@outcomeeng/spx 0.6.10 → 0.6.12

package/dist/cli.js

@@ -289,9 +289,6 @@ async function resolveAgentResumeScopeContext(options) {
     return { match: (core) => core.branch === target, claudeDirAccepts: () => true };
   }
   const invocationRoot = await options.resolveWorktreeRoot(options.invocationDir);
-  if (invocationRoot === null) {
-    return null;
-  }
   const projectPrefix = claudeProjectDirName(invocationRoot);
   return {
     match: (core) => isPathInsideOrEqual(invocationRoot, core.cwd),
@@ -326,11 +323,11 @@ function renderAgentResumeJson(candidates) {
 }
 async function recentStoreFiles(paths, fs8, nowMs) {
   const stats = await mapWithConcurrency(paths, AGENT_RESUME_LIMITS.READ_CONCURRENCY, async (path7) => {
-    const stat8 = await fs8.stat(path7).catch(() => null);
-    if (stat8 === null || !isRecentAgentSessionMtime(stat8.mtimeMs, nowMs)) {
+    const stat9 = await fs8.stat(path7).catch(() => null);
+    if (stat9 === null || !isRecentAgentSessionMtime(stat9.mtimeMs, nowMs)) {
       return null;
     }
-    return { path: path7, modifiedAtMs: stat8.mtimeMs };
+    return { path: path7, modifiedAtMs: stat9.mtimeMs };
   });
   return stats.filter((file) => file !== null).sort((left, right) => right.modifiedAtMs - left.modifiedAtMs || left.path.localeCompare(right.path));
 }
@@ -529,6 +526,195 @@ async function mapWithConcurrency(items, concurrency, mapper) {
   return results;
 }
 
+// src/domains/session/types.ts
+var SESSION_PRIORITY = {
+  HIGH: "high",
+  MEDIUM: "medium",
+  LOW: "low"
+};
+var SESSION_STATUSES = ["todo", "doing", "archive"];
+var DEFAULT_LIST_STATUSES = ["doing", "todo"];
+var SESSION_FILE_ENCODING = "utf-8";
+var SESSION_FILE_ERROR_CODE = {
+  NOT_FOUND: "ENOENT"
+};
+var SESSION_OUTPUT_MARKER = {
+  HANDOFF_ID: "HANDOFF_ID",
+  PICKUP_ID: "PICKUP_ID",
+  SESSION_FILE: "SESSION_FILE"
+};
+function formatSessionOutputMarker(marker, value) {
+  return `<${marker}>${value}</${marker}>`;
+}
+var CLAIMABLE_STATUS = SESSION_STATUSES[0];
+var PRIORITY_ORDER = {
+  [SESSION_PRIORITY.HIGH]: 0,
+  [SESSION_PRIORITY.MEDIUM]: 1,
+  [SESSION_PRIORITY.LOW]: 2
+};
+var DEFAULT_PRIORITY = SESSION_PRIORITY.MEDIUM;
+var SESSION_FRONT_MATTER = {
+  PRIORITY: "priority",
+  GIT_REF: "git_ref",
+  GOAL: "goal",
+  NEXT_STEP: "next_step",
+  CREATED_AT: "created_at",
+  AGENT_SESSION_ID: "agent_session_id",
+  SPECS: "specs",
+  FILES: "files"
+};
+
+// src/domains/agent/search.ts
+var AGENT_SEARCH_DEFAULT_LIMIT = 20;
+var AGENT_SEARCH_MATCH_REASON = {
+  ALL: "all",
+  PICKUP_ID: "pickup-id",
+  CONTAINS: "contains",
+  SESSION_ID: "session-id",
+  AGENT: "agent",
+  BRANCH: "branch"
+};
+function pickupIdSearchLiteral(pickupId) {
+  return formatSessionOutputMarker(SESSION_OUTPUT_MARKER.PICKUP_ID, pickupId);
+}
+function agentSearchQueryFromOptions(options) {
+  const contentNeedles = [];
+  if (options.pickupId !== void 0) {
+    contentNeedles.push({
+      reason: AGENT_SEARCH_MATCH_REASON.PICKUP_ID,
+      value: pickupIdSearchLiteral(options.pickupId)
+    });
+  }
+  if (options.contains !== void 0) {
+    contentNeedles.push({ reason: AGENT_SEARCH_MATCH_REASON.CONTAINS, value: options.contains });
+  }
+  return {
+    contentNeedles,
+    sessionId: options.sessionId ?? null,
+    branch: options.branch ?? null,
+    agent: options.agent ?? null,
+    includeAll: options.all === true,
+    limit: options.limit ?? AGENT_SEARCH_DEFAULT_LIMIT
+  };
+}
+async function searchAgentSessions(options) {
+  const selectedAgents = options.query.agent === null ? [AGENT_SESSION_KIND.CODEX, AGENT_SESSION_KIND.CLAUDE_CODE] : [options.query.agent];
+  const perAgent = await Promise.all(
+    selectedAgents.map((agent) => searchAgentStore(agent, options))
+  );
+  return perAgent.flat().sort(compareSearchResults).slice(0, Math.max(0, options.query.limit));
+}
+function renderAgentSearchJson(results) {
+  return JSON.stringify(results, null, 2);
+}
+function renderAgentSearchList(results) {
+  if (results.length === 0) {
+    return "No matching agent sessions found.";
+  }
+  return results.map((result) => {
+    const updatedAt = result.updatedAt ?? new Date(result.modifiedAtMs).toISOString();
+    return `${updatedAt} ${AGENT_SESSION_LABEL[result.agent]} ${result.sessionId} ${result.cwd}`;
+  }).join("\n");
+}
+async function searchAgentStore(agent, options) {
+  const paths = agent === AGENT_SESSION_KIND.CODEX ? await collectJsonlFiles(codexSessionStoreDir(options.homeDir), options.fs) : await claudeTranscriptFiles(
+    claudeCodeSessionStoreDir(options.homeDir),
+    options.fs,
+    claudeDirAcceptsProductScope(options.productScopeRoot)
+  );
+  const files = await storeFiles(paths, options.fs, options.nowMs, options.query.includeAll);
+  const parser = agent === AGENT_SESSION_KIND.CODEX ? parseCodexHead : parseClaudeHead;
+  return collectMatchingSessions(agent, files, options, parser);
+}
+function claudeDirAcceptsProductScope(productScopeRoot) {
+  const projectPrefix = claudeProjectDirName(productScopeRoot);
+  return (dirName) => dirName === projectPrefix || dirName.startsWith(`${projectPrefix}${CLAUDE_PROJECT_ENCODED_SEPARATOR}`);
+}
+async function collectMatchingSessions(agent, files, options, parseHead) {
+  const results = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const file of files) {
+    const head = await options.fs.readHead(file.path, AGENT_RESUME_LIMITS.METADATA_HEAD_BYTES).catch(() => null);
+    if (head === null) continue;
+    const core = parseHead(head);
+    if (core === null || !core.interactive || seen.has(core.sessionId)) continue;
+    if (!coreMatchesProductScope(core, options.productScopeRoot)) continue;
+    const matches = await matchReasons(agent, core, file.path, options);
+    if (matches.length === 0) continue;
+    seen.add(core.sessionId);
+    results.push({
+      agent,
+      sessionId: core.sessionId,
+      cwd: core.cwd,
+      sourcePath: file.path,
+      modifiedAtMs: file.modifiedAtMs,
+      updatedAt: core.updatedAt,
+      branch: core.branch,
+      matches
+    });
+  }
+  return results;
+}
+async function matchReasons(agent, core, path7, options) {
+  if (!hasSearchSelector(options.query)) {
+    return [AGENT_SEARCH_MATCH_REASON.ALL];
+  }
+  const metadataMatches = metadataMatchReasons(agent, core, options.query);
+  const contentMatches = await contentMatchReasons(path7, options);
+  if (metadataMatches === null || contentMatches === null) {
+    return [];
+  }
+  return [...metadataMatches, ...contentMatches];
+}
+function hasSearchSelector(query) {
+  return query.contentNeedles.length > 0 || query.sessionId !== null || query.branch !== null || query.agent !== null;
+}
+function metadataMatchReasons(agent, core, query) {
+  const matches = [];
+  if (query.agent !== null) {
+    if (agent !== query.agent) return null;
+    matches.push(AGENT_SEARCH_MATCH_REASON.AGENT);
+  }
+  if (query.sessionId !== null && core.sessionId === query.sessionId) {
+    matches.push(AGENT_SEARCH_MATCH_REASON.SESSION_ID);
+  } else if (query.sessionId !== null) {
+    return null;
+  }
+  if (query.branch !== null) {
+    if (core.branch !== query.branch) return null;
+    matches.push(AGENT_SEARCH_MATCH_REASON.BRANCH);
+  }
+  return matches;
+}
+async function contentMatchReasons(path7, options) {
+  if (options.query.contentNeedles.length === 0) {
+    return [];
+  }
+  const content = await options.fs.readText(path7).catch(() => null);
+  return content === null ? null : matchingContentNeedles(content, options.query.contentNeedles);
+}
+function matchingContentNeedles(content, needles) {
+  const matches = needles.filter((needle) => content.includes(needle.value)).map((needle) => needle.reason);
+  return matches.length === needles.length ? matches : null;
+}
+function coreMatchesProductScope(core, productScopeRoot) {
+  return isPathInsideOrEqual(productScopeRoot, core.cwd);
+}
+async function storeFiles(paths, fs8, nowMs, includeAll) {
+  const files = await mapWithConcurrency(paths, AGENT_RESUME_LIMITS.READ_CONCURRENCY, async (path7) => {
+    const stat9 = await fs8.stat(path7).catch(() => null);
+    if (stat9 === null) return null;
+    if (!includeAll && !isRecentAgentSessionMtime(stat9.mtimeMs, nowMs)) return null;
+    return { path: path7, modifiedAtMs: stat9.mtimeMs };
+  });
+  return files.filter((file) => file !== null).sort((left, right) => right.modifiedAtMs - left.modifiedAtMs || left.path.localeCompare(right.path));
+}
+function compareSearchResults(left, right) {
+  const modifiedDiff = right.modifiedAtMs - left.modifiedAtMs;
+  if (modifiedDiff !== 0) return modifiedDiff;
+  return `${left.agent}:${left.sessionId}`.localeCompare(`${right.agent}:${right.sessionId}`);
+}
+
 // src/git/root.ts
 import { execa } from "execa";
 import { basename, dirname, isAbsolute as isAbsolute2, join, resolve as resolve4 } from "path";
@@ -917,9 +1103,9 @@ var defaultAgentResumeCommandDeps = {
   fs: nodeAgentSessionFileSystem,
   homeDir: homedir,
   nowMs: Date.now,
-  resolveWorktreeRoot: async (cwd) => {
+  resolveWorktreeRoot: async (cwd, fallbackWorktreeRoot) => {
     const result = await detectWorktreeProductRoot(cwd);
-    return result.isGitRepo ? result.productDir : null;
+    return result.isGitRepo ? result.productDir : fallbackWorktreeRoot;
   }
 };
 async function loadAgentResumeCandidates(options) {
@@ -930,7 +1116,7 @@ async function loadAgentResumeCandidates(options) {
     nowMs: deps.nowMs(),
     scope: options.scope,
     fs: deps.fs,
-    resolveWorktreeRoot: deps.resolveWorktreeRoot
+    resolveWorktreeRoot: (cwd) => deps.resolveWorktreeRoot(cwd, options.fallbackWorktreeRoot)
   });
 }
 async function listAgentResumeSessions(options) {
@@ -940,6 +1126,63 @@ async function jsonAgentResumeSessions(options) {
   return renderAgentResumeJson(await loadAgentResumeCandidates(options));
 }
 
+// src/commands/agent/search.ts
+import { open as open2, readdir as readdir2, readFile, stat as stat2 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+var nodeAgentSearchFileSystem = {
+  async readDir(path7) {
+    const entries = await readdir2(path7, { withFileTypes: true });
+    return entries.map((entry) => ({
+      name: entry.name,
+      isDirectory: entry.isDirectory(),
+      isFile: entry.isFile()
+    }));
+  },
+  async readHead(path7, maxBytes) {
+    const handle = await open2(path7, "r");
+    try {
+      const buffer = Buffer.alloc(maxBytes);
+      const { bytesRead } = await handle.read(buffer, 0, maxBytes, 0);
+      return buffer.toString(AGENT_SESSION_STORE.TEXT_ENCODING, 0, bytesRead);
+    } finally {
+      await handle.close();
+    }
+  },
+  async readText(path7) {
+    return readFile(path7, AGENT_SESSION_STORE.TEXT_ENCODING);
+  },
+  async stat(path7) {
+    const result = await stat2(path7);
+    return { mtimeMs: result.mtimeMs };
+  }
+};
+var defaultAgentSearchCommandDeps = {
+  fs: nodeAgentSearchFileSystem,
+  homeDir: homedir2,
+  nowMs: Date.now,
+  resolveProductScopeRoot: resolveAgentSearchProductScopeRoot
+};
+async function resolveAgentSearchProductScopeRoot(cwd, fallbackProductScopeRoot, gitDeps = defaultGitDependencies) {
+  const result = await detectWorktreeProductRoot(cwd, gitDeps);
+  return result.isGitRepo ? result.productDir : fallbackProductScopeRoot;
+}
+async function loadAgentSearchResults(options) {
+  const deps = options.deps ?? defaultAgentSearchCommandDeps;
+  return searchAgentSessions({
+    homeDir: deps.homeDir(),
+    nowMs: deps.nowMs(),
+    productScopeRoot: await deps.resolveProductScopeRoot(options.cwd, options.fallbackProductScopeRoot),
+    fs: deps.fs,
+    query: options.query
+  });
+}
+async function listAgentSearchSessions(options) {
+  return renderAgentSearchList(await loadAgentSearchResults(options));
+}
+async function jsonAgentSearchSessions(options) {
+  return renderAgentSearchJson(await loadAgentSearchResults(options));
+}
+
 // src/lib/process-lifecycle/exit-codes.ts
 var SIGINT_EXIT_CODE = 130;
 var SIGTERM_EXIT_CODE = 143;
@@ -1118,6 +1361,50 @@ function spawnManagedSubprocess(runner, command, args, options) {
   });
 }
 
