@pmelab/gtd 60.1.0 → 62.0.0

package/dist/chunks/{testkit-BhTey1Do.mjs → testkit-XQeYCNMn.mjs}

@@ -1,5 +1,5 @@
 import { C as moveScript, D as revertScript, E as restoreScript, H as installContext, K as markedOptions, O as showScript, S as checkScript, T as removeScript, Y as protocolMismatch, i as configure, k as writeScript$1, n as configProblems, o as isFactoryWorkflow, p as numeric, s as answered, t as flows_exports, x as applyScript } from "./flows-DENt0uWV.mjs";
-import { O as ACCESS_REFUSAL, a as renderScriptJson, d as renderLandPlain, f as DEMAND_BRIEFING, g as statusOf, h as renderBeatJson, i as judgeJson, j as renderFormat, l as noopText, m as beatDocument, n as resolveSession, o as scriptFields, p as renderBeatPlain, r as selectPath, s as landFields, t as globMatches, u as renderLandJson, v as beatKindOf, y as demandOf } from "./wire-DZ8R1RU9.mjs";
+import { M as renderFormat, O as ACCESS_REFUSAL, a as renderScriptJson, d as renderLandPlain, f as DEMAND_BRIEFING, g as statusOf, h as renderBeatJson, i as judgeJson, k as PIN_PATH, l as noopText, m as beatDocument, n as resolveSession, o as scriptFields, p as renderBeatPlain, r as selectPath, s as landFields, t as globMatches, u as renderLandJson, v as beatKindOf, y as demandOf } from "./wire-CPNSm_9N.mjs";
 import { M as headingSectionBodies, N as formatFinding, a as sections, c as openThreads, i as sectionBodies, l as steeringFormatFor, o as threads, r as openQuestions, s as BUILT_IN_MODE_NAMES, t as parseCodeThreads, u as unansweredQuestions } from "./steering-DF_BMadH.mjs";
 import { createRequire, isBuiltin } from "node:module";
 import * as Crypto from "node:crypto";
@@ -22274,7 +22274,13 @@ The \`kind\` field (\`--json=kind\`) selects what to do:
   Land it immediately, no display needed.
 - \`script\` — run \`--json=content\` with \`sh -c\`, appending its output to
   \`--json=log\`, and ignore its exit code — the outcome lives in the tree,
-  not in the exit code.
+  not in the exit code. Two script beats carry a \`pin\` mark: the **pin
+  beat** right after a process starts (\`pin: "add"\`, its script writes
+  \`gtd bundle\`'s output to \`.gtd/process.gtdpin\`) and the **unpin beat**
+  once the flow has ended (\`pin: "remove"\`, its script deletes that file).
+  Both run unattended, like any script beat. A driver may write or delete the
+  file its own way instead of running the script; either way it then lands,
+  and the unpin's landing is the commit that closes the process.
 - \`prompt\` — send plain \`gtd next\`'s own output to your agent CLI over
   stdin (it's the bare content at this kind, so no separate \`--json=content\`
   read is needed), using the accompanying \`session.id\`/\`session.resume\`/
@@ -22317,7 +22323,8 @@ skills, \`skills\` (an array of the skill names, already trimmed and split —
 \`label\`, \`file\`, \`mode\`, \`edges\`, \`judge\` (the pending judgment's rendered
 document). When a cost has been recorded (a prior \`gtd land --cost=<n>\`):
 \`cost\`, \`costByModel\`. Always \`approvals\` (an array of
-\`{step, name, email, commit}\`, \`[]\` when none).
+\`{step, name, email, commit}\`, \`[]\` when none). Only at a pin or unpin
+beat: \`pin\` (\`"add"\` or \`"remove"\`).
 
 \`gtd land\` fields, in fixed order: \`schema\`, \`script\` (the POSIX sh to run), \`settled\`
 (true for a no-op at a \`script\` rest — stop immediately, nothing more to
@@ -22792,11 +22799,20 @@ const diffTrees$1 = (before, after) => {
 	};
 };
 const isEmptyDiff = (diff) => diff.added.length === 0 && diff.modified.length === 0 && diff.deleted.length === 0;
+const withoutPath = (tree, hidden) => {
+	let paths;
+	return {
+		paths: () => paths ??= tree.paths().filter((path) => path !== hidden),
+		read: (path) => path === hidden ? void 0 : tree.read(path),
+		...tree.id !== void 0 ? { id: (path) => path === hidden ? void 0 : tree.id(path) } : {}
+	};
+};
+const OLDEST_READABLE_FORMAT = 1;
 const short$1 = (hash) => hash.slice(0, 7);
 const formatFault = (commits) => {
-	const foreign = commits.find((c) => c.format !== 1);
+	const foreign = commits.find((c) => c.format < OLDEST_READABLE_FORMAT || c.format > 2);
 	if (foreign === void 0) return void 0;
-	return `gtd: commit ${short$1(foreign.hash)} is written in history format ${foreign.format}, but this gtd reads format 1 — run a gtd release that reads format ${foreign.format} to continue this process`;
+	return `gtd: commit ${short$1(foreign.hash)} is written in history format ${foreign.format}, but this gtd reads formats ${OLDEST_READABLE_FORMAT} to 2 — run a gtd release that reads format ${foreign.format} to continue this process`;
 };
 //#endregion
 //#region src/replay/Trailers.ts
@@ -22833,6 +22849,11 @@ const parseStepId = (raw) => {
 		occurrence: Number(match[2])
 	};
 };
+/** What a pin and an unpin beat rest at, and their commits name — neither is a step of the workflow. */
+const PIN_STATES = {
+	add: "pin",
+	remove: "unpin"
+};
 const isVerdict$1 = (value) => {
 	if (typeof value !== "object" || value === null) return false;
 	const v = value;
@@ -22852,13 +22873,7 @@ const parseJson = (raw) => {
 const TRAILER_RE = /^(Gtd-[A-Za-z-]+):[ \t]*(.*?)[ \t]*$/gm;
 const COST_RE = /^([0-9]+(?:\.[0-9]+)?)(?:[ \t]+(.+))?$/;
 const VAR_RE = /^([^=\s]+)=(.*)$/;
-const CONFIG_RE = /^([0-9a-f]{16}) (.+)$/;
 const CONTROL_CHARACTER$1 = /[\x00-\x1f\x7f-\x9f\u2028\u2029]/;
-const encodePath = (path) => path.trim() !== path || path.startsWith("\"") || CONTROL_CHARACTER$1.test(path) ? JSON.stringify(path) : path;
-const decodePath = (raw) => {
-	const path = raw.startsWith("\"") ? parseJson(raw) : raw;
-	return typeof path === "string" && path !== "" && !CONTROL_CHARACTER$1.test(path) ? path : void 0;
-};
 const decodeApproval = (raw) => {
 	const parsed = parseJson(raw);
 	if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
@@ -22910,11 +22925,6 @@ const TRAILER_READERS = {
 		const kv = VAR_RE.exec(value);
 		if (kv !== null) into.vars[kv[1]] = kv[2];
 	},
-	"Gtd-Config": (value, into) => {
-		const entry = CONFIG_RE.exec(value);
-		const path = entry === null ? void 0 : decodePath(entry[2]);
-		if (path !== void 0) into.config[path] = entry[1];
-	},
 	"Gtd-Review-Base": (value, into) => {
 		into.reviewBase ??= value.split(/\s/)[0];
 	},
@@ -22930,6 +22940,9 @@ const TRAILER_READERS = {
 	"Gtd-Approved": (value, into) => {
 		into.approved ??= decodeApproval(value);
 	},
+	"Gtd-Pin": (value, into) => {
+		if (value === "add" || value === "remove") into.pin ??= value;
+	},
 	"Gtd-Format": (value, into) => {
 		if (FORMAT_RE.test(value)) into.format ??= Number(value);
 	},
@@ -22952,10 +22965,10 @@ const parseCommitMessage = (message) => {
 		version: void 0,
 		kept: void 0,
 		approved: void 0,
+		pin: void 0,
 		judge: [],
 		marks: [],
 		vars: {},
-		config: {},
 		cost: [],
 		format: void 0
 	};
@@ -22969,24 +22982,28 @@ const parseCommitMessage = (message) => {
 };
 const sortedEntries = (record = {}) => Object.entries(record).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
 /** Trailer order is fixed so the same spec always yields the same bytes. */
+const trailer = (name, value) => value === void 0 ? [] : [`Gtd-${name}: ${value}`];
+const costValue = (cost) => cost === void 0 ? void 0 : `${cost.cost}${cost.model !== void 0 ? ` ${cost.model}` : ""}`;
 const formatCommitMessage = (spec) => {
-	const lines = [];
-	if (spec.step !== void 0) lines.push(`Gtd-Step: ${formatStepId(spec.step)}`);
-	if (spec.workflow !== void 0) lines.push(`Gtd-Workflow: ${spec.workflow}`);
-	if (spec.reviewBase !== void 0) lines.push(`Gtd-Review-Base: ${spec.reviewBase}`);
-	for (const [name, value] of sortedEntries(spec.vars)) lines.push(`Gtd-Var: ${name}=${value}`);
-	for (const [path, hash] of sortedEntries(spec.config)) lines.push(`Gtd-Config: ${hash} ${encodePath(path)}`);
-	if (spec.cost !== void 0) lines.push(`Gtd-Cost: ${spec.cost.cost}${spec.cost.model !== void 0 ? ` ${spec.cost.model}` : ""}`);
-	for (const verdict of spec.judge ?? []) lines.push(`Gtd-Judge: ${JSON.stringify(verdict)}`);
-	for (const m of spec.marks ?? []) lines.push(`Gtd-Mark: ${m.name}=${m.value}`);
-	if (spec.approved !== void 0) lines.push(`Gtd-Approved: ${encodeApproval(spec.approved)}`);
-	if (spec.branch !== void 0) lines.push(`Gtd-Branch: ${spec.branch}`);
-	if (spec.version !== void 0) lines.push(`Gtd-Version: ${spec.version}`);
-	lines.push(`Gtd-Format: 1`);
+	const lines = [
+		...trailer("Step", spec.step && formatStepId(spec.step)),
+		...trailer("Workflow", spec.workflow),
+		...trailer("Review-Base", spec.reviewBase),
+		...sortedEntries(spec.vars).map(([name, value]) => `Gtd-Var: ${name}=${value}`),
+		...trailer("Cost", costValue(spec.cost)),
+		...(spec.judge ?? []).map((verdict) => `Gtd-Judge: ${JSON.stringify(verdict)}`),
+		...(spec.marks ?? []).map((m) => `Gtd-Mark: ${m.name}=${m.value}`),
+		...trailer("Approved", spec.approved && encodeApproval(spec.approved)),
+		...trailer("Pin", spec.pin),
+		...trailer("Branch", spec.branch),
+		...trailer("Version", spec.version),
+		`Gtd-Format: 2`
+	];
 	return `${formatSubject(spec.actor, spec.to, spec.from)}\n\n${lines.join("\n")}`;
 };
 //#endregion
 //#region src/replay/Replay.ts
+const UNPIN_STATE = PIN_STATES.remove;
 const actorOfKind = (kind) => kind === "run" ? "check" : kind === "agent" ? "agent" : kind === "human" ? "human" : "judge";
 const memoryScopeOf = (name) => {
 	const dot = name.lastIndexOf(".");
@@ -23120,7 +23137,33 @@ const modeWithoutFile = (step) => {
 	if (options.mode === void 0 || options.file !== void 0) return void 0;
 	return `gtd: step "${step.name}": mode requires file in ${step.kind}() options — name the steering file the mode checks`;
 };
-const replay = async (input) => {
+const withoutPin = (input) => {
+	const hide = (tree) => withoutPath(tree, PIN_PATH);
+	return {
+		...input,
+		episode: {
+			base: {
+				...input.episode.base,
+				tree: hide(input.episode.base.tree)
+			},
+			commits: input.episode.commits.map((c) => ({
+				...c,
+				tree: hide(c.tree),
+				...c.kept !== void 0 ? { kept: {
+					...c.kept,
+					tree: hide(c.kept.tree)
+				} } : {}
+			}))
+		},
+		...input.startTree !== void 0 ? { startTree: hide(input.startTree) } : {},
+		...input.pending !== void 0 ? { pending: {
+			...input.pending,
+			tree: hide(input.pending.tree)
+		} } : {}
+	};
+};
+const replay = async (raw) => {
+	const input = withoutPin(raw);
 	const commits = input.episode.commits.map((c) => ({
 		...c,
 		parsed: parseCommitMessage(c.message)
@@ -23129,6 +23172,9 @@ const replay = async (input) => {
 	let cursor = 0;
 	let pendingUsed = false;
 	let position = input.episode.base;
+	const skipPins = () => {
+		while (cursor < commits.length && commits[cursor].parsed.pin !== void 0) cursor++;
+	};
 	let previousPosition = input.episode.base;
 	let expectedNext;
 	const occurrences = /* @__PURE__ */ new Map();
@@ -23310,19 +23356,24 @@ const replay = async (input) => {
 		if (unapproved !== void 0) return finish(unapproved);
 		cursor++;
 		advance(commit);
-		if (commit.parsed.kept !== void 0) if (commit.kept === void 0) keptTips.delete(step.name);
-		else keptTips.set(step.name, {
-			hash: commit.kept.hash,
-			before: commit.tree,
-			after: commit.kept.tree
-		});
+		skipPins();
+		noteKept(step, commit);
 		const to = commit.parsed.parsed?.to;
-		if (to !== void 0) expectedNext = {
+		if (to !== void 0 && to !== UNPIN_STATE) expectedNext = {
 			name: to,
 			hash: commit.hash
 		};
 		return replyFor(step.request, commit.parsed.judge);
 	};
+	const noteKept = (step, commit) => {
+		if (commit.parsed.kept === void 0) return;
+		if (commit.kept === void 0) keptTips.delete(step.name);
+		else keptTips.set(step.name, {
+			hash: commit.kept.hash,
+			before: commit.tree,
+			after: commit.kept.tree
+		});
+	};
 	const landPending = (step, pending) => {
 		pendingUsed = true;
 		landed = step;
@@ -23339,7 +23390,10 @@ const replay = async (input) => {
 		return replyFor(step.request, pending.verdicts ?? []);
 	};
 	const answer = (step) => {
-		while (cursor < commits.length && isAttemptAt(commits[cursor], step.name)) cursor++;
+		while (cursor < commits.length && isAttemptAt(commits[cursor], step.name)) {
+			cursor++;
+			skipPins();
+		}
 		const commit = commits[cursor];
 		if (commit !== void 0) return consumeCommit(step, commit);
 		if (input.pending === void 0 || pendingUsed) return finish({
@@ -23352,6 +23406,7 @@ const replay = async (input) => {
 		return landPending(step, input.pending);
 	};
 	const requestFault = (request) => {
+		if (Object.values(PIN_STATES).includes(scoped(request.name))) return `gtd: step "${scoped(request.name)}": the name is reserved for the pin and unpin beats — rename the step`;
 		if (request.kind === "run" && typeof request.body !== "string") return `gtd: step "${scoped(request.name)}": a run() body is a shell script string — decide in flow code, then render the script (see checkScript and friends)`;
 		if (request.kind !== "agent") return void 0;
 		const name = scoped(request.name);
@@ -23378,15 +23433,18 @@ const replay = async (input) => {
 		const blocker = blockerAt(step);
 		return blocker === void 0 ? answer(step) : finish(blocker);
 	};
-	const endOfFlow = (via) => cursor < commits.length ? {
-		kind: "divergence",
-		message: `gtd: the flow ended, but commit ${short(commits[cursor].hash)} continues the episode — ${DIVERGED}`
-	} : {
-		kind: "ended",
-		via,
-		trace,
-		landed,
-		marks
+	const endOfFlow = (via) => {
+		skipPins();
+		return cursor < commits.length ? {
+			kind: "divergence",
+			message: `gtd: the flow ended, but commit ${short(commits[cursor].hash)} continues the episode — ${DIVERGED}`
+		} : {
+			kind: "ended",
+			via,
+			trace,
+			landed,
+			marks
+		};
 	};
 	const changesSince = (hash) => {
 		const tree = treeAt(hash);
@@ -23449,10 +23507,11 @@ const replay = async (input) => {
 		skillsFor: (localName) => resolveSkills(memoryScopeOf(scoped(localName))) ?? [],
 		accessFor: (localName, file) => foldedAccessFor(resolveAccess(memoryScopeOf(scoped(localName))), file),
 		head: () => {
-			const rest = commits.slice(cursor);
+			const rest = commits.slice(cursor).filter((c) => c.parsed.pin === void 0);
 			return rest.length > 0 && rest.every((c) => c.parsed.step === void 0) ? rest[rest.length - 1].hash : position.hash;
 		}
 	};
+	skipPins();
 	installContext(context);
 	try {
 		const flowDone = input.flow({}).then(() => {
@@ -23840,7 +23899,8 @@ const load = gen(function* () {
 		},
 		...compiled.ui !== void 0 ? { ui: compiled.ui } : {},
 		warnings: diagnostics.filter((d) => d.severity === "warning"),
-		fingerprint: pinned?.fingerprint ?? configFingerprint(loaded.file.dependencyFiles, host.root, module.read ?? readFromDisk)
+		fingerprint: pinned?.fingerprint ?? configFingerprint(loaded.file.dependencyFiles, host.root, module.read ?? readFromDisk),
+		drift: pinned === void 0 ? [] : changedConfigFiles(pinned.fingerprint, configFingerprint(Object.keys(pinned.fingerprint).map((file) => resolve(host.root, file)), host.root, readFromDisk))
 	};
 });
 const readFromDisk = (path) => {
@@ -24490,10 +24550,6 @@ const resolveScopeAccess = (def, skills, vars) => gen(function* () {
 //#endregion
 //#region src/workflow/Workflow.ts
 const knownModes = (def) => Object.keys(def.modes);
-//#endregion
-//#region src/workflow/pin.ts
-/** Bumped when a launcher could no longer run an older pin the same way. */
-const PIN_FORMAT = 1;
 /**
 * The engine a pin carries, as ES module source. Live, the `gtd.core.mjs` the
 * running gtd ships beside its own bundle.
@@ -24519,1549 +24575,1650 @@ const pin = (module, root, version) => gen(function* () {
 		try: () => pinnedWorkflowSource(module, root, version),
 		catch: (e) => new GtdError(`gtd bundle: ${module.filepath}: ${e instanceof Error ? e.message : String(e)}`)
 	})) + core.replace(/^#!.*\n/, "");
-	return Buffer.concat([Buffer.from(`gtdpin ${PIN_FORMAT} gtd ${version}\n`), gzipSync(source, { level: 9 })]);
+	return Buffer.concat([Buffer.from(`gtdpin 1 gtd ${version}\n`), gzipSync(source, { level: 9 })]);
 });
 //#endregion
-//#region src/step/planStep.ts
+//#region src/emit/GitScript.ts
+const shellQuote = (value) => `'${value.replace(/'/g, "'\\''")}'`;
 /**
-* At the human review gate an unconditional `gtd uncheck '<file>'` runs
-* ahead of the commit, resetting every checkbox before `git add -A` picks it
-* up — a tick is read-progress, never sign-off.
+* `--allow-empty` because gtd's workflow commits may be empty on purpose.
+* Mirrors `Git.ts`'s retry: only re-tries without hooks on the specific
+* "empty git commit" rejection message, discriminated from the captured
+* output rather than the exit code, so a genuinely rejected commit (a lint
+* error, a commit-msg hook) still fails.
 */
-const uncheckStep = (snapshot) => snapshot.stepDef.actor === "human" && snapshot.stepDef.mode === "review" && snapshot.file !== void 0 ? [{
-	kind: "uncheck",
-	file: snapshot.file
-}] : [];
-const planStep = (snapshot, opts = {}) => {
-	const landing = snapshot.landing;
-	if (landing.kind === "refusal") return {
-		kind: "refusal",
-		message: landing.message
-	};
-	if (landing.kind === "noop") return {
-		kind: "noop",
-		state: snapshot.state,
-		settled: landing.settled
-	};
-	const cost = opts.cost === void 0 ? {} : { cost: {
-		cost: opts.cost,
-		...opts.model !== void 0 ? { model: opts.model } : {}
-	} };
-	if (landing.kind === "attempt") {
-		const message = formatCommitMessage({
-			actor: snapshot.actor,
-			to: snapshot.state,
-			...cost
-		});
-		return {
-			kind: "commit",
-			state: snapshot.state,
-			to: snapshot.state,
-			subject: landing.subject,
-			steps: [{
-				kind: "gitWrite",
-				write: {
-					kind: "commitAll",
-					message
-				}
-			}, {
-				kind: "outcome",
-				outcome: {
-					kind: "commit",
-					subject: landing.subject
-				}
-			}]
-		};
-	}
-	const message = formatCommitMessage({
-		...landing.spec,
-		...cost,
-		...opts.judge !== void 0 && opts.judge.length > 0 ? { judge: opts.judge } : {}
-	});
-	const subject = message.split("\n")[0];
-	const outcome = landing.to === snapshot.state ? {
-		kind: "outcome",
-		outcome: {
-			kind: "commit",
-			subject
-		}
-	} : {
-		kind: "outcome",
-		outcome: {
-			kind: "transition",
-			from: snapshot.state,
-			to: landing.to
-		}
-	};
-	return {
-		kind: "commit",
-		state: snapshot.state,
-		to: landing.to,
-		subject,
-		steps: [
-			...uncheckStep(snapshot),
-			{
-				kind: "gitWrite",
-				write: landing.keepTurn !== void 0 ? {
-					kind: "keepTurn",
-					ref: landing.keepTurn,
-					message
-				} : landing.spec.approved !== void 0 ? {
-					kind: "commitClean",
-					message
-				} : {
-					kind: "commitAll",
-					message
-				}
-			},
-			...landing.keepHistory !== void 0 ? [{
-				kind: "gitWrite",
-				write: {
-					kind: "updateRef",
-					ref: landing.keepHistory,
-					target: "HEAD"
-				}
-			}] : [],
-			outcome
-		]
-	};
+const commitAllowEmpty = (message, only) => {
+	const m = shellQuote(message);
+	const paths = only === void 0 ? "" : ` -- ${shellQuote(only)}`;
+	return [
+		`if ! out=$(git commit --allow-empty -m ${m}${paths} 2>&1); then`,
+		`  case "$out" in`,
+		`    *"empty git commit"*) git commit --allow-empty --no-verify -m ${m}${paths} || exit 1 ;;`,
+		`    *) printf '%s\\n' "$out" >&2; exit 1 ;;`,
+		`  esac`,
+		`fi`
+	].join("\n");
 };
-//#endregion
-//#region src/step/accessRefusal.ts
+const CHANGED_SINCE_LAND = "gtd: the working tree changed since `gtd land` — revert the edits and run `gtd land` again to approve";
+/** `git add -A || exit 1` (an `&&` left side would not abort under `set -e`) then `commitAllowEmpty`. */
+const commitAll = (message) => `git add -A || exit 1\n${commitAllowEmpty(message)}`;
+/** Commits `path` alone, as the worktree has it; every other pending change stays pending. */
+const commitPath = (path, message) => `git add -A -- ${shellQuote(path)} || exit 1\n${commitAllowEmpty(message, path)}`;
+/** A pin beat's script. A failed `gtd bundle` leaves no half-written pin behind. */
+const pinScript = (path) => {
+	const p = shellQuote(path);
+	const slash = path.lastIndexOf("/");
+	return `${slash === -1 ? "" : `mkdir -p ${shellQuote(path.slice(0, slash))}\n`}gtd bundle >${p} || { rm -f -- ${p}; exit 1; }`;
+};
+/** An unpin beat's script, and `gtd abandon`'s removal of the pin. */
+const unpinScript = (path) => `rm -f -- ${shellQuote(path)}`;
 /**
-* The landing refusal for changes outside `write`, or `undefined` when every
-* path is allowed. `null` is unrestricted. The message is the fix prompt: gtd
-* runs no fix turn of its own.
