@rafinery/cli 0.8.6 → 0.8.10

package/bin/rafa.mjs

@@ -50,7 +50,6 @@ const COMMANDS = [
   "doctor",
   "fold",
   "distill",
-  "distiller",
   "ci-setup",
   "leverage",
   "benchmark",

package/blueprint/.claude/rafa/hooks/brain-switch.mjs

@@ -1,9 +1,20 @@
 // rafa brain-switch — the post-checkout worker (capture-engine P1, spec r2
 // §2.2). Keeps the nested .rafa/ repo's branch in LOCKSTEP with the code
-// branch: code branch cut/switch ⇒ brain branch cut/switch (created lazily
-// from the current local state). Dirty brain surfaces are committed to the OLD
-// branch first (switch-carryover) — deterministic, nothing lost, nothing
-// blocks. argv: <prevHEAD> <newHEAD> <flag> (git's post-checkout contract;
+// branch: code branch cut/switch ⇒ brain branch cut/switch. Dirty brain
+// surfaces are committed to the OLD branch first (switch-carryover) —
+// deterministic, nothing lost, nothing blocks.
+//
+// FRESH-SLATE RULE (owner 2026-07-23): a NEW branch's mirror is cut FROM THE
+// REMOTE TRUNK (the published org brain), never from whatever branch the local
+// mirror happened to sit on. That makes the slate exact — no session leftovers
+// from other branches, no local-vs-remote drift — and keeps the branch's diff
+// vs trunk equal to precisely what the branch captures (the reconciler's
+// git-plane semantic). Cutting an EMPTY tree instead would read as mass
+// deletion of the org brain in that diff — never that.
+// Fallback ladder (offline-safe, never blocks a checkout):
+//   origin/<trunk> (freshly fetched, bounded) → local <trunk> → current HEAD.
+//
+// argv: <prevHEAD> <newHEAD> <flag> (git's post-checkout contract;
 // flag "1" = branch checkout, "0" = file checkout → no-op).
 
 import { execSync } from "node:child_process";
@@ -15,11 +26,25 @@ try {
   if (process.env.RAFA_HOOKS_DISABLED === "1") process.exit(0);
   if (process.argv[4] !== "1") process.exit(0);
   if (!existsSync(join(ROOT, "rafa.json"))) process.exit(0);
-  if (!existsSync(join(ROOT, ".rafa", ".git"))) process.exit(0);
 
-  const sh = (cmd, cwd = ROOT) =>
-    execSync(cmd, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
-  const shR = (cmd) => sh(cmd, join(ROOT, ".rafa"));
+  const sh = (cmd, cwd = ROOT, timeout) =>
+    execSync(cmd, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], ...(timeout ? { timeout } : {}) }).trim();
+  const shR = (cmd, timeout) => sh(cmd, join(ROOT, ".rafa"), timeout);
+
+  // SELF-HEAL (owner 2026-07-23): a repo with rafa.json but no materialized .rafa
+  // instance must still mirror — "clone → just works" means the FIRST branch checkout
+  // bootstraps the lazy .rafa itself (same npx precedent as the pre-push checkpoint
+  // hook), bounded so a checkout can never hang. A bootstrap failure degrades to the
+  // old silent no-op — a checkout must never break.
+  if (!existsSync(join(ROOT, ".rafa", ".git"))) {
+    try {
+      console.error("rafa · no local .rafa instance — bootstrapping (one-time) …");
+      sh("npx -y @rafinery/cli pull", ROOT, 90000);
+    } catch {
+      process.exit(0);
+    }
+    if (!existsSync(join(ROOT, ".rafa", ".git"))) process.exit(0);
+  }
 