+// src/lib/sanitize-cli-argument.ts
+var MAX_CLI_ARGUMENT_DISPLAY_LENGTH = 120;
+var ELLIPSIS_TOKEN = "...";
+var SENTINEL_UNDEFINED = "<undefined>";
+var SENTINEL_NULL = "<null>";
+var SENTINEL_EMPTY = "<empty>";
+var CONTROL_CHAR_UPPER_BOUND = 31;
+var DEL_CHAR_CODE = 127;
+var HEX_RADIX = 16;
+var HEX_PAD = 2;
+function formatHexEscape(code) {
+  return String.raw`\x${code.toString(HEX_RADIX).padStart(HEX_PAD, "0")}`;
+}
+function nonStringSentinel(type) {
+  return `<non-string:${type}>`;
+}
+function sanitizeCliArgument(input) {
+  return truncate(escapeCliArgument(input));
+}
+function escapeCliArgument(input) {
+  if (input === void 0) return SENTINEL_UNDEFINED;
+  if (input === null) return SENTINEL_NULL;
+  if (typeof input !== "string") return nonStringSentinel(typeof input);
+  if (input.length === 0) return SENTINEL_EMPTY;
+  return escapeControlCharacters(input);
+}
+function escapeControlCharacters(value) {
+  let out = "";
+  for (const char of value) {
+    const code = char.codePointAt(0);
+    if (code === void 0) continue;
+    if (code <= CONTROL_CHAR_UPPER_BOUND || code === DEL_CHAR_CODE) {
+      out += formatHexEscape(code);
+    } else {
+      out += char;
+    }
+  }
+  return out;
+}
+function truncate(value) {
+  if (value.length <= MAX_CLI_ARGUMENT_DISPLAY_LENGTH) return value;
+  return value.slice(0, MAX_CLI_ARGUMENT_DISPLAY_LENGTH - ELLIPSIS_TOKEN.length) + ELLIPSIS_TOKEN;
+}
+
 // src/interfaces/cli/foreground-launch.ts
 var FOREGROUND_LAUNCH_STDIO = "inherit";
 var LAUNCH_FAILURE_STATUS = 1;
@@ -1240,14 +1527,26 @@ async function runAgentResumePicker(candidates, renderPicker = render) {
 var AGENT_CLI = {
   commandName: "agent",
   resumeCommandName: "resume",
+  searchCommandName: "search",
   flags: {
     latest: "--latest",
     list: "--list",
     json: "--json",
-    branch: "--branch"
+    branch: "--branch",
+    all: "--all",
+    pickupId: "--pickup-id",
+    contains: "--contains",
+    sessionId: "--session-id",
+    agent: "--agent",
+    limit: "--limit"
   },
   optionArgs: {
-    branch: "--branch <name>"
+    branch: "--branch <name>",
+    pickupId: "--pickup-id <id>",
+    contains: "--contains <literal>",
+    sessionId: "--session-id <id>",
+    agent: "--agent <kind>",
+    limit: "--limit <count>"
   }
 };
 var AGENT_CLI_EXIT = {
@@ -1265,6 +1564,7 @@ var DEFAULT_AGENT_CLI_DEPENDENCIES = {
     );
   }
 };
+var POSITIVE_DECIMAL_INTEGER_PATTERN = /^[1-9][0-9]*$/;
 function writeOutput(invocation, output) {
   invocation.io.writeStdout(`${output}
 `);
@@ -1281,6 +1581,33 @@ function handleError(invocation, error) {
 function resumeScopeFromOptions(options) {
   return options.branch === void 0 ? worktreeResumeScope() : branchResumeScope(options.branch);
 }
+function parseSearchLimit(value) {
+  if (!POSITIVE_DECIMAL_INTEGER_PATTERN.test(value)) {
+    throw new Error(`agent search limit must be a positive integer: ${sanitizeCliArgument(value)}`);
+  }
+  const parsed = Number.parseInt(value, 10);
+  if (!Number.isSafeInteger(parsed)) {
+    throw new Error(`agent search limit must be a positive integer: ${sanitizeCliArgument(value)}`);
+  }
+  return parsed;
+}
+function parseSearchAgentKind(value) {
+  if (value === AGENT_SESSION_KIND.CODEX || value === AGENT_SESSION_KIND.CLAUDE_CODE) {
+    return value;
+  }
+  throw new Error(`agent search kind must be codex or claude-code: ${sanitizeCliArgument(value)}`);
+}
+function searchQueryFromOptions(options) {
+  return {
+    pickupId: options.pickupId,
+    contains: options.contains,
+    sessionId: options.sessionId,
+    branch: options.branch,
+    agent: options.agent === void 0 ? void 0 : parseSearchAgentKind(options.agent),
+    all: options.all,
+    limit: options.limit === void 0 ? AGENT_SEARCH_DEFAULT_LIMIT : parseSearchLimit(options.limit)
+  };
+}
 async function dispatchInteractiveResume(mode, commandOptions, deps, invocation) {
   const candidates = await loadAgentResumeCandidates(commandOptions);
   if (candidates.length === 0) {
@@ -1307,12 +1634,14 @@ function createAgentDomain(deps = {}) {
         let requestedExitCode = AGENT_CLI_EXIT.SUCCESS;
         try {
           const mode = resolveAgentResumeMode(options);
+          const productContext = invocation.resolveProductContext();
           if (mode === AGENT_RESUME_MODE.PICK && !resolvedDeps.isInteractiveTerminal()) {
             writeError(invocation, AGENT_RESUME_TEXT.INTERACTIVE_REQUIRED);
             requestedExitCode = AGENT_CLI_EXIT.FAILURE;
           } else {
             const commandOptions = {
-              cwd: invocation.resolveEffectiveInvocationDir(),
+              cwd: productContext.effectiveInvocationDir,
+              fallbackWorktreeRoot: productContext.productDir,
               scope: resumeScopeFromOptions(options),
               deps: resolvedDeps.resumeDeps
             };
@@ -1331,6 +1660,21 @@ function createAgentDomain(deps = {}) {
         }
         return invocation.io.exit(requestedExitCode);
       });
+      agentCmd.command(AGENT_CLI.searchCommandName).description("Search Codex and Claude Code agent session transcripts for this product").option(AGENT_CLI.optionArgs.pickupId, "Search for an exact SPX pickup marker").option(AGENT_CLI.optionArgs.contains, "Search transcript content for a literal string").option(AGENT_CLI.optionArgs.sessionId, "Search for an agent session id").option(AGENT_CLI.optionArgs.branch, "Search for sessions started on the named branch").option(AGENT_CLI.optionArgs.agent, "Search only one agent kind").option(AGENT_CLI.flags.all, "Include sessions outside the recent-session window").option(AGENT_CLI.optionArgs.limit, "Maximum number of results").option(AGENT_CLI.flags.json, "Print matching sessions as JSON").action(async (options) => {
+        try {
+          const productContext = invocation.resolveProductContext();
+          const commandOptions = {
+            cwd: productContext.effectiveInvocationDir,
+            fallbackProductScopeRoot: productContext.productDir,
+            query: agentSearchQueryFromOptions(searchQueryFromOptions(options)),
+            deps: resolvedDeps.searchDeps
+          };
+          const output = options.json === true ? await jsonAgentSearchSessions(commandOptions) : await listAgentSearchSessions(commandOptions);
+          writeOutput(invocation, output);
+        } catch (error) {
+          handleError(invocation, error);
+        }
+      });
     }
   };
 }
@@ -1443,6 +1787,7 @@ import {
   mkdir as nodeMkdir,
   open as nodeOpen,
   readdir as nodeReaddir,
+  rename as nodeRename,
   rm as nodeRm
 } from "fs/promises";
 import { dirname as dirname2, join as join2 } from "path";
@@ -1536,6 +1881,9 @@ var defaultFileSystem = {
   },
   readdir: nodeReaddir,
   lstat: nodeLstat,
+  rename: async (from, to) => {
+    await nodeRename(from, to);
+  },
   rm: async (path7, options) => {
     await nodeRm(path7, options);
   }
@@ -1628,8 +1976,8 @@ function formatRunTimestamp(date) {
   );
   return `${year}-${month}-${day}${RUN_TIMESTAMP_SEPARATOR}${hours}-${minutes}-${seconds}-${milliseconds}`;
 }
-function generateRunId(randomBytes2 = nodeRandomBytes) {
-  return randomBytes2(STATE_STORE_RUN_TOKEN.ID_BYTES).toString(HEX_ENCODING);
+function generateRunId(randomBytes3 = nodeRandomBytes) {
+  return randomBytes3(STATE_STORE_RUN_TOKEN.ID_BYTES).toString(HEX_ENCODING);
 }
 function createStateStoreRunToken(options) {
   const startedAt = formatRunTimestamp(options.date);
@@ -1651,7 +1999,7 @@ async function createJsonlRunFile(scopeDir, domainName, options = {}) {
   if (!domainRunsDir.ok) return domainRunsDir;
   const maxAttempts = options.maxAttempts ?? RUN_FILE_CREATE_ATTEMPTS;
   const startedDate = (options.now ?? (() => /* @__PURE__ */ new Date()))();
-  const randomBytes2 = options.randomBytes ?? nodeRandomBytes;
+  const randomBytes3 = options.randomBytes ?? nodeRandomBytes;
   try {
     await fs8.mkdir(domainRunsDir.value, { recursive: true });
   } catch (error) {
@@ -1661,7 +2009,7 @@ async function createJsonlRunFile(scopeDir, domainName, options = {}) {
     };
   }
   for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
-    const token = createStateStoreRunToken({ date: startedDate, randomBytes: randomBytes2 });
+    const token = createStateStoreRunToken({ date: startedDate, randomBytes: randomBytes3 });
     const name = runFileName(token.runToken);
     const path7 = join2(domainRunsDir.value, name);
     try {
@@ -2184,8 +2532,8 @@ import path2 from "path";
 // src/lib/atomic-file-write.ts
 var TEMP_TOKEN_BYTES = 8;
 var TEMP_SUFFIX = ".tmp";
-function atomicWriteTempPath(targetPath, randomBytes2) {
-  const token = randomBytes2(TEMP_TOKEN_BYTES).toString("hex");
+function atomicWriteTempPath(targetPath, randomBytes3) {
+  const token = randomBytes3(TEMP_TOKEN_BYTES).toString("hex");
   return `${targetPath}.${token}${TEMP_SUFFIX}`;
 }
 async function writeFileAtomic(targetPath, content, options) {
@@ -2545,14 +2893,14 @@ async function compactRetrieveCommand(options) {
 }
 
 // src/commands/compact/store.ts
-import { readFile } from "fs/promises";
+import { readFile as readFile2 } from "fs/promises";
 var UTF8_ENCODING = "utf8";
 async function compactStoreCommand(options) {
   const sessionToken = resolveCompactSessionToken(options.sessionId, options.env ?? process.env);
   if (sessionToken === void 0) return 1;
   let transcript;
   try {
-    transcript = await readFile(options.transcript, UTF8_ENCODING);
+    transcript = await readFile2(options.transcript, UTF8_ENCODING);
   } catch {
     return 1;
   }
@@ -2608,7 +2956,7 @@ var compactDomain = {
 };
 
 // src/config/index.ts
-import { readFile as readFile2 } from "fs/promises";
+import { readFile as readFile3 } from "fs/promises";
 import { join as join4 } from "path";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 import { parse as parseYaml, parseDocument as parseYamlDocument, stringify as stringifyYaml } from "yaml";
@@ -2879,37 +3227,37 @@ function validateAgents(raw) {
   }
   return { ok: true, value: agents };
 }
-function validateAgentConfig(path7, raw, defaults5) {
+function validateAgentConfig(path7, raw, defaults6) {
   if (!isRecord2(raw)) return { ok: false, error: `${path7} must be an object` };
   const unknown = rejectUnknownFields(path7, raw, HARNESS_ENVIRONMENT_AGENT_CONFIG_ALLOWED_FIELDS);
   if (!unknown.ok) return unknown;
   const enabledRaw = raw[HARNESS_ENVIRONMENT_CONFIG_FIELDS.ENABLED];
-  const enabled = enabledRaw === void 0 ? { ok: true, value: defaults5.enabled } : validateBoolean(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.ENABLED}`, enabledRaw);
+  const enabled = enabledRaw === void 0 ? { ok: true, value: defaults6.enabled } : validateBoolean(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.ENABLED}`, enabledRaw);
   if (!enabled.ok) return enabled;
   const hooksRaw = raw[HARNESS_ENVIRONMENT_CONFIG_FIELDS.HOOKS];
-  const hooks = hooksRaw === void 0 ? { ok: true, value: defaults5.hooks } : validateAgentHooks(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.HOOKS}`, hooksRaw, defaults5.hooks);
+  const hooks = hooksRaw === void 0 ? { ok: true, value: defaults6.hooks } : validateAgentHooks(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.HOOKS}`, hooksRaw, defaults6.hooks);
   if (!hooks.ok) return hooks;
   return { ok: true, value: { enabled: enabled.value, hooks: hooks.value } };
 }
-function validateAgentHooks(path7, raw, defaults5) {
+function validateAgentHooks(path7, raw, defaults6) {
   if (!isRecord2(raw)) return { ok: false, error: `${path7} must be an object` };
   const unknown = rejectUnknownFields(path7, raw, HARNESS_ENVIRONMENT_AGENT_HOOKS_ALLOWED_FIELDS);
   if (!unknown.ok) return unknown;
   const sessionStartRaw = raw[HARNESS_ENVIRONMENT_CONFIG_FIELDS.SESSION_START];
-  const sessionStart = sessionStartRaw === void 0 ? { ok: true, value: defaults5.sessionStart } : validateSessionStartHooks(
+  const sessionStart = sessionStartRaw === void 0 ? { ok: true, value: defaults6.sessionStart } : validateSessionStartHooks(
     `${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.SESSION_START}`,
     sessionStartRaw,
-    defaults5.sessionStart
+    defaults6.sessionStart
   );
   if (!sessionStart.ok) return sessionStart;
   return { ok: true, value: { sessionStart: sessionStart.value } };
 }
-function validateSessionStartHooks(path7, raw, defaults5) {
+function validateSessionStartHooks(path7, raw, defaults6) {
   if (!isRecord2(raw)) return { ok: false, error: `${path7} must be an object` };
   const unknown = rejectUnknownFields(path7, raw, HARNESS_ENVIRONMENT_SESSION_START_HOOKS_ALLOWED_FIELDS);
   if (!unknown.ok) return unknown;
   const compactStdoutRaw = raw[HARNESS_ENVIRONMENT_CONFIG_FIELDS.COMPACT_STDOUT];
-  const compactStdout = compactStdoutRaw === void 0 ? { ok: true, value: defaults5.compactStdout } : validateBoolean(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.COMPACT_STDOUT}`, compactStdoutRaw);
+  const compactStdout = compactStdoutRaw === void 0 ? { ok: true, value: defaults6.compactStdout } : validateBoolean(`${path7}.${HARNESS_ENVIRONMENT_CONFIG_FIELDS.COMPACT_STDOUT}`, compactStdoutRaw);
   if (!compactStdout.ok) return compactStdout;
   return { ok: true, value: { compactStdout: compactStdout.value } };
 }
@@ -2982,8 +3330,8 @@ function validatePluginBootstrap(raw) {
     }
   };
 }
-function validateEntryArray(path7, raw, validateEntry, defaults5) {
-  if (raw === void 0) return { ok: true, value: defaults5 };
+function validateEntryArray(path7, raw, validateEntry, defaults6) {
+  if (raw === void 0) return { ok: true, value: defaults6 };
   if (!Array.isArray(raw)) return { ok: false, error: `${path7} must be an array` };
   const entries = [];
   for (const [index, entry] of raw.entries()) {
@@ -3274,6 +3622,36 @@ var diagnoseConfigDescriptor = {
   validate: validate2
 };
 
