@nathapp/nax 0.88.0-canary.2 → 0.88.0

package/dist/nax.js

@@ -12889,6 +12889,212 @@ function hasNaxDirNear(ctx) {
 var MAX_NESTED_DEPTH = 3, NEGATIVE_TTL_MS = 1000;
 var init_nax_dirs = () => {};
 
+// ../nax-agent/src/tools/bash-canonical.ts
+function refused(reason) {
+  return { kind: "refused", reason: `Bash canonical analysis refused: ${reason}` };
+}
+function optionWidth(word, options) {
+  if (options.flags.includes(word))
+    return 1;
+  if (options.values.includes(word))
+    return 2;
+  if (options.values.some((flag) => flag.startsWith("--") ? word.startsWith(`${flag}=`) : word.startsWith(flag) && word.length > flag.length))
+    return 1;
+  if (/^-[A-Za-z0-9]+$/.test(word) && [...word.slice(1)].every((letter) => options.flags.includes(`-${letter}`)))
+    return 1;
+  return;
+}
+function afterOptions(tokens, start, options) {
+  let i = start;
+  while (tokens[i]?.text.startsWith("-")) {
+    const token = tokens[i];
+    if (token.opaque)
+      return "opaque wrapper option";
+    if (token.text === "--")
+      return i + 1;
+    const width = optionWidth(token.text, options);
+    if (width === undefined)
+      return `unknown option ${token.text}`;
+    if (width === 2 && tokens[i + 1] === undefined)
+      return `missing value for ${token.text}`;
+    i += width;
+  }
+  return i;
+}
+function shellPayload(tokens) {
+  for (let i = 1;i < tokens.length; i += 1) {
+    const token = tokens[i];
+    const word = token.text;
+    if (!word.startsWith("-") && !word.startsWith("+") || word === "--")
+      return;
+    if (token.opaque)
+      return "opaque shell option";
+    if (word === "-o" || word === "+o" || word === "-O" || word === "--rcfile" || word === "--init-file") {
+      i += 1;
+      continue;
+    }
+    if (/^-[A-Za-z]*c[A-Za-z]*$/.test(word))
+      return tokens[i + 1] ?? "missing shell command string";
+  }
+  return;
+}
+function stripPrefixes(input) {
+  let tokens = input;
+  for (;; ) {
+    const head = tokens[0];
+    if (head === undefined)
+      return [];
+    if (head.opaque)
+      return "opaque command head";
+    if (KEYWORDS.has(head.text) || ASSIGNMENT3.test(head.text)) {
+      tokens = tokens.slice(1);
+      continue;
+    }
+    const wrapper = Object.hasOwn(WRAPPERS, head.text) ? WRAPPERS[head.text] : undefined;
+    if (wrapper === undefined)
+      break;
+    const next = afterOptions(tokens, 1, wrapper);
+    if (typeof next === "string")
+      return `${head.text}: ${next}`;
+    const command = head.text === "timeout" ? next + 1 : next;
+    if (head.text === "timeout" && tokens[next] === undefined)
+      return "missing timeout duration";
+    tokens = tokens.slice(command);
+  }
+  return tokens;
+}
+function expandShell(payload, depth) {
+  if (depth >= 3)
+    return refused("shell command strings nest deeper than 3 levels");
+  if (payload.opaque)
+    return refused("opaque shell command string");
+  const lexed = lexBashCommand(payload.text);
+  if (lexed.kind === "refused")
+    return refused(`shell command string contains ${lexed.construct}`);
+  const segments = [];
+  for (const nested of lexed.segments) {
+    const result = canonicalise2(nested, depth + 1);
+    if (result.kind === "refused")
+      return result;
+    segments.push(...result.segments);
+  }
+  return { kind: "ok", segments };
+}
+function canonicalise2(segment, depth) {
+  const stripped = stripPrefixes(segment.tokens);
+  if (typeof stripped === "string")
+    return refused(stripped);
+  let tokens = stripped;
+  if (tokens.length === 0)
+    return { kind: "ok", segments: [] };
+  if (tokens.length === 1 && CLOSERS.has(tokens[0]?.text ?? ""))
+    return { kind: "ok", segments: [] };
+  if (tokens[0]?.text === "git") {
+    const next = afterOptions(tokens, 1, GIT_OPTIONS);
+    if (typeof next === "string")
+      return refused(`git: ${next}`);
+    tokens = [tokens[0], ...tokens.slice(next)];
+  }
+  const head = tokens[0]?.text.split("/").pop() ?? "";
+  if (SHELLS.has(head)) {
+    const payload = shellPayload(tokens);
+    if (typeof payload === "string")
+      return refused(payload);
+    if (payload !== undefined)
+      return expandShell(payload, depth);
+  }
+  return { kind: "ok", segments: [{ ...segment, tokens }] };
+}
+function canonicalSegments(segment) {
+  return canonicalise2(segment, 0);
+}
+var WRAPPERS, GIT_OPTIONS, KEYWORDS, CLOSERS, SHELLS, ASSIGNMENT3;
+var init_bash_canonical = __esm(() => {
+  init_permissions();
+  WRAPPERS = {
+    env: { flags: ["-i", "--ignore-environment"], values: ["-u", "--unset"] },
+    command: { flags: ["-p"], values: [] },
+    exec: { flags: ["-c", "-l"], values: ["-a"] },
+    time: { flags: ["-p"], values: [] },
+    nohup: { flags: [], values: [] },
+    nice: { flags: [], values: ["-n", "--adjustment"] },
+    timeout: {
+      flags: ["--foreground", "--preserve-status", "-v", "--verbose"],
+      values: ["-k", "--kill-after", "-s", "--signal"]
+    },
+    stdbuf: { flags: [], values: ["-i", "-o", "-e", "--input", "--output", "--error"] },
+    xargs: {
+      flags: ["-0", "--null", "-r", "--no-run-if-empty", "-t", "--verbose", "-p", "--interactive", "-x", "--exit"],
+      values: [
+        "-I",
+        "-n",
+        "-P",
+        "-d",
+        "-E",
+        "-L",
+        "-s",
+        "-a",
+        "--replace",
+        "--max-args",
+        "--max-procs",
+        "--delimiter",
+        "--eof",
+        "--max-lines",
+        "--max-chars",
+        "--arg-file"
+      ]
+    },
+    busybox: { flags: [], values: [] },
+    sudo: {
+      flags: [
+        "-A",
+        "-b",
+        "-E",
+        "-H",
+        "-K",
+        "-k",
+        "-n",
+        "-S",
+        "--askpass",
+        "--background",
+        "--preserve-env",
+        "--set-home",
+        "--non-interactive",
+        "--stdin"
+      ],
+      values: [
+        "-u",
+        "-g",
+        "-h",
+        "-D",
+        "-C",
+        "-p",
+        "-r",
+        "-t",
+        "-U",
+        "--user",
+        "--group",
+        "--host",
+        "--chdir",
+        "--close-from",
+        "--prompt",
+        "--role",
+        "--type",
+        "--other-user"
+      ]
+    },
+    doas: { flags: ["-n", "-s", "-L"], values: ["-u", "-C"] }
+  };
+  GIT_OPTIONS = {
+    flags: ["--no-pager", "-p", "--paginate", "--bare", "--literal-pathspecs", "--no-replace-objects"],
+    values: ["-C", "-c", "--git-dir", "--work-tree", "--namespace"]
+  };
+  KEYWORDS = new Set(["if", "then", "else", "elif", "do", "while", "until", "{"]);
+  CLOSERS = new Set(["fi", "done", "}"]);
+  SHELLS = new Set(["sh", "bash", "dash", "zsh", "ksh"]);
+  ASSIGNMENT3 = /^[A-Za-z_][A-Za-z0-9_]*=/;
+});
+
 // ../nax-agent/src/tools/bash-cwd.ts
 function cdTargetsFor(segment, cwd, resolvePath) {
   const words = segment.tokens.map((token) => token.text);
@@ -13366,10 +13572,23 @@ function pathIsClean(spec, ctx) {
 function stashIsExempt(args, ctx) {
   if (args[0] === "pop" || args[0] === "apply")
     return restoreIsExempt(args.slice(1), ctx);
+  if (args[0] !== "push")
+    return false;
   const separator = args.indexOf("--");
-  if (args[0] !== "push" || separator === -1)
+  const options = args.slice(1, separator === -1 ? args.length : separator);
+  if (options.some((word) => word === "--pathspec-from-file" || word.startsWith("--pathspec-from-file="))) {
     return false;
-  const specs = args.slice(separator + 1);
+  }
+  const specs = [];
+  for (let i = 0;i < options.length; i += 1) {
+    const word = options[i];
+    if (word === "-m" || word === "--message")
+      i += 1;
+    else if (!word.startsWith("-"))
+      specs.push(word);
+  }
+  if (separator !== -1)
+    specs.push(...args.slice(separator + 1));
   if (specs.some((spec) => isFullNaxExclusion(spec, ctx)))
     return true;
   return specs.length > 0 && specs.every((spec) => pathIsClean(spec, ctx));
@@ -13393,6 +13612,41 @@ var init_nax_stash_restore = __esm(() => {
   };
 });
 
+// ../nax-agent/src/tools/nax-verb-gaps.ts
+function verbGapsRefusal(verb, args, ctx) {
+  if (!PATH_VERBS.has(verb) && !AUTOSTASH_VERBS.has(verb) && verb !== "sparse-checkout")
+    return;
+  const nax = findNaxDirs(ctx);
+  if (nax.length === 0)
+    return;
+  if (AUTOSTASH_VERBS.has(verb)) {
+    const flags = splitOperands(verb, args).flags;
+    return flags.includes("--autostash") ? NAX_OWNED_RUN_STATE_EXPLANATION : undefined;
+  }
+  if (verb === "sparse-checkout") {
+    return args[0] === "list" ? undefined : NAX_OWNED_RUN_STATE_EXPLANATION;
+  }
+  const ops = splitOperands(verb, args);
+  const specs = [...ops.before, ...ops.after].filter((spec) => !isExclusionSpec(spec));
+  if (specs.some((spec) => /[*?[]/.test(spec))) {
+    return `${NAX_OWNED_RUN_STATE_EXPLANATION} Glob pathspecs may also select files under \`.nax/\`; name literal paths instead.`;
+  }
+  if (verb === "rm" || verb === "reset") {
+    if (specs.some((spec) => operandTouchesNax(spec, ctx) || coversNax(spec, ctx, nax))) {
+      return NAX_OWNED_RUN_STATE_EXPLANATION;
+    }
+  }
+  return;
+}
+var PATH_VERBS, AUTOSTASH_VERBS;
+var init_nax_verb_gaps = __esm(() => {
+  init_denial_redirect();
+  init_nax_dirs();
+  init_nax_revert();
+  PATH_VERBS = new Set(["checkout", "restore", "rm", "reset"]);
+  AUTOSTASH_VERBS = new Set(["rebase", "pull", "merge"]);
+});
+
 // ../nax-agent/src/tools/nax-state-guard.ts
 import { resolve as resolve15 } from "path";
 function withGitDirs(ctx, dirs) {
@@ -13422,7 +13676,7 @@ function stashRefusal(args, ctx) {
 function shellCommandString(words) {
   const head = commandHeadIndex(words);
   const shell = words[head]?.split("/").pop();
-  if (shell === undefined || !SHELLS.has(shell))
+  if (shell === undefined || !SHELLS2.has(shell))
     return;
   const flag = shell === "eval" ? head : words.findIndex((word, i) => i > head && /^-[A-Za-z]*c[A-Za-z]*$/.test(word));
   if (flag === -1 || flag + 1 >= words.length)
@@ -13430,6 +13684,9 @@ function shellCommandString(words) {
   return words.slice(flag + 1).join(" ").replace(/^\s*['"]|['"]\s*$/g, "");
 }
 function verbRefusal(git, segment, where) {
+  const gaps = verbGapsRefusal(git.subcommand, git.args, where);
+  if (gaps !== undefined)
+    return gaps;
   if (git.literalPathspecs && EXCLUDING_VERBS.has(git.subcommand) && git.args.some((a) => a.startsWith(":"))) {
     if (hasNaxDirNear(where))
       return LITERAL_PATHSPECS_REFUSAL;
@@ -13595,14 +13852,14 @@ function stashIsSafeWord(words) {
 function mayRunItsStrings(words) {
   const head = baseName(words[commandHeadIndex(words)]);
   const lead = baseName(leadWord(words));
-  return [head, lead].some((n) => SHELLS.has(n) || EXEC_STYLE_HEADS.has(n) || isInterpreterName(n));
+  return [head, lead].some((n) => SHELLS2.has(n) || EXEC_STYLE_HEADS.has(n) || isInterpreterName(n));
 }
 function nestedRefusal(words, ctx) {
   const git = locateGit(words);
   const readableGit = git !== undefined && !git.uncertain;
   if (!runsNestedShell(words) && !mayRunItsStrings(words))
     return;
-  const shellHead = SHELLS.has(baseName(words[commandHeadIndex(words)]));
+  const shellHead = SHELLS2.has(baseName(words[commandHeadIndex(words)]));
   if (!shellHead && (readableGit || !mentionsGuardedVerb(words.join(" "))))
     return;
   for (const word of words) {
@@ -13632,7 +13889,7 @@ function naxStateRefusalInText(command, ctx) {
   }
   return;
 }
-var STASH_SAFE_SUBCOMMANDS, INDEX_HIDING_FLAG, SHELLS, UPDATE_INDEX_REFUSAL, LITERAL_PATHSPECS_REFUSAL, STASH_REFUSAL, ALIAS_REFUSAL, DISCARD_VERBS, EXCLUDING_VERBS, HEREDOC_MARKER, baseName = (word) => (word ?? "").split("/").pop(), EXEC_STYLE_HEADS, isInterpreterName = (name) => /^(?:python[\d.]*|lua[\d.]*)$/.test(name), leadWord = (words) => words.find((w) => !/^[A-Za-z_]\w*=/.test(w)), runsNestedShell = (words) => words.some((word) => SHELLS.has(baseName(word)) || /^-[A-Za-z]*c[A-Za-z]*$/.test(word));
+var STASH_SAFE_SUBCOMMANDS, INDEX_HIDING_FLAG, SHELLS2, UPDATE_INDEX_REFUSAL, LITERAL_PATHSPECS_REFUSAL, STASH_REFUSAL, ALIAS_REFUSAL, DISCARD_VERBS, EXCLUDING_VERBS, HEREDOC_MARKER, baseName = (word) => (word ?? "").split("/").pop(), EXEC_STYLE_HEADS, isInterpreterName = (name) => /^(?:python[\d.]*|lua[\d.]*)$/.test(name), leadWord = (words) => words.find((w) => !/^[A-Za-z_]\w*=/.test(w)), runsNestedShell = (words) => words.some((word) => SHELLS2.has(baseName(word)) || /^-[A-Za-z]*c[A-Za-z]*$/.test(word));
 var init_nax_state_guard = __esm(() => {
   init_denial_redirect();
   init_locate();
@@ -13640,10 +13897,11 @@ var init_nax_state_guard = __esm(() => {
   init_nax_evasion();
   init_nax_revert();
   init_nax_stash_restore();
+  init_nax_verb_gaps();
   init_nax_dirs();
   STASH_SAFE_SUBCOMMANDS = new Set(["list", "show", "create", "store", "drop", "clear"]);
   INDEX_HIDING_FLAG = /^--(?:no-)?(?:sk|as)/;
-  SHELLS = new Set(["bash", "sh", "zsh", "dash", "ksh", "eval"]);
+  SHELLS2 = new Set(["bash", "sh", "zsh", "dash", "ksh", "eval"]);
   UPDATE_INDEX_REFUSAL = `${NAX_OWNED_RUN_STATE_EXPLANATION} ` + "Marking it with `git update-index --skip-worktree` or `--assume-unchanged` hides it from git and from nax's own commits, " + "and the flag outlives the run. To see whether something pre-existed, use `git diff HEAD -- <file>` or `git show HEAD:<file>`.";
   LITERAL_PATHSPECS_REFUSAL = "`--literal-pathspecs` / `GIT_LITERAL_PATHSPECS` turn every `:(...)` and `:!` exclusion into a literal path, " + "so nothing keeps nax's run state under `.nax/` out of this command. Drop the literal-pathspec setting.";
   STASH_REFUSAL = "`git stash` is refused while the repository holds nax's run state under `.nax/`: the stash would capture " + "nax's uncommitted state and a later pop would replay stale copies over what nax has written since. " + "To check whether something pre-existed, use `git diff HEAD -- <file>` or `git show HEAD:<file>`. " + `A \`git stash push -- . ${COVERING_EXCLUSION}\` is allowed. ` + "`push` of files or directories outside `.nax` is allowed, and so is `pop` or `apply` of a stash that holds no `.nax` path (quote the ref, e.g. `'stash@{1}'`).";
@@ -13809,6 +14067,33 @@ function lexicalDenial(lexed) {
     return;
   return deny(`command contains ${lexed.construct}, which cannot be analysed and is therefore refused -- ` + "rewrite it without that construct, or use a structured tool", false, true);
 }
+function matchingDenial(args, segments) {
+  const entry = args.denyEntry;
+  if (entry === undefined)
+    return;
+  for (const segment of segments) {
+    if (segment.tokens[0]?.text === "eval")
+      return deny("Bash canonical analysis refused: eval cannot be analysed");
+    if (matchesSegment(entry, segment)) {
+      return deny(`${args.tool} segment "${render2(segment)}" is denied for this stage by rule ${ruleExpr(args.tool, entry, segment)}`);
+    }
+  }
+  return;
+}
+function ruleSegments(segments, refuseUnreadable) {
+  const views = [];
+  for (const segment of segments) {
+    views.push(segment);
+    const canonical = canonicalSegments(segment);
+    if (canonical.kind === "refused") {
+      if (refuseUnreadable)
+        return canonical;
+    } else {
+      views.push(...canonical.segments);
+    }
+  }
+  return { kind: "ok", segments: views };
+}
 function checkBashCommand(args) {
   const { command, tool } = args;
   const invalid = invalidCommandDenial(command);
@@ -13819,11 +14104,13 @@ function checkBashCommand(args) {
     return state;
   const lexed = lexBashCommand(command);
   const segments = lexed.kind === "ok" ? lexed.segments : lexed.prefix;
-  for (const segment of segments) {
-    if (args.denyEntry !== undefined && matchesSegment(args.denyEntry, segment)) {
-      return deny(`${tool} segment "${render2(segment)}" is denied for this stage by rule ${ruleExpr(tool, args.denyEntry, segment)}`);
-    }
-  }
+  const views = ruleSegments(segments, args.denyEntry !== undefined);
+  if (views.kind === "refused")
+    return deny(views.reason);
+  const matchingSegments = views.segments;
+  const denied = matchingDenial(args, matchingSegments);
+  if (denied !== undefined)
+    return denied;
   let cwd = [args.initialPath];
   for (const segment of segments) {
     const result = checkPayload(args, segment, cwd);
@@ -13841,7 +14128,7 @@ function checkBashCommand(args) {
     const alternatives = granted === "" ? "no command forms are granted for this stage" : `granted forms: ${granted}`;
     return deny(`${tool} is not granted "${render2(segment)}" -- ${alternatives}`, false, true);
   }
-  for (const segment of segments) {
+  for (const segment of matchingSegments) {
     if (args.askEntry !== undefined && matchesSegment(args.askEntry, segment)) {
       return { kind: "ask", rule: ruleExpr(tool, args.askEntry, segment) };
     }
@@ -13850,6 +14137,7 @@ function checkBashCommand(args) {
 }
 var init_policy_bash = __esm(() => {
   init_permissions();
+  init_bash_canonical();
   init_exec_guard();
   init_nax_revert();
   init_nax_state_guard();
@@ -17415,24 +17703,39 @@ function turnRetryFitsBudget(delayMs, remainingMs) {
   return remainingMs === undefined || delayMs <= remainingMs;
 }
 function abortError(signal) {
-  return signal.reason ?? new DOMException("Aborted", "AbortError");
+  return signal?.reason ?? new DOMException("Aborted", "AbortError");
 }
 function abortableSleep(ms, sleep, signal) {
   if (signal === undefined)
-    return sleep(ms);
+    return sleep(ms, signal);
   if (signal.aborted)
     return Promise.reject(abortError(signal));
   return new Promise((resolve, reject) => {
     const onAbort = () => reject(abortError(signal));
     signal.addEventListener("abort", onAbort, { once: true });
-    sleep(ms).then(() => {
+    Promise.resolve().then(() => sleep(ms, signal)).then(() => {
       signal.removeEventListener("abort", onAbort);
       resolve();
-    }, reject);
+    }, (error) => {
+      signal.removeEventListener("abort", onAbort);
+      reject(error);
+    });
   });
 }
-function realSleep(ms) {
-  return new Promise((resolve) => setTimeout(resolve, ms));
+function realSleep(ms, signal) {
+  if (signal?.aborted)
+    return Promise.reject(abortError(signal));
+  return new Promise((resolve, reject) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(abortError(signal));
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
 }
 async function retryTransportFault(firstError, deps) {
   const { sleep } = deps;
@@ -22714,6 +23017,25 @@ class SinkRegistry {
 // src/logger/logger.ts
 import { appendFileSync, mkdirSync as mkdirSync2 } from "fs";
 import { appendFile as appendFile3 } from "fs/promises";
+function flushDeferredWarnings() {
+  for (const { stage, message } of deferredWarnings.splice(0)) {
+    _loggerDeps.writeStderr(`nax warning (${stage}): ${message}
+`);
+  }
+}
+function warnOrDefer(stage, message) {
+  if (instance !== null) {
+    instance.warn(stage, message);
+    return;
+  }
+  if (deferredWarnings.some((item) => item.stage === stage && item.message === message))
+    return;
+  deferredWarnings.push({ stage, message });
+  if (!warningExitRegistered) {
+    warningExitRegistered = true;
+    _loggerDeps.onExit(flushDeferredWarnings);
+  }
+}
 
