@pmelab/gtd 24.3.0 → 24.4.0

package/dist/testkit.mjs

@@ -1,6 +1,6 @@
-import { configProblems, configure, installContext, isFactoryWorkflow, protocolMismatch, t as flows_exports } from "./flows.mjs";
+import { checkScript, configProblems, configure, installContext, isFactoryWorkflow, moveScript, protocolMismatch, removeScript, restoreScript, revertScript, showScript, t as flows_exports } from "./flows.mjs";
 import { O as renderFormat, T as ACCESS_REFUSAL, _ as demandOf, a as landFields, c as renderLandJson, d as renderBeatPlain, f as beatDocument, g as beatKindOf, i as judgeJson, l as renderLandPlain, m as statusOf, n as resolveSession, p as renderBeatJson, r as selectPath, s as noopText, t as globMatches } from "./chunks/wire-DA7q2ikx.mjs";
-import { C as headingSections, S as headingSectionBodies, a as unansweredQuestions, b as parseThreadsWithFindings, n as openThreads, r as steeringFormatFor, s as parseCodeThreads, t as BUILT_IN_MODE_NAMES } from "./chunks/steering-D-PvRC5W.mjs";
+import { C as headingSections, S as headingSectionBodies, a as unansweredQuestions, b as parseThreadsWithFindings, n as openThreads, r as steeringFormatFor, s as parseCodeThreads, t as BUILT_IN_MODE_NAMES, w as formatFinding } from "./chunks/steering-DVILanVf.mjs";
 import { $ as makeSemaphore, $i as toJSON, $n as mapBoth, $r as none$1, $t as provideMerge$1, A as catchTag, Ai as getOption, An as scopeTag, Ar as interrupt$2, At as sync$2, B as flatten$4, Bi as isSome, Bn as make$16, Br as tap$1, Bt as unsafeMakeSemaphore$1, C as all$1, Ci as unsafeFromArray, Cn as isInterruptedOnly, Cr as exitFailCause, Ct as scope, D as async, Di as Tag, Dn as ensuring$3, Dr as fiberId, Dt as serviceOption, E as asVoid$1, Ei as GenericTag, En as squash, Er as exitZipRight, Et as scopedWith$1, F as exit, Fi as filter$1, Fn as sequential, Fr as onInterrupt, Ft as tryPromise, G as forkScoped, Gi as isLeft, Gn as Class, Gr as withFiberRuntime, Gt as zipRight$3, H as forEach$2, Hi as match$4, Hn as set$1, Hr as uninterruptibleMask$1, Ht as withFiberRuntime$1, I as fail$5, Ii as flatMap$5, In as bind, Ir as scopeClose, It as try_, J as interrupt$4, Ji as right, Jn as die, Jr as empty$6, Jt as TaggedError$1, K as gen, Ki as left, Kn as spanTag, Kr as zipRight$1, Kt as zipWith, L as failCause$4, Li as fromNullable, Ln as bindTo, Lr as succeed$4, Lt as uninterruptible$1, M as dieMessage, Mi as empty$5, Mn as inheritAll$1, Mr as interruptFiber, Mt as tapErrorCause, N as either, Ni as fromIterable, Nn as interruptAllAs$1, Nr as interruptible$1, Nt as timeout, O as catchAll$1, Oi as add, On as forEachConcurrentDiscard, Or as fiberRefLocally, Ot as succeed$6, P as ensuring$2, Pi as splitAt, Pn as join$3, Pr as map$3, Pt as tryMap, Q as logWarning, Qi as format, Qn as map$5, Qr as make$19, Qt as provide$1, R as fiberIdWith, Ri as getOrElse, Rn as sleep, Rr as suspend$4, Rt as uninterruptibleMask, S as addFinalizer$1, Si as toArray, Sn as isInterrupted, Sr as exitFail, St as sandbox, T as as, Ti as unsafeHead, Tn as reduceWithContext, Tr as exitVoid, Tt as scoped$4, U as forkDaemon, Ui as none, Un as update$1, Ur as void_$2, Ut as zip$1, V as fnUntraced, Vi as map$8, Vn as modify$1, Vr as uninterruptible, Vt as when, W as forkIn, Wi as some, Wn as TypeId$10, Wr as whenEffect, Wt as zipLeft, X as intoDeferred, Xi as BaseProto, Xn as failCause$3, Xr as combineAll, Xt as fromEffect$5, Y as interruptible, Yi as pipeArguments, Yn as fail$4, Yr as combine, Yt as tagged, Z as isEffect, Zi as NodeInspectSymbol, Zn as isFailure, Zr as ids, Zt as mergeAll$2, _ as decodeSync, _i as prepend, _n as failureOrCause, _r as deferredMake, _t as repeat, a as Literal, aa as constVoid, ai as decode, an as forkIn$1, ar as as$1, at as matchCauseEffect, b as acquireRelease, bi as take$2, bn as interruptors, br as deferredUnsafeMake, bt as runPromiseExit$1, c as String$, ca as pipe, ci as appendAll, cn as addFinalizer, cr as catchAll, ct as onError, d as Union, di as filter, dn as extend, dr as deferredComplete, dt as orElseSucceed, ea as equals, ei as get$4, en as scoped$3, er as match$3, et as map$4, f as between, fi as fromIterable$1, fn as fork, fr as deferredFail, ft as promise, gi as of, gn as fail$3, gr as deferredIsDone, gt as raceWith, hi as map$7, hn as die$1, hr as deferredInterruptWith, ht as race, i as Defect, ia as constUndefined, ii as size$2, in as updateContext$1, ir as zipRight$2, it as matchCause, j as die$2, ji as omit, jn as _await$2, jr as interruptAsFiber, jt as tap, k as catchAllCause, ki as get$5, kn as scopeMake, kr as flatMap$3, kt as suspend$5, l as Struct, li as drop, ln as addFinalizerExit, lr as currentContext$1, lt as orDie, m as optional$1, mi as isEmpty$2, mn as NoSuchElementException, mr as deferredInterrupt, mt as provideService, n as Boolean$, na as constFalse, ni as set$2, nn as unsafeFork, nr as void_$3, nt as mapError, o as Never, oa as dual, oi as isFinite, on as unsafeMakeSemaphore, or as asVoid, ot as matchEffect, p as decodeUnknown, pi as isChunk, pn as make$18, pr as deferredFailCause, pt as provide$2, q as ignore, qi as match$2, qn as all, qr as DeferredTypeId$1, qt as spaced$1, r as Cause, ra as constTrue, ri as has, rn as unsafeRunPromiseExit, rr as zip$2, rt as match$5, s as Number$, sa as identity, si as append$1, sn as Scope, sr as asyncInterrupt, st as negate, t as Array$, ta as hasProperty, ti as make$17, tn as succeed$3, tr as succeed$5, tt as mapBoth$1, u as TaggedError, ui as empty$4, un as close, ur as deferredAwait, ut as orElse, v as encodeSync, vi as reduce, vn as flipCauseOption, vr as deferredSucceed, vt as retry, w as annotateLogs, wi as unsafeGet, wn as map$6, wr as exitSucceed, wt as scopeWith, x as acquireUseRelease$2, xi as takeRight, xn as isDieType, xr as exitAs, xt as runtime, y as _void, yi as reverse, yn as interrupt$3, yr as deferredUnsafeDone, yt as runPromise, z as flatMap$4, zi as isNone, zn as get$3, zr as sync$1, zt as unsafeMakeLatch } from "./chunks/Schema-B5yK7QrT.mjs";
 import { createRequire } from "node:module";
 import * as Crypto from "node:crypto";
@@ -9,11 +9,11 @@ import * as Path from "node:path";
 import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { PassThrough } from "node:stream";
 import * as NFS from "node:fs";
-import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import * as OS from "node:os";
 import { homedir, tmpdir } from "node:os";
 import * as ChildProcess from "node:child_process";
-import { execFileSync, execSync } from "node:child_process";
+import { execFileSync, execSync, spawnSync } from "node:child_process";
 import * as NodeUrl from "node:url";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import * as readline from "node:readline";
@@ -2438,9 +2438,9 @@ const pipeToOrFail = /*#__PURE__*/ dual(2, (self, that) => suspend$3(() => {
 	return pipeTo$1(pipeTo$1(pipeTo$1(self, reader), that), writer);
 }));
 /** @internal */
-const run$3 = (self) => scopedWith$1((scope) => runIn(self, scope));
+const run$4 = (self) => scopedWith$1((scope) => runIn(self, scope));
 /** @internal */
-const runDrain = (self) => run$3(drain$2(self));
+const runDrain = (self) => run$4(drain$2(self));
 /** @internal */
 const runScoped = (self) => scopeWith((scope) => runIn(self, scope));
 /** @internal */
@@ -3013,7 +3013,7 @@ const map = /*#__PURE__*/ dual(2, (self, f) => new StreamImpl(pipe(toChannel$2(s
 /** @internal */
 const mapChunks$1 = /*#__PURE__*/ dual(2, (self, f) => new StreamImpl(pipe(toChannel$2(self), mapOut(f))));
 /** @internal */
-const mkString$1 = (self) => run$2(self, mkString$2);
+const mkString$1 = (self) => run$3(self, mkString$2);
 /** @internal */
 const pipeThroughChannel = /*#__PURE__*/ dual(2, (self, channel) => new StreamImpl(pipeTo$1(toChannel$2(self), channel)));
 /** @internal */
@@ -3022,9 +3022,9 @@ const repeatEffectChunkOption = (effect) => unfoldChunkEffect(effect, (effect) =
 	onSome: fail$5
 }))));
 /** @internal */
-const run$2 = /*#__PURE__*/ dual(2, (self, sink) => toChannel$2(self).pipe(pipeToOrFail(toChannel$3(sink)), runDrain));
+const run$3 = /*#__PURE__*/ dual(2, (self, sink) => toChannel$2(self).pipe(pipeToOrFail(toChannel$3(sink)), runDrain));
 /** @internal */
-const runCollect$1 = (self) => run$2(self, collectAll());
+const runCollect$1 = (self) => run$3(self, collectAll());
 /** @internal */
 const runIntoQueueScoped = /*#__PURE__*/ dual(2, (self, queue) => {
 	const writer = readWithCause({
@@ -3764,7 +3764,7 @@ const mkString = mkString$1;
 * @since 2.0.0
 * @category destructors
 */
-const run$1 = run$2;
+const run$2 = run$3;
 /**
 * Runs the stream and collects all of its elements to a chunk.