+// src/lib/agent-run-journal/config.ts
+var RUNTIME_SECTION = "runtime";
+var RUNTIME_CONFIG_FIELDS = {
+  EVENT_NAMESPACE: "eventNamespace"
+};
+var RUNTIME_EVENT_NAMESPACE_DEFAULT = "sh.spx";
+var defaults2 = { eventNamespace: RUNTIME_EVENT_NAMESPACE_DEFAULT };
+function validate3(value) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return { ok: false, error: `${RUNTIME_SECTION} section must be an object` };
+  }
+  const candidate = value;
+  const raw = candidate[RUNTIME_CONFIG_FIELDS.EVENT_NAMESPACE];
+  if (raw === void 0) {
+    return { ok: true, value: { eventNamespace: RUNTIME_EVENT_NAMESPACE_DEFAULT } };
+  }
+  if (typeof raw !== "string" || raw.trim().length === 0) {
+    return {
+      ok: false,
+      error: `${RUNTIME_SECTION}.${RUNTIME_CONFIG_FIELDS.EVENT_NAMESPACE} must be a non-empty string`
+    };
+  }
+  return { ok: true, value: { eventNamespace: raw } };
+}
+var runtimeConfigDescriptor = {
+  section: RUNTIME_SECTION,
+  defaults: defaults2,
+  validate: validate3
+};
+
 // src/lib/file-inclusion/adapters/eslint.ts
 function eslintAdapter(scope2, config) {
   return scope2.excluded.flatMap((entry) => [config.ignoreFlag, entry.path]);
@@ -3334,7 +3712,7 @@ var DEFAULT_SCOPE_CONFIG = {};
 var DEFAULT_TOOLS_CONFIG = Object.fromEntries(
   Object.entries(TOOL_DEFAULT_FLAGS).map(([name, flag]) => [name, { ignoreFlag: flag }])
 );
-var defaults2 = {
+var defaults3 = {
   scope: DEFAULT_SCOPE_CONFIG,
   tools: DEFAULT_TOOLS_CONFIG
 };
@@ -3406,7 +3784,7 @@ function validateTools(raw) {
   }
   return { ok: true, value: tools };
 }
-function validate3(value) {
+function validate4(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return { ok: false, error: `${FILE_INCLUSION_SECTION} section must be an object` };
   }
@@ -3433,8 +3811,8 @@ function validate3(value) {
 }
 var fileInclusionConfigDescriptor = {
   section: FILE_INCLUSION_SECTION,
-  defaults: defaults2,
-  validate: validate3
+  defaults: defaults3,
+  validate: validate4
 };
 
 // src/config/source-roots.ts
@@ -3457,7 +3835,7 @@ var PRECOMMIT_DEFAULTS = {
   sourceDirs: TEST_RELEVANT_SOURCE_ROOT_PREFIXES,
   testPattern: ".test.ts"
 };
-function validate4(value) {
+function validate5(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return { ok: false, error: `${PRECOMMIT_SECTION} section must be an object` };
   }
@@ -3487,7 +3865,7 @@ function validate4(value) {
 var precommitConfigDescriptor = {
   section: PRECOMMIT_SECTION,
   defaults: PRECOMMIT_DEFAULTS,
-  validate: validate4
+  validate: validate5
 };
 
 // src/lib/spec-tree/config.ts
@@ -3678,7 +4056,7 @@ function buildConfigFromKindNames(kindNames) {
   const entries = kindNames.map((kind) => [kind, KIND_REGISTRY[kind]]);
   return { kinds: Object.fromEntries(entries) };
 }
-function validate5(value) {
+function validate6(value) {
   if (typeof value !== "object" || value === null) {
     return { ok: false, error: `${SPEC_TREE_SECTION} section must be an object` };
   }
@@ -3777,7 +4155,7 @@ function validateKindDefinitionMap(kindEntries) {
 var specTreeConfigDescriptor = {
   section: SPEC_TREE_SECTION,
   defaults: buildDefaults(),
-  validate: validate5
+  validate: validate6
 };
 
 // src/config/primitives/path-filter.ts
@@ -3850,7 +4228,7 @@ var TESTING_CONFIG_FIELDS = {
   PASSING_SCOPE: "passingScope"
 };
 var DEFAULT_PASSING_SCOPE = resolveDefaultPassingScope();
-var defaults3 = {
+var defaults4 = {
   passingScope: DEFAULT_PASSING_SCOPE
 };
 function resolveDefaultPassingScope() {
@@ -3863,14 +4241,14 @@ function resolveDefaultPassingScope() {
   }
   return result.value;
 }
-function validate6(value) {
+function validate7(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return { ok: false, error: `${TESTING_SECTION} section must be an object` };
   }
   const candidate = value;
   const passingScopeRaw = candidate[TESTING_CONFIG_FIELDS.PASSING_SCOPE];
   if (passingScopeRaw === void 0) {
-    return { ok: true, value: defaults3 };
+    return { ok: true, value: defaults4 };
   }
   const passingScopeResult = validatePathFilterConfig(
     passingScopeRaw,
@@ -3886,8 +4264,8 @@ function validate6(value) {
 }
 var testingConfigDescriptor = {
   section: TESTING_SECTION,
-  defaults: defaults3,
-  validate: validate6
+  defaults: defaults4,
+  validate: validate7
 };
 
 // src/validation/literal/config.ts
@@ -3951,7 +4329,7 @@ var LITERAL_DEFAULTS = {
 function isNonNegativeInteger(value) {
   return typeof value === "number" && Number.isInteger(value) && value >= 0;
 }
-function validate7(value) {
+function validate8(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return { ok: false, error: `${LITERAL_SECTION} section must be an object` };
   }
@@ -4015,7 +4393,7 @@ function isStringArray(value) {
 var literalConfigDescriptor = {
   section: LITERAL_SECTION,
   defaults: LITERAL_DEFAULTS,
-  validate: validate7
+  validate: validate8
 };
 
 // src/validation/config/descriptor.ts
@@ -4034,7 +4412,7 @@ var VALIDATION_PATH_TOOL_SUBSECTIONS = {
   LITERAL: "literal",
   FORMATTING: "formatting"
 };
-var defaults4 = {
+var defaults5 = {
   paths: {},
   literal: {
     enabled: true,
@@ -4074,7 +4452,7 @@ function validateLiteral(raw) {
     };
   }
   const candidate = raw;
-  const enabledRaw = candidate[VALIDATION_ENABLED_FIELD] ?? defaults4.literal.enabled;
+  const enabledRaw = candidate[VALIDATION_ENABLED_FIELD] ?? defaults5.literal.enabled;
   if (typeof enabledRaw !== "boolean") {
     return {
       ok: false,
@@ -4099,7 +4477,7 @@ function validateKnip(raw) {
     };
   }
   const candidate = raw;
-  const enabledRaw = candidate[VALIDATION_ENABLED_FIELD] ?? defaults4.knip.enabled;
+  const enabledRaw = candidate[VALIDATION_ENABLED_FIELD] ?? defaults5.knip.enabled;
   if (typeof enabledRaw !== "boolean") {
     return {
       ok: false,
@@ -4108,7 +4486,7 @@ function validateKnip(raw) {
   }
   return { ok: true, value: { enabled: enabledRaw } };
 }
-function validate8(value) {
+function validate9(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return { ok: false, error: `${VALIDATION_SECTION} section must be an object` };
   }
@@ -4126,8 +4504,8 @@ function validate8(value) {
 }
 var validationConfigDescriptor = {
   section: VALIDATION_SECTION,
-  defaults: defaults4,
-  validate: validate8
+  defaults: defaults5,
+  validate: validate9
 };
 
 // src/config/registry.ts
@@ -4138,15 +4516,16 @@ var productionRegistry = [
   fileInclusionConfigDescriptor,
   precommitConfigDescriptor,
   harnessEnvironmentConfigDescriptor,
-  diagnoseConfigDescriptor
+  diagnoseConfigDescriptor,
+  runtimeConfigDescriptor
 ];
 
 // src/config/descriptor-digest.ts
 import { createHash as createHash3 } from "crypto";
 var DEFAULT_DESCRIPTOR_PATH = "descriptor section";
-var SHA256_ALGORITHM2 = "sha256";
+var DESCRIPTOR_DIGEST_SHA256_ALGORITHM = "sha256";
 var UTF8_ENCODING2 = "utf8";
-var HEX_ENCODING2 = "hex";
+var DESCRIPTOR_DIGEST_HEX_ENCODING = "hex";
 function canonicalDescriptorJson(value, path7 = DEFAULT_DESCRIPTOR_PATH) {
   const normalized = normalizeDescriptorJsonValue(value, path7, /* @__PURE__ */ new WeakSet());
   if (!normalized.ok) return normalized;
@@ -4155,7 +4534,7 @@ function canonicalDescriptorJson(value, path7 = DEFAULT_DESCRIPTOR_PATH) {
 function digestDescriptorSection(value, path7 = DEFAULT_DESCRIPTOR_PATH) {
   const canonical = canonicalDescriptorJson(value, path7);
   if (!canonical.ok) return canonical;
-  const sha256 = createHash3(SHA256_ALGORITHM2).update(Buffer.from(canonical.value, UTF8_ENCODING2)).digest(HEX_ENCODING2);
+  const sha256 = createHash3(DESCRIPTOR_DIGEST_SHA256_ALGORITHM).update(Buffer.from(canonical.value, UTF8_ENCODING2)).digest(DESCRIPTOR_DIGEST_HEX_ENCODING);
   return {
     ok: true,
     value: {
@@ -4269,7 +4648,7 @@ async function readProductConfigFile(productDir) {
     const path7 = join4(productDir, filename);
     let raw;
     try {
-      raw = await readFile2(path7, "utf8");
+      raw = await readFile3(path7, "utf8");
     } catch (error) {
       if (isFileNotFound(error)) continue;
       return { ok: false, error: `failed to read ${filename}: ${toMessage(error)}` };
@@ -4553,7 +4932,7 @@ var configDomain = {
 };
 
 // src/interfaces/cli/diagnose.ts
-import { readFile as readFile3 } from "fs/promises";
+import { readFile as readFile4 } from "fs/promises";
 import { Option } from "commander";
 
 // src/domains/diagnose/types.ts
@@ -5898,7 +6277,7 @@ import {
   mkdir as nodeMkdir2,
   readFile as nodeReadFile,
   readlink as nodeReadlink,
-  rename as nodeRename,
+  rename as nodeRename2,
   rm as nodeRm2,
   symlink as nodeSymlink,
   writeFile as nodeWriteFile
@@ -5910,7 +6289,7 @@ var defaultOccupancyFileSystem = {
   writeFile: async (path7, data) => {
     await nodeWriteFile(path7, data);
   },
-  rename: nodeRename,
+  rename: nodeRename2,
   symlink: nodeSymlink,
   readlink: nodeReadlink,
   readFile: nodeReadFile,
@@ -6251,50 +6630,6 @@ var defaultSpxReachabilityProbe = {
   }
 };
 
-// src/lib/sanitize-cli-argument.ts
-var MAX_CLI_ARGUMENT_DISPLAY_LENGTH = 120;
-var ELLIPSIS_TOKEN = "...";
-var SENTINEL_UNDEFINED = "<undefined>";
-var SENTINEL_NULL = "<null>";
-var SENTINEL_EMPTY = "<empty>";
-var CONTROL_CHAR_UPPER_BOUND = 31;
-var DEL_CHAR_CODE = 127;
-var HEX_RADIX = 16;
-var HEX_PAD = 2;
-function formatHexEscape(code) {
-  return String.raw`\x${code.toString(HEX_RADIX).padStart(HEX_PAD, "0")}`;
-}
-function nonStringSentinel(type) {
-  return `<non-string:${type}>`;
-}
-function sanitizeCliArgument(input) {
-  return truncate(escapeCliArgument(input));
-}
-function escapeCliArgument(input) {
-  if (input === void 0) return SENTINEL_UNDEFINED;
-  if (input === null) return SENTINEL_NULL;
-  if (typeof input !== "string") return nonStringSentinel(typeof input);
-  if (input.length === 0) return SENTINEL_EMPTY;
-  return escapeControlCharacters(input);
-}
-function escapeControlCharacters(value) {
-  let out = "";
-  for (const char of value) {
-    const code = char.codePointAt(0);
-    if (code === void 0) continue;
-    if (code <= CONTROL_CHAR_UPPER_BOUND || code === DEL_CHAR_CODE) {
-      out += formatHexEscape(code);
-    } else {
-      out += char;
-    }
-  }
-  return out;
-}
-function truncate(value) {
-  if (value.length <= MAX_CLI_ARGUMENT_DISPLAY_LENGTH) return value;
-  return value.slice(0, MAX_CLI_ARGUMENT_DISPLAY_LENGTH - ELLIPSIS_TOKEN.length) + ELLIPSIS_TOKEN;
-}
-
 // src/interfaces/cli/diagnose.ts
 var DIAGNOSE_CLI = {
   COMMAND: "diagnose",
@@ -6341,7 +6676,7 @@ var diagnoseDomain = {
           isTty: Boolean(process.stdout.isTTY)
         }),
         registry: defaultRegistry(),
-        fs: { readFile: (path7) => readFile3(path7, "utf8") }
+        fs: { readFile: (path7) => readFile4(path7, "utf8") }
       });
       if (!result.ok) {
         handleError2(result.error, invocation.io);
@@ -6845,9 +7180,9 @@ var JOURNAL_RUN_STATE_INCOMPLETE_REASON = {
 };
 var JOURNAL_RUN_EVENT = {
   SOURCE: "/spx/journal",
-  STARTED_TYPE: "com.outcomeeng.spx.journal.run.started",
-  PROGRESS_TYPE: "com.outcomeeng.spx.journal.run.progress",
-  COMPLETED_TYPE: "com.outcomeeng.spx.journal.run.completed"
+  STARTED_TYPE: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.journal.run.started`,
+  PROGRESS_TYPE: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.journal.run.progress`,
+  COMPLETED_TYPE: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.journal.run.completed`
 };
 var JOURNAL_RUN_STATE_FIELDS = {
   BRANCH_NAME: "branchName",
@@ -6866,13 +7201,18 @@ var JOURNAL_RUN_STATE_FIELDS = {
   STATUS: "status"
 };
 function foldJournalRunState(events, sealed) {
-  if (!sealed) return { ok: false, reason: JOURNAL_RUN_STATE_INCOMPLETE_REASON.UNSEALED };
+  if (!sealed) {
+    return { ok: false, reason: JOURNAL_RUN_STATE_INCOMPLETE_REASON.UNSEALED };
+  }
   let completed;
   for (const event of events) {
     if (event.type === JOURNAL_RUN_EVENT.COMPLETED_TYPE) completed = event;
   }
   if (completed === void 0) {
-    return { ok: false, reason: JOURNAL_RUN_STATE_INCOMPLETE_REASON.MISSING_STATE };
+    return {
+      ok: false,
+      reason: JOURNAL_RUN_STATE_INCOMPLETE_REASON.MISSING_STATE
+    };
   }
   const validated = validateJournalRunState(completed.data);
   if (!validated.ok) {
@@ -6885,13 +7225,17 @@ function foldJournalRunState(events, sealed) {
   return validated;
 }
 function isJournalRunStateStatus(value) {
-  return typeof value === "string" && Object.values(JOURNAL_RUN_STATE_STATUS).includes(value);
+  return typeof value === "string" && Object.values(JOURNAL_RUN_STATE_STATUS).includes(
+    value
+  );
 }
 function isJournalTargetKind(value) {
   return typeof value === "string" && Object.values(JOURNAL_TARGET_KIND).includes(value);
 }
 function validateJournalRunState(value) {
-  if (!isRecord5(value)) return { ok: false, error: "journal run state must be an object" };
+  if (!isRecord5(value)) {
+    return { ok: false, error: "journal run state must be an object" };
+  }
   const identity = readRunStateIdentity(value);
   if (!identity.ok) return identity;
   const body = readRunStateBody(value);
@@ -6903,9 +7247,15 @@ function readRunStateIdentity(value) {
   if (!branchName.ok) return branchName;
   const branchSlug = readString(value, JOURNAL_RUN_STATE_FIELDS.BRANCH_SLUG);
   if (!branchSlug.ok) return branchSlug;
-  const targetKind = readTargetKind(value, JOURNAL_RUN_STATE_FIELDS.TARGET_KIND);
+  const targetKind = readTargetKind(
+    value,
+    JOURNAL_RUN_STATE_FIELDS.TARGET_KIND
+  );
   if (!targetKind.ok) return targetKind;
-  const pullRequestNumber = readOptionalNonNegativeInteger(value, JOURNAL_RUN_STATE_FIELDS.PULL_REQUEST_NUMBER);
+  const pullRequestNumber = readOptionalNonNegativeInteger(
+    value,
+    JOURNAL_RUN_STATE_FIELDS.PULL_REQUEST_NUMBER
+  );
   if (!pullRequestNumber.ok) return pullRequestNumber;
   const headSha = readString(value, JOURNAL_RUN_STATE_FIELDS.HEAD_SHA);
   if (!headSha.ok) return headSha;
@@ -6927,9 +7277,15 @@ function readRunStateIdentity(value) {
   };
 }
 function readRunStateBody(value) {
-  const configDigest = readString(value, JOURNAL_RUN_STATE_FIELDS.CONFIG_DIGEST);
+  const configDigest = readString(
+    value,
+    JOURNAL_RUN_STATE_FIELDS.CONFIG_DIGEST
+  );
   if (!configDigest.ok) return configDigest;
-  const participants = readStringArray(value, JOURNAL_RUN_STATE_FIELDS.PARTICIPANTS);
+  const participants = readStringArray(
+    value,
+    JOURNAL_RUN_STATE_FIELDS.PARTICIPANTS
+  );
   if (!participants.ok) return participants;
   const scope2 = readPathFilter(value, JOURNAL_RUN_STATE_FIELDS.SCOPE);
   if (!scope2.ok) return scope2;
@@ -6937,7 +7293,10 @@ function readRunStateBody(value) {
   if (!startedAt.ok) return startedAt;
   const completedAt = readString(value, JOURNAL_RUN_STATE_FIELDS.COMPLETED_AT);
   if (!completedAt.ok) return completedAt;
-  const outputPaths = readStringArray(value, JOURNAL_RUN_STATE_FIELDS.OUTPUT_PATHS);
+  const outputPaths = readStringArray(
+    value,
+    JOURNAL_RUN_STATE_FIELDS.OUTPUT_PATHS
+  );
   if (!outputPaths.ok) return outputPaths;
   const status = readStatus(value, JOURNAL_RUN_STATE_FIELDS.STATUS);
   if (!status.ok) return status;
@@ -6966,7 +7325,10 @@ function readOptionalString(value, field) {
 function readOptionalNonNegativeInteger(value, field) {
   const raw = value[field];
   if (raw === void 0) return { ok: true, value: void 0 };
-  return typeof raw === "number" && Number.isInteger(raw) && raw >= 0 ? { ok: true, value: raw } : { ok: false, error: `${field} must be a non-negative integer when present` };
+  return typeof raw === "number" && Number.isInteger(raw) && raw >= 0 ? { ok: true, value: raw } : {
+    ok: false,
+    error: `${field} must be a non-negative integer when present`
+  };
 }
 function readStringArray(value, field) {
   const raw = value[field];
@@ -7208,6 +7570,7 @@ function createJournal(backend, identity) {
 