 class Logger {
   level;
@@ -22898,6 +23220,9 @@ function initLogger(options = { level: "silent" }) {
   }
   instance = new Logger(options);
   setAgentLogger(instance);
+  for (const { stage, message } of deferredWarnings.splice(0)) {
+    instance.warn(stage, message);
+  }
   if (options.filePath && !exitFlushRegistered) {
     exitFlushRegistered = true;
     process.on("exit", () => instance?.flushSync());
@@ -22924,7 +23249,7 @@ function resetLogger() {
   instance = null;
   setAgentLogger(null);
 }
-var LOG_LEVEL_PRIORITY, MAX_BATCH_BYTES, instance = null, exitFlushRegistered = false, noopLogger2;
+var LOG_LEVEL_PRIORITY, MAX_BATCH_BYTES, instance = null, exitFlushRegistered = false, _loggerDeps, deferredWarnings, warningExitRegistered = false, noopLogger2;
 var init_logger = __esm(() => {
   init_internal();
   init_errors4();
@@ -22938,6 +23263,15 @@ var init_logger = __esm(() => {
     debug: 3
   };
   MAX_BATCH_BYTES = 64 * 1024;
+  _loggerDeps = {
+    onExit: (handler) => {
+      process.once("exit", handler);
+    },
+    writeStderr: (text) => {
+      process.stderr.write(text);
+    }
+  };
+  deferredWarnings = [];
   noopLogger2 = new Logger({ level: "silent", useChalk: false, headless: false });
 });
 
@@ -23396,9 +23730,7 @@ function migrateLegacyNonBlockingFix(raw, logger) {
 
 // src/config/compat-shims.ts
 function defaultConfigWarn(msg) {
-  try {
-    getLogger2().warn("config", msg);
-  } catch {}
+  warnOrDefer("config", msg);
 }
 function createConfigWarnDedupe(sink = defaultConfigWarn) {
   const seen = new Set;
@@ -24985,7 +25317,7 @@ function resolveWorkflowConfig(config) {
   return config?.workflow ?? WORKFLOW_DEFAULTS;
 }
 function isWorkflowMode(config) {
-  return config?.execution?.mode === "workflow";
+  return config !== undefined && (config.execution?.mode ?? "workflow") === "workflow";
 }
 var ExecutionModeSchema, WorkflowConfigObjectSchema, WORKFLOW_DEFAULTS;
 var init_schemas_workflow = __esm(() => {
@@ -48222,7 +48554,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@nathapp/nax",
-    version: "0.88.0-canary.2",
+    version: "0.88.0",
     description: "AI Coding Agent Orchestrator \u2014 loops until done",
     type: "module",
     bin: {
@@ -48278,7 +48610,7 @@ var init_package = __esm(() => {
       "test:integration": "bun test ./test/integration/ --timeout=60000",
       "test:ui": "bun test ./test/ui/ --timeout=60000",
       "test:e2e": "bun run scripts/run-tests.ts --e2e",
-      "test:confined": "bun ../nax-agent/scripts/run-confined-tests.ts --package=. --timeout=5000 ./test/unit/ && bun ../nax-agent/scripts/run-confined-tests.ts --package=. --timeout=5000 ./test/integration/",
+      "test:confined": "bun ../nax-agent/scripts/run-confined-tests.ts --package=. --timeout=5000 --parallel=4 ./test/unit/ && bun ../nax-agent/scripts/run-confined-tests.ts --package=. --timeout=5000 --parallel=4 ./test/integration/",
       "test:coverage": "bun run ../repo-tooling/scripts/check-coverage.ts --require-all-files",
       "test:coverage:report": "bun run ../repo-tooling/scripts/check-coverage.ts --require-all-files --report",
       "test:coverage:update": "bun run ../repo-tooling/scripts/check-coverage.ts --require-all-files --update-baseline",
@@ -48308,7 +48640,7 @@ var init_package = __esm(() => {
       "@agentclientprotocol/sdk": "~1.7.0",
       "@anthropic-ai/sandbox-runtime": "0.0.77",
       "@modelcontextprotocol/sdk": "^1.32.1",
-      "@nathapp/nax-ai": "0.88.0-canary.2",
+      "@nathapp/nax-ai": "0.88.0",
       chalk: "^5.6.2",
       commander: "^13.1.0",
       ink: "^6.7.0",
@@ -55578,7 +55910,8 @@ function editTargets(toolCall) {
     return [];
   const fromLocations = Array.isArray(toolCall.locations) ? toolCall.locations.flatMap((l) => isRecord5(l) && typeof l.path === "string" && l.path !== "" ? [l.path] : []) : [];
   const raw = isRecord5(toolCall.rawInput) ? toolCall.rawInput : {};
-  const fromRaw = RAW_PATH_KEYS.flatMap((k) => typeof raw[k] === "string" && raw[k] !== "" ? [raw[k]] : []);
+  const keys = typeof toolCall.kind === "string" && WRITE_KINDS.has(toolCall.kind) ? WRITE_PATH_KEYS : RAW_PATH_KEYS;
+  const fromRaw = keys.flatMap((k) => typeof raw[k] === "string" && raw[k] !== "" ? [raw[k]] : []);
   return [...new Set([...fromLocations, ...fromRaw])];
 }
 function expand(path, cwd) {
@@ -55649,10 +55982,12 @@ async function firstOutsidePolicy(targets, policy, cwd) {
   }
   return;
 }
-var OUTSIDE_WRITE_ROOTS_REASON = "the edit target is outside the sandbox write roots", RAW_PATH_KEYS, _editTargetsDeps, SEPARATORS, hasDotDotSegment = (path) => path.split(SEPARATORS).includes(".."), MAX_SYMLINK_HOPS = 40, canonicalPolicyPath = async (path) => await canonical3(path) ?? path, nfc = (path) => path.normalize("NFC"), foldCase = (path) => _editTargetsDeps.platform() === "darwin" || _editTargetsDeps.platform() === "win32" ? path.toLowerCase() : path, contains = (path, root) => path === root || path.startsWith(root.endsWith(sep18) ? root : `${root}${sep18}`), withinRoot = (path, root) => contains(nfc(path), nfc(root)), withinDenied = (path, denied) => contains(foldCase(nfc(path)), foldCase(nfc(denied)));
+var OUTSIDE_WRITE_ROOTS_REASON = "the edit target is outside the sandbox write roots", RAW_PATH_KEYS, WRITE_PATH_KEYS, WRITE_KINDS, _editTargetsDeps, SEPARATORS, hasDotDotSegment = (path) => path.split(SEPARATORS).includes(".."), MAX_SYMLINK_HOPS = 40, canonicalPolicyPath = async (path) => await canonical3(path) ?? path, nfc = (path) => path.normalize("NFC"), foldCase = (path) => _editTargetsDeps.platform() === "darwin" || _editTargetsDeps.platform() === "win32" ? path.toLowerCase() : path, contains = (path, root) => path === root || path.startsWith(root.endsWith(sep18) ? root : `${root}${sep18}`), withinRoot = (path, root) => contains(nfc(path), nfc(root)), withinDenied = (path, denied) => contains(foldCase(nfc(path)), foldCase(nfc(denied)));
 var init_edit_targets = __esm(() => {
   init_text();
   RAW_PATH_KEYS = ["file_path", "notebook_path"];
+  WRITE_PATH_KEYS = [...RAW_PATH_KEYS, "path", "filePath", "old_path", "new_path"];
+  WRITE_KINDS = new Set(["edit", "delete", "move"]);
   _editTargetsDeps = { platform: () => process.platform };
   SEPARATORS = sep18 === "/" ? /\// : /[/\\]/;
 });
@@ -55735,8 +56070,10 @@ async function decidePermission(request, ctx) {
 async function decideFull(request, display, offered, auto, ctx) {
   if (offered.allowOnce === undefined)
     return denyNoAllowOnce(offered, auto);
-  const outside = ctx.sandbox !== undefined && display.tool !== "execute" && !READ_ONLY_KINDS.has(display.tool) ? await firstOutsidePolicy(editTargets(request.toolCall), ctx.sandbox, ctx.cwd) : undefined;
-  if (outside !== undefined) {
+  const targets = editTargets(request.toolCall);
+  const unknownWrite = ctx.sandbox !== undefined && WRITE_KINDS.has(display.tool) && targets.length === 0;
+  const outside = ctx.sandbox !== undefined && display.tool !== "execute" && !READ_ONLY_KINDS.has(display.tool) ? await firstOutsidePolicy(targets, ctx.sandbox, ctx.cwd) : undefined;
+  if (unknownWrite || outside !== undefined) {
     auto(OUTSIDE_WRITE_ROOTS_REASON, "deny");
     return rejectWith(offered);
   }
@@ -55976,8 +56313,12 @@ function startedLaunch(child, stderr, maxMessageBytes) {
     gone = true;
   });
   const kill = () => {
-    if (!gone && pid !== undefined)
-      killProcessGroup(pid, "SIGKILL");
+    if (pid === undefined)
+      return;
+    if (gone)
+      _launchDeps.killProcessGroup(pid, "SIGKILL", { singleProcessFallback: false });
+    else
+      _launchDeps.killProcessGroup(pid, "SIGKILL");
   };
   return {
     target: { kind: "stream", stream },
@@ -55993,14 +56334,23 @@ function startedLaunch(child, stderr, maxMessageBytes) {
       return exit.value;
     },
     async terminate(graceMs) {
-      if (!gone && pid !== undefined) {
+      if (pid === undefined) {
+        await exited;
+        return;
+      }
+      if (!gone)
         child.stdin.end();
-        killProcessGroup(pid, "SIGTERM");
-        const timer = setTimeout(kill, graceMs);
+      if (gone)
+        _launchDeps.killProcessGroup(pid, "SIGTERM", { singleProcessFallback: false });
+      else
+        _launchDeps.killProcessGroup(pid, "SIGTERM");
+      const timer = setTimeout(kill, graceMs);
+      try {
         await exited;
+        kill();
+      } finally {
         clearTimeout(timer);
       }
-      await exited;
     }
   };
 }
@@ -56020,11 +56370,12 @@ async function agentGoneError(during, launched, secrets) {
   const exitDetails = exit === undefined ? {} : { exitCode: exit.code, signal: exit.signal, ...exit.spawnError === undefined ? {} : { spawnError: true } };
   return backendUnavailable(stderr === "" ? what : `${what}; stderr: ${stderr}`, { during, ...exitDetails, stderr });
 }
-var GONE_WAIT_MS = 1000, STDERR_DRAIN_MS = 200;
+var GONE_WAIT_MS = 1000, _launchDeps, STDERR_DRAIN_MS = 200;
 var init_launch = __esm(() => {
   init_acp();
   init_src();
   init_errors6();
+  _launchDeps = { killProcessGroup };
 });
 
 // ../nax-agent-acp/src/client/capabilities.ts
@@ -72379,8 +72730,8 @@ var init_version = __esm(() => {
   NAX_AI_VERSION = CATALOG_VERSION;
   NAX_COMMIT = (() => {
     try {
-      if (/^[0-9a-f]{6,10}$/.test("9c41694"))
-        return "9c41694";
+      if (/^[0-9a-f]{6,10}$/.test("33be270"))
+        return "33be270";
     } catch {}
     try {
       const result = Bun.spawnSync(["git", "rev-parse", "--short", "HEAD"], {
@@ -77156,6 +77507,18 @@ async function connectMcp(config, opts) {
   try {
     if (signal.aborted)
       throw new McpConnectError("MCP connect failed: aborted");
+    if (config.kind === "stdio" && opts.onSpawn !== undefined) {
+      const start = handle.transport.start;
+      let notified = false;
+      handle.transport.start = async function() {
+        await start.call(this);
+        const pid = handle.pid();
+        if (pid !== null && !notified) {
+          notified = true;
+          opts.onSpawn?.(pid);
+        }
+      };
+    }
     await client.connect(handle.transport, { signal, timeout: opts.timeoutMs });
     const tools = await listAll(client, signal, opts.timeoutMs);
     return liveConnection(config, client, handle, tools, {
@@ -77251,7 +77614,8 @@ async function connectMcpServer(args) {
     cwd: args.workdir
   };
   const opts = {
-    signal: new AbortController().signal,
+    signal: args.signal ?? new AbortController().signal,
+    onSpawn: args.onSpawn,
     timeoutMs: args.connectTimeoutMs,
     clientInfo: { name: "nax", version: "1" }
   };
@@ -77349,6 +77713,8 @@ var init_lock = __esm(() => {
 // src/mcp/pool.ts
 function createMcpPool(opts) {
   const retry = opts.retry ?? MCP_DEFAULT_RETRY;
+  const controller = new AbortController;
+  const { signal } = controller;
   const keyOf = (serverId, workdir) => JSON.stringify([serverId, workdir]);
   const entries = new Map;
   const events = [];
@@ -77361,8 +77727,10 @@ function createMcpPool(opts) {
     if (server === undefined || !server.enabled)
       return;
     await assertTrusted(workdir, "mcp");
-    for (let attempt = 1;attempt <= retry.maxAttempts; attempt++) {
+    for (let attempt = 1;attempt <= retry.maxAttempts && !signal.aborted; attempt++) {
       let connection;
+      let spawnedPid;
+      let registration;
       try {
         connection = await connectMcpServer({
           serverId,
@@ -77370,11 +77738,16 @@ function createMcpPool(opts) {
           command: server.command,
           args: server.args,
           env: server.env,
-          connectTimeoutMs: MCP_CONNECT_TIMEOUT_MS
+          connectTimeoutMs: MCP_CONNECT_TIMEOUT_MS,
+          signal,
+          onSpawn(pid) {
+            spawnedPid = pid;
+            registration = opts.pidRegistry?.register(pid).catch(() => {});
+          }
         });
+        signal.throwIfAborted();
+        await registration;
         const pid = connection.pid;
-        if (pid !== null)
-          await opts.pidRegistry?.register(pid).catch(() => {});
         const tools = await connection.listTools();
         record({ kind: "connected", serverId, workdir, at: new Date().toISOString(), pid, toolCount: tools.length });
         getSafeLogger2()?.info("mcp", `[pool] ${serverId} connected`, {
@@ -77386,12 +77759,11 @@ function createMcpPool(opts) {
         });
         return { connection, tools };
       } catch (error) {
-        if (connection !== undefined) {
-          const pid = connection.pid;
+        if (connection !== undefined)
           await connection.close().catch(() => {});
-          if (pid !== null)
-            await opts.pidRegistry?.unregister(pid).catch(() => {});
-        }
+        await registration;
+        if (spawnedPid !== undefined)
+          await opts.pidRegistry?.unregister(spawnedPid).catch(() => {});
         const reason = error instanceof Error ? error.message : String(error);
         record({ kind: "connect-failed", serverId, workdir, at: new Date().toISOString(), reason, attempt });
         getSafeLogger2()?.warn("mcp", `[pool] ${serverId} connect failed`, {
@@ -77401,8 +77773,8 @@ function createMcpPool(opts) {
           attempt,
           error: reason
         });
-        if (attempt < retry.maxAttempts && retry.baseDelayMs > 0) {
-          await Bun.sleep(retry.baseDelayMs * attempt);
+        if (attempt < retry.maxAttempts && retry.baseDelayMs > 0 && !signal.aborted) {
+          await cancellableDelay(retry.baseDelayMs * attempt, signal).catch(() => {});
         }
       }
     }
@@ -77459,6 +77831,7 @@ function createMcpPool(opts) {
       if (closed)
         return;
       closed = true;
+      controller.abort();
       const pending = [...entries.values()];
       entries.clear();
       const settled = await Promise.allSettled(pending);
@@ -78445,7 +78818,15 @@ var init_deps = __esm(() => {
   init_errors4();
   init_tree_snapshot();
   init_hardened_git();
-  _snapshotDeps = { rm: rm8, lstat: lstat4, snapshotWorkingTree, changedPathsBetween, git: runHardenedGit };
+  _snapshotDeps = {
+    rm: rm8,
+    lstat: lstat4,
+    snapshotWorkingTree,
+    changedPathsBetween,
+    git: runHardenedGit,
+    sleep: (ms) => Bun.sleep(ms),
+    now: Date.now
+  };
 });
 
