const call2 = startCall(session2.stream);
-  const turnId = opts.turnId ?? randomUUID14();
+  const turnId = opts.turnId ?? randomUUID15();
   try {
     session2.opts.onActiveCall?.(call2.callId, async () => controller.abort(new WatchdogCancel));
     session2.slot.set({
@@ -93908,7 +94028,7 @@ class AgentManager {
         sessionName,
         prompt,
         response: outcome.result.output,
-        ...resolveFinalDispatch(augmented, agentName, outcome.fallbacks, outcome.finalTier),
+        ...resolveFinalDispatch(augmented, agentName, outcome),
         stage,
         resolvedPermissions,
         tokenUsage: outcome.result.tokenUsage,
@@ -95168,7 +95288,7 @@ var init_config_descriptions = __esm(() => {
     "quality.stripEnvVars": "Environment variables to strip during verification",
     tdd: "Test-driven development configuration",
     "tdd.maxRetries": "Max retries per TDD session before escalating",
-    "tdd.strategy": "TDD strategy: auto | strict | lite | off",
+    "tdd.strategy": 'TDD strategy: auto | strict | lite | off | simple ("tdd-simple" is accepted for simple)',
     "tdd.sessionTiers": "Per-session model tier overrides",
     "tdd.sessionTiers.testWriter": "Model tier for test-writer session",
     "tdd.sessionTiers.implementer": "Ignored by design \u2014 implementer follows story.routing.modelTier + escalation, not this field. Kept optional so legacy configs still parse.",
@@ -98902,8 +99022,41 @@ var init_fix_diagnosis = __esm(() => {
   init_import_resolution();
 });
 
+// src/utils/drain-within.ts
+async function drainWithin(drain, deadlineMs) {
+  let timer;
+  const expired = new Promise((resolve37) => {
+    timer = setTimeout(() => resolve37(""), deadlineMs);
+  });
+  try {
+    return await Promise.race([drain, expired]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
 // src/acceptance/hardening.ts
 import path12 from "path";
+async function awaitExitAndDrain(proc, timers) {
+  const stdoutDrain = new Response(proc.stdout).text().catch(() => "");
+  const stderrDrain = new Response(proc.stderr).text().catch(() => "");
+  let exitCode;
+  let output;
+  try {
+    exitCode = await proc.exited;
+    const [stdout, stderr] = await Promise.all([
+      drainWithin(stdoutDrain, _hardeningDeps.drainTimeoutMs),
+      drainWithin(stderrDrain, _hardeningDeps.drainTimeoutMs)
+    ]);
+    output = `${stdout}
+${stderr}`;
+  } finally {
+    clearTimeout(timers.killTimer);
+    if (timers.sigkillTimer)
+      clearTimeout(timers.sigkillTimer);
+  }
+  return { exitCode, output };
+}
 async function processPackageGroup(ctx, packageDir, groupStories, language, result) {
   await assertTrusted(packageDir, "acceptance-command");
   const logger = getSafeLogger2();
@@ -98986,30 +99139,23 @@ async function processPackageGroup(ctx, packageDir, groupStories, language, resu
     detached: true
   });
   let exitedBeforeSigkill = false;
-  let sigkillTimer;
   proc.exited.then(() => {
     exitedBeforeSigkill = true;
   }).catch(() => {});
   const timeoutMs = config2.acceptance?.timeoutMs ?? DEFAULT_HARDENING_TIMEOUT_MS;
-  const killTimer = setTimeout(() => {
-    killProcessGroup(proc.pid, "SIGTERM");
-    sigkillTimer = setTimeout(() => {
-      sigkillTimer = undefined;
-      if (!exitedBeforeSigkill) {
-        killProcessGroup(proc.pid, "SIGKILL");
-      }
-    }, HARDENING_SIGKILL_GRACE_PERIOD_MS);
-  }, timeoutMs);
-  const [exitCode, stdout, stderr] = await Promise.all([
-    proc.exited,
-    new Response(proc.stdout).text().catch(() => ""),
-    new Response(proc.stderr).text().catch(() => "")
-  ]);
-  clearTimeout(killTimer);
-  if (sigkillTimer)
-    clearTimeout(sigkillTimer);
-  const output = `${stdout}
-${stderr}`;
+  const timers = {
+    killTimer: setTimeout(() => {
+      killProcessGroup(proc.pid, "SIGTERM");
+      timers.sigkillTimer = setTimeout(() => {
+        timers.sigkillTimer = undefined;
+        if (!exitedBeforeSigkill) {
+          killProcessGroup(proc.pid, "SIGKILL");
+        }
+      }, HARDENING_SIGKILL_GRACE_PERIOD_MS);
+    }, timeoutMs),
+    sigkillTimer: undefined
+  };
+  const { exitCode, output } = await awaitExitAndDrain(proc, timers);
   const failedACs = parseTestFailures(output);
   const failedSet = new Set(failedACs.map((ac) => ac.toUpperCase()));
   if (exitCode !== 0 && failedACs.length === 0) {
@@ -99114,19 +99260,59 @@ var init_hardening = __esm(() => {
     writeFile: async (p, c) => {
       await Bun.write(p, c);
     },
-    detectLanguage
+    detectLanguage,
+    drainTimeoutMs: 2000
+  };
+});
+
+// src/acceptance/override-keys.ts
+import { relative as relative26 } from "path";
+function scopedOverrideKey(workdir, packageDir, acId) {
+  return `${relative26(workdir, packageDir) || "."}${OVERRIDE_SCOPE_SEPARATOR}${acId}`;
+}
+function definingPackageCount(acId, counts) {
+  const n = Number(NUMBERED_AC.exec(acId)?.[1] ?? 0);
+  if (n < 1)
+    return 0;
+  return [...counts.values()].filter((count2) => count2 >= n).length;
+}
+function createOverrideLookup(opts) {
+  const table = opts.overrides ?? {};
+  const reported = new Set;
+  return {
+    reasonFor(packageDir, acId) {
+      const scoped2 = table[scopedOverrideKey(opts.workdir, packageDir, acId)];
+      if (scoped2 !== undefined)
+        return scoped2;
+      const bare = table[acId];
+      if (bare === undefined || !opts.multiPackage)
+        return bare;
+      if (definingPackageCount(acId, opts.acCountByPackageDir) === 1)
+        return bare;
+      if (!reported.has(acId)) {
+        reported.add(acId);
+        opts.onIgnoredBareKey(acId);
+      }
+      return;
+    }
   };
+}
+var OVERRIDE_SCOPE_SEPARATOR = "::", NUMBERED_AC;
+var init_override_keys = __esm(() => {
+  NUMBERED_AC = /^AC-(\d+)$/;
 });
 