+* An approval records exactly the judged tree: HEAD is pinned before the
+* clean check and the commit is built over its tree with `commit-tree`, so no
+* hook runs and none can add to it. A HEAD that moved fails the guarded
+* `update-ref`. `commit-tree` ignores `commit.gpgSign`, so it is read here.
 */
-const accessRefusal = (changes, write) => {
-	if (write === null) return void 0;
-	const offending = [...new Set(changes.filter((c) => !write.some((glob) => globMatches(c.path, glob))).map((c) => c.path))];
-	if (offending.length === 0) return void 0;
+const commitClean = (message) => [
+	`gtd_head=$(git rev-parse --verify HEAD) || exit 1`,
+	`if [ -n "$(git status --porcelain --untracked-files=all --ignore-submodules=none)" ]; then`,
+	`  printf '%s\\n' ${shellQuote(CHANGED_SINCE_LAND)} >&2`,
+	`  exit 1`,
+	`fi`,
+	`gtd_sign_cfg=$(git config --type=bool --default=false commit.gpgSign) || exit 1`,
+	`if [ "$gtd_sign_cfg" = true ]; then gtd_sign=-S; else gtd_sign=--no-gpg-sign; fi`,
+	`gtd_tip=$(git commit-tree "$gtd_sign" "$gtd_head^{tree}" -p "$gtd_head" -m ${shellQuote(message)}) || exit 1`,
+	`git update-ref -m ${shellQuote(`commit: ${message}`)} HEAD "$gtd_tip" "$gtd_head" || exit 1`
+].join("\n");
+/** No current caller — see `Git.ts`'s `GitWriterOperations.commitAsIs` for why it's kept anyway. */
+const commitAsIs = (message) => commitAllowEmpty(message);
+/** No current caller — see `Git.ts`'s `GitWriterOperations.softResetTo` for why it's kept anyway. */
+const softResetTo = (ref) => `git reset --soft ${shellQuote(ref)}`;
+const mixedResetTo = (ref) => `git reset --mixed ${shellQuote(ref)}`;
+const hardResetTo = (ref) => `git reset --hard ${shellQuote(ref)}`;
+/**
+* `git add -A` then `git reset --hard HEAD` — discards every pending change,
+* tracked or untracked. Joined with `&&`: a failed stage must not reach the
+* hard reset, or untracked survivors remain — the exact outcome this builder
+* exists to avoid. No current caller — see `Git.ts`'s
+* `GitWriterOperations.discardPending` for why it's kept anyway.
+*/
+const discardPending = () => `git add -A && git reset --hard HEAD`;
+/**
+* POSIX sh (runs under dash). The marker is a `commit-tree` over HEAD's own
+* tree, so no hook runs on it and its tree is the pre-turn tree by
+* construction; `commit-tree` ignores `commit.gpgSign`, hence the explicit
+* `-S`, read (and failing closed) before any object or ref is written; the
+* index is already staged by then, so an early exit leaves the turn staged.
+* The kept ref is deleted only after `reset -q` succeeds: it is then the
+* turn's only handle.
+* The branch moves before the final hard reset, so if that reset fails the
+* marker has landed and the turn is still in the working tree (kept ref
+* present); every other failure leaves the branch untouched.
+*/
+const keepTurn = (refPrefix, message) => {
+	const keptRef = `${shellQuote(`${refPrefix}/`)}"$gtd_kept"`;
 	return [
-		ACCESS_REFUSAL,
-		...offending.map((path) => `  - ${path}`),
-		`allowed: ${write.length === 0 ? "(nothing)" : write.join(", ")}`
+		`git add -A || exit 1`,
+		`gtd_sign_cfg=$(git config --type=bool --default=false commit.gpgSign) || exit 1`,
+		`if [ "$gtd_sign_cfg" = true ]; then gtd_sign=-S; else gtd_sign=--no-gpg-sign; fi`,
+		`gtd_head=$(git rev-parse --verify HEAD) || exit 1`,
+		`gtd_tree=$(git write-tree) || exit 1`,
+		`gtd_kept=$(git commit-tree "$gtd_tree" -p "$gtd_head" -m ${shellQuote(message)}) || exit 1`,
+		`git update-ref ${keptRef} "$gtd_kept" || exit 1`,
+		`gtd_marker=$(printf '%s\\nGtd-Kept: %s' ${shellQuote(message)} "$gtd_kept")`,
+		`if ! gtd_tip=$(git commit-tree "$gtd_sign" "$gtd_head^{tree}" -p "$gtd_head" -m "$gtd_marker") || ! git update-ref -m ${shellQuote(`commit: ${message}`)} HEAD "$gtd_tip" "$gtd_head"; then`,
+		`  git reset -q && git update-ref -d ${keptRef}`,
+		`  exit 1`,
+		`fi`,
+		`git reset --hard HEAD`
 	].join("\n");
 };
-//#endregion
-//#region src/step/planStart.ts
-const refusal = (message) => ({
-	kind: "refusal",
-	message
-});
-const checkOverrides = (commandLabel, varOverrides, declaredNames, envNames) => gen(function* () {
-	const environmentOnly = Object.keys(varOverrides).filter((n) => !declaredNames.includes(n) && envNames.includes(n));
-	if (environmentOnly.length > 0) return yield* fail$4(new GtdUsageError(`${commandLabel}: --var pins process settings only; ${environmentOnly.join(", ")} ${environmentOnly.length === 1 ? "is an environment setting" : "are environment settings"} — set it as a workflow option in gtd.config.ts or with a GTD_<NAME> environment variable`));
-	const undeclared = Object.keys(varOverrides).filter((n) => !declaredNames.includes(n));
-	if (undeclared.length > 0) return yield* fail$4(new GtdUsageError(`${commandLabel}: --var name(s) not declared by this workflow: ${undeclared.join(", ")} — declared: ${declaredNames.length > 0 ? declaredNames.join(", ") : "(none)"}`));
-});
+const updateRef = (ref, hash) => `git update-ref ${shellQuote(ref)} ${shellQuote(hash)}`;
+/** `git update-ref -d <ref>` — idempotent: deleting a missing ref is already a no-op in real git. */
+const deleteRef = (ref) => `git update-ref -d ${shellQuote(ref)}`;
 /**
-* `gtd start <name>`: start a brand NEW process on a workflow, writing an
-* opening commit that names the workflow's first step and carries a
-* `Gtd-Workflow:` trailer, every process setting as a `Gtd-Var:` trailer, plus
-* a `Gtd-Review-Base:` trailer when the workflow fixes the process's diff base,
-* and a `Gtd-Config:` trailer per config file.
-* All validation is a REFUSAL, not an Effect failure.
+* No `+` on the refspec: a local ref the remote's tip does not descend from
+* fails the fetch instead of being overwritten (a fast-forward still applies).
 */
-const planStart = (current, actor, start) => gen(function* () {
-	const { workflow, first, commandLabel, vars: varOverrides } = start;
-	const name = workflow.name;
-	if (!current.idle) return refusal(`${commandLabel}: a process is already underway (resting at "${current.state}") — finish it, or run \`gtd abandon\`, before starting another`);
-	if ("refusal" in first) return refusal(`${commandLabel}: ${first.refusal}`);
-	const { firstStep } = first;
-	yield* checkOverrides(commandLabel, varOverrides, Object.keys(workflow.vars), Object.keys(workflow.env));
-	const baseOf = workflow.def.base;
-	const flags = yield* StartFlags;
-	const hostEnv = (yield* Host).env;
-	const badFlag = ownFlagRefusal(workflow.vars, flags, hostEnv);
-	if (badFlag !== void 0) return refusal(`${commandLabel}: ${badFlag}`);
-	const vars = resolveStartVars(workflow.vars, flags, varOverrides, hostEnv);
-	const multiline = multilineSetting(vars);
-	if (multiline !== void 0) return refusal(`${commandLabel}: process setting "${multiline}" spans several lines — a process setting is pinned in a commit trailer and must be a single line`);
-	const template = yield* try_({
-		try: () => baseOf?.(name, vars),
-		catch: (e) => /* @__PURE__ */ new Error(`${commandLabel}: ${e instanceof Error ? e.message : String(e)}`)
-	});
-	const base = template === void 0 ? void 0 : yield* resolveBase(commandLabel, template);
-	if (typeof base === "object") return base;
-	const subject = formatSubject(actor, firstStep);
-	return {
-		kind: "start",
-		workflow: name,
-		subject,
-		steps: [{
-			kind: "gitWrite",
-			write: {
-				kind: "commitAll",
-				message: formatCommitMessage({
-					actor,
-					to: firstStep,
-					workflow: name,
-					...base !== void 0 ? { reviewBase: base } : {},
-					vars,
-					config: start.config
-				})
-			}
-		}, {
-			kind: "outcome",
-			outcome: {
-				kind: "commit",
-				subject
-			}
-		}]
-	};
-});
-/**
-* The workflow's diff base: `git merge-base <base> HEAD`, where a blank base
-* means the default branch. The merge-base is what gets pinned, so a base on
-* another branch reviews exactly this branch's own commits.
-*/
-const resolveBase = (commandLabel, value) => gen(function* () {
-	const git = yield* GitService;
-	const rendered = value.trim();
-	const target = rendered === "" ? yield* git.defaultBranch() : rendered;
-	const resolvedBase = yield* result(git.resolveRef(target));
-	if (resolvedBase._tag === "Failure") return refusal(`${commandLabel}: "${target}" does not resolve to a commit`);
-	const mergeBase = yield* git.mergeBase(resolvedBase.success, "HEAD");
-	if (isNone(mergeBase)) return refusal(`${commandLabel}: "${target}" shares no common ancestor with HEAD`);
-	if (mergeBase.value === (yield* git.resolveRef("HEAD"))) return refusal(`${commandLabel}: nothing to review: HEAD has no commits beyond ${target}`);
-	return mergeBase.value;
-});
-//#endregion
-//#region src/step/strayPaths.ts
-/** Globs use the `access.write` dialect (`globMatches`). */
-const strayPaths = (touched, allow) => touched.filter((path) => !allow.some((glob) => globMatches(path, glob))).sort();
-//#endregion
-//#region src/edge/Edge.ts
-const EMPTY_TREE$1 = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
-const ACTORS = /* @__PURE__ */ new Set([
-	"agent",
-	"human",
-	"check",
-	"judge"
-]);
-/**
-* Where the episode HEAD belongs to begins, read off subjects alone. Walking
-* back from HEAD: a bare `gtd(human): <step>` commit with no `Gtd-Step` is what
-* `gtd start` writes — no landing ever produces one — and opens an
-* episode as its first commit (its `Gtd-Workflow` trailer names the workflow;
-* a legacy `--entry` opening has none); a commit that is not a gtd step commit, or one
-* entering the flow's first step (a finished episode), bounds the episode
-* from below.
-*/
-const locateEpisode = (def, history) => {
-	for (let i = history.length - 1; i >= 0; i--) {
-		const message = parseCommitMessage(history[i].message);
-		const subject = message.parsed;
-		if (subject !== void 0 && message.step === void 0 && subject.from === void 0 && subject.actor === "human") return {
-			workflow: message.workflow,
-			legacyOpening: message.workflow === void 0,
-			baseIndex: i,
-			processStart: i
-		};
-		if (subject === void 0 || !ACTORS.has(subject.actor) || subject.to === def.initial) return {
-			workflow: void 0,
-			legacyOpening: false,
-			baseIndex: i,
-			processStart: i + 1
-		};
+const fetchHistoryRefs = (remote) => [
+	`set -eu`,
+	`before=$(git for-each-ref --format='x' 'refs/gtd/history/' | wc -l)`,
+	`git fetch ${shellQuote(remote)} 'refs/gtd/history/*:refs/gtd/history/*'`,
+	`after=$(git for-each-ref --format='x' 'refs/gtd/history/' | wc -l)`,
+	`printf '%s history refs arrived\\n' "$((after - before))"`
+].join("\n");
+/** Marks an emitted block as print-only — mirrors `OutcomeScript.ts`'s `OUTCOME_MARKER` verbatim, so `src/twins/EmittedScriptRecognizer.ts` recognizes either path's output identically. */
+const OUTCOME_MARKER$1 = "# gtd: outcome (print-only)";
+const printfLine$1 = (fmt, args) => `${OUTCOME_MARKER$1}\nprintf ${shellQuote(fmt.replace(/\n/g, "\\n"))} ${args.join(" ")}`;
+const renderOutcome = (outcome) => {
+	switch (outcome.kind) {
+		case "transition": return printfLine$1("%s %s → %s\n", [
+			"'->'",
+			shellQuote(outcome.from),
+			shellQuote(outcome.to)
+		]);
+		case "commit": return printfLine$1("%s %s\n", ["'[commit]'", shellQuote(outcome.subject)]);
+		case "note": return printfLine$1("%s\n", [shellQuote(outcome.text)]);
 	}
-	return {
-		workflow: void 0,
-		legacyOpening: false,
-		baseIndex: -1,
-		processStart: 0
-	};
-};
-const headTurnOf = (head) => {
-	if (head === void 0) return void 0;
-	const message = parseCommitMessage(head.message);
-	const subject = message.parsed;
-	if (subject === void 0 || !ACTORS.has(subject.actor)) return void 0;
-	return {
-		state: subject.to,
-		actor: subject.actor,
-		empty: head.touched.length === 0,
-		step: message.step !== void 0
-	};
 };
-const traceEntryOf = (hash, message) => ({
-	state: message.parsed?.to ?? "",
-	hash,
-	actor: message.parsed?.actor ?? ""
-});
-const costEntriesOf = (hash, message) => message.cost.map((c) => ({
-	cost: c.cost,
-	model: c.model ?? "unspecified",
-	hash
-}));
-const hashAt = (history, index) => history[index]?.hash;
-const historyFormatFault = (history, location) => formatFault(history.slice(location.baseIndex + 1).concat(history[location.baseIndex]?.message.startsWith("gtd") ? [history[location.baseIndex]] : []).map((c) => ({
-	hash: c.hash,
-	format: parseCommitMessage(c.message).format
-})));
-/** Fails on a history in a format this gtd does not read, before anything acts on it. */
-const runOf = (history, location, closingHash = void 0) => {
-	const fault = historyFormatFault(history, location);
-	return fault === void 0 ? succeed$1(buildRun(history, location, closingHash)) : fail$4(new Error(fault));
-};
-const pinnedConfigOf = (history) => {
-	for (let i = history.length - 1; i >= 0; i--) {
-		const files = parseCommitMessage(history[i].message).config;
-		if (Object.keys(files).length > 0) return {
-			commit: history[i].hash,
-			files
-		};
+const renderGitWrite = (write) => {
+	switch (write.kind) {
+		case "commitAll": return commitAll(write.message);
+		case "commitPath": return commitPath(write.path, write.message);
+		case "commitClean": return commitClean(write.message);
+		case "updateRef": return updateRef(write.ref, write.target);
+		case "keepTurn": return keepTurn(write.ref, write.message);
 	}
 };
-const approvalEntryOf = (hash, message) => message.approved === void 0 ? [] : [{
-	step: formatStepId(message.approved.step),
-	name: message.approved.name,
-	email: message.approved.email,
-	commit: hash
-}];
-const buildRun = (history, location, closingHash) => {
-	const processCommits = history.slice(location.processStart);
-	const parsed = processCommits.map((c) => parseCommitMessage(c.message));
-	const first = parsed[0];
-	const startParentHash = hashAt(history, location.processStart - 1) ?? EMPTY_TREE$1;
-	const head = history[history.length - 1];
-	return {
-		workflow: location.workflow,
-		legacyOpening: location.legacyOpening,
-		startHash: hashAt(history, location.processStart) ?? head?.hash ?? EMPTY_TREE$1,
-		startParentHash,
-		diffBase: first?.reviewBase ?? startParentHash,
-		trace: processCommits.map((c, i) => traceEntryOf(c.hash, parsed[i])),
-		costEntries: parsed.flatMap((m, i) => costEntriesOf(processCommits[i].hash, m)),
-		judgeVerdicts: parsed.flatMap((m) => m.judge),
-		marks: parsed.flatMap((m) => m.marks),
-		approvals: processCommits.flatMap((c, i) => approvalEntryOf(c.hash, parsed[i])),
-		pinnedVars: { ...first?.vars },
-		pinnedConfig: pinnedConfigOf(history.slice(Math.max(location.baseIndex, 0))),
-		headTurn: headTurnOf(head),
-		closingHash,
-		episode: {
-			base: hashAt(history, location.baseIndex),
-			commits: history.slice(location.baseIndex + 1)
-		}
-	};
-};
-const PAGE_TIERS = [
-	32,
-	128,
-	512,
-	Infinity
-];
 /**
-* `locateEpisode`'s own boundary test, subject-only: a commit that isn't a
-* gtd step commit, or one landing the flow's initial state, bounds an
-* episode from below — EXCEPT a bare `gtd(human): <x>` subject (no `→`),
-* which is NEVER a boundary here, whatever `<x>` is. That bare shape is
-* `locateEpisode`'s own `opening` branch (a started episode's first commit),
-* which takes priority there over the initial-state check no matter what the
-* workflow's first step is named — including one named after `def.initial`
-* itself, where the two branches would otherwise disagree. A bare human commit can
-* also be a self-loop step landing rather than a real opening (this
-* subject-only pass can't read the `Gtd-Step` trailer that would tell them
-* apart), so ruling it out here can only make `findBoundaryBase` walk a FEW
-* commits further back than strictly needed — never stop short of the
-* boundary `locateEpisode` would find once it has full commit bodies in
-* hand. That asymmetry is the only direction this approximation may err in;
-* it must never call a real boundary "not yet found".
+* Wraps `command` so a non-zero exit prints `prompt` plus the command's
+* captured output before propagating that exit code — mirrors `Emit.ts`'s
+* `failurePromptWrapper` (same reverse-import concern as `renderOutcome`
+* above: `Emit.ts` imports `shellQuote` from here already).
 */
-const subjectIsBoundary = (def, subject) => {
-	const parsed = parseCommitMessage(subject).parsed;
-	if (parsed === void 0 || !ACTORS.has(parsed.actor)) return true;
-	if (parsed.actor === "human" && parsed.from === void 0) return false;
-	return parsed.to === def.initial;
+const failurePromptWrapper$1 = (command, prompt) => {
+	return [
+		`gtd_validate_status=0`,
+		`gtd_validate_out="$( {`,
+		command,
+		`} 2>&1 )" || gtd_validate_status=$?`,
+		`if [ "$gtd_validate_status" -ne 0 ]; then`,
+		`  printf '%s\\n\\n%s\\n' ${shellQuote(prompt)} "$gtd_validate_out"`,
+		`  exit "$gtd_validate_status"`,
+		`fi`
+	].join("\n");
 };
-/** The last page index (walking newest→oldest, same direction as `locateEpisode`) whose subject is a boundary, or `undefined` if none in `page`. */
-const boundaryIndexIn = (def, page) => {
-	for (let i = page.length - 1; i >= 0; i--) if (subjectIsBoundary(def, page[i].subject)) return i;
+const renderLandStep = (step) => {
+	if (step.kind === "gitWrite") return renderGitWrite(step.write);
+	if (step.kind === "outcome") return renderOutcome(step.outcome);
+	if (step.kind === "uncheck") return `gtd uncheck ${shellQuote(step.file)}`;
+	return step.onFailure !== void 0 ? failurePromptWrapper$1(step.command, step.onFailure) : step.command;
 };
+const ScriptSurface = { render: (steps) => {
+	const rendered = steps.map(renderLandStep);
+	return rendered.length === 0 ? "" : ["set -eu", ...rendered].join("\n\n");
+} };
+//#endregion
+//#region src/emit/Emit.ts
+/** Exits 0 when the declared steering file is absent — nothing to format or validate yet. An OR list, not `if`: its left side failing never trips `set -e`. */
+const fileExistsGuard = (file) => `[ -f ${shellQuote(file)} ] || exit 0`;
+/** A mode or `ui.format` command finds the file it works on in `$GTD_FILE`. */
+const withFileVar = (command, file) => `export GTD_FILE=${shellQuote(file)}\n${command}`;
+const SIMPLE_LEADING_WORD_RE = /^[A-Za-z0-9_./-]+(?=[ \t]|$)/;
+const SHELL_METACHARACTER_RE = /[|&;$<>(){}`]/;
+const FILE_VAR_RE = /"\$GTD_FILE"|"\$\{GTD_FILE\}"|\$GTD_FILE\b|\$\{GTD_FILE\}/g;
+/** `command` with `file` written in for `$GTD_FILE` — one line an agent can copy, equivalent to running it under `withFileVar`. */
+const commandForFile = (command, file) => command.replace(FILE_VAR_RE, shellQuote(file));
 /**
-* `findBoundaryBase`'s result: `base` is the hash to pass `commitHistory` so
-* a `git.commitHistory(base, head)` call reads exactly the episode ending at
-* `head`, plus whatever a subject-only read couldn't rule out — never the
-* whole repository. `base` is deliberately the boundary commit's PARENT, not
-* the boundary commit itself: `commitHistory`'s range excludes `base`, and
-* `runOf` needs the boundary commit present in the read history
-* (`episode.base`, `startParentHash`). `base: undefined` means "read from the
-* repository root" — an empty repository, an unresolvable `head`, or an
-* episode that reaches the root commit, none of which cost anything extra
-* since that IS the whole history in those cases.