 // src/review/reviewer-guard/snapshot-ignore-rules.ts
@@ -78586,9 +78967,9 @@ var init_snapshot_refs = __esm(() => {
 });
 
 // src/review/reviewer-guard/snapshot.ts
-import { join as join70 } from "path";
+import { join as join70, resolve as resolve39 } from "path";
 function isKeeperOwnedPath(toplevel, rel) {
-  return classifyRunStatePath(join70(toplevel, rel)) !== null;
+  return activeKeepers().some((keeper) => keeper.get(join70(toplevel, rel)) !== undefined);
 }
 async function takeRepoSnapshot(workdir) {
   const toplevel = await git2(["rev-parse", "--show-toplevel"], workdir);
@@ -78636,6 +79017,38 @@ async function snapshotEntries(snap) {
   }
   return entries;
 }
+async function waitForIndexLock(snap, failures) {
+  const lock = resolve39(snap.toplevel, await git2(["rev-parse", "--git-path", "index.lock"], snap.toplevel));
+  const deadline = _snapshotDeps.now() + INDEX_LOCK_WAIT_MS;
+  while (true) {
+    try {
+      await _snapshotDeps.lstat(lock);
+    } catch (err) {
+      if (isAbsent(err))
+        return;
+      throw err;
+    }
+    const remaining = deadline - _snapshotDeps.now();
+    if (remaining <= 0) {
+      failures.push("index.lock held");
+      return;
+    }
+    await _snapshotDeps.sleep(Math.min(INDEX_LOCK_POLL_MS, remaining));
+  }
+}
+async function checkoutPaths(snap, paths, failures) {
+  let restored = false;
+  for (let i = 0;i < paths.length; i += CHECKOUT_CHUNK) {
+    const chunk = paths.slice(i, i + CHECKOUT_CHUNK);
+    try {
+      await git2(["checkout", snap.tree, "--", ...chunk.map((p) => `:(top,literal)${p}`)], snap.toplevel);
+      restored = true;
+    } catch (err) {
+      failures.push(`checkout ${chunk.length} path(s): ${errorMessage(err)}`);
+    }
+  }
+  return restored;
+}
 async function restoreTree(snap, failures) {
   const entries = await snapshotEntries(snap);
   const ruleChanges = await restoreIgnoreRules({
@@ -78646,8 +79059,15 @@ async function restoreTree(snap, failures) {
     skip: (p) => isKeeperOwnedPath(snap.toplevel, p),
     remove: removePath
   }, failures);
-  const current = await _snapshotDeps.snapshotWorkingTree(snap.toplevel);
-  const diffed = (await _snapshotDeps.changedPathsBetween(snap.toplevel, snap.tree, current)).filter((p) => !isKeeperOwnedPath(snap.toplevel, p));
+  let diffed;
+  try {
+    const current = await _snapshotDeps.snapshotWorkingTree(snap.toplevel);
+    diffed = (await _snapshotDeps.changedPathsBetween(snap.toplevel, snap.tree, current)).filter((p) => !isKeeperOwnedPath(snap.toplevel, p));
+  } catch (err) {
+    failures.push(`tree: ${errorMessage(err)}`);
+    const paths = [...entries].filter(([p, entry]) => entry.type !== "commit" && !isKeeperOwnedPath(snap.toplevel, p)).map(([p]) => p);
+    return { paths, restored: await checkoutPaths(snap, paths, failures), fallback: "tracked-only" };
+  }
   const changed = [...new Set([...ruleChanges, ...diffed])];
   if (changed.length === 0)
     return { paths: [], restored: false };
@@ -78656,10 +79076,7 @@ async function restoreTree(snap, failures) {
   for (const p of remove) {
     await removePath(join70(snap.toplevel, p)).catch((err) => failures.push(`remove ${p}: ${errorMessage(err)}`));
   }
-  for (let i = 0;i < restore.length; i += CHECKOUT_CHUNK) {
-    const chunk = restore.slice(i, i + CHECKOUT_CHUNK);
-    await git2(["checkout", snap.tree, "--", ...chunk.map((p) => `:(top,literal)${p}`)], snap.toplevel).catch((err) => failures.push(`checkout ${chunk.length} path(s): ${errorMessage(err)}`));
-  }
+  await checkoutPaths(snap, restore, failures);
   return { paths: changed, restored: restore.length > 0 || ruleChanges.length > 0 };
 }
 async function restoreIndex(snap, force) {
@@ -78687,10 +79104,12 @@ async function restoreRepoSnapshot(snap) {
   const replaceRemoved = await phase("replace-refs", false, () => removeAddedReplaceRefs(snap, snap.toplevel));
   const refsLeft = await phase("refs-report", [], () => diffRefsLeft(snap, snap.toplevel));
   const stashLeft = await phase("stash-report", [], () => diffStashesLeft(snap.stashes, snap.toplevel));
+  await phase("index-lock", undefined, () => waitForIndexLock(snap, failures));
   const tree = await phase("tree", { paths: [], restored: false }, () => restoreTree(snap, failures));
   const indexRestored = await phase("index", false, () => restoreIndex(snap, tree.restored));
   return {
     paths: tree.paths,
+    ...tree.fallback === undefined ? {} : { fallback: tree.fallback },
     indexRestored,
     headRestored: headMoved || replaceRemoved,
     refsLeft,
@@ -78698,7 +79117,7 @@ async function restoreRepoSnapshot(snap) {
     failures
   };
 }
-var CHECKOUT_CHUNK = 500;
+var CHECKOUT_CHUNK = 500, INDEX_LOCK_WAIT_MS = 5000, INDEX_LOCK_POLL_MS = 100;
 var init_snapshot = __esm(() => {
   init_internal();
   init_store();
@@ -80752,7 +81171,7 @@ var init_session_run_hop = __esm(() => {
 });
 
 // src/runtime/index.ts
-import { basename as basename12, isAbsolute as isAbsolute26, join as join74, resolve as resolve39 } from "path";
+import { basename as basename12, isAbsolute as isAbsolute26, join as join74, resolve as resolve40 } from "path";
 function createRuntime(config, workdir, opts) {
   const runId = crypto.randomUUID();
   const controller = new AbortController;
@@ -80783,7 +81202,7 @@ function createRuntime(config, workdir, opts) {
   const reviewAuditor = opts?.reviewAuditor ?? (config.review?.audit?.enabled ? new ReviewAuditor(runId, outputDir) : createNoOpReviewAuditor());
   const usageEnabled = config.agent?.usageAudit?.enabled ?? false;
   const configuredUsageDir = config.agent?.usageAudit?.dir;
-  const usageDir = configuredUsageDir === undefined ? join74(outputDir, "usage") : isAbsolute26(configuredUsageDir) ? configuredUsageDir : resolve39(workdir, configuredUsageDir);
+  const usageDir = configuredUsageDir === undefined ? join74(outputDir, "usage") : isAbsolute26(configuredUsageDir) ? configuredUsageDir : resolve40(workdir, configuredUsageDir);
   let usageAuditor;
   if (opts?.usageAuditor) {
     usageAuditor = opts.usageAuditor;
@@ -80986,12 +81405,12 @@ var init_runtime3 = __esm(() => {
 
 // src/context/engine/stage-assembler.ts
 import { readdir as readdir4 } from "fs/promises";
-import { isAbsolute as isAbsolute27, join as join75, resolve as resolve40 } from "path";
+import { isAbsolute as isAbsolute27, join as join75, resolve as resolve41 } from "path";
 function dedupeScratchDirs(dirs) {
   return [...new Set(dirs.filter((dir) => Boolean(dir)))];
 }
 function toAbsolutePath2(projectDir, pathValue) {
-  return isAbsolute27(pathValue) ? pathValue : resolve40(projectDir, pathValue);
+  return isAbsolute27(pathValue) ? pathValue : resolve41(projectDir, pathValue);
 }
 async function discoverSessionScratchDirsOnDisk(projectDir, featureName, storyId, ttlMs) {
   const logger = getLogger2();
@@ -90526,19 +90945,24 @@ var init_workflow_branch_fix = __esm(() => {
 });
 
 // src/operations/workflow-review-coverage.ts
-function normalize6(entry) {
-  return entry.startsWith("./") ? entry.slice(2) : entry;
+import { isAbsolute as isAbsolute30, relative as relative29 } from "path";
+function normalize6(entry, repoRoot) {
+  const path = isAbsolute30(entry) ? relative29(repoRoot, entry) : entry;
+  if (path === ".." || path.startsWith("../") || isAbsolute30(path))
+    return;
+  return path.startsWith("./") ? path.slice(2) : path;
 }
 function covers2(entry, path) {
-  return entry === path || entry.endsWith(`/${path}`);
+  return entry !== undefined && entry === path;
 }
-function unreadFiles(required, inspected) {
-  const entries = inspected.map(normalize6);
+function unreadFiles(required, inspected, repoRoot) {
+  const entries = inspected.map((entry) => normalize6(entry, repoRoot));
   return required.filter((path) => !entries.some((entry) => covers2(entry, path)));
 }
-function isCompleteBranchVerdict(verdict, requiredFiles) {
-  return unreadFiles(requiredFiles, verdict.inspectedFiles).length === 0;
+function isCompleteBranchVerdict(verdict, requiredFiles, repoRoot) {
+  return unreadFiles(requiredFiles, verdict.inspectedFiles, repoRoot).length === 0;
 }
+var init_workflow_review_coverage = () => {};
 
 // src/operations/workflow-story-review.ts
 var REVIEWER_VERIFY_TOOLS, WORKFLOW_REVIEW_TOOLS, workflowStoryReviewOp;
@@ -90584,6 +91008,7 @@ var init_workflow_branch_review = __esm(() => {
   init_config();
   init_prompts();
   init_workflow_replies();
+  init_workflow_review_coverage();
   init_workflow_story_review();
   workflowBranchReviewOp = {
     kind: "run",
@@ -90605,12 +91030,12 @@ var init_workflow_branch_review = __esm(() => {
     retry: (input) => {
       const invalid = (lastOutput) => {
         const verdict = parseBranchReviewReply(lastOutput, input.minorIds);
-        const missing = verdict ? unreadFiles(input.requiredFiles, verdict.inspectedFiles) : [];
+        const missing = verdict ? unreadFiles(input.requiredFiles, verdict.inspectedFiles, input.repoRoot) : [];
         return missing.length > 0 ? buildWorkflowBranchCoverageRetry(input.range, missing) : buildWorkflowReviewJsonRetry();
       };
       return makeParseRetryStrategy({
         parse: (output) => parseBranchReviewReply(output, input.minorIds),
-        validate: (parsed) => parsed !== null && isCompleteBranchVerdict(parsed, input.requiredFiles),
+        validate: (parsed) => parsed !== null && isCompleteBranchVerdict(parsed, input.requiredFiles, input.repoRoot),
         reviewerKind: "workflow-branch-review",
         maxAttempts: 2,
         prompts: { invalid, truncated: buildWorkflowReviewJsonRetryCondensed },
@@ -90776,6 +91201,7 @@ var init_operations = __esm(() => {
   init_workflow_implement();
   init_workflow_re_review();
   init_workflow_replies();
+  init_workflow_review_coverage();
   init_workflow_story_review();
   init_write_test();
 });
@@ -91913,7 +92339,7 @@ var init_failed_criteria = __esm(() => {
 });
 
 // src/acceptance/import-resolution.ts
-import { resolve as resolve41, sep as sep20 } from "path";
+import { resolve as resolve42, sep as sep20 } from "path";
 function languageFromExtension(testFilePath) {
   if (!testFilePath)
     return;
@@ -91935,8 +92361,8 @@ async function resolveLanguage(opts) {
   return "typescript";
 }
 async function readCapped2(relPath, packageDir) {
-  const resolvedPackageDir = resolve41(packageDir);
-  const fullPath = resolve41(resolvedPackageDir, relPath);
+  const resolvedPackageDir = resolve42(packageDir);
+  const fullPath = resolve42(resolvedPackageDir, relPath);
   if (fullPath !== resolvedPackageDir && !fullPath.startsWith(resolvedPackageDir + sep20)) {
     return null;
   }
@@ -92361,9 +92787,9 @@ var init_hardening = __esm(() => {
 });
 
 // src/acceptance/override-keys.ts
-import { relative as relative29 } from "path";
+import { relative as relative30 } from "path";
 function scopedOverrideKey(workdir, packageDir, acId) {
-  return `${relative29(workdir, packageDir) || "."}${OVERRIDE_SCOPE_SEPARATOR}${acId}`;
+  return `${relative30(workdir, packageDir) || "."}${OVERRIDE_SCOPE_SEPARATOR}${acId}`;
 }
 function definingPackageCount(acId, counts) {
   const n = Number(NUMBERED_AC.exec(acId)?.[1] ?? 0);
@@ -92412,7 +92838,7 @@ var init_acceptance2 = __esm(() => {
 
 // src/cli/features-acceptance.ts
 import { existsSync as existsSync14 } from "fs";
-import { join as join89, relative as relative30 } from "path";
+import { join as join89, relative as relative31 } from "path";
 async function resolveFeatureAcceptance(featureName, workdir) {
   let enabled = true;
   try {
@@ -92433,11 +92859,11 @@ async function resolveFeatureAcceptance(featureName, workdir) {
     const prd = await loadPRD(prdPath);
     const testGroups = await groupStoriesByPackage(prd, repoRoot, featureName, config.acceptance?.testPath, config.project?.language);
     const groups = await Promise.all(testGroups.map(async (g) => {
-      const packageDir = relative30(repoRoot, g.packageDir);
+      const packageDir = relative31(repoRoot, g.packageDir);
       const command = await resolveGroupCommand(repoRoot, packageDir, config.acceptance?.command);
       return {
         packageDir,
-        testPath: relative30(repoRoot, g.testPath),
+        testPath: relative31(repoRoot, g.testPath),
         exists: await Bun.file(g.testPath).exists(),
         command,
         cwd: packageDir,
@@ -92469,7 +92895,7 @@ var init_features_acceptance = __esm(() => {
 
 // src/cli/features-resolve.ts
 import { existsSync as existsSync15, readdirSync as readdirSync3 } from "fs";
-import { join as join90, relative as relative31 } from "path";
+import { join as join90, relative as relative32 } from "path";
 async function resolveTestPatterns(workdir) {
   try {
     const config = await loadConfig(workdir);
@@ -92492,17 +92918,17 @@ async function searchSpecSource(naxDir, repoRoot, name) {
   ];
   const docsSpecExact = join90(repoRoot, "docs", "specs", `SPEC-${name}.md`);
   candidates.push({ abs: docsSpecExact, kind: "markdown" });
-  const checked = candidates.map((c) => relative31(repoRoot, c.abs));
+  const checked = candidates.map((c) => relative32(repoRoot, c.abs));
   for (const { abs, kind } of candidates.slice(0, 2)) {
     if (kind === "markdown") {
       const nonEmpty = await isNonEmptyFile(abs);
       if (nonEmpty) {
-        return { source: { kind, path: relative31(repoRoot, abs) }, checked };
+        return { source: { kind, path: relative32(repoRoot, abs) }, checked };
       }
     }
   }
   if (await isNonEmptyFile(docsSpecExact)) {
-    return { source: { kind: "markdown", path: relative31(repoRoot, docsSpecExact) }, checked };
+    return { source: { kind: "markdown", path: relative32(repoRoot, docsSpecExact) }, checked };
   }
   const docsSpecsDir = join90(repoRoot, "docs", "specs");
   if (existsSync15(docsSpecsDir)) {
@@ -92510,7 +92936,7 @@ async function searchSpecSource(naxDir, repoRoot, name) {
     for (const match of glob.scanSync({ cwd: docsSpecsDir, absolute: false })) {
       const abs = join90(docsSpecsDir, match);
       if (await isNonEmptyFile(abs)) {
-        const relPath = relative31(repoRoot, abs);
+        const relPath = relative32(repoRoot, abs);
         if (!checked.includes(relPath))
           checked.push(relPath);
         return { source: { kind: "markdown", path: relPath }, checked };
@@ -92518,7 +92944,7 @@ async function searchSpecSource(naxDir, repoRoot, name) {
     }
   }
   const prdAbs = join90(naxDir, "features", name, "prd.json");
-  const prdRel = relative31(repoRoot, prdAbs);
+  const prdRel = relative32(repoRoot, prdAbs);
   if (!checked.includes(prdRel))
     checked.push(prdRel);
   if (existsSync15(prdAbs)) {
@@ -92570,8 +92996,8 @@ async function resolveFeatureSpec(name, workdir) {
     return {
       status: "ok",
       featureName: null,
-      specSource: { kind: "markdown", path: relative31(repoRoot, abs) },
-      message: `resolved spec: ${relative31(repoRoot, abs)}`
+      specSource: { kind: "markdown", path: relative32(repoRoot, abs) },
+      message: `resolved spec: ${relative32(repoRoot, abs)}`
     };
   }
   if (name !== undefined && name.trim() !== "") {
@@ -97561,7 +97987,7 @@ var init_windsurf = __esm(() => {
 
 // src/context/generator/index.ts
 import { existsSync as existsSync21 } from "fs";
-import { join as join98, relative as relative32 } from "path";
+import { join as join98, relative as relative33 } from "path";
 async function loadContextContent(options, config) {
   if (!_generatorDeps.existsSync(options.contextPath)) {
     throw new NaxError(`Context file not found: ${options.contextPath}`, "CONTEXT_FILE_NOT_FOUND", {
@@ -97692,7 +98118,7 @@ async function discoverWorkspacePackages2(repoRoot) {
 }
 async function generateForPackage(packageDir, config, dryRun = false, repoRoot) {
   const resolvedRepoRoot = repoRoot ?? packageDir;
-  const relativePkgPath = relative32(resolvedRepoRoot, packageDir);
+  const relativePkgPath = relative33(resolvedRepoRoot, packageDir);
   const contextPath = join98(resolvedRepoRoot, ".nax", "mono", relativePkgPath, "context.md");
   if (!_generatorDeps.existsSync(contextPath)) {
     return [
@@ -97975,10 +98401,10 @@ var init_generate = __esm(() => {
 });
 