   const branch = sh("git rev-parse --abbrev-ref HEAD");
   if (branch === "HEAD") process.exit(0); // detached — no mirror
@@ -33,14 +58,71 @@ try {
   } catch {
     /* nothing dirty */
   }
-  // Trunk mirrors to the brain repo's SAME-NAMED branch when it exists — the
-  // default branch stays the distiller's write target; the session only ever
-  // reads there. A missing trunk-named brain branch is left alone.
+
+  // The brain trunk = the mirror of the code repo's default-ish branch (the
+  // distiller's write target; sessions only ever read there).
+  const trunkOf = () => {
+    for (const t of ["main", "master"]) {
+      try {
+        shR(`git rev-parse --verify -q "refs/remotes/origin/${t}"`);
+        return t;
+      } catch {
+        /* keep looking */
+      }
+      try {
+        shR(`git rev-parse --verify -q "refs/heads/${t}"`);
+        return t;
+      } catch {
+        /* keep looking */
+      }
+    }
+    return null;
+  };
+  const fetchTrunk = (trunk) => {
+    try {
+      shR(`git fetch -q origin "${trunk}"`, 8000); // bounded — a hook must never hang a checkout
+      return true;
+    } catch {
+      return false;
+    }
+  };
+
   try {
+    // SWITCH — a same-named mirror branch exists: check it out. Switching TO the
+    // trunk additionally freshens it from remote (ff-only; divergence left alone —
+    // pull --full --force is the explicit adopt path).
     shR(`git rev-parse --verify -q "refs/heads/${branch}"`);
     shR(`git checkout -q "${branch}"`);
+    if (branch === "main" || branch === "master") {
+      if (fetchTrunk(branch)) {
+        try {
+          shR(`git merge -q --ff-only "origin/${branch}"`);
+        } catch {
+          /* diverged — loud adoption is pull --full --force, never a silent hook */
+        }
+      }
+    }
   } catch {
-    if (branch !== "main" && branch !== "master") shR(`git checkout -q -b "${branch}"`);
+    // CUT — no mirror branch yet. Never mirror-cut the trunk itself; for any other
+    // branch, base the new mirror on the freshest trunk we can reach.
+    if (branch !== "main" && branch !== "master") {
+      const trunk = trunkOf();
+      let base = null;
+      if (trunk) {
+        fetchTrunk(trunk); // best-effort freshness — offline still falls through
+        for (const ref of [`refs/remotes/origin/${trunk}`, `refs/heads/${trunk}`]) {
+          try {
+            shR(`git rev-parse --verify -q "${ref}"`);
+            base = ref;
+            break;
+          } catch {
+            /* next */
+          }
+        }
+      }
+      if (base) shR(`git checkout -q -b "${branch}" "${base}"`);
+      else shR(`git checkout -q -b "${branch}"`); // last resort: old behavior, current HEAD
+    }
   }
 } catch {
   /* silent by design */

package/lib/releases.mjs

@@ -245,6 +245,25 @@ export const RELEASES = [
       "sha and mints the node (brain ↔ code). Merges need NOT be PR-driven: a plain " +
       "`git merge` + push to main reconciles too. `rafa update` re-vendors the scan SOP.",
   },
+  {
+    version: "0.8.10",
+    contract: 1,
+    plans: 2,
+    requires: "update",
+    summary:
+      "(0.8.7/0.8.9 were unusable publishes — npm shipped the `workspace:*` dep " +
+      "literally; both unpublished, `pnpm publish` is the only publish path.) " +
+      "FRESH-SLATE BRANCH MIRRORING: a NEW code branch's brain-mirror branch is cut " +
+      "FROM THE REMOTE TRUNK (the published org brain; fetched fresh, offline-safe " +
+      "fallback ladder) — never from whatever branch the local .rafa mirror sat on. " +
+      "No session leftovers cross branches, local-vs-remote drift can't leak into a " +
+      "new branch, and the branch's diff vs trunk stays exactly what the branch " +
+      "captured. Switching TO the trunk ff-freshens it from remote (divergence stays " +
+      "loud — `rafa pull --full --force` is the explicit adopt). SELF-HEAL: a repo " +
+      "with rafa.json but no materialized .rafa bootstraps it automatically on the " +
+      "first branch checkout (bounded; a failure never breaks the checkout). " +
+      "`rafa update` re-vendors the post-checkout hook.",
+  },
 ];
 
 // The release this CLI build ships (last entry).

package/package.json

@@ -1,12 +1,11 @@
 {
   "name": "@rafinery/cli",
-  "version": "0.8.6",
+  "version": "0.8.10",
   "description": "rafa — the AI engineer CLI. Vendors the rafa blueprint into your repo (shadcn-style) and runs the deterministic contract gates.",
   "type": "module",
   "bin": {
     "rafa": "bin/rafa.mjs",
-    "cli": "bin/rafa.mjs",
-    "rafa-distiller": "bin/rafa-distiller.mjs"
+    "cli": "bin/rafa.mjs"
   },
   "files": [
     "bin",
@@ -18,11 +17,16 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@rafinery/okf": "0.1.1"
+    "@rafinery/okf": "workspace:*"
   },
   "publishConfig": {
     "access": "public"
   },
+  "scripts": {
+    "bundle": "node scripts/bundle-blueprint.mjs",
+    "prepare": "node scripts/bundle-blueprint.mjs",
+    "test": "node --test"
+  },
   "keywords": [
     "rafa",
     "rafinery",
@@ -38,9 +42,5 @@
     "url": "git+https://github.com/rafinery-ai/rafinery.git",
     "directory": "packages/cli"
   },
-  "homepage": "https://github.com/rafinery-ai/rafinery/tree/main/packages/cli",
-  "scripts": {
-    "bundle": "node scripts/bundle-blueprint.mjs",
-    "test": "node --test"
-  }
-}
+  "homepage": "https://github.com/rafinery-ai/rafinery/tree/main/packages/cli"
+}

package/LICENSE

@@ -1,21 +0,0 @@
-The MIT License
-
-Copyright (c) Atai Barkai
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.