-*
-* `head` is the CONCRETE hash the literal `head` argument resolved to on this
-* call's first read — `undefined` only when it never resolved (an empty
-* repository, or an unresolvable ref). The caller must hand this hash, not
-* the original `head` argument, to its own `commitHistory` call: resolving a
-* symbolic ref (literal `HEAD`, most callers' default) a second time risks
-* reading a DIFFERENT commit than this function paged through, if something
-* moves HEAD in between — pinning both reads to one resolved hash is what
-* keeps the two-read split from disagreeing with itself.
+* The leading word of a rendered `format:`/`validate:` command, when the
+* command has exactly one unambiguous binary to probe — `undefined` for
+* anything a shell metacharacter could hide a second command behind. A missing
+* guard degrades to a raw exit; a wrong guard would refuse a working command.
 */
-const findBoundaryBase = (git, def, head) => gen(function* () {
-	let pinnedHead = head;
-	for (const pageSize of PAGE_TIERS) {
-		const page = yield* git.subjectHistory(pageSize, 0, pinnedHead);
-		if (pinnedHead === void 0) pinnedHead = page[page.length - 1]?.hash;
-		const wholeHistory = !Number.isFinite(pageSize) || page.length < pageSize;
-		const boundaryIdx = boundaryIndexIn(def, page);
-		if (boundaryIdx === void 0 || boundaryIdx === 0) {
-			if (wholeHistory) return {
-				base: void 0,
-				head: pinnedHead
-			};
-			continue;
-		}
-		return {
-			base: page[boundaryIdx - 1].hash,
-			head: pinnedHead
-		};
-	}
-	return {
-		base: void 0,
-		head: pinnedHead
-	};
-});
-const historyUpTo = (git, def, head) => flatMap(findBoundaryBase(git, def, head), ({ base, head: resolvedHead }) => git.commitHistory(base, resolvedHead));
-const computeProcessRun = (git, def, head) => flatMap(historyUpTo(git, def, head), (history) => runOf(history, locateEpisode(def, history)));
-const changedSinceStart = (pinned, current, workspace) => {
-	if (pinned === void 0) return [];
-	return changedConfigFiles(pinned.files, current).filter((path) => {
-		const committed = workspace.readCommittedSync(path, pinned.commit);
-		return current[path] === void 0 || committed === void 0 || contentHash(committed) !== current[path];
-	});
-};
-const warnConfigChanges = (run, current, workspace) => gen(function* () {
-	const changed = changedSinceStart(run.pinnedConfig, current, workspace);
-	if (changed.length === 0) return;
-	yield* (yield* Narrator).warn(`gtd: warning: the config changed since this process started (${changed.join(", ")}) — the rest of the process replays under the changed config`);
-});
-/** The run alone, never replaying — `gtd abandon` must work even when replay would refuse, short of a history it cannot read. */
-const currentRun = gen(function* () {
-	const git = yield* GitService;
-	const config = yield* (yield* ConfigService).load;
-	return yield* computeProcessRun(git, config.workflow);
-});
-const runAtTip = (git, def, tip) => gen(function* () {
-	if (tip === void 0) {
-		const history = yield* historyUpTo(git, def, void 0);
-		return yield* runOf(history, locateEpisode(def, history));
-	}
-	if (!(parseCommitMessage(tip.subject).parsed?.to === def.initial)) {
-		const history = yield* historyUpTo(git, def, tip.hash);
-		return yield* runOf(history, locateEpisode(def, history));
-	}
-	const parentRef = `${tip.hash}~1`;
-	const before = yield* historyUpTo(git, def, parentRef);
-	const location = locateEpisode(def, before);
-	let closing = yield* git.commitHistory(parentRef, tip.hash);
-	if (closing.length === 0) closing = yield* git.commitHistory(void 0, tip.hash);
-	return yield* runOf([...before, ...closing], { ...location }, tip.hash);
-});
-const runAtHead = (git, def) => gen(function* () {
-	return yield* runAtTip(git, def, (yield* git.subjectHistory(1, 0))[0]);
-});
-/** The process HEAD closes or sits inside — `gtd summary`'s run. */
-const summaryRun = gen(function* () {
-	const git = yield* GitService;
-	const def = (yield* (yield* ConfigService).load).workflow;
-	return yield* runAtHead(git, def);
-});
-const commitTree = (workspace, hash) => {
-	let entries;
-	const list = () => entries ??= workspace.treeSync(hash);
-	let sortedPaths;
-	const contents = /* @__PURE__ */ new Map();
-	return {
-		paths: () => sortedPaths ??= [...list().keys()].sort(),
-		read: (path) => {
-			if (!list().has(path)) return void 0;
-			if (!contents.has(path)) contents.set(path, workspace.readCommittedSync(path, hash));
-			return contents.get(path);
-		},
-		id: (path) => list().get(path)
-	};
+const extractLeadingBinary = (command) => {
+	if (command.includes("\n")) return void 0;
+	if (SHELL_METACHARACTER_RE.test(command.replace(FILE_VAR_RE, ""))) return void 0;
+	const match = SIMPLE_LEADING_WORD_RE.exec(command);
+	return match === null ? void 0 : match[0];
 };
 /**
-* The tree a landing would commit: the working tree, with any rewrite the
-* landing script applies first. `entries` is `setup.pendingWorktree()` —
-* already memoized — never a fresh `workspace.worktreeSync()` call; see that
-* field's own comment for why the memo lives there and not on `Workspace`.
+* Names a typo'd or uninstalled binary and the `$PATH` it was looked up on.
+* `$PATH` is a shell word the DRIVER's shell expands at run time, so gtd never
+* resolves it in-process. Exits 127, matching bash's "command not found".
 */
-const pendingTree = (workspace, entries, rewrite) => {
-	const paths = [...entries.keys()];
-	const readWorktree = (path) => {
-		try {
-			return workspace.readSync(path);
-		} catch {
-			return;
-		}
-	};
-	return {
-		paths: () => paths,
-		read: (path) => {
-			if (!entries.has(path)) return void 0;
-			const content = readWorktree(path);
-			return content === void 0 || rewrite?.path !== path ? content : rewrite.apply(content);
-		},
-		id: (path) => rewrite?.path === path ? void 0 : entries.get(path)
-	};
+const binaryGuard = (binary, mode, key) => {
+	const messageQ = shellQuote(`gtd: mode "${mode}": "${key}" command not found: ${binary}`);
+	return [
+		`command -v ${shellQuote(binary)} >/dev/null 2>&1 || {`,
+		`  printf '%s\\n%s\\n' ${messageQ} '$PATH: '"$PATH"`,
+		`  exit 127`,
+		`}`
+	].join("\n");
 };
 /**
-* The one resolver of both setting kinds. Process settings: the recorded
-* (pinned) value wins per name, anything unrecorded resolves live — the
-* fallback for a process started before pinning existed. Environment settings
-* are always live. `startOverrides` are `--var` values, passed only while a
-* process is being started.
+* Prints `prompt` plus the captured output on a non-zero exit, then propagates
+* it. The `{ … }` group inlines a multi-line `command` verbatim; the
+* assignment sits left of `||` so `set -e` never trips on the failure itself.
 */
-const settingsFor = (workflow, pinnedVars, hostEnv, startOverrides = {}, startFlags) => ({
-	vars: {
-		...resolveStartVars(workflow.vars, startFlags, startOverrides, hostEnv),
-		...pinnedVars
-	},
-	env: resolveVars(workflow.env, {}, hostEnv)
+const failurePromptWrapper = (command, prompt) => {
+	return [
+		`gtd_validate_status=0`,
+		`gtd_validate_out="$( {`,
+		command,
+		`} 2>&1 )" || gtd_validate_status=$?`,
+		`if [ "$gtd_validate_status" -ne 0 ]; then`,
+		`  printf '%s\\n\\n%s\\n' ${shellQuote(prompt)} "$gtd_validate_out"`,
+		`  exit "$gtd_validate_status"`,
+		`fi`
+	].join("\n");
+};
+const renderStep = (step) => {
+	if (step.kind === "command" && step.onFailure !== void 0) return failurePromptWrapper(step.command, step.onFailure);
+	return step.command;
+};
+const assembleScript = (steps) => steps.length === 0 ? "" : ["set -eu", ...steps.map(renderStep)].join("\n\n");
+/** Build both halves from already-rendered command strings; an empty (or omitted) array produces the empty-string result, so a driver checking `if [ -n "$required" ]` never has to special-case a bare preamble. */
+const emitScripts = (required = [], optional = []) => ({
+	required: assembleScript(required),
+	optional: assembleScript(optional)
 });
-/** The workflow a run replays on: its pinned one, else the default. */
-const workflowOf = (config, run) => {
-	if (run.legacyOpening) return fail$4(/* @__PURE__ */ new Error("gtd: this process was opened by `gtd --entry`, which no longer exists — run `gtd abandon` to start over"));
-	if (run.workflow === void 0) return succeed$1(config.defaultWorkflow);
-	const named = config.workflowNamed(run.workflow);
-	if (named !== void 0) return succeed$1(named);
-	return fail$4(/* @__PURE__ */ new Error(`gtd: this process runs workflow "${run.workflow}", which gtd.config.ts no longer defines — run \`gtd abandon\` to start over`));
+/** Exported so `src/twins/EmittedScriptRecognizer.ts` can recognize these by exact string comparison. `printf`, not `echo`, avoids shell-specific backslash-escape quirks. */
+const DID_NOT_RUN_COMMENT = "# gtd emitted this and did NOT run it — run it with `sh` to apply it";
+const PRESENTATION_ONLY_COMMENT = "# presentation only — safe to skip";
+const PRESENTATION_FAILURE_WARNING = "printf 'gtd: presentation-only follow-up failed — continuing\\n' >&2";
+/**
+* A write command's single pasteable script (`gtd abandon | sh`,
+* `gtd land --json=script`'s own field). `optional`, when non-empty, is
+* wrapped in a subshell whose failure is swallowed — presentation-only, so it
+* must never turn a landed turn into a non-zero exit.
+*/
+const combinedScript = (required, optional) => {
+	if (required.length === 0) return "";
+	if (optional.length === 0) return `${DID_NOT_RUN_COMMENT}\n\n${required}`;
+	return [
+		DID_NOT_RUN_COMMENT,
+		"",
+		required,
+		"",
+		PRESENTATION_ONLY_COMMENT,
+		`(\n${optional}\n) || ${PRESENTATION_FAILURE_WARNING}`
+	].join("\n");
 };
+//#endregion
+//#region src/emit/OutcomeScript.ts
+/**
+* A `printf '<fmt>' <args...>` bash statement — `args` are already-valid bash
+* tokens (a `shellQuote`d literal, a `"$(git …)"` substitution), never
+* re-quoted here: a value reaches the script as a printf ARGUMENT, never
+* interpolated into the format itself, so a subject or state name containing
+* `%` can never be read as a conversion spec. Markers like `->` are arguments
+* too, keeping every format string free of a leading `-` that a shell's
+* `printf` could mistake for an option. A real newline in `fmt` is emitted as
+* the two-character `\n` escape `printf` itself expands, keeping every emitted
+* statement on one line.
+*/
+const printfLine = (fmt, args) => `${OUTCOME_MARKER}\nprintf ${shellQuote(fmt.replace(/\n/g, "\\n"))} ${args.join(" ")}`;
+/**
+* Marks an emitted block as print-only. Load-bearing beyond documentation:
+* `src/twins/EmittedScriptRecognizer.ts` recognizes an outcome block by
+* this line, and a bare `printf` would be ambiguous with a workflow
+* `script:` command that happens to start the same way.
+*/
+const OUTCOME_MARKER = "# gtd: outcome (print-only)";
+const FMT_ABANDON_NOOP = "no gtd process is underway (resting at \"%s\") — nothing to abandon\n";
+const FMT_ABANDONED = "abandoned the process resting at \"%s\" — HEAD is back at %s (\"%s\"), resting at \"%s\".\nEverything the process produced is kept as uncommitted changes (`git status`); discard them with `git checkout -- . && git clean -fd .gtd` for a clean tree.\n";
+const FMT_RESTORED = "restored the retained history — HEAD is back at %s (\"%s\"), resting at \"%s\". Resume with the loop, or `git reset` to any earlier turn to restart from there.\n";
+/** `no gtd process is underway (resting at "<initial>") — nothing to abandon` — `gtd abandon`'s no-op plain-text line. */
+const abandonNoopText = (initial) => renderFormat(FMT_ABANDON_NOOP, initial);
+/** One already-rendered plain line. */
+const noteOutcome = (text) => printfLine("%s\n", [shellQuote(text)]);
+/**
+* Resolves the post-hoc short hash/subject from `head` (a commitish) in-script
+* — this line runs AFTER the reset that made `head` the new HEAD, so neither
+* value is knowable when gtd generates it.
+*/
+const abandonedOutcome = (from, head, state) => printfLine(FMT_ABANDONED, [
+	shellQuote(from),
+	`"$(git rev-parse --short ${shellQuote(head)})"`,
+	`"$(git log -1 --format=%s ${shellQuote(head)})"`,
+	shellQuote(state)
+]);
+/** `gtd abandon`'s no-op outcome — the same wording `abandonNoopText` renders. */
+const abandonNoopOutcome = (initial) => noteOutcome(abandonNoopText(initial));
+/** Resolves the post-hoc short hash/subject from `to` (a commitish) in-script, for the same reason `abandonedOutcome` does. */
+const restoredOutcome = (to, state) => printfLine(FMT_RESTORED, [
+	`"$(git rev-parse --short ${shellQuote(to)})"`,
+	`"$(git log -1 --format=%s ${shellQuote(to)})"`,
+	shellQuote(state)
+]);
+//#endregion
+//#region src/emit/ModeContradiction.ts
 /**
-* `judgeBudgetBytes` is the one var that refuses rather than disabling its
-* mechanism when blanked: without a bound the judge payload is rejected
-* anyway. Absent falls back to a conservative default.
+* Written for two readers at once, since gtd validate's exit code carries no
+* second meaning to distinguish them: the agent (this is a CONFIGURATION BUG,
+* not the steering file — stop, don't edit it, or a fix-retry loop will
+* thrash on the document) and the human (which mode, and the exact rendered
+* `format:` command, to fix `gtd.config.ts` without reproducing the failure).
 */
-const DEFAULT_JUDGE_BUDGET_BYTES = 32768;
-const judgeBudgetBytes = (vars) => {
-	const raw = vars.judgeBudgetBytes;
-	if (raw === void 0) return DEFAULT_JUDGE_BUDGET_BYTES;
-	const n = Number(raw);
-	if (raw.trim() === "" || !Number.isInteger(n) || n <= 0) throw new Error(`"judgeBudgetBytes" must be a positive integer — got ${JSON.stringify(raw)} (blanking this var disables the payload bound rather than the mechanism it guards, so it is refused rather than defaulted)`);
-	return n;
-};
-const replayFor = (setup, pending) => replay({
-	flow: setup.def.flow,
-	episode: {
-		base: setup.base,
-		commits: setup.episode
-	},
-	vars: setup.vars,
-	env: setup.env,
-	start: setup.run.diffBase,
-	startTree: setup.run.diffBase === EMPTY_TREE$1 ? treeFromRecord({}) : commitTree(setup.workspace, setup.run.diffBase),
-	budgetBytes: setup.budget,
-	skills: setup.skills,
-	configuredSkills: setup.def.configuredSkills,
-	access: setup.access,
-	configuredAccess: setup.def.configuredAccess,
-	...pending !== void 0 ? { pending } : {}
-});
-const replayError = (outcome) => {
-	if (outcome.kind === "divergence" || outcome.kind === "failed") return new Error(outcome.message);
-	if (outcome.kind === "refused") return /* @__PURE__ */ new Error(`gtd: ${outcome.message}`);
-	if (outcome.kind === "ended") return /* @__PURE__ */ new Error("gtd: history ends the episode, but HEAD does not enter the default workflow's first step — the workflow changed under this process; run `gtd abandon` to start over");
-};
-const judgeDocument = (step) => step.request.kind === "judge" ? judgeJson(step.request.evidence, step.request.questions) : void 0;
+const contradictionMessage = (mode, formatCommand) => `gtd: mode "${mode}"'s format: command breaks its own validator — this is a CONFIGURATION BUG, not a problem with the steering file. Do NOT edit the steering file — stop and end your turn now.\nThe rendered format: command that ran:\n${formatCommand}\nWhat it turned mode "${mode}"'s own canonical sample into:`;
 /**
-* The fixed sentence appended to a judge gate's message when a bounded read
-* dropped bytes to fit `judgeBudgetBytes` — a constant, so no workflow can
-* reword or drop it.
+* Formats a copy of the mode's own canonical sample and re-validates it with
+* `gtd check <mode>`, failing loudly when the round-trip breaks it — detects a
+* mode whose `format:` contradicts its own `validate:` without ever touching
+* the real steering file. `printf '%s'` over a `shellQuote`d sample, never a
+* heredoc, since no delimiter chosen ahead of time can collide with the
+* sample's own bytes. One bash fragment with no blank lines (so
+* `src/emit/Emit.ts`'s `assembleScript` never splits it from a sibling step), meant
+* to run BEFORE `[ -f <file> ] || exit 0` in the emitted validate script so it
+* still fires at a first-write beat where the real steering file doesn't
+* exist yet.
 */
-const TRUNCATION_NOTICE = "Note: some evidence above was truncated to fit the judge's payload budget.";
-const DEFAULT_JUDGE_MESSAGE = "A judgment is pending. Run `gtd judge answer` and pipe a verdict, or land to take the conservative default with no verdict recorded.";
-const optional = (key, value) => value === void 0 ? {} : { [key]: value };
-const commonOf = (step) => {
-	const options = step.request.options;
-	return {
-		actor: step.actor,
-		...optional("label", options.label),
-		...optional("file", options.file),
-		...optional("mode", options.mode)
-	};
-};
-const promptDef = (common, request, skills, access) => ({
-	...common,
-	kind: "prompt",
-	content: request.prompt,
-	...optional("model", request.options.model),
-	...optional("system", request.options.system),
-	...optional("allowEmpty", request.options.allowEmpty),
-	...optional("keep", request.options.keep),
-	...optional("skills", skills),
-	...optional("access", access)
-});
-const scriptDef = (common, request) => ({
-	...common,
-	kind: "script",
-	content: request.body
-});
-const judgeDef = (common, request, step) => {
-	const message = request.options.message ?? DEFAULT_JUDGE_MESSAGE;
-	return {
-		...common,
-		kind: "message",
-		content: step.truncated ? `${message}\n\n${TRUNCATION_NOTICE}` : message,
-		...optional("judge", judgeDocument(step))
-	};
+const buildModeContradictionCheck = (inputs) => {
+	const { mode, samplePath, sample, formatCommand } = inputs;
+	const pathQ = shellQuote(samplePath);
+	const messageQ = shellQuote(contradictionMessage(mode, formatCommand));
+	return [
+		`printf '%s' ${shellQuote(sample)} > ${pathQ}`,
+		formatCommand,
+		`gtd check ${mode} ${pathQ} >/dev/null 2>&1 || {`,
+		`  printf '%s\\n' ${messageQ} >&2`,
+		`  cat ${pathQ} >&2`,
+		`  rm -f ${pathQ}`,
+		`  exit 1`,
+		`}`,
+		`rm -f ${pathQ}`
+	].join("\n");
 };
-const messageDef = (common, request, step) => ({
-	...common,
-	kind: "message",
-	content: request.options.message ?? request.options.label ?? step.name,
-	...optional("acceptClean", request.options.approve === true || request.options.acceptClean),
-	...optional("approve", request.options.approve)
-});
-const stepDefOf = (step) => {
-	const request = step.request;
-	const common = commonOf(step);
-	switch (request.kind) {
-		case "agent": return promptDef(common, request, step.skills, step.access);
-		case "run": return scriptDef(common, request);
-		case "judge": return judgeDef(common, request, step);
-		case "human": return messageDef(common, request, step);
-	}
+/**
+* Skip notice for a mode whose validator is EXTERNAL (a user `validate:`
+* command, not one of the two built-in modes) — there's no in-process parser
+* to round-trip a sample through. Printed to stderr since silence would read
+* as a clean bill of health.
+*/
+const modeContradictionSkipNotice = (mode) => {
+	return `printf '%s\\n' ${shellQuote(`gtd: mode "${mode}" has an external validate: command — skipping the format/validate contradiction check`)} >&2`;
 };
-const ROOT_MEMORY_SCOPE_NAME = "root";
+//#endregion
+//#region src/emit/SteeringMode.ts
 /**
-* An agent rest's memory key, `<scope>#<hash7>`: the hash is the commit the
-* current unbroken run into the scope started FROM, so the same run always
-* re-derives the same key. `resumed` is whether an agent turn in that run
-* already landed.
+* `format` alone (no live/external verdict) when there's no validator at
+* all; a live in-process validator for a `"builtin"` validate OR a command
+* that is exactly the format's own seeded string; `externalValidate` for any
+* other command. Each arm returns directly — a flat sequence, not nested
+* ternaries — so the four outcomes stay each their own case to read, not a
+* boolean expression to re-derive.