 // src/utils/ignored-nax-paths.ts
-import { relative as relative33 } from "path";
+import { relative as relative34 } from "path";
 function naxTrackedPaths(projectDir) {
   const dir = featureDir(projectDir, PROBE_FEATURE);
-  return [ledgerPath(projectDir, PROBE_FEATURE), ...COMMITTED_FEATURE_FILES.map((name) => `${dir}/${name}`)].map((absolute) => relative33(projectDir, absolute));
+  return [ledgerPath(projectDir, PROBE_FEATURE), ...COMMITTED_FEATURE_FILES.map((name) => `${dir}/${name}`)].map((absolute) => relative34(projectDir, absolute));
 }
 function parseCheckIgnore(stdout) {
   const out = [];
@@ -98033,7 +98459,7 @@ var init_ignored_nax_paths = __esm(() => {
 
 // src/cli/init-context.ts
 import { mkdir as mkdir30, readdir as readdir9 } from "fs/promises";
-import { basename as basename17, join as join100, relative as relative34, sep as sep21 } from "path";
+import { basename as basename17, join as join100, relative as relative35, sep as sep21 } from "path";
 async function bunFileExists(path) {
   return Bun.file(path).exists();
 }
@@ -98060,7 +98486,7 @@ async function walkDir(root, current, out, maxFiles) {
         continue;
       await walkDir(root, join100(current, entry.name), out, maxFiles);
     } else if (entry.isFile()) {
-      out.push(relative34(root, join100(current, entry.name)).replaceAll(sep21, "/"));
+      out.push(relative35(root, join100(current, entry.name)).replaceAll(sep21, "/"));
     }
   }
 }
@@ -99421,11 +99847,11 @@ var init_rollback = __esm(() => {
 });
 
 // src/utils/paths.ts
-import { join as join106, relative as relative35, sep as sep22 } from "path";
+import { join as join106, relative as relative36, sep as sep22 } from "path";
 function packageDirRelative(projectDir, workdir) {
   if (!projectDir || !workdir || workdir === projectDir)
     return;
-  const rel = relative35(projectDir, workdir);
+  const rel = relative36(projectDir, workdir);
   if (rel === ".." || rel.startsWith(`..${sep22}`))
     return;
   return rel && rel !== "." ? rel : undefined;
@@ -100593,7 +101019,7 @@ function countOscillationOutcomes(iterations) {
 }
 
 // src/execution/story-orchestrator/give-up-advice.ts
-import { join as join107, relative as relative36 } from "path";
+import { join as join107, relative as relative37 } from "path";
 function worstSeverity(findings) {
   return [...findings].sort((a, b) => compareSeverity(b.severity, a.severity))[0]?.severity;
 }
@@ -100666,7 +101092,7 @@ function buildGiveUpHook(args) {
     outputDir: ctx.runtime.outputDir,
     feature,
     runId: ctx.runtime.runId,
-    specPath: relative36(repoRoot, join107(featureDir(repoRoot, feature), "spec.md")),
+    specPath: relative37(repoRoot, join107(featureDir(repoRoot, feature), "spec.md")),
     workdir: ctx.packageDir,
     queueHeadsUp: (s, text) => ctx.runtime.advisorHeadsUps.push(s, text)
   });
@@ -102770,7 +103196,7 @@ var init_fix_review_strategy = __esm(() => {
 });
 
 // src/execution/build-plan-for-strategy.ts
-import { join as join108, normalize as normalize7, resolve as resolve42, sep as sep23 } from "path";
+import { join as join108, normalize as normalize7, resolve as resolve43, sep as sep23 } from "path";
 function requiresInitialRefCapture(strategy) {
   return isThreeSessionStrategy(strategy);
 }
@@ -102785,7 +103211,7 @@ function resolveStoryPathAnchors(ctxPackageDir, storyWorkdir) {
   if (segments.length === 0) {
     return { repoRoot: base, packageDir: base };
   }
-  const candidateRoot = resolve42(base, ...Array(segments.length).fill(".."));
+  const candidateRoot = resolve43(base, ...Array(segments.length).fill(".."));
   if (join108(candidateRoot, normalizedRel) === base) {
     return { repoRoot: candidateRoot, packageDir: base };
   }
@@ -105006,7 +105432,7 @@ var init_worktree_id = __esm(() => {
 // src/worktree/manager.ts
 import { existsSync as existsSync25, symlinkSync } from "fs";
 import { mkdir as mkdir34, stat as stat10 } from "fs/promises";
-import { join as join114, resolve as resolve43 } from "path";
+import { join as join114, resolve as resolve44 } from "path";
 async function resolveGitInfoDir(projectRoot) {
   const dotGit = join114(projectRoot, ".git");
   const isPointerFile = await stat10(dotGit).then((s) => s.isFile(), () => false);
@@ -105021,7 +105447,7 @@ async function resolveGitInfoDir(projectRoot) {
       stderr
     });
   }
-  return join114(resolve43(projectRoot, commonDir), "info");
+  return join114(resolve44(projectRoot, commonDir), "info");
 }
 function dropRetiredLines(content, retired) {
   const lines = content.split(`
@@ -107977,6 +108403,204 @@ var init_approval = __esm(() => {
   init_advisor3();
 });
 
+// src/workflow/run-log.ts
+function logWorkflow(storyId, message, data = {}) {
+  getSafeLogger2()?.info("workflow", message, { storyId, ...data });
+}
+function mirrorLedger(storyId, text) {
+  const capped = text.length > MAX_MIRROR_CHARS ? `${text.slice(0, MAX_MIRROR_CHARS - 3)}...` : text;
+  logWorkflow(storyId, storyId === FEATURE_SCOPE ? capped : `${storyId}: ${capped}`, { ledger: true });
+}
+function shortIssue(issue) {
+  const flat = issue.replace(/\s+/g, " ").trim();
+  return flat.length > MAX_ISSUE_CHARS ? `${flat.slice(0, MAX_ISSUE_CHARS - 3)}...` : flat;
+}
+function describeFindings(findings) {
+  if (findings.length === 0)
+    return "no findings";
+  const counts = SEVERITY_ORDER2.map((sev) => [sev, findings.filter((f) => f.severity === sev).length]).filter(([, n]) => n > 0).map(([sev, n]) => `${n} ${sev}`);
+  const items = findings.map((f) => f.id ? `${f.id} ${shortIssue(f.issue)}` : shortIssue(f.issue));
+  return `${counts.join(", ")} (${items.join(", ")})`;
+}
+function startStep(storyId, label, options = {}) {
+  const now = options.now ?? Date.now;
+  const prefix = storyId === FEATURE_SCOPE ? "" : `${storyId} `;
+  const startedAt = now();
+  if (options.announce !== false) {
+    const model = options.model ? { agentName: options.model.agentName, model: options.model.model } : {};
+    logWorkflow(storyId, `${prefix}${label} start`, { step: label, ...model });
+  }
+  return {
+    done(text, data = {}) {
+      const durationMs = now() - startedAt;
+      const joiner = options.bare ? " " : ": ";
+      logWorkflow(storyId, `${prefix}${label}${joiner}${text}  ${formatDuration(durationMs)}`, {
+        step: label,
+        durationMs,
+        ...data
+      });
+      return durationMs;
+    }
+  };
+}
+var MAX_ISSUE_CHARS = 60, MAX_MIRROR_CHARS = 200, SEVERITY_ORDER2;
+var init_run_log = __esm(() => {
+  init_log_format();
+  init_logger2();
+  init_advisor_live();
+  SEVERITY_ORDER2 = ["critical", "important", "minor"];
+});
+
+// src/workflow/ledger.ts
+import { appendFile as appendFile9, mkdir as mkdir35 } from "fs/promises";
+import { join as join118 } from "path";
+function ledgerFilePath(runDir) {
+  return join118(runDir, "ledger.md");
+}
+function oneLine2(text) {
+  return text.replace(/\s+/g, " ").trim();
+}
+async function ensureLedger(runDir, runId, feature) {
+  const path = ledgerFilePath(runDir);
+  if (await Bun.file(path).exists())
+    return;
+  await _ledgerDeps2.mkdir(runDir, { recursive: true });
+  const header = `# Workflow ledger \u2014 run: ${runId} \u2014 feature: ${feature}
+`;
+  await runStateWrite(path, { content: header }, async () => {
+    await Bun.write(path, header);
+  });
+}
+async function appendLedger(runDir, storyId, text, options = {}) {
+  const path = ledgerFilePath(runDir);
+  const line = `${storyId}: ${text}
+`;
+  await runStateWrite(path, { append: line }, () => _ledgerDeps2.appendFile(path, line));
+  if (options.mirror !== false)
+    mirrorLedger(storyId, text);
+}
+var _ledgerDeps2, ledgerText;
+var init_ledger2 = __esm(() => {
+  init_store();
+  init_run_log();
+  _ledgerDeps2 = { appendFile: appendFile9, mkdir: mkdir35 };
+  ledgerText = {
+    fixRound: (round, max, summary) => `fix round ${round}/${max} (${oneLine2(summary)})`,
+    deferredMinor: (issue) => `deferred-minor: ${oneLine2(issue)}`,
+    ruling: (r) => `Ruling: ${oneLine2(r.text)} \u2014 ${oneLine2(r.why)} \u2014 ${oneLine2(r.costIfWrong)}${r.coercedFrom ? " (coerced from defer: no later review step)" : ""}`,
+    end: (state, summary) => `${state} (${oneLine2(summary)})`,
+    reviewSkipped: (what) => `review-skipped (${oneLine2(what)})`,
+    note: (text) => oneLine2(text)
+  };
+});
+
+// src/workflow/preflight.ts
+import { rename as rename10 } from "fs/promises";
+import { join as join119 } from "path";
+function preflightPath(runDir) {
+  return join119(runDir, "preflight.json");
+}
+function what(d) {
+  return d.action.type === "supersede" ? `supersede ${describeTarget(d.action.target)}` : d.action.type;
+}
+function isRecordObject(v) {
+  return typeof v === "object" && v !== null && !Array.isArray(v);
+}
+function isStringArray2(v) {
+  return Array.isArray(v) && v.every((s) => typeof s === "string");
+}
+function isOverlapEntry(v) {
+  return isRecordObject(v) && typeof v.storyId === "string" && isStringArray2(v.specSections);
+}
+function isConflictRecord(v) {
+  return isRecordObject(v) && typeof v.questionId === "string" && isStringArray2(v.storyIds) && typeof v.summary === "string" && (v.decisionId === null || typeof v.decisionId === "string") && typeof v.action === "string";
+}
+function isReusable(v) {
+  if (!isRecordObject(v) || v.schemaVersion !== 1 || !isStringArray2(v.storyIds) || v.fallbackReason)
+    return false;
+  return Array.isArray(v.overlap) && v.overlap.every(isOverlapEntry) && Array.isArray(v.conflicts) && v.conflicts.every(isConflictRecord);
+}
+async function readExisting(path) {
+  const file = Bun.file(path);
+  if (!await file.exists())
+    return null;
+  try {
+    const parsed = JSON.parse(await file.text());
+    if (isReusable(parsed))
+      return parsed;
+    getLogger2().warn("workflow", "preflight.json is unusable (wrong shape or failed pre-flight) - re-running", {
+      storyId: "_run",
+      reason: "wrong-shape-or-fallback"
+    });
+  } catch (err) {
+    getLogger2().warn("workflow", "preflight.json is unreadable - re-running pre-flight", {
+      storyId: "_run",
+      reason: err instanceof Error ? err.message : String(err)
+    });
+  }
+  return null;
+}
+async function runPreflight(input) {
+  const path = preflightPath(input.runDir);
+  const existing = await readExisting(path);
+  if (existing)
+    return existing;
+  const result = await input.advisor.adviseBatch({
+    kind: "preflight",
+    summary: `Pre-flight for ${input.storyIds.length} stories.`,
+    storyIds: [...input.storyIds]
+  });
+  const items = result.kind === "preflight" ? result.items : [];
+  const conflicts = items.map((item) => ({
+    questionId: item.question.id,
+    storyIds: item.decision?.appliesTo ?? (item.question.storyId ? [item.question.storyId] : []),
+    summary: item.question.summary,
+    decisionId: item.decision?.id ?? null,
+    action: item.decision?.action.type ?? "hold",
+    ...item.fallbackReason ? { fallbackReason: item.fallbackReason } : {}
+  }));
+  const file = {
+    schemaVersion: 1,
+    storyIds: [...input.storyIds],
+    overlap: result.kind === "preflight" ? result.overlap : [],
+    conflicts,
+    ...result.kind === "preflight" && result.fallbackReason ? { fallbackReason: result.fallbackReason } : {}
+  };
+  const tmp = `${path}.tmp`;
+  await Bun.write(tmp, `${JSON.stringify(file, null, 2)}
+`);
+  await rename10(tmp, path);
+  for (const [i, item] of items.entries()) {
+    const record = conflicts[i];
+    if (!record)
+      continue;
+    const text = item.decision ? ledgerText.ruling({
+      action: "hold",
+      text: `pre-flight ${item.decision.id}: ${what(item.decision)}`,
+      why: item.decision.rationale,
+      costIfWrong: costIfWrongOf(item.decision),
+      source: "advisor"
+    }) : ledgerText.ruling({
+      action: "hold",
+      text: "pre-flight hold (default)",
+      why: item.fallbackReason ?? "no advisor ruling",
+      costIfWrong: "the story runs under the spec as written",
+      source: "default"
+    });
+    for (const storyId of record.storyIds)
+      await input.ledger(storyId, text);
+  }
+  return file;
+}
+var isReusablePreflight;
+var init_preflight = __esm(() => {
+  init_advisor();
+  init_logger2();
+  init_advisor_live();
+  init_ledger2();
+  isReusablePreflight = isReusable;
+});
+
 // src/workflow/open-items.ts
 function findingItem(f, r) {
   return {
@@ -108024,8 +108648,8 @@ var init_open_items = __esm(() => {
 });
 
 // src/workflow/result.ts
-import { mkdir as mkdir35, readdir as readdir10, rename as rename10, stat as stat11 } from "fs/promises";
-import { basename as basename18, join as join118 } from "path";
+import { mkdir as mkdir36, readdir as readdir10, rename as rename11, stat as stat11 } from "fs/promises";
+import { basename as basename18, join as join120 } from "path";
 function newStoryRecord(storyId, maxRounds, now) {
   return {
     storyId,
@@ -108044,7 +108668,7 @@ function newStoryRecord(storyId, maxRounds, now) {
   };
 }
 async function readResult(runDir) {
-  const file = Bun.file(join118(runDir, RESULT_FILE));
+  const file = Bun.file(join120(runDir, RESULT_FILE));
   if (!await file.exists())
     return null;
   try {
@@ -108080,7 +108704,7 @@ async function writePreflightTokens(runDir, header, byRole) {
 }
 async function writeResult(runDir, next) {
   await _resultDeps.mkdir(runDir, { recursive: true });
-  const path = join118(runDir, RESULT_FILE);
+  const path = join120(runDir, RESULT_FILE);
   const tmp = `${path}.tmp`;
   const text = `${JSON.stringify(next, null, 2)}
 `;
@@ -108109,9 +108733,9 @@ async function runDirsNewestFirst(featureDir) {
   }
   const dated = [];
   for (const name of entries) {
-    const runDir = join118(featureDir, name);
+    const runDir = join120(featureDir, name);
     try {
-      dated.push({ runDir, mtimeMs: (await _resultDeps.stat(join118(runDir, RESULT_FILE))).mtimeMs });
+      dated.push({ runDir, mtimeMs: (await _resultDeps.stat(join120(runDir, RESULT_FILE))).mtimeMs });
     } catch {}
   }
   return [...dated].sort((a, b) => b.mtimeMs - a.mtimeMs).map((d) => d.runDir);
@@ -108133,7 +108757,120 @@ var _resultDeps, RESULT_FILE = "result.json";
 var init_result = __esm(() => {
   init_store();
   init_open_items();
-  _resultDeps = { mkdir: mkdir35, readdir: readdir10, rename: rename10, stat: stat11 };
+  _resultDeps = { mkdir: mkdir36, readdir: readdir10, rename: rename11, stat: stat11 };
+});
+
+// src/workflow/feature-record.ts
+import { basename as basename19 } from "path";
+function newFeatureRecord(input) {
+  return {
+    step: "repo-gates",
+    startedAt: input.now,
+    ...input.head ? { startHead: input.head } : {},
+    seed: input.seed,
+    gateFindings: [],
+    reviewRan: false,
+    reviewOpen: [],
+    minors: input.minors,
+    newMinors: [],
+    nextFindingId: 1,
+    fixRan: false,
+    rulings: [],
+    reasons: [],
+    timings: {},
+    tokensByRole: {}
+  };
+}
+function minorsFrom(deferred) {
+  return deferred.map((m, i) => ({ id: `M${i + 1}`, storyId: m.storyId, text: m.text, triage: "leave" }));
+}
+async function collectStoryRecords(featureDir) {
+  const found = new Map;
+  for (const runDir of await runDirsNewestFirst(featureDir)) {
+    const stories = (await readResult(runDir))?.stories ?? {};
+    for (const [id, record] of Object.entries(stories)) {
+      if (!found.has(id))
+        found.set(id, { record, runDir });
+    }
+  }
+  return Object.fromEntries(found);
+}
+function isFeatureRecord(v) {
+  if (typeof v !== "object" || v === null)
+    return false;
+  const o = v;
+  return FEATURE_STEPS.includes(o.step) && typeof o.nextFindingId === "number" && Array.isArray(o.gateFindings) && Array.isArray(o.reviewOpen) && Array.isArray(o.minors) && Array.isArray(o.rulings) && Array.isArray(o.reasons);
+}
+async function loadPriorFeature(featureDir, currentRunId) {
+  for (const runDir of await runDirsNewestFirst(featureDir)) {
+    if (basename19(runDir) === currentRunId)
+      continue;
+    const feature = (await readResult(runDir))?.featureWorkflow;
+    if (feature === undefined)
+      continue;
+    if (isFeatureRecord(feature))
+      return feature;
+    getSafeLogger2()?.warn("workflow", "Prior feature record is malformed \u2014 ignored", { storyId: "_run", runDir });
+  }
+  return null;
+}
+function fromRecord(id, title, located) {
+  const r = located.record;
+  if (!r.state)
+    return null;
+  return {
+    id,
+    title,
+    state: r.state,
+    ...r.reason ? { reason: r.reason } : {},
+    rounds: r.round,
+    unreviewed: r.unreviewed,
+    flagged: r.flagged ?? 0,
+    runDir: located.runDir
+  };
+}
+function summariseStories(prd, records) {
+  return prd.userStories.map((s) => {
+    const located = records[s.id];
+    const closed = located ? fromRecord(s.id, s.title, located) : null;
+    if (closed)
+      return closed;
+    const base = { id: s.id, title: s.title, unreviewed: false, flagged: 0 };
+    if (s.passes || s.status === "passed")
+      return { ...base, state: "complete", reason: PASSED_EARLIER, rounds: 0 };
+    return { ...base, state: "not-run", rounds: located?.record.round ?? 0 };
+  });
+}
+async function newestPreflight(featureDir) {
+  for (const runDir of await runDirsNewestFirst(featureDir)) {
+    const path = preflightPath(runDir);
+    const file = Bun.file(path);
+    if (!await file.exists())
+      continue;
+    try {
+      const parsed = JSON.parse(await file.text());
+      if (isReusablePreflight(parsed))
+        return { path, file: parsed };
+    } catch {}
+  }
+  return null;
+}
+var FEATURE_STEPS, PASSED_EARLIER = "passed earlier, no workflow record";
+var init_feature_record = __esm(() => {
+  init_logger2();
+  init_preflight();
+  init_result();
+  FEATURE_STEPS = [
+    "repo-gates",
+    "branch-review",
+    "branch-fix",
+    "branch-rereview",
+    "adjudicate",
+    "final-gates",
+    "gate-repair",
+    "publish",
+    "done"
+  ];
 });
 