package/bin/rafa-distiller.mjs

@@ -1,13 +0,0 @@
-#!/usr/bin/env node
-// rafa-distiller — the distiller loop's binary (reconciliation orchestrator, spec
-// §2.6). boot.sh's DISTILLER_ENTRY seam: the sandbox image's boot.sh wins the claim
-// (claim-on-start, exports RAFA_ATTEMPT) and `exec rafa-distiller`. From here the
-// metered loop owns the run: heartbeat + arbitrate against merged main + author
-// survivors through the gates + push (never force) + reconcile_report.
-//
-// Thin entry only — the loop lives in ../lib/distiller.mjs so it stays importable +
-// unit-testable (runDistiller) without a sandbox.
-
-import distiller from "../lib/distiller.mjs";
-
-await distiller(process.argv.slice(2));

package/lib/distiller/state-plane.mjs

@@ -1,159 +0,0 @@
-// The reconcile_* state-plane protocol, client side (reconciliation orchestrator,
-// spec §2.6 / refinery-arc-p1-state-plane). boot.sh already won the claim and
-// handed us the attempt token; from here the distiller must:
-//   heartbeat  — extend the lease every ~2 min wall-clock (a dead run's lease
-//                expires and the queue sweep re-queues the row — completeness).
-//   log_append — batch narration ~1 s and ship it as chunks (the live tail).
-//   report     — the terminal write: node delta + per-branch outcomes + meter
-//                (success) OR errorClass + message (failure).
-//
-// EVERY write carries the attempt fence token: a write from a superseded attempt
-// (the run was killed and re-claimed → attempt++) is rejected by the queue as a
-// zombie (`stale-attempt`). That is the fencing half of exit-gate case 2, provable
-// at this boundary — we always send `attempt`, and a fenced write comes back
-// `ok:false`. The queue-side detection + retry is proven in reconcileStatePlane.test.
-//
-// Timers + the platform `call` are INJECTED so the whole surface is unit-testable
-// with a manual clock and a fake platform (no real 2-min waits, no real network).
-
-// Heartbeat: fire reconcile_heartbeat on an interval. `beat()` also fires on demand
-// (e.g. a phase transition). A beat that comes back fenced/not-running means WE are
-// the zombie — stop and surface it via onFenced; the loop aborts rather than push.
-export function startHeartbeat({
-  call,
-  reconciliationId,
-  attempt,
-  actor,
-  phase = "reconciling",
-  intervalMs = 120_000, // ~2 min wall-clock
-  setTimer = setInterval,
-  clearTimer = clearInterval,
-  onFenced = () => {},
-}) {
-  let currentPhase = phase;
-  let stopped = false;
-  let handle = null;
-
-  async function beat() {
-    if (stopped) return { ok: false, reason: "stopped" };
-    let res;
-    try {
-      res = await call("reconcile_heartbeat", {
-        reconciliationId,
-        attempt,
-        phase: currentPhase,
-        actorMeta: actor,
-      });
-    } catch (e) {
-      // Transport hiccup on a single beat is non-fatal — the lease still has slack;
-      // the NEXT beat retries. A persistent outage lets the lease expire (sweep
-      // re-queues), which is the correct completeness behaviour.
-      return { ok: false, reason: "transport", error: e instanceof Error ? e.message : String(e) };
-    }
-    if (res && res.ok === false && (res.reason === "stale-attempt" || res.reason === "not-running")) {
-      stop();
-      onFenced(res.reason);
-    }
-    return res;
-  }
-
-  function setPhase(p) {
-    currentPhase = p;
-  }
-
-  function stop() {
-    stopped = true;
-    if (handle) clearTimer(handle);
-    handle = null;
-  }
-
-  handle = setTimer(() => {
-    void beat();
-  }, intervalMs);
-
-  return { beat, setPhase, stop };
-}
-
-// Log batcher: buffer narration lines and flush them as chunks on a ~1 s cadence
-// (and on demand). A batch the queue rejects for a credential pattern is DROPPED
-// with a value-free warning (names are contracts, values are secrets — the queue
-// screens per line, we never echo the line). Attempt-fenced like every write.
-export function makeLogBatcher({
-  call,
-  reconciliationId,
-  attempt,
-  actor,
-  flushMs = 1000,
-  setTimer = setInterval,
-  clearTimer = clearInterval,
-  warn = () => {},
-}) {
-  let buffer = [];
-  let stopped = false;
-  let handle = null;
-
-  async function flush() {
-    if (buffer.length === 0) return { ok: true, appended: 0 };
-    const chunks = buffer;
-    buffer = [];
-    let res;
-    try {
-      res = await call("reconcile_log_append", {
-        reconciliationId,
-        attempt,
-        chunks,
-        actorMeta: actor,
-      });
-    } catch (e) {
-      // Never fatal: dropping a log batch loses narration, never correctness.
-      return { ok: false, reason: "transport", error: e instanceof Error ? e.message : String(e) };
-    }
-    if (res && res.ok === false && res.reason === "secret-detected") {
-      // The queue named the position, never the content — keep it that way.
-      warn(`log batch dropped: a line matched a credential pattern (chunk ${res.chunkIndex}) — not stored, value never echoed`);
-    }
-    return res;
-  }
-
-  function append(...lines) {
-    if (stopped) return;
-    for (const l of lines) if (l != null && String(l).length) buffer.push(String(l));
-  }
-
-  async function stop() {
-    stopped = true;
-    if (handle) clearTimer(handle);
-    handle = null;
-    return flush(); // final drain
-  }
-
-  handle = setTimer(() => {
-    void flush();
-  }, flushMs);
-
-  return { append, flush, stop };
-}
-
-// The terminal write. A SUCCESS payload carries the node delta + per-branch
-// outcomes + meter (the pointer advance composes atomically queue-side). A run
-// that refuted EVERYTHING is still a success — refutations are outcomes, not
-// infrastructure failures (exit-gate: refute-everything is GREEN). A FAILURE
-// payload carries the errorClass (deterministic → needs-attention now; transient
-// → backoff retry) + a message.
-export async function reportSuccess({ call, reconciliationId, attempt, actor, parents, delta, outcomes, meter }) {
-  return call("reconcile_report", {
-    reconciliationId,
-    attempt,
-    actorMeta: actor,
-    result: { kind: "success", parents, delta, outcomes, meter },
-  });
-}
-
-export async function reportFailure({ call, reconciliationId, attempt, actor, errorClass, message }) {
-  return call("reconcile_report", {
-    reconciliationId,
-    attempt,
-    actorMeta: actor,
-    result: { kind: "failure", errorClass, message },
-  });
-}