 // src/acceptance/index.ts
 var exports_acceptance = {};
 __export(exports_acceptance, {
+  OVERRIDE_SCOPE_SEPARATOR: () => OVERRIDE_SCOPE_SEPARATOR,
   _acceptanceExecutionDeps: () => _acceptanceExecutionDeps,
   _groupDeps: () => _groupDeps,
   acceptanceTestFilename: () => acceptanceTestFilename2,
   buildAcceptanceRunCommand: () => buildAcceptanceRunCommand,
   buildAcceptanceTestPrompt: () => buildAcceptanceTestPrompt,
   checkAcceptanceCoverage: () => checkAcceptanceCoverage,
+  createOverrideLookup: () => createOverrideLookup,
   effectiveAcceptanceFramework: () => effectiveAcceptanceFramework,
   findExistingAcceptanceTestPath: () => findExistingAcceptanceTestPath,
   findMissingAcceptanceTestPaths: () => findMissingAcceptanceTestPaths,
@@ -99144,6 +99330,7 @@ __export(exports_acceptance, {
   resolveSuggestedPackageFeatureTestPath: () => resolveSuggestedPackageFeatureTestPath,
   resolveSuggestedTestFile: () => resolveSuggestedTestFile,
   runHardeningPass: () => runHardeningPass,
+  scopedOverrideKey: () => scopedOverrideKey,
   substituteAcceptanceTestPath: () => substituteAcceptanceTestPath,
   suggestedTestFilename: () => suggestedTestFilename,
   warnMissingAcceptanceTests: () => warnMissingAcceptanceTests
@@ -99154,13 +99341,14 @@ var init_acceptance2 = __esm(() => {
   init_fix_diagnosis();
   init_generator();
   init_hardening();
+  init_override_keys();
   init_refinement();
   init_test_path();
 });
 