 *
@@ -4726,7 +4726,7 @@ const makeExecutor$1 = (start) => {
 		stream,
 		string: (command, encoding = "utf-8") => {
 			const decoder = new TextDecoder(encoding);
-			return pipe(start(command), flatMap$4((process) => run$1(process.stdout, collectUint8Array)), map$4((bytes) => decoder.decode(bytes)), scoped$4);
+			return pipe(start(command), flatMap$4((process) => run$2(process.stdout, collectUint8Array)), map$4((bytes) => decoder.decode(bytes)), scoped$4);
 		},
 		lines: (command, encoding = "utf-8") => {
 			return pipe(streamLines(command, encoding), runCollect, map$4(toArray));
@@ -4959,7 +4959,7 @@ const ProcessProto = {
 		};
 	}
 };
-const runCommand$1 = (fileSystem) => (command) => {
+const runCommand$2 = (fileSystem) => (command) => {
 	switch (command._tag) {
 		case "StandardCommand": {
 			const spawn = flatMap$4(make$15(), (exitCode) => async((resume) => {
@@ -5031,17 +5031,17 @@ const runCommand$1 = (fileSystem) => (command) => {
 					stderr,
 					stdout
 				});
-			}), typeof command.stdin === "string" ? identity : tap((process) => forkDaemon(run$1(command.stdin, process.stdin))));
+			}), typeof command.stdin === "string" ? identity : tap((process) => forkDaemon(run$2(command.stdin, process.stdin))));
 		}
 		case "PipedCommand": {
 			const flattened = flatten(command);
-			if (flattened.length === 1) return pipe(flattened[0], runCommand$1(fileSystem));
+			if (flattened.length === 1) return pipe(flattened[0], runCommand$2(fileSystem));
 			const head = flattened[0];
 			const tail = flattened.slice(1);
 			const initial = tail.slice(0, tail.length - 1);
 			const last = tail[tail.length - 1];
-			const stream = initial.reduce((stdin$2, command) => pipe(stdin(command, stdin$2), runCommand$1(fileSystem), map$4((process) => process.stdout), unwrapScoped), pipe(runCommand$1(fileSystem)(head), map$4((process) => process.stdout), unwrapScoped));
-			return pipe(stdin(last, stream), runCommand$1(fileSystem));
+			const stream = initial.reduce((stdin$2, command) => pipe(stdin(command, stdin$2), runCommand$2(fileSystem), map$4((process) => process.stdout), unwrapScoped), pipe(runCommand$2(fileSystem)(head), map$4((process) => process.stdout), unwrapScoped));
+			return pipe(stdin(last, stream), runCommand$2(fileSystem));
 		}
 	}
 };
@@ -5051,7 +5051,7 @@ const runCommand$1 = (fileSystem) => (command) => {
 * @since 1.0.0
 * @category layer
 */
-const layer$5 = /* @__PURE__ */ effect$1(CommandExecutor, /*#__PURE__*/ pipe(FileSystem, /*#__PURE__*/ map$4((fileSystem) => makeExecutor(runCommand$1(fileSystem)))));
+const layer$5 = /* @__PURE__ */ effect$1(CommandExecutor, /*#__PURE__*/ pipe(FileSystem, /*#__PURE__*/ map$4((fileSystem) => makeExecutor(runCommand$2(fileSystem)))));
 //#endregion
 //#region node_modules/@effect/platform-node-shared/dist/esm/internal/path.js
 const fromFileUrl = (url) => try_({
@@ -5352,7 +5352,7 @@ const classifyUntracked = (exec, ref, untrackedPaths) => gen(function* () {
 * `git add`. Callers that expect a probe to fail handle it with an explicit
 * `catchAll`.
 */
-const run = (root, ...args) => scoped$4(gen(function* () {
+const run$1 = (root, ...args) => scoped$4(gen(function* () {
 	const process = yield* (yield* CommandExecutor).start(make$1(...args).pipe(workingDirectory(root), stdout("pipe"), stderr("pipe")));
 	const collect = (stream) => stream.pipe(decodeText(), mkString);
 	const [stdout$3, stderr$3, exitCode] = yield* all$1([
@@ -5386,7 +5386,7 @@ var InvalidRefError = class extends Error {
 */
 const resolvedRefOrCorrupted = (ref, hash) => /^[0-9a-f]{40}$/.test(hash) ? succeed$6(hash) : fail$5(new InvalidRefError(`Invalid ref: ${ref}`, [`ref: ${ref}`]));
 const makeGitImpl = (executor, root) => {
-	const exec = (...args) => run(root, ...args).pipe(provide$2(succeed$1(CommandExecutor, executor)));
+	const exec = (...args) => run$1(root, ...args).pipe(provide$2(succeed$1(CommandExecutor, executor)));
 	return {
 		lastCommitSubject: (ref = "HEAD") => exec("git", "log", "-1", "--pretty=%s", "--end-of-options", ref).pipe(map$4((s) => s.trim())),
 		lastCommitMessage: (ref = "HEAD") => exec("git", "log", "-1", "--pretty=%B", "--end-of-options", ref).pipe(map$4((s) => s.trim())),
@@ -5420,7 +5420,7 @@ const makeGitImpl = (executor, root) => {
 		}),
 		resolveRef: (ref) => exec("git", "rev-parse", "--verify", "--end-of-options", ref).pipe(map$4((s) => s.trim()), flatMap$4((hash) => resolvedRefOrCorrupted(ref, hash))),
 		readRefOption: (ref) => exec("git", "rev-parse", "--verify", "--quiet", ref).pipe(map$4((s) => some(s.trim())), catchAll$1(() => succeed$6(none()))),
-		isAncestor: (a, b) => run(root, "git", "merge-base", "--is-ancestor", a, b).pipe(provide$2(succeed$1(CommandExecutor, executor)), map$4(() => true), catchAll$1(() => succeed$6(false))),
+		isAncestor: (a, b) => run$1(root, "git", "merge-base", "--is-ancestor", a, b).pipe(provide$2(succeed$1(CommandExecutor, executor)), map$4(() => true), catchAll$1(() => succeed$6(false))),
 		mergeBase: (a, b) => exec("git", "merge-base", a, b).pipe(map$4((s) => some(s.trim())), catchAll$1(() => succeed$6(none()))),
 		defaultBranch: () => exec("git", "symbolic-ref", "--quiet", "--short", "refs/remotes/origin/HEAD").pipe(map$4((s) => s.trim()), catchAll$1(() => succeed$6("")), map$4((name) => name === "" ? "main" : name)),
 		topLevel: () => exec("git", "rev-parse", "--show-toplevel").pipe(map$4((s) => s.trim())),
@@ -7503,6 +7503,30 @@ var ConfigDiscovery = class ConfigDiscovery extends Tag("ConfigDiscovery")() {
 	});
 };
 //#endregion
+//#region src/workflow/fingerprint.ts
+const HASH_LENGTH = 16;
+const CONTROL_CHARACTER = /[\x00-\x1f\x7f-\x9f]/;
+const contentHash = (content) => createHash("sha256").update(content).digest("hex").slice(0, HASH_LENGTH);
+const realOr = (path) => {
+	try {
+		return realpathSync(path);
+	} catch {
+		return path;
+	}
+};
+const configFingerprint = (files, root, read) => {
+	const fingerprint = {};
+	const realRoot = realOr(root);
+	for (const file of files) {
+		const path = relative(realRoot, realOr(file)).split(sep).join("/");
+		if (CONTROL_CHARACTER.test(path)) continue;
+		const content = read(file);
+		if (content !== void 0) fingerprint[path] = contentHash(content);
+	}
+	return fingerprint;
+};
+const changedConfigFiles = (recorded, current) => [.../* @__PURE__ */ new Set([...Object.keys(recorded), ...Object.keys(current)])].filter((path) => recorded[path] !== current[path]).sort();
+//#endregion
 //#region src/workflow/Diagnostic.ts
 const compareSegment = (a, b) => {
 	if (typeof a === "number" && typeof b === "number") return a - b;
@@ -7637,9 +7661,16 @@ const load = gen(function* () {
 		},
 		...compiled.ui !== void 0 ? { ui: compiled.ui } : {},
 		warnings: diagnostics.filter((d) => d.severity === "warning"),
-		workflowFiles: loaded.file.dependencyFiles
+		fingerprint: configFingerprint(loaded.file.dependencyFiles, host.root, module.read ?? readFromDisk)
 	};
 });
+const readFromDisk = (path) => {
+	try {
+		return readFileSync(path, "utf8");
+	} catch {
+		return;
+	}
+};
 const TRANSFORM_MEMO_SIZE = 512;
 const memoized = (transform) => {
 	const memo = /* @__PURE__ */ new Map();
@@ -7656,12 +7687,18 @@ const memoized = (transform) => {
 };
 let jitiModule;
 let transform;
-const jiti = (shipped) => {
+const jiti = (shipped, local) => {
 	const require = createRequire(import.meta.url);
 	jitiModule ??= require("jiti");
 	transform ??= memoized(require(join(dirname(require.resolve("jiti/package.json")), "dist", "babel.cjs")));
 	return jitiModule.createJiti(import.meta.url, {
-		virtualModules: shipped.modules,
+		virtualModules: new Proxy(shipped.modules, {
+			has: (modules, id) => id in modules || typeof id === "string" && local?.resolve(id) !== void 0,
+			get: (modules, id) => {
+				const path = typeof id === "string" ? local?.resolve(id) : void 0;
+				return path === void 0 ? modules[id] : local.load(path);
+			}
+		}),
 		alias: shipped.missing,
 		fsCache: false,
 		moduleCache: false,
@@ -7858,12 +7895,9 @@ const namespaceOf = (exported) => typeof exported === "object" && exported !== n
 * pulled in, transitively.