package/lib/distiller.mjs

@@ -1,431 +0,0 @@
-// The distiller loop — the metered core boot.sh hands off to (reconciliation
-// orchestrator, spec §2.6; refinery-arc-p1-distiller). boot.sh has already won the
-// claim (claim-on-start) and exported RAFA_ATTEMPT (the fence token); this is the
-// run that owns the repo. Sequence:
-//
-//   heartbeat on → collect the folded working sets → arbitrate against merged main
-//   (the mechanical DOCTRINE, doctrine.mjs) → author survivors + the per-run
-//   reconciliation-report concept → okf emit → verify-citations → compile → push
-//   (NEVER force) → reconcile_report (node delta + per-branch outcomes + meter).
-//
-// The ONE non-mechanical step is claim-level truth — judged by the org's own LLM
-// behind the `judge` seam. Every other decision (fold, re-ground, prune, sweep,
-// latest-merge-wins, provenance, failure class) is deterministic doctrine, so the
-// whole loop is drivable in tests with a fake judge + fake platform + a manual clock.
-//
-// Refutations are a GREEN run (reconcile_report success with refuted outcomes), not
-// a failure. A gate rejection is DETERMINISTIC (needs-attention now, no retry spend);
-// a boot/clone/network fault is TRANSIENT (backoff retry while a later branch proceeds).
-
-import { existsSync, mkdirSync, writeFileSync, rmSync, readFileSync, readdirSync, statSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { createRequire } from "node:module";
-import { pathToFileURL } from "node:url";
-import { runOkfEmit } from "./gate/okf-emit.mjs";
-import { runVerifyCitations } from "./gate/verify-citations.mjs";
-import { runCompile } from "./gate/compile.mjs";
-import push from "./push.mjs";
-import pull from "./pull.mjs";
-import { callTool } from "./mcp-client.mjs";
-import {
-  startHeartbeat,
-  makeLogBatcher,
-  reportSuccess,
-  reportFailure,
-} from "./distiller/state-plane.mjs";
-import {
-  foldCandidates,
-  arbitrateCandidate,
-  resolveCollision,
-  rewriteCites,
-  changedFilesSince,
-  mergeRangeSweep,
-  outcomeRow,
-  perBranchOutcomes,
-  buildDelta,
-  renderReconReport,
-  classifyError,
-  deterministicFailure,
-  transientFailure,
-} from "./distiller/doctrine.mjs";
-
-// Load the already-mirrored org brain notes for the merge-range sweep: every
-// `.rafa/brain/{rules,playbooks}/**/*.md` (the `await pull(["--full"])` in the
-// entry puts them on disk before the loop runs). Skips generated `index.md`,
-// scratch `_*.md`, and conflict `*.theirs.md`; reconciliations/ is excluded by
-// only walking rules + playbooks. Returns [{ path, content }] with bundle-relative
-// paths ("brain/rules/x.md") mirroring foldCandidates' candidate shape.
-export function loadBrainNotes(cwd = process.cwd()) {
-  const brain = join(cwd, ".rafa", "brain");
-  const walkMd = (dir) => {
-    if (!existsSync(dir)) return [];
-    return readdirSync(dir).flatMap((e) => {
-      const p = join(dir, e);
-      if (statSync(p).isDirectory()) return walkMd(p);
-      return e.endsWith(".md") && e !== "index.md" && !e.startsWith("_") && !e.endsWith(".theirs.md")
-        ? [p]
-        : [];
-    });
-  };
-  const notes = [];
-  for (const sub of ["rules", "playbooks"]) {
-    for (const p of walkMd(join(brain, sub)))
-      notes.push({ path: "brain/" + p.slice(brain.length + 1), content: readFileSync(p, "utf8") });
-  }
-  return notes;
-}
-
-// A brain-relative path that would escape .rafa/ is refused loudly (mirrors
-// distill.mjs safeRel — never write, never guess).
-const safeRel = (p) => {
-  if (p.startsWith("/") || p.split("/").includes(".."))
-    throw deterministicFailure(`unsafe working-set path: ${p}`);
-  return p;
-};
-
-// The Agent SDK is not a hard dependency of the CLI (heavy; only the metered judge
-// needs it). Same isolated-install resolution order as distill.mjs.
-async function loadAgentSdk(cwd) {
-  const roots = [process.env.RAFA_AGENT_SDK_DIR, null, cwd];
-  for (const root of roots) {
-    try {
-      if (root === null) return await import("@anthropic-ai/claude-agent-sdk");