 // src/cli/features-acceptance.ts
 import { existsSync as existsSync16 } from "fs";
-import { join as join79, relative as relative26 } from "path";
+import { join as join79, relative as relative27 } from "path";
 async function resolveFeatureAcceptance(featureName, workdir) {
   let enabled = true;
   try {
@@ -99181,11 +99369,11 @@ async function resolveFeatureAcceptance(featureName, workdir) {
     const prd = await loadPRD(prdPath);
     const testGroups = await groupStoriesByPackage(prd, repoRoot, featureName, config2.acceptance?.testPath, config2.project?.language);
     const groups = await Promise.all(testGroups.map(async (g) => {
-      const packageDir = relative26(repoRoot, g.packageDir);
+      const packageDir = relative27(repoRoot, g.packageDir);
       const command2 = await resolveGroupCommand(repoRoot, packageDir, config2.acceptance?.command);
       return {
         packageDir,
-        testPath: relative26(repoRoot, g.testPath),
+        testPath: relative27(repoRoot, g.testPath),
         exists: await Bun.file(g.testPath).exists(),
         command: command2,
         cwd: packageDir,
@@ -99240,7 +99428,7 @@ var init_feature_name = __esm(() => {
 
 // src/cli/features-resolve.ts
 import { existsSync as existsSync17, readdirSync as readdirSync3 } from "fs";
-import { join as join80, relative as relative27 } from "path";
+import { join as join80, relative as relative28 } from "path";
 async function resolveTestPatterns(workdir) {
   try {
     const config2 = await loadConfig(workdir);
@@ -99263,17 +99451,17 @@ async function searchSpecSource(naxDir, repoRoot, name) {
   ];
   const docsSpecExact = join80(repoRoot, "docs", "specs", `SPEC-${name}.md`);
   candidates.push({ abs: docsSpecExact, kind: "markdown" });
-  const checked = candidates.map((c) => relative27(repoRoot, c.abs));
+  const checked = candidates.map((c) => relative28(repoRoot, c.abs));
   for (const { abs, kind } of candidates.slice(0, 2)) {
     if (kind === "markdown") {
       const nonEmpty2 = await isNonEmptyFile(abs);
       if (nonEmpty2) {
-        return { source: { kind, path: relative27(repoRoot, abs) }, checked };
+        return { source: { kind, path: relative28(repoRoot, abs) }, checked };
       }
     }
   }
   if (await isNonEmptyFile(docsSpecExact)) {
-    return { source: { kind: "markdown", path: relative27(repoRoot, docsSpecExact) }, checked };
+    return { source: { kind: "markdown", path: relative28(repoRoot, docsSpecExact) }, checked };
   }
   const docsSpecsDir = join80(repoRoot, "docs", "specs");
   if (existsSync17(docsSpecsDir)) {
@@ -99281,7 +99469,7 @@ async function searchSpecSource(naxDir, repoRoot, name) {
     for (const match of glob2.scanSync({ cwd: docsSpecsDir, absolute: false })) {
       const abs = join80(docsSpecsDir, match);
       if (await isNonEmptyFile(abs)) {
-        const relPath = relative27(repoRoot, abs);
+        const relPath = relative28(repoRoot, abs);
         if (!checked.includes(relPath))
           checked.push(relPath);
         return { source: { kind: "markdown", path: relPath }, checked };
@@ -99289,7 +99477,7 @@ async function searchSpecSource(naxDir, repoRoot, name) {
     }
   }
   const prdAbs = join80(naxDir, "features", name, "prd.json");
-  const prdRel = relative27(repoRoot, prdAbs);
+  const prdRel = relative28(repoRoot, prdAbs);
   if (!checked.includes(prdRel))
     checked.push(prdRel);
   if (existsSync17(prdAbs)) {
@@ -99341,8 +99529,8 @@ async function resolveFeatureSpec(name, workdir) {
     return {
       status: "ok",
       featureName: null,
-      specSource: { kind: "markdown", path: relative27(repoRoot, abs) },
-      message: `resolved spec: ${relative27(repoRoot, abs)}`
+      specSource: { kind: "markdown", path: relative28(repoRoot, abs) },
+      message: `resolved spec: ${relative28(repoRoot, abs)}`
     };
   }
   if (name !== undefined && name.trim() !== "") {
@@ -99791,7 +99979,7 @@ var init_windsurf = __esm(() => {
 