 // src/lib/appendable-journal-store/index.ts
 var SEAL_MARKER_SUFFIX = ".sealed";
+var APPENDABLE_JOURNAL_SEAL_MARKER_CONTENT = "";
 var LINE_SEPARATOR3 = "\n";
 function appendableJournalSealMarkerPath(runFilePath) {
   return `${runFilePath}${SEAL_MARKER_SUFFIX}`;
@@ -7247,7 +7610,7 @@ function createAppendableJournalStore(options) {
     readAll,
     async seal() {
       await fs8.mkdir(dirname5(sealMarkerPath), { recursive: true });
-      await fs8.writeFile(sealMarkerPath, "");
+      await fs8.writeFile(sealMarkerPath, APPENDABLE_JOURNAL_SEAL_MARKER_CONTENT);
     },
     async isSealed() {
       return await readFileOrUndefined(fs8, sealMarkerPath) !== void 0;
@@ -7658,6 +8021,18 @@ async function readSealedJournalRunSet(scope2, options = {}) {
     }))
   };
 }
+async function findJournalRunBranchSlugs(scope2, options = {}) {
+  const fs8 = options.fs ?? defaultFileSystem;
+  const branches = await branchSlugs(scope2, fs8);
+  if (!branches.ok) return branches;
+  const matches = [];
+  for (const branchSlug of branches.value) {
+    const runFilePath = bindRunFilePath({ ...scope2, branchSlug });
+    if (!runFilePath.ok) return runFilePath;
+    if (await runFileExists(fs8, runFilePath.value)) matches.push(branchSlug);
+  }
+  return { ok: true, value: matches };
+}
 async function appendJournalEvent(ref, input, sink, options = {}) {
   const bound = await bindJournal(ref, options.fs);
   if (!bound.ok) return bound;
@@ -7692,6 +8067,20 @@ async function sealJournalRun(ref, options = {}) {
     return { ok: false, error: `${JOURNAL_RUNTIME_ERROR.SEAL_FAILED}: ${toMessage(error)}` };
   }
 }
+async function isJournalRunSealed(ref, options = {}) {
+  const runFilePath = bindRunFilePath(ref);
+  if (!runFilePath.ok) return runFilePath;
+  const fs8 = options.fs ?? defaultFileSystem;
+  if (!await runFileExists(fs8, runFilePath.value)) {
+    return { ok: false, error: JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND };
+  }
+  const store = createAppendableJournalStore({ runFilePath: runFilePath.value, fs: fs8 });
+  try {
+    return { ok: true, value: await store.isSealed() };
+  } catch (error) {
+    return { ok: false, error: `${JOURNAL_RUNTIME_ERROR.READ_FAILED}: ${toMessage(error)}` };
+  }
+}
 async function renderJournalRun(ref, projection, options = {}) {
   const bound = await bindJournal(ref, options.fs);
   if (!bound.ok) return bound;
@@ -7736,6 +8125,7 @@ var JOURNAL_CLI_ERROR = {
   INVALID_READ_SET_EVENT_LIMIT: "journal read-set event limit must be a positive whole integer",
   INVALID_SEALED_FILTER: "journal list sealed filter is not registered",
   INVALID_TERMINAL_STATE_FILTER: "journal list terminal-state filter is not registered",
+  RUN_TOKEN_AMBIGUOUS: "journal run token matches multiple branch scopes; rerun with --branch-slug",
   OPEN_HYDRATION_FAILED: "journal open failed to hydrate the pull request's prior runs"
 };
 var CURSOR_PATTERN = /^\d+$/;
@@ -7858,6 +8248,34 @@ function verbOptions(deps) {
 function runRef(context, runToken) {
   return { productDir: context.productDir, branchSlug: context.branchSlug, type: context.type, runToken };
 }
+async function inspectionRunRef(scope2, deps) {
+  const context = await resolveJournalRunContext(scope2, deps);
+  if (!context.ok) return context;
+  if (scope2.branchSlug !== void 0) return { ok: true, value: runRef(context.value, scope2.runToken) };
+  const branches = await findJournalRunBranchSlugs(
+    {
+      productDir: context.value.productDir,
+      type: context.value.type,
+      runToken: scope2.runToken
+    },
+    verbOptions(deps)
+  );
+  if (!branches.ok) return branches;
+  if (branches.value.length === 1) {
+    const branchSlug = branches.value[0];
+    return {
+      ok: true,
+      value: {
+        productDir: context.value.productDir,
+        branchSlug,
+        type: context.value.type,
+        runToken: scope2.runToken
+      }
+    };
+  }
+  if (branches.value.length > 1) return { ok: false, error: JOURNAL_CLI_ERROR.RUN_TOKEN_AMBIGUOUS };
+  return { ok: true, value: runRef(context.value, scope2.runToken) };
+}
 function okResult(output) {
   return { exitCode: JOURNAL_CLI_EXIT_CODE.OK, output };
 }
@@ -7974,9 +8392,9 @@ async function journalAppendCommand(scope2, input, binding, deps = {}) {
 async function journalReadCommand(scope2, fromCursor, deps = {}) {
   const cursor = parseJournalCursor(fromCursor);
   if (!cursor.ok) return errorResult(cursor.error);
-  const context = await resolveJournalRunContext(scope2, deps);
-  if (!context.ok) return errorResult(context.error);
-  const events = await readJournalEvents(runRef(context.value, scope2.runToken), cursor.value, verbOptions(deps));
+  const ref = await inspectionRunRef(scope2, deps);
+  if (!ref.ok) return errorResult(ref.error);
+  const events = await readJournalEvents(ref.value, cursor.value, verbOptions(deps));
   if (!events.ok) return errorResult(events.error);
   return okResult(JSON.stringify(events.value));
 }
@@ -8025,10 +8443,10 @@ async function journalSealCommand(scope2, deps = {}) {
   return okResult(JSON.stringify({ sealed: true }));
 }
 async function journalRenderCommand(scope2, deps = {}) {
-  const context = await resolveJournalRunContext(scope2, deps);
-  if (!context.ok) return errorResult(context.error);
+  const ref = await inspectionRunRef(scope2, deps);
+  if (!ref.ok) return errorResult(ref.error);
   const rendered = await renderJournalRun(
-    runRef(context.value, scope2.runToken),
+    ref.value,
     (events) => [...events],
     verbOptions(deps)
   );
@@ -8354,7 +8772,7 @@ function sessionOptionToken(option) {
 }
 
 // src/commands/session/archive.ts
-import { mkdir, rename, stat as stat2 } from "fs/promises";
+import { mkdir, rename, stat as stat3 } from "fs/promises";
 import { dirname as dirname7, join as join8 } from "path";
 
 // src/domains/session/archive.ts
@@ -8667,7 +9085,7 @@ var SessionAlreadyArchivedError = class extends Error {
 };
 async function fileExists(path7) {
   try {
-    const stats = await stat2(path7);
+    const stats = await stat3(path7);
     return stats.isFile();
   } catch {
     return false;
@@ -8709,7 +9127,7 @@ async function archiveCommand(options) {
 }
 
 // src/commands/session/delete.ts
-import { stat as stat3, unlink } from "fs/promises";
+import { stat as stat4, unlink } from "fs/promises";
 
 // src/domains/session/delete.ts
 function resolveDeletePath(sessionId, existingPaths) {
@@ -8882,44 +9300,6 @@ function parseSessionId(id) {
   return date;
 }
 
-// src/domains/session/types.ts
-var SESSION_PRIORITY = {
-  HIGH: "high",
-  MEDIUM: "medium",
-  LOW: "low"
-};
-var SESSION_STATUSES = ["todo", "doing", "archive"];
-var DEFAULT_LIST_STATUSES = ["doing", "todo"];
-var SESSION_FILE_ENCODING = "utf-8";
-var SESSION_FILE_ERROR_CODE = {
-  NOT_FOUND: "ENOENT"
-};
-var SESSION_OUTPUT_MARKER = {
-  HANDOFF_ID: "HANDOFF_ID",
-  PICKUP_ID: "PICKUP_ID",
-  SESSION_FILE: "SESSION_FILE"
-};
-function formatSessionOutputMarker(marker, value) {
-  return `<${marker}>${value}</${marker}>`;
-}
-var CLAIMABLE_STATUS = SESSION_STATUSES[0];
-var PRIORITY_ORDER = {
-  [SESSION_PRIORITY.HIGH]: 0,
-  [SESSION_PRIORITY.MEDIUM]: 1,
-  [SESSION_PRIORITY.LOW]: 2
-};
-var DEFAULT_PRIORITY = SESSION_PRIORITY.MEDIUM;
-var SESSION_FRONT_MATTER = {
-  PRIORITY: "priority",
-  GIT_REF: "git_ref",
-  GOAL: "goal",
-  NEXT_STEP: "next_step",
-  CREATED_AT: "created_at",
-  AGENT_SESSION_ID: "agent_session_id",
-  SPECS: "specs",
-  FILES: "files"
-};
-
 // src/domains/session/list.ts
 var FRONT_MATTER_PATTERN = /^---\r?\n([\s\S]*?)\r?\n(?:---|\.\.\.)\r?\n?/;
 var SESSION_PRIORITY_VALUES = Object.values(SESSION_PRIORITY);
@@ -9158,7 +9538,7 @@ async function findExistingPaths(paths) {
   const existing = [];
   for (const path7 of paths) {
     try {
-      const stats = await stat3(path7);
+      const stats = await stat4(path7);
       if (stats.isFile()) {
         existing.push(path7);
       }
@@ -9180,7 +9560,7 @@ async function deleteCommand(options) {
 }
 
 // src/commands/session/handoff.ts
-import { mkdir as mkdir2, stat as stat4, writeFile } from "fs/promises";
+import { mkdir as mkdir2, stat as stat5, writeFile } from "fs/promises";
 import { join as join10, resolve as resolve6 } from "path";
 import { stringify as stringifyYaml3 } from "yaml";
 
@@ -9431,7 +9811,7 @@ async function rejectDirectoryInjectionEntries(entries, cwd) {
     if (entry.length === 0) continue;
     let entryIsDirectory = false;
     try {
-      entryIsDirectory = (await stat4(resolve6(cwd, entry))).isDirectory();
+      entryIsDirectory = (await stat5(resolve6(cwd, entry))).isDirectory();
     } catch {
       continue;
     }
@@ -9489,7 +9869,7 @@ ${formatSessionOutputMarker(SESSION_OUTPUT_MARKER.SESSION_FILE, absolutePath)}`;
 }
 
 // src/commands/session/list.ts
-import { readdir as readdir2, readFile as readFile4 } from "fs/promises";
+import { readdir as readdir3, readFile as readFile5 } from "fs/promises";
 import { join as join11 } from "path";
 var SESSION_LIST_FORMAT = {
   TEXT: "text",
@@ -9498,13 +9878,13 @@ var SESSION_LIST_FORMAT = {
 var SESSION_LIST_EMPTY_TEXT = "(no sessions)";
 async function loadSessionsFromDir(dir, status) {
   try {
-    const files = await readdir2(dir);
+    const files = await readdir3(dir);
     const sessions = [];
     for (const file of files) {
       if (!file.endsWith(".md")) continue;
       const id = file.replace(".md", "");
       const filePath = join11(dir, file);
-      const content = await readFile4(filePath, SESSION_FILE_ENCODING);
+      const content = await readFile5(filePath, SESSION_FILE_ENCODING);
       const metadata = parseSessionMetadata(content);
       sessions.push({
         id,
@@ -9567,7 +9947,7 @@ async function listCommand(options) {
 }
 