-      if (!root) continue;
-      const req = createRequire(join(root, "package.json"));
-      return await import(pathToFileURL(req.resolve("@anthropic-ai/claude-agent-sdk")).href);
-    } catch {
-      /* try the next root */
-    }
-  }
-  throw deterministicFailure(
-    "@anthropic-ai/claude-agent-sdk is not installed — the distiller image bakes it in " +
-      "(RAFA_AGENT_SDK_DIR points at the isolated install).",
-  );
-}
-
-// ── the injectable orchestration ────────────────────────────────────────────────
-// Every external effect is a seam with a real default: `call` (platform MCP),
-// `judge` (org LLM), `collectSets` (working sets), `orgNotes` (brain notes for the
-// sweep), gate/push runners, timers, clock. Tests pass deterministic fakes; the
-// sandbox path builds the real ones in the default export below.
-export async function runDistiller({
-  env = process.env,
-  cwd = process.cwd(),
-  call,
-  judge,
-  collectSets,
-  orgNotes = async () => [],
-  cursorSha = env.RAFA_CURSOR_SHA || "",
-  parents = (env.RAFA_PARENT_SHAS || "").split(",").filter(Boolean),
-  authorSurvivor,
-  removeNote,
-  authorReport,
-  runGates,
-  doPush,
-  now = () => Date.now(),
-  setTimer = setInterval,
-  clearTimer = clearInterval,
-  log = console.log,
-} = {}) {
-  const reconciliationId = env.RAFA_LEAD_RECONCILIATION_ID;
-  const attempt = Number(env.RAFA_ATTEMPT);
-  const mergeSha = env.RAFA_MERGE_SHA;
-  const tier = env.RAFA_TIER === "provisional" ? "provisional" : "canonical";
-  const model = env.RAFA_MODEL || "claude-opus-4-8";
-  const actor = { model, agent: "distiller", runner: "sandbox" };
-  if (!reconciliationId) throw deterministicFailure("RAFA_LEAD_RECONCILIATION_ID is not set");
-  if (!Number.isFinite(attempt)) throw deterministicFailure("RAFA_ATTEMPT (the fence token) is not set");
-  if (!mergeSha) throw deterministicFailure("RAFA_MERGE_SHA is not set");
-
-  const t0 = now();
-  const meter = { machineSeconds: 0, tokens: 0 };
-  let fenced = false;
-
-  // Token accounting rides the judge seam's return (`{ hold, reason, tokens }`) —
-  // the ONLY metered step is claim-level truth. This wrapper accumulates it so
-  // reconcile_report's meter reflects real LLM spend, never a hardcoded 0.
-  let judgedTokens = 0;
-  const meteredJudge = async (cand, ctx) => {
-    const v = await judge(cand, ctx);
-    judgedTokens += v && Number.isFinite(v.tokens) ? v.tokens : 0;
-    return v;
-  };
-
-  const hb = startHeartbeat({
-    call, reconciliationId, attempt, actor, phase: "reconciling",
-    setTimer, clearTimer,
-    onFenced: () => { fenced = true; log("! heartbeat fenced (a newer attempt owns this run) — aborting"); },
-  });
-  const logs = makeLogBatcher({ call, reconciliationId, attempt, actor, setTimer, clearTimer, warn: log });
-
-  try {
-    logs.append("distiller: collecting folded working sets");
-    const branchSets = await collectSets();
-    hb.setPhase("arbitrating");
-
-    // Fold N branches into ONE run; a path carried by >1 branch is a collision.
-    const { candidates, collisions } = foldCandidates(branchSets);
-    const dispositions = [];
-
-    // Non-colliding candidates: arbitrate each against merged main.
-    for (const cand of candidates) {
-      const d = await arbitrateCandidate(cand, cwd, { judge: meteredJudge });
-      dispositions.push({ ...d, candidate: cand });
-    }
-    // Collisions: judge every version, latest-merge-wins tiebreak (case 5).
-    for (const { versions } of collisions) {
-      for (const d of await resolveCollision(versions, cwd, { judge: meteredJudge })) dispositions.push(d);
-    }
-
-    // Merge-range sweep (case 4, second half): existing org notes citing files the
-    // merge changed get their citations re-resolved — re-ground or prune, same rule.
-    // changedFilesSince returns null on an UNREACHABLE range (a cursor sha not yet
-    // in the clone) — honor that contract: a transient skip (backoff retry once the
-    // sha lands), a loud log line, NEVER a silent coerce-to-[] that would let stale