 */
 const loadWorkflows = (module, shipped) => {
-	const cache = {};
-	const exports = namespaceOf(jiti(shipped).evalModule(module.source, {
-		filename: module.filepath,
-		cache
-	}));
-	const file = fileFrom(exports, module.filepath, Object.keys(cache));
+	const { exports: evaluated, files } = module.read === void 0 ? evaluateFromDisk(module, shipped) : evaluateRead(module, module.read, shipped);
+	const exports = namespaceOf(evaluated);
+	const file = fileFrom(exports, module.filepath, files);
 	const exported = Object.entries(exports).filter(([name, value]) => !RESERVED_EXPORTS.has(name) && isWorkflow(value));
 	const value = defaultExport(exports);
 	const defaultName = exported.find(([, other]) => other === value)?.[0] ?? "default";
@@ -7887,6 +7921,49 @@ const loadWorkflows = (module, shipped) => {
 		diagnostics: nameRejections(rejections)
 	};
 };
+const evaluateFromDisk = (module, shipped) => {
+	const cache = {};
+	return {
+		exports: jiti(shipped).evalModule(module.source, {
+			filename: module.filepath,
+			cache
+		}),
+		files: Object.keys(cache)
+	};
+};
+const moduleCandidates = (path) => [
+	path,
+	path.replace(/\.js$/, ".ts"),
+	path.replace(/\.mjs$/, ".mts"),
+	`${path}.ts`,
+	join(path, "index.ts")
+];
+/**
+* Evaluates the config with every local module it imports taken from `read`
+* instead of the disk. jiti matches a virtual module on the specifier as
+* written, so each module gets its own instance resolving against its own
+* directory. A specifier `read` cannot serve falls through to the disk, and
+* fails the way a missing file does.
+*/
+const evaluateRead = (module, read, shipped) => {
+	const files = [module.filepath];
+	const evaluated = /* @__PURE__ */ new Map();
+	const evaluate = (filepath, source) => jiti(shipped, {
+		resolve: (specifier) => /^\.\.?\//.test(specifier) ? moduleCandidates(join(dirname(filepath), specifier)).find((candidate) => read(candidate) !== void 0) : void 0,
+		load: (path) => {
+			if (!evaluated.has(path)) {
+				evaluated.set(path, {});
+				files.push(path);
+				evaluated.set(path, evaluate(path, read(path)));
+			}
+			return evaluated.get(path);
+		}
+	}).evalModule(source, { filename: filepath });
+	return {
+		exports: evaluate(module.filepath, module.source),
+		files
+	};
+};
 const isWorkflow = (value) => typeof value === "function" || isFactoryWorkflow(value);
 const defaultExport = (exports) => {
 	const value = exports.default;
@@ -8114,35 +8191,6 @@ const resolveScopeAccess = (def, skills, vars) => gen(function* () {
 //#region src/workflow/Workflow.ts
 const knownModes = (def) => Object.keys(def.modes);
 //#endregion
-//#region src/workflow/fingerprint.ts
-const HASH_LENGTH = 16;
-const CONTROL_CHARACTER = /[\x00-\x1f\x7f-\x9f]/;
-const contentHash = (content) => createHash("sha256").update(content).digest("hex").slice(0, HASH_LENGTH);
-const realOr = (path) => {
-	try {
-		return realpathSync(path);
-	} catch {
-		return path;
-	}
-};
-const configFingerprint = (files, root) => {
-	const fingerprint = {};
-	const realRoot = realOr(root);
-	for (const file of files) {
-		const path = relative(realRoot, realOr(file)).split(sep).join("/");
-		if (CONTROL_CHARACTER.test(path)) continue;
-		let content;
-		try {
-			content = readFileSync(file);
-		} catch {
-			continue;
-		}
-		fingerprint[path] = contentHash(content);
-	}
-	return fingerprint;
-};
-const changedConfigFiles = (recorded, current) => [.../* @__PURE__ */ new Set([...Object.keys(recorded), ...Object.keys(current)])].filter((path) => recorded[path] !== current[path]).sort();
-//#endregion
 //#region src/step/planStep.ts
 /**
 * At the human review gate an unconditional `gtd uncheck '<file>'` runs
@@ -8858,7 +8906,7 @@ const restAt = (ref, startOverrides = {}) => gen(function* () {
 		path: e.path
 	})) : [];
 	const memory = memoryOf(outcome.trace, run);
-	const configNow = configFingerprint(config.workflowFiles, host.root);
+	const configNow = config.fingerprint;
 	if (ref === void 0) yield* warnConfigChanges(run, configNow, workspace);
 	return {
 		def,
@@ -9087,7 +9135,7 @@ const inRepoConfigPaths = (root, files, recorded) => {
 const configRefusal = (tip, paths) => /* @__PURE__ */ new Error(`gtd history: refused — config differs at ${tip.slice(0, 7)}: ${paths.join(", ")}. A history ref replays under today's config, so it is unreadable after the config changes`);
 const differingConfigPaths = (git, workspace, root, config, run, hash) => gen(function* () {
 	const differing = [];
-	for (const path of inRepoConfigPaths(root, config.workflowFiles, run.pinnedConfig?.files ?? {})) if ((yield* orElseSucceed(git.readFileAtRef(hash, path), () => void 0)) !== workspace.readSync(path)) differing.push(path);
+	for (const path of inRepoConfigPaths(root, Object.keys(config.fingerprint), run.pinnedConfig?.files ?? {})) if ((yield* orElseSucceed(git.readFileAtRef(hash, path), () => void 0)) !== workspace.readSync(path)) differing.push(path);
 	return differing;
 });
 const notClosedError = (hash, outcome) => outcome.kind === "rest" ? /* @__PURE__ */ new Error(`gtd history: ${hash.slice(0, 7)} does not close a process under today's config`) : replayError(outcome) ?? /* @__PURE__ */ new Error("gtd history: replay failed");
@@ -10079,12 +10127,6 @@ const runValidateCommand = (out) => gen(function* () {
 	const resolved = yield* resolveValidateScript(rest);
 	out.write(resolved !== void 0 && resolved.script.length > 0 ? `${resolved.script}\n` : `nothing to validate at "${rest.state}"\n`);
 });
-/** `file:line:col: message` — the shape editors and grep already jump on. Stored 0-based, printed 1-based. A finding with a `line` but no `range`, or none at all, degrades to the shorter forms. */
-const formatFinding = (file, finding) => {
-	if (finding.line === void 0) return finding.message;
-	const col = finding.range !== void 0 ? `:${finding.range.start.character + 1}` : "";
-	return `${file}:${finding.line + 1}${col}: ${finding.message}`;
-};
 /**
 * Runs `<mode>`'s parser over `<file>`, exiting non-zero on any finding.
 * Resolves no workflow state and reads no config — this is what a seeded
@@ -10300,7 +10342,7 @@ const dispatchVoidCommand = (command, json, out) => {
 * (the `standaloneKinds` run bare). Both guard checks run before `dispatch`,
 * so a refusal writes nothing and emits no script by construction.