 // src/commands/session/pickup.ts
-import { mkdir as mkdir3, readdir as readdir3, readFile as readFile5, rename as rename2 } from "fs/promises";
+import { mkdir as mkdir3, readdir as readdir4, readFile as readFile6, rename as rename2 } from "fs/promises";
 import { join as join12, resolve as resolve7 } from "path";
 
 // src/domains/session/pickup.ts
@@ -9607,8 +9987,8 @@ function selectBestSession(sessions) {
 var PICKUP_TARGET_STATUS = SESSION_STATUSES[1];
 var PICKUP_DEPS = {
   mkdir: mkdir3,
-  readdir: readdir3,
-  readFile: readFile5,
+  readdir: readdir4,
+  readFile: readFile6,
   rename: rename2
 };
 async function loadTodoSessions(config) {
@@ -9717,7 +10097,7 @@ async function loadPickCandidates(options) {
 }
 
 // src/commands/session/prune.ts
-import { readdir as readdir4, readFile as readFile6, unlink as unlink2 } from "fs/promises";
+import { readdir as readdir5, readFile as readFile7, unlink as unlink2 } from "fs/promises";
 import { join as join13 } from "path";
 
 // src/domains/session/prune.ts
@@ -9762,13 +10142,13 @@ function validatePruneOptions(options) {
 }
 async function loadArchiveSessions(config) {
   try {
-    const files = await readdir4(config.archiveDir);
+    const files = await readdir5(config.archiveDir);
     const sessions = [];
     for (const file of files) {
       if (!file.endsWith(".md")) continue;
       const id = file.replace(".md", "");
       const filePath = join13(config.archiveDir, file);
-      const content = await readFile6(filePath, SESSION_FILE_ENCODING);
+      const content = await readFile7(filePath, SESSION_FILE_ENCODING);
       const metadata = parseSessionMetadata(content);
       sessions.push({
         id,
@@ -9817,7 +10197,7 @@ async function pruneCommand(options) {
 }
 
 // src/commands/session/release.ts
-import { readdir as readdir5, rename as rename3 } from "fs/promises";
+import { readdir as readdir6, rename as rename3 } from "fs/promises";
 
 // src/domains/session/release.ts
 function buildReleasePaths(sessionId, config) {
@@ -9848,7 +10228,7 @@ var SESSION_RELEASE_OUTPUT = {
 };
 async function loadDoingSessions(config) {
   try {
-    const files = await readdir5(config.doingDir);
+    const files = await readdir6(config.doingDir);
     return files.filter((file) => file.endsWith(".md")).map((file) => ({ id: file.replace(".md", "") }));
   } catch (error) {
     if (error instanceof Error && "code" in error && error.code === SESSION_FILE_ERROR_CODE.NOT_FOUND) {
@@ -9885,12 +10265,12 @@ async function releaseCommand(options) {
 }
 
 // src/commands/session/show.ts
-import { readFile as readFile7, stat as stat5 } from "fs/promises";
+import { readFile as readFile8, stat as stat6 } from "fs/promises";
 async function findExistingPath(paths, _config) {
   for (let i = 0; i < paths.length; i++) {
     const filePath = paths[i];
     try {
-      const stats = await stat5(filePath);
+      const stats = await stat6(filePath);
       if (stats.isFile()) {
         return { path: filePath, status: SEARCH_ORDER[i] };
       }
@@ -9905,7 +10285,7 @@ async function resolveSession(sessionId, config) {
   if (!found) {
     throw new SessionNotFoundError(sessionId);
   }
-  const content = await readFile7(found.path, SESSION_FILE_ENCODING);
+  const content = await readFile8(found.path, SESSION_FILE_ENCODING);
   return { status: found.status, path: found.path, content };
 }
 async function showSingle(sessionId, config) {
@@ -10569,7 +10949,7 @@ var sessionDomain = {
 };
 
 // src/lib/spec-tree/index.ts
-import { readdir as readdir6, readFile as readFile8 } from "fs/promises";
+import { readdir as readdir7, readFile as readFile9 } from "fs/promises";
 import { join as join14 } from "path";
 var SPEC_TREE_FIELD_KEY = {
   VERSION: "version",
@@ -10654,7 +11034,7 @@ function createFilesystemSpecTreeSource(options) {
       if (ref.path === void 0) {
         throw new Error("Filesystem source refs require a path");
       }
-      return readFile8(join14(options.productDir, ref.path), SPEC_TREE_TEXT_ENCODING);
+      return readFile9(join14(options.productDir, ref.path), SPEC_TREE_TEXT_ENCODING);
     }
   };
 }
@@ -10945,7 +11325,7 @@ async function* readFilesystemSourceEntries(productDir, registry, schemaVersions
 async function* walkFilesystemDirectory(context) {
   let entries;
   try {
-    entries = await readdir6(context.absolutePath, { withFileTypes: true });
+    entries = await readdir7(context.absolutePath, { withFileTypes: true });
   } catch (error) {
     if (isFileNotFound2(error)) return;
     throw error;
@@ -11117,7 +11497,7 @@ function formatNextNode(node) {
 }
 
 // src/commands/test/discovery.ts
-import { readdir as readdir7 } from "fs/promises";
+import { readdir as readdir8 } from "fs/promises";
 import { join as join15, relative as relative2, sep as sep2 } from "path";
 var TESTS_DIRECTORY_NAME = SPEC_TREE_EVIDENCE_FILE.DIRECTORY_NAME;
 var SPEC_ROOT_DIRECTORY = SPEC_TREE_CONFIG.ROOT_DIRECTORY;
@@ -11131,7 +11511,7 @@ async function discoverTestFiles(productDir) {
 async function collectTestFiles(directory, insideTestsDir, found) {
   let entries;
   try {
-    entries = await readdir7(directory, { withFileTypes: true });
+    entries = await readdir8(directory, { withFileTypes: true });
   } catch (error) {
     if (hasErrorCode2(error, ERROR_CODE_NOT_FOUND2)) return;
     throw error;
@@ -11380,8 +11760,8 @@ var PRODUCT_INPUT_DIGEST_FIELDS = {
   DESCRIPTOR_ID: "descriptorId",
   DIGEST: "digest"
 };
-var SHA256_ALGORITHM3 = "sha256";
-var HEX_ENCODING3 = "hex";
+var SHA256_ALGORITHM2 = "sha256";
+var HEX_ENCODING2 = "hex";
 var SEGMENT_SEPARATOR = "-";
 var defaultFileSystem2 = defaultFileSystem;
 function formatTestRunTimestamp(date) {
@@ -11657,7 +12037,7 @@ function isRecord6(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function sha256Hex2(value) {
-  return createHash4(SHA256_ALGORITHM3).update(value).digest(HEX_ENCODING3);
+  return createHash4(SHA256_ALGORITHM2).update(value).digest(HEX_ENCODING2);
 }
 var UNKNOWN_ERROR_MESSAGE = "unknown error";
 function toErrorMessage3(error) {
@@ -12542,7 +12922,7 @@ function createNodeStatusProvider(productDir) {
 }
 
 // src/lib/node-status/update.ts
-import { mkdir as mkdir4, readdir as readdir8, rm, writeFile as writeFile2 } from "fs/promises";
+import { mkdir as mkdir4, readdir as readdir9, rm, writeFile as writeFile2 } from "fs/promises";
 import { dirname as dirname8, join as join21 } from "path";
 
 // src/git/tracked-paths.ts
@@ -12666,7 +13046,7 @@ async function collectNodeStatusFiles(directory) {
 }
 async function readDirectoryEntries(directory) {
   try {
-    return await readdir8(directory, { withFileTypes: true });
+    return await readdir9(directory, { withFileTypes: true });
   } catch (error) {
     if (isNodeError3(error) && error.code === "ENOENT") return [];
     throw error;
@@ -13275,7 +13655,7 @@ var testingRegistry = {
 
 // src/interfaces/cli/test-runner-deps.ts
 import { createWriteStream } from "fs";
-import { mkdtemp, readFile as readFile9 } from "fs/promises";
+import { mkdtemp, readFile as readFile10 } from "fs/promises";
 import { tmpdir } from "os";
 import { join as join23 } from "path";
 import { finished } from "stream/promises";
@@ -13325,7 +13705,7 @@ function createRunnerDepsFor(productDir, outStream = process.stdout) {
 }
 function createRelatedDepsFor(productDir) {
   const runCommand = createRelatedCommandRunner(productDir);
-  return () => ({ runCommand, readFile: (path7) => readFile9(join23(productDir, path7), "utf8") });
+  return () => ({ runCommand, readFile: (path7) => readFile10(join23(productDir, path7), "utf8") });
 }
 function artifactFileName(index, suffix) {
   return `${index.toString(ARTIFACT_INDEX_RADIX).padStart(ARTIFACT_INDEX_WIDTH, "0")}-${suffix}`;
@@ -17025,11 +17405,11 @@ function formatLintResult(result, quiet, durationMs) {
 }
 
 // src/validation/literal/index.ts
-import { readFile as readFile11 } from "fs/promises";
+import { readFile as readFile12 } from "fs/promises";
 import { isAbsolute as isAbsolute9, relative as relative7, resolve as resolve10 } from "path";
 
 // src/lib/file-inclusion/pipeline.ts
-import { readdir as readdir9, readFile as readFile10, stat as stat6 } from "fs/promises";
+import { readdir as readdir10, readFile as readFile11, stat as stat7 } from "fs/promises";
 import { join as join33, relative as relative6, sep as sep3 } from "path";
 
 // src/lib/file-inclusion/ignore-source.ts
@@ -17335,7 +17715,7 @@ function isNodeError4(err) {
 }
 async function isDirectory(absolutePath) {
   try {
-    return (await stat6(absolutePath)).isDirectory();
+    return (await stat7(absolutePath)).isDirectory();
   } catch (err) {
     if (isNodeError4(err) && (err.code === "ENOENT" || err.code === "ENOTDIR")) {
       return false;
@@ -17345,7 +17725,7 @@ async function isDirectory(absolutePath) {
 }
 async function isGitdirPointerFile(absolutePath) {
   try {
-    const content = await readFile10(absolutePath, "utf8");
+    const content = await readFile11(absolutePath, "utf8");
     return content.startsWith(GITDIR_POINTER_PREFIX);
   } catch (err) {
     if (isNodeError4(err) && (err.code === "ENOENT" || err.code === "ENOTDIR")) {
@@ -17356,7 +17736,7 @@ async function isGitdirPointerFile(absolutePath) {
 }
 async function readDirectoryEntries2(absoluteDir) {
   try {
-    return await readdir9(absoluteDir, { withFileTypes: true });
+    return await readdir10(absoluteDir, { withFileTypes: true });
   } catch (err) {
     if (isNodeError4(err) && (err.code === "ENOENT" || err.code === "ENOTDIR")) {
       return [];
@@ -17969,7 +18349,7 @@ async function validateLiteralReuse(input) {
 }
 async function readSafe(path7) {
   try {
-    return await readFile11(path7, "utf8");
+    return await readFile12(path7, "utf8");
   } catch (err) {
     if (typeof err === "object" && err !== null && "code" in err) {
       const code = err.code;
@@ -19115,13 +19495,13 @@ async function persistVerificationContext(scope2, document, options = {}) {
       const existing = await readExistingContext(fs8, contextPath.value);
       if (!existing.ok) return existing;
       if (existing.value === document.canonicalJson) {
-        return { ok: true, value: { digest: document.digest, contextPath: contextPath.value } };
+        return { ok: true, value: { digest: document.digest, contextPath: contextPath.value, created: false } };
       }
       return { ok: false, error: VERIFICATION_CONTEXT_RUNTIME_ERROR.CONTENT_MISMATCH };
     }
     return { ok: false, error: `${VERIFICATION_CONTEXT_RUNTIME_ERROR.WRITE_FAILED}: ${toMessage(error)}` };
   }
-  return { ok: true, value: { digest: document.digest, contextPath: contextPath.value } };
+  return { ok: true, value: { digest: document.digest, contextPath: contextPath.value, created: true } };
 }
 async function readExistingContext(fs8, contextPath) {
   try {
@@ -19264,9 +19644,10 @@ var verificationContextDomain = {
 };
 
 // src/interfaces/cli/verify.ts
-import { readFile as readFile12 } from "fs/promises";
+import { readFile as readFile13 } from "fs/promises";
 
 // src/commands/verify/cli.ts
+import { randomBytes as randomBytes2 } from "crypto";
 import { dirname as dirname12 } from "path";
 