-    // org notes through undetected.
-    const changed = changedFilesSince(cursorSha, mergeSha, cwd);
-    if (changed === null) {
-      logs.append(`distiller: merge-range ${cursorSha}..${mergeSha} unreachable — transient skip, retrying`);
-      throw transientFailure(`merge-range sweep: ${cursorSha}..${mergeSha} unreachable (cursor sha not in the clone yet?)`);
-    }
-    const orgNoteList = await orgNotes();
-    const sweep = mergeRangeSweep({ changedFiles: changed, orgNotes: orgNoteList, cwd });
-    // Observability: the sweep's reach is REPORTED (a true 0 is fine; an
-    // indistinguishable stub is not). Counts only — never note content.
-    logs.append(
-      `distiller: merge-range sweep — ${orgNoteList.length} org note(s) loaded · ` +
-        `${changed.length} changed file(s) in range · ${sweep.length} citation(s) re-checked`,
-    );
-    for (const s of sweep) {
-      if (s.disposition.status === "deleted") {
-        dispositions.push({
-          outcome: "pruned", noteId: s.noteId, cites: [s.cite],
-          detail: `sweep: ${s.disposition.record}`,
-          candidate: { path: s.notePath, branch: "(org-brain)", capturedAtSha: mergeSha },
-          sweepPath: s.notePath,
-        });
-      } else if (s.disposition.status === "regrounded") {
-        dispositions.push({
-          outcome: "rewritten", noteId: s.noteId, cites: [s.disposition.to],
-          detail: `sweep: re-grounded ${s.cite.loc} → ${s.disposition.to.loc}`,
-          candidate: { path: s.notePath, branch: "(org-brain)", capturedAtSha: mergeSha },
-        });
-      }
-    }
-
-    // Author survivors into the brain; prune deletions; refuted/folded author nothing.
-    hb.setPhase("authoring");
-    for (const d of dispositions) {
-      if (d.outcome === "banked") {
-        authorSurvivor({ path: safeRel(d.candidate.path), content: d.candidate.content });
-      } else if (d.outcome === "rewritten" && d.candidate.content) {
-        authorSurvivor({
-          path: safeRel(d.candidate.path),
-          content: rewriteCites(d.candidate.content, d.regroundings),
-        });
-      } else if (d.outcome === "pruned" && d.sweepPath) {
-        removeNote(safeRel(d.sweepPath));
-      }
-    }
-
-    // The per-run reconciliation-report concept (provenance record).
-    const outcomeRows = dispositions.map((d) =>
-      outcomeRow({
-        candidate: d.candidate, outcome: d.outcome, detail: d.detail,
-        reconciliationId, supersededBy: d.supersededBy,
-      }),
-    );
-    meter.machineSeconds = Math.round((now() - t0) / 1000);
-    meter.tokens = judgedTokens; // real LLM spend from the judge seam, not a hardcoded 0
-    const report = renderReconReport({
-      mergeSha, outcome: "succeeded", tier, reconciliationId, outcomeRows, meter,
-    });
-    authorReport(report);
-    logs.append(`distiller: ${outcomeRows.length} outcome(s) — running gates`);
-
-    // Gates + push. A gate rejection is DETERMINISTIC (retrying only burns spend).
-    hb.setPhase("gating");
-    if (fenced) throw deterministicFailure("run fenced before gating — a newer attempt owns it");
-    const gate = runGates();
-    if (!gate.ok) throw deterministicFailure(gate.message || "authored brain failed the gates");
-    hb.setPhase("pushing");
-    doPush(); // never force — push.mjs rebase-replays, aborts loudly on real conflict
-
-    // Terminal success (refutations included in the delta — a refute-everything run
-    // is GREEN here, not a failure).
-    const delta = buildDelta(dispositions);
-    const outcomes = perBranchOutcomes(branchSets, outcomeRows);
-    const res = await reportSuccess({ call, reconciliationId, attempt, actor, parents, delta, outcomes, meter });
-    log(
-      `✓ reconciliation ${reconciliationId}: ${delta.banked.length} banked · ${delta.rewritten.length} rewritten · ` +
-        `${delta.pruned.length} pruned · ${delta.refuted.length} refuted · ${collisions.length} collision(s)`,
-    );