 // src/workflow/rulings.ts
@@ -108180,8 +108917,8 @@ var init_step_context = __esm(() => {
 });
 
 // src/workflow/brief.ts
-import { mkdir as mkdir36 } from "fs/promises";
-import { isAbsolute as isAbsolute30, join as join119 } from "path";
+import { mkdir as mkdir37 } from "fs/promises";
+import { dirname as dirname30, isAbsolute as isAbsolute31, join as join121 } from "path";
 function specExcerpts(specText, storyId) {
   const sections = specText.split(/^(?=#{1,6} )/m).map((s) => s.trim()).filter(Boolean);
   const hits = sections.filter((s) => s.includes(storyId));
@@ -108208,7 +108945,7 @@ async function loadSpec(sc) {
     const rel = resolved.specSource?.path;
     if (!rel)
       return { excerpts: [] };
-    const abs = isAbsolute30(rel) ? rel : join119(sc.projectDir, rel);
+    const abs = isAbsolute31(rel) ? rel : join121(sc.projectDir, rel);
     const file = Bun.file(abs);
     return { path: rel, excerpts: await file.exists() ? specExcerpts(await file.text(), sc.story.id) : [] };
   } catch {
@@ -108216,8 +108953,8 @@ async function loadSpec(sc) {
   }
 }
 async function redBaseDependencies(sc) {
-  const result = await readResult(sc.runDir);
-  return (sc.story.dependencies ?? []).map((id) => result?.stories[id]).filter((r) => r?.state === "complete-gate-open").map((r) => ({ storyId: r?.storyId ?? "", reason: r?.reason ?? "gate red" }));
+  const records = await collectStoryRecords(dirname30(sc.runDir));
+  return (sc.story.dependencies ?? []).map((id) => records[id]?.record).filter((r) => r?.state === "complete-gate-open").map((r) => ({ storyId: r?.storyId ?? "", reason: r?.reason ?? "gate red" }));
 }
 function contextFilePaths(sc) {
   return (sc.story.contextFiles ?? []).map((entry) => typeof entry === "string" ? entry : entry.path);
@@ -108251,35 +108988,35 @@ async function writeBrief(sc) {
     redBaseDependencies: redBase,
     reportPath: sc.reportPath
   });
-  await mkdir36(sc.storyDir, { recursive: true });
+  await mkdir37(sc.storyDir, { recursive: true });
   await Bun.write(sc.briefPath, text);
 }
 var MAX_EXCERPT_CHARS = 12000;
 var init_brief = __esm(() => {
   init_logger2();
   init_prompts();
-  init_result();
+  init_feature_record();
   init_rulings();
   init_step_context();
 });
 
 // src/workflow/paths.ts
-import { join as join120 } from "path";
+import { join as join122 } from "path";
 function workflowFeatureDir(projectDir, feature) {
-  return join120(featureDir(projectDir, feature), "workflow");
+  return join122(featureDir(projectDir, feature), "workflow");
 }
 function workflowRunDir(projectDir, feature, runId) {
-  return join120(workflowFeatureDir(projectDir, feature), runId);
+  return join122(workflowFeatureDir(projectDir, feature), runId);
 }
 function workflowStoryDir(runDir, storyId) {
-  return join120(runDir, storyId);
+  return join122(runDir, storyId);
 }
 var init_paths5 = __esm(() => {
   init_config();
 });
 
 // src/workflow/feature-context.ts
-import { join as join121 } from "path";
+import { join as join123 } from "path";
 async function buildFeatureContext(input) {
   const storyPackageDirs = input.prd.userStories.map(storyPackageDir);
   const dispatchAsk = await _featureContextDeps2.buildRunDispatchAskWiring({
@@ -108320,8 +109057,8 @@ async function buildFeatureContext(input) {
     outputDir: input.runtime.outputDir,
     runDir,
     featureDir: workflowFeatureDir(input.workdir, input.feature),
-    prdPath: join121(featureDir(input.workdir, input.feature), "prd.json"),
-    reportPath: join121(runDir, "feature-report.md"),
+    prdPath: join123(featureDir(input.workdir, input.feature), "prd.json"),
+    reportPath: join123(runDir, "feature-report.md"),
     packageDirs: [...new Set(storyPackageDirs.filter((d) => typeof d === "string" && d !== ""))],
     ...input.abortSignal ? { runSignal: input.abortSignal } : {},
     dryRun: input.runtime.dryRun === true
@@ -108337,97 +109074,6 @@ var init_feature_context3 = __esm(() => {
   _featureContextDeps2 = { buildRunDispatchAskWiring };
 });
 
-// src/workflow/run-log.ts
-function logWorkflow(storyId, message, data = {}) {
-  getSafeLogger2()?.info("workflow", message, { storyId, ...data });
-}
-function mirrorLedger(storyId, text) {
-  const capped = text.length > MAX_MIRROR_CHARS ? `${text.slice(0, MAX_MIRROR_CHARS - 3)}...` : text;
-  logWorkflow(storyId, storyId === FEATURE_SCOPE ? capped : `${storyId}: ${capped}`, { ledger: true });
-}
-function shortIssue(issue) {
-  const flat = issue.replace(/\s+/g, " ").trim();
-  return flat.length > MAX_ISSUE_CHARS ? `${flat.slice(0, MAX_ISSUE_CHARS - 3)}...` : flat;
-}
-function describeFindings(findings) {
-  if (findings.length === 0)
-    return "no findings";
-  const counts = SEVERITY_ORDER2.map((sev) => [sev, findings.filter((f) => f.severity === sev).length]).filter(([, n]) => n > 0).map(([sev, n]) => `${n} ${sev}`);
-  const items = findings.map((f) => f.id ? `${f.id} ${shortIssue(f.issue)}` : shortIssue(f.issue));
-  return `${counts.join(", ")} (${items.join(", ")})`;
-}
-function startStep(storyId, label, options = {}) {
-  const now = options.now ?? Date.now;
-  const prefix = storyId === FEATURE_SCOPE ? "" : `${storyId} `;
-  const startedAt = now();
-  if (options.announce !== false) {
-    const model = options.model ? { agentName: options.model.agentName, model: options.model.model } : {};
-    logWorkflow(storyId, `${prefix}${label} start`, { step: label, ...model });
-  }
-  return {
-    done(text, data = {}) {
-      const durationMs = now() - startedAt;
-      const joiner = options.bare ? " " : ": ";
-      logWorkflow(storyId, `${prefix}${label}${joiner}${text}  ${formatDuration(durationMs)}`, {
-        step: label,
-        durationMs,
-        ...data
-      });
-      return durationMs;
-    }
-  };
-}
-var MAX_ISSUE_CHARS = 60, MAX_MIRROR_CHARS = 200, SEVERITY_ORDER2;
-var init_run_log = __esm(() => {
-  init_log_format();
-  init_logger2();
-  init_advisor_live();
-  SEVERITY_ORDER2 = ["critical", "important", "minor"];
-});
-
-// src/workflow/ledger.ts
-import { appendFile as appendFile9, mkdir as mkdir37 } from "fs/promises";
-import { join as join122 } from "path";
-function ledgerFilePath(runDir) {
-  return join122(runDir, "ledger.md");
-}
-function oneLine2(text) {
-  return text.replace(/\s+/g, " ").trim();
-}
-async function ensureLedger(runDir, runId, feature) {
-  const path = ledgerFilePath(runDir);
-  if (await Bun.file(path).exists())
-    return;
-  await _ledgerDeps2.mkdir(runDir, { recursive: true });
-  const header = `# Workflow ledger \u2014 run: ${runId} \u2014 feature: ${feature}
-`;
-  await runStateWrite(path, { content: header }, async () => {
-    await Bun.write(path, header);
-  });
-}
-async function appendLedger(runDir, storyId, text, options = {}) {
-  const path = ledgerFilePath(runDir);
-  const line = `${storyId}: ${text}
-`;
-  await runStateWrite(path, { append: line }, () => _ledgerDeps2.appendFile(path, line));
-  if (options.mirror !== false)
-    mirrorLedger(storyId, text);
-}
-var _ledgerDeps2, ledgerText;
-var init_ledger2 = __esm(() => {
-  init_store();
-  init_run_log();
-  _ledgerDeps2 = { appendFile: appendFile9, mkdir: mkdir37 };
-  ledgerText = {
-    fixRound: (round, max, summary) => `fix round ${round}/${max} (${oneLine2(summary)})`,
-    deferredMinor: (issue) => `deferred-minor: ${oneLine2(issue)}`,
-    ruling: (r) => `Ruling: ${oneLine2(r.text)} \u2014 ${oneLine2(r.why)} \u2014 ${oneLine2(r.costIfWrong)}${r.coercedFrom ? " (coerced from defer: no later review step)" : ""}`,
-    end: (state, summary) => `${state} (${oneLine2(summary)})`,
-    reviewSkipped: (what) => `review-skipped (${oneLine2(what)})`,
-    note: (text) => oneLine2(text)
-  };
-});
-
 // src/workflow/adjudicate.ts
 async function adjudicateResidual(advisor, req, ledger) {
   let answer = { rulings: [], diagnoses: {} };
@@ -108480,7 +109126,7 @@ var init_adjudicate = __esm(() => {
 
 // src/workflow/git.ts
 import { mkdir as mkdir38 } from "fs/promises";
-import { dirname as dirname30, relative as relative37 } from "path";
+import { dirname as dirname31, relative as relative38 } from "path";
 function ledgerCommitMessage(feature) {
   return `chore(${feature}): advisor decisions`;
 }
@@ -108493,7 +109139,7 @@ function ledgerGitError(path, step, result) {
   });
 }
 async function commitLedger(projectDir, feature) {
-  const path = relative37(projectDir, ledgerPath(projectDir, feature));
+  const path = relative38(projectDir, ledgerPath(projectDir, feature));
   if (!await Bun.file(ledgerPath(projectDir, feature)).exists())
     return false;
   const added = await _workflowDeps.git(["add", "-f", "--", path], projectDir);
@@ -108590,7 +109236,7 @@ async function writeBranchReviewPackage(projectDir, from, path) {
   const changedSection = `## Changed files (${records.length})${lines.length > 0 ? `
 ${lines.join(`
 `)}` : ""}`;
-  await mkdir38(dirname30(path), { recursive: true });
+  await mkdir38(dirname31(path), { recursive: true });
   await Bun.write(path, `## Commits (${range})
 ${log.stdout.trim() || "(none)"}
 
@@ -108619,7 +109265,7 @@ async function writeReviewPackage(projectDir, from, path) {
   }
   const body = truncateDiff(diff.stdout, stat.stdout);
   const omitted = body === diff.stdout ? "" : omittedFilesSection(names.stdout, body);
-  await mkdir38(dirname30(path), { recursive: true });
+  await mkdir38(dirname31(path), { recursive: true });
   await Bun.write(path, `## Commits (${range})
 ${log.stdout.trim() || "(none)"}
 
@@ -108630,6 +109276,16 @@ ${stat.stdout.trim() || "(no changes)"}
 ${body}
 ${omitted}`);
 }
+async function readDefaultBranch(projectDir) {
+  try {
+    const result = await _workflowDeps.git(["symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD"], projectDir);
+    if (result.exitCode !== 0)
+      return;
+    return result.stdout.trim().replace(/^origin\//, "") || undefined;
+  } catch {
+    return;
+  }
+}
 var DIFF_CONTEXT_LINES = 10;
 var init_git3 = __esm(() => {
   init_advisor();
@@ -108702,12 +109358,12 @@ var init_branch_fix = __esm(() => {
 });
 
 // src/workflow/review-coverage.ts
-function basename19(path) {
+function basename20(path) {
   const cut = path.lastIndexOf("/");
   return cut === -1 ? path : path.slice(cut + 1);
 }
 function isNonSource(path) {
-  const base = basename19(path).toLowerCase();
+  const base = basename20(path).toLowerCase();
   return LOCKFILE_BASENAMES2.has(base) || NON_SOURCE_SUFFIXES.some((suffix) => base.endsWith(suffix));
 }
 function owningPackage(path, packageDirs) {
@@ -108776,7 +109432,7 @@ var init_review_coverage = __esm(() => {
 });
 
 // src/workflow/story-review.ts
-import { join as join123 } from "path";
+import { join as join124 } from "path";
 async function underReviewLimit(sc, writePackage, run) {
   try {
     await writePackage();
@@ -108800,7 +109456,7 @@ async function underReviewLimit(sc, writePackage, run) {
 }
 async function writeVerdictSafe(sc, file, verdict) {
   try {
-    await Bun.write(join123(sc.storyDir, file), `${JSON.stringify(verdict, null, 2)}
+    await Bun.write(join124(sc.storyDir, file), `${JSON.stringify(verdict, null, 2)}
 `);
   } catch (err) {
     getLogger2().warn("workflow", `Could not write ${file}, continuing`, {
@@ -108810,7 +109466,7 @@ async function writeVerdictSafe(sc, file, verdict) {
   }
 }
 async function runStoryReview(sc, concerns, gates = {}) {
-  const packagePath = join123(sc.storyDir, "package-0.diff");
+  const packagePath = join124(sc.storyDir, "package-0.diff");
   const prompt = buildWorkflowStoryReviewPrompt({
     briefPath: sc.briefPath,
     reportPath: sc.reportPath,
@@ -108837,10 +109493,10 @@ var init_story_review = __esm(() => {
 });
 
 // src/workflow/branch-review.ts
-import { join as join124 } from "path";
+import { join as join125 } from "path";
 async function writeFeatureArtifact(fc, name, value) {
   try {
-    await Bun.write(join124(fc.runDir, name), `${JSON.stringify(value, null, 2)}
+    await Bun.write(join125(fc.runDir, name), `${JSON.stringify(value, null, 2)}
 `);
   } catch (err) {
     getLogger2().warn("workflow", `Could not write ${name}, continuing`, { storyId: "_run", error: errorMessage(err) });
@@ -108850,7 +109506,7 @@ function branchReviewModel(fc) {
   return fc.workflow.models.branchReview ?? fc.config.finish?.reviewers?.quality ?? undefined;
 }
 async function runBranchReview(fc, input) {
-  const packagePath = join124(fc.runDir, "package-branch.diff");
+  const packagePath = join125(fc.runDir, "package-branch.diff");
   const range = `${input.seed}..HEAD`;
   const prompt = buildWorkflowBranchReviewPrompt({
     ...input.specPath ? { specPath: input.specPath } : {},
@@ -108869,15 +109525,16 @@ async function runBranchReview(fc, input) {
     timeoutMs: fc.workflow.timeouts.reviewMs,
     minorIds: input.facts.minors.map((m) => m.id),
     requiredFiles,
+    repoRoot: fc.projectDir,
     range
   }));
   if (!outcome.ran)
     return outcome;
-  const unread = unreadFiles(requiredFiles, outcome.verdict.inspectedFiles ?? []);
+  const unread = unreadFiles(requiredFiles, outcome.verdict.inspectedFiles ?? [], fc.projectDir);
   return unread.length > 0 ? { ran: true, verdict: { ...outcome.verdict, unreadFiles: unread } } : outcome;
 }
 async function runBranchReReview(fc, input) {
-  const packagePath = join124(fc.runDir, "package-branch-fix.diff");
+  const packagePath = join125(fc.runDir, "package-branch-fix.diff");
   const prompt = buildWorkflowBranchReReviewPrompt({
     ...input.specPath ? { specPath: input.specPath } : {},
     reportPath: fc.reportPath,
@@ -108913,12 +109570,12 @@ var init_cost_limit = __esm(() => {
 });
 
 // src/finish/a3-hints.ts
-import { join as join125 } from "path";
+import { join as join126 } from "path";
 async function listJson(dir) {
   const glob = new Bun.Glob("*.json");
   const out = [];
   for await (const name of glob.scan({ cwd: dir, absolute: false }))
-    out.push(join125(dir, name));
+    out.push(join126(dir, name));
   return out.sort((a, b) => a.localeCompare(b));
 }
 function hintsFromRecord(raw) {
@@ -108946,7 +109603,7 @@ function hintsFromRecord(raw) {
   return out;
 }
 async function readA3Hints(outputDir, feature) {
-  const dir = join125(outputDir, "nbf-worth-check", feature);
+  const dir = join126(outputDir, "nbf-worth-check", feature);
   let files;
   try {
     files = await _a3HintsDeps.listJson(dir);
@@ -108973,7 +109630,7 @@ var init_a3_hints = __esm(() => {
 });
 