 */
-const runCommand = (command, json, out) => {
+const runCommand$1 = (command, json, out) => {
 	const dispatch = dispatchVoidCommand(command, json, out);
 	if (needsOf(command.kind) !== "state") return dispatch;
 	return gen(function* () {
@@ -11261,7 +11303,7 @@ const runCli = (argv, io) => {
 		io.exit(2);
 	});
 	const out = bufferedArtifactOut(io);
-	return runCommand(plan.command, plan.json, out).pipe(map$4(() => {
+	return runCommand$1(plan.command, plan.json, out).pipe(map$4(() => {
 		out.flush();
 		io.exit(0);
 	}), provide$2(io.layers(plan.verbose)), sandbox, catchAll$1((cause) => isInterruptedOnly(cause) ? failCause$4(cause) : report(io, plan.json.kind !== "off")(cause)));
@@ -11340,10 +11382,10 @@ var InMemRepo = class InMemRepo {
 	}
 	resolveRef(ref) {
 		if (/^[0-9a-f]{40}$/.test(ref)) return this.commits.has(ref) ? ref : null;
-		const tildeMatch = /^(HEAD|[0-9a-f]{40})(~(\d+))?$/.exec(ref);
+		const tildeMatch = /^(HEAD|[0-9a-f]{40})(~(\d+)|\^)?$/.exec(ref);
 		if (tildeMatch) {
 			const base = tildeMatch[1];
-			const steps = tildeMatch[3] !== void 0 ? parseInt(tildeMatch[3], 10) : 0;
+			const steps = tildeMatch[3] !== void 0 ? parseInt(tildeMatch[3], 10) : tildeMatch[2] === "^" ? 1 : 0;
 			let cur = base === "HEAD" ? this.head : this.commits.has(base) ? base : null;
 			for (let i = 0; i < steps; i++) {
 				if (cur === null) return null;
@@ -11480,6 +11522,33 @@ var InMemRepo = class InMemRepo {
 		const dirPrefix = prefix.endsWith("/") ? prefix : `${prefix}/`;
 		return [...this.worktree.keys()].filter((key) => key === prefix || key.startsWith(dirPrefix)).sort();
 	}
+	/** Everything git would keep on disk, serialized — two snapshots compare equal exactly when nothing was written. */
+	snapshot() {
+		const sorted = (m) => [...m.entries()].sort(([a], [b]) => a.localeCompare(b));
+		return JSON.stringify({
+			head: this.head,
+			branch: this.currentBranch,
+			commits: [...this.commits.keys()].sort(),
+			branches: sorted(this.branches),
+			refs: sorted(this.refs),
+			index: sorted(this.index),
+			worktree: sorted(this.worktree)
+		});
+	}
+	/** Every ref name under `prefix` (`refs/…`), sorted — `git for-each-ref <prefix>`. */
+	refNamesUnder(prefix) {
+		return [...this.refs.keys()].filter((ref) => ref.startsWith(prefix)).sort();
+	}
+	/** Whether `path` is in the index — what `git diff <commit> -- <path>` compares against the worktree. */
+	isTracked(path) {
+		return this.index.has(path);
+	}
+	/** `git add <path>` — the index takes `path` as the worktree has it, or drops it. */
+	stage(path) {
+		const content = this.worktree.get(path);
+		if (content === void 0) this.index.delete(path);
+		else this.index.set(path, content);
+	}
 	/** `git add -A` — the index becomes exactly the current worktree. */
 	stageAll() {
 		this.index = new Map(this.worktree);
@@ -11809,7 +11878,8 @@ const makeInMemoryConfigDiscovery = (repo, root) => {
 					const source = workspace.atPath(filepath);
 					if (source !== void 0) return {
 						filepath,
-						source
+						source,
+						read: workspace.atPath
 					};
 				}
 			},
@@ -11872,6 +11942,269 @@ const makeCapturingCliIo = (repo, env = {}, tools = {}) => {
 	};
 };
 //#endregion
+//#region src/testkit/FlowScripts.ts
+const SHEBANG = "#!/usr/bin/env sh";
+const words$1 = (text) => [...text.matchAll(/'((?:[^']|'\\'')*)'/g)].map((m) => m[1].replaceAll("'\\''", "'"));
+const ok = (output = "") => ({
+	ok: true,
+	output
+});
+/** `rm -rf -- <paths>`. `InMemRepo.pathsUnder("")` is the whole tree, where a real `rm -- ''` removes nothing. */
+const removeAll = (repo, paths) => {
+	if (paths.includes("")) throw new Error("testkit: rm: refusing an empty path");
+	for (const path of paths) for (const file of repo.pathsUnder(path)) repo.deleteFile(file);
+};
+const deleteIfPresent = (repo, path) => {
+	if (repo.readFile(path) !== void 0) repo.deleteFile(path);
+};
+const recognizeRemove = (repo, script) => {
+	const line = script.split("\n").find((l) => l.startsWith("rm -rf -- ")) ?? "";
+	const paths = words$1(line);
+	if (removeScript(paths) !== script) return void 0;
+	removeAll(repo, paths);
+	return ok();
+};
+const recognizeMove = (repo, script) => {
+	const line = script.split("\n").find((l) => l.startsWith("mv -- ")) ?? "";
+	const [from, to] = words$1(line);
+	if (from === void 0 || to === void 0 || moveScript(from, to) !== script) return void 0;
+	const content = repo.readFile(from);
+	if (content === void 0) return {
+		ok: false,
+		error: `mv: ${from}: No such file`,
+		output: ""
+	};
+	repo.deleteFile(from);
+	repo.writeFile(to, content);
+	return ok();
+};
+const recognizeShow = (repo, script) => {
+	const line = script.split("\n").find((l) => l.startsWith("git show ")) ?? "";
+	const [source, to] = words$1(line);
+	const at = source?.indexOf(":") ?? -1;
+	if (source === void 0 || to === void 0 || at === -1) return void 0;
+	const ref = source.slice(0, at);
+	const path = source.slice(at + 1);
+	if (showScript(ref, path, to) !== script) return void 0;
+	const content = repo.fileAtRef(ref, path);
+	if (content === null) return {
+		ok: false,
+		error: `git show: ${source} does not exist`,
+		output: ""
+	};
+	repo.writeFile(to, content);
+	return ok();
+};
+/** `git diff --quiet <commit> -- <path>`: the worktree copy of a tracked path, or nothing for an untracked one, against `commit`'s. */
+const unchangedSince = (repo, commit, path) => {
+	return (repo.isTracked(path) ? repo.readFile(path) ?? null : null) === repo.fileAtRef(commit, path);
+};
+const RESTORE_LINE = / && git restore --source=/;
+const REMOVE_LINE = / && rm -f -- /;
+const parseRestoreLine = (line) => {
+	const [commit, path, source] = words$1(line);
+	if (commit === void 0 || path === void 0) return void 0;
+	if (RESTORE_LINE.test(line) && source !== void 0) return {
+		commit,
+		path,
+		source
+	};
+	return REMOVE_LINE.test(line) ? {
+		commit,
+		path
+	} : void 0;
+};
+/** Applies one line, returning its exit status as `sh` would see it. */
+const applyRestoreLine = (repo, { commit, path, source }) => {
+	if (!unchangedSince(repo, commit, path)) return false;
+	if (source !== void 0 && repo.resolveRef(source) === null) return false;
+	const content = source === void 0 ? null : repo.fileAtRef(source, path);
+	if (content !== null) repo.writeFile(path, content);
+	else if (source === void 0 || repo.isTracked(path)) deleteIfPresent(repo, path);
+	return true;
+};
+const recognizeRestore = (repo, script) => {
+	const parsed = script.split("\n").slice(2, -1).map(parseRestoreLine);
+	if (parsed.includes(void 0)) return void 0;
+	const lines = parsed;
+	const restoring = lines.filter((l) => l.source !== void 0);
+	const paths = {
+		restore: restoring.map((l) => l.path),
+		remove: lines.filter((l) => l.source === void 0).map((l) => l.path)
+	};
+	if (restoreScript(lines[0]?.commit ?? "", paths, restoring[0]?.source) !== script) return void 0;
+	if (lines.map((line) => applyRestoreLine(repo, line)).at(-1) === false) return {
+		ok: false,
+		error: "the last path changed since the commit",
+		output: ""
+	};
+	return ok();
+};
+const PATCH_FAILED = "error: patch does not apply";
+/**
+* `git diff C^ C | git apply -R`, which is all or nothing. A file still
+* exactly as `C` left it reverts; a file gone, or one `C` added and that
+* changed since, fails the whole patch. A file `C` modified and that changed
+* since may still apply through its context — that needs real git, so it
+* throws rather than guess.