 // src/context/generator/index.ts
 import { existsSync as existsSync19 } from "fs";
-import { join as join82, relative as relative28 } from "path";
+import { join as join82, relative as relative29 } from "path";
 async function loadContextContent(options, config2) {
   if (!_generatorDeps.existsSync(options.contextPath)) {
     throw new NaxError(`Context file not found: ${options.contextPath}`, "CONTEXT_FILE_NOT_FOUND", {
@@ -99922,7 +100110,7 @@ async function discoverWorkspacePackages2(repoRoot) {
 }
 async function generateForPackage(packageDir, config2, dryRun = false, repoRoot) {
   const resolvedRepoRoot = repoRoot ?? packageDir;
-  const relativePkgPath = relative28(resolvedRepoRoot, packageDir);
+  const relativePkgPath = relative29(resolvedRepoRoot, packageDir);
   const contextPath = join82(resolvedRepoRoot, ".nax", "mono", relativePkgPath, "context.md");
   if (!_generatorDeps.existsSync(contextPath)) {
     return [
@@ -100206,7 +100394,7 @@ var init_generate = __esm(() => {
 
 // src/cli/init-context.ts
 import { mkdir as mkdir25, readdir as readdir7 } from "fs/promises";
-import { basename as basename11, join as join84, relative as relative29, sep as sep18 } from "path";
+import { basename as basename11, join as join84, relative as relative30, sep as sep18 } from "path";
 async function bunFileExists(path13) {
   return Bun.file(path13).exists();
 }
@@ -100233,7 +100421,7 @@ async function walkDir(root, current, out, maxFiles) {
         continue;
       await walkDir(root, join84(current, entry2.name), out, maxFiles);
     } else if (entry2.isFile()) {
-      out.push(relative29(root, join84(current, entry2.name)).replaceAll(sep18, "/"));
+      out.push(relative30(root, join84(current, entry2.name)).replaceAll(sep18, "/"));
     }
   }
 }
@@ -101437,7 +101625,7 @@ var init_resume_hydrate = __esm(() => {
 });
 
 // src/tdd/rollback.ts
-import { rm as rm9 } from "fs/promises";
+import { rm as rm10 } from "fs/promises";
 import { join as join88 } from "path";
 async function runGitBounded2(args, workdir) {
   if (!workdir) {
@@ -101558,18 +101746,18 @@ var init_rollback = __esm(() => {
     autoCommitIfDirty,
     getUntrackedPaths,
     getGitRoot,
-    rm: rm9,
+    rm: rm10,
     timeoutMs: ROLLBACK_GIT_TIMEOUT_MS,
     drainTimeoutMs: ROLLBACK_DRAIN_TIMEOUT_MS
   };
 });
 
 // src/utils/paths.ts
-import { join as join89, relative as relative30, sep as sep19 } from "path";
+import { join as join89, relative as relative31, sep as sep19 } from "path";
 function packageDirRelative(projectDir, workdir) {
   if (!projectDir || !workdir || workdir === projectDir)
     return;
-  const rel = relative30(projectDir, workdir);
+  const rel = relative31(projectDir, workdir);
   if (rel === ".." || rel.startsWith(`..${sep19}`))
     return;
   return rel && rel !== "." ? rel : undefined;
@@ -106166,8 +106354,8 @@ var init_escalation = __esm(() => {
 });
 
 // src/execution/lock.ts
-import { randomUUID as randomUUID15 } from "crypto";
-import { rename as rename6, unlink as unlink6 } from "fs/promises";
+import { randomUUID as randomUUID16 } from "crypto";
+import { rename as rename7, unlink as unlink6 } from "fs/promises";
 import { hostname as hostname3 } from "os";
 import path14 from "path";
 async function serializeLockOperation(workdir, operation) {
@@ -106210,7 +106398,7 @@ function parseHolder(raw) {
   }
 }
 async function publishFileAtomically(targetPath, content) {
-  const tempPath = `${targetPath}.${randomUUID15()}.tmp`;
+  const tempPath = `${targetPath}.${randomUUID16()}.tmp`;
   try {
     await Bun.write(tempPath, content);
     const fs = await import("fs");
@@ -106383,14 +106571,14 @@ var init_lock2 = __esm(() => {
   init_logger2();
   pendingLockOperations = new Map;
   _lockDeps = {
-    rename: rename6,
+    rename: rename7,
     host: () => hostname3(),
     readLockText: (lockPath) => Bun.file(lockPath).text()
   };
 });
 