-    return { ok: true, delta, outcomes, meter, report, reportResult: res };
-  } catch (e) {
-    const errorClass = classifyError(e);
-    const message = e instanceof Error ? e.message : String(e);
-    // A fenced run must not stamp a terminal state (the newer attempt owns it).
-    if (fenced) {
-      log(`! run fenced — leaving the terminal write to the owning attempt (${message})`);
-      return { ok: false, fenced: true, errorClass, message };
-    }
-    log(`✗ reconciliation ${reconciliationId} failed (${errorClass}): ${message}`);
-    const res = await reportFailure({ call, reconciliationId, attempt, actor, errorClass, message });
-    return { ok: false, errorClass, message, reportResult: res };
-  } finally {
-    hb.stop();
-    await logs.stop();
-  }
-}
-
-// ── the CLI entry (bin/rafa-distiller.mjs · boot.sh's DISTILLER_ENTRY seam) ───────
-// Builds the REAL seams from the sandbox environment and runs the loop. This is the
-// path that only exercises end-to-end inside the pinned image (E2B/Docker) — the
-// exit-gate sandbox-run clause. The doctrine + state-plane it composes are proven
-// at module level without a sandbox.
-export default async function distiller(_args = []) {
-  process.env.RAFA_HOOKS_DISABLED = "1"; // never re-fire session sensors from the worker
-  const cwd = process.cwd();
-  const env = process.env;
-  const repo = env.RAFA_REPO;
-
-  // Real platform call — mirrors boot.sh exactly (JSON-RPC 2.0 to RAFA_MCP_URL, key
-  // in the Authorization header never logged, `repo` = RAFA_REPO). The route spreads
-  // the tool payload to the TOP LEVEL of structuredContent, so { ok, attempt, … } is
-  // read there. Reuses mcp-client's transport error shaping.
-  const call = async (tool, args = {}) => {
-    // callTool derives repo/key/url from rafa.json + env; in the image RAFA_MCP_URL,
-    // RAFA_MCP_KEY, and the committed rafa.json are all present, and the reconcile
-    // tools scope by the agent key. Pass repo explicitly for parity with boot.sh.
-    return callTool(cwd, tool, { repo, ...args });
-  };
-
-  // Real judge seam — the org's own LLM (Agent SDK, ANTHROPIC_API_KEY from the image
-  // secrets). Claim-level truth ONLY; the doctrine decides everything else. Kept
-  // behind loadAgentSdk so tests never touch it.
-  const judge = async (candidate) => {
-    const sdk = await loadAgentSdk(cwd);
-    const run = sdk.query({
-      prompt:
-        "You are the distiller's claim judge. The checked-out repo IS merged main.\n" +
-        "Judge ONLY whether this note's normative claim still holds against the code as it now\n" +
-        "stands. Its citations already ground (the doctrine verified that). Reply with a single\n" +
-        `JSON line {"hold": true|false, "reason": "<cited reason if false>"}.\n\n` +
-        `Note (${candidate.path}):\n${candidate.content}`,
-      options: { cwd, permissionMode: "bypassPermissions", allowedTools: ["Read", "Grep", "Glob", "Bash"], settingSources: [], maxTurns: 30 },
-    });
-    let verdict = { hold: true };
-    let tokens = 0;
-    for await (const m of run) {
-      if (m.type === "assistant")
-        for (const b of m.message?.content ?? []) {
-          if (b.type !== "text") continue;
-          const mm = b.text.match(/\{[^{}]*"hold"[^{}]*\}/);
-          if (mm) { try { verdict = JSON.parse(mm[0]); } catch { /* keep last */ } }
-        }
-      if (m.type === "result") {
-        if (m.subtype !== "success") throw deterministicFailure(`judge did not complete (${m.subtype})`);
-        // Usage from the SDK result message (same field distill.mjs meters on) →
-        // the metering wrapper accumulates it into reconcile_report's meter.tokens.
-        tokens += (m.usage?.input_tokens ?? 0) + (m.usage?.output_tokens ?? 0);
-      }
-    }
-    return { ...verdict, tokens };
-  };
-
-  // Real working-set collector — the folded branches the run reconciles. The
-  // reconcile fold groups them; here we enumerate live branches and gather each.
-  const collectSets = async () => {