+*/
+const reverseApply = (repo, commit) => {
+	const parent = `${commit}^`;
+	const changed = [.../* @__PURE__ */ new Set([...repo.pathsAtRef(parent), ...repo.pathsAtRef(commit)])].filter((p) => repo.fileAtRef(parent, p) !== repo.fileAtRef(commit, p));
+	for (const path of changed) {
+		const after = repo.fileAtRef(commit, path);
+		const current = repo.readFile(path) ?? null;
+		if (current === after) continue;
+		if (current === null || after === null || repo.fileAtRef(parent, path) === null) return `${PATCH_FAILED}: ${path}`;
+		throw new Error(`testkit: cannot tell in memory whether reverting ${commit} applies to the hand-edited ${path} — run this @live`);
+	}
+	for (const path of changed) {
+		const before = repo.fileAtRef(parent, path);
+		if (before === null) repo.deleteFile(path);
+		else repo.writeFile(path, before);
+	}
+};
+const recognizeRevert = (repo, script) => {
+	const lines = script.split("\n");
+	const [, commit] = words$1(lines.find((l) => l.startsWith("if ! git diff --quiet ")) ?? "");
+	const [, failure] = words$1(lines.find((l) => l.includes("printf '%s\\n\\n' ")) ?? "");
+	const [report] = words$1(lines.find((l) => l.startsWith("    } > ")) ?? "");
+	if (commit === void 0 || failure === void 0 || report === void 0) return void 0;
+	if (revertScript(commit, report, failure) !== script) return void 0;
+	const error = reverseApply(repo, commit);
+	if (error !== void 0) repo.writeFile(report, `${failure}\n\n${error}\n`);
+	return ok();
+};
+/** One preamble line — the closed vocabulary the bundled workflows write there. */
+const runPreambleLine = (repo, line) => {
+	const quoted = words$1(line);
+	if (line === "exit 0") return {
+		exit: true,
+		output: ""
+	};
+	if (line.startsWith("mkdir -p ")) return {
+		exit: false,
+		output: ""
+	};
+	if (line.startsWith("rm -f ")) {
+		for (const path of quoted) deleteIfPresent(repo, path);
+		return {
+			exit: false,
+			output: ""
+		};
+	}
+	if (line.startsWith("rm -rf -- ")) {
+		removeAll(repo, quoted);
+		return {
+			exit: false,
+			output: ""
+		};
+	}
+	const printf = /^printf '%s\\n' '(?:[^']|'\\'')*' (>&2|> '(?:[^']|'\\'')*')$/.exec(line);
+	if (printf !== null) {
+		const [, text, file] = quoted;
+		if (printf[1] === ">&2") return {
+			exit: false,
+			output: `${text}\n`
+		};
+		repo.writeFile(file, `${text}\n`);
+		return {
+			exit: false,
+			output: ""
+		};
+	}
+	throw new Error(`testkit: cannot run the preamble line \`${line}\` in memory`);
+};
+/** Rejoins lines a single-quoted word spans, so a preamble entry carrying a newline stays one line. */
+const shellLines = (lines) => {
+	const joined = [];
+	let open = false;
+	for (const line of lines) {
+		if (open) joined[joined.length - 1] += `\n${line}`;
+		else joined.push(line);
+		for (let i = 0; i < line.length; i++) if (line[i] === "'" && (open || line[i - 1] !== "\\")) open = !open;
+	}
+	return joined;
+};
+const outsideCommand = (lines, mkdir) => {
+	const before = shellLines(lines.slice(2, mkdir));
+	const swept = before.at(-1)?.startsWith("rm -rf -- ") === true;
+	const green = lines.find((l) => l.startsWith("  rm -rf -- "));
+	return {
+		sweep: swept ? words$1(before.at(-1)) : [],
+		sweepOnGreen: green === void 0 ? [] : words$1(green),
+		preamble: swept ? before.slice(0, -1) : before
+	};
+};
+const parseCheck = (script) => {
+	const lines = script.split("\n");
+	const mkdir = lines.findIndex((l) => l.startsWith("mkdir -p \"$(dirname "));
+	const close = lines.findIndex((l, i) => i > mkdir && /^\) > '.*' 2>&1$/.test(l));
+	if (mkdir === -1 || lines[mkdir + 1] !== "(" || close === -1) return void 0;
+	const [report] = words$1(lines[mkdir]);
+	const [, stamp] = words$1(lines.find((l) => l.includes("<!-- gtd check %s -->")) ?? "");
+	if (report === void 0 || stamp === void 0) return void 0;
+	return {
+		command: lines.slice(mkdir + 2, close).join("\n"),
+		report,
+		stamp,
+		...outsideCommand(lines, mkdir)
+	};
+};
+const runCommand = (repo, commands, command) => {
+	const scripted = commands.get(command);
+	if (scripted === void 0) throw new Error(`testkit: cannot run \`${command}\` in memory — script it ("the shell command … exits …")`);
+	if (scripted.kind === "exit") return scripted;
+	if (scripted.kind === "missing") return {
+		status: 127,
+		output: `sh: ${command}: not found\n`
+	};
+	repo.writeFile(scripted.file, rewritten(repo, scripted));
+	return {
+		status: 0,
+		output: ""
+	};
+};
+/** What a scripted rewrite leaves in its file. */
+const rewritten = (repo, command) => command.append === true ? `${repo.readFile(command.file) ?? ""}${command.content}` : command.content;
+const recognizeCheck = (repo, commands, script) => {
+	const parsed = parseCheck(script);
+	if (parsed === void 0) return void 0;
+	const { command, report, stamp, sweep, sweepOnGreen, preamble } = parsed;
+	if (checkScript(command, {
+		report,
+		stamp,
+		sweep,
+		sweepOnGreen,
+		preamble
+	}) !== script) return;
+	let printed = "";
+	for (const line of preamble) {
+		const outcome = runPreambleLine(repo, line);
+		printed += outcome.output;
+		if (outcome.exit) return ok(printed);
+	}
+	removeAll(repo, sweep);
+	const { status, output } = runCommand(repo, commands, command);
+	if (status === 0) {
+		deleteIfPresent(repo, report);
+		removeAll(repo, sweepOnGreen);
+		return ok(printed);
+	}
+	const body = output.length > 0 ? output : `the test command failed with exit code ${status} and produced no output.`;
+	repo.writeFile(report, `${body}\n<!-- gtd check ${stamp} -->\n`);
+	return ok(printed);
+};
+/**
+* Applies a `src/flows/scripts.ts` script to `repo`, or `undefined` when
+* `script` is none of them. `commands` stands in for the real programs a
+* check runs, keyed by the exact command string.
+*/
+const applyFlowScript = (repo, commands, script) => {
+	if (!script.startsWith(`${SHEBANG}\n`)) return void 0;
+	return recognizeRemove(repo, script) ?? recognizeMove(repo, script) ?? recognizeShow(repo, script) ?? recognizeRevert(repo, script) ?? recognizeRestore(repo, script) ?? recognizeCheck(repo, commands, script);
+};
+//#endregion
 //#region src/testkit/EmittedScriptRecognizer.ts
 /**
 * Reverses `GitScript.ts`'s `shellQuote`: extracts every `'...'` token from
@@ -11908,6 +12241,8 @@ const extractQuotedTokens = (text) => {
 	}
 	return tokens;
 };
+/** What the in-memory tier prints for `$PATH` — there is none to name. */
+const IN_MEMORY_PATH = "(in-memory: no PATH)";
 const SET_FLAGS_RE = /^set\s+-\S+(\s+\S+)*$/;
 const recognizeSetFlags = (block) => SET_FLAGS_RE.test(block) ? { kind: "noop" } : void 0;
 const PRECONDITION_RE = /^\[ "\$\(git rev-parse HEAD\)" = '([0-9a-f]{40})' \] \|\| \{ echo "precondition failed: HEAD moved" >&2; exit 1; \}$/;
@@ -11915,11 +12250,9 @@ const recognizePrecondition = (repo, block) => {
 	const match = PRECONDITION_RE.exec(block);
 	if (!match) return void 0;
 	const expected = match[1];
-	const actual = repo.resolveRef("HEAD");
-	if (actual === expected) return { kind: "noop" };
-	return {
+	return repo.resolveRef("HEAD") === expected ? { kind: "noop" } : {
 		kind: "failed",
-		error: `precondition failed: HEAD is ${actual ?? "(no commits)"}, expected ${expected}`
+		error: "precondition failed: HEAD moved"
 	};
 };
 /**
@@ -12006,9 +12339,9 @@ const recognizeFileExistsGuard = (repo, block) => {
 	if (file === void 0 || fileExistsGuard(file) !== block) return void 0;
 	return repo.readFile(file) !== void 0 ? { kind: "noop" } : { kind: "stopped" };
 };
-/** `binaryGuard`. The in-memory tier has no real `$PATH` to probe — a scripted command IS the stand-in for "this binary exists" — so this always no-ops; the guard actually tripping is `@live`-only coverage. */
+/** `binaryGuard`. The in-memory tier has no `$PATH`: a binary is present unless declared `missing`. */
 const BINARY_GUARD_MESSAGE_RE = /^gtd: mode "([^"]+)": "(format|validate)" command not found: (.+)$/;
-const recognizeBinaryGuard = (block) => {
+const recognizeBinaryGuard = (commands, block) => {
 	const [binary, , message] = extractQuotedTokens(block);
 	if (binary === void 0 || message === void 0) return void 0;
 	const match = BINARY_GUARD_MESSAGE_RE.exec(message);
@@ -12016,10 +12349,29 @@ const recognizeBinaryGuard = (block) => {
 	const [, mode, key, messageBinary] = match;
 	if (messageBinary !== binary) return void 0;
 	if (binaryGuard(binary, mode, key) !== block) return void 0;
-	return { kind: "noop" };
+	if (commands.get(binary)?.kind !== "missing") return { kind: "noop" };
+	return {
+		kind: "failed",
+		error: `${message}\n$PATH: ${IN_MEMORY_PATH}`,
+		status: 127
+	};
 };
 /** Recognized by `OUTCOME_MARKER` rather than re-derived and string-compared: an outcome only prints, so no git effect a loose match could miss — unlike `recognizeGitBuilders`, where a near-miss would silently skip a real mutation. */
-const recognizeOutcome = (block) => block.startsWith("# gtd: outcome (print-only)") ? { kind: "noop" } : void 0;
+const recognizeOutcome = (repo, block) => {
+	if (!block.startsWith(`# gtd: outcome (print-only)\nprintf `)) return void 0;
+	const line = block.slice(28);
+	const [format, ...args] = shellWords(repo, line.slice(7));
+	return {
+		kind: "noop",
+		output: renderFormat(format.replace(/\\n/g, "\n"), ...args)
+	};
+};
+/** The word list of `printf`'s arguments: quoted literals, and the `"$(git …)"` lookups outcome lines carry. */
+const shellWords = (repo, text) => [...text.matchAll(/'((?:[^']|'\\'')*)'|"\$\(git (rev-parse --short|log -1 --format=%s) '([^']*)'\)"/g)].map((m) => {
+	if (m[1] !== void 0) return m[1].replaceAll("'\\''", "'");
+	const hash = repo.resolveRef(m[3]) ?? "";
+	return m[2] === "rev-parse --short" ? hash.slice(0, 7) : repo.lastCommitSubject(hash) ?? "";
+});
 /**
 * `failurePromptWrapper`. The constants below bracket the template's one
 * variable part; the extracted pair is confirmed by RE-RUNNING the real
@@ -12036,8 +12388,27 @@ const expandFileVar = (text) => {
 	if (file === void 0) return void 0;
 	return text.slice(match[0].length).replace(/"\$GTD_FILE"|"\$\{GTD_FILE\}"/g, shellQuote(file)).replace(/\$\{GTD_FILE\}|\$GTD_FILE\b/g, file);
 };
-/** A mode's `format:`/`validate:` command: `gtd check`, or a scripted command. */
-const recognizeModeCommand = (repo, commands, command) => recognizeGtdCheck(repo, command) ?? recognizeScriptedCommand(repo, commands, command);
+/**
+* A mode's `format:`/`validate:` command, under `withFileVar` or not:
+* `gtd check`, or a scripted command — keyed by the command as expanded, or
+* as written in the config (`fmt $GTD_FILE`), which is the only key a command
+* run on a scratch path can have.