 // src/domains/verify/verify.ts
@@ -19279,18 +19660,35 @@ var VERIFY_VERB = {
   START: "start",
   INPUT: "input",
   APPEND_SCOPE: "append-scope",
-  APPEND_FINDING: "append-finding"
+  APPEND_FINDING: "append-finding",
+  FINISH: "finish",
+  STATUS: "status",
+  RENDER: "render"
 };
+var VERIFY_LIFECYCLE_ACTION = {
+  SCOPE_ADD: "scope add",
+  FINDING_ADD: "finding add",
+  FINISH: VERIFY_VERB.FINISH
+};
+var UNSEALED_NEXT_ACTIONS = [
+  VERIFY_LIFECYCLE_ACTION.SCOPE_ADD,
+  VERIFY_LIFECYCLE_ACTION.FINDING_ADD,
+  VERIFY_LIFECYCLE_ACTION.FINISH
+];
 var VERIFY_VERIFICATION_TYPE = {
   REVIEW: "review"
 };
+var VERIFY_VERIFICATION_TYPES = new Set(Object.values(VERIFY_VERIFICATION_TYPE));
+function isVerifyVerificationType(value) {
+  return VERIFY_VERIFICATION_TYPES.has(value);
+}
 var REVIEW_FINDING_DISPOSITION = {
   BLOCKING: "BLOCKING",
   DEBT: "DEBT"
 };
 var VERIFY_APPEND_EVENT_TYPE = {
-  SCOPE: "io.spx.verify.scope",
-  FINDING: "io.spx.verify.finding"
+  SCOPE: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.verify.scope`,
+  FINDING: `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.verify.finding`
 };
 var VERIFY_EVENT_SOURCE = "/spx/verify";
 var VERIFY_APPEND_EVENT_FIELD = {
@@ -19308,7 +19706,9 @@ var VERIFY_SCOPE_ERROR = {
 var VERIFY_INPUT_DIGEST_PATH = "verify run input";
 function parseChangesetScope(scope2) {
   const separatorIndex = scope2.indexOf(VERIFY_SCOPE_SEPARATOR);
-  if (separatorIndex < 0) return { ok: false, error: VERIFY_SCOPE_ERROR.MALFORMED_CHANGESET };
+  if (separatorIndex < 0) {
+    return { ok: false, error: VERIFY_SCOPE_ERROR.MALFORMED_CHANGESET };
+  }
   const base = scope2.slice(0, separatorIndex);
   const head = scope2.slice(separatorIndex + VERIFY_SCOPE_SEPARATOR.length);
   if (base.length === 0 || head.length === 0 || head.includes(VERIFY_SCOPE_SEPARATOR)) {
@@ -19328,7 +19728,10 @@ function buildRunLocator(parts) {
   };
 }
 function digestRunInput(source, content) {
-  const digest = digestDescriptorSection({ source, content }, VERIFY_INPUT_DIGEST_PATH);
+  const digest = digestDescriptorSection(
+    { source, content },
+    VERIFY_INPUT_DIGEST_PATH
+  );
   if (!digest.ok) return digest;
   return { ok: true, value: digest.value.sha256 };
 }
@@ -19348,7 +19751,10 @@ function verifyInputRecordPath(scope2) {
   if (!token.ok) return token;
   return {
     ok: true,
-    value: join36(runs.value, `${VERIFY_INPUT_RECORD.PREFIX}${token.value}${VERIFY_INPUT_RECORD.SUFFIX}`)
+    value: join36(
+      runs.value,
+      `${VERIFY_INPUT_RECORD.PREFIX}${token.value}${VERIFY_INPUT_RECORD.SUFFIX}`
+    )
   };
 }
 var VERIFY_APPEND_ATTEMPT = 1;
@@ -19397,6 +19803,58 @@ function buildAppendEvent(args) {
     }
   };
 }
+var VERIFY_TERMINAL_EVENT_TYPE = `${RUNTIME_EVENT_NAMESPACE_DEFAULT}.verify.terminal`;
+var VERIFY_TERMINAL_EVENT_FIELD = {
+  TERMINAL_STATUS: "terminalStatus"
+};
+var VERIFY_TERMINAL_EVENT_ID_PREFIX = "verify-terminal-";
+function isVerifyTerminalStatus(value) {
+  return isJournalRunStateStatus(value);
+}
+function buildTerminalEvent(args) {
+  return {
+    id: `${VERIFY_TERMINAL_EVENT_ID_PREFIX}${args.runToken}`,
+    source: VERIFY_EVENT_SOURCE,
+    type: VERIFY_TERMINAL_EVENT_TYPE,
+    time: args.at.toISOString(),
+    attempt: VERIFY_APPEND_ATTEMPT,
+    data: {
+      [VERIFY_TERMINAL_EVENT_FIELD.TERMINAL_STATUS]: args.terminalStatus
+    }
+  };
+}
+var VERIFY_NO_EVENTS_SEQUENCE = 0;
+function findTerminalEvent(events) {
+  return events.find((event) => event.type === VERIFY_TERMINAL_EVENT_TYPE);
+}
+function terminalStatusOf(event) {
+  if (event === void 0 || !isJsonRecord(event.data)) return void 0;
+  const status = event.data[VERIFY_TERMINAL_EVENT_FIELD.TERMINAL_STATUS];
+  return typeof status === "string" ? status : void 0;
+}
+function countVerifyFindings(events) {
+  return events.filter(
+    (event) => event.type === VERIFY_APPEND_EVENT_TYPE.FINDING
+  ).length;
+}
+function lastSequenceOf(events) {
+  return events.reduce(
+    (max, event) => event.seq > max ? event.seq : max,
+    VERIFY_NO_EVENTS_SEQUENCE
+  );
+}
+function projectVerifyRun(events) {
+  const terminal = findTerminalEvent(events);
+  const terminalStatus = terminalStatusOf(terminal);
+  const sealed = terminal !== void 0;
+  return {
+    sealed,
+    ...terminalStatus === void 0 ? {} : { terminalStatus },
+    findingCount: countVerifyFindings(events),
+    lastSequence: lastSequenceOf(events),
+    nextActions: sealed ? [] : UNSEALED_NEXT_ACTIONS
+  };
+}
 