 */
-const memoryOf = (trace, run) => {
-	const rest = trace[trace.length - 1];
-	if (rest === void 0 || rest.kind !== "agent") return {
-		key: void 0,
-		resumed: false
+const capabilitiesFor = (mode, format, validate) => {
+	if (format === void 0) return validate?.kind === "command" ? { externalValidate: true } : {};
+	if (validate?.kind === "builtin") return {
+		format,
+		liveValidate: format.validate
+	};
+	if (validate === void 0) return { format };
+	if (isSeededValidateCommand(mode, validate.command)) return {
+		format,
+		liveValidate: format.validate
 	};
-	const start = scopeRunStart(trace, rest.memoryScope);
-	const token = start <= 0 ? run.startParentHash : trace[start - 1].enteredAt;
-	const resumed = trace.slice(Math.max(start, 0), trace.length - 1).some((s) => s.kind === "agent" && s.memoryScope === rest.memoryScope);
 	return {
-		key: `${rest.memoryScope || ROOT_MEMORY_SCOPE_NAME}#${token.slice(0, 7)}`,
-		resumed
+		format,
+		externalValidate: true
 	};
 };
-const hintsOf = (def) => ({
-	...optional("model", def.model),
-	...optional("label", def.label),
-	...optional("file", def.file),
-	...optional("judge", def.judge),
-	...optional("system", def.system),
-	...optional("mode", def.mode),
-	...optional("skills", def.skills),
-	...optional("access", def.access)
-});
-const normalizeStatus = (raw) => raw === "A" ? "A" : raw === "D" ? "D" : "M";
-/** Per-model token totals, highest-cost first (ties broken by model name). */
-const costByModel = (entries) => {
-	const byModel = /* @__PURE__ */ new Map();
-	for (const entry of entries) byModel.set(entry.model, (byModel.get(entry.model) ?? 0) + entry.cost);
-	return [...byModel.entries()].map(([model, cost]) => ({
-		model,
-		cost
-	})).sort((a, b) => b.cost - a.cost || a.model.localeCompare(b.model));
-};
-const costTotals = (entries) => ({
-	total: entries.reduce((sum, entry) => sum + entry.cost, 0),
-	byModel: costByModel(entries)
-});
-const setupFor = (config, run, workspace, host, startOverrides = {}) => gen(function* () {
-	const resolved = yield* workflowOf(config, run);
-	const def = resolved.def;
-	const startFlags = run.trace.length === 0 ? yield* StartFlags : {};
-	const { vars, env } = settingsFor(resolved, run.pinnedVars, host.env, startOverrides, startFlags);
-	const skills = yield* resolveScopeSkills(def, vars);
-	const access = yield* resolveScopeAccess(def, skills, vars);
-	const budget = yield* try_({
-		try: () => judgeBudgetBytes(vars),
-		catch: (e) => e instanceof Error ? e : new Error(String(e))
-	});
-	yield* workspace.episodeTrees(run.episode.base, run.episode.commits.map((c) => c.hash));
-	const base = run.episode.base === void 0 ? {
-		hash: EMPTY_TREE$1,
-		tree: treeFromRecord({})
-	} : {
-		hash: run.episode.base,
-		tree: commitTree(workspace, run.episode.base)
-	};
-	const git = yield* GitService;
-	const episode = [];
-	for (const c of run.episode.commits) {
-		const tip = parseCommitMessage(c.message).kept;
-		const exists = tip !== void 0 && isSome(yield* git.readRefOption(`${tip}^{commit}`));
-		episode.push({
-			hash: c.hash,
-			message: c.message,
-			tree: commitTree(workspace, c.hash),
-			...exists ? { kept: {
-				hash: tip,
-				tree: commitTree(workspace, tip)
-			} } : {}
-		});
-	}
-	let pendingMemo;
-	return {
-		resolved,
-		def,
-		vars,
-		env,
-		setup: {
-			def,
-			run,
-			vars,
-			env,
-			budget,
-			skills,
-			access,
-			workspace,
-			base,
-			episode,
-			pendingWorktree: () => pendingMemo ??= workspace.worktreeSync()
-		}
+/**
+* Resolve a `mode:` name against `def.modes` plus the built-in registry
+* (`src/workflow/SteeringFormats.ts`) — half by half: a declared `format:`/`validate:`
+* wins, and an undeclared `validate:` falls back to the built-in format's own
+* parser when the name is registered. `format` is set from the registry
+* ALONE, independent of which half of `validate` wins — a declared validator
+* overrides validation, not the format identity.
+*
+* `def: undefined` is the LSP's built-in-only fallback — resolving `mode`
+* against the registry alone, with no workflow definition in hand (e.g. the
+* basename dispatch for a `REVIEW.md` no config maps).
+*
+* The `"unknown"` arm carries the whole refusal message, naming what IS known
+* when `def` is given — this is the one place that message is built, so it
+* can never drift from what actually resolved.
+*/
+const resolveMode = (def, state, mode) => {
+	const declared = def?.modes?.[mode];
+	const format = steeringFormatFor(mode);
+	if (declared === void 0 && format === void 0) return {
+		kind: "unknown",
+		message: def !== void 0 ? `state "${state}": mode "${mode}" is not defined by the active workflow (known modes: ${knownModes(def).join(", ")})` : `mode "${mode}" is not a built-in steering format`
 	};
-});
-const pendingChanges = (git, withIndex) => gen(function* () {
-	const worktree = yield* git.changedPaths();
-	if (!withIndex) return worktree;
-	const seen = new Set(worktree.map((e) => e.path));
-	return [...worktree, ...(yield* git.stagedPaths()).filter((e) => !seen.has(e.path))];
-});
-/** Resolve the rest at `ref`, or at HEAD when `ref` is `undefined`. */
-const restAt = (ref, startOverrides = {}) => gen(function* () {
-	const git = yield* GitService;
-	const config = yield* (yield* ConfigService).load;
-	const workspace = yield* Workspace;
-	const host = yield* Host;
-	const run = yield* computeProcessRun(git, config.workflow, ref);
-	const { resolved, def, vars, env, setup } = yield* setupFor(config, run, workspace, host, startOverrides);
-	const outcome = yield* promise(() => replayFor(setup));
-	const error = replayError(outcome);
-	if (error !== void 0 || outcome.kind !== "rest") return yield* fail$4(error ?? /* @__PURE__ */ new Error("gtd: replay found no rest"));
-	const step = outcome.rest;
-	yield* (yield* Narrator).narrate(`rest resolved: ${step.name} (awaits ${step.actor})`);
-	const stepDef = stepDefOf(step);
-	if (stepDef.mode !== void 0 && def.modes[stepDef.mode] === void 0) return yield* fail$4(/* @__PURE__ */ new Error(`gtd: config: step "${step.name}": mode "${stepDef.mode}" is not a mode this workflow knows (${knownModes(def).join(", ")})`));
-	const changes = ref === void 0 ? (yield* pendingChanges(git, stepDef.approve === true)).map((e) => ({
-		status: normalizeStatus(e.status),
-		path: e.path
-	})) : [];
-	const memory = memoryOf(outcome.trace, run);
-	const configNow = config.fingerprint;
-	if (ref === void 0) yield* warnConfigChanges(run, configNow, workspace);
+	const validate = declared?.validate !== void 0 ? {
+		kind: "command",
+		command: declared.validate
+	} : format !== void 0 ? {
+		kind: "builtin",
+		format
+	} : void 0;
 	return {
-		def,
-		workflowName: resolved.name,
-		state: step.name,
-		stepDef,
-		actor: step.actor,
-		step,
-		trace: outcome.trace,
-		run,
-		vars,
-		env,
-		config: configNow,
-		changes,
-		memory: memory.key,
-		memoryResumed: memory.resumed,
-		hints: hintsOf(stepDef),
-		cost: costTotals(run.costEntries),
-		setup
+		kind: "resolved",
+		mode,
+		...format !== void 0 ? { format } : {},
+		...declared?.format !== void 0 ? { formatCommand: declared.format } : {},
+		...validate !== void 0 ? { validate } : {},
+		capabilities: capabilitiesFor(mode, format, validate)
 	};
+};
+/** `gtd next`'s fix-retry instruction, printed ahead of the failing command's captured output. */
+const fixPromptInstruction = (file) => `Your last turn does not pass its own validation script. Fix these format violations in ${file}, then finish:`;
+/**
+* Pushes a `binaryGuard` step ahead of `command` when its own leading word
+* is unambiguous — BEFORE, not wrapped around: a guard that fails must stop
+* the script on its own `exit 127`, without touching `failurePromptWrapper`'s
+* captured-output path. Each command guards on its OWN leading word — a
+* guard naming the wrong binary is worse than none.
+*/
+const pushGuardedCommand = (steps, mode, key, command, file, onFailure) => {
+	const binary = extractLeadingBinary(command);
+	if (binary !== void 0) steps.push({
+		kind: "command",
+		command: binaryGuard(binary, mode, key)
+	});
+	steps.push({
+		kind: "command",
+		command: withFileVar(command, file),
+		...onFailure !== void 0 ? { onFailure } : {}
+	});
+};
+/**
+* `resolved`'s `format:`/`validate:` as `EmitStep[]` — format first,
+* validate last, the last one wrapped with `onFailure` when the validator is
+* a command (a built-in's own in-process parser has no shell step to wrap:
+* `gtd check`'s seeded command carries that instead). Each command gets its
+* own `binaryGuard` immediately ahead of it.
+*/
+const modeCommandSteps = (resolved, file) => {
+	const steps = [];
+	if (resolved.formatCommand !== void 0) pushGuardedCommand(steps, resolved.mode, "format", resolved.formatCommand, file, void 0);
+	if (resolved.validate?.kind === "command") pushGuardedCommand(steps, resolved.mode, "validate", resolved.validate.command, file, fixPromptInstruction(file));
+	return steps;
+};
+/** `<Host.scratchDir>/gtd-mode-sample-<mode>-<pid>.md` — an absolute literal baked in at emit time, never a shell variable. `<pid>` avoids collisions between concurrent `gtd` processes. Never a `/tmp` literal or `mktemp` (`tests/tooling/no-tmp-assumption.test.ts` scans for both). */
+const scratchSamplePath = (scratchDir, mode) => join(scratchDir, `gtd-mode-sample-${mode}-${process.pid}.md`);
+/**
+* The contradiction round-trip/skip-notice steps for `resolved`'s `mode:`.
+* No `formatCommand` means nothing to round-trip: empty. Otherwise: a live
+* built-in validator runs the round-trip against that format's own canonical
+* sample; an external validator prints a one-line skip notice instead, since
+* silence there would read as a clean bill of health; a format-only mode with
+* neither has nothing to round-trip either.
+*/
+const modeContradictionSteps = (resolved) => gen(function* () {
+	if (resolved.formatCommand === void 0) return [];
+	const { capabilities } = resolved;
+	if (capabilities.format !== void 0 && capabilities.liveValidate !== void 0) {
+		const { scratchDir } = yield* Host;
+		const samplePath = scratchSamplePath(scratchDir, resolved.mode);
+		const formatCommand = withFileVar(resolved.formatCommand, samplePath);
+		return [{
+			kind: "command",
+			command: buildModeContradictionCheck({
+				mode: resolved.mode,
+				samplePath,
+				sample: capabilities.format.sample,
+				formatCommand
+			})
+		}];
+	}
+	if (capabilities.externalValidate === true) return [{
+		kind: "command",
+		command: modeContradictionSkipNotice(resolved.mode)
+	}];
+	return [];
 });
-const currentRest = restAt(void 0);
 /**
-* Whether `gtd start <name>` can start a process here: the workflow must
-* reach a step from the tree the opening commit would capture. That step is
-* what the opening commit's subject names.
+* Renders `resolved`'s complete validate script for `file`: the mode's
+* format/validate contradiction check, a guard for a not-yet-written file,
+* then the format/validate commands themselves (format first). gtd never
+* runs this script itself — `resolveMode`+`validateScriptFor` only render
+* text for a driver to execute (`gtd renders; the driver executes`).
 */
-const startRefusal = (rest, resolved, startVars) => gen(function* () {
-	const host = yield* Host;
-	const { vars, env } = settingsFor(resolved, {}, host.env, startVars, yield* StartFlags);
-	const skills = yield* resolveScopeSkills(resolved.def, vars);
-	const access = yield* resolveScopeAccess(resolved.def, skills, vars);
-	const workspace = rest.setup.workspace;
-	const outcome = yield* promise(() => replay({
-		flow: resolved.def.flow,
-		episode: {
-			base: {
-				hash: "",
-				tree: pendingTree(workspace, rest.setup.pendingWorktree(), void 0)
-			},
-			commits: []
+const validateScriptFor = (resolved, file) => gen(function* () {
+	return { script: emitScripts([
+		...yield* modeContradictionSteps(resolved),
+		{
+			kind: "command",
+			command: fileExistsGuard(file)
 		},
-		vars,
-		env,
-		start: "",
-		budgetBytes: rest.setup.budget,
-		skills,
-		configuredSkills: resolved.def.configuredSkills,
-		access,
-		configuredAccess: resolved.def.configuredAccess
-	}));
-	if (outcome.kind === "rest") return { firstStep: outcome.rest.name };
-	if (outcome.kind === "refused") return { refusal: outcome.message };
-	const why = outcome.kind === "ended" ? "the flow reaches no step" : outcome.message;
-	return { refusal: `workflow "${resolved.name}" cannot start — ${why}` };
-});
-/** The review window's diff base at the rest. */
-const reviewBaseFor = (rest) => rest.step.request.options.base ?? rest.run.diffBase;
-const renderRest = (rest) => succeed$1({
-	state: rest.state,
-	actor: rest.actor,
-	kind: rest.stepDef.kind,
-	content: rest.stepDef.content,
-	...rest.hints,
-	...rest.memory !== void 0 ? { memory: rest.memory } : {},
-	memoryResumed: rest.memoryResumed
+		...modeCommandSteps(resolved, file)
+	]).required };
 });
+//#endregion
+//#region src/step/planStep.ts
 /**
-* Derived, restart-proof stall detection: the tree is clean, HEAD is an empty
-* attempt at this very agent rest, and another dispatch would repeat it.
+* At the human review gate an unconditional `gtd uncheck '<file>'` runs
+* ahead of the commit, resetting every checkbox before `git add -A` picks it
+* up — a tick is read-progress, never sign-off.
 */
-const stalledAt = (rest) => rest.changes.length === 0 && rest.stepDef.kind === "prompt" && rest.stepDef.allowEmpty !== true && rest.run.headTurn?.state === rest.state && rest.run.headTurn.actor === rest.actor && !rest.run.headTurn.step && rest.run.headTurn.empty;
-/** No process is underway: the default workflow's first step, first visit — a dirty tree there is a turn not yet landed, not a process. */
-const noProcessUnderway = (rest) => rest.run.workflow === void 0 && rest.state === rest.def.initial && rest.step.id.occurrence === 1;
-/** `idle` means exactly one thing: no process underway, clean tree. */
-const restIsIdle = (rest) => noProcessUnderway(rest) && rest.changes.length === 0;
-const isHumanReviewGate = (def) => def.actor === "human" && def.mode === "review";
-const approvalRefusal = (rest, approver) => {
-	if (rest.stepDef.approve !== true) return void 0;
-	const id = rest.step.id;
-	if (rest.changes.length > 0) return {
-		kind: "refusal",
-		message: `gtd land: approval-gate: ${formatStepId(id)} approves exactly the judged diff — revert your edits and run \`gtd land\` on a clean tree to approve, or run \`gtd abandon\``
+const uncheckStep = (snapshot) => snapshot.stepDef.actor === "human" && snapshot.stepDef.mode === "review" && snapshot.file !== void 0 ? [{
+	kind: "uncheck",
+	file: snapshot.file
+}] : [];
+const gitWriteOf = (landing, message) => {
+	if (landing.only !== void 0) return {
+		kind: "commitPath",
+		path: landing.only,
+		message
 	};
-	if (isNone(approver)) return {
-		kind: "refusal",
-		message: `gtd land: approval-gate: ${formatStepId(id)} records who approved it, but git has no author identity — set user.name and user.email`
+	if (landing.keepTurn !== void 0) return {
+		kind: "keepTurn",
+		ref: landing.keepTurn,
+		message
 	};
-	if (!isRecordableApproval({
-		step: id,
-		...approver.value
-	})) return {
-		kind: "refusal",
-		message: `gtd land: approval-gate: ${formatStepId(id)} cannot record ${approver.value.name} <${approver.value.email}> as approver — it would not read back unchanged from its Gtd-Approved trailer (a control character, for example)`
+	if (landing.spec.approved !== void 0) return {
+		kind: "commitClean",
+		message
+	};
+	return {
+		kind: "commitAll",
+		message
 	};
 };
-/** The landing a clean tree decides before any replay, if it decides one. */
-const cleanLanding = (rest) => {
-	if (rest.changes.length > 0) return void 0;
-	const def = rest.stepDef;
-	if (def.kind === "prompt" && def.allowEmpty !== true) return {
-		kind: "attempt",
-		subject: formatSubject(rest.actor, rest.state)
+const planStep = (snapshot, opts = {}) => {
+	const landing = snapshot.landing;
+	if (landing.kind === "refusal") return {
+		kind: "refusal",
+		message: landing.message
 	};
-	if (rest.actor === "human" && def.acceptClean !== true) return {
+	if (landing.kind === "noop") return {
 		kind: "noop",
-		settled: false
+		state: snapshot.state,
+		settled: landing.settled
+	};
+	const cost = opts.cost === void 0 ? {} : { cost: {
+		cost: opts.cost,
+		...opts.model !== void 0 ? { model: opts.model } : {}
+	} };
+	if (landing.kind === "attempt") {
+		const message = formatCommitMessage({
+			actor: snapshot.actor,
+			to: snapshot.state,
+			...cost
+		});
+		return {
+			kind: "commit",
+			state: snapshot.state,
+			to: snapshot.state,
+			subject: landing.subject,
+			steps: [{
+				kind: "gitWrite",
+				write: {
+					kind: "commitAll",
+					message
+				}
+			}, {
+				kind: "outcome",
+				outcome: {
+					kind: "commit",
+					subject: landing.subject
+				}
+			}]
+		};
+	}
+	const message = formatCommitMessage({
+		...landing.spec,
+		...cost,
+		...opts.judge !== void 0 && opts.judge.length > 0 ? { judge: opts.judge } : {}
+	});
+	const subject = message.split("\n")[0];
+	const outcome = landing.to === snapshot.state ? {
+		kind: "outcome",
+		outcome: {
+			kind: "commit",
+			subject
+		}
+	} : {
+		kind: "outcome",
+		outcome: {
+			kind: "transition",
+			from: snapshot.state,
+			to: landing.to
+		}
 	};
-};
-/** At the human review gate the pending tree lands with every tick cleared, as the landing script will. */
-const reviewGateRewrite = (def) => {
-	const reviewFormat = steeringFormatFor("review");
-	if (!isHumanReviewGate(def) || def.file === void 0 || reviewFormat === void 0) return;
 	return {
-		path: def.file,
-		apply: (content) => reviewFormat.clearTicks(content)
-	};
-};
-const multilineRefusal = (vars) => {
-	const multiline = multilineSetting(vars);
-	return multiline === void 0 ? void 0 : {
-		kind: "refusal",
-		message: `gtd: process setting "${multiline}" spans several lines — a process setting is pinned in a commit trailer and must be a single line`
+		kind: "commit",
+		state: snapshot.state,
+		to: landing.to,
+		subject,
+		steps: [
+			...uncheckStep(snapshot),
+			{
+				kind: "gitWrite",
+				write: gitWriteOf(landing, message)
+			},
+			...landing.keepHistory !== void 0 ? [{
+				kind: "gitWrite",
+				write: {
+					kind: "updateRef",
+					ref: landing.keepHistory,
+					target: "HEAD"
+				}
+			}] : [],
+			outcome
+		]
 	};
 };
-const landingTarget = (outcome, rest) => {
-	if (outcome.kind === "refused") return succeed$1({
-		kind: "refusal",
-		message: outcome.message
-	});
-	if (outcome.kind === "divergence" || outcome.kind === "failed") return fail$4(new Error(outcome.message));
-	if (outcome.kind !== "rest") return succeed$1(rest.def.initial);
-	const reserved = initialStepRefusal(rest.run.workflow, outcome.rest.name, rest.def.initial);
-	return succeed$1(reserved === void 0 ? outcome.rest.name : reserved);
-};
+//#endregion
+//#region src/step/accessRefusal.ts
 /**
-* A step commit entering the default's first step is what ends an episode, so
-* a named workflow landing there would read back as finished. Its opening
-* commit may name that step: a bare opening is never read as a boundary.
+* The landing refusal for changes outside `write`, or `undefined` when every
+* path is allowed. `null` is unrestricted. The message is the fix prompt: gtd
+* runs no fix turn of its own.
 */
-const initialStepRefusal = (workflow, step, initial) => workflow !== void 0 && step === initial ? {
+const accessRefusal = (changes, write) => {
+	if (write === null) return void 0;
+	const offending = [...new Set(changes.filter((c) => !write.some((glob) => globMatches(c.path, glob))).map((c) => c.path))];
+	if (offending.length === 0) return void 0;
+	return [
+		ACCESS_REFUSAL,
+		...offending.map((path) => `  - ${path}`),
+		`allowed: ${write.length === 0 ? "(nothing)" : write.join(", ")}`
+	].join("\n");
+};
+//#endregion
+//#region src/step/planStart.ts
+const refusal = (message) => ({
 	kind: "refusal",
-	message: `gtd: workflow "${workflow}" reaches step "${step}", the default workflow's first step — that is where a finished process waits, so a started process must never land there; rename the step`
-} : void 0;
-const closingTrailers = (branch) => ({
-	version: GTD_VERSION,
-	...isSome(branch) ? { branch: branch.value } : {}
+	message
 });
-const isSettledNoop = (rest, to) => rest.changes.length === 0 && rest.stepDef.kind === "script" && to === rest.state;
-const keptTurn = (rest) => rest.stepDef.keep === true && rest.changes.length > 0 ? { keepTurn: keptRef(rest.run.startHash, rest.state) } : {};
-const approvedTrailer = (rest, approver) => isSome(approver) ? { approved: {
-	step: rest.step.id,
-	...approver.value
-} } : {};
-const landingTo = (rest, to, branch, approver, marks) => {
-	if (isSettledNoop(rest, to)) return {
-		kind: "noop",
-		settled: true
-	};
-	const underway = !noProcessUnderway(rest);
-	const starts = !underway && to !== rest.def.initial;
-	const refused = starts ? multilineRefusal(rest.vars) : void 0;
-	if (refused !== void 0) return refused;
-	const finishes = underway && to === rest.def.initial;
+const checkOverrides = (commandLabel, varOverrides, declaredNames, envNames) => gen(function* () {
+	const environmentOnly = Object.keys(varOverrides).filter((n) => !declaredNames.includes(n) && envNames.includes(n));
+	if (environmentOnly.length > 0) return yield* fail$4(new GtdUsageError(`${commandLabel}: --var pins process settings only; ${environmentOnly.join(", ")} ${environmentOnly.length === 1 ? "is an environment setting" : "are environment settings"} — set it as a workflow option in gtd.config.ts or with a GTD_<NAME> environment variable`));
+	const undeclared = Object.keys(varOverrides).filter((n) => !declaredNames.includes(n));
+	if (undeclared.length > 0) return yield* fail$4(new GtdUsageError(`${commandLabel}: --var name(s) not declared by this workflow: ${undeclared.join(", ")} — declared: ${declaredNames.length > 0 ? declaredNames.join(", ") : "(none)"}`));
+});
+/**
+* `gtd start <name>`: start a brand NEW process on a workflow, writing an
+* opening commit that names the workflow's first step and carries a
+* `Gtd-Workflow:` trailer, every process setting as a `Gtd-Var:` trailer, plus
+* and a `Gtd-Review-Base:` trailer when the workflow fixes the process's diff base.