+*/
+const recognizeModeCommand = (repo, commands, block) => {
+	const command = expandFileVar(block) ?? block;
+	const exact = recognizeGtdCheck(repo, command) ?? recognizeScriptedCommand(repo, commands, command);
+	if (exact !== void 0) return exact;
+	const match = FILE_VAR_PREFIX_RE.exec(block);
+	if (match === null) return void 0;
+	const scripted = commands.get(block.slice(match[0].length));
+	const [file] = extractQuotedTokens(match[1]);
+	if (scripted === void 0 || file === void 0) return void 0;
+	const bound = scripted.kind === "rewrite" && scripted.file === "$GTD_FILE" ? {
+		...scripted,
+		file
+	} : scripted;
+	return recognizeScriptedCommand(repo, /* @__PURE__ */ new Map([[command, bound]]), command);
+};
 const FAILURE_PROMPT_HEADER = "gtd_validate_status=0\ngtd_validate_out=\"$( {\n";
 const FAILURE_PROMPT_MIDDLE = "\n} 2>&1 )\" || gtd_validate_status=$?\nif [ \"$gtd_validate_status\" -ne 0 ]; then\n  printf '%s\\n\\n%s\\n' ";
 const FAILURE_PROMPT_FOOTER = " \"$gtd_validate_out\"\n  exit \"$gtd_validate_status\"\nfi";
@@ -12049,11 +12420,12 @@ const recognizeFailurePromptWrapper = (repo, commands, block) => {
 	const promptQuoted = block.slice(middleIndex + 101, block.length - 53);
 	const [prompt] = extractQuotedTokens(promptQuoted);
 	if (prompt === void 0 || failurePromptWrapper(inner, prompt) !== block) return void 0;
-	const innerOutcome = recognizeModeCommand(repo, commands, expandFileVar(inner) ?? inner);
+	const innerOutcome = recognizeModeCommand(repo, commands, inner);
 	if (innerOutcome === void 0) return void 0;
 	if (innerOutcome.kind === "failed") return {
 		kind: "failed",
-		error: `${prompt}\n\n${innerOutcome.error}`
+		error: `${prompt}\n\n${innerOutcome.error.replace(/\n+$/, "")}`,
+		status: innerOutcome.status ?? 1
 	};
 	return innerOutcome;
 };
@@ -12066,7 +12438,10 @@ const recognizeModeContradictionSkipNotice = (block) => {
 	if (!match) return void 0;
 	const mode = match[1];
 	if (modeContradictionSkipNotice(mode) !== block) return void 0;
-	return { kind: "noop" };
+	return {
+		kind: "noop",
+		output: `${message}\n`
+	};
 };
 /** The printf line's own pieces — the sample bytes, the scratch path, and the literal PREFIX text (up to and including that path) — or `undefined` when `block` doesn't open with `printf '%s' ...`. */
 const parsePrintfPrefix = (block) => {
@@ -12129,7 +12504,7 @@ const simulateModeContradictionCheck = (repo, commands, parsed) => {
 	const { mode, samplePath, sample, formatCommand, format } = parsed;
 	repo.writeFile(samplePath, sample);
 	const command = expandFileVar(formatCommand) ?? formatCommand;
-	const formatOutcome = recognizeScriptedCommand(repo, commands, command);
+	const formatOutcome = recognizeModeCommand(repo, commands, formatCommand);
 	if (formatOutcome === void 0) {
 		repo.deleteFile(samplePath);
 		return {
@@ -12171,16 +12546,16 @@ const recognizeGtdCheck = (repo, block) => {
 	const format = steeringFormatFor(mode);
 	if (format === void 0 || file === void 0) return {
 		kind: "failed",
-		error: `gtd check: no built-in steering format named "${mode}"`
+		error: `gtd check: unknown mode "${mode}" — known modes: ${BUILT_IN_MODE_NAMES.join(", ")}`
 	};
 	const content = repo.readFile(file);
 	if (content === void 0) return { kind: "noop" };
-	const findings = format.validate(content);
-	if (findings.length > 0) return {
+	const findings = format.validate(content).map((finding) => formatFinding(file, finding));
+	if (findings.length === 0) return { kind: "noop" };
+	return {
 		kind: "failed",
-		error: `gtd check ${mode} ${file}: ${findings.map((f) => f.line !== void 0 ? `${file}:${f.line + 1}: ${f.message}` : f.message).join("; ")}`
+		error: `gtd check: ${file} is not valid under mode "${mode}" (${findings.length} finding(s)):\n` + findings.join("\n")
 	};
-	return { kind: "noop" };
 };
 const GTD_UNCHECK_RE = /^gtd uncheck (.+)$/;
 /** `gtd uncheck <file>` — the review-gate reset prepended ahead of the human's commit, so no tick ever reaches it. Re-runs the REAL `clearTicks`, writing back only on an actual change. */
@@ -12204,27 +12579,44 @@ const recognizeGtdUncheck = (repo, block) => {
 */
 const recognizeDidNotRunComment = (block) => block === "# gtd emitted this and did NOT run it — pipe it into `sh` to land the turn" ? { kind: "noop" } : void 0;
 /** `combinedScript`'s optional half. ALWAYS reports `noop` whatever the inner result, mirroring bash's `( … ) || <warning>`, where the subshell's exit status is swallowed and must never fail the outer script. */
+const PRESENTATION_FAILURE_TEXT = `${extractQuotedTokens(PRESENTATION_FAILURE_WARNING)[0].replace(/\\n$/, "")}\n`;
 const PRESENTATION_SUBSHELL_PREFIX = `${PRESENTATION_ONLY_COMMENT}\n(\n`;
 const PRESENTATION_SUBSHELL_SUFFIX = `\n) || ${PRESENTATION_FAILURE_WARNING}`;
 const recognizePresentationSubshell = (repo, commands, block) => {
 	if (!block.startsWith(PRESENTATION_SUBSHELL_PREFIX) || !block.endsWith(PRESENTATION_SUBSHELL_SUFFIX)) return;
 	const inner = block.slice(PRESENTATION_SUBSHELL_PREFIX.length, block.length - PRESENTATION_SUBSHELL_SUFFIX.length);
-	applyEmittedScript(repo, commands, inner);
-	return { kind: "noop" };
+	const result = applyEmittedScript(repo, commands, inner);
+	if (result.ok) return {
+		kind: "noop",
+		output: result.output
+	};
+	return {
+		kind: "noop",
+		output: `${result.output}${PRESENTATION_FAILURE_TEXT}`
+	};
 };
 /** Anything left over must be an EXACT hit in the scripted-command table — mirrors `ScriptedCommand`'s two `kind`s (`Layers.ts`). */
 const recognizeScriptedCommand = (repo, commands, block) => {
 	const scripted = commands.get(block);
 	if (scripted === void 0) return void 0;
 	if (scripted.kind === "rewrite") {
-		repo.writeFile(scripted.file, scripted.content);
+		repo.writeFile(scripted.file, rewritten(repo, scripted));
 		return { kind: "applied" };
 	}
+	if (scripted.kind === "missing") return {
+		kind: "failed",
+		error: `sh: ${block.split(" ")[0]}: not found`,
+		status: 127
+	};
 	if (scripted.status !== 0) return {
 		kind: "failed",
-		error: `scripted command "${block}" exited ${scripted.status}: ${scripted.output}`
+		error: scripted.output,
+		status: scripted.status
+	};
+	return {
+		kind: "noop",
+		output: scripted.output
 	};
-	return { kind: "noop" };
 };
 /**
 * Splits on blank lines, IGNORING those inside a single-quoted string: every
@@ -12280,14 +12672,27 @@ const splitBlocks = (script) => {
 	if (current.trim().length > 0) blocks.push(current.trim());
 	return blocks;
 };
+/** `deferNotesScript`: append its one section to `.gtd/TODO.md`, reading the section's lines off the final `printf`. */
+const DEFER_HEAD = "mkdir -p .gtd\nif [ -s .gtd/TODO.md ]; then";
+const recognizeDeferNotes = (repo, block) => {
+	if (!block.startsWith(DEFER_HEAD)) return void 0;
+	const at = block.lastIndexOf("\nprintf '%s\\n' ");
+	if (at === -1) return void 0;
+	const lines = extractQuotedTokens(block.slice(at + 15));
+	const old = repo.readFile(".gtd/TODO.md") ?? "";
+	const sep = old === "" ? "" : `${old.endsWith("\n") ? "" : "\n"}\n`;
+	repo.writeFile(".gtd/TODO.md", `${old}${sep}${lines.join("\n")}\n`);
+	return { kind: "applied" };
+};
 /** Every recognizer `applyEmittedScript` tries, first match wins — `recognizeScriptedCommand` stays last since it's the exact-hit fallback for anything the rest don't claim. */
 const recognizersFor = (repo, commands) => [
 	(block) => recognizeSetFlags(block),
 	(block) => recognizeDidNotRunComment(block),
 	(block) => recognizePrecondition(repo, block),
 	(block) => recognizeFileExistsGuard(repo, block),
-	(block) => recognizeBinaryGuard(block),
+	(block) => recognizeBinaryGuard(commands, block),
 	(block) => recognizeGitBuilders(repo, block),
+	(block) => recognizeDeferNotes(repo, block),
 	(block) => recognizeFailurePromptWrapper(repo, commands, block),
 	(block) => recognizePresentationSubshell(repo, commands, block),
 	(block) => recognizeModeContradictionSkipNotice(block),
@@ -12295,10 +12700,9 @@ const recognizersFor = (repo, commands) => [
 	(block) => recognizeGtdCheck(repo, block),
 	(block) => recognizeGtdUncheck(repo, block),
 	(block) => {
-		const command = expandFileVar(block);
-		return command === void 0 ? void 0 : recognizeModeCommand(repo, commands, command);
+		return FILE_VAR_PREFIX_RE.test(block) ? recognizeModeCommand(repo, commands, block) : void 0;
 	},
-	(block) => recognizeOutcome(block),
+	(block) => recognizeOutcome(repo, block),
 	(block) => recognizeScriptedCommand(repo, commands, block)
 ];
 const recognizeBlock = (recognizers, block) => {
@@ -12314,21 +12718,50 @@ const recognizeBlock = (recognizers, block) => {
 * real script. No block after the failing one is applied.