 // src/commands/verify/cli.ts
 var VERIFY_CLI_EXIT_CODE = {
@@ -19407,19 +19865,40 @@ var VERIFY_CLI_ENV = {
   BRANCH: SPX_VERIFY_ENV.BRANCH
 };
 var VERIFY_CLI_ERROR = {
-  INPUT_REQUIRED: "spx verify start requires --input <input-source>",
-  RUN_REQUIRED: "spx verify existing-run verbs require an explicit --run <run-token>",
-  RUN_NOT_FOUND: "spx verify could not locate the requested run",
-  CHANGED_SCOPE_FAILED: "spx verify could not derive the changeset changed-file scope",
-  INPUT_PERSIST_FAILED: "spx verify could not persist the recorded run input",
-  INPUT_READ_FAILED: "spx verify could not read the recorded run input",
-  PAYLOAD_REQUIRED: "spx verify append verbs require --payload <payload-source>",
-  IDEMPOTENCY_KEY_REQUIRED: "spx verify append verbs require --idempotency-key <key>",
-  PAYLOAD_READ_FAILED: "spx verify could not read the append payload",
-  PAYLOAD_INVALID: "spx verify append payload is not valid JSON",
-  FINDING_INVALID: "spx verify append-finding payload failed verification-type validation",
-  UNSUPPORTED_VERIFICATION_TYPE: "spx verify append-finding has no finding validator for the verification type",
-  APPEND_FAILED: "spx verify could not append the evidence event"
+  INPUT_REQUIRED: "spx verification run start requires --input <input-source>",
+  RUN_REQUIRED: "spx verification run existing-run commands require an explicit --run <run-token>",
+  RUN_NOT_FOUND: "spx verification run could not locate the requested run",
+  RUN_SELECTOR_MISMATCH: "spx verification run selector does not match the recorded run",
+  CHANGED_SCOPE_FAILED: "spx verification run could not derive the changeset changed-file scope",
+  INPUT_PERSIST_FAILED: "spx verification run could not persist the recorded run input",
+  INPUT_READ_FAILED: "spx verification run could not read the recorded run input",
+  PAYLOAD_REQUIRED: "spx verification run evidence-add commands require --payload <payload-source>",
+  IDEMPOTENCY_KEY_REQUIRED: "spx verification run evidence-add commands require --idempotency-key <key>",
+  PAYLOAD_READ_FAILED: "spx verification run could not read the evidence payload",
+  PAYLOAD_INVALID: "spx verification run evidence payload is not valid JSON",
+  RUN_FINISHED: "spx verification run cannot add evidence to a finished run",
+  FINDING_INVALID: "spx verification run finding add payload failed verification-type validation",
+  UNSUPPORTED_VERIFICATION_TYPE: "spx verification run verification type is not registered",
+  APPEND_FAILED: "spx verification run could not append the evidence event",
+  TERMINAL_STATUS_REQUIRED: "spx verification run finish requires --terminal-status <status>",
+  TERMINAL_STATUS_INVALID: "spx verification run finish requires a terminal status in the journal terminal-status vocabulary",
+  FINISH_FAILED: "spx verification run could not record terminal completion",
+  SEAL_FAILED: "spx verification run could not seal the run journal",
+  STATUS_FAILED: "spx verification run could not read the run status",
+  RENDER_FAILED: "spx verification run could not render the run projection"
+};
+var VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD = {
+  RUN: "run=",
+  VERIFICATION_TYPE: "verification-type=",
+  SCOPE_TYPE: "scope-type=",
+  SCOPE: "scope=",
+  BACKEND: "backend=",
+  NAMESPACE: "namespace=",
+  TARGET: "target="
+};
+var VERIFY_START_ROLLBACK_ARTIFACT = {
+  CONTEXT_FILE: "verification context file",
+  RUN_FILE: "journal run file"
 };
 function okResult3(output) {
   return { exitCode: VERIFY_CLI_EXIT_CODE.OK, output };
@@ -19478,73 +19957,131 @@ async function persistInputRecord(runScope2, record6, deps) {
   const fs8 = deps.fs ?? defaultFileSystem;
   try {
     await fs8.mkdir(dirname12(path7.value), { recursive: true });
-    await fs8.writeFile(path7.value, JSON.stringify(record6));
+    await writeFileAtomic(path7.value, JSON.stringify(record6), { fs: fs8, randomBytes: randomBytes2 });
     return { ok: true, value: void 0 };
   } catch (error) {
     return { ok: false, error: `${VERIFY_CLI_ERROR.INPUT_PERSIST_FAILED}: ${toMessage2(error)}` };
   }
 }
+async function readStartInputContent(source, deps) {
+  try {
+    return { ok: true, value: await deps.readInputSource(source) };
+  } catch (error) {
+    return { ok: false, error: `${VERIFY_CLI_ERROR.INPUT_READ_FAILED}: ${toMessage2(error)}` };
+  }
+}
+async function removeStartedRunArtifact(path7, label, deps) {
+  const fs8 = deps.fs ?? defaultFileSystem;
+  try {
+    await fs8.rm(path7, { force: true });
+    return { ok: true, value: void 0 };
+  } catch (error) {
+    return {
+      ok: false,
+      error: `${VERIFY_CLI_ERROR.INPUT_PERSIST_FAILED}: rollback failed for ${label}: ${toMessage2(error)}`
+    };
+  }
+}
+async function removeStartedRunArtifacts(artifacts, deps) {
+  const rollbackErrors = [];
+  if (artifacts.contextPath !== void 0) {
+    const contextRollback = await removeStartedRunArtifact(
+      artifacts.contextPath,
+      VERIFY_START_ROLLBACK_ARTIFACT.CONTEXT_FILE,
+      deps
+    );
+    if (!contextRollback.ok) rollbackErrors.push(contextRollback.error);
+  }
+  if (artifacts.runFile !== void 0) {
+    const runRollback = await removeStartedRunArtifact(
+      artifacts.runFile,
+      VERIFY_START_ROLLBACK_ARTIFACT.RUN_FILE,
+      deps
+    );
+    if (!runRollback.ok) rollbackErrors.push(runRollback.error);
+  }
+  if (rollbackErrors.length > 0) return { ok: false, error: rollbackErrors.join("; ") };
+  return { ok: true, value: void 0 };
+}
+function isStoredRecordedInput(value) {
+  if (typeof value !== "object" || value === null) return false;
+  const record6 = value;
+  return typeof record6.scopeIdentity === "string" && typeof record6.scopeType === "string" && typeof record6.source === "string" && typeof record6.digest === "string" && typeof record6.content === "string";
+}
+function parseRecordedInput(content) {
+  try {
+    const parsed = JSON.parse(content);
+    if (!isStoredRecordedInput(parsed)) {
+      return { ok: false, error: `${VERIFY_CLI_ERROR.INPUT_READ_FAILED}: recorded input is missing required fields` };
+    }
+    return { ok: true, value: parsed };
+  } catch (error) {
+    return { ok: false, error: `${VERIFY_CLI_ERROR.INPUT_READ_FAILED}: ${toMessage2(error)}` };
+  }
+}
 async function readInputRecordAt(path7, deps) {
   const fs8 = deps.fs ?? defaultFileSystem;
+  let content;
   try {
-    const content = await fs8.readFile(path7, STATE_STORE_TEXT_ENCODING);
-    return { ok: true, value: JSON.parse(content) };
+    content = await fs8.readFile(path7, STATE_STORE_TEXT_ENCODING);
   } catch (error) {
     if (hasErrorCode(error, ERROR_CODE_NOT_FOUND)) return { ok: true, value: void 0 };
     return { ok: false, error: `${VERIFY_CLI_ERROR.INPUT_READ_FAILED}: ${toMessage2(error)}` };
   }
+  const parsed = parseRecordedInput(content);
+  if (!parsed.ok) return parsed;
+  return { ok: true, value: parsed.value };
 }
-function verifyRunNotFoundDiagnostic(context) {
+function verifyRunLocatorDiagnostic(summary, context) {
   return [
-    VERIFY_CLI_ERROR.RUN_NOT_FOUND,
-    `run=${context.runToken}`,
-    `verification-type=${context.verificationType}`,
-    `scope-type=${context.scopeType}`,
-    `scope=${context.scopeIdentity}`,
-    `backend=${context.backendIdentity}`,
-    `namespace=${context.storageNamespace}`,
-    `target=${context.searchedTarget}`
+    summary,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.RUN}${context.runToken}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.VERIFICATION_TYPE}${context.verificationType}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.SCOPE_TYPE}${context.scopeType}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.SCOPE}${context.scopeIdentity}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.BACKEND}${context.backendIdentity}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.NAMESPACE}${context.storageNamespace}`,
+    `${VERIFY_RUN_NOT_FOUND_DIAGNOSTIC_FIELD.TARGET}${context.searchedTarget}`
   ].join(" ");
 }
-async function verifyStartCommand(options, deps) {
-  if (options.scopeType !== VERIFY_SCOPE_TYPE.CHANGESET) return errorResult3(VERIFY_SCOPE_ERROR.UNSUPPORTED_SCOPE_TYPE);
-  if (options.input.trim().length === 0) return errorResult3(VERIFY_CLI_ERROR.INPUT_REQUIRED);
-  const scope2 = parseChangesetScope(options.scope);
-  if (!scope2.ok) return errorResult3(scope2.error);
-  const resolved = await resolveVerifyScope(deps);
-  if (!resolved.ok) return errorResult3(resolved.error);
-  const inputContent = await deps.readInputSource(options.input);
-  const inputDigest = digestRunInput(options.input, inputContent);
-  if (!inputDigest.ok) return errorResult3(inputDigest.error);
-  const context = await verificationContextCreateCommand(
-    {
-      subject: VERIFICATION_CONTEXT_SUBJECT_KIND.CHANGESET,
-      base: scope2.value.base,
-      head: scope2.value.head,
-      predicate: options.verificationType,
-      workflow: options.verificationType
-    },
-    forwardDeps(deps)
-  );
-  if (context.exitCode !== VERIFY_CLI_EXIT_CODE.OK) return errorResult3(context.output);
-  const contextDigest = JSON.parse(context.output).digest;
+function verifyRunNotFoundDiagnostic(context) {
+  return verifyRunLocatorDiagnostic(VERIFY_CLI_ERROR.RUN_NOT_FOUND, context);
+}
+async function completeVerifyStartCommand(args) {
+  const { options, deps } = args;
   const opened = await journalOpenCommand(
-    { type: options.verificationType, branchSlug: resolved.value.branchSlug },
+    { type: options.verificationType, branchSlug: args.branchSlug },
     forwardDeps(deps)
   );
-  if (opened.exitCode !== VERIFY_CLI_EXIT_CODE.OK) return errorResult3(opened.output);
+  if (opened.exitCode !== VERIFY_CLI_EXIT_CODE.OK) {
+    const rollback = await removeStartedRunArtifacts(
+      { ...args.contextCreated ? { contextPath: args.contextPath } : {} },
+      deps
+    );
+    return errorResult3(rollback.ok ? opened.output : `${opened.output}; ${rollback.error}`);
+  }
   const { runToken, runFile } = JSON.parse(opened.output);
   const runScope2 = {
-    productDir: resolved.value.productDir,
-    branchSlug: resolved.value.branchSlug,
+    productDir: args.productDir,
+    branchSlug: args.branchSlug,
     type: options.verificationType,
     runToken
   };
-  const recorded = { source: options.input, digest: inputDigest.value, content: inputContent };
+  const recorded = {
+    scopeIdentity: options.scope,
+    scopeType: options.scopeType,
+    source: options.input,
+    digest: args.inputDigest,
+    content: args.inputContent
+  };
   const persisted = await persistInputRecord(runScope2, recorded, deps);
-  if (!persisted.ok) return errorResult3(persisted.error);
-  const changedScope = await resolveChangedScope(scope2.value, deps);
-  if (!changedScope.ok) return errorResult3(changedScope.error);
+  if (!persisted.ok) {
+    const rollback = await removeStartedRunArtifacts(
+      { ...args.contextCreated ? { contextPath: args.contextPath } : {}, runFile },
+      deps
+    );
+    return errorResult3(rollback.ok ? persisted.error : `${persisted.error}; ${rollback.error}`);
+  }
   const namespace = verifyRunsDir(runScope2);
   if (!namespace.ok) return errorResult3(namespace.error);
   const locator = buildRunLocator({
@@ -19552,52 +20089,69 @@ async function verifyStartCommand(options, deps) {
     verificationType: options.verificationType,
     scopeType: options.scopeType,
     scopeIdentity: options.scope,
-    backendIdentity: resolved.value.backendIdentity,
+    backendIdentity: args.backendIdentity,
     storageNamespace: namespace.value,
     runTarget: runFile
   });
   const report2 = {
     runToken,
-    contextDigest,
-    changedScope: changedScope.value,
-    input: { source: options.input, digest: inputDigest.value },
+    contextDigest: args.contextDigest,
+    changedScope: args.changedScope,
+    input: { source: options.input, digest: args.inputDigest },
     locator
   };
   return okResult3(JSON.stringify(report2));
 }
-async function verifyInputCommand(options, deps) {
-  if (options.run.trim().length === 0) return errorResult3(VERIFY_CLI_ERROR.RUN_REQUIRED);
+async function verifyStartCommand(options, deps) {
+  if (!isVerifyVerificationType(options.verificationType)) {
+    return errorResult3(VERIFY_CLI_ERROR.UNSUPPORTED_VERIFICATION_TYPE);
+  }
+  if (options.scopeType !== VERIFY_SCOPE_TYPE.CHANGESET) return errorResult3(VERIFY_SCOPE_ERROR.UNSUPPORTED_SCOPE_TYPE);
+  if (options.input.trim().length === 0) return errorResult3(VERIFY_CLI_ERROR.INPUT_REQUIRED);
+  const scope2 = parseChangesetScope(options.scope);
+  if (!scope2.ok) return errorResult3(scope2.error);
   const resolved = await resolveVerifyScope(deps);
   if (!resolved.ok) return errorResult3(resolved.error);
-  const runScope2 = {
+  const inputContent = await readStartInputContent(options.input, deps);
+  if (!inputContent.ok) return errorResult3(inputContent.error);
+  const inputDigest = digestRunInput(options.input, inputContent.value);
+  if (!inputDigest.ok) return errorResult3(inputDigest.error);
+  const changedScope = await resolveChangedScope(scope2.value, deps);
+  if (!changedScope.ok) return errorResult3(changedScope.error);
+  const context = await verificationContextCreateCommand(
+    {
+      subject: VERIFICATION_CONTEXT_SUBJECT_KIND.CHANGESET,
+      base: scope2.value.base,
+      head: scope2.value.head,
+      predicate: options.verificationType,
+      workflow: options.verificationType
+    },
+    forwardDeps(deps)
+  );
+  if (context.exitCode !== VERIFY_CLI_EXIT_CODE.OK) return errorResult3(context.output);
+  const { digest: contextDigest, contextPath, created: contextCreated } = JSON.parse(context.output);
+  return completeVerifyStartCommand({
+    options,
+    deps,
     productDir: resolved.value.productDir,
     branchSlug: resolved.value.branchSlug,
-    type: options.verificationType,
-    runToken: options.run
-  };
-  const path7 = verifyInputRecordPath(runScope2);
-  if (!path7.ok) return errorResult3(path7.error);
-  const namespace = verifyRunsDir(runScope2);
-  if (!namespace.ok) return errorResult3(namespace.error);
-  const record6 = await readInputRecordAt(path7.value, deps);
-  if (!record6.ok) return errorResult3(record6.error);
-  if (record6.value === void 0) {
-    return errorResult3(
-      verifyRunNotFoundDiagnostic({
-        runToken: options.run,
-        verificationType: options.verificationType,
-        scopeType: options.scopeType,
-        scopeIdentity: options.scope,
-        backendIdentity: resolved.value.backendIdentity,
-        storageNamespace: namespace.value,
-        searchedTarget: path7.value
-      })
-    );
-  }
+    backendIdentity: resolved.value.backendIdentity,
+    changedScope: changedScope.value,
+    inputDigest: inputDigest.value,
+    inputContent: inputContent.value,
+    contextDigest,
+    contextPath,
+    contextCreated
+  });
+}
+async function verifyInputCommand(options, deps) {
+  const run = await resolveExistingRun(options, deps);
+  if (!run.ok) return errorResult3(run.error);
+  const record6 = run.value.recordedInput;
   const report2 = {
-    source: record6.value.source,
-    digest: record6.value.digest,
-    content: record6.value.content
+    source: record6.source,
+    digest: record6.digest,
+    content: record6.content
   };
   return okResult3(JSON.stringify(report2));
 }
@@ -19606,12 +20160,36 @@ async function readRunJournalEvents(scope2, deps) {
   if (read.exitCode !== VERIFY_CLI_EXIT_CODE.OK) return { ok: false, error: read.output };
   return { ok: true, value: JSON.parse(read.output) };
 }
+async function readAppendExistingEvents(options, deps, journalScope, backendIdentity, namespace) {
+  const existingEvents = await readRunJournalEvents(journalScope, deps);
+  if (!existingEvents.ok) {
+    if (existingEvents.error === JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND) {
+      return {
+        ok: false,
+        error: appendRunNotFoundDiagnostic(options, backendIdentity, namespace)
+      };
+    }
+    return { ok: false, error: `${VERIFY_CLI_ERROR.APPEND_FAILED}: ${existingEvents.error}` };
+  }
+  if (findTerminalEvent(existingEvents.value) !== void 0) {
+    return { ok: false, error: VERIFY_CLI_ERROR.RUN_FINISHED };
+  }
+  return existingEvents;
+}
 async function prepareAppend(options, deps) {
   if (options.run.trim().length === 0) return { ok: false, error: VERIFY_CLI_ERROR.RUN_REQUIRED };
+  if (!isVerifyVerificationType(options.verificationType)) {
+    return { ok: false, error: VERIFY_CLI_ERROR.UNSUPPORTED_VERIFICATION_TYPE };
+  }
   if (options.payload.trim().length === 0) return { ok: false, error: VERIFY_CLI_ERROR.PAYLOAD_REQUIRED };
   if (options.idempotencyKey.trim().length === 0) {
     return { ok: false, error: VERIFY_CLI_ERROR.IDEMPOTENCY_KEY_REQUIRED };
   }
+  if (options.scopeType !== VERIFY_SCOPE_TYPE.CHANGESET) {
+    return { ok: false, error: VERIFY_SCOPE_ERROR.UNSUPPORTED_SCOPE_TYPE };
+  }
+  const scope2 = parseChangesetScope(options.scope);
+  if (!scope2.ok) return scope2;
   const readPayload = deps.readPayloadSource;
   const binding = deps.journalBinding;
   if (readPayload === void 0 || binding === void 0) return { ok: false, error: VERIFY_CLI_ERROR.APPEND_FAILED };
@@ -19625,25 +20203,53 @@ async function prepareAppend(options, deps) {
   };
   const namespace = verifyRunsDir(runScope2);
   if (!namespace.ok) return namespace;
+  const journalScope = {
+    type: options.verificationType,
+    runToken: options.run,
+    branchSlug: resolved.value.branchSlug
+  };
+  const existingEvents = await readAppendExistingEvents(
+    options,
+    deps,
+    journalScope,
+    resolved.value.backendIdentity,
+    namespace.value
+  );
+  if (!existingEvents.ok) return existingEvents;
   const inputPath = verifyInputRecordPath(runScope2);
   if (!inputPath.ok) return inputPath;
   const inputRecord = await readInputRecordAt(inputPath.value, deps);
   if (!inputRecord.ok) return inputRecord;
   if (inputRecord.value === void 0) {
-    return { ok: false, error: appendRunNotFoundDiagnostic(options, resolved.value.backendIdentity, namespace.value) };
+    return {
+      ok: false,
+      error: appendRunNotFoundDiagnostic(options, resolved.value.backendIdentity, namespace.value, inputPath.value)
+    };
+  }
+  if (!recordedSelectorMatches(inputRecord.value, options)) {
+    return {
+      ok: false,
+      error: appendRunSelectorMismatchDiagnostic(
+        options,
+        resolved.value.backendIdentity,
+        namespace.value,
+        inputPath.value
+      )
+    };
   }
   return {
     ok: true,
     value: {
       readPayload,
       binding,
-      journalScope: { type: options.verificationType, runToken: options.run, branchSlug: resolved.value.branchSlug },
+      journalScope,
       namespace: namespace.value,
-      backendIdentity: resolved.value.backendIdentity
+      backendIdentity: resolved.value.backendIdentity,
+      existingEvents: existingEvents.value
     }
   };
 }
-function appendRunNotFoundDiagnostic(options, backendIdentity, namespace) {
+function appendRunNotFoundDiagnostic(options, backendIdentity, namespace, searchedTarget = namespace) {
   return verifyRunNotFoundDiagnostic({
     runToken: options.run,
     verificationType: options.verificationType,
@@ -19651,7 +20257,18 @@ function appendRunNotFoundDiagnostic(options, backendIdentity, namespace) {
     scopeIdentity: options.scope,
     backendIdentity,
     storageNamespace: namespace,
-    searchedTarget: namespace
+    searchedTarget
+  });
+}
+function appendRunSelectorMismatchDiagnostic(options, backendIdentity, namespace, searchedTarget) {
+  return verifyRunLocatorDiagnostic(VERIFY_CLI_ERROR.RUN_SELECTOR_MISMATCH, {
+    runToken: options.run,
+    verificationType: options.verificationType,
+    scopeType: options.scopeType,
+    scopeIdentity: options.scope,
+    backendIdentity,
+    storageNamespace: namespace,
+    searchedTarget
   });
 }
 function validateAppendFinding(verb, verificationType, payload) {
@@ -19667,16 +20284,9 @@ function appendEventType(verb) {
 async function verifyAppend(options, deps, verb) {
   const prepared = await prepareAppend(options, deps);
   if (!prepared.ok) return errorResult3(prepared.error);
-  const { readPayload, binding, journalScope, namespace, backendIdentity } = prepared.value;
+  const { readPayload, binding, journalScope, existingEvents } = prepared.value;
   const eventType = appendEventType(verb);
-  const before = await readRunJournalEvents(journalScope, deps);
-  if (!before.ok) {
-    if (before.error === JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND) {
-      return errorResult3(appendRunNotFoundDiagnostic(options, backendIdentity, namespace));
-    }
-    return errorResult3(`${VERIFY_CLI_ERROR.APPEND_FAILED}: ${before.error}`);
-  }
-  const existing = findAppendedSequence(before.value, options.idempotencyKey, eventType);
+  const existing = findAppendedSequence(existingEvents, options.idempotencyKey, eventType);
   if (existing !== void 0) {
     const report3 = { sequence: existing, idempotent: true };
     return okResult3(JSON.stringify(report3));
@@ -19714,24 +20324,270 @@ async function verifyAppendScopeCommand(options, deps) {
 async function verifyAppendFindingCommand(options, deps) {
   return verifyAppend(options, deps, VERIFY_VERB.APPEND_FINDING);
 }
+function existingRunNotFound(run, options) {
+  return verifyRunNotFoundDiagnostic({
+    runToken: run.runToken,
+    verificationType: options.verificationType,
+    scopeType: options.scopeType,
+    scopeIdentity: options.scope,
+    backendIdentity: run.backendIdentity,
+    storageNamespace: run.namespace,
+    searchedTarget: run.inputRecordPath
+  });
+}
+function existingRunSelectorMismatch(run, options) {
+  return verifyRunLocatorDiagnostic(VERIFY_CLI_ERROR.RUN_SELECTOR_MISMATCH, {
+    runToken: run.runToken,
+    verificationType: options.verificationType,
+    scopeType: options.scopeType,
+    scopeIdentity: options.scope,
+    backendIdentity: run.backendIdentity,
+    storageNamespace: run.namespace,
+    searchedTarget: run.inputRecordPath
+  });
+}
+function recordedSelectorMatches(record6, options) {
+  return record6.scopeType === options.scopeType && record6.scopeIdentity === options.scope;
+}
+async function readExistingRecordedInput(run, deps) {
+  return readInputRecordAt(run.inputRecordPath, deps);
+}
+async function resolveExistingRunAddress(options, deps) {
+  if (!isVerifyVerificationType(options.verificationType)) {
+    return { ok: false, error: VERIFY_CLI_ERROR.UNSUPPORTED_VERIFICATION_TYPE };
+  }
+  if (options.scopeType !== VERIFY_SCOPE_TYPE.CHANGESET) {
+    return { ok: false, error: VERIFY_SCOPE_ERROR.UNSUPPORTED_SCOPE_TYPE };
+  }
+  const scope2 = parseChangesetScope(options.scope);
+  if (!scope2.ok) return scope2;
+  if (options.run.trim().length === 0) return { ok: false, error: VERIFY_CLI_ERROR.RUN_REQUIRED };
+  const resolved = await resolveVerifyScope(deps);
+  if (!resolved.ok) return resolved;
+  const runScope2 = {
+    productDir: resolved.value.productDir,
+    branchSlug: resolved.value.branchSlug,
+    type: options.verificationType,
+    runToken: options.run
+  };
+  const namespace = verifyRunsDir(runScope2);
+  if (!namespace.ok) return namespace;
+  const inputPath = verifyInputRecordPath(runScope2);
+  if (!inputPath.ok) return inputPath;
+  return {
+    ok: true,
+    value: {
+      productDir: resolved.value.productDir,
+      runToken: options.run,
+      journalScope: { type: options.verificationType, runToken: options.run, branchSlug: resolved.value.branchSlug },
+      namespace: namespace.value,
+      backendIdentity: resolved.value.backendIdentity,
+      inputRecordPath: inputPath.value
+    }
+  };
+}
+async function resolveExistingRun(options, deps) {
+  const address = await resolveExistingRunAddress(options, deps);
+  if (!address.ok) return address;
+  const inputRecord = await readExistingRecordedInput(address.value, deps);
+  if (!inputRecord.ok) return inputRecord;
+  if (inputRecord.value === void 0) {
+    return { ok: false, error: existingRunNotFound(address.value, options) };
+  }
+  if (!recordedSelectorMatches(inputRecord.value, options)) {
+    return { ok: false, error: existingRunSelectorMismatch(address.value, options) };
+  }
+  const run = { ...address.value, recordedInput: inputRecord.value };
+  return { ok: true, value: run };
+}
+function isRecordedInputReadFailure(error) {
+  return error.startsWith(VERIFY_CLI_ERROR.INPUT_READ_FAILED);
+}
+async function readRecordedInputForProjection(run, options, events, deps) {
+  const terminal = findTerminalEvent(events);
+  const inputRecord = await readExistingRecordedInput(run, deps);
+  if (!inputRecord.ok) {
+    if (terminal !== void 0 && isRecordedInputReadFailure(inputRecord.error)) {
+      return { ok: true, value: void 0 };
+    }
+    return inputRecord;
+  }
+  if (inputRecord.value === void 0) return { ok: true, value: void 0 };
+  if (!recordedSelectorMatches(inputRecord.value, options)) {
+    return { ok: false, error: existingRunSelectorMismatch(run, options) };
+  }
+  return { ok: true, value: inputRecord.value };
+}
+function verifyFinishReport(runToken, projection) {
+  return {
+    runToken,
+    ...projection.terminalStatus === void 0 ? {} : { terminalStatus: projection.terminalStatus },
+    sealed: projection.sealed,
+    findingCount: projection.findingCount,
+    lastSequence: projection.lastSequence
+  };
+}
+async function isJournalPhysicallySealed(run, deps) {
+  return isJournalRunSealed(
+    { ...run.journalScope, productDir: run.productDir },
+    { ...deps.fs === void 0 ? {} : { fs: deps.fs } }
+  );
+}
+async function sealExistingRun(run, deps) {
+  const sealed = await journalSealCommand(run.journalScope, forwardDeps(deps));
+  if (sealed.exitCode !== VERIFY_CLI_EXIT_CODE.OK) {
+    return errorResult3(`${VERIFY_CLI_ERROR.SEAL_FAILED}: ${sealed.output}`);
+  }
+  return void 0;
+}
+function finishReadFailure(run, options, error) {
+  if (error === JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND) {
+    return errorResult3(existingRunNotFound(run, options));
+  }
+  return errorResult3(`${VERIFY_CLI_ERROR.FINISH_FAILED}: ${error}`);
+}
+async function finishProjectionResult(run, deps) {
+  const events = await readRunJournalEvents(run.journalScope, deps);
+  if (!events.ok) return errorResult3(`${VERIFY_CLI_ERROR.FINISH_FAILED}: ${events.error}`);
+  return okResult3(JSON.stringify(verifyFinishReport(run.runToken, projectVerifyRun(events.value))));
+}
+async function retrySealForTerminalRun(run, deps) {
+  const physicallySealed = await isJournalPhysicallySealed(run, deps);
+  if (!physicallySealed.ok) return void 0;
+  if (physicallySealed.value) return void 0;
+  return sealExistingRun(run, deps);
+}
+async function verifyFinishCommand(options, deps) {
+  if (options.terminalStatus.trim().length === 0) return errorResult3(VERIFY_CLI_ERROR.TERMINAL_STATUS_REQUIRED);
+  if (!isVerifyTerminalStatus(options.terminalStatus)) return errorResult3(VERIFY_CLI_ERROR.TERMINAL_STATUS_INVALID);
+  const run = await resolveExistingRunAddress(options, deps);
+  if (!run.ok) return errorResult3(run.error);
+  const before = await readRunJournalEvents(run.value.journalScope, deps);
+  if (!before.ok) {
+    return finishReadFailure(run.value, options, before.error);
+  }
+  const inputRecord = await readRecordedInputForProjection(run.value, options, before.value, deps);
+  if (!inputRecord.ok) return errorResult3(inputRecord.error);
+  if (findTerminalEvent(before.value) !== void 0) {
+    const retrySeal = await retrySealForTerminalRun(run.value, deps);
+    return retrySeal ?? finishProjectionResult(run.value, deps);
+  }
+  if (inputRecord.value === void 0) {
+    return errorResult3(existingRunNotFound(run.value, options));
+  }
+  const binding = deps.journalBinding;
+  if (binding === void 0) return errorResult3(VERIFY_CLI_ERROR.FINISH_FAILED);
+  const event = buildTerminalEvent({
+    runToken: run.value.runToken,
+    terminalStatus: options.terminalStatus,
+    at: deps.now?.() ?? /* @__PURE__ */ new Date()
+  });
+  const appended = await journalAppendCommand(run.value.journalScope, event, binding, forwardDeps(deps));
+  if (appended.exitCode !== VERIFY_CLI_EXIT_CODE.OK) {
+    return errorResult3(`${VERIFY_CLI_ERROR.FINISH_FAILED}: ${appended.output}`);
+  }
+  const sealResult = await sealExistingRun(run.value, deps);
+  if (sealResult !== void 0) return sealResult;
+  return finishProjectionResult(run.value, deps);
+}
+async function verifyStatusCommand(options, deps) {
+  const run = await resolveExistingRunAddress(options, deps);
+  if (!run.ok) return errorResult3(run.error);
+  const events = await readRunJournalEvents(run.value.journalScope, deps);
+  if (!events.ok) {
+    if (events.error === JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND) {
+      return errorResult3(existingRunNotFound(run.value, options));
+    }
+    return errorResult3(`${VERIFY_CLI_ERROR.STATUS_FAILED}: ${events.error}`);
+  }
+  const inputRecord = await readRecordedInputForProjection(run.value, options, events.value, deps);
+  if (!inputRecord.ok) return errorResult3(inputRecord.error);
+  if (inputRecord.value === void 0 && findTerminalEvent(events.value) === void 0) {
+    return errorResult3(existingRunNotFound(run.value, options));
+  }
+  const projection = projectVerifyRun(events.value);
+  const report2 = {
+    runToken: run.value.runToken,
+    verificationType: options.verificationType,
+    scopeType: options.scopeType,
+    sealed: projection.sealed,
+    lastSequence: projection.lastSequence,
+    ...projection.terminalStatus === void 0 ? {} : { terminalStatus: projection.terminalStatus },
+    findingCount: projection.findingCount,
+    nextActions: projection.nextActions
+  };
+  return okResult3(JSON.stringify(report2));
+}
+async function verifyRenderCommand(options, deps) {
+  const run = await resolveExistingRunAddress(options, deps);
+  if (!run.ok) return errorResult3(run.error);
+  const events = await readRunJournalEvents(run.value.journalScope, deps);
+  if (!events.ok) {
+    if (events.error === JOURNAL_RUNTIME_ERROR.RUN_NOT_FOUND) {
+      return errorResult3(existingRunNotFound(run.value, options));
+    }
+    return errorResult3(`${VERIFY_CLI_ERROR.RENDER_FAILED}: ${events.error}`);
+  }
+  const inputRecord = await readRecordedInputForProjection(run.value, options, events.value, deps);
+  if (!inputRecord.ok) return errorResult3(inputRecord.error);
+  if (inputRecord.value === void 0 && findTerminalEvent(events.value) === void 0) {
+    return errorResult3(existingRunNotFound(run.value, options));
+  }
+  const projection = projectVerifyRun(events.value);
+  const report2 = {
+    runToken: run.value.runToken,
+    findingCount: projection.findingCount,
+    sealed: projection.sealed,
+    ...projection.terminalStatus === void 0 ? {} : { terminalStatus: projection.terminalStatus },
+    events: events.value
+  };
+  return okResult3(JSON.stringify(report2));
+}
 