 // src/execution/feature-lock.ts
-import { mkdir as mkdir28, rename as rename7, unlink as unlink7 } from "fs/promises";
+import { mkdir as mkdir28, rename as rename8, unlink as unlink7 } from "fs/promises";
 import { hostname as hostname4 } from "os";
 import path15 from "path";
 function validateFeatureId2(featureId) {
@@ -106629,7 +106817,7 @@ var init_feature_lock = __esm(() => {
     featureLockPath,
     host: () => hostname4(),
     isProcessAlive,
-    rename: rename7,
+    rename: rename8,
     tryExclusiveCreate,
     unlink: unlink7
   };
@@ -107799,6 +107987,17 @@ var init_acceptance3 = __esm(() => {
         storiesByPackageDir.set(pkgDir, (storiesByPackageDir.get(pkgDir) ?? 0) + 1);
         acsByPackageDir.set(pkgDir, (acsByPackageDir.get(pkgDir) ?? 0) + s.acceptanceCriteria.length);
       }
+      const overrideLookup = createOverrideLookup({
+        overrides: ctx.prd.acceptanceOverrides,
+        workdir: ctx.workdir,
+        acCountByPackageDir: acsByPackageDir,
+        multiPackage: testGroups.length > 1,
+        onIgnoredBareKey: (acId) => logger.warn("acceptance", "Bare acceptance override ignored: several packages define this AC id", {
+          storyId: ctx.story.id,
+          acId,
+          hint: `scope it to one package: "<package>::${acId}"`
+        })
+      });
       const allFailedACs = [];
       const seenAcKeys = new Set;
       const allFindings = [];
@@ -107856,14 +108055,14 @@ var init_acceptance3 = __esm(() => {
         const output = execution.output ?? "";
         allOutputParts.push(output);
         const { failedACs, taggedFailureCount } = parseTestFailuresDetailed(output);
-        const overrides = ctx.prd.acceptanceOverrides ?? {};
-        const actualFailures = failedACs.filter((acId) => !overrides[acId]);
-        const overriddenFailures = failedACs.filter((acId) => overrides[acId]);
+        const reasonFor = (acId) => overrideLookup.reasonFor(packageDir, acId);
+        const actualFailures = failedACs.filter((acId) => !reasonFor(acId));
+        const overriddenFailures = failedACs.filter((acId) => reasonFor(acId));
         if (overriddenFailures.length > 0) {
           logger.warn("acceptance", "Skipped failures (overridden)", {
             storyId: ctx.story.id,
             overriddenFailures,
-            overrides: overriddenFailures.map((acId) => ({ acId, reason: overrides[acId] }))
+            overrides: overriddenFailures.map((acId) => ({ acId, reason: reasonFor(acId) }))
           });
         }
         if (failedACs.length === 0 && exitCode !== 0) {
@@ -108973,7 +109172,7 @@ var init_scope_files = __esm(() => {
 });
 
 // src/pipeline/stages/context.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 import { join as join99 } from "path";
 async function runV2Path(ctx) {
   const logger = getLogger2();
@@ -109214,7 +109413,7 @@ var init_context3 = __esm(() => {
     createOrchestrator: createDefaultOrchestrator,
     loadPlugins: loadPluginProviders,
     v1FeatureProvider: () => new FeatureContextProvider,
-    uuid: () => randomUUID16(),
+    uuid: () => randomUUID17(),
     readDigest: readDigestFile,
     writeDigest: writeDigestFile,
     loadFeatureManifests,
@@ -110856,7 +111055,8 @@ async function executeHook(hookDef, ctx, workdir) {
     stdin: new Response(contextJson),
     stdout: "pipe",
     stderr: "pipe",
-    env: buildAllowedEnv({ env: env2 })
+    env: buildAllowedEnv({ env: env2 }),
+    detached: true
   });
   let timedOut = false;
   let killTimeoutId;
@@ -111759,7 +111959,7 @@ var init_headless_formatter = __esm(() => {
 