 */
 const applyEmittedScript = (repo, commands, script) => {
+	const flow = applyFlowScript(repo, commands, script);
+	if (flow !== void 0) return flow.ok ? {
+		ok: true,
+		status: 0,
+		output: flow.output
+	} : {
+		ok: false,
+		status: 1,
+		output: flow.output,
+		error: flow.error ?? ""
+	};
+	return script.startsWith("#!") ? unrecognized(script) : applyBlocks(repo, commands, script);
+};
+const applyBlocks = (repo, commands, script) => {
 	const recognizers = recognizersFor(repo, commands);
+	let output = "";
 	for (const block of splitBlocks(script)) {
 		const outcome = recognizeBlock(recognizers, block);
-		if (outcome === void 0) return {
-			ok: false,
-			error: `unrecognized script block: ${block.split("\n")[0]}`
-		};
-		if (outcome.kind === "stopped") return { ok: true };
-		if (outcome.kind === "failed") return {
-			ok: false,
-			error: outcome.error
-		};
+		if (outcome === void 0) return unrecognized(block, output);
+		if (outcome.kind === "noop") output += outcome.output ?? "";
+		if (outcome.kind === "stopped") break;
+		if (outcome.kind === "failed") return failedAt(outcome, output);
 	}
-	return { ok: true };
+	return {
+		ok: true,
+		status: 0,
+		output
+	};
 };
+const failedAt = (outcome, output) => {
+	const printed = outcome.error.length === 0 || outcome.error.endsWith("\n") ? "" : "\n";
+	return {
+		ok: false,
+		status: outcome.status ?? 1,
+		output: `${output}${outcome.error}${printed}`,
+		error: outcome.error
+	};
+};
+const unrecognized = (block, output = "") => ({
+	ok: false,
+	status: 1,
+	output,
+	error: `unrecognized script block: ${block.split("\n")[0]}`
+});
 //#endregion
 //#region src/testkit/TestRepo.ts
 const REGISTRY = Symbol.for("@pmelab/gtd/testkit:modules");
@@ -12463,7 +12896,9 @@ const testRepo = (options) => {
 		commit: (message) => repo.commitAllWithPrefix(message),
 		show: (ref, path) => repo.fileAtRef(ref, path) ?? void 0,
 		runScript: (script) => {
-			for (const line of script.split("\n")) runLine(repo, line.trim());
+			const flow = applyFlowScript(repo, /* @__PURE__ */ new Map(), script);
+			if (flow === void 0) for (const line of script.split("\n")) runLine(repo, line.trim());
+			else if (!flow.ok) throw new Error(`testkit: ${flow.error ?? ""}`);
 		},
 		gtd,
 		start: (workflow, ...args) => begin([
@@ -12549,7 +12984,8 @@ const makeLiveTier = (initialCommit = true) => {
 			onDiskContent: true,
 			commitHooks: true,
 			linkedWorktrees: true,
-			directoryChainConfig: true
+			directoryChainConfig: true,
+			remotes: true
 		},
 		provide,
 		provideExit,
@@ -12588,7 +13024,37 @@ const makeLiveTier = (initialCommit = true) => {
 				}
 			},
 			readWorktreeFile: (path) => readFileSync(join(root, path), "utf8"),
-			existsPath: (path) => existsSync(join(root, path))
+			existsPath: (path) => existsSync(join(root, path)),
+			snapshot: async () => {
+				gitExec("status", "--porcelain");
+				await new Promise((r) => setTimeout(r, 1100));
+				gitExec("status", "--porcelain");
+				const files = readdirSync(join(root, ".git"), {
+					recursive: true,
+					withFileTypes: true
+				}).filter((entry) => entry.isFile()).map((entry) => join(entry.parentPath, entry.name)).filter((path) => !path.includes(`${sep}gtd-cache${sep}`)).sort().map((path) => `${path}:${statSync(path).size}:${statSync(path).mtimeMs}`);
+				return JSON.stringify({
+					files,
+					status: gitExec("status", "--porcelain", "-uall")
+				});
+			},
+			headSubject: () => gitExec("log", "-1", "--pretty=%s"),
+			headTouchedPaths: () => gitExec("show", "--name-only", "--pretty=format:", "HEAD").split("\n").filter((line) => line.length > 0)
+		},
+		runScript: (script) => {
+			const result = spawnSync("sh", ["-c", `exec 2>&1\n${script}`], {
+				cwd: root,
+				encoding: "utf8",
+				env: {
+					...process.env,
+					PATH: `${gtdShimDir()}:${process.env["PATH"] ?? ""}`
+				}
+			});
+			return {
+				ok: result.status === 0,
+				status: result.status ?? 1,
+				output: result.stdout
+			};
 		},
 		dispose: () => rmSync(root, {
 			recursive: true,
@@ -12596,6 +13062,15 @@ const makeLiveTier = (initialCommit = true) => {
 		})
 	};
 };
+/** A dir whose `gtd` runs this build's bundle, so a script's bare `gtd` is the code under test. */
+let shimDir;
+const gtdShimDir = () => {
+	if (shimDir !== void 0) return shimDir;
+	shimDir = mkdtempSync(join(tmpdir(), "gtd-tier-shim-"));
+	const bundle = join(import.meta.dirname, "../../dist/gtd.bundle.mjs");
+	writeFileSync(join(shimDir, "gtd"), `#!/bin/sh\nexec node "${bundle}" "$@"\n`, { mode: 493 });
+	return shimDir;
+};
 const IN_MEM_ROOT = "/repo";
 const makeInMemTier = (initialCommit = true) => {
 	const repo = new InMemRepo();
@@ -12613,7 +13088,8 @@ const makeInMemTier = (initialCommit = true) => {
 			onDiskContent: false,
 			commitHooks: false,
 			linkedWorktrees: false,
-			directoryChainConfig: true
+			directoryChainConfig: true,
+			remotes: false
 		},
 		provide,
 		provideExit,
@@ -12646,7 +13122,21 @@ const makeInMemTier = (initialCommit = true) => {
 				if (content === void 0) throw new Error(`ENOENT: no such file or directory, open '${path}'`);
 				return content;
 			},
-			existsPath: (path) => repo.hasPath(path)
+			existsPath: (path) => repo.hasPath(path),
+			snapshot: async () => repo.snapshot(),
+			headSubject: () => repo.lastCommitSubject() ?? "",
+			headTouchedPaths: () => {
+				return [.../* @__PURE__ */ new Set([...repo.pathsAtRef("HEAD~1"), ...repo.pathsAtRef("HEAD")])].filter((p) => repo.fileAtRef("HEAD~1", p) !== repo.fileAtRef("HEAD", p)).sort();
+			}
+		},
+		runScript: (script, commands = /* @__PURE__ */ new Map()) => {
+			const { ok, status, output, error } = applyEmittedScript(repo, commands, script);
+			if (error?.startsWith("unrecognized script block:") === true) throw new Error(error);
+			return {
+				ok,
+				status,
+				output
+			};
 		},
 		dispose: () => {}
 	};
@@ -12693,6 +13183,32 @@ const runGitServiceContract = (makeTier) => {
 	afterEach(() => {
 		t.dispose();
 	});
+	it("no reader writes to the repository", async () => {
+		t.seed.commit("feat: second", { "second.txt": "two" });
+		t.seed.writeFile("dirty.txt", "dirty");
+		const before = await t.observe.snapshot();
+		await runGit(t, (g) => all$1([
+			g.lastCommitSubject(),
+			g.lastCommitMessage(),
+			g.hasCommits(),
+			g.resolveRef("HEAD"),
+			g.readRefOption("refs/gtd/none"),
+			g.isAncestor("HEAD~1", "HEAD"),
+			g.mergeBase("HEAD~1", "HEAD"),
+			g.defaultBranch(),
+			g.topLevel(),
+			g.gitDir(),
+			g.gitCommonDir(),
+			g.commitHistory(),
+			g.subjectHistory(10, 0),
+			g.readFileAtRef("HEAD", "second.txt"),
+			g.changedPaths(),
+			g.changedPaths("HEAD~1")
+		]));
+		expect(await t.observe.snapshot()).toBe(before);
+		await runGit(t, (g) => g.updateRef("refs/gtd/marker", t.observe.resolveRef("HEAD")));
+		expect(await t.observe.snapshot()).not.toBe(before);
+	});
 	describe("resolveRef", () => {
 		it("resolves HEAD to a 40-char hash", async () => {
 			expect(await runGit(t, (g) => g.resolveRef("HEAD"))).toMatch(/^[0-9a-f]{40}$/);
@@ -13228,31 +13744,18 @@ const runGitServiceContract = (makeTier) => {
 	});
 };
 /**
-* Runs a `GitScript.ts` builder's output through a REAL shell against `t.root`
-* — the same execution model the eventual driver uses (`bash -c <script>`),
-* so a builder that's syntactically fine but semantically wrong (a missing
-* `&&`, a misquoted path) fails here exactly as it would in production.