 // src/interfaces/cli/verify.ts
+var VERIFICATION_RUN_CLI_SURFACE = {
+  addCommandName: "add",
+  findingResourceCommandName: "finding",
+  forbiddenRootCommandName: "verify",
+  forbiddenRunHelpTerms: ["Append", "append"],
+  forbiddenRunCommandNames: ["journal", "event", "append-scope", "append-finding"],
+  rootCommandName: "verification",
+  runCommandName: "run",
+  scopeResourceCommandName: "scope"
+};
 var VERIFY_CLI = {
-  commandName: "verify",
+  addCommandName: VERIFICATION_RUN_CLI_SURFACE.addCommandName,
+  commandName: VERIFICATION_RUN_CLI_SURFACE.rootCommandName,
   description: "Record and replay a typed verification run",
   startCommandName: VERIFY_VERB.START,
   inputCommandName: VERIFY_VERB.INPUT,
-  appendScopeCommandName: VERIFY_VERB.APPEND_SCOPE,
-  appendFindingCommandName: VERIFY_VERB.APPEND_FINDING,
+  findingCommandName: VERIFICATION_RUN_CLI_SURFACE.findingResourceCommandName,
+  runCommandName: VERIFICATION_RUN_CLI_SURFACE.runCommandName,
+  scopeCommandName: VERIFICATION_RUN_CLI_SURFACE.scopeResourceCommandName,
+  finishCommandName: VERIFY_VERB.FINISH,
+  statusCommandName: VERIFY_VERB.STATUS,
+  renderCommandName: VERIFY_VERB.RENDER,
   verificationTypeOption: "--verification-type <type>",
   scopeTypeOption: "--scope-type <scope-type>",
   scopeOption: "--scope <base>..<head>",
   inputOption: "--input <input-source>",
   runOption: "--run <token>",
   payloadOption: "--payload <payload-source>",
-  idempotencyKeyOption: "--idempotency-key <key>"
+  payloadOptionDescription: "Evidence payload source; stdin or a file path",
+  idempotencyKeyOption: "--idempotency-key <key>",
+  idempotencyKeyOptionDescription: "Caller-supplied idempotency key for the evidence add",
+  terminalStatusOption: "--terminal-status <status>"
 };
 var CLI_SOURCE_ENCODING = "utf8";
+var DEFAULT_VERIFY_CLI_HANDLERS = {
+  appendFinding: verifyAppendFindingCommand,
+  appendScope: verifyAppendScopeCommand,
+  finish: verifyFinishCommand,
+  input: verifyInputCommand,
+  render: verifyRenderCommand,
+  start: verifyStartCommand,
+  status: verifyStatusCommand
+};
 async function readStdinText() {
   const chunks = [];
   for await (const chunk of process.stdin) {
@@ -19741,35 +20597,48 @@ async function readStdinText() {
 }
 async function readCliSource(source) {
   if (source === VERIFY_INPUT_SOURCE.STDIN) return readStdinText();
-  return readFile12(source, CLI_SOURCE_ENCODING);
+  return readFile13(source, CLI_SOURCE_ENCODING);
 }
 var verifyDomain = {
   name: VERIFY_CLI.commandName,
   description: VERIFY_CLI.description,
-  register: (program, invocation) => {
-    const deps = () => ({
-      cwd: invocation.resolveEffectiveInvocationDir(),
-      readInputSource: readCliSource,
-      readPayloadSource: readCliSource,
-      // The append verbs write a single structured JSON result to stdout, so the run's event
-      // stream goes to stderr under the local backend rather than sharing the result channel.
-      journalBinding: createJournalStreamBinding(invocation.io, stderrStreamSink(invocation.io))
-    });
-    const command = program.command(VERIFY_CLI.commandName).description(VERIFY_CLI.description);
-    command.command(VERIFY_CLI.startCommandName).description("Start a changeset-scoped verification run and report its run locator").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.inputOption, "Verification input source; stdin or a file path").action(async (options) => {
-      reportCliResult(await verifyStartCommand(options, deps()), invocation.io);
-    });
-    command.command(VERIFY_CLI.inputCommandName).description("Replay the verification input recorded at start").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").action(async (options) => {
-      reportCliResult(await verifyInputCommand(options, deps()), invocation.io);
-    });
-    command.command(VERIFY_CLI.appendScopeCommandName).description("Record the inspected scope for a started run").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.payloadOption, "Append payload source; stdin or a file path").requiredOption(VERIFY_CLI.idempotencyKeyOption, "Caller-supplied idempotency key for the append").action(async (options) => {
-      reportCliResult(await verifyAppendScopeCommand(options, deps()), invocation.io);
-    });
-    command.command(VERIFY_CLI.appendFindingCommandName).description("Record a validated verification finding for a started run").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.payloadOption, "Append payload source; stdin or a file path").requiredOption(VERIFY_CLI.idempotencyKeyOption, "Caller-supplied idempotency key for the append").action(async (options) => {
-      reportCliResult(await verifyAppendFindingCommand(options, deps()), invocation.io);
-    });
-  }
-};
+  register: (program, invocation) => registerVerifyCommands(program, invocation)
+};
+function registerVerifyCommands(program, invocation, handlers = DEFAULT_VERIFY_CLI_HANDLERS) {
+  const deps = () => ({
+    cwd: invocation.resolveEffectiveInvocationDir(),
+    readInputSource: readCliSource,
+    readPayloadSource: readCliSource,
+    // The append verbs write a single structured JSON result to stdout, so the run's event
+    // stream goes to stderr under the local backend rather than sharing the result channel.
+    journalBinding: createJournalStreamBinding(invocation.io, stderrStreamSink(invocation.io))
+  });
+  const command = program.command(VERIFY_CLI.commandName).description(VERIFY_CLI.description);
+  const runCommand = command.command(VERIFY_CLI.runCommandName).description("Manage a typed verification run lifecycle");
+  runCommand.command(VERIFY_CLI.startCommandName).description("Start a changeset-scoped verification run and report its run locator").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.inputOption, "Verification input source; stdin or a file path").action(async (options) => {
+    reportCliResult(await handlers.start(options, deps()), invocation.io);
+  });
+  runCommand.command(VERIFY_CLI.inputCommandName).description("Replay the verification input recorded at start").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").action(async (options) => {
+    reportCliResult(await handlers.input(options, deps()), invocation.io);
+  });
+  const scopeCommand = runCommand.command(VERIFY_CLI.scopeCommandName).description("Manage inspected scope evidence for a started verification run");
+  scopeCommand.command(VERIFY_CLI.addCommandName).description("Record the inspected scope for a started run").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.payloadOption, VERIFY_CLI.payloadOptionDescription).requiredOption(VERIFY_CLI.idempotencyKeyOption, VERIFY_CLI.idempotencyKeyOptionDescription).action(async (options) => {
+    reportCliResult(await handlers.appendScope(options, deps()), invocation.io);
+  });
+  const findingCommand = runCommand.command(VERIFY_CLI.findingCommandName).description("Manage finding evidence for a started verification run");
+  findingCommand.command(VERIFY_CLI.addCommandName).description("Record a validated verification finding for a started run").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.payloadOption, VERIFY_CLI.payloadOptionDescription).requiredOption(VERIFY_CLI.idempotencyKeyOption, VERIFY_CLI.idempotencyKeyOptionDescription).action(async (options) => {
+    reportCliResult(await handlers.appendFinding(options, deps()), invocation.io);
+  });
+  runCommand.command(VERIFY_CLI.finishCommandName).description("Record terminal completion, seal the run journal, and report its terminal projection").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").requiredOption(VERIFY_CLI.terminalStatusOption, "Terminal status recorded before sealing").action(async (options) => {
+    reportCliResult(await handlers.finish(options, deps()), invocation.io);
+  });
+  runCommand.command(VERIFY_CLI.statusCommandName).description("Report the run's resumable status projected from its journal history").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").action(async (options) => {
+    reportCliResult(await handlers.status(options, deps()), invocation.io);
+  });
+  runCommand.command(VERIFY_CLI.renderCommandName).description("Render the run's journal projection with its authoritative finding count").requiredOption(VERIFY_CLI.verificationTypeOption, "Verification type recorded for the run").requiredOption(VERIFY_CLI.scopeTypeOption, "Scope type; changeset").requiredOption(VERIFY_CLI.scopeOption, "Changeset scope as <base>..<head>").requiredOption(VERIFY_CLI.runOption, "Run token reported by start").action(async (options) => {
+    reportCliResult(await handlers.render(options, deps()), invocation.io);
+  });
+}
 
 // src/interfaces/cli/worktree.ts
 import { randomBytes as nodeRandomBytes4 } from "crypto";
@@ -19927,11 +20796,11 @@ function renderTextStatusChild(record6) {
 }
 
 // src/lib/worktree-path-info.ts
-import { stat as stat7 } from "fs/promises";
+import { stat as stat8 } from "fs/promises";
 var defaultWorktreePathInfo = {
   isExistingNonDirectory: async (path7) => {
     try {
-      const pathStats = await stat7(path7);
+      const pathStats = await stat8(path7);
       return !pathStats.isDirectory();
     } catch {
       return false;