+* All validation is a REFUSAL, not an Effect failure.
+*/
+const planStart = (current, actor, start) => gen(function* () {
+	const { workflow, first, commandLabel, vars: varOverrides } = start;
+	const name = workflow.name;
+	if (!current.idle) return refusal(`${commandLabel}: a process is already underway (resting at "${current.state}") — finish it, or run \`gtd abandon\`, before starting another`);
+	if ("refusal" in first) return refusal(`${commandLabel}: ${first.refusal}`);
+	const { firstStep } = first;
+	yield* checkOverrides(commandLabel, varOverrides, Object.keys(workflow.vars), Object.keys(workflow.env));
+	const baseOf = workflow.def.base;
+	const flags = yield* StartFlags;
+	const hostEnv = (yield* Host).env;
+	const badFlag = ownFlagRefusal(workflow.vars, flags, hostEnv);
+	if (badFlag !== void 0) return refusal(`${commandLabel}: ${badFlag}`);
+	const vars = resolveStartVars(workflow.vars, flags, varOverrides, hostEnv);
+	const multiline = multilineSetting(vars);
+	if (multiline !== void 0) return refusal(`${commandLabel}: process setting "${multiline}" spans several lines — a process setting is pinned in a commit trailer and must be a single line`);
+	const template = yield* try_({
+		try: () => baseOf?.(name, vars),
+		catch: (e) => /* @__PURE__ */ new Error(`${commandLabel}: ${e instanceof Error ? e.message : String(e)}`)
+	});
+	const base = template === void 0 ? void 0 : yield* resolveBase(commandLabel, template);
+	if (typeof base === "object") return base;
+	const subject = formatSubject(actor, firstStep);
 	return {
-		kind: "commit",
-		to,
-		spec: {
-			actor: rest.actor,
-			from: rest.state,
-			to,
-			step: rest.step.id,
-			...marks.length > 0 && { marks },
-			...approvedTrailer(rest, approver),
-			...startTrailers(rest, starts),
-			...finishes ? closingTrailers(branch) : {}
-		},
-		...finishes ? { keepHistory: processHistoryRef(rest.run.startHash) } : {},
-		...keptTurn(rest)
+		kind: "start",
+		workflow: name,
+		subject,
+		steps: [{
+			kind: "gitWrite",
+			write: {
+				kind: "commitAll",
+				message: formatCommitMessage({
+					actor,
+					to: firstStep,
+					workflow: name,
+					...base !== void 0 ? { reviewBase: base } : {},
+					vars
+				})
+			}
+		}, {
+			kind: "outcome",
+			outcome: {
+				kind: "commit",
+				subject
+			}
+		}]
 	};
-};
-const startTrailers = (rest, starts) => starts ? {
-	vars: rest.vars,
-	config: rest.config
-} : {};
-const outcomeMarks = (outcome) => outcome.kind === "rest" || outcome.kind === "ended" ? outcome.marks : [];
+});
 /**
-* What landing the pending turn at `rest` does — a pure decision from a
-* replay with the working tree as the pending turn. The target step is
-* computed by replaying, never matched.
+* The workflow's diff base: `git merge-base <base> HEAD`, where a blank base
+* means the default branch. The merge-base is what gets pinned, so a base on
+* another branch reviews exactly this branch's own commits.
 */
-const decideLanding = (rest, verdicts, branch, approver) => gen(function* () {
-	const unapproved = approvalRefusal(rest, approver);
-	if (unapproved !== void 0) return unapproved;
-	const early = cleanLanding(rest);
-	if (early !== void 0) return early;
-	if (rest.stepDef.kind === "prompt" && rest.stepDef.access?.write != null) {
-		const message = accessRefusal(rest.changes, rest.stepDef.access.write);
-		if (message !== void 0) return {
-			kind: "refusal",
-			message
-		};
-	}
-	const outcome = yield* promise(() => replayFor(rest.setup, {
-		tree: pendingTree(rest.setup.workspace, rest.setup.pendingWorktree(), reviewGateRewrite(rest.stepDef)),
-		...verdicts !== void 0 ? { verdicts } : {}
-	}));
-	const to = yield* landingTarget(outcome, rest);
-	if (typeof to !== "string") return to;
-	return landingTo(rest, to, branch, approver, outcomeMarks(outcome));
-});
-/** Where landing the pending turn would leave the process, or `undefined` when it would land nothing. */
-const previewLanding = (rest) => decideLanding(rest, void 0, none(), none()).pipe(map((landing) => landing.kind === "commit" ? landing.to : void 0), catch_(() => succeed$1(void 0)));
-/** Every fact the pure landing planner needs, read once: the rest, its steering file, and the landing decision. */
-const snapshotFromRest = (rest, verdicts) => gen(function* () {
+const resolveBase = (commandLabel, value) => gen(function* () {
 	const git = yield* GitService;
-	const branch = yield* git.currentBranch();
-	const approver = rest.stepDef.approve === true ? yield* git.authorIdent() : none();
-	const landing = yield* decideLanding(rest, verdicts, branch, approver);
+	const rendered = value.trim();
+	const target = rendered === "" ? yield* git.defaultBranch() : rendered;
+	const resolvedBase = yield* result(git.resolveRef(target));
+	if (resolvedBase._tag === "Failure") return refusal(`${commandLabel}: "${target}" does not resolve to a commit`);
+	const mergeBase = yield* git.mergeBase(resolvedBase.success, "HEAD");
+	if (isNone(mergeBase)) return refusal(`${commandLabel}: "${target}" shares no common ancestor with HEAD`);
+	if (mergeBase.value === (yield* git.resolveRef("HEAD"))) return refusal(`${commandLabel}: nothing to review: HEAD has no commits beyond ${target}`);
+	return mergeBase.value;
+});
+//#endregion
+//#region src/step/strayPaths.ts
+/** Globs use the `access.write` dialect (`globMatches`). */
+const strayPaths = (touched, allow) => touched.filter((path) => !allow.some((glob) => globMatches(path, glob))).sort();
+//#endregion
+//#region src/edge/Edge.ts
+const EMPTY_TREE$1 = "4b825dc642cb6eb9a060e54bf8d69288fbee4904";
+const ACTORS = /* @__PURE__ */ new Set([
+	"agent",
+	"human",
+	"check",
+	"judge"
+]);
+const isOpening = ({ parsed, step }) => parsed !== void 0 && step === void 0 && parsed.from === void 0 && parsed.actor === "human";
+const boundsEpisode = (def, { parsed, pin }) => pin !== "add" && (parsed === void 0 || !ACTORS.has(parsed.actor) || parsed.to === def.initial);
+/**
+* Where the episode HEAD belongs to begins, read off subjects alone. Walking
+* back from HEAD: a bare `gtd(human): <step>` commit with no `Gtd-Step` is what
+* `gtd start` writes — no landing ever produces one — and opens an
+* episode as its first commit (its `Gtd-Workflow` trailer names the workflow;
+* a legacy `--entry` opening has none); a commit that is not a gtd step commit, or one
+* entering the flow's first step (a finished episode), bounds the episode
+* from below.
+*/
+const locateEpisode = (def, history) => {
+	for (let i = history.length - 1; i >= 0; i--) {
+		const message = parseCommitMessage(history[i].message);
+		if (isOpening(message)) return {
+			workflow: message.workflow,
+			legacyOpening: message.workflow === void 0,
+			baseIndex: i,
+			processStart: i
+		};
+		if (boundsEpisode(def, message)) return {
+			workflow: void 0,
+			legacyOpening: false,
+			baseIndex: i,
+			processStart: i + 1
+		};
+	}
 	return {
-		stepDef: rest.stepDef,
-		state: rest.state,
-		actor: rest.actor,
-		changes: rest.changes,
-		file: rest.hints.file,
-		landing
+		workflow: void 0,
+		legacyOpening: false,
+		baseIndex: -1,
+		processStart: 0
 	};
-});
-const humanCommitsOf = (trace, entryCommit) => trace.filter((entry) => entry.actor === "human" && entry.hash !== entryCommit).map((entry) => ({
-	hash: entry.hash,
-	state: entry.state
-}));
-const summaryInput = (run, settings) => {
-	const entryCommit = run.trace[0].hash;
-	const { total, byModel } = costTotals(run.costEntries);
+};
+const headTurnOf = (head) => {
+	if (head === void 0) return void 0;
+	const message = parseCommitMessage(head.message);
+	const subject = message.parsed;
+	if (subject === void 0 || !ACTORS.has(subject.actor) || message.pin !== void 0) return void 0;
 	return {
-		entryCommit,
-		processBase: run.startParentHash,
-		processTip: run.trace[run.trace.length - 1].hash,
-		humanCommits: humanCommitsOf(run.trace, entryCommit),
-		processCost: total,
-		processCostByModel: byModel,
-		marks: run.marks,
-		...settings
+		state: subject.to,
+		actor: subject.actor,
+		empty: head.touched.length === 0,
+		step: message.step !== void 0
 	};
 };
-const summaryFor = (run) => gen(function* () {
-	const config = yield* (yield* ConfigService).load;
-	const host = yield* Host;
-	const resolved = yield* workflowOf(config, run);
-	const summary = resolved.def.summary;
-	if (summary === void 0 || run.trace.length === 0) return { prompt: void 0 };
-	return { prompt: summary(summaryInput(run, settingsFor(resolved, run.pinnedVars, host.env, {}, {}))) };
-});
-/** Repository-relative paths of the config files today's config and the process's own record name; one outside the repository cannot be read at a ref, so it is left out. */
-const inRepoConfigPaths = (root, files, recorded) => {
-	const paths = new Set(Object.keys(recorded));
-	for (const file of files) paths.add(relative(root, resolve(root, file)).split(sep).join("/"));
-	return [...paths].filter((p) => p !== "" && !p.startsWith("..") && !isAbsolute(p)).sort();
-};
-const configRefusal = (command, tip, paths, reason = "A history ref replays under today's config, so it is unreadable after the config changes") => /* @__PURE__ */ new Error(`${command}: refused — config differs at ${tip.slice(0, 7)}: ${paths.join(", ")}. ${reason}`);
-const differingConfigPaths = (git, workspace, root, config, run, hash) => gen(function* () {
-	const differing = [];
-	for (const path of inRepoConfigPaths(root, Object.keys(config.fingerprint), run.pinnedConfig?.files ?? {})) if ((yield* orElseSucceed(git.readFileAtRef(hash, path), () => void 0)) !== workspace.readSync(path)) differing.push(path);
-	return differing;
+const traceEntryOf = (hash, message) => ({
+	state: message.parsed?.to ?? "",
+	hash,
+	actor: message.parsed?.actor ?? ""
 });
-const notClosedError = (hash, outcome) => outcome.kind === "rest" ? /* @__PURE__ */ new Error(`gtd history: ${hash.slice(0, 7)} does not close a process under today's config`) : replayError(outcome) ?? /* @__PURE__ */ new Error("gtd history: replay failed");
-const historySteps = (run) => {
-	const messages = new Map(run.episode.commits.map((c) => [c.hash, c.message]));
-	return run.trace.map((entry) => {
-		const message = parseCommitMessage(messages.get(entry.hash) ?? "");
-		return {
-			hash: entry.hash,
-			subject: (messages.get(entry.hash) ?? "").split("\n")[0] ?? "",
-			actor: entry.actor,
-			from: message.parsed?.from,
-			to: entry.state,
-			verdicts: message.judge,
-			...optional("approval", approvalEntryOf(entry.hash, message)[0])
-		};
-	});
+const costEntriesOf = (hash, message) => message.cost.map((c) => ({
+	cost: c.cost,
+	model: c.model ?? "unspecified",
+	hash
+}));
+const hashAt = (history, index) => history[index]?.hash;
+const historyFormatFault = (history, location) => formatFault(history.slice(location.baseIndex + 1).concat(history[location.baseIndex]?.message.startsWith("gtd") ? [history[location.baseIndex]] : []).map((c) => ({
+	hash: c.hash,
+	format: parseCommitMessage(c.message).format
+})));
+/** Fails on a history in a format this gtd does not read, before anything acts on it. */
+const runOf = (history, location, closingHash = void 0) => {
+	const fault = historyFormatFault(history, location);
+	return fault === void 0 ? succeed$1(buildRun(history, location, closingHash)) : fail$4(new Error(fault));
 };
-const versionWarningFor = (recorded) => recorded === GTD_VERSION ? void 0 : `gtd: warning: this history was recorded by ${recorded === void 0 ? "an unknown gtd version" : `gtd ${recorded}`} and is replayed by gtd ${GTD_VERSION} — the engine the workflow runs on may have changed since`;
-/**
-* Replays the closed run at `tip` under today's config. The workflow is not
-* fingerprinted for a version change: the engine under it moves with every
-* upgrade, and the version warning is the only signal.
-*/
-const historyTrail = (tip) => gen(function* () {
-	const git = yield* GitService;
-	const config = yield* (yield* ConfigService).load;
-	const hash = yield* git.resolveRef(tip);
-	const subject = yield* git.lastCommitSubject(hash);
-	const run = yield* runAtTip(git, config.workflow, {
-		hash,
-		subject
-	});
-	const { outcome, recorded, versionWarning } = yield* replayFinishedProcess(config, run, hash, {
-		command: "gtd history",
-		notEnded: (o) => notClosedError(hash, o)
-	});
-	return {
-		tip: hash,
-		steps: historySteps(run),
-		ended: outcome.via,
-		version: {
-			recorded,
-			running: GTD_VERSION
-		},
-		...versionWarning !== void 0 ? { versionWarning } : {}
-	};
-});
-/** Refuses on config drift before replaying, so a stale config never runs the flow. */
-const replayFinishedProcess = (config, run, hash, how) => gen(function* () {
-	const git = yield* GitService;
-	const workspace = yield* Workspace;
-	const host = yield* Host;
-	const recorded = parseCommitMessage(run.episode.commits.find((c) => c.hash === hash)?.message ?? "").version;
-	const versionWarning = versionWarningFor(recorded);
-	const withWarning = (err) => versionWarning === void 0 ? err : /* @__PURE__ */ new Error(`${err.message}\n${versionWarning}`);
-	const differing = yield* differingConfigPaths(git, workspace, host.root, config, run, hash);
-	if (differing.length > 0) return yield* fail$4(withWarning(configRefusal(how.command, hash, differing, how.configReason)));
-	const { setup } = yield* setupFor(config, run, workspace, host);
-	const outcome = yield* promise(() => replayFor(setup));
-	if (outcome.kind !== "ended") return yield* fail$4(withWarning(how.notEnded(outcome)));
+const approvalEntryOf = (hash, message) => message.approved === void 0 ? [] : [{
+	step: formatStepId(message.approved.step),
+	name: message.approved.name,
+	email: message.approved.email,
+	commit: hash
+}];
+const buildRun = (history, location, closingHash) => {
+	const allProcessCommits = history.slice(location.processStart);
+	const allParsed = allProcessCommits.map((c) => parseCommitMessage(c.message));
+	const processCommits = allProcessCommits.filter((_, i) => allParsed[i].pin !== "add");
+	const parsed = allParsed.filter((m) => m.pin !== "add");
+	const first = parsed[0];
+	const startParentHash = hashAt(history, location.processStart - 1) ?? EMPTY_TREE$1;
+	const head = history[history.length - 1];
 	return {
-		outcome,
-		recorded,
-		...versionWarning !== void 0 ? { versionWarning } : {}
+		workflow: location.workflow,
+		legacyOpening: location.legacyOpening,
+		startHash: hashAt(history, location.processStart) ?? head?.hash ?? EMPTY_TREE$1,
+		startParentHash,
+		diffBase: first?.reviewBase ?? startParentHash,
+		trace: processCommits.map((c, i) => traceEntryOf(c.hash, parsed[i])),
+		costEntries: parsed.flatMap((m, i) => costEntriesOf(processCommits[i].hash, m)),
+		judgeVerdicts: parsed.flatMap((m) => m.judge),
+		pinCommitted: allParsed.some((m) => m.pin === "add"),
+		marks: parsed.flatMap((m) => m.marks),
+		approvals: processCommits.flatMap((c, i) => approvalEntryOf(c.hash, parsed[i])),
+		pinnedVars: { ...first?.vars },
+		headTurn: headTurnOf(head),
+		closingHash,
+		episode: {
+			base: hashAt(history, location.baseIndex),
+			commits: history.slice(location.baseIndex + 1)
+		}
 	};
-});
-//#endregion
-//#region src/emit/GitScript.ts
-const shellQuote = (value) => `'${value.replace(/'/g, "'\\''")}'`;
-/**
-* `--allow-empty` because gtd's workflow commits may be empty on purpose.
-* Mirrors `Git.ts`'s retry: only re-tries without hooks on the specific
-* "empty git commit" rejection message, discriminated from the captured
-* output rather than the exit code, so a genuinely rejected commit (a lint
-* error, a commit-msg hook) still fails.
-*/
-const commitAllowEmpty = (message) => {
-	const m = shellQuote(message);
-	return [
-		`if ! out=$(git commit --allow-empty -m ${m} 2>&1); then`,
-		`  case "$out" in`,
-		`    *"empty git commit"*) git commit --allow-empty --no-verify -m ${m} || exit 1 ;;`,
-		`    *) printf '%s\\n' "$out" >&2; exit 1 ;;`,
-		`  esac`,
-		`fi`
-	].join("\n");
 };
-const CHANGED_SINCE_LAND = "gtd: the working tree changed since `gtd land` — revert the edits and run `gtd land` again to approve";
-/** `git add -A || exit 1` (an `&&` left side would not abort under `set -e`) then `commitAllowEmpty`. */
-const commitAll = (message) => `git add -A || exit 1\n${commitAllowEmpty(message)}`;
-/**
-* An approval records exactly the judged tree: HEAD is pinned before the
-* clean check and the commit is built over its tree with `commit-tree`, so no
-* hook runs and none can add to it. A HEAD that moved fails the guarded
-* `update-ref`. `commit-tree` ignores `commit.gpgSign`, so it is read here.
-*/
-const commitClean = (message) => [
-	`gtd_head=$(git rev-parse --verify HEAD) || exit 1`,
-	`if [ -n "$(git status --porcelain --untracked-files=all --ignore-submodules=none)" ]; then`,
-	`  printf '%s\\n' ${shellQuote(CHANGED_SINCE_LAND)} >&2`,
-	`  exit 1`,
-	`fi`,
-	`gtd_sign_cfg=$(git config --type=bool --default=false commit.gpgSign) || exit 1`,
-	`if [ "$gtd_sign_cfg" = true ]; then gtd_sign=-S; else gtd_sign=--no-gpg-sign; fi`,
-	`gtd_tip=$(git commit-tree "$gtd_sign" "$gtd_head^{tree}" -p "$gtd_head" -m ${shellQuote(message)}) || exit 1`,
-	`git update-ref -m ${shellQuote(`commit: ${message}`)} HEAD "$gtd_tip" "$gtd_head" || exit 1`
-].join("\n");
-/** No current caller — see `Git.ts`'s `GitWriterOperations.commitAsIs` for why it's kept anyway. */
-const commitAsIs = (message) => commitAllowEmpty(message);
-/** No current caller — see `Git.ts`'s `GitWriterOperations.softResetTo` for why it's kept anyway. */
-const softResetTo = (ref) => `git reset --soft ${shellQuote(ref)}`;
-const mixedResetTo = (ref) => `git reset --mixed ${shellQuote(ref)}`;
-const hardResetTo = (ref) => `git reset --hard ${shellQuote(ref)}`;
-/**
-* `git add -A` then `git reset --hard HEAD` — discards every pending change,
-* tracked or untracked. Joined with `&&`: a failed stage must not reach the
-* hard reset, or untracked survivors remain — the exact outcome this builder
-* exists to avoid. No current caller — see `Git.ts`'s
-* `GitWriterOperations.discardPending` for why it's kept anyway.
-*/
-const discardPending = () => `git add -A && git reset --hard HEAD`;
+const PAGE_TIERS = [
+	32,
+	128,
+	512,
+	Infinity
+];
 /**
-* POSIX sh (runs under dash). The marker is a `commit-tree` over HEAD's own
-* tree, so no hook runs on it and its tree is the pre-turn tree by
-* construction; `commit-tree` ignores `commit.gpgSign`, hence the explicit
-* `-S`, read (and failing closed) before any object or ref is written; the
-* index is already staged by then, so an early exit leaves the turn staged.
-* The kept ref is deleted only after `reset -q` succeeds: it is then the
-* turn's only handle.
-* The branch moves before the final hard reset, so if that reset fails the
-* marker has landed and the turn is still in the working tree (kept ref
-* present); every other failure leaves the branch untouched.