 // src/finish/acceptance-evidence.ts
-import { basename as basename20, extname, join as join126 } from "path";
+import { basename as basename21, extname, join as join127 } from "path";
 function splitAcBlocks(text) {
   const lines = text.split(`
 `);
@@ -109001,7 +109658,7 @@ ${f.problem}`.matchAll(BACKTICK))
   for (const m of f.title.matchAll(CODE_WORD))
     ids.add(m[0]);
   if (f.file) {
-    const base = basename20(f.file, extname(f.file));
+    const base = basename21(f.file, extname(f.file));
     if (!GENERIC_BASENAMES.has(base))
       ids.add(base);
   }
@@ -109022,7 +109679,7 @@ function findPinnedAcs(files, f) {
   return scored.filter((p) => p.score >= 1).sort((a, b) => b.score - a.score).slice(0, MAX_PINNED_BLOCKS);
 }
 async function loadAcceptanceFiles(workdir, paths) {
-  const texts = await Promise.all(paths.map((p) => _acceptanceEvidenceDeps.readText(join126(workdir, p))));
+  const texts = await Promise.all(paths.map((p) => _acceptanceEvidenceDeps.readText(join127(workdir, p))));
   return paths.flatMap((path, i) => {
     const text = texts[i];
     return typeof text === "string" ? [{ path, text }] : [];
@@ -109041,17 +109698,17 @@ var init_acceptance_evidence = __esm(() => {
 
 // src/finish/safe-path.ts
 import { realpath as realpath4 } from "fs/promises";
-import { basename as basename21, dirname as dirname31, join as join127, relative as relative38, sep as sep24 } from "path";
+import { basename as basename22, dirname as dirname32, join as join128, relative as relative39, sep as sep24 } from "path";
 async function insideRoot(root, target) {
   const realRoot = await realpath4(root).catch(() => null);
   if (realRoot === null)
     return false;
-  let dir = dirname31(target);
+  let dir = dirname32(target);
   for (;; ) {
     const real = await realpath4(dir).catch(() => null);
     if (real !== null)
       return real === realRoot || real.startsWith(realRoot + sep24);
-    const up = dirname31(dir);
+    const up = dirname32(dir);
     if (up === dir)
       return false;
     dir = up;
@@ -109061,12 +109718,12 @@ async function realpathLoose(target) {
   const real = await realpath4(target).catch(() => null);
   if (real !== null)
     return real;
-  const up = dirname31(target);
-  return up === target ? target : join127(await realpathLoose(up), basename21(target));
+  const up = dirname32(target);
+  return up === target ? target : join128(await realpathLoose(up), basename22(target));
 }
 async function relativeInsideRoot(root, dir) {
   const [realRoot, realDir] = await Promise.all([realpathLoose(root), realpathLoose(dir)]);
-  const rel = relative38(realRoot, realDir);
+  const rel = relative39(realRoot, realDir);
   if (rel === "" || rel.startsWith("..") || rel.startsWith(sep24))
     return null;
   return rel.split(sep24).join("/");
@@ -109214,7 +109871,7 @@ var init_set_aside_git = __esm(() => {
 });
 
 // src/finish/acceptance-guard.ts
-import { join as join128 } from "path";
+import { join as join129 } from "path";
 function acceptancePathsOf(context) {
   if (context.acceptanceStatus === "disabled")
     return [];
@@ -109243,7 +109900,7 @@ function changedAcs(before, after) {
 }
 async function acsChangedIn(root, path) {
   const head = await gitLiteral(["show", `HEAD:${path}`], root);
-  const after = await _guardDeps.readText(join128(root, path));
+  const after = await _guardDeps.readText(join129(root, path));
   return changedAcs(head.exitCode === 0 ? head.stdout : "", after ?? "");
 }
 async function restoreFromHead(root, paths) {
@@ -109821,7 +110478,7 @@ function draftReason(f) {
     parts.push(`${f.unreviewedFixCommits.length} unreviewed fix commit(s)`);
   return parts.join("; ");
 }
-async function resolve44(args) {
+async function resolve45(args) {
   const { facts } = args;
   if (isClean(facts)) {
     if ((facts.restoreFailed?.length ?? 0) > 0)
@@ -109858,7 +110515,7 @@ var init_resolve = __esm(() => {
 });
 
 // src/finish/advise.ts
-import { relative as relative39 } from "path";
+import { relative as relative40 } from "path";
 async function reusablePrior(deps, f, key) {
   if (BLOCKING3.has(f.severity))
     return;
@@ -109993,7 +110650,7 @@ function createFinishAdvisor(deps) {
       return { action, rationale: decision.rationale };
     },
     async commitLedger(state) {
-      const path = relative39(state.workdir, ledgerPath(deps.repoRoot, deps.feature));
+      const path = relative40(state.workdir, ledgerPath(deps.repoRoot, deps.feature));
       const added = await git(["add", "-f", "--", path], state.workdir);
       if (added.exitCode !== 0)
         throw ledgerGitError2("add", added);
@@ -110047,15 +110704,15 @@ var init_advise2 = __esm(() => {
 
 // src/finish/audit.ts
 import { appendFile as appendFile10, mkdir as mkdir39, readFile as readFile10, writeFile as writeFile12 } from "fs/promises";
-import { join as join129 } from "path";
+import { join as join130 } from "path";
 function roundsPath(t) {
-  return join129(t.auditDir, `${t.runId}.jsonl`);
+  return join130(t.auditDir, `${t.runId}.jsonl`);
 }
 function resultPath(t) {
-  return join129(t.auditDir, `${t.runId}.result.json`);
+  return join130(t.auditDir, `${t.runId}.result.json`);
 }
 function ledgerPath2(auditDir) {
-  return join129(auditDir, "last.json");
+  return join130(auditDir, "last.json");
 }
 async function updateLedger(t, result) {
   if (!result.headSha || !result.branch)
@@ -110213,14 +110870,14 @@ var init_state = __esm(() => {
 });
 
 // src/finish/checkpoint.ts
-import { mkdir as mkdir40, rename as rename11, rm as rm11, writeFile as writeFile13 } from "fs/promises";
-import { join as join130 } from "path";
+import { mkdir as mkdir40, rename as rename12, rm as rm11, writeFile as writeFile13 } from "fs/promises";
+import { join as join131 } from "path";
 function checkpointPath(audit) {
-  return join130(audit.auditDir, `${audit.runId}.checkpoint.json`);
+  return join131(audit.auditDir, `${audit.runId}.checkpoint.json`);
 }
 async function writeCheckpoint(audit, state) {
   const target = checkpointPath(audit);
-  const tmp = join130(audit.auditDir, `${audit.runId}.checkpoint.${_checkpointDeps.uniqueId()}.tmp`);
+  const tmp = join131(audit.auditDir, `${audit.runId}.checkpoint.${_checkpointDeps.uniqueId()}.tmp`);
   try {
     const text = serializeFinishState(state);
     await _checkpointDeps.mkdir(audit.auditDir);
@@ -110246,7 +110903,7 @@ var init_checkpoint2 = __esm(() => {
       await mkdir40(path, { recursive: true });
     },
     writeFile: (path, text) => writeFile13(path, text, "utf8"),
-    rename: (from, to) => rename11(from, to),
+    rename: (from, to) => rename12(from, to),
     remove: (path) => rm11(path, { force: true }),
     uniqueId: () => crypto.randomUUID()
   };
@@ -110967,7 +111624,7 @@ var init_acceptance4 = __esm(() => {
 });
 
 // src/finish/gates/quality.ts
-import { join as join132 } from "path";
+import { join as join133 } from "path";
 function overlayCommandsOf(override) {
   const commands = override?.quality?.commands;
   return commands !== undefined && Object.keys(commands).length > 0 ? commands : undefined;
@@ -110976,7 +111633,7 @@ async function resolveGateCommands(repoRoot, packageDirs) {
   const seen = new Set;
   const out = [];
   const add = (name, command, cwd, setup) => {
-    if (command === undefined)
+    if (command === undefined || !(typeof command === "string" ? [command] : command).some((part) => part.trim()))
       return;
     const key = `${cwd}::${JSON.stringify(command)}::${JSON.stringify(setup ?? null)}`;
     if (seen.has(key))
@@ -110997,11 +111654,12 @@ async function resolveGateCommands(repoRoot, packageDirs) {
     const overlayCommands = overlayCommandsOf(override);
     if (!overlayCommands)
       continue;
-    const packageCwd = join132(repoRoot, packageDir);
+    const packageCwd = join133(repoRoot, packageDir);
     for (const gate of GATE_ORDER) {
       if (overlayCommands[gate] === undefined)
         continue;
-      add(`${gate}@${packageDir}`, overlayCommands[gate], packageCwd, setupFor(overlayCommands, gate));
+      const setupCommands = Object.hasOwn(overlayCommands, "e2eSetup") ? overlayCommands : { ...overlayCommands, e2eSetup: rootCommands.e2eSetup };
+      add(`${gate}@${packageDir}`, overlayCommands[gate], packageCwd, setupFor(setupCommands, gate));
     }
   }
   return out;
@@ -111048,7 +111706,7 @@ ${res.output}`);
       passed: false,
       ran,
       failing: [],
-      output: `[quality] no quality.commands configured in ${join132(repoRoot, PROJECT_NAX_DIR, "config.json")} \u2014 nothing was verified`
+      output: `[quality] no quality.commands configured in ${join133(repoRoot, PROJECT_NAX_DIR, "config.json")} \u2014 nothing was verified`
     };
   }
   return { passed: failing.length === 0, ran, failing, output: chunks.join(`
@@ -111075,12 +111733,12 @@ var restorePending = (h) => !h.restored && h.settledBy === undefined, restorePen
 
 // src/finish/untracked-snapshot.ts
 import { chmod, copyFile, lstat as lstat5, mkdir as mkdir41, realpath as realpath5, rm as rm12, unlink as unlink8 } from "fs/promises";
-import { dirname as dirname32, join as join133, relative as relative40, resolve as resolve45, sep as sep25 } from "path";
+import { dirname as dirname33, join as join134, relative as relative41, resolve as resolve46, sep as sep25 } from "path";
 async function copyFileInto(src, dest, ownerOnly = false) {
   try {
     if (!(await lstat5(src)).isFile())
       return false;
-    await mkdir41(dirname32(dest), ownerOnly ? { recursive: true, mode: PRIVATE_DIR } : { recursive: true });
+    await mkdir41(dirname33(dest), ownerOnly ? { recursive: true, mode: PRIVATE_DIR } : { recursive: true });
     await copyFile(src, dest);
     if (ownerOnly)
       await chmod(dest, PRIVATE_FILE);
@@ -111091,17 +111749,17 @@ async function copyFileInto(src, dest, ownerOnly = false) {
 }
 async function privateDirs(top, dir) {
   await mkdir41(dir, { recursive: true, mode: PRIVATE_DIR });
-  for (let d = dir;; d = dirname32(d)) {
+  for (let d = dir;; d = dirname33(d)) {
     await chmod(d, PRIVATE_DIR);
-    if (d === top || dirname32(d) === d)
+    if (d === top || dirname33(d) === d)
       return;
   }
 }
 async function removeSnapshotDir(auditDir, snapshot) {
   if (!snapshot)
     return;
-  const rel = relative40(resolve45(auditDir), resolve45(snapshot.dir));
-  if (rel === "" || rel.startsWith("..") || resolve45(rel) === rel)
+  const rel = relative41(resolve46(auditDir), resolve46(snapshot.dir));
+  if (rel === "" || rel.startsWith("..") || resolve46(rel) === rel)
     return;
   await rm12(snapshot.dir, { recursive: true, force: true }).catch(() => {
     return;
@@ -111120,16 +111778,16 @@ async function snapshotUntracked(workdir, paths, dir) {
   await rm12(dir, { recursive: true, force: true }).catch(() => {
     return;
   });
-  await privateDirs(dirname32(dir), dir);
+  await privateDirs(dirname33(dir), dir);
   const { fileMax, totalMax } = _setAsideDeps.limits;
   const files = [];
   let total = 0;
   for (const path of paths) {
-    const st = await lstat5(join133(root, path)).catch(() => null);
+    const st = await lstat5(join134(root, path)).catch(() => null);
     if (!st?.isFile())
       continue;
     const fits = st.size <= fileMax && total + st.size <= totalMax;
-    const saved = fits && await copyFileInto(join133(root, path), join133(dir, path), true);
+    const saved = fits && await copyFileInto(join134(root, path), join134(dir, path), true);
     if (saved)
       total += st.size;
     files.push({ path, size: st.size, mtimeMs: st.mtimeMs, mode: st.mode & 511, saved });
@@ -111158,7 +111816,7 @@ async function restoreUntracked(workdir, snapshot, handoffPath) {
   const out = { restored: [], movedAside: [], failed: [] };
   const root = await repoRoot(workdir);
   for (const e of snapshot?.files ?? []) {
-    const file = join133(root, e.path);
+    const file = join134(root, e.path);
     if (!await insideRoot(root, file)) {
       out.failed.push(e.path);
       continue;
@@ -111166,10 +111824,10 @@ async function restoreUntracked(workdir, snapshot, handoffPath) {
     const st = await lstat5(file).catch(() => null);
     if (unchanged(st, e))
       continue;
-    const kept = !st?.isFile() || await copyFileInto(file, join133(handoffPath, "untracked-modified", e.path), true);
+    const kept = !st?.isFile() || await copyFileInto(file, join134(handoffPath, "untracked-modified", e.path), true);
     if (!kept) {
       out.failed.push(e.path);
-    } else if (e.saved && snapshot && await putBack(root, join133(snapshot.dir, e.path), file, e.mode)) {
+    } else if (e.saved && snapshot && await putBack(root, join134(snapshot.dir, e.path), file, e.mode)) {
       out.restored.push(e.path);
     } else if (!e.saved && st) {
       const removed = await _setAsideDeps.remove(file).then(() => true, () => false);
@@ -111180,7 +111838,7 @@ async function restoreUntracked(workdir, snapshot, handoffPath) {
   }
   return out;
 }
-var UNTRACKED_FILE_MAX = 1048576, UNTRACKED_TOTAL_MAX = 20971520, _setAsideDeps, PRIVATE_DIR = 448, PRIVATE_FILE = 384, realOrResolved = (path) => realpath5(path).catch(() => resolve45(path));
+var UNTRACKED_FILE_MAX = 1048576, UNTRACKED_TOTAL_MAX = 20971520, _setAsideDeps, PRIVATE_DIR = 448, PRIVATE_FILE = 384, realOrResolved = (path) => realpath5(path).catch(() => resolve46(path));
 var init_untracked_snapshot = __esm(() => {
   init_errors4();
   init_safe_path();
@@ -111193,9 +111851,9 @@ var init_untracked_snapshot = __esm(() => {
 
 // src/finish/set-aside.ts
 import { lstat as lstat6, mkdir as mkdir42, readFile as readFile11, writeFile as writeFile14 } from "fs/promises";
-import { join as join134 } from "path";
+import { join as join135 } from "path";
 function handoffDir(audit, n) {
-  return join134(audit.auditDir, `${audit.runId}.handoff-${n}`);
+  return join135(audit.auditDir, `${audit.runId}.handoff-${n}`);
 }
 function warn2(message, err) {
   getSafeLogger2()?.warn("finish", message, { storyId: "_run", error: errorMessage(err) });
@@ -111233,7 +111891,7 @@ async function dropIntent(root, created) {
 async function savePatch(root, dir, baseSha, created) {
   await addIntent(root, created);
   try {
-    const diff = await git3(["diff", "--binary", "--no-renames", `--output=${join134(dir, PATCH)}`, baseSha], root);
+    const diff = await git3(["diff", "--binary", "--no-renames", `--output=${join135(dir, PATCH)}`, baseSha], root);
     return diff.exitCode === 0;
   } finally {
     await dropIntent(root, created).catch(() => {
@@ -111250,7 +111908,7 @@ async function restoreKnown(root, baseSha, inBase) {
   return ok;
 }
 async function removeEntry(root, rel) {
-  const file = join134(root, rel);
+  const file = join135(root, rel);
   if (!await insideRoot(root, file))
     return false;
   if (!await lstat6(file).catch(() => null))
@@ -111273,7 +111931,7 @@ async function restorePaths(root, base, tracked, created) {
   return ok;
 }
 async function writeMeta(record) {
-  await writeFile14(join134(record.dir, META), `${JSON.stringify(record, null, 2)}
+  await writeFile14(join135(record.dir, META), `${JSON.stringify(record, null, 2)}
 `, "utf8");
 }
 function newRecord(args, dir, created, changedPaths) {
@@ -111302,7 +111960,7 @@ async function saveWork(args, root, record) {
   try {
     await mkdir42(record.dir, { recursive: true });
     if (args.note) {
-      await writeFile14(join134(record.dir, NOTE), `${JSON.stringify(args.note, null, 2)}
+      await writeFile14(join135(record.dir, NOTE), `${JSON.stringify(args.note, null, 2)}
 `, "utf8");
       record.hasNote = true;
     }
@@ -111356,7 +112014,7 @@ async function setAside(input) {
 async function readHandoffNote(record) {
   if (!record.hasNote)
     return;
-  const text = await readFile11(join134(record.dir, NOTE), "utf8").catch(() => null);
+  const text = await readFile11(join135(record.dir, NOTE), "utf8").catch(() => null);
   const parsed = text ? tryParseLLMJson(text) : null;
   return isHandoffNote(parsed) ? parsed : undefined;
 }
@@ -111364,7 +112022,7 @@ async function reapplyHandoff(workdir, record) {
   if (!record.patchSaved)
     return { applied: false, files: [] };
   const root = await repoRoot(workdir);
-  const patch = join134(record.dir, PATCH);
+  const patch = join135(record.dir, PATCH);
   const check = await git3(["apply", "--check", "--whitespace=nowarn", patch], root);
   if (check.exitCode !== 0)
     return { applied: false, files: [] };
@@ -111461,7 +112119,7 @@ var init_finalize_dirt = __esm(() => {
 });
 
 // src/finish/fix-step.ts
-import { join as join135 } from "path";
+import { join as join136 } from "path";
 function findingIdsOf(findings) {
   return (findings ?? []).map(findingId);
 }
@@ -111532,7 +112190,7 @@ async function captureBase(state, deps) {
     if (!captured) {
       return { error: new NaxError("Cannot read the worktree base", "FINISH_FIX_BASE", { stage: "finish" }) };
     }
-    const snapshotDir = join135(deps.audit.auditDir, `${deps.audit.runId}.fix-base-${state.handoffs.length + 1}`);
+    const snapshotDir = join136(deps.audit.auditDir, `${deps.audit.runId}.fix-base-${state.handoffs.length + 1}`);
     return {
       ...captured,
       untrackedSnapshot: await snapshotUntracked(state.workdir, captured.untrackedBefore, snapshotDir)
@@ -112308,7 +112966,7 @@ var init_gates_loop = __esm(() => {
 });
 