+* The SAME writer postconditions `runGitServiceContract` asserts against
+* `GitOperations`, asserted here against `GitScript.ts`'s builders as a driver
+* runs them: real `sh` on Live, the in-memory twin on InMemory.
 */
-const execScript = (t, script) => {
-	execFileSync("bash", ["-c", script], {
-		cwd: t.root,
-		stdio: "pipe"
-	});
+const run = (t, script) => {
+	const result = t.runScript(script);
+	if (!result.ok) throw new Error(`script failed on ${t.name}: ${result.output}`);
 };
-/** Names touched by HEAD's own commit — `git show`'s diff against its parent, not the whole tree. */
-const headTouchedPaths = (t) => gitExecIn(t.root, "show", "--name-only", "--pretty=format:", "HEAD").split("\n").filter((line) => line.length > 0);
-const headSubject = (t) => gitExecIn(t.root, "log", "-1", "--pretty=%s");
-/**
-* The SAME 9 writer postconditions `runGitServiceContract` asserts against
-* `GitOperations`, asserted here against `GitScript.ts`'s bash builders
-* instead — driven through real `bash` against a real repo (`makeLiveTier`),
-* never the in-memory fake, since a fake root (`/repo`) has no shell to run
-* against.
-*/
-const runGitScriptContract = () => {
+const runGitScriptContract = (makeTier) => {
 	let t;
 	beforeEach(() => {
-		t = makeLiveTier();
+		t = makeTier();
 	});
 	afterEach(() => {
 		t.dispose();
@@ -13261,17 +13764,17 @@ const runGitScriptContract = () => {
 		it("stages (git add -A) before committing — a new untracked file lands in the commit", () => {
 			t.seed.writeFile("new.ts", "export const x = 1");
 			const headBefore = t.observe.resolveRef("HEAD");
-			execScript(t, commitAll("gtd: building"));
+			run(t, commitAll("gtd: building"));
 			expect(t.observe.resolveRef("HEAD")).not.toBe(headBefore);
-			expect(headSubject(t)).toBe("gtd: building");
-			expect(headTouchedPaths(t)).toEqual(["new.ts"]);
+			expect(t.observe.headSubject()).toBe("gtd: building");
+			expect(t.observe.headTouchedPaths()).toEqual(["new.ts"]);
 			expect(t.observe.statusPorcelain().trim()).toBe("");
 		});
 		it("commits even on a clean tree (--allow-empty), never 'nothing to commit'", () => {
 			const headBefore = t.observe.resolveRef("HEAD");
-			execScript(t, commitAll("gtd: grilled"));
+			run(t, commitAll("gtd: grilled"));
 			expect(t.observe.resolveRef("HEAD")).not.toBe(headBefore);
-			expect(headSubject(t)).toBe("gtd: grilled");
+			expect(t.observe.headSubject()).toBe("gtd: grilled");
 		});
 	});
 	describe("commitAsIs", () => {
@@ -13279,22 +13782,22 @@ const runGitScriptContract = () => {
 			t.seed.writeFile("a.txt", "a");
 			t.seed.stageAll();
 			t.seed.writeFile("b.txt", "b");
-			execScript(t, commitAsIs("feat: squash"));
-			expect(headSubject(t)).toBe("feat: squash");
-			expect(headTouchedPaths(t)).toEqual(["a.txt"]);
+			run(t, commitAsIs("feat: squash"));
+			expect(t.observe.headSubject()).toBe("feat: squash");
+			expect(t.observe.headTouchedPaths()).toEqual(["a.txt"]);
 		});
 		it("commits even on a clean index (--allow-empty), never 'nothing to commit'", () => {
 			const headBefore = t.observe.resolveRef("HEAD");
-			execScript(t, commitAsIs("gtd: empty squash"));
+			run(t, commitAsIs("gtd: empty squash"));
 			expect(t.observe.resolveRef("HEAD")).not.toBe(headBefore);
-			expect(headSubject(t)).toBe("gtd: empty squash");
+			expect(t.observe.headSubject()).toBe("gtd: empty squash");
 		});
 	});
 	describe("softResetTo", () => {
 		it("moves HEAD back but keeps worktree changes from the second commit", () => {
 			const firstHash = t.observe.resolveRef("HEAD");
 			t.seed.commit("feat: second", { "second.txt": "second content" });
-			execScript(t, softResetTo(firstHash));
+			run(t, softResetTo(firstHash));
 			expect(t.observe.resolveRef("HEAD")).toBe(firstHash);
 			expect(t.observe.statusPorcelain()).toContain("second.txt");
 		});
@@ -13303,7 +13806,7 @@ const runGitScriptContract = () => {
 		it("moves HEAD, index, and working tree content back to the target ref", () => {
 			const firstHash = t.observe.resolveRef("HEAD");
 			t.seed.commit("feat: second", { "readme.txt": "modified content" });
-			execScript(t, hardResetTo(firstHash));
+			run(t, hardResetTo(firstHash));
 			expect(t.observe.resolveRef("HEAD")).toBe(firstHash);
 			expect(t.observe.statusPorcelain()).toBe("");
 			expect(t.observe.readWorktreeFile("readme.txt")).toBe("hello");
@@ -13313,7 +13816,7 @@ const runGitScriptContract = () => {
 		it("moves HEAD and index, leaving the working tree untouched", () => {
 			const firstHash = t.observe.resolveRef("HEAD");
 			t.seed.commit("feat: second", { "second.txt": "second content" });
-			execScript(t, mixedResetTo(firstHash));
+			run(t, mixedResetTo(firstHash));
 			expect(t.observe.resolveRef("HEAD")).toBe(firstHash);
 			expect(t.observe.statusPorcelain()).toContain("second.txt");
 		});
@@ -13322,36 +13825,37 @@ const runGitScriptContract = () => {
 		it("drops both tracked modifications and untracked files", () => {
 			t.seed.writeFile("readme.txt", "modified");
 			t.seed.writeFile("untracked.txt", "new");
-			execScript(t, discardPending());
+			run(t, discardPending());
 			expect(t.observe.statusPorcelain()).toBe("");
 		});
 	});
 	describe("updateRef / deleteRef", () => {
 		it("updateRef points a ref at a commit", () => {
 			const head = t.observe.resolveRef("HEAD");
-			execScript(t, updateRef("refs/gtd/marker", head));
+			run(t, updateRef("refs/gtd/marker", head));
 			expect(t.observe.refExists("refs/gtd/marker")).toBe(true);
 			expect(t.observe.resolveRef("refs/gtd/marker")).toBe(head);
 		});
 		it("updateRef with HEAD points the ref at the commit just made", () => {
-			execScript(t, commitAll("feat: just made"));
-			execScript(t, updateRef("refs/gtd/history/x", "HEAD"));
+			run(t, commitAll("feat: just made"));
+			run(t, updateRef("refs/gtd/history/x", "HEAD"));
 			expect(t.observe.resolveRef("refs/gtd/history/x")).toBe(t.observe.resolveRef("HEAD"));
 		});
 		it("deleteRef removes an existing ref, and tolerates deleting it again", () => {
 			const head = t.observe.resolveRef("HEAD");
-			execScript(t, updateRef("refs/gtd/marker", head));
-			execScript(t, deleteRef("refs/gtd/marker"));
-			execScript(t, deleteRef("refs/gtd/marker"));
+			run(t, updateRef("refs/gtd/marker", head));
+			run(t, deleteRef("refs/gtd/marker"));
+			run(t, deleteRef("refs/gtd/marker"));
 			expect(t.observe.refExists("refs/gtd/marker")).toBe(false);
 		});
 		it("deleteRef tolerates a ref that was never created", () => {
-			expect(() => execScript(t, deleteRef("refs/gtd/never-created"))).not.toThrow();
+			expect(() => run(t, deleteRef("refs/gtd/never-created"))).not.toThrow();
 			expect(t.observe.refExists("refs/gtd/never-created")).toBe(false);
 		});
 	});
 	describe("fetchHistoryRefs", () => {
-		it("pulls every refs/gtd/history/* from a bare remote and prints the count", () => {
+		it("pulls every refs/gtd/history/* from a bare remote and prints the count", (ctx) => {
+			if (!t.capabilities.remotes) ctx.skip();
 			const bare = realpathSync(mkdtempSync(join(tmpdir(), "gtd-git-tier-bare-")));
 			try {
 				gitExecIn(bare, "init", "-q", "--bare");
@@ -13375,7 +13879,8 @@ const runGitScriptContract = () => {
 				});
 			}
 		});
-		it("fails loudly when a local history ref conflicts with the remote's", () => {
+		it("fails loudly when a local history ref conflicts with the remote's", (ctx) => {
+			if (!t.capabilities.remotes) ctx.skip();
 			const bare = realpathSync(mkdtempSync(join(tmpdir(), "gtd-git-tier-bare-")));
 			try {
 				gitExecIn(bare, "init", "-q", "--bare");