-*/
-const keepTurn = (refPrefix, message) => {
-	const keptRef = `${shellQuote(`${refPrefix}/`)}"$gtd_kept"`;
-	return [
-		`git add -A || exit 1`,
-		`gtd_sign_cfg=$(git config --type=bool --default=false commit.gpgSign) || exit 1`,
-		`if [ "$gtd_sign_cfg" = true ]; then gtd_sign=-S; else gtd_sign=--no-gpg-sign; fi`,
-		`gtd_head=$(git rev-parse --verify HEAD) || exit 1`,
-		`gtd_tree=$(git write-tree) || exit 1`,
-		`gtd_kept=$(git commit-tree "$gtd_tree" -p "$gtd_head" -m ${shellQuote(message)}) || exit 1`,
-		`git update-ref ${keptRef} "$gtd_kept" || exit 1`,
-		`gtd_marker=$(printf '%s\\nGtd-Kept: %s' ${shellQuote(message)} "$gtd_kept")`,
-		`if ! gtd_tip=$(git commit-tree "$gtd_sign" "$gtd_head^{tree}" -p "$gtd_head" -m "$gtd_marker") || ! git update-ref -m ${shellQuote(`commit: ${message}`)} HEAD "$gtd_tip" "$gtd_head"; then`,
-		`  git reset -q && git update-ref -d ${keptRef}`,
-		`  exit 1`,
-		`fi`,
-		`git reset --hard HEAD`
-	].join("\n");
+* `locateEpisode`'s own boundary test, subject-only: a commit that isn't a
+* gtd step commit, or one landing the flow's initial state, bounds an
+* episode from below — EXCEPT a bare `gtd(human): <x>` subject (no `→`),
+* which is NEVER a boundary here, whatever `<x>` is. That bare shape is
+* `locateEpisode`'s own `opening` branch (a started episode's first commit),
+* which takes priority there over the initial-state check no matter what the
+* workflow's first step is named — including one named after `def.initial`
+* itself, where the two branches would otherwise disagree. A bare human commit can
+* also be a self-loop step landing rather than a real opening (this
+* subject-only pass can't read the `Gtd-Step` trailer that would tell them
+* apart), so ruling it out here can only make `findBoundaryBase` walk a FEW
+* commits further back than strictly needed — never stop short of the
+* boundary `locateEpisode` would find once it has full commit bodies in
+* hand. That asymmetry is the only direction this approximation may err in;
+* it must never call a real boundary "not yet found".
+*/
+const subjectIsBoundary = (def, subject) => {
+	const parsed = parseCommitMessage(subject).parsed;
+	if (parsed === void 0 || !ACTORS.has(parsed.actor)) return true;
+	if (parsed.actor === "human" && parsed.from === void 0) return false;
+	if (parsed.actor === "check" && parsed.from === PIN_STATES.add) return false;
+	return parsed.to === def.initial;
+};
+/** The last page index (walking newest→oldest, same direction as `locateEpisode`) whose subject is a boundary, or `undefined` if none in `page`. */
+const boundaryIndexIn = (def, page) => {
+	for (let i = page.length - 1; i >= 0; i--) if (subjectIsBoundary(def, page[i].subject)) return i;
 };
-const updateRef = (ref, hash) => `git update-ref ${shellQuote(ref)} ${shellQuote(hash)}`;
-/** `git update-ref -d <ref>` — idempotent: deleting a missing ref is already a no-op in real git. */
-const deleteRef = (ref) => `git update-ref -d ${shellQuote(ref)}`;
 /**
-* No `+` on the refspec: a local ref the remote's tip does not descend from
-* fails the fetch instead of being overwritten (a fast-forward still applies).
+* `findBoundaryBase`'s result: `base` is the hash to pass `commitHistory` so
+* a `git.commitHistory(base, head)` call reads exactly the episode ending at
+* `head`, plus whatever a subject-only read couldn't rule out — never the
+* whole repository. `base` is deliberately the boundary commit's PARENT, not
+* the boundary commit itself: `commitHistory`'s range excludes `base`, and
+* `runOf` needs the boundary commit present in the read history
+* (`episode.base`, `startParentHash`). `base: undefined` means "read from the
+* repository root" — an empty repository, an unresolvable `head`, or an
+* episode that reaches the root commit, none of which cost anything extra
+* since that IS the whole history in those cases.
+*
+* `head` is the CONCRETE hash the literal `head` argument resolved to on this
+* call's first read — `undefined` only when it never resolved (an empty
+* repository, or an unresolvable ref). The caller must hand this hash, not
+* the original `head` argument, to its own `commitHistory` call: resolving a
+* symbolic ref (literal `HEAD`, most callers' default) a second time risks
+* reading a DIFFERENT commit than this function paged through, if something
+* moves HEAD in between — pinning both reads to one resolved hash is what
+* keeps the two-read split from disagreeing with itself.
 */
-const fetchHistoryRefs = (remote) => [
-	`set -eu`,
-	`before=$(git for-each-ref --format='x' 'refs/gtd/history/' | wc -l)`,
-	`git fetch ${shellQuote(remote)} 'refs/gtd/history/*:refs/gtd/history/*'`,
-	`after=$(git for-each-ref --format='x' 'refs/gtd/history/' | wc -l)`,
-	`printf '%s history refs arrived\\n' "$((after - before))"`
-].join("\n");
-/** Marks an emitted block as print-only — mirrors `OutcomeScript.ts`'s `OUTCOME_MARKER` verbatim, so `src/twins/EmittedScriptRecognizer.ts` recognizes either path's output identically. */
-const OUTCOME_MARKER$1 = "# gtd: outcome (print-only)";
-const printfLine$1 = (fmt, args) => `${OUTCOME_MARKER$1}\nprintf ${shellQuote(fmt.replace(/\n/g, "\\n"))} ${args.join(" ")}`;
-const renderOutcome = (outcome) => {
-	switch (outcome.kind) {
-		case "transition": return printfLine$1("%s %s → %s\n", [
-			"'->'",
-			shellQuote(outcome.from),
-			shellQuote(outcome.to)
-		]);
-		case "commit": return printfLine$1("%s %s\n", ["'[commit]'", shellQuote(outcome.subject)]);
-		case "note": return printfLine$1("%s\n", [shellQuote(outcome.text)]);
+const findBoundaryBase = (git, def, head) => gen(function* () {
+	let pinnedHead = head;
+	for (const pageSize of PAGE_TIERS) {
+		const page = yield* git.subjectHistory(pageSize, 0, pinnedHead);
+		if (pinnedHead === void 0) pinnedHead = page[page.length - 1]?.hash;
+		const wholeHistory = !Number.isFinite(pageSize) || page.length < pageSize;
+		const boundaryIdx = boundaryIndexIn(def, page);
+		if (boundaryIdx === void 0 || boundaryIdx === 0) {
+			if (wholeHistory) return {
+				base: void 0,
+				head: pinnedHead
+			};
+			continue;
+		}
+		return {
+			base: page[boundaryIdx - 1].hash,
+			head: pinnedHead
+		};
 	}
-};
-const renderGitWrite = (write) => {
-	switch (write.kind) {
-		case "commitAll": return commitAll(write.message);
-		case "commitClean": return commitClean(write.message);
-		case "updateRef": return updateRef(write.ref, write.target);
-		case "keepTurn": return keepTurn(write.ref, write.message);
+	return {
+		base: void 0,
+		head: pinnedHead
+	};
+});
+const historyUpTo = (git, def, head) => flatMap(findBoundaryBase(git, def, head), ({ base, head: resolvedHead }) => git.commitHistory(base, resolvedHead));
+const computeProcessRun = (git, def, head) => flatMap(historyUpTo(git, def, head), (history) => runOf(history, locateEpisode(def, history)));
+/** The run alone, never replaying — `gtd abandon` must work even when replay would refuse, short of a history it cannot read. */
+const currentRun = gen(function* () {
+	const git = yield* GitService;
+	const config = yield* (yield* ConfigService).load;
+	return yield* computeProcessRun(git, config.workflow);
+});
+const runAtTip = (git, def, tip) => gen(function* () {
+	if (tip === void 0) {
+		const history = yield* historyUpTo(git, def, void 0);
+		return yield* runOf(history, locateEpisode(def, history));
+	}
+	if (!(parseCommitMessage(tip.subject).parsed?.to === def.initial)) {
+		const history = yield* historyUpTo(git, def, tip.hash);
+		return yield* runOf(history, locateEpisode(def, history));
 	}
+	const parentRef = `${tip.hash}~1`;
+	const before = yield* historyUpTo(git, def, parentRef);
+	const location = locateEpisode(def, before);
+	let closing = yield* git.commitHistory(parentRef, tip.hash);
+	if (closing.length === 0) closing = yield* git.commitHistory(void 0, tip.hash);
+	return yield* runOf([...before, ...closing], { ...location }, tip.hash);
+});
+const runAtHead = (git, def) => gen(function* () {
+	return yield* runAtTip(git, def, (yield* git.subjectHistory(1, 0))[0]);
+});
+/** The process HEAD closes or sits inside — `gtd summary`'s run. */
+const summaryRun = gen(function* () {
+	const git = yield* GitService;
+	const def = (yield* (yield* ConfigService).load).workflow;
+	return yield* runAtHead(git, def);
+});
+const commitTree = (workspace, hash) => {
+	let entries;
+	const list = () => entries ??= workspace.treeSync(hash);
+	let sortedPaths;
+	const contents = /* @__PURE__ */ new Map();
+	return {
+		paths: () => sortedPaths ??= [...list().keys()].sort(),
+		read: (path) => {
+			if (!list().has(path)) return void 0;
+			if (!contents.has(path)) contents.set(path, workspace.readCommittedSync(path, hash));
+			return contents.get(path);
+		},
+		id: (path) => list().get(path)
+	};
 };
 /**
-* Wraps `command` so a non-zero exit prints `prompt` plus the command's
-* captured output before propagating that exit code — mirrors `Emit.ts`'s
-* `failurePromptWrapper` (same reverse-import concern as `renderOutcome`
-* above: `Emit.ts` imports `shellQuote` from here already).
+* The tree a landing would commit: the working tree, with any rewrite the
+* landing script applies first. `entries` is `setup.pendingWorktree()` —
+* already memoized — never a fresh `workspace.worktreeSync()` call; see that
+* field's own comment for why the memo lives there and not on `Workspace`.
 */
-const failurePromptWrapper$1 = (command, prompt) => {
-	return [
-		`gtd_validate_status=0`,
-		`gtd_validate_out="$( {`,
-		command,
-		`} 2>&1 )" || gtd_validate_status=$?`,
-		`if [ "$gtd_validate_status" -ne 0 ]; then`,
-		`  printf '%s\\n\\n%s\\n' ${shellQuote(prompt)} "$gtd_validate_out"`,
-		`  exit "$gtd_validate_status"`,
-		`fi`
-	].join("\n");
-};
-const renderLandStep = (step) => {
-	if (step.kind === "gitWrite") return renderGitWrite(step.write);
-	if (step.kind === "outcome") return renderOutcome(step.outcome);
-	if (step.kind === "uncheck") return `gtd uncheck ${shellQuote(step.file)}`;
-	return step.onFailure !== void 0 ? failurePromptWrapper$1(step.command, step.onFailure) : step.command;
+const pendingTree = (workspace, entries, rewrite) => {
+	const paths = [...entries.keys()];
+	const readWorktree = (path) => {
+		try {
+			return workspace.readSync(path);
+		} catch {
+			return;
+		}
+	};
+	return {
+		paths: () => paths,
+		read: (path) => {
+			if (!entries.has(path)) return void 0;
+			const content = readWorktree(path);
+			return content === void 0 || rewrite?.path !== path ? content : rewrite.apply(content);
+		},
+		id: (path) => rewrite?.path === path ? void 0 : entries.get(path)
+	};
 };
-const ScriptSurface = { render: (steps) => {
-	const rendered = steps.map(renderLandStep);
-	return rendered.length === 0 ? "" : ["set -eu", ...rendered].join("\n\n");
-} };
-//#endregion
-//#region src/emit/Emit.ts
-/** Exits 0 when the declared steering file is absent — nothing to format or validate yet. An OR list, not `if`: its left side failing never trips `set -e`. */
-const fileExistsGuard = (file) => `[ -f ${shellQuote(file)} ] || exit 0`;
-/** A mode or `ui.format` command finds the file it works on in `$GTD_FILE`. */
-const withFileVar = (command, file) => `export GTD_FILE=${shellQuote(file)}\n${command}`;
-const SIMPLE_LEADING_WORD_RE = /^[A-Za-z0-9_./-]+(?=[ \t]|$)/;
-const SHELL_METACHARACTER_RE = /[|&;$<>(){}`]/;
-const FILE_VAR_RE = /"\$GTD_FILE"|"\$\{GTD_FILE\}"|\$GTD_FILE\b|\$\{GTD_FILE\}/g;
-/** `command` with `file` written in for `$GTD_FILE` — one line an agent can copy, equivalent to running it under `withFileVar`. */
-const commandForFile = (command, file) => command.replace(FILE_VAR_RE, shellQuote(file));
 /**
-* The leading word of a rendered `format:`/`validate:` command, when the
-* command has exactly one unambiguous binary to probe — `undefined` for
-* anything a shell metacharacter could hide a second command behind. A missing
-* guard degrades to a raw exit; a wrong guard would refuse a working command.
+* The one resolver of both setting kinds. Process settings: the recorded
+* (pinned) value wins per name, anything unrecorded resolves live — the
+* fallback for a process started before pinning existed. Environment settings
+* are always live. `startOverrides` are `--var` values, passed only while a
+* process is being started.
 */
-const extractLeadingBinary = (command) => {
-	if (command.includes("\n")) return void 0;
-	if (SHELL_METACHARACTER_RE.test(command.replace(FILE_VAR_RE, ""))) return void 0;
-	const match = SIMPLE_LEADING_WORD_RE.exec(command);
-	return match === null ? void 0 : match[0];
+const settingsFor = (workflow, pinnedVars, hostEnv, startOverrides = {}, startFlags) => ({
+	vars: {
+		...resolveStartVars(workflow.vars, startFlags, startOverrides, hostEnv),
+		...pinnedVars
+	},
+	env: resolveVars(workflow.env, {}, hostEnv)
+});
+/** The workflow a run replays on: its pinned one, else the default. */
+const workflowOf = (config, run) => {
+	if (run.legacyOpening) return fail$4(/* @__PURE__ */ new Error("gtd: this process was opened by `gtd --entry`, which no longer exists — run `gtd abandon` to start over"));
+	if (run.workflow === void 0) return succeed$1(config.defaultWorkflow);
+	const named = config.workflowNamed(run.workflow);
+	if (named !== void 0) return succeed$1(named);
+	return fail$4(/* @__PURE__ */ new Error(`gtd: this process runs workflow "${run.workflow}", which gtd.config.ts no longer defines — run \`gtd abandon\` to start over`));
 };
 /**
-* Names a typo'd or uninstalled binary and the `$PATH` it was looked up on.
-* `$PATH` is a shell word the DRIVER's shell expands at run time, so gtd never
-* resolves it in-process. Exits 127, matching bash's "command not found".
+* `judgeBudgetBytes` is the one var that refuses rather than disabling its
+* mechanism when blanked: without a bound the judge payload is rejected
+* anyway. Absent falls back to a conservative default.
 */
-const binaryGuard = (binary, mode, key) => {
-	const messageQ = shellQuote(`gtd: mode "${mode}": "${key}" command not found: ${binary}`);
-	return [
-		`command -v ${shellQuote(binary)} >/dev/null 2>&1 || {`,
-		`  printf '%s\\n%s\\n' ${messageQ} '$PATH: '"$PATH"`,
-		`  exit 127`,
-		`}`
-	].join("\n");
+const DEFAULT_JUDGE_BUDGET_BYTES = 32768;
+const judgeBudgetBytes = (vars) => {
+	const raw = vars.judgeBudgetBytes;
+	if (raw === void 0) return DEFAULT_JUDGE_BUDGET_BYTES;
+	const n = Number(raw);
+	if (raw.trim() === "" || !Number.isInteger(n) || n <= 0) throw new Error(`"judgeBudgetBytes" must be a positive integer — got ${JSON.stringify(raw)} (blanking this var disables the payload bound rather than the mechanism it guards, so it is refused rather than defaulted)`);
+	return n;
+};
+const replayFor = (setup, pending) => replay({
+	flow: setup.def.flow,
+	episode: {
+		base: setup.base,
+		commits: setup.episode
+	},
+	vars: setup.vars,
+	env: setup.env,
+	start: setup.run.diffBase,
+	startTree: setup.run.diffBase === EMPTY_TREE$1 ? treeFromRecord({}) : commitTree(setup.workspace, setup.run.diffBase),
+	budgetBytes: setup.budget,
+	skills: setup.skills,
+	configuredSkills: setup.def.configuredSkills,
+	access: setup.access,
+	configuredAccess: setup.def.configuredAccess,
+	...pending !== void 0 ? { pending } : {}
+});
+const replayError = (outcome) => {
+	if (outcome.kind === "divergence" || outcome.kind === "failed") return new Error(outcome.message);
+	if (outcome.kind === "refused") return /* @__PURE__ */ new Error(`gtd: ${outcome.message}`);
+	if (outcome.kind === "ended") return /* @__PURE__ */ new Error("gtd: history ends the episode, but HEAD does not enter the default workflow's first step — the workflow changed under this process; run `gtd abandon` to start over");
 };
+const judgeDocument = (step) => step.request.kind === "judge" ? judgeJson(step.request.evidence, step.request.questions) : void 0;
 /**
-* Prints `prompt` plus the captured output on a non-zero exit, then propagates
-* it. The `{ … }` group inlines a multi-line `command` verbatim; the
-* assignment sits left of `||` so `set -e` never trips on the failure itself.
+* The fixed sentence appended to a judge gate's message when a bounded read
+* dropped bytes to fit `judgeBudgetBytes` — a constant, so no workflow can
+* reword or drop it.
 */
-const failurePromptWrapper = (command, prompt) => {
-	return [
-		`gtd_validate_status=0`,
-		`gtd_validate_out="$( {`,
-		command,
-		`} 2>&1 )" || gtd_validate_status=$?`,
-		`if [ "$gtd_validate_status" -ne 0 ]; then`,
-		`  printf '%s\\n\\n%s\\n' ${shellQuote(prompt)} "$gtd_validate_out"`,
-		`  exit "$gtd_validate_status"`,
-		`fi`
-	].join("\n");
+const TRUNCATION_NOTICE = "Note: some evidence above was truncated to fit the judge's payload budget.";
+const DEFAULT_JUDGE_MESSAGE = "A judgment is pending. Run `gtd judge answer` and pipe a verdict, or land to take the conservative default with no verdict recorded.";
+const optional = (key, value) => value === void 0 ? {} : { [key]: value };
+const commonOf = (step) => {
+	const options = step.request.options;
+	return {
+		actor: step.actor,
+		...optional("label", options.label),
+		...optional("file", options.file),
+		...optional("mode", options.mode)
+	};
 };
-const renderStep = (step) => {
-	if (step.kind === "command" && step.onFailure !== void 0) return failurePromptWrapper(step.command, step.onFailure);
-	return step.command;
+const promptDef = (common, request, skills, access) => ({
+	...common,
+	kind: "prompt",
+	content: request.prompt,
+	...optional("model", request.options.model),
+	...optional("system", request.options.system),
+	...optional("allowEmpty", request.options.allowEmpty),
+	...optional("keep", request.options.keep),
+	...optional("skills", skills),
+	...optional("access", access)
+});
+const scriptDef = (common, request) => ({
+	...common,
+	kind: "script",
+	content: request.body
+});
+const judgeDef = (common, request, step) => {
+	const message = request.options.message ?? DEFAULT_JUDGE_MESSAGE;
+	return {
+		...common,
+		kind: "message",
+		content: step.truncated ? `${message}\n\n${TRUNCATION_NOTICE}` : message,
+		...optional("judge", judgeDocument(step))
+	};
 };
-const assembleScript = (steps) => steps.length === 0 ? "" : ["set -eu", ...steps.map(renderStep)].join("\n\n");
-/** Build both halves from already-rendered command strings; an empty (or omitted) array produces the empty-string result, so a driver checking `if [ -n "$required" ]` never has to special-case a bare preamble. */
-const emitScripts = (required = [], optional = []) => ({
-	required: assembleScript(required),
-	optional: assembleScript(optional)
+const messageDef = (common, request, step) => ({
+	...common,
+	kind: "message",
+	content: request.options.message ?? request.options.label ?? step.name,
+	...optional("acceptClean", request.options.approve === true || request.options.acceptClean),
+	...optional("approve", request.options.approve)
 });
-/** Exported so `src/twins/EmittedScriptRecognizer.ts` can recognize these by exact string comparison. `printf`, not `echo`, avoids shell-specific backslash-escape quirks. */
-const DID_NOT_RUN_COMMENT = "# gtd emitted this and did NOT run it — run it with `sh` to apply it";
-const PRESENTATION_ONLY_COMMENT = "# presentation only — safe to skip";
-const PRESENTATION_FAILURE_WARNING = "printf 'gtd: presentation-only follow-up failed — continuing\\n' >&2";
-/**
-* A write command's single pasteable script (`gtd abandon | sh`,
-* `gtd land --json=script`'s own field). `optional`, when non-empty, is
-* wrapped in a subshell whose failure is swallowed — presentation-only, so it
-* must never turn a landed turn into a non-zero exit.
-*/
-const combinedScript = (required, optional) => {
-	if (required.length === 0) return "";
-	if (optional.length === 0) return `${DID_NOT_RUN_COMMENT}\n\n${required}`;
-	return [
-		DID_NOT_RUN_COMMENT,
-		"",
-		required,
-		"",
-		PRESENTATION_ONLY_COMMENT,
-		`(\n${optional}\n) || ${PRESENTATION_FAILURE_WARNING}`
-	].join("\n");
+const stepDefOf = (step) => {
+	const request = step.request;
+	const common = commonOf(step);
+	switch (request.kind) {
+		case "agent": return promptDef(common, request, step.skills, step.access);
+		case "run": return scriptDef(common, request);
+		case "judge": return judgeDef(common, request, step);
+		case "human": return messageDef(common, request, step);
+	}
 };
-//#endregion
-//#region src/emit/OutcomeScript.ts
-/**
-* A `printf '<fmt>' <args...>` bash statement — `args` are already-valid bash
-* tokens (a `shellQuote`d literal, a `"$(git …)"` substitution), never
-* re-quoted here: a value reaches the script as a printf ARGUMENT, never
-* interpolated into the format itself, so a subject or state name containing
-* `%` can never be read as a conversion spec. Markers like `->` are arguments
-* too, keeping every format string free of a leading `-` that a shell's
-* `printf` could mistake for an option. A real newline in `fmt` is emitted as
-* the two-character `\n` escape `printf` itself expands, keeping every emitted
-* statement on one line.