 // src/execution/lifecycle/run-tmp-wipe.ts
 import { lstatSync as lstatSync4 } from "fs";
-import { rm as rm10 } from "fs/promises";
+import { rm as rm11 } from "fs/promises";
 function inspect(path19) {
   try {
     return _runTmpWipeDeps.exists(path19) ? { state: "present" } : { state: "absent" };
@@ -111799,7 +111999,7 @@ var init_run_tmp_wipe = __esm(() => {
   init_internal();
   init_logger2();
   _runTmpWipeDeps = {
-    remove: (path19) => rm10(path19, { recursive: true, force: true }),
+    remove: (path19) => rm11(path19, { recursive: true, force: true }),
     exists: (path19) => {
       try {
         lstatSync4(path19);
@@ -111814,7 +112014,7 @@ var init_run_tmp_wipe = __esm(() => {
 });
 
 // src/execution/lifecycle/scratchpad-wipe.ts
-import { rm as rm11 } from "fs/promises";
+import { rm as rm12 } from "fs/promises";
 import { join as join102 } from "path";
 async function wipeScratchpad(workdir, opts = {}) {
   if (opts.dryRun)
@@ -111837,7 +112037,7 @@ var init_scratchpad_wipe = __esm(() => {
   init_internal();
   init_logger2();
   _scratchpadWipeDeps = {
-    remove: (path19) => rm11(path19, { recursive: true, force: true })
+    remove: (path19) => rm12(path19, { recursive: true, force: true })
   };
 });
 
@@ -113220,7 +113420,7 @@ var init_rtk = __esm(() => {
 });
 
 // src/execution/status-file.ts
-import { rename as rename8, unlink as unlink8 } from "fs/promises";
+import { rename as rename9, unlink as unlink8 } from "fs/promises";
 import { resolve as resolve39 } from "path";
 function countProgress(prd) {
   const stories = prd.userStories;
@@ -113284,7 +113484,7 @@ async function writeStatusFile(filePath2, status) {
     await unlink8(tmpPath);
   } catch {}
   await Bun.write(tmpPath, JSON.stringify(status, null, 2));
-  await rename8(tmpPath, resolvedPath);
+  await rename9(tmpPath, resolvedPath);
 }
 var init_status_file = __esm(() => {
   init_errors4();
@@ -115160,7 +115360,7 @@ async function* streamJsonlLines(file2) {
 }
 
 // src/plugins/builtin/curator/rollup-prune.ts
-import { appendFile as appendFile6, rename as rename9, unlink as unlink9, writeFile as writeFile13 } from "fs/promises";
+import { appendFile as appendFile6, rename as rename10, unlink as unlink9, writeFile as writeFile12 } from "fs/promises";
 async function scanProjectRunIds(rollupPath, projectKey) {
   const maxTsByRunId = new Map;
   for await (const line of streamJsonlLines(Bun.file(rollupPath))) {
@@ -115205,7 +115405,7 @@ async function pruneRollupUnlocked(input) {
     buffer = "";
   };
   try {
-    await writeFile13(tmpPath, "");
+    await writeFile12(tmpPath, "");
     for await (const line of streamJsonlLines(Bun.file(rollupPath))) {
       if (!line.trim())
         continue;
@@ -115241,7 +115441,7 @@ async function pruneRollupUnlocked(input) {
         await flush();
     }
     await flush();
-    await rename9(tmpPath, rollupPath);
+    await rename10(tmpPath, rollupPath);
   } catch (err) {
     await unlink9(tmpPath).catch(() => {});
     throw err;
@@ -115640,8 +115840,8 @@ function collectRectify(context, entry2, data) {
     ts: stringValue(entry2.timestamp ?? entry2.ts, now()),
     kind: "rectify-cycle",
     payload: {
-      iteration: numberValue(data.attempt ?? data.rectifyAttempt ?? data.iteration, 1),
-      status: stringValue(data.status, "started")
+      iteration: numberValue(data.iterationCount, 1),
+      status: data.exitReason === "resolved" ? "passed" : "failed"
     }
   };
 }
@@ -115733,7 +115933,7 @@ async function collectFromRunJsonl(context) {
         observations.push(collectPullCall(context, entry2, data));
       } else if (stage === "acceptance" && message === "verdict") {
         observations.push(collectAcceptanceVerdict(context, entry2, data));
-      } else if (stage === "rectify" && message === "Starting rectification loop") {
+      } else if (stage === "story-orchestrator" && typeof data.iterationCount === "number") {
         observations.push(collectRectify(context, entry2, data));
       } else if (stage === "escalation" && message.includes("Escalating")) {
         observations.push(collectEscalation(context, entry2, data));
@@ -116098,7 +116298,7 @@ function renderProposals(proposals, runId, observationCount, provenance) {
 }
 