 // src/finish/review-inputs.ts
-import { join as join136, relative as relative41 } from "path";
+import { join as join137, relative as relative42 } from "path";
 function isRecord12(value) {
   return typeof value === "object" && value !== null;
 }
@@ -112327,13 +112985,13 @@ function storiesFromText(text) {
   return rows.flatMap((row) => isRecord12(row) && typeof row.id === "string" && typeof row.title === "string" ? [{ id: row.id, title: row.title }] : []);
 }
 async function loadReviewInputs(state, outputDir) {
-  const prdAbs = join136(featureDir(state.workdir, state.feature), "prd.json");
+  const prdAbs = join137(featureDir(state.workdir, state.feature), "prd.json");
   const [changed, hints, prdText] = await Promise.all([
     changedFiles(state.workdir, state.base),
     outputDir ? readA3Hints(outputDir, state.feature) : Promise.resolve([]),
     _reviewInputsDeps.readText(prdAbs)
   ]);
-  return { changed, hints, stories: storiesFromText(prdText), prdPath: relative41(state.workdir, prdAbs) };
+  return { changed, hints, stories: storiesFromText(prdText), prdPath: relative42(state.workdir, prdAbs) };
 }
 var _reviewInputsDeps;
 var init_review_inputs = __esm(() => {
@@ -112455,7 +113113,7 @@ async function decide3(state, deps, rdeps) {
   const advise = approvalAdvisor(deps.advise, asked);
   const run = async () => {
     const facts = currentFacts(state, rdeps.inputs.changed);
-    return { facts, res: await resolve44({ facts, advise, reReviewUsed: state.review.reReviewUsed }) };
+    return { facts, res: await resolve45({ facts, advise, reReviewUsed: state.review.reReviewUsed }) };
   };
   let out = await run();
   if (out.res.outcome === "re-review") {
@@ -113233,7 +113891,7 @@ var init_narrative = __esm(() => {
 
 // src/finish/pr/context.ts
 import { readFile as readFile12 } from "fs/promises";
-import { join as join137 } from "path";
+import { join as join138 } from "path";
 async function readJson(path) {
   let text;
   try {
@@ -113320,8 +113978,8 @@ function fromResolution(state) {
 async function loadFinishPrContext(args) {
   const featureDirPath = featureDir(args.state.workdir, args.state.feature);
   const [prd, status, rounds, stat, template, specSummary, advisorDecisions] = await Promise.all([
-    readJson(join137(featureDirPath, "prd.json")),
-    readJson(join137(featureDirPath, "status.json")),
+    readJson(join138(featureDirPath, "prd.json")),
+    readJson(join138(featureDirPath, "status.json")),
     readRounds(args.audit),
     runDiffstat(args.state.workdir, args.state.base),
     loadTemplate(args.state.workdir, args.forge),
@@ -114315,6 +114973,12 @@ function classifyGh(r) {
     return { state: "failed", summary };
   return checks.every((c) => GH_OK.has(c.bucket)) ? { state: "green", summary } : { state: "waiting", summary };
 }
+function glabPipelineSha(mr) {
+  const head = mr.head_pipeline;
+  const fallback = mr.pipeline;
+  const sha = (isRecord13(head) ? head.sha : undefined) ?? (isRecord13(fallback) ? fallback.sha : undefined);
+  return typeof sha === "string" ? sha : undefined;
+}
 function classifyGlab(r) {
   if (r.exitCode !== 0)
     return cliError(r);
@@ -114327,9 +114991,13 @@ function classifyGlab(r) {
   if (status === undefined)
     return glabWaiting(parsed.value);
   const summary = `CI pipeline: ${status}`;
-  if (status === "success") {
+  if (status === "manual" || status === "scheduled") {
+    return { state: "unavailable", detail: `pipeline is waiting on a ${status} job` };
+  }
+  if (status === "success" || status === "skipped") {
     const waiting = glabWaiting(parsed.value, summary);
-    return waiting.state === "conflicting" ? waiting : { state: "green", summary };
+    const sha = glabPipelineSha(parsed.value);
+    return waiting.state === "conflicting" ? waiting : { state: "green", summary, sha };
   }
   return GL_FAILED.has(status) ? { state: "failed", summary } : glabWaiting(parsed.value, summary);
 }
@@ -114344,7 +115012,7 @@ async function githubWaiting(poll, prRef, cwd) {
   if (poll.state !== "waiting" && poll.state !== "green")
     return poll;
   try {
-    const r = await _ciWaitDeps.run(["gh", "pr", "view", prRef, "--json", "mergeable,mergeStateStatus,baseRefName"], {
+    const r = await _ciWaitDeps.run(["gh", "pr", "view", prRef, "--json", "mergeable,mergeStateStatus,baseRefName,headRefOid"], {
       cwd
     });
     if (r.exitCode !== 0)
@@ -114353,7 +115021,9 @@ async function githubWaiting(poll, prRef, cwd) {
     if (!parsed.ok || !isRecord13(parsed.value))
       return poll;
     const mr = parsed.value;
-    return mr.mergeable === "CONFLICTING" || mr.mergeStateStatus === "DIRTY" ? conflictPoll(mr.baseRefName) : poll;
+    if (mr.mergeable === "CONFLICTING" || mr.mergeStateStatus === "DIRTY")
+      return conflictPoll(mr.baseRefName);
+    return typeof mr.headRefOid === "string" ? { ...poll, sha: mr.headRefOid } : poll;
   } catch {
     return poll;
   }
@@ -114410,7 +115080,18 @@ async function waitWithHeartbeat(ms, startedAt, progress) {
     progress.heartbeatIfDue(startedAt);
   }
 }
+function bindToHead(poll, expectedSha) {
+  if (poll.state !== "green" || !expectedSha || !poll.sha || poll.sha === expectedSha)
+    return poll;
+  return {
+    ...poll,
+    state: "waiting",
+    mismatch: `checks report ${poll.sha.slice(0, 8)} but HEAD is ${expectedSha.slice(0, 8)}`
+  };
+}
 function terminalPoll(poll) {
+  if (poll.state === "unavailable")
+    return { outcome: "unavailable", detail: poll.detail };
   if (poll.state === "green")
     return { outcome: "green", detail: "all checks passed" };
   if (poll.state === "failed")
@@ -114482,7 +115163,7 @@ async function waitForChecks(forge, prRef, opts) {
     for (;; ) {
       if (opts.signal?.aborted)
         return end("pending", "aborted");
-      const poll = await pollOnce(forge, prRef, opts.cwd);
+      const poll = bindToHead(await pollOnce(forge, prRef, opts.cwd), opts.expectedSha);
       history.note(poll);
       if ("summary" in poll)
         progress.note(poll.summary);
@@ -114490,6 +115171,8 @@ async function waitForChecks(forge, prRef, opts) {
       if (terminal)
         return end(terminal.outcome, terminal.detail);
       if (_ciWaitDeps.now() + opts.pollMs > deadline) {
+        if ("mismatch" in poll && poll.mismatch)
+          return end("unavailable", poll.mismatch);
         const timeout = errors.timeout() ?? history.timeout(opts.timeoutMs);
         return end(timeout.outcome, timeout.detail);
       }
@@ -114717,9 +115400,9 @@ var init_pr_body = __esm(() => {
 });
 
 // src/workflow/finalize.ts
-import { isAbsolute as isAbsolute31, join as join138 } from "path";
-function isPublishableBranch(branch) {
-  return !PROTECTED_BRANCHES.has(branch);
+import { isAbsolute as isAbsolute32, join as join139 } from "path";
+function isPublishableBranch(branch, defaultBranch) {
+  return !PROTECTED_BRANCHES.has(branch) && branch !== defaultBranch;
 }
 function workflowPrTitle(fc) {
   const raw = `feat(${fc.feature}): ${fc.prd.userStories.length} stories (nax workflow)`;
@@ -114728,7 +115411,8 @@ function workflowPrTitle(fc) {
 async function publishTarget(fc) {
   if (fc.dryRun)
     return { reason: "dry run" };
-  if (!isPublishableBranch(fc.branch))
+  const defaultBranch = await readDefaultBranch(fc.projectDir);
+  if (!isPublishableBranch(fc.branch, defaultBranch))
     return { reason: `branch "${fc.branch || "(empty)"}" is not a feature branch` };
   const forge = await _featureDeps.detectForge(fc.projectDir);
   return forge ? { forge } : { reason: "no forge detected (origin is not GitHub or GitLab)" };
@@ -114766,7 +115450,7 @@ async function loadAssumptions(stories) {
     if (!s.runDir)
       continue;
     try {
-      const file = Bun.file(join138(workflowStoryDir(s.runDir, s.id), "report.md"));
+      const file = Bun.file(join139(workflowStoryDir(s.runDir, s.id), "report.md"));
       const text = await file.exists() ? extractAssumptions(await file.text()) : "";
       if (text)
         out.push({ storyId: s.id, text });
@@ -114779,7 +115463,7 @@ async function specClosingIssues(fc) {
     const rel = (await _workflowDeps.resolveFeatureSpec(fc.feature, fc.projectDir)).specSource?.path;
     if (!rel)
       return;
-    const abs = isAbsolute31(rel) ? rel : join138(fc.projectDir, rel);
+    const abs = isAbsolute32(rel) ? rel : join139(fc.projectDir, rel);
     const closes = parseClosingIssues(await Bun.file(abs).text());
     return closes.length > 0 ? closes : undefined;
   } catch {
@@ -114905,9 +115589,19 @@ async function pushLedger(fc) {
     });
   }
 }
-function waitForCi(fc, forge) {
+async function waitForCi(fc, forge) {
+  let expectedSha;
+  try {
+    expectedSha = await readHead(fc.projectDir) || undefined;
+  } catch (err) {
+    getSafeLogger2()?.warn("workflow", "Could not read pushed HEAD \u2014 CI SHA comparison unavailable", {
+      storyId: "_run",
+      error: errorMessage(err)
+    });
+  }
   return _featureDeps.waitForChecks(forge, fc.branch, {
     cwd: fc.projectDir,
+    ...expectedSha ? { expectedSha } : {},
     timeoutMs: fc.workflow.timeouts.ciWaitMs,
     pollMs: fc.workflow.timeouts.ciPollMs,
     ...fc.runSignal ? { signal: fc.runSignal } : {}
@@ -115229,6 +115923,7 @@ function featureModelFor(fc) {
         timeoutMs: NO_TIMEOUT,
         minorIds: [],
         requiredFiles: [],
+        repoRoot: fc.projectDir,
         range: ""
       });
     }
@@ -115299,7 +115994,7 @@ var init_tokens = __esm(() => {
 
 // src/workflow/tool-error-outcome.ts
 import { readdir as readdir11, readFile as readFile13 } from "fs/promises";
-import { join as join139 } from "path";
+import { join as join140 } from "path";
 function targetOf(row) {
   for (const field of TARGET_FIELDS) {
     const value = row.input?.[field];
@@ -115356,7 +116051,7 @@ async function readToolEntriesSince(scope, sinceMs) {
   const entries = [];
   for (const { name, stamp } of stamped) {
     try {
-      const body = JSON.parse(await readFile13(join139(dir, name), "utf8"));
+      const body = JSON.parse(await readFile13(join140(dir, name), "utf8"));
       for (const [index, row] of (body.calls ?? []).entries()) {
         entries.push({ key: `${name}#${index}`, row, fileStamp: stamp });
       }
@@ -115941,225 +116636,6 @@ var init_feature_machine = __esm(() => {
   };
 });
 
-// src/workflow/preflight.ts
-import { rename as rename12 } from "fs/promises";
-import { join as join140 } from "path";
-function preflightPath(runDir) {
-  return join140(runDir, "preflight.json");
-}
-function what(d) {
-  return d.action.type === "supersede" ? `supersede ${describeTarget(d.action.target)}` : d.action.type;
-}
-function isRecordObject(v) {
-  return typeof v === "object" && v !== null && !Array.isArray(v);
-}
-function isStringArray2(v) {
-  return Array.isArray(v) && v.every((s) => typeof s === "string");
-}
-function isOverlapEntry(v) {
-  return isRecordObject(v) && typeof v.storyId === "string" && isStringArray2(v.specSections);
-}
-function isConflictRecord(v) {
-  return isRecordObject(v) && typeof v.questionId === "string" && isStringArray2(v.storyIds) && typeof v.summary === "string" && (v.decisionId === null || typeof v.decisionId === "string") && typeof v.action === "string";
-}
-function isReusable(v) {
-  if (!isRecordObject(v) || v.schemaVersion !== 1 || v.fallbackReason)
-    return false;
-  return Array.isArray(v.overlap) && v.overlap.every(isOverlapEntry) && Array.isArray(v.conflicts) && v.conflicts.every(isConflictRecord);
-}
-async function readExisting(path) {
-  const file = Bun.file(path);
-  if (!await file.exists())
-    return null;
-  try {
-    const parsed = JSON.parse(await file.text());
-    if (isReusable(parsed))
-      return parsed;
-    getLogger2().warn("workflow", "preflight.json is unusable (wrong shape or failed pre-flight) - re-running", {
-      storyId: "_run",
-      reason: "wrong-shape-or-fallback"
-    });
-  } catch (err) {
-    getLogger2().warn("workflow", "preflight.json is unreadable - re-running pre-flight", {
-      storyId: "_run",
-      reason: err instanceof Error ? err.message : String(err)
-    });
-  }
-  return null;
-}
-async function runPreflight(input) {
-  const path = preflightPath(input.runDir);
-  const existing = await readExisting(path);
-  if (existing)
-    return existing;
-  const result = await input.advisor.adviseBatch({
-    kind: "preflight",
-    summary: `Pre-flight for ${input.storyIds.length} stories.`,
-    storyIds: [...input.storyIds]
-  });
-  const items = result.kind === "preflight" ? result.items : [];
-  const conflicts = items.map((item) => ({
-    questionId: item.question.id,
-    storyIds: item.decision?.appliesTo ?? (item.question.storyId ? [item.question.storyId] : []),
-    summary: item.question.summary,
-    decisionId: item.decision?.id ?? null,
-    action: item.decision?.action.type ?? "hold",
-    ...item.fallbackReason ? { fallbackReason: item.fallbackReason } : {}
-  }));
-  const file = {
-    schemaVersion: 1,
-    overlap: result.kind === "preflight" ? result.overlap : [],
-    conflicts,
-    ...result.kind === "preflight" && result.fallbackReason ? { fallbackReason: result.fallbackReason } : {}
-  };
-  const tmp = `${path}.tmp`;
-  await Bun.write(tmp, `${JSON.stringify(file, null, 2)}
-`);
-  await rename12(tmp, path);
-  for (const [i, item] of items.entries()) {
-    const record = conflicts[i];
-    if (!record)
-      continue;
-    const text = item.decision ? ledgerText.ruling({
-      action: "hold",
-      text: `pre-flight ${item.decision.id}: ${what(item.decision)}`,
-      why: item.decision.rationale,
-      costIfWrong: costIfWrongOf(item.decision),
-      source: "advisor"
-    }) : ledgerText.ruling({
-      action: "hold",
-      text: "pre-flight hold (default)",
-      why: item.fallbackReason ?? "no advisor ruling",
-      costIfWrong: "the story runs under the spec as written",
-      source: "default"
-    });
-    for (const storyId of record.storyIds)
-      await input.ledger(storyId, text);
-  }
-  return file;
-}
-var isReusablePreflight;
-var init_preflight = __esm(() => {
-  init_advisor();
-  init_logger2();
-  init_advisor_live();
-  init_ledger2();
-  isReusablePreflight = isReusable;
-});
-
-// src/workflow/feature-record.ts
-import { basename as basename22 } from "path";
-function newFeatureRecord(input) {
-  return {
-    step: "repo-gates",
-    startedAt: input.now,
-    ...input.head ? { startHead: input.head } : {},
-    seed: input.seed,
-    gateFindings: [],
-    reviewRan: false,
-    reviewOpen: [],
-    minors: input.minors,
-    newMinors: [],
-    nextFindingId: 1,
-    fixRan: false,
-    rulings: [],
-    reasons: [],
-    timings: {},
-    tokensByRole: {}
-  };
-}
-function minorsFrom(deferred) {
-  return deferred.map((m, i) => ({ id: `M${i + 1}`, storyId: m.storyId, text: m.text, triage: "leave" }));
-}
-async function collectStoryRecords(featureDir) {
-  const found = new Map;
-  for (const runDir of await runDirsNewestFirst(featureDir)) {
-    const stories = (await readResult(runDir))?.stories ?? {};
-    for (const [id, record] of Object.entries(stories)) {
-      if (!found.has(id))
-        found.set(id, { record, runDir });
-    }
-  }
-  return Object.fromEntries(found);
-}
-function isFeatureRecord(v) {
-  if (typeof v !== "object" || v === null)
-    return false;
-  const o = v;
-  return FEATURE_STEPS.includes(o.step) && typeof o.nextFindingId === "number" && Array.isArray(o.gateFindings) && Array.isArray(o.reviewOpen) && Array.isArray(o.minors) && Array.isArray(o.rulings) && Array.isArray(o.reasons);
-}
-async function loadPriorFeature(featureDir, currentRunId) {
-  for (const runDir of await runDirsNewestFirst(featureDir)) {
-    if (basename22(runDir) === currentRunId)
-      continue;
-    const feature = (await readResult(runDir))?.featureWorkflow;
-    if (feature === undefined)
-      continue;
-    if (isFeatureRecord(feature))
-      return feature;
-    getSafeLogger2()?.warn("workflow", "Prior feature record is malformed \u2014 ignored", { storyId: "_run", runDir });
-  }
-  return null;
-}
-function fromRecord(id, title, located) {
-  const r = located.record;
-  if (!r.state)
-    return null;
-  return {
-    id,
-    title,
-    state: r.state,
-    ...r.reason ? { reason: r.reason } : {},
-    rounds: r.round,
-    unreviewed: r.unreviewed,
-    flagged: r.flagged ?? 0,
-    runDir: located.runDir
-  };
-}
-function summariseStories(prd, records) {
-  return prd.userStories.map((s) => {
-    const located = records[s.id];
-    const closed = located ? fromRecord(s.id, s.title, located) : null;
-    if (closed)
-      return closed;
-    const base = { id: s.id, title: s.title, unreviewed: false, flagged: 0 };
-    if (s.passes || s.status === "passed")
-      return { ...base, state: "complete", reason: PASSED_EARLIER, rounds: 0 };
-    return { ...base, state: "not-run", rounds: located?.record.round ?? 0 };
-  });
-}
-async function newestPreflight(featureDir) {
-  for (const runDir of await runDirsNewestFirst(featureDir)) {
-    const path = preflightPath(runDir);
-    const file = Bun.file(path);
-    if (!await file.exists())
-      continue;
-    try {
-      const parsed = JSON.parse(await file.text());
-      if (isReusablePreflight(parsed))
-        return { path, file: parsed };
-    } catch {}
-  }
-  return null;
-}
-var FEATURE_STEPS, PASSED_EARLIER = "passed earlier, no workflow record";
-var init_feature_record = __esm(() => {
-  init_logger2();
-  init_preflight();
-  init_result();
-  FEATURE_STEPS = [
-    "repo-gates",
-    "branch-review",
-    "branch-fix",
-    "branch-rereview",
-    "adjudicate",
-    "final-gates",
-    "gate-repair",
-    "publish",
-    "done"
-  ];
-});
-
 // src/workflow/ledger-items.ts
 function parseLine(line) {
   const m = LINE.exec(line);
@@ -116295,6 +116771,8 @@ async function resumeOrRestart(fc, prior, head) {
   };
 }
 async function startRecord(fc, prior, head) {
+  if (isFinishedAtHead(prior, head) && isTransientDraft(prior))
+    return { ...prior, step: "publish" };
   return prior && prior.step !== "done" ? resumeOrRestart(fc, prior, head) : freshRecord(fc, head);
 }
 function logComplete(stories, rec) {
@@ -116312,6 +116790,9 @@ function logHandOff(stories, storiesDurationMs) {
   const took = storiesDurationMs === undefined ? "" : ` (${formatDuration(storiesDurationMs)})`;
   logWorkflow(FEATURE_SCOPE, `stories done ${ran}/${stories.length}${took} - feature workflow start`);
 }
+function isTransientDraft(prior) {
+  return prior.outcome === "draft" && (prior.ci === "unavailable" || prior.reasons.some((reason) => reason.startsWith("PR update failed:")));
+}
 function isFinishedAtHead(prior, head) {
   const done = prior?.outcome === "ready" || prior?.outcome === "draft" || prior?.outcome === "pushed";
   return prior?.step === "done" && head !== undefined && head !== "" && prior.head === head && done;
@@ -116321,7 +116802,7 @@ async function runInContext(fc, input, meter) {
   const stories = summariseStories(fc.prd, await collectStoryRecords(fc.featureDir));
   const prior = await loadPriorFeature(fc.featureDir, fc.runId);
   const head = await currentHead(fc);
-  if (isFinishedAtHead(prior, head)) {
+  if (isFinishedAtHead(prior, head) && !isTransientDraft(prior)) {
     const current = {
       ...prior,
       passed: featurePassed({ ...prior.finalGates ? { finalGates: prior.finalGates } : {}, stories })
@@ -116389,12 +116870,16 @@ async function storePreflightTokens(meter, where) {
     });
   }
 }
-async function adoptPriorPreflight(featureDir, runDir) {
+async function adoptPriorPreflight(featureDir, runDir, storyIds) {
   if (await Bun.file(preflightPath(runDir)).exists())
     return false;
   const prior = await newestPreflight(featureDir);
   if (!prior)
     return false;
+  const covered = new Set(prior.file.storyIds);
+  const pending = new Set(storyIds);
+  if (covered.size !== pending.size || [...pending].some((id) => !covered.has(id)))
+    return false;
   await mkdir43(runDir, { recursive: true });
   await Bun.write(preflightPath(runDir), `${JSON.stringify(prior.file, null, 2)}
 `);
@@ -116415,7 +116900,7 @@ async function runWorkflowPreflight(input) {
     const { fc } = built;
     here = { runDir: fc.runDir, header: { runId: fc.runId, feature: fc.feature } };
     await ensureLedger(fc.runDir, fc.runId, fc.feature);
-    if (await adoptPriorPreflight(fc.featureDir, fc.runDir)) {
+    if (await adoptPriorPreflight(fc.featureDir, fc.runDir, storyIds)) {
       getSafeLogger2()?.info("workflow", "Reusing the pre-flight of an earlier run", { storyId: "_run" });
     }
     const advisor = _workflowDeps.createAdvisor({
@@ -116854,6 +117339,7 @@ class LoopState {
   suiteThisIteration = false;
   costStop = false;
   constructor(resume) {
+    this.fixBase = resume?.fixBase;
     this.round = resume?.round ?? 0;
     this.reviewed = resume?.reviewed ?? false;
     this.unreviewed = resume?.unreviewed ?? false;
@@ -117004,6 +117490,7 @@ async function runStoryLoop(env) {
     s.pendingSession = [];
     await env.sink.update({
       openFindings: open,
+      fixBase: s.fixBase,
       reviewed: s.reviewed,
       unreviewed: s.unreviewed,
       nextFindingId: s.nextId,
@@ -117029,7 +117516,7 @@ async function runStoryLoop(env) {
     if (s.reviewOpen.length > 0 && s.fixBase === undefined)
       s.fixBase = await env.steps.head();
     await env.sink.ledger(ledgerText.fixRound(s.round, env.maxFixRounds, `${open.length} open: ${open.map((f) => f.id).join(", ")}${fresh ? ", fresh" : ""}`));
-    await env.sink.update({ phase: "fix", round: s.round });
+    await env.sink.update({ phase: "fix", round: s.round, fixBase: s.fixBase });
     const turn = {
       kind: "fix",
       round: s.round,
@@ -120977,7 +121464,7 @@ var init_rtk = __esm(() => {
 