-*/
-const printfLine = (fmt, args) => `${OUTCOME_MARKER}\nprintf ${shellQuote(fmt.replace(/\n/g, "\\n"))} ${args.join(" ")}`;
+const ROOT_MEMORY_SCOPE_NAME = "root";
 /**
-* Marks an emitted block as print-only. Load-bearing beyond documentation:
-* `src/twins/EmittedScriptRecognizer.ts` recognizes an outcome block by
-* this line, and a bare `printf` would be ambiguous with a workflow
-* `script:` command that happens to start the same way.
+* An agent rest's memory key, `<scope>#<hash7>`: the hash is the commit the
+* current unbroken run into the scope started FROM, so the same run always
+* re-derives the same key. `resumed` is whether an agent turn in that run
+* already landed.
 */
-const OUTCOME_MARKER = "# gtd: outcome (print-only)";
-const FMT_ABANDON_NOOP = "no gtd process is underway (resting at \"%s\") — nothing to abandon\n";
-const FMT_ABANDONED = "abandoned the process resting at \"%s\" — HEAD is back at %s (\"%s\"), resting at \"%s\".\nEverything the process produced is kept as uncommitted changes (`git status`); discard them with `git checkout -- . && git clean -fd .gtd` for a clean tree.\n";
-const FMT_RESTORED = "restored the retained history — HEAD is back at %s (\"%s\"), resting at \"%s\". Resume with the loop, or `git reset` to any earlier turn to restart from there.\n";
-/** `no gtd process is underway (resting at "<initial>") — nothing to abandon` — `gtd abandon`'s no-op plain-text line. */
-const abandonNoopText = (initial) => renderFormat(FMT_ABANDON_NOOP, initial);
-/** One already-rendered plain line. */
-const noteOutcome = (text) => printfLine("%s\n", [shellQuote(text)]);
+const memoryOf = (trace, run) => {
+	const rest = trace[trace.length - 1];
+	if (rest === void 0 || rest.kind !== "agent") return {
+		key: void 0,
+		resumed: false
+	};
+	const start = scopeRunStart(trace, rest.memoryScope);
+	const token = start <= 0 ? run.startParentHash : trace[start - 1].enteredAt;
+	const resumed = trace.slice(Math.max(start, 0), trace.length - 1).some((s) => s.kind === "agent" && s.memoryScope === rest.memoryScope);
+	return {
+		key: `${rest.memoryScope || ROOT_MEMORY_SCOPE_NAME}#${token.slice(0, 7)}`,
+		resumed
+	};
+};
+const hintsOf = (def) => ({
+	...optional("model", def.model),
+	...optional("label", def.label),
+	...optional("file", def.file),
+	...optional("judge", def.judge),
+	...optional("system", def.system),
+	...optional("mode", def.mode),
+	...optional("skills", def.skills),
+	...optional("access", def.access)
+});
+const normalizeStatus = (raw) => raw === "A" ? "A" : raw === "D" ? "D" : "M";
+/** Per-model token totals, highest-cost first (ties broken by model name). */
+const costByModel = (entries) => {
+	const byModel = /* @__PURE__ */ new Map();
+	for (const entry of entries) byModel.set(entry.model, (byModel.get(entry.model) ?? 0) + entry.cost);
+	return [...byModel.entries()].map(([model, cost]) => ({
+		model,
+		cost
+	})).sort((a, b) => b.cost - a.cost || a.model.localeCompare(b.model));
+};
+const costTotals = (entries) => ({
+	total: entries.reduce((sum, entry) => sum + entry.cost, 0),
+	byModel: costByModel(entries)
+});
+const setupFor = (config, run, workspace, host, startOverrides = {}) => gen(function* () {
+	const resolved = yield* workflowOf(config, run);
+	const def = resolved.def;
+	const startFlags = run.trace.length === 0 ? yield* StartFlags : {};
+	const { vars, env } = settingsFor(resolved, run.pinnedVars, host.env, startOverrides, startFlags);
+	const skills = yield* resolveScopeSkills(def, vars);
+	const access = yield* resolveScopeAccess(def, skills, vars);
+	const budget = yield* try_({
+		try: () => judgeBudgetBytes(vars),
+		catch: (e) => e instanceof Error ? e : new Error(String(e))
+	});
+	yield* workspace.episodeTrees(run.episode.base, run.episode.commits.map((c) => c.hash));
+	const base = run.episode.base === void 0 ? {
+		hash: EMPTY_TREE$1,
+		tree: treeFromRecord({})
+	} : {
+		hash: run.episode.base,
+		tree: commitTree(workspace, run.episode.base)
+	};
+	const git = yield* GitService;
+	const episode = [];
+	for (const c of run.episode.commits) {
+		const tip = parseCommitMessage(c.message).kept;
+		const exists = tip !== void 0 && isSome(yield* git.readRefOption(`${tip}^{commit}`));
+		episode.push({
+			hash: c.hash,
+			message: c.message,
+			tree: commitTree(workspace, c.hash),
+			...exists ? { kept: {
+				hash: tip,
+				tree: commitTree(workspace, tip)
+			} } : {}
+		});
+	}
+	let pendingMemo;
+	return {
+		resolved,
+		def,
+		vars,
+		env,
+		setup: {
+			def,
+			run,
+			vars,
+			env,
+			budget,
+			skills,
+			access,
+			workspace,
+			base,
+			episode,
+			pendingWorktree: () => pendingMemo ??= workspace.worktreeSync()
+		}
+	};
+});
+const pendingChanges = (git, withIndex) => gen(function* () {
+	const worktree = yield* git.changedPaths();
+	if (!withIndex) return worktree;
+	const seen = new Set(worktree.map((e) => e.path));
+	return [...worktree, ...(yield* git.stagedPaths()).filter((e) => !seen.has(e.path))];
+});
+/** Resolve the rest at `ref`, or at HEAD when `ref` is `undefined`. */
+const restAt = (ref, startOverrides = {}) => gen(function* () {
+	const git = yield* GitService;
+	const config = yield* (yield* ConfigService).load;
+	const workspace = yield* Workspace;
+	const host = yield* Host;
+	const run = yield* computeProcessRun(git, config.workflow, ref);
+	const { resolved, def, vars, env, setup } = yield* setupFor(config, run, workspace, host, startOverrides);
+	const outcome = yield* promise(() => replayFor(setup));
+	const pinned = headHasPin(workspace, run);
+	const pin = pinBeatAt(outcome, run, def, pinned);
+	const resting = restingOn(outcome, pin);
+	if (resting === void 0) return yield* fail$4(replayError(outcome) ?? /* @__PURE__ */ new Error("gtd: replay found no rest"));
+	const { reached, step } = resting;
+	const { stepDef, state, memory } = restFacts(pin, step, reached.trace, run);
+	yield* (yield* Narrator).narrate(`rest resolved: ${state} (awaits ${stepDef.actor})`);
+	if (stepDef.mode !== void 0 && def.modes[stepDef.mode] === void 0) return yield* fail$4(/* @__PURE__ */ new Error(`gtd: config: step "${step.name}": mode "${stepDef.mode}" is not a mode this workflow knows (${knownModes(def).join(", ")})`));
+	const changes = ref === void 0 ? (yield* pendingChanges(git, stepDef.approve === true)).map((e) => ({
+		status: normalizeStatus(e.status),
+		path: e.path
+	})) : [];
+	if (ref === void 0 && config.drift.length > 0) yield* (yield* Narrator).warn(`gtd: notice: the live config differs from the pinned one (${config.drift.join(", ")}); \`gtd repin\` to switch`);
+	return {
+		def,
+		workflowName: resolved.name,
+		state,
+		stepDef,
+		actor: stepDef.actor,
+		pin,
+		pinned,
+		step,
+		trace: reached.trace,
+		run,
+		vars,
+		env,
+		changes,
+		memory: memory.key,
+		memoryResumed: memory.resumed,
+		hints: hintsOf(stepDef),
+		cost: costTotals(run.costEntries),
+		setup
+	};
+});
+const currentRest = restAt(void 0);
+/** The step the process rests at and the trace that reached it — at an unpin, the flow's last step. */
+const restingOn = (outcome, pin) => {
+	if (outcome.kind === "rest") return {
+		reached: outcome,
+		step: outcome.rest
+	};
+	if (outcome.kind !== "ended" || pin !== "remove") return void 0;
+	const step = outcome.trace.at(-1);
+	return step === void 0 ? void 0 : {
+		reached: outcome,
+		step
+	};
+};
+/** A pin or unpin beat has its own script, no step's, and no agent memory. */
+const restFacts = (pin, step, trace, run) => pin === void 0 ? {
+	stepDef: stepDefOf(step),
+	state: step.name,
+	memory: memoryOf(trace, run)
+} : {
+	stepDef: pinStepDef(pin),
+	state: PIN_STATES[pin],
+	memory: {
+		key: void 0,
+		resumed: false
+	}
+};
+const headHasPin = (workspace, run) => {
+	const head = run.episode.commits.at(-1)?.hash ?? run.episode.base;
+	return head !== void 0 && workspace.treeSync(head).has(".gtd/process.gtdpin");
+};
+const underwayAt = (run, step, def) => run.workflow !== void 0 || step.name !== def.initial || step.id.occurrence !== 1;
 /**
-* Resolves the post-hoc short hash/subject from `head` (a commitish) in-script
-* — this line runs AFTER the reset that made `head` the new HEAD, so neither
-* value is knowable when gtd generates it.
+* A started process pins first — again, should a turn have deleted the pin;
+* a pinned flow that ended unpins before the closing commit.
 */
-const abandonedOutcome = (from, head, state) => printfLine(FMT_ABANDONED, [
-	shellQuote(from),
-	`"$(git rev-parse --short ${shellQuote(head)})"`,
-	`"$(git log -1 --format=%s ${shellQuote(head)})"`,
-	shellQuote(state)
-]);
-/** `gtd abandon`'s no-op outcome — the same wording `abandonNoopText` renders. */
-const abandonNoopOutcome = (initial) => noteOutcome(abandonNoopText(initial));
-/** Resolves the post-hoc short hash/subject from `to` (a commitish) in-script, for the same reason `abandonedOutcome` does. */
-const restoredOutcome = (to, state) => printfLine(FMT_RESTORED, [
-	`"$(git rev-parse --short ${shellQuote(to)})"`,
-	`"$(git log -1 --format=%s ${shellQuote(to)})"`,
-	shellQuote(state)
-]);
-//#endregion
-//#region src/emit/ModeContradiction.ts
+const pinBeatAt = (outcome, run, def, pinned) => {
+	if (flowEnded(outcome, run, def)) return pinned || run.pinCommitted ? "remove" : void 0;
+	if (outcome.kind !== "rest" || pinned) return void 0;
+	return underwayAt(run, outcome.rest, def) ? "add" : void 0;
+};
+const flowEnded = (outcome, run, def) => outcome.kind === "ended" || outcome.kind === "rest" && run.workflow === void 0 && outcome.rest.name === def.initial && underwayAt(run, outcome.rest, def);
+const pinStepDef = (pin) => ({
+	actor: "check",
+	kind: "script",
+	content: pin === "add" ? pinScript(PIN_PATH) : unpinScript(PIN_PATH)
+});
 /**
-* Written for two readers at once, since gtd validate's exit code carries no
-* second meaning to distinguish them: the agent (this is a CONFIGURATION BUG,
-* not the steering file — stop, don't edit it, or a fix-retry loop will
-* thrash on the document) and the human (which mode, and the exact rendered
-* `format:` command, to fix `gtd.config.ts` without reproducing the failure).
+* Whether `gtd start <name>` can start a process here: the workflow must
+* reach a step from the tree the opening commit would capture. That step is
+* what the opening commit's subject names.
 */
-const contradictionMessage = (mode, formatCommand) => `gtd: mode "${mode}"'s format: command breaks its own validator — this is a CONFIGURATION BUG, not a problem with the steering file. Do NOT edit the steering file — stop and end your turn now.\nThe rendered format: command that ran:\n${formatCommand}\nWhat it turned mode "${mode}"'s own canonical sample into:`;
+const startRefusal = (rest, resolved, startVars) => gen(function* () {
+	const host = yield* Host;
+	const { vars, env } = settingsFor(resolved, {}, host.env, startVars, yield* StartFlags);
+	const skills = yield* resolveScopeSkills(resolved.def, vars);
+	const access = yield* resolveScopeAccess(resolved.def, skills, vars);
+	const workspace = rest.setup.workspace;
+	const outcome = yield* promise(() => replay({
+		flow: resolved.def.flow,
+		episode: {
+			base: {
+				hash: "",
+				tree: pendingTree(workspace, rest.setup.pendingWorktree(), void 0)
+			},
+			commits: []
+		},
+		vars,
+		env,
+		start: "",
+		budgetBytes: rest.setup.budget,
+		skills,
+		configuredSkills: resolved.def.configuredSkills,
+		access,
+		configuredAccess: resolved.def.configuredAccess
+	}));
+	if (outcome.kind === "rest") return { firstStep: outcome.rest.name };
+	if (outcome.kind === "refused") return { refusal: outcome.message };
+	const why = outcome.kind === "ended" ? "the flow reaches no step" : outcome.message;
+	return { refusal: `workflow "${resolved.name}" cannot start — ${why}` };
+});
+/** The review window's diff base at the rest. */
+const reviewBaseFor = (rest) => rest.step.request.options.base ?? rest.run.diffBase;
+const renderRest = (rest) => succeed$1({
+	state: rest.state,
+	actor: rest.actor,
+	kind: rest.stepDef.kind,
+	content: rest.stepDef.content,
+	...rest.hints,
+	...rest.memory !== void 0 ? { memory: rest.memory } : {},
+	memoryResumed: rest.memoryResumed,
+	...rest.pin !== void 0 ? { pin: rest.pin } : {}
+});
 /**
-* Formats a copy of the mode's own canonical sample and re-validates it with
-* `gtd check <mode>`, failing loudly when the round-trip breaks it — detects a
-* mode whose `format:` contradicts its own `validate:` without ever touching
-* the real steering file. `printf '%s'` over a `shellQuote`d sample, never a
-* heredoc, since no delimiter chosen ahead of time can collide with the
-* sample's own bytes. One bash fragment with no blank lines (so
-* `src/emit/Emit.ts`'s `assembleScript` never splits it from a sibling step), meant
-* to run BEFORE `[ -f <file> ] || exit 0` in the emitted validate script so it
-* still fires at a first-write beat where the real steering file doesn't
-* exist yet.
+* Derived, restart-proof stall detection: the tree is clean, HEAD is an empty
+* attempt at this very agent rest, and another dispatch would repeat it.
 */
-const buildModeContradictionCheck = (inputs) => {
-	const { mode, samplePath, sample, formatCommand } = inputs;
-	const pathQ = shellQuote(samplePath);
-	const messageQ = shellQuote(contradictionMessage(mode, formatCommand));
-	return [
-		`printf '%s' ${shellQuote(sample)} > ${pathQ}`,
-		formatCommand,
-		`gtd check ${mode} ${pathQ} >/dev/null 2>&1 || {`,
-		`  printf '%s\\n' ${messageQ} >&2`,
-		`  cat ${pathQ} >&2`,
-		`  rm -f ${pathQ}`,
-		`  exit 1`,
-		`}`,
-		`rm -f ${pathQ}`
-	].join("\n");
+const stalledAt = (rest) => rest.changes.length === 0 && rest.stepDef.kind === "prompt" && rest.stepDef.allowEmpty !== true && rest.run.headTurn?.state === rest.state && rest.run.headTurn.actor === rest.actor && !rest.run.headTurn.step && rest.run.headTurn.empty;
+/** No process is underway: the default workflow's first step, first visit — a dirty tree there is a turn not yet landed, not a process. */
+const noProcessUnderway = (rest) => rest.pin === void 0 && !underwayAt(rest.run, rest.step, rest.def);
+/** `idle` means exactly one thing: no process underway, clean tree. */
+const restIsIdle = (rest) => noProcessUnderway(rest) && rest.changes.length === 0;
+const isHumanReviewGate = (def) => def.actor === "human" && def.mode === "review";
+const approvalRefusal = (rest, approver) => {
+	if (rest.stepDef.approve !== true) return void 0;
+	const id = rest.step.id;
+	if (rest.changes.length > 0) return {
+		kind: "refusal",
+		message: `gtd land: approval-gate: ${formatStepId(id)} approves exactly the judged diff — revert your edits and run \`gtd land\` on a clean tree to approve, or run \`gtd abandon\``
+	};
+	if (isNone(approver)) return {
+		kind: "refusal",
+		message: `gtd land: approval-gate: ${formatStepId(id)} records who approved it, but git has no author identity — set user.name and user.email`
+	};
+	if (!isRecordableApproval({
+		step: id,
+		...approver.value
+	})) return {
+		kind: "refusal",
+		message: `gtd land: approval-gate: ${formatStepId(id)} cannot record ${approver.value.name} <${approver.value.email}> as approver — it would not read back unchanged from its Gtd-Approved trailer (a control character, for example)`
+	};
 };
-/**
-* Skip notice for a mode whose validator is EXTERNAL (a user `validate:`
-* command, not one of the two built-in modes) — there's no in-process parser
-* to round-trip a sample through. Printed to stderr since silence would read
-* as a clean bill of health.
-*/
-const modeContradictionSkipNotice = (mode) => {
-	return `printf '%s\\n' ${shellQuote(`gtd: mode "${mode}" has an external validate: command — skipping the format/validate contradiction check`)} >&2`;
+/** The landing a clean tree decides before any replay, if it decides one. */
+const cleanLanding = (rest) => {
+	if (rest.changes.length > 0) return void 0;
+	const def = rest.stepDef;
+	if (def.kind === "prompt" && def.allowEmpty !== true) return {
+		kind: "attempt",
+		subject: formatSubject(rest.actor, rest.state)
+	};
+	if (rest.actor === "human" && def.acceptClean !== true) return {
+		kind: "noop",
+		settled: false
+	};
+};
+/** At the human review gate the pending tree lands with every tick cleared, as the landing script will. */
+const reviewGateRewrite = (def) => {
+	const reviewFormat = steeringFormatFor("review");
+	if (!isHumanReviewGate(def) || def.file === void 0 || reviewFormat === void 0) return;
+	return {
+		path: def.file,
+		apply: (content) => reviewFormat.clearTicks(content)
+	};
+};
+const multilineRefusal = (vars) => {
+	const multiline = multilineSetting(vars);
+	return multiline === void 0 ? void 0 : {
+		kind: "refusal",
+		message: `gtd: process setting "${multiline}" spans several lines — a process setting is pinned in a commit trailer and must be a single line`
+	};
+};
+const landingTarget = (outcome, rest) => {
+	if (outcome.kind === "refused") return succeed$1({
+		kind: "refusal",
+		message: outcome.message
+	});
+	if (outcome.kind === "divergence" || outcome.kind === "failed") return fail$4(new Error(outcome.message));
+	if (outcome.kind !== "rest") return succeed$1(rest.def.initial);
+	const reserved = initialStepRefusal(rest.run.workflow, outcome.rest.name, rest.def.initial);
+	return succeed$1(reserved === void 0 ? outcome.rest.name : reserved);
 };
-//#endregion
-//#region src/emit/SteeringMode.ts
 /**
-* `format` alone (no live/external verdict) when there's no validator at
-* all; a live in-process validator for a `"builtin"` validate OR a command
-* that is exactly the format's own seeded string; `externalValidate` for any
-* other command. Each arm returns directly — a flat sequence, not nested
-* ternaries — so the four outcomes stay each their own case to read, not a
-* boolean expression to re-derive.
+* A step commit entering the default's first step is what ends an episode, so
+* a named workflow landing there would read back as finished. Its opening
+* commit may name that step: a bare opening is never read as a boundary.
 */
-const capabilitiesFor = (mode, format, validate) => {
-	if (format === void 0) return validate?.kind === "command" ? { externalValidate: true } : {};
-	if (validate?.kind === "builtin") return {
-		format,
-		liveValidate: format.validate
+const initialStepRefusal = (workflow, step, initial) => workflow !== void 0 && step === initial ? {
+	kind: "refusal",
+	message: `gtd: workflow "${workflow}" reaches step "${step}", the default workflow's first step — that is where a finished process waits, so a started process must never land there; rename the step`
+} : void 0;
+const closingTrailers = (branch) => ({
+	version: GTD_VERSION,
+	...isSome(branch) ? { branch: branch.value } : {}
+});
+const isSettledNoop = (rest, to) => rest.changes.length === 0 && rest.stepDef.kind === "script" && to === rest.state;
+const keptTurn = (rest) => rest.stepDef.keep === true && rest.changes.length > 0 ? { keepTurn: keptRef(rest.run.startHash, rest.state) } : {};
+const approvedTrailer = (rest, approver) => isSome(approver) ? { approved: {
+	step: rest.step.id,
+	...approver.value
+} } : {};
+const landingTo = (rest, to, branch, approver, marks) => {
+	if (isSettledNoop(rest, to)) return {
+		kind: "noop",
+		settled: true
 	};
-	if (validate === void 0) return { format };
-	if (isSeededValidateCommand(mode, validate.command)) return {
-		format,
-		liveValidate: format.validate
+	const underway = !noProcessUnderway(rest);
+	const starts = !underway && to !== rest.def.initial;
+	const refused = starts ? multilineRefusal(rest.vars) : void 0;
+	if (refused !== void 0) return refused;
+	const { finishes, landsAt } = endingOf(rest, to, underway);
+	return {
+		kind: "commit",
+		to: landsAt,
+		spec: {
+			actor: rest.actor,
+			from: rest.state,
+			to: landsAt,
+			step: rest.step.id,
+			...marks.length > 0 && { marks },
+			...approvedTrailer(rest, approver),
+			...startTrailers(rest, starts),
+			...finishes ? closingTrailers(branch) : {}
+		},
+		...finishes ? { keepHistory: processHistoryRef(rest.run.startHash) } : {},
+		...keptTurn(rest)
 	};
+};
+const endingOf = (rest, to, underway) => {
+	const ends = underway && to === rest.def.initial;
 	return {
-		format,
-		externalValidate: true
+		finishes: ends && !rest.pinned,
+		landsAt: ends && rest.pinned ? PIN_STATES.remove : to
+	};
+};
+/** A pin or unpin commit carries the pin alone; the unpin commit closes the process. */
+const pinLanding = (rest, pin, branch) => {
+	const change = rest.changes.find((c) => c.path === PIN_PATH)?.status;
+	return pin === "add" ? pinCommit(rest, change) : unpinCommit(rest, change, branch);
+};
+const pinCommit = (rest, change) => {
+	if (change === void 0 || change === "D") return pinRefusal("add");
+	const to = rest.step.name;
+	return {
+		kind: "commit",
+		to,
+		spec: {
+			actor: rest.actor,
+			from: rest.state,
+			to,
+			pin: "add"
+		},
+		only: PIN_PATH
+	};
+};
+const unpinCommit = (rest, change, branch) => {
+	if (change !== "D" && rest.pinned) return pinRefusal("remove");
+	const to = rest.def.initial;
+	return {
+		kind: "commit",
+		to,
+		spec: {
+			actor: rest.actor,
+			from: rest.state,
+			to,
+			pin: "remove",
+			...closingTrailers(branch)
+		},
+		keepHistory: processHistoryRef(rest.run.startHash),
+		...rest.pinned ? { only: PIN_PATH } : {}
 	};
 };
+const pinRefusal = (pin) => ({
+	kind: "refusal",
+	message: pin === "add" ? `gtd land: ${PIN_PATH} is missing — run the pin beat's script (\`gtd next --json=content\`); if its \`gtd bundle\` fails, fix what it reports, or run \`gtd abandon\`` : `gtd land: ${PIN_PATH} is still there — run the unpin beat's script (\`gtd next --json=content\`), then land`
+});
+const startTrailers = (rest, starts) => starts ? { vars: rest.vars } : {};
+const outcomeMarks = (outcome) => outcome.kind === "rest" || outcome.kind === "ended" ? outcome.marks : [];
 /**
-* Resolve a `mode:` name against `def.modes` plus the built-in registry
-* (`src/workflow/SteeringFormats.ts`) — half by half: a declared `format:`/`validate:`
-* wins, and an undeclared `validate:` falls back to the built-in format's own
-* parser when the name is registered. `format` is set from the registry
-* ALONE, independent of which half of `validate` wins — a declared validator
-* overrides validation, not the format identity.