-    const { branches } = await call("list_working_sets", {});
-    const sets = [];
-    for (const b of branches ?? []) {
-      const branch = typeof b === "string" ? b : b.branch;
-      const allFiles = (await call("get_working_set", { branch, status: "active" })).files ?? [];
-      // Intent records are provenance, never arbitrated claims (P2) — the
-      // note-shaped doctrine must not judge them.
-      const files = allFiles.filter((f) => !f.path.startsWith("intent/"));
-      if (files.length)
-        sets.push({
-          branch,
-          // Set-level grounding: the newest per-row capture sha when the rows
-          // carry one (branch listings never did — b.capturedAtSha was always
-          // undefined), else the triggering merge sha as before.
-          capturedAtSha:
-            files
-              .filter((f) => typeof f.capturedAtSha === "string" && f.capturedAtSha)
-              .sort((a, b2) => (b2.updatedAt ?? 0) - (a.updatedAt ?? 0))[0]
-              ?.capturedAtSha || mergeShaOf(env),
-          mergedAt: (typeof b === "object" && b.mergedAt) || 0,
-          files: files.map((f) => ({
-            path: f.path,
-            content: f.content,
-            ...(f.capturedAtSha ? { capturedAtSha: f.capturedAtSha } : {}),
-          })),
-        });
-    }
-    return sets;
-  };
-
-  const brainRoot = join(cwd, ".rafa", "brain");
-  const authorSurvivor = ({ path, content }) => {
-    const abs = join(cwd, ".rafa", path);
-    mkdirSync(dirname(abs), { recursive: true });
-    writeFileSync(abs, content);
-  };
-  const removeNote = (path) => rmSync(join(cwd, ".rafa", path), { force: true });
-  const authorReport = ({ path, content }) => {
-    const abs = join(cwd, ".rafa", path);
-    mkdirSync(dirname(abs), { recursive: true });
-    writeFileSync(abs, content);
-  };
-
-  // Gates re-run OURS, trust-but-verify — the authoring push order (contract §11):
-  // okf emit → verify-citations → compile. A non-zero anywhere is a deterministic
-  // gate rejection.
-  const runGates = () => {
-    if (runOkfEmit([`--repo=${repo || ""}`]) !== 0)
-      return { ok: false, message: "okf emit failed on the authored brain" };
-    if (runVerifyCitations([]) !== 0)
-      return { ok: false, message: "citation checker failed on the authored brain" };
-    if (runCompile([`--repo=${repo || ""}`]) !== 0)
-      return { ok: false, message: "compile gate failed on the authored brain" };
-    return { ok: true };
-  };
-  const doPush = () => push(["--verb=distill"]); // push.mjs re-runs the same gates + pushes; NEVER --force
-
-  // Mirror the org brain first (the authoring target the survivors fold into).
-  // Prep failures MUST self-report (live-caught 2026-07-18: a safe.directory
-  // throw here died before the state plane ever started — running row, no
-  // lastError, no logs, invisible until someone ssh'd the sandbox). Best-effort
-  // report, then rethrow: the row shows the reason and the sweep retries.
-  try {
-    await pull(["--full"]);
-  } catch (e) {
-    const message = `brain mirror (pull --full) failed: ${e instanceof Error ? e.message.split("\n")[0] : e}`;
-    try {
-      await reportFailure({
-        call,
-        reconciliationId: env.RAFA_LEAD_RECONCILIATION_ID,
-        attempt: Number(env.RAFA_ATTEMPT),
-        actor: { model: env.RAFA_MODEL || "claude-opus-4-8", agent: "distiller", runner: "sandbox" },
-        errorClass: "transient",
-        message,
-      });
-    } catch {
-      /* the report is best-effort — the lease/sweep loop still recovers */
-    }
-    throw e;
-  }
-  if (!existsSync(brainRoot)) mkdirSync(brainRoot, { recursive: true });
-
-  const result = await runDistiller({
-    env, cwd, call, judge, collectSets, authorSurvivor, removeNote, authorReport, runGates, doPush,
-    orgNotes: async () => loadBrainNotes(cwd), // the mirrored brain is the sweep source
-  });
-  if (!result.ok && !result.fenced) process.exitCode = 1;
-  return result;
-}
-
-function mergeShaOf(env) {
-  return env.RAFA_MERGE_SHA || "";
-}