 // src/plugins/builtin/curator/rollup.ts
-import { appendFile as appendFile7, mkdir as mkdir30, writeFile as writeFile14 } from "fs/promises";
+import { appendFile as appendFile7, mkdir as mkdir30, writeFile as writeFile13 } from "fs/promises";
 import * as path22 from "path";
 async function appendToRollup(observations, rollupPath) {
   const dir = path22.dirname(rollupPath);
@@ -116111,7 +116311,7 @@ async function appendToRollupUnlocked(observations, rollupPath) {
     if (observations.length === 0) {
       const f = Bun.file(rollupPath);
       if (!await f.exists()) {
-        await writeFile14(rollupPath, "");
+        await writeFile13(rollupPath, "");
       }
       return;
     }
@@ -117183,7 +117383,7 @@ var init_language_commands = __esm(() => {
 });
 
 // src/review/scoped-lint.ts
-import { join as join109, relative as relative32 } from "path";
+import { join as join109, relative as relative33 } from "path";
 function normalizePath3(path25) {
   return path25.replaceAll("\\", "/").replace(/^\.\//, "");
 }
@@ -117209,7 +117409,7 @@ async function listChangedFiles(workdir, baseRef) {
 function inferActivePackageDir(workdir, projectDir) {
   if (!projectDir)
     return;
-  const rel = normalizePath3(relative32(projectDir, workdir));
+  const rel = normalizePath3(relative33(projectDir, workdir));
   if (!rel || rel === "." || rel.startsWith(".."))
     return;
   return rel;
@@ -118294,8 +118494,8 @@ function resolveCanonicalTargetPath(projectDir, canonicalFile) {
   const root = resolve42(projectDir);
   if (target !== root && !target.startsWith(root + sep21))
     return null;
-  const relative33 = target.slice(root.length + 1).replaceAll(sep21, "/");
-  return CURATOR_TARGET_SHAPES.some((shape) => shape.test(relative33)) ? target : null;
+  const relative34 = target.slice(root.length + 1).replaceAll(sep21, "/");
+  return CURATOR_TARGET_SHAPES.some((shape) => shape.test(relative34)) ? target : null;
 }
 function isWithinCanonicalRulesDir(projectDir, targetPath) {
   const rulesRoot = resolve42(projectDir, CANONICAL_RULES_DIR);
@@ -118881,7 +119081,7 @@ __export(exports_migrate, {
   partitionTrackedCandidates: () => partitionTrackedCandidates
 });
 import { existsSync as existsSync30 } from "fs";
-import { mkdir as mkdir32, readdir as readdir10, rename as rename10 } from "fs/promises";
+import { mkdir as mkdir32, readdir as readdir10, rename as rename11 } from "fs/promises";
 import path26 from "path";
 async function detectGeneratedContent(naxDir) {
   if (!existsSync30(naxDir))
@@ -119066,7 +119266,7 @@ async function migrateCommand(options) {
     const archiveBase = path26.join(globalConfigDir(), "_archive");
     const archiveDest = path26.join(archiveBase, `${options.reclaim}-${Date.now()}`);
     await mkdir32(archiveBase, { recursive: true });
-    await rename10(src, archiveDest);
+    await rename11(src, archiveDest);
     logger.info("migrate", `Reclaimed: archived to ${archiveDest}`, { storyId: "_migrate" });
     return;
   }
@@ -119165,7 +119365,7 @@ async function migrateCommand(options) {
   Remove the destination or run nax migrate --dry-run to inspect.`, "MIGRATE_CONFLICT", { stage: "migrate", src: candidate.srcPath, dest });
     }
     try {
-      await rename10(candidate.srcPath, dest);
+      await rename11(candidate.srcPath, dest);
     } catch (err) {
       const isXdev = err instanceof Error && "code" in err && err.code === "EXDEV";
       if (isXdev) {
@@ -122019,7 +122219,7 @@ var init_queue_file_lock = __esm(() => {
 });
 
 // src/execution/queue-handler.ts
-import { rename as rename11, unlink as unlink12 } from "fs/promises";
+import { rename as rename12, unlink as unlink12 } from "fs/promises";
 import path29 from "path";
 function getSafeLogger9() {
   try {
@@ -122039,7 +122239,7 @@ async function claimCommandsLocked(queuePath, processingPath, logger) {
     return null;
   }
   try {
-    await rename11(queuePath, processingPath);
+    await rename12(queuePath, processingPath);
   } catch (error48) {
     logger?.warn("queue", "Failed to rename queue file for processing", {
       error: error48.message
@@ -122215,7 +122415,7 @@ var init_run_cost_reconcile = __esm(() => {
 });
 