 // src/execution/status-file.ts
 import { rename as rename13, unlink as unlink9 } from "fs/promises";
-import { resolve as resolve46 } from "path";
+import { resolve as resolve47 } from "path";
 function countProgress(prd) {
   const stories = prd.userStories;
   const passed = stories.filter((s) => s.status === "passed").length;
@@ -121037,7 +121524,7 @@ function buildStatusSnapshot(state) {
   return snapshot;
 }
 async function writeStatusFile(filePath, status) {
-  const resolvedPath = resolve46(filePath);
+  const resolvedPath = resolve47(filePath);
   if (filePath.includes("../") || filePath.includes("..\\")) {
     throw new NaxError("Invalid status file path: path traversal detected", "STATUS_FILE_PATH_TRAVERSAL", {
       stage: "execution",
@@ -124710,7 +125197,7 @@ var init_language_commands = __esm(() => {
 });
 
 // src/review/scoped-lint.ts
-import { join as join151, relative as relative43 } from "path";
+import { join as join151, relative as relative44 } from "path";
 function normalizePath3(path) {
   return path.replaceAll("\\", "/").replace(/^\.\//, "");
 }
@@ -124736,7 +125223,7 @@ async function listChangedFiles(workdir, baseRef) {
 function inferActivePackageDir(workdir, projectDir) {
   if (!projectDir)
     return;
-  const rel = normalizePath3(relative43(projectDir, workdir));
+  const rel = normalizePath3(relative44(projectDir, workdir));
   if (!rel || rel === "." || rel.startsWith(".."))
     return;
   return rel;
@@ -125504,14 +125991,14 @@ var init_run_setup_init = __esm(() => {
 
 // src/commands/common.ts
 import { existsSync as existsSync29, readdirSync as readdirSync5, realpathSync as realpathSync6 } from "fs";
-import { join as join152, resolve as resolve48 } from "path";
+import { join as join152, resolve as resolve49 } from "path";
 function resolveProject(options = {}) {
   const { dir, feature } = options;
   let projectRoot;
   let naxDir;
   let configPath;
   if (dir) {
-    projectRoot = realpathSync6(resolve48(dir));
+    projectRoot = realpathSync6(resolve49(dir));
     naxDir = join152(projectRoot, ".nax");
     if (!existsSync29(naxDir)) {
       throw new NaxError(`Directory does not contain a nax project: ${projectRoot}
@@ -125589,7 +126076,7 @@ async function resolveProjectAsync(options = {}) {
   if (!dir) {
     return resolveProject(options);
   }
-  if (existsSync29(resolve48(dir))) {
+  if (existsSync29(resolve49(dir))) {
     return resolveProject(options);
   }
   const isPlainName = !dir.includes("/") && !dir.includes("\\");
@@ -125605,17 +126092,17 @@ async function resolveProjectAsync(options = {}) {
       } catch {}
     }
     throw new NaxError(`No project found for name or path: "${dir}"
-Checked filesystem path: ${resolve48(dir)}
+Checked filesystem path: ${resolve49(dir)}
 Checked identity registry: ${registryIdentityPath}
-Tip: use an absolute or relative path, or run "nax init" in your project directory first.`, "PROJECT_NOT_FOUND", { dir, resolvedPath: resolve48(dir), registryIdentityPath });
+Tip: use an absolute or relative path, or run "nax init" in your project directory first.`, "PROJECT_NOT_FOUND", { dir, resolvedPath: resolve49(dir), registryIdentityPath });
   }
   try {
     return resolveProject(options);
   } catch (err) {
     if (err instanceof Error && "code" in err && err.code === "ENOENT") {
-      throw new NaxError(`Path does not exist: ${resolve48(dir)}`, "PROJECT_NOT_FOUND", {
+      throw new NaxError(`Path does not exist: ${resolve49(dir)}`, "PROJECT_NOT_FOUND", {
         dir,
-        resolvedPath: resolve48(dir),
+        resolvedPath: resolve49(dir),
         cause: err
       });
     }
@@ -125623,7 +126110,7 @@ Tip: use an absolute or relative path, or run "nax init" in your project directo
   }
 }
 function findProjectRoot(startDir) {
-  let current = resolve48(startDir);
+  let current = resolve49(startDir);
   let depth = 0;
   while (depth < MAX_DIRECTORY_DEPTH) {
     const naxDir = join152(current, ".nax");
@@ -125650,7 +126137,7 @@ var init_common = __esm(() => {
 // src/commands/curator.ts
 import { readdirSync as readdirSync6 } from "fs";
 import { unlink as unlink11 } from "fs/promises";
-import { join as join153, resolve as resolve49, sep as sep26 } from "path";
+import { join as join153, resolve as resolve50, sep as sep26 } from "path";
 function openInEditor(filePath) {
   const [editor, ...args] = parseCommandToArgv(process.env.EDITOR ?? process.env.VISUAL ?? "vi");
   if (!editor)
@@ -125794,15 +126281,15 @@ async function curatorStatus(options) {
   }
 }
 function resolveCanonicalTargetPath(projectDir, canonicalFile) {
-  const target = resolve49(projectDir, canonicalFile);
-  const root = resolve49(projectDir);
+  const target = resolve50(projectDir, canonicalFile);
+  const root = resolve50(projectDir);
   if (target !== root && !target.startsWith(root + sep26))
     return null;
   const relative = target.slice(root.length + 1).replaceAll(sep26, "/");
   return CURATOR_TARGET_SHAPES.some((shape) => shape.test(relative)) ? target : null;
 }
 function isWithinCanonicalRulesDir(projectDir, targetPath) {
-  const rulesRoot = resolve49(projectDir, CANONICAL_RULES_DIR);
+  const rulesRoot = resolve50(projectDir, CANONICAL_RULES_DIR);
   return targetPath === rulesRoot || targetPath.startsWith(rulesRoot + sep26);
 }
 async function curatorCommit(options) {
@@ -127069,7 +127556,7 @@ function renderReport(timeline, options = {}) {
 
 // src/commands/replay.ts
 import { existsSync as existsSync34 } from "fs";
-import { dirname as dirname36 } from "path";
+import { dirname as dirname37 } from "path";
 async function readJsonlLenient(path) {
   if (!existsSync34(path))
     return [];
@@ -127098,7 +127585,7 @@ async function readJsonOrUndefined(path) {
 }
 async function readMetricsFromProject(meta) {
   await Promise.resolve().then(() => init_tracker());
-  const outputDir = dirname36(dirname36(dirname36(meta.eventsDir)));
+  const outputDir = dirname37(dirname37(dirname37(meta.eventsDir)));
   const all = await loadRunMetrics(outputDir);
   return all.find((m) => m.runId === meta.runId);
 }
@@ -129255,7 +129742,7 @@ var init_tdd_failure_category = __esm(() => {
 });
 
 // src/execution/uncategorised-advice.ts
-import { join as join162, relative as relative44 } from "path";
+import { join as join162, relative as relative45 } from "path";
 function callContextFor(ctx) {
   return {
     runtime: ctx.runtime,
@@ -129306,7 +129793,7 @@ async function adviseUncategorised(frame, pauseReason) {
     outputDir: ctx.runtime.outputDir,
     feature,
     runId: ctx.runtime.runId,
-    specPath: relative44(repoRoot, join162(featureDir(repoRoot, feature), "spec.md")),
+    specPath: relative45(repoRoot, join162(featureDir(repoRoot, feature), "spec.md")),
     workdir: ctx.workdir,
     ...headsUpChannel(ctx)
   });
@@ -133130,7 +133617,7 @@ var init_checks_native_credentials = __esm(() => {
 
 // src/precheck/checks-warnings.ts
 import { existsSync as existsSync39 } from "fs";
-import { isAbsolute as isAbsolute34 } from "path";
+import { isAbsolute as isAbsolute35 } from "path";
 async function checkClaudeMdExists(workdir) {
   const claudeMdPath = `${workdir}/CLAUDE.md`;
   const passed = existsSync39(claudeMdPath);
@@ -133299,7 +133786,7 @@ async function checkPromptOverrideFiles(config, workdir) {
 }
 async function checkHomeEnvValid() {
   const home = process.env.HOME ?? "";
-  const passed = home !== "" && isAbsolute34(home);
+  const passed = home !== "" && isAbsolute35(home);
   return {
     name: "home-env-valid",
     tier: "warning",
@@ -134257,12 +134744,12 @@ var init_finalize_routing = __esm(() => {
 
 // src/plan/strategies/persist-prd.ts
 import { existsSync as defaultExistsSync, renameSync as defaultRenameSync } from "fs";
-import { dirname as dirname37, join as join169 } from "path";
+import { dirname as dirname38, join as join169 } from "path";
 function unverifiedStampedStoryIds(prd) {
   return prd.userStories.filter((story) => story.workdirSource !== undefined && (story.contextFiles?.length ?? 0) + (story.expectedFiles?.length ?? 0) + (story.modifiedFiles?.length ?? 0) > 0).map((story) => story.id);
 }
 function moveDraftAside(outputPath) {
-  const rejectedPath = join169(dirname37(outputPath), "prd.rejected.json");
+  const rejectedPath = join169(dirname38(outputPath), "prd.rejected.json");
   if (!_persistPrdDeps.existsSync(outputPath)) {
     return { phrase: `no draft was on disk at ${outputPath}` };
   }
@@ -135528,13 +136015,13 @@ var init_rules_cli_deps = __esm(() => {
 });
 
 // src/cli/rules-migrate-plan.ts
-import { resolve as resolve50, sep as sep27 } from "path";
+import { resolve as resolve51, sep as sep27 } from "path";
 async function planMigration(sources, options) {
   const writes = [];
   const skips = [];
-  const resolvedTargetDir = resolve50(options.targetDir);
+  const resolvedTargetDir = resolve51(options.targetDir);
   for (const source of sources) {
-    const resolvedTargetPath = resolve50(source.targetPath);
+    const resolvedTargetPath = resolve51(source.targetPath);
     if (!resolvedTargetPath.startsWith(`${resolvedTargetDir}${sep27}`) && resolvedTargetPath !== resolvedTargetDir) {
       throw new NaxError(`Migration target escapes ${options.targetDir}: ${source.targetFileName} -> ${source.targetPath}`, "RULES_MIGRATE_TARGET_ESCAPE", { stage: "rules-migrate-plan", targetDir: options.targetDir, entry: source.targetPath });
     }
@@ -135677,7 +136164,7 @@ var init_rules_migrate = __esm(() => {
 });
 
 // src/cli/rules.ts
-import { join as join178, resolve as resolve51, sep as sep28 } from "path";
+import { join as join178, resolve as resolve52, sep as sep28 } from "path";
 async function rulesLintCommand2(options) {
   return rulesLintCommand(options, {
     globCanonicalRuleFiles: _rulesCLIDeps.globCanonicalRuleFiles,
@@ -135728,8 +136215,8 @@ async function exportRuleDirectory(input) {
   const drifted = [];
   for (const rule of rules) {
     const rel = rule.path ?? rule.fileName;
-    const target = resolve51(workdir, ruleDir, rel);
-    if (!target.startsWith(`${resolve51(workdir, ruleDir)}${sep28}`)) {
+    const target = resolve52(workdir, ruleDir, rel);
+    if (!target.startsWith(`${resolve52(workdir, ruleDir)}${sep28}`)) {
       throw new NaxError(`Rule path escapes ${ruleDir}: ${rel}`, "RULES_EXPORT_PATH_ESCAPE", {
         stage: "rules-export",
         rule: rel
@@ -135749,9 +136236,9 @@ async function exportRuleDirectory(input) {
     }
     await _rulesCLIDeps.writeFile(target, content);
   }
-  const expected = new Set(rules.map((r) => resolve51(workdir, ruleDir, r.path ?? r.fileName)));
+  const expected = new Set(rules.map((r) => resolve52(workdir, ruleDir, r.path ?? r.fileName)));
   for (const existing of _rulesCLIDeps.globInDir(join178(workdir, ruleDir))) {
-    if (!expected.has(resolve51(existing))) {
+    if (!expected.has(resolve52(existing))) {
       _rulesCLIDeps.getLogger().warn("rules-export", "Generated rules dir contains a file with no canonical source", {
         file: existing,
         hint: `Delete it, or add the rule to ${CANONICAL_RULES_DIR}/`
@@ -136656,7 +137143,7 @@ var init_status_features_details = __esm(() => {
 
 // src/cli/status-features.ts
 import { existsSync as existsSync46, readdirSync as readdirSync10 } from "fs";
-import { basename as basename34, join as join185, resolve as resolve52 } from "path";
+import { basename as basename34, join as join185, resolve as resolve53 } from "path";
 async function loadStatusFile(featureDir) {
   const statusPath = join185(featureDir, "status.json");
   if (!existsSync46(statusPath)) {
@@ -136883,7 +137370,7 @@ async function displayFeatureDetails(featureName, featureDir) {
   }
 }
 function resolveRootFromDir(dir) {
-  const resolved = resolve52(dir);
+  const resolved = resolve53(dir);
   const naxDir = _statusFeaturesDeps.findProjectDir(resolved);
   return naxDir ? join185(naxDir, "..") : resolved;
 }
@@ -137025,12 +137512,12 @@ var init_status_dispatch = __esm(() => {
 
 // src/cli/trust.ts
 import { homedir as osHomedir2 } from "os";
-import { resolve as resolve53 } from "path";
+import { resolve as resolve54 } from "path";
 function unreadableStoreLine(reason) {
   return trustStoreUnreadableError(trustStorePath(), reason).message;
 }
 function resolveAgainstCwd(path, deps) {
-  return path === undefined ? deps.cwd() : resolve53(deps.cwd(), path);
+  return path === undefined ? deps.cwd() : resolve54(deps.cwd(), path);
 }
 function foldersOf(read) {
   return read.state === "ok" ? read.file.folders : [];