-*
-* `def: undefined` is the LSP's built-in-only fallback — resolving `mode`
-* against the registry alone, with no workflow definition in hand (e.g. the
-* basename dispatch for a `REVIEW.md` no config maps).
-*
-* The `"unknown"` arm carries the whole refusal message, naming what IS known
-* when `def` is given — this is the one place that message is built, so it
-* can never drift from what actually resolved.
+* What landing the pending turn at `rest` does — a pure decision from a
+* replay with the working tree as the pending turn. The target step is
+* computed by replaying, never matched.
 */
-const resolveMode = (def, state, mode) => {
-	const declared = def?.modes?.[mode];
-	const format = steeringFormatFor(mode);
-	if (declared === void 0 && format === void 0) return {
-		kind: "unknown",
-		message: def !== void 0 ? `state "${state}": mode "${mode}" is not defined by the active workflow (known modes: ${knownModes(def).join(", ")})` : `mode "${mode}" is not a built-in steering format`
+const decideLanding = (rest, verdicts, branch, approver) => gen(function* () {
+	if (rest.pin !== void 0) return pinLanding(rest, rest.pin, branch);
+	const unapproved = approvalRefusal(rest, approver);
+	if (unapproved !== void 0) return unapproved;
+	const early = cleanLanding(rest);
+	if (early !== void 0) return early;
+	if (rest.stepDef.kind === "prompt" && rest.stepDef.access?.write != null) {
+		const message = accessRefusal(rest.changes, rest.stepDef.access.write);
+		if (message !== void 0) return {
+			kind: "refusal",
+			message
+		};
+	}
+	const outcome = yield* promise(() => replayFor(rest.setup, {
+		tree: pendingTree(rest.setup.workspace, rest.setup.pendingWorktree(), reviewGateRewrite(rest.stepDef)),
+		...verdicts !== void 0 ? { verdicts } : {}
+	}));
+	const to = yield* landingTarget(outcome, rest);
+	if (typeof to !== "string") return to;
+	return landingTo(rest, to, branch, approver, outcomeMarks(outcome));
+});
+/** Where landing the pending turn would leave the process, or `undefined` when it would land nothing. */
+const previewLanding = (rest) => decideLanding(rest, void 0, none(), none()).pipe(map((landing) => landing.kind === "commit" ? landing.to : void 0), catch_(() => succeed$1(void 0)));
+/** Every fact the pure landing planner needs, read once: the rest, its steering file, and the landing decision. */
+const snapshotFromRest = (rest, verdicts) => gen(function* () {
+	const git = yield* GitService;
+	const branch = yield* git.currentBranch();
+	const approver = rest.stepDef.approve === true ? yield* git.authorIdent() : none();
+	const landing = yield* decideLanding(rest, verdicts, branch, approver);
+	return {
+		stepDef: rest.stepDef,
+		state: rest.state,
+		actor: rest.actor,
+		changes: rest.changes,
+		file: rest.hints.file,
+		landing
 	};
-	const validate = declared?.validate !== void 0 ? {
-		kind: "command",
-		command: declared.validate
-	} : format !== void 0 ? {
-		kind: "builtin",
-		format
-	} : void 0;
+});
+const humanCommitsOf = (trace, entryCommit) => trace.filter((entry) => entry.actor === "human" && entry.hash !== entryCommit).map((entry) => ({
+	hash: entry.hash,
+	state: entry.state
+}));
+const summaryInput = (run, settings) => {
+	const entryCommit = run.trace[0].hash;
+	const { total, byModel } = costTotals(run.costEntries);
 	return {
-		kind: "resolved",
-		mode,
-		...format !== void 0 ? { format } : {},
-		...declared?.format !== void 0 ? { formatCommand: declared.format } : {},
-		...validate !== void 0 ? { validate } : {},
-		capabilities: capabilitiesFor(mode, format, validate)
+		entryCommit,
+		processBase: run.startParentHash,
+		processTip: run.trace[run.trace.length - 1].hash,
+		humanCommits: humanCommitsOf(run.trace, entryCommit),
+		processCost: total,
+		processCostByModel: byModel,
+		marks: run.marks,
+		...settings
 	};
 };
-/** `gtd next`'s fix-retry instruction, printed ahead of the failing command's captured output. */
-const fixPromptInstruction = (file) => `Your last turn does not pass its own validation script. Fix these format violations in ${file}, then finish:`;
-/**
-* Pushes a `binaryGuard` step ahead of `command` when its own leading word
-* is unambiguous — BEFORE, not wrapped around: a guard that fails must stop
-* the script on its own `exit 127`, without touching `failurePromptWrapper`'s
-* captured-output path. Each command guards on its OWN leading word — a
-* guard naming the wrong binary is worse than none.
-*/
-const pushGuardedCommand = (steps, mode, key, command, file, onFailure) => {
-	const binary = extractLeadingBinary(command);
-	if (binary !== void 0) steps.push({
-		kind: "command",
-		command: binaryGuard(binary, mode, key)
-	});
-	steps.push({
-		kind: "command",
-		command: withFileVar(command, file),
-		...onFailure !== void 0 ? { onFailure } : {}
-	});
-};
+const summaryFor = (run) => gen(function* () {
+	const config = yield* (yield* ConfigService).load;
+	const host = yield* Host;
+	const resolved = yield* workflowOf(config, run);
+	const summary = resolved.def.summary;
+	if (summary === void 0 || run.trace.length === 0) return { prompt: void 0 };
+	return { prompt: summary(summaryInput(run, settingsFor(resolved, run.pinnedVars, host.env, {}, {}))) };
+});
 /**
-* `resolved`'s `format:`/`validate:` as `EmitStep[]` — format first,
-* validate last, the last one wrapped with `onFailure` when the validator is
-* a command (a built-in's own in-process parser has no shell step to wrap:
-* `gtd check`'s seeded command carries that instead). Each command gets its
-* own `binaryGuard` immediately ahead of it.
+* Repository-relative paths of today's config files; one outside the
+* repository cannot be read at a ref, so it is left out. A file only the old
+* config read needs no check: whichever file imported it differs too.
 */
-const modeCommandSteps = (resolved, file) => {
-	const steps = [];
-	if (resolved.formatCommand !== void 0) pushGuardedCommand(steps, resolved.mode, "format", resolved.formatCommand, file, void 0);
-	if (resolved.validate?.kind === "command") pushGuardedCommand(steps, resolved.mode, "validate", resolved.validate.command, file, fixPromptInstruction(file));
-	return steps;
+const inRepoConfigPaths = (root, files) => {
+	const paths = /* @__PURE__ */ new Set();
+	for (const file of files) paths.add(relative(root, resolve(root, file)).split(sep).join("/"));
+	return [...paths].filter((p) => p !== "" && !p.startsWith("..") && !isAbsolute(p)).sort();
 };
-/** `<Host.scratchDir>/gtd-mode-sample-<mode>-<pid>.md` — an absolute literal baked in at emit time, never a shell variable. `<pid>` avoids collisions between concurrent `gtd` processes. Never a `/tmp` literal or `mktemp` (`tests/tooling/no-tmp-assumption.test.ts` scans for both). */
-const scratchSamplePath = (scratchDir, mode) => join(scratchDir, `gtd-mode-sample-${mode}-${process.pid}.md`);
-/**
-* The contradiction round-trip/skip-notice steps for `resolved`'s `mode:`.
-* No `formatCommand` means nothing to round-trip: empty. Otherwise: a live
-* built-in validator runs the round-trip against that format's own canonical
-* sample; an external validator prints a one-line skip notice instead, since
-* silence there would read as a clean bill of health; a format-only mode with
-* neither has nothing to round-trip either.
-*/
-const modeContradictionSteps = (resolved) => gen(function* () {
-	if (resolved.formatCommand === void 0) return [];
-	const { capabilities } = resolved;
-	if (capabilities.format !== void 0 && capabilities.liveValidate !== void 0) {
-		const { scratchDir } = yield* Host;
-		const samplePath = scratchSamplePath(scratchDir, resolved.mode);
-		const formatCommand = withFileVar(resolved.formatCommand, samplePath);
-		return [{
-			kind: "command",
-			command: buildModeContradictionCheck({
-				mode: resolved.mode,
-				samplePath,
-				sample: capabilities.format.sample,
-				formatCommand
-			})
-		}];
-	}
-	if (capabilities.externalValidate === true) return [{
-		kind: "command",
-		command: modeContradictionSkipNotice(resolved.mode)
-	}];
-	return [];
+const configRefusal = (command, tip, paths, reason = "A history ref replays under today's config, so it is unreadable after the config changes") => /* @__PURE__ */ new Error(`${command}: refused — config differs at ${tip.slice(0, 7)}: ${paths.join(", ")}. ${reason}`);
+const differingConfigPaths = (git, workspace, root, config, hash) => gen(function* () {
+	const differing = [];
+	for (const path of inRepoConfigPaths(root, Object.keys(config.fingerprint))) if ((yield* orElseSucceed(git.readFileAtRef(hash, path), () => void 0)) !== workspace.readSync(path)) differing.push(path);
+	return differing;
 });
+const notClosedError = (hash, outcome) => outcome.kind === "rest" ? /* @__PURE__ */ new Error(`gtd history: ${hash.slice(0, 7)} does not close a process under today's config`) : replayError(outcome) ?? /* @__PURE__ */ new Error("gtd history: replay failed");
+const historySteps = (run) => {
+	const messages = new Map(run.episode.commits.map((c) => [c.hash, c.message]));
+	return run.trace.map((entry) => {
+		const message = parseCommitMessage(messages.get(entry.hash) ?? "");
+		return {
+			hash: entry.hash,
+			subject: (messages.get(entry.hash) ?? "").split("\n")[0] ?? "",
+			actor: entry.actor,
+			from: message.parsed?.from,
+			to: entry.state,
+			verdicts: message.judge,
+			...optional("approval", approvalEntryOf(entry.hash, message)[0])
+		};
+	});
+};
+const versionWarningFor = (recorded) => recorded === GTD_VERSION ? void 0 : `gtd: warning: this history was recorded by ${recorded === void 0 ? "an unknown gtd version" : `gtd ${recorded}`} and is replayed by gtd ${GTD_VERSION} — the engine the workflow runs on may have changed since`;
 /**
-* Renders `resolved`'s complete validate script for `file`: the mode's
-* format/validate contradiction check, a guard for a not-yet-written file,
-* then the format/validate commands themselves (format first). gtd never
-* runs this script itself — `resolveMode`+`validateScriptFor` only render
-* text for a driver to execute (`gtd renders; the driver executes`).
+* Replays the closed run at `tip` under today's config. The workflow is not
+* fingerprinted for a version change: the engine under it moves with every
+* upgrade, and the version warning is the only signal.
 */
-const validateScriptFor = (resolved, file) => gen(function* () {
-	return { script: emitScripts([
-		...yield* modeContradictionSteps(resolved),
-		{
-			kind: "command",
-			command: fileExistsGuard(file)
+const historyTrail = (tip) => gen(function* () {
+	const git = yield* GitService;
+	const config = yield* (yield* ConfigService).load;
+	const hash = yield* git.resolveRef(tip);
+	const subject = yield* git.lastCommitSubject(hash);
+	const run = yield* runAtTip(git, config.workflow, {
+		hash,
+		subject
+	});
+	const { outcome, recorded, versionWarning } = yield* replayFinishedProcess(config, run, hash, {
+		command: "gtd history",
+		notEnded: (o) => notClosedError(hash, o)
+	});
+	return {
+		tip: hash,
+		steps: historySteps(run),
+		ended: outcome.via,
+		version: {
+			recorded,
+			running: GTD_VERSION
 		},
-		...modeCommandSteps(resolved, file)
-	]).required };
+		...versionWarning !== void 0 ? { versionWarning } : {}
+	};
+});
+/** Refuses on config drift before replaying, so a stale config never runs the flow. */
+const replayFinishedProcess = (config, run, hash, how) => gen(function* () {
+	const git = yield* GitService;
+	const workspace = yield* Workspace;
+	const host = yield* Host;
+	const recorded = parseCommitMessage(run.episode.commits.find((c) => c.hash === hash)?.message ?? "").version;
+	const versionWarning = versionWarningFor(recorded);
+	const withWarning = (err) => versionWarning === void 0 ? err : /* @__PURE__ */ new Error(`${err.message}\n${versionWarning}`);
+	const differing = yield* differingConfigPaths(git, workspace, host.root, config, hash);
+	if (differing.length > 0) return yield* fail$4(withWarning(configRefusal(how.command, hash, differing, how.configReason)));
+	const { setup } = yield* setupFor(config, run, workspace, host);
+	const outcome = yield* promise(() => replayFor(setup));
+	if (outcome.kind !== "ended") return yield* fail$4(withWarning(how.notEnded(outcome)));
+	return {
+		outcome,
+		recorded,
+		...versionWarning !== void 0 ? { versionWarning } : {}
+	};
 });
 //#endregion
 //#region src/cli/ToolCommands.ts
@@ -26118,7 +26275,7 @@ const runStraysCommand = (command, json, out) => gen(function* () {
 	const narrator = yield* Narrator;
 	const base = yield* resolveSide(git, command.base);
 	const tip = yield* resolveSide(git, command.tip);
-	const touched = yield* git.diffPaths(base, tip);
+	const touched = (yield* git.diffPaths(base, tip)).filter((path) => path !== PIN_PATH);
 	const strays = strayPaths(touched, command.globs);
 	const total = touched.length;
 	if (json.kind === "select") yield* writeSelection(out, strays, json.path).pipe(catchIf((error) => error instanceof SelectorUsageError && /^\d+$/.test(json.path), () => void_));
@@ -27014,8 +27171,7 @@ const startWorkflow = (workflow, varOverrides, json, out, commandLabel) => gen(f
 		workflow: resolved,
 		first: started,
 		commandLabel,
-		vars: varOverrides,
-		config: rest.config
+		vars: varOverrides
 	});
 	if (plan.kind === "refusal") return yield* fail$4(new Error(plan.message));
 	yield* writeScript(json, out, listingCommitted(landingScript(ScriptSurface.render(plan.steps)), rest.changes));
@@ -27127,6 +27283,10 @@ const runAbandonCommand = (json, out) => gen(function* () {
 			kind: "gitWrite",
 			command: mixedResetTo(run.startParentHash)
 		},
+		{
+			kind: "gitWrite",
+			command: unpinScript(PIN_PATH)
+		},
 		{
 			kind: "outcome",
 			command: abandonedOutcome(restState, run.startParentHash, initial)
@@ -27284,7 +27444,7 @@ const runCodeThreadsCheckCommand = () => gen(function* () {
 	if (rest.run.trace.length === 0) return;
 	const git = yield* GitService;
 	const workspace = yield* Workspace;
-	const lines = (yield* git.changedPaths(rest.run.diffBase)).filter((c) => c.status !== "D").flatMap(({ path }) => {
+	const lines = (yield* git.changedPaths(rest.run.diffBase)).filter((c) => c.status !== "D" && c.path !== ".gtd/process.gtdpin").flatMap(({ path }) => {
 		const { threads, findings } = parseCodeThreads(path, workspace.atPath(path) ?? "");
 		return [...threads.filter((t) => t.waitingOn === "human").map((t) => `${path}:${t.line + 1}: ${t.entries[0].text}`), ...findings.map((f) => `${path}:${(f.line ?? 0) + 1}: ${f.message}`)];
 	});
@@ -28013,6 +28173,7 @@ const flagHeader = (row) => {
 };
 const GLOBAL_OPTIONS = [
 	["-v, --verbose", "Narrate on stderr what gtd resolved"],
+	["--live", "Run this gtd, not the process's pin; it may misread the process"],
 	["-h, --help", "Print help; gtd <command> --help for one command"],
 	["-V, --version", "Print the version"],
 	["--", "End the options: every word after it is an argument"]
@@ -28024,7 +28185,7 @@ const EXTRA_TOPICS = [[
 ], [
 	"version",
 	"Print the version",
-	"Print gtd's version."
+	"Print gtd's version, and the version of a pinned process's gtd."
 ]];
 const EXAMPLES = `  $ gtd start                                   list what can start
   $ gtd start <name>                            start a process
@@ -28865,6 +29026,17 @@ var InMemRepo = class InMemRepo {
 		this.index = new Map(this.worktree);
 		this.resetHard();
 	}
+	/** Twin of `GitScript.commitPath`: commits `path` as the worktree has it, every other staged change left staged. */
+	commitPath(path, message) {
+		if (!this.worktree.has(path) && !this.headTree().has(path) && !this.index.has(path)) return `error: pathspec '${path}' did not match any file(s) known to git`;
+		const staged = new Map(this.index);
+		this.index = new Map(this.headTree());
+		this.stage(path);
+		const failure = this.commitAsIs(message);
+		this.index = staged;
+		this.stage(path);
+		return failure;
+	}
 	commitAllWithPrefix(prefix) {
 		this.index = new Map(this.worktree);
 		return this.commitAsIs(prefix);
@@ -29631,6 +29803,16 @@ const recognizeGitBuilders = (repo, block) => {
 	}
 	const conditionLine = conditionStatement(block);
 	if (block.startsWith("git add -A || exit 1\ngtd_sign_cfg=")) return recognizeKeepTurn(repo, block);
+	if (block.startsWith("git add -A -- ")) {
+		const [path, message] = extractQuotedTokens(block);
+		if (path === void 0 || message === void 0 || commitPath(path, message) !== block) return;
+		const failure = repo.commitPath(path, message);
+		return failure === void 0 ? { kind: "applied" } : {
+			kind: "failed",
+			error: failure,
+			status: 1
+		};
+	}
 	if (block.startsWith("git add -A || exit 1\n")) {
 		const [message] = extractQuotedTokens(conditionLine);
 		if (message !== void 0 && commitAll(message) === block) {
@@ -29708,6 +29890,19 @@ const recognizeGitBuilders = (repo, block) => {
 		return;
 	}
 };
+/** What the in-memory `gtd bundle` prints: a pin header, and no engine behind it. */
+const IN_MEMORY_PIN = "gtdpin 1 gtd in-memory\n";
+/** A pin or unpin beat's script. */
+const recognizePinScripts = (repo, block) => {
+	if (block === pinScript(".gtd/process.gtdpin")) {
+		repo.writeFile(PIN_PATH, IN_MEMORY_PIN);
+		return { kind: "applied" };
+	}
+	if (block === unpinScript(".gtd/process.gtdpin")) {
+		if (repo.readFile(".gtd/process.gtdpin") !== void 0) repo.deleteFile(PIN_PATH);
+		return { kind: "applied" };
+	}
+};
 /** The REAL `fileExistsGuard` block, re-derived from the extracted path and string-compared. The one recognizer that can report `{ kind: "stopped" }`: a real `exit 0` there ends the script successfully. */
 const recognizeFileExistsGuard = (repo, block) => {
 	const [file] = extractQuotedTokens(block);
@@ -30073,6 +30268,7 @@ const recognizersFor = (repo, commands, git) => [
 	(block) => recognizeBinaryGuard(commands, block),
 	(block) => git ? recognizeGitBuilders(repo, block) : void 0,
 	(block) => recognizeWriteLines(repo, block),
+	(block) => recognizePinScripts(repo, block),
 	(block) => recognizeFailurePromptWrapper(repo, commands, block),
 	(block) => recognizePresentationSubshell(repo, commands, block, git),
 	(block) => recognizeModeContradictionSkipNotice(block),
@@ -30310,12 +30506,16 @@ const expectedVerdict = (doc) => {
 	return ["expected a JSON array, one entry per question — answer a boolean for a noul, a string for a choice, a number for a score; p between 0 and 1:", `[${questions.map(({ id, primitive }) => `{ "id": ${JSON.stringify(id)}, "answer": ${ANSWER[primitive] ?? "\"<answer>\""}, "p": 0.9 }`).join(", ")}]`].join("\n");
 };
 const quoted = (names) => names.map((name) => `"${name}"`).join(", ");
-/** Who acts at `doc`: its scripted actor, or a check's own script under `checks: "run"`. A stall has none. */
+/** Who acts at `doc`: its scripted actor, or its own script at a pin beat or a check under `checks: "run"`. A stall has none. */
 const actorAt = (doc, actors, checks) => {
 	if (doc.kind === "stalled") return {
 		scripted: false,
 		actor: void 0
 	};
+	if (doc.pin !== void 0) return {
+		scripted: false,
+		actor: runsItsScript
+	};
 	if (Object.hasOwn(actors, doc.state)) return {
 		scripted: true,
 		actor: actors[doc.state]