 // src/finish/audit.ts
-import { appendFile as appendFile8, mkdir as mkdir34, readFile as readFile10, writeFile as writeFile15 } from "fs/promises";
+import { appendFile as appendFile8, mkdir as mkdir34, readFile as readFile10, writeFile as writeFile14 } from "fs/promises";
 import { join as join120 } from "path";
 function roundsPath(t) {
   return join120(t.auditDir, `${t.runId}.jsonl`);
@@ -122243,7 +122443,7 @@ async function updateLedger(t, result) {
   };
   try {
     await mkdir34(t.auditDir, { recursive: true });
-    await writeFile15(ledgerPath(t.auditDir), `${JSON.stringify(entry2, null, 2)}
+    await writeFile14(ledgerPath(t.auditDir), `${JSON.stringify(entry2, null, 2)}
 `, "utf8");
   } catch {}
 }
@@ -122293,7 +122493,7 @@ async function writeResult(t, result, options = {}) {
   const rounds = await readRounds(t);
   const withRounds = rounds.length > 0 ? { ...result, rounds } : result;
   await mkdir34(t.auditDir, { recursive: true });
-  await writeFile15(resultPath(t), `${JSON.stringify(withRounds, null, 2)}
+  await writeFile14(resultPath(t), `${JSON.stringify(withRounds, null, 2)}
 `, "utf8");
   if (options.ledger === false)
     return;
@@ -122826,7 +123026,7 @@ function languageRunner(language) {
 function buildAcceptanceCommand(repoRoot, group) {
   const absFile = shellQuote(`${repoRoot}/${group.testPath}`);
   const template = group.command ?? `${languageRunner(group.language)} {{FILE}}`;
-  return template.replace(/\{\{FILE\}\}|\{\{file\}\}|\{\{files\}\}/g, absFile);
+  return template.replace(/\{\{FILE\}\}|\{\{file\}\}|\{\{files\}\}/g, () => absFile);
 }
 async function runAcceptanceGate(repoRoot, groups, opts = {}) {
   const chunks = [];
@@ -125060,7 +125260,7 @@ var init_interaction3 = __esm(() => {
 });
 
 // src/pipeline/subscribers/registry.ts
-import { mkdir as mkdir36, writeFile as writeFile16 } from "fs/promises";
+import { mkdir as mkdir36, writeFile as writeFile15 } from "fs/promises";
 import { basename as basename16, join as join124 } from "path";
 function wireRegistry(bus, feature, runId, workdir, outputDir) {
   const logger = getSafeLogger2();
@@ -125080,7 +125280,7 @@ function wireRegistry(bus, feature, runId, workdir, outputDir) {
           eventsDir: join124(outputDir, "features", feature, "runs"),
           registeredAt: new Date().toISOString()
         };
-        await writeFile16(metaFile, JSON.stringify(meta3, null, 2));
+        await writeFile15(metaFile, JSON.stringify(meta3, null, 2));
       } catch (err) {
         logger?.warn("registry-writer", "Failed to write meta.json (non-fatal)", {
           path: metaFile,
@@ -128014,7 +128214,7 @@ __export(exports_story_size_gate, {
 function countBulletPoints(text) {
   const lines2 = text.split(`
 `);
-  const bulletPattern = /^\s*[-*\u2022]|\d+\./;
+  const bulletPattern = /^\s*(?:[-*\u2022]|\d+\.)\s/;
   return lines2.filter((line) => bulletPattern.test(line)).length;
 }
 function analyzeStory(story, config2) {
@@ -153098,9 +153298,9 @@ function parseSchedule(input, now3) {
   const trimmed = input.trim();
   if (trimmed === "")
     return { ok: false, error: `Empty schedule value. ${ACCEPTED}` };
-  const relative33 = parseRelative(trimmed, now3);
-  if (relative33)
-    return relative33;
+  const relative34 = parseRelative(trimmed, now3);
+  if (relative34)
+    return relative34;
   const timeOfDay = parseTimeOfDay(trimmed, now3);
   if (timeOfDay)
     return timeOfDay;