@remnic/bench 9.69.38 → 9.69.40

package/dist/index.js

@@ -187,7 +187,7 @@ import {
   writeLeaderboardArtifactsForResult,
   writeRepeatedFailureRunMetadata,
   writeRepeatedFailureStatistics
-} from "./chunk-PWFYSAUK.js";
+} from "./chunk-WTC5UT2S.js";
 
 // src/build-week-evidence-receipt.ts
 import { createHash as createHash2 } from "crypto";
@@ -13963,7 +13963,7 @@ async function resolveLocalLabRuntimeProfile(options) {
 
 // src/benchmark.ts
 import fs from "fs";
-import path32 from "path";
+import path33 from "path";
 import { createHash as createHash17 } from "crypto";
 import { expandTildePath as expandTildePath3 } from "@remnic/core";
 
@@ -23994,8 +23994,8 @@ function isPlainObject4(value) {
 
 // src/benchmarks/published/memoryagentbench/runner.ts
 import { randomUUID as randomUUID9 } from "crypto";
-import { access, readFile as readFile15 } from "fs/promises";
-import path15 from "path";
+import { readFile as readFile16 } from "fs/promises";
+import path16 from "path";
 
 // src/benchmarks/published/memoryagentbench/fixture.ts
 var MEMORY_AGENT_BENCH_SMOKE_FIXTURE = [
@@ -24067,6 +24067,172 @@ var MEMORY_AGENT_BENCH_SMOKE_FIXTURE = [
   }
 ];
 
+// src/benchmarks/published/memoryagentbench/recsys-entity-mapping.ts
+import { lstatSync, realpathSync } from "fs";
+import { access, readFile as readFile15 } from "fs/promises";
+import path15 from "path";
+async function loadRecSysEntityMapping(datasetDir) {
+  const candidates = recsysEntityMappingCandidates(datasetDir);
+  for (const candidate of candidates) {
+    if (!isSafeRecsysMappingCandidate(candidate, datasetDir)) {
+      continue;
+    }
+    if (!await fileExists(candidate)) {
+      continue;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(await readFile15(candidate, "utf8"));
+    } catch (error) {
+      console.error(
+        `  [WARN] MemoryAgentBench ReDial entity mapping ${candidate} is invalid JSON; trying the next candidate: ${error instanceof Error ? error.message : String(error)}`
+      );
+      continue;
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+      console.error(
+        `  [WARN] MemoryAgentBench ReDial entity mapping ${candidate} must be an object; trying the next candidate.`
+      );
+      continue;
+    }
+    const idToName = /* @__PURE__ */ new Map();
+    let invalidMapping = false;
+    for (const [rawName, rawId] of Object.entries(parsed)) {
+      const id = typeof rawId === "number" ? rawId : Number(rawId);
+      if (!Number.isInteger(id)) {
+        console.error(
+          `  [WARN] MemoryAgentBench ReDial entity mapping ${candidate} has non-integer id for ${rawName}; trying the next candidate.`
+        );
+        invalidMapping = true;
+        break;
+      }
+      idToName.set(id, extractMovieName(rawName));
+    }
+    if (invalidMapping) {
+      continue;
+    }
+    if (idToName.size === 0) {
+      console.error(
+        `  [WARN] MemoryAgentBench ReDial entity mapping ${candidate} is empty; trying the next candidate.`
+      );
+      continue;
+    }
+    return {
+      idToName,
+      movieCandidates: [...new Set(idToName.values())],
+      aliasCounts: countMovieAliases([...new Set(idToName.values())]),
+      sourcePath: candidate
+    };
+  }
+  return null;
+}
+async function requireRecSysEntityMapping(datasetDir) {
+  const mapping = await loadRecSysEntityMapping(datasetDir);
+  if (!mapping) {
+    throw new Error(
+      `MemoryAgentBench ReDial samples require a valid ReDial entity mapping. Expected one of: ${recsysEntityMappingCandidates(datasetDir).join(", ") || "entity2id.json under the dataset directory"}.`
+    );
+  }
+  return mapping;
+}
+function movieAliases(movie) {
+  const aliases = [movie];
+  const titleWithoutYear = movie.replace(/\s*\(\d{4}\)\s*$/, "").trim();
+  if (titleWithoutYear.length >= 2 && titleWithoutYear !== movie) {
+    aliases.push(titleWithoutYear);
+  }
+  const titleWithoutArticle = titleWithoutYear.replace(/^(?:the|a|an)\s+/i, "").trim();
+  if (titleWithoutArticle.length >= 2 && titleWithoutArticle !== titleWithoutYear) {
+    aliases.push(titleWithoutArticle);
+  }
+  return aliases;
+}
+function recsysEntityMappingCandidates(datasetDir) {
+  if (!datasetDir) {
+    return [];
+  }
+  const absoluteDatasetDir = path15.resolve(datasetDir);
+  const roots = [
+    absoluteDatasetDir,
+    path15.dirname(absoluteDatasetDir)
+  ];
+  const canonicalSuffixes = [
+    path15.join("processed_data", "Recsys_Redial", "entity2id.json"),
+    path15.join("Recsys_Redial", "entity2id.json")
+  ];
+  const looseSuffixes = ["entity2id.json"];
+  return [
+    ...roots.flatMap(
+      (root) => canonicalSuffixes.map((suffix) => path15.join(root, suffix))
+    ),
+    ...looseSuffixes.map((suffix) => path15.join(absoluteDatasetDir, suffix))
+  ];
+}
+function isSafeRecsysMappingCandidate(candidate, datasetDir) {
+  if (!datasetDir) {
+    return false;
+  }
+  const root = path15.dirname(path15.resolve(datasetDir));
+  const resolvedRoot = path15.resolve(root);
+  const resolvedCandidate = path15.resolve(candidate);
+  const rel = path15.relative(resolvedRoot, resolvedCandidate);
+  if (rel === "" || rel === ".." || rel.startsWith(`..${path15.sep}`) || path15.isAbsolute(rel)) {
+    return false;
+  }
+  let current = resolvedRoot;
+  for (const part of rel.split(path15.sep)) {
+    if (part === "" || part === ".") {
+      continue;
+    }
+    current = path15.join(current, part);
+    try {
+      if (lstatSync(current).isSymbolicLink()) {
+        return false;
+      }
+    } catch {
+      return false;
+    }
+  }
+  try {
+    const rootReal = realpathSync(resolvedRoot);
+    const candidateReal = realpathSync(resolvedCandidate);
+    const realRel = path15.relative(rootReal, candidateReal);
+    return realRel !== "" && realRel !== ".." && !realRel.startsWith(`..${path15.sep}`) && !path15.isAbsolute(realRel);
+  } catch {
+    return false;
+  }
+}
+async function fileExists(filePath) {
+  try {
+    await access(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function extractMovieName(rawName) {
+  const filename = rawName.split("/").pop() ?? rawName;
+  const decodedFilename = decodeUrlComponentSafely(filename);
+  return decodedFilename.replace(/[_>]+/g, " ").replace(/\((\d{4})\s+film\)$/i, "($1)").replace(/\s+/g, " ").trim();
+}
+function decodeUrlComponentSafely(value) {
+  try {
+    return decodeURIComponent(value);
+  } catch {
+    return value;
+  }
+}
+function countMovieAliases(movieCandidates) {
+  const counts2 = /* @__PURE__ */ new Map();
+  for (const movie of movieCandidates) {
+    for (const alias of movieAliases(movie)) {
+      const normalizedAlias = alias.toLowerCase();
+      counts2.set(normalizedAlias, (counts2.get(normalizedAlias) ?? 0) + 1);
+    }
+  }
+  return counts2;
+}
+
 // src/benchmarks/published/memoryagentbench/runner.ts
 var DATASET_SPLITS2 = [
   {
@@ -24926,28 +25092,6 @@ function findMovieCandidateMention(normalizedLine, movie, aliasCounts) {
 function stripTrailingRecommendationPunctuation(value) {
   return value.replace(/^["'`]+/g, "").replace(/["'`.!?;:]+$/g, "").trim();
 }
-function countMovieAliases(movieCandidates) {
-  const counts2 = /* @__PURE__ */ new Map();
-  for (const movie of movieCandidates) {
-    for (const alias of movieAliases(movie)) {
-      const normalizedAlias = alias.toLowerCase();
-      counts2.set(normalizedAlias, (counts2.get(normalizedAlias) ?? 0) + 1);
-    }
-  }
-  return counts2;
-}
-function movieAliases(movie) {
-  const aliases = [movie];
-  const titleWithoutYear = movie.replace(/\s*\(\d{4}\)\s*$/, "").trim();
-  if (titleWithoutYear.length >= 2 && titleWithoutYear !== movie) {
-    aliases.push(titleWithoutYear);
-  }
-  const titleWithoutArticle = titleWithoutYear.replace(/^(?:the|a|an)\s+/i, "").trim();
-  if (titleWithoutArticle.length >= 2 && titleWithoutArticle !== titleWithoutYear) {
-    aliases.push(titleWithoutArticle);
-  }
-  return aliases;
-}
 function findDelimitedIndex(haystack, needle) {
   let start = 0;
   while (start < haystack.length) {
@@ -25009,108 +25153,6 @@ function editDistance(a, b) {
   }
   return previous[b.length] ?? 0;
 }
-async function loadRecSysEntityMapping(datasetDir) {
-  const candidates = recsysEntityMappingCandidates(datasetDir);
-  for (const candidate of candidates) {
-    if (!await fileExists(candidate)) {
-      continue;
-    }
-    let parsed;
-    try {
-      parsed = JSON.parse(await readFile15(candidate, "utf8"));
-    } catch (error) {
-      console.error(
-        `  [WARN] MemoryAgentBench ReDial entity mapping ${candidate} is invalid JSON; trying the next candidate: ${error instanceof Error ? error.message : String(error)}`
-      );
-      continue;
-    }
-    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
-      console.error(
-        `  [WARN] MemoryAgentBench ReDial entity mapping ${candidate} must be an object; trying the next candidate.`
-      );
-      continue;
-    }
-    const idToName = /* @__PURE__ */ new Map();
-    let invalidMapping = false;
-    for (const [rawName, rawId] of Object.entries(parsed)) {
-      const id = typeof rawId === "number" ? rawId : Number(rawId);
-      if (!Number.isInteger(id)) {
-        console.error(
-          `  [WARN] MemoryAgentBench ReDial entity mapping ${candidate} has non-integer id for ${rawName}; trying the next candidate.`
-        );
-        invalidMapping = true;
-        break;
-      }
-      idToName.set(id, extractMovieName(rawName));
-    }
-    if (invalidMapping) {
-      continue;
-    }
-    if (idToName.size === 0) {
-      console.error(
-        `  [WARN] MemoryAgentBench ReDial entity mapping ${candidate} is empty; trying the next candidate.`
-      );
-      continue;
-    }
-    return {
-      idToName,
-      movieCandidates: [...new Set(idToName.values())],
-      aliasCounts: countMovieAliases([...new Set(idToName.values())]),
-      sourcePath: candidate
-    };
-  }
-  return null;
-}
-async function requireRecSysEntityMapping(datasetDir) {
-  const mapping = await loadRecSysEntityMapping(datasetDir);
-  if (!mapping) {
-    throw new Error(
-      `MemoryAgentBench ReDial samples require a valid ReDial entity mapping. Expected one of: ${recsysEntityMappingCandidates(datasetDir).join(", ") || "entity2id.json under the dataset directory"}.`
-    );
-  }
-  return mapping;
-}
-function recsysEntityMappingCandidates(datasetDir) {
-  if (!datasetDir) {
-    return [];
-  }
-  const absoluteDatasetDir = path15.resolve(datasetDir);
-  const roots = [
-    absoluteDatasetDir,
-    path15.dirname(absoluteDatasetDir)
-  ];
-  const canonicalSuffixes = [
-    path15.join("processed_data", "Recsys_Redial", "entity2id.json"),
-    path15.join("Recsys_Redial", "entity2id.json")
-  ];
-  const looseSuffixes = ["entity2id.json"];
-  return [
-    ...roots.flatMap(
-      (root) => canonicalSuffixes.map((suffix) => path15.join(root, suffix))
-    ),
-    ...looseSuffixes.map((suffix) => path15.join(absoluteDatasetDir, suffix))
-  ];
-}
-async function fileExists(filePath) {
-  try {
-    await access(filePath);
-    return true;
-  } catch {
-    return false;
-  }
-}
-function extractMovieName(rawName) {
-  const filename = rawName.split("/").pop() ?? rawName;
-  const decodedFilename = decodeUrlComponentSafely(filename);
-  return decodedFilename.replace(/[_>]+/g, " ").replace(/\((\d{4})\s+film\)$/i, "($1)").replace(/\s+/g, " ").trim();
-}
-function decodeUrlComponentSafely(value) {
-  try {
-    return decodeURIComponent(value);
-  } catch {
-    return value;
-  }
-}
 async function loadDataset9(mode, datasetDir, limit) {
   const normalizedLimit = normalizeLimit8(limit);
   const ensureDatasetItems = (items) => {
@@ -25125,7 +25167,7 @@ async function loadDataset9(mode, datasetDir, limit) {
     const datasetErrors = [];
     for (const filename of DATASET_BUNDLE_CANDIDATES) {
       const parsed = await tryReadDatasetFile(
-        path15.join(datasetDir, filename),
+        path16.join(datasetDir, filename),
         filename,
         datasetErrors
       );
@@ -25142,7 +25184,7 @@ async function loadDataset9(mode, datasetDir, limit) {
       let splitData;
       for (const filename of splitConfig.candidates) {
         try {
-          splitData = await readDatasetFile(path15.join(datasetDir, filename), filename);
+          splitData = await readDatasetFile(path16.join(datasetDir, filename), filename);
           break;
         } catch (error) {
           if (!isFileNotFoundError2(error)) {
@@ -25180,7 +25222,7 @@ async function loadDataset9(mode, datasetDir, limit) {
   return ensureDatasetItems(applyLimit8(MEMORY_AGENT_BENCH_SMOKE_FIXTURE, normalizedLimit));
 }
 async function readDatasetFile(filePath, filename) {
-  const raw = await readFile15(filePath, "utf8");
+  const raw = await readFile16(filePath, "utf8");
   const parsed = filename.endsWith(".jsonl") ? parseJsonLines(raw, filename) : parseJsonArray(raw, filename);
   return parsed.map(
     (item, index) => parseMemoryAgentBenchItem(item, `${filename} item ${index + 1}`)
@@ -25791,7 +25833,7 @@ function loadCases(mode, limit) {
 // src/benchmarks/remnic/extraction-judge-calibration/runner.ts
 import { randomUUID as randomUUID11 } from "crypto";
 import os3 from "os";
-import path16 from "path";
+import path17 from "path";
 import {
   createVerdictCache,
   judgeFactDurability,
@@ -25901,8 +25943,8 @@ var extractionJudgeCalibrationDefinition = {
 async function runExtractionJudgeCalibrationBenchmark(options) {
   const cases = loadCases2(options.mode, options.limit);
   const config = parseConfig2({
-    memoryDir: path16.join(os3.tmpdir(), "remnic-bench-extraction-judge"),
-    workspaceDir: path16.join(os3.tmpdir(), "remnic-bench-extraction-judge-workspace"),
+    memoryDir: path17.join(os3.tmpdir(), "remnic-bench-extraction-judge"),
+    workspaceDir: path17.join(os3.tmpdir(), "remnic-bench-extraction-judge-workspace"),
     openaiApiKey: "bench-test-key",
     extractionJudgeEnabled: true,
     extractionJudgeBatchSize: 4,
@@ -27634,7 +27676,7 @@ function constantAggregate2(value) {
 
 // src/benchmarks/remnic/entity-consolidation/runner.ts
 import os4 from "os";
-import path17 from "path";
+import path18 from "path";
 import { randomUUID as randomUUID14 } from "crypto";
 import { mkdtemp as mkdtemp4, rm as rm5 } from "fs/promises";
 import { StorageManager as StorageManager2 } from "@remnic/core";
@@ -27797,7 +27839,7 @@ function loadCases4(mode, limit) {
   return limited;
 }
 async function executeCase(sample) {
-  const tmpDir = await mkdtemp4(path17.join(os4.tmpdir(), "remnic-bench-entity-consolidation-"));
+  const tmpDir = await mkdtemp4(path18.join(os4.tmpdir(), "remnic-bench-entity-consolidation-"));
   try {
     const storage = new StorageManager2(tmpDir);
     await storage.ensureDirectories();
@@ -27976,9 +28018,9 @@ function parseNonNegativeInt(rawValue) {
 
 // src/benchmarks/remnic/page-versioning/runner.ts
 import { randomUUID as randomUUID15 } from "crypto";
-import { mkdir as mkdir5, mkdtemp as mkdtemp5, readFile as readFile16, rm as rm6, writeFile as writeFile5 } from "fs/promises";
+import { mkdir as mkdir5, mkdtemp as mkdtemp5, readFile as readFile17, rm as rm6, writeFile as writeFile5 } from "fs/promises";
 import os5 from "os";
-import path18 from "path";
+import path19 from "path";
 import {
   createVersion,
   diffVersions,
@@ -28142,10 +28184,10 @@ function loadCases5(mode, limit) {
   return limited;
 }
 async function executeCase2(sample, dependencies) {
-  const tmpDir = await mkdtemp5(path18.join(os5.tmpdir(), "remnic-bench-page-versioning-"));
+  const tmpDir = await mkdtemp5(path19.join(os5.tmpdir(), "remnic-bench-page-versioning-"));
   try {
-    const factsDir = path18.join(tmpDir, "facts");
-    const pagePath = path18.join(factsDir, `${sample.id}.md`);
+    const factsDir = path19.join(tmpDir, "facts");
+    const pagePath = path19.join(factsDir, `${sample.id}.md`);
     await mkdir5(factsDir, { recursive: true });
     const config = versioningConfig();
     switch (sample.scenario) {
@@ -28156,7 +28198,7 @@ async function executeCase2(sample, dependencies) {
         await dependencies.createVersion(pagePath, "modified content", "write", config, void 0, void 0, tmpDir);
         await dependencies.revertToVersion(pagePath, "1", config, void 0, tmpDir);
         const history = await dependencies.listVersions(pagePath, config, tmpDir);
-        const pageContent = await readFile16(pagePath, "utf-8");
+        const pageContent = await readFile17(pagePath, "utf-8");
         const observed = await dependencies.getVersion(pagePath, "3", config, tmpDir);
         return {
           versionIds: history.versions.map((version) => version.versionId),
@@ -28173,7 +28215,7 @@ async function executeCase2(sample, dependencies) {
           await dependencies.createVersion(pagePath, content, "write", pruningConfig, void 0, void 0, tmpDir);
         }
         const history = await dependencies.listVersions(pagePath, pruningConfig, tmpDir);
-        const pageContent = await readFile16(pagePath, "utf-8");
+        const pageContent = await readFile17(pagePath, "utf-8");
         const prunedIds = [];
         for (const versionId of ["1", "2"]) {
           try {
@@ -28214,7 +28256,7 @@ async function executeCase2(sample, dependencies) {
           tmpDir
         );
         const history = await dependencies.listVersions(pagePath, config, tmpDir);
-        const pageContent = await readFile16(pagePath, "utf-8");
+        const pageContent = await readFile17(pagePath, "utf-8");
         const diff = await dependencies.diffVersions(pagePath, "1", "2", config, tmpDir);
         const observedLines = normalizeDiffChangedLines(diff);
         return {
@@ -30501,7 +30543,7 @@ function loadCases9(mode, limit) {
 import { randomUUID as randomUUID22 } from "crypto";
 import { mkdtemp as mkdtemp6, rm as rm7 } from "fs/promises";
 import os6 from "os";
-import path19 from "path";
+import path20 from "path";
 import {
   StorageManager as StorageManager3,
   parseConfig as parseConfig3,
@@ -30632,7 +30674,7 @@ async function runProceduralRecallBenchmark(options) {
   }
   for (const sample of e2eCases) {
     const startedAt = performance.now();
-    const dir = await mkdtemp6(path19.join(os6.tmpdir(), "remnic-bench-procedural-recall-"));
+    const dir = await mkdtemp6(path20.join(os6.tmpdir(), "remnic-bench-procedural-recall-"));
     let section = null;
     try {
       const storage = new StorageManager3(dir);
@@ -30653,7 +30695,7 @@ ${body}`,
       );
       const config = parseConfig3({
         memoryDir: dir,
-        workspaceDir: path19.join(dir, "ws"),
+        workspaceDir: path20.join(dir, "ws"),
         openaiApiKey: "bench-key",
         procedural: {
           enabled: sample.proceduralEnabled !== false,
@@ -30725,7 +30767,7 @@ ${body}`,
 import { randomUUID as randomUUID23 } from "crypto";
 import { mkdtemp as mkdtemp7, writeFile as writeFile6, rm as rm8, mkdir as mkdir6, realpath as realpath5 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
-import path20 from "path";
+import path21 from "path";
 
 // src/ingestion-scorer.ts
 function normalize(value) {
@@ -31227,12 +31269,12 @@ async function runIngestionEntityRecallBenchmark(options) {
     throw new Error("ingestionAdapter is required for ingestion benchmarks");
   }
   const fixture = emailFixture.generate();
-  const fixtureDir = await mkdtemp7(path20.join(tmpdir2(), "bench-email-"));
+  const fixtureDir = await mkdtemp7(path21.join(tmpdir2(), "bench-email-"));
   try {
     await options.ingestionAdapter.reset();
     for (const file of fixture.files) {
-      const filePath = path20.join(fixtureDir, file.relativePath);
-      await mkdir6(path20.dirname(filePath), { recursive: true });
+      const filePath = path21.join(fixtureDir, file.relativePath);
+      await mkdir6(path21.dirname(filePath), { recursive: true });
       await writeFile6(filePath, file.content, "utf8");
     }
     const { result: ingestionLog, durationMs } = await timed(
@@ -31362,7 +31404,7 @@ async function buildResult(options, tasks, totalLatencyMs) {
 import { randomUUID as randomUUID24 } from "crypto";
 import { mkdtemp as mkdtemp8, writeFile as writeFile7, rm as rm9, mkdir as mkdir7, realpath as realpath6 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import path21 from "path";
+import path22 from "path";
 var ingestionSchemaCompletenessDefinition = {
   id: "ingestion-schema-completeness",
   title: "Ingestion: Schema Completeness",
@@ -31381,12 +31423,12 @@ async function runIngestionSchemaCompletenessBenchmark(options) {
     throw new Error("ingestionAdapter is required for ingestion benchmarks");
   }
   const fixture = emailFixture.generate();
-  const fixtureDir = await mkdtemp8(path21.join(tmpdir3(), "bench-email-"));
+  const fixtureDir = await mkdtemp8(path22.join(tmpdir3(), "bench-email-"));
   try {
     await options.ingestionAdapter.reset();
     for (const file of fixture.files) {
-      const filePath = path21.join(fixtureDir, file.relativePath);
-      await mkdir7(path21.dirname(filePath), { recursive: true });
+      const filePath = path22.join(fixtureDir, file.relativePath);
+      await mkdir7(path22.dirname(filePath), { recursive: true });
       await writeFile7(filePath, file.content, "utf8");
     }
     const { result: ingestionLog, durationMs } = await timed(
@@ -31535,7 +31577,7 @@ async function runIngestionSchemaCompletenessBenchmark(options) {
 import { randomUUID as randomUUID25 } from "crypto";
 import { mkdtemp as mkdtemp9, writeFile as writeFile8, rm as rm10, mkdir as mkdir8, realpath as realpath7 } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
-import path22 from "path";
+import path23 from "path";
 var ingestionBacklinkF1Definition = {
   id: "ingestion-backlink-f1",
   title: "Ingestion: Backlink F1",
@@ -31554,12 +31596,12 @@ async function runIngestionBacklinkF1Benchmark(options) {
     throw new Error("ingestionAdapter is required for ingestion benchmarks");
   }
   const fixture = emailFixture.generate();
-  const fixtureDir = await mkdtemp9(path22.join(tmpdir4(), "bench-email-"));
+  const fixtureDir = await mkdtemp9(path23.join(tmpdir4(), "bench-email-"));
   try {
     await options.ingestionAdapter.reset();
     for (const file of fixture.files) {
-      const filePath = path22.join(fixtureDir, file.relativePath);
-      await mkdir8(path22.dirname(filePath), { recursive: true });
+      const filePath = path23.join(fixtureDir, file.relativePath);
+      await mkdir8(path23.dirname(filePath), { recursive: true });
       await writeFile8(filePath, file.content, "utf8");
     }
     const { result: ingestionLog, durationMs } = await timed(
@@ -31636,7 +31678,7 @@ async function runIngestionBacklinkF1Benchmark(options) {
 import { randomUUID as randomUUID26 } from "crypto";
 import { mkdtemp as mkdtemp10, writeFile as writeFile9, rm as rm11, mkdir as mkdir9, realpath as realpath8 } from "fs/promises";
 import { tmpdir as tmpdir5 } from "os";
-import path23 from "path";
+import path24 from "path";
 var INGESTION_SETUP_FRICTION_LOWER_IS_BETTER = /* @__PURE__ */ new Set(["setup_friction", "commands_count", "prompts_count", "errors_count"]);
 var ingestionSetupFrictionDefinition = {
   id: "ingestion-setup-friction",
@@ -31656,12 +31698,12 @@ async function runIngestionSetupFrictionBenchmark(options) {
     throw new Error("ingestionAdapter is required for ingestion benchmarks");
   }
   const fixture = emailFixture.generate();
-  const fixtureDir = await mkdtemp10(path23.join(tmpdir5(), "bench-friction-"));
+  const fixtureDir = await mkdtemp10(path24.join(tmpdir5(), "bench-friction-"));
   try {
     await options.ingestionAdapter.reset();
     for (const file of fixture.files) {
-      const filePath = path23.join(fixtureDir, file.relativePath);
-      await mkdir9(path23.dirname(filePath), { recursive: true });
+      const filePath = path24.join(fixtureDir, file.relativePath);
+      await mkdir9(path24.dirname(filePath), { recursive: true });
       await writeFile9(filePath, file.content, "utf8");
     }
     const { result: ingestionLog, durationMs } = await timed(
@@ -31742,7 +31784,7 @@ async function runIngestionSetupFrictionBenchmark(options) {
 import { randomUUID as randomUUID27 } from "crypto";
 import { mkdtemp as mkdtemp11, writeFile as writeFile10, rm as rm12, mkdir as mkdir10, realpath as realpath9 } from "fs/promises";
 import { tmpdir as tmpdir6 } from "os";
-import path24 from "path";
+import path25 from "path";
 var CITATION_SUPPORT_THRESHOLD = 0.72;
 var ingestionCitationAccuracyDefinition = {
   id: "ingestion-citation-accuracy",
@@ -31801,10 +31843,10 @@ function resolveCitedSources(sourceRefs, seeAlso, pageRef, sourceContentMap) {
     return "";
   }
   for (const ref of normalizedRefs) {
-    const refBase = path24.basename(ref).toLowerCase();
+    const refBase = path25.basename(ref).toLowerCase();
     let matched = false;
     for (const [relativePath, content] of sourceContentMap) {
-      if (relativePath === ref || relativePath.endsWith(ref) || path24.basename(relativePath).toLowerCase() === refBase) {
+      if (relativePath === ref || relativePath.endsWith(ref) || path25.basename(relativePath).toLowerCase() === refBase) {
         resolved.push(content);
         matched = true;
         break;
@@ -31820,9 +31862,9 @@ function resolveCitedSources(sourceRefs, seeAlso, pageRef, sourceContentMap) {
   if (normalizedRefs.length > 0) {
     return "";
   }
-  const pageBase = path24.basename(pageRef).toLowerCase();
+  const pageBase = path25.basename(pageRef).toLowerCase();
   for (const [relativePath, content] of sourceContentMap) {
-    if (path24.basename(relativePath).toLowerCase() === pageBase) {
+    if (path25.basename(relativePath).toLowerCase() === pageBase) {
       return content;
     }
   }
@@ -31833,12 +31875,12 @@ async function runIngestionCitationAccuracyBenchmark(options) {
     throw new Error("ingestionAdapter is required for ingestion benchmarks");
   }
   const fixture = emailFixture.generate();
-  const fixtureDir = await mkdtemp11(path24.join(tmpdir6(), "bench-citation-"));
+  const fixtureDir = await mkdtemp11(path25.join(tmpdir6(), "bench-citation-"));
   try {
     await options.ingestionAdapter.reset();
     for (const file of fixture.files) {
-      const filePath = path24.join(fixtureDir, file.relativePath);
-      await mkdir10(path24.dirname(filePath), { recursive: true });
+      const filePath = path25.join(fixtureDir, file.relativePath);
+      await mkdir10(path25.dirname(filePath), { recursive: true });
       await writeFile10(filePath, file.content, "utf8");
     }
     const benchmarkStart = performance.now();
@@ -32224,7 +32266,7 @@ var ASSISTANT_MORNING_BRIEF_SMOKE_SCENARIOS = ASSISTANT_MORNING_BRIEF_SCENARIOS.
 
 // src/benchmarks/remnic/_assistant-common/runner.ts
 import { randomUUID as randomUUID28 } from "crypto";
-import path26 from "path";
+import path27 from "path";
 
 // src/run-seeds.ts
 function buildBenchmarkRunSeeds(runCount, baseSeed) {
@@ -32316,7 +32358,7 @@ function pairedDeltaConfidenceInterval(candidateValues, baselineValues, options
 // src/judges/sealed-rubric.ts
 import { createHash as createHash10 } from "crypto";
 import { appendFileSync, mkdirSync } from "fs";
-import path25 from "path";
+import path26 from "path";
 
 // src/judges/sealed-prompts/assistant-rubric-v1.ts
 var ASSISTANT_RUBRIC_V1 = `# Assistant rubric v1 (sealed)
@@ -32596,7 +32638,7 @@ function createSpotCheckFileLogger(options) {
     return { log() {
     } };
   }
-  const logPath = path25.join(directory, `${runId}.jsonl`);
+  const logPath = path26.join(directory, `${runId}.jsonl`);
   let written = 0;
   let warnedOnWriteFailure = false;
   const cap = typeof sampleSize === "number" && sampleSize > 0 ? sampleSize : 5;
@@ -32685,7 +32727,7 @@ async function runAssistantBenchmark(definition, scenarios, resolved, runnerOpti
   const runId = buildRunId(definition.id);
   const spotCheckLogger = createSpotCheckFileLogger({
     runId,
-    directory: runnerOptions.spotCheckDir ?? path26.join(process.cwd(), "benchmarks", "results", "spot-checks"),
+    directory: runnerOptions.spotCheckDir ?? path27.join(process.cwd(), "benchmarks", "results", "spot-checks"),
     sampleRate: 0.35,
     sampleSize: 5
   });
@@ -33334,7 +33376,7 @@ async function runAssistantSynthesisBenchmark(options) {
 
 // src/benchmarks/remnic/buffer-surprise-trigger/runner.ts
 import { randomUUID as randomUUID29 } from "crypto";
-import path27 from "path";
+import path28 from "path";
 import os7 from "os";
 import { mkdir as mkdir11, rm as rm13 } from "fs/promises";
 import {
@@ -33565,7 +33607,7 @@ function hasExplicitTopicPivotCue(text) {
 }
 async function runBufferSurpriseTriggerBenchmark(options) {
   const cases = loadCases10(options.mode, options.limit);
-  const tmpRoot = path27.join(
+  const tmpRoot = path28.join(
     os7.tmpdir(),
     `remnic-bench-buffer-surprise-${randomUUID29()}`
   );
@@ -33634,11 +33676,11 @@ async function runBufferSurpriseTriggerBenchmark(options) {
   };
 }
 async function runSingleCase(caseDef, options) {
-  const memoryDir = path27.join(
+  const memoryDir = path28.join(
     options.tmpRoot,
     `${caseDef.id}-${options.label}`
   );
-  const workspaceDir = path27.join(memoryDir, "workspace");
+  const workspaceDir = path28.join(memoryDir, "workspace");
   await mkdir11(workspaceDir, { recursive: true });
   const config = parseConfig4({
     memoryDir,
@@ -35904,7 +35946,7 @@ async function runMemCorrectBenchmark(options) {
 // src/benchmarks/remnic/bounded-memory-contracts/runner.ts
 import { randomUUID as randomUUID33 } from "crypto";
 import { mkdir as mkdir12, writeFile as writeFile11 } from "fs/promises";
-import path28 from "path";
+import path29 from "path";
 
 // src/benchmarks/remnic/bounded-memory-contracts/fixture.ts
 import { createHash as createHash12 } from "crypto";
@@ -37136,23 +37178,23 @@ async function runBoundedMemoryContractsBenchmark(options) {
   };
 }
 async function writeArtifacts(outputDir, byCondition, conditionAggregates, tasks) {
-  const root = path28.resolve(outputDir);
-  await mkdir12(path28.join(root, "conditions"), { recursive: true });
-  await mkdir12(path28.join(root, "prompts"), { recursive: true });
-  await mkdir12(path28.join(root, "retrieval"), { recursive: true });
-  await mkdir12(path28.join(root, "scores"), { recursive: true });
+  const root = path29.resolve(outputDir);
+  await mkdir12(path29.join(root, "conditions"), { recursive: true });
+  await mkdir12(path29.join(root, "prompts"), { recursive: true });
+  await mkdir12(path29.join(root, "retrieval"), { recursive: true });
+  await mkdir12(path29.join(root, "scores"), { recursive: true });
   const csvRows = [
     "task_id,condition,family,scope,task_success,should_ask_accuracy,relevant_memory_recall,stale_memory_harm_rate,wrong_scope_retrieval_rate,supersession_respected_rate,citation_coverage,memory_tokens_injected,retrieved_item_count,compression_ratio_vs_raw_transcript"
   ];
   for (const condition of BOUNDED_MEMORY_CONDITIONS) {
     const results = byCondition.get(condition);
-    const condDir = path28.join(root, "conditions", condition);
+    const condDir = path29.join(root, "conditions", condition);
     await mkdir12(condDir, { recursive: true });
     for (const { task, pack, decision } of results) {
       const scores = scoreTaskPair(task, pack, decision);
       const promptMd = renderPromptPack(task, condition, pack);
-      const promptPath = path28.join(root, "prompts", `${task.id}.${condition}.md`);
-      await mkdir12(path28.dirname(promptPath), { recursive: true });
+      const promptPath = path29.join(root, "prompts", `${task.id}.${condition}.md`);
+      await mkdir12(path29.dirname(promptPath), { recursive: true });
       await writeFile11(promptPath, promptMd, "utf8");
       const retrievalJson = `${JSON.stringify(
         {
@@ -37176,7 +37218,7 @@ async function writeArtifacts(outputDir, byCondition, conditionAggregates, tasks
         2
       )}
 `;
-      const retrievalPath = path28.join(root, "retrieval", `${task.id}.${condition}.json`);
+      const retrievalPath = path29.join(root, "retrieval", `${task.id}.${condition}.json`);
       await writeFile11(retrievalPath, retrievalJson, "utf8");
       csvRows.push(
         [
@@ -37198,23 +37240,23 @@ async function writeArtifacts(outputDir, byCondition, conditionAggregates, tasks
       );
     }
     await writeFile11(
-      path28.join(condDir, "summary.json"),
+      path29.join(condDir, "summary.json"),
       `${JSON.stringify(conditionAggregates[condition], null, 2)}
 `,
       "utf8"
     );
   }
-  await writeFile11(path28.join(root, "scores", "per-task.csv"), `${csvRows.join("\n")}
+  await writeFile11(path29.join(root, "scores", "per-task.csv"), `${csvRows.join("\n")}
 `, "utf8");
   await writeFile11(
-    path28.join(root, "scores", "aggregate.json"),
+    path29.join(root, "scores", "aggregate.json"),
     `${JSON.stringify(conditionAggregates, null, 2)}
 `,
     "utf8"
   );
   const report = renderReportMarkdown(tasks, conditionAggregates);
-  await writeFile11(path28.join(root, "report.md"), report, "utf8");
-  return path28.join(root, "report.md");
+  await writeFile11(path29.join(root, "report.md"), report, "utf8");
+  return path29.join(root, "report.md");
 }
 function renderPromptPack(task, condition, pack) {
   const lines = [];
@@ -37264,14 +37306,14 @@ import { createHash as createHash16, randomUUID as randomUUID34 } from "crypto";
 
 // src/benchmarks/remnic/staged-memory/fixture.ts
 import { createHash as createHash15 } from "crypto";
-import { lstat as lstat5, mkdir as mkdir14, readFile as readFile18, rename as rename4, rm as rm15, writeFile as writeFile13 } from "fs/promises";
-import path31 from "path";
+import { lstat as lstat5, mkdir as mkdir14, readFile as readFile19, rename as rename4, rm as rm15, writeFile as writeFile13 } from "fs/promises";
+import path32 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 
 // src/generators/drift-gen/index.ts
 import { createHash as createHash14 } from "crypto";
 import { mkdir as mkdir13, readdir as readdir7, rename as rename3, rm as rm14, writeFile as writeFile12 } from "fs/promises";
-import path30 from "path";
+import path31 from "path";
 
 // src/generators/drift-gen/names.ts
 var PERSON_NAMES = Object.freeze([
@@ -37997,8 +38039,8 @@ function renderUserSessions(rng, user, epochs) {
 
 // src/generators/drift-gen/validate.ts
 import { createHash as createHash13 } from "crypto";
-import { lstat as lstat4, readFile as readFile17, readdir as readdir6 } from "fs/promises";
-import path29 from "path";
+import { lstat as lstat4, readFile as readFile18, readdir as readdir6 } from "fs/promises";
+import path30 from "path";
 var FACT_COUNT_TOLERANCE = 0.1;
 var RATIO_TOLERANCE = 0.05;
 var MAX_QUESTION_ANSWER_LEAKAGE = 0.6;
@@ -38086,7 +38128,7 @@ async function readJsonl(filePath, errors, isShape) {
       errors.push(`symlinked corpus file rejected: ${filePath}`);
       return [];
     }
-    raw = await readFile17(filePath, "utf8");
+    raw = await readFile18(filePath, "utf8");
   } catch {
     errors.push(`missing file: ${filePath}`);
     return [];
@@ -38130,31 +38172,31 @@ async function isNonSymlinkDirectory(dirPath, errors) {
 }
 async function hasNoSymlinkComponents(rootDir, targetPath, errors, description) {
   let current = rootDir;
-  for (const part of path29.relative(rootDir, targetPath).split(path29.sep)) {
+  for (const part of path30.relative(rootDir, targetPath).split(path30.sep)) {
     if (part.length === 0 || part === ".") continue;
-    current = path29.join(current, part);
+    current = path30.join(current, part);
     try {
       if ((await lstat4(current)).isSymbolicLink()) {
-        errors.push(`${description} contains a symlinked path component: ${path29.relative(rootDir, current)}`);
+        errors.push(`${description} contains a symlinked path component: ${path30.relative(rootDir, current)}`);
         return false;
       }
     } catch {
-      errors.push(`${description} is missing: ${path29.relative(rootDir, current)}`);
+      errors.push(`${description} is missing: ${path30.relative(rootDir, current)}`);
       return false;
     }
   }
   return true;
 }
 function corpusRelativePath(corpusDir, targetPath) {
-  return path29.relative(corpusDir, targetPath).split(path29.sep).join("/");
+  return path30.relative(corpusDir, targetPath).split(path30.sep).join("/");
 }
 async function loadSeedDir(corpusDir, seed, errors) {
-  const seedDir = path29.join(corpusDir, String(seed));
+  const seedDir = path30.join(corpusDir, String(seed));
   const empty = { seed, facts: [], probes: [], sessions: [], consumedFiles: [] };
   if (!await isNonSymlinkDirectory(seedDir, errors)) return empty;
-  const goldDir = path29.join(seedDir, "gold");
-  const factsPath = path29.join(goldDir, "facts.jsonl");
-  const probesPath = path29.join(goldDir, "probes.jsonl");
+  const goldDir = path30.join(seedDir, "gold");
+  const factsPath = path30.join(goldDir, "facts.jsonl");
+  const probesPath = path30.join(goldDir, "probes.jsonl");
   let facts = [];
   let probes = [];
   const consumedFiles = [];
@@ -38167,7 +38209,7 @@ async function loadSeedDir(corpusDir, seed, errors) {
     probes = await readJsonl(probesPath, errors, isGoldProbeShape);
   }
   const sessions = [];
-  const usersDir = path29.join(seedDir, "users");
+  const usersDir = path30.join(seedDir, "users");
   if (!await isNonSymlinkDirectory(usersDir, errors)) {
     return { seed, facts, probes, sessions, consumedFiles };
   }
@@ -38175,7 +38217,7 @@ async function loadSeedDir(corpusDir, seed, errors) {
   try {
     const entries = await readdir6(usersDir, { withFileTypes: true });
     for (const entry of entries) {
-      const userDir = path29.join(usersDir, entry.name);
+      const userDir = path30.join(usersDir, entry.name);
       if (entry.isSymbolicLink()) {
         errors.push(`symlinked corpus entry rejected: ${userDir}`);
         continue;
@@ -38187,8 +38229,8 @@ async function loadSeedDir(corpusDir, seed, errors) {
     return { seed, facts, probes, sessions, consumedFiles };
   }
   for (const userId of userIds.sort()) {
-    const userDir = path29.join(usersDir, userId);
-    const sessionsPath = path29.join(userDir, "sessions.jsonl");
+    const userDir = path30.join(usersDir, userId);
+    const sessionsPath = path30.join(userDir, "sessions.jsonl");
     consumedFiles.push(corpusRelativePath(corpusDir, sessionsPath));
     for (const session of await readJsonl(sessionsPath, errors, isDriftSessionShape)) {
       if (session.userId !== userId) {
@@ -38499,10 +38541,10 @@ function isManifestShape(value) {
   );
 }
 async function checkFileHashes(corpusDir, manifest, errors) {
-  const resolvedRoot = path29.resolve(corpusDir);
+  const resolvedRoot = path30.resolve(corpusDir);
   for (const [relPath, expected] of Object.entries(manifest.files)) {
-    const absPath = path29.resolve(corpusDir, relPath);
-    if (absPath !== resolvedRoot && !absPath.startsWith(resolvedRoot + path29.sep)) {
+    const absPath = path30.resolve(corpusDir, relPath);
+    if (absPath !== resolvedRoot && !absPath.startsWith(resolvedRoot + path30.sep)) {
       errors.push(`manifest lists a path outside the corpus root: ${relPath}`);
       continue;
     }
@@ -38511,7 +38553,7 @@ async function checkFileHashes(corpusDir, manifest, errors) {
     }
     let data;
     try {
-      data = await readFile17(absPath);
+      data = await readFile18(absPath);
     } catch {
       errors.push(`manifest lists missing file: ${relPath}`);
       continue;
@@ -38560,13 +38602,13 @@ async function validateDriftCorpus(corpusDir) {
   } catch {
     return { ok: false, errors: [`corpus directory not found: ${corpusDir}`], warnings, stats: emptyStats };
   }
-  const manifestPath = path29.join(corpusDir, "dataset.manifest.json");
+  const manifestPath = path30.join(corpusDir, "dataset.manifest.json");
   if (!await hasNoSymlinkComponents(corpusDir, manifestPath, errors, "dataset manifest")) {
     return { ok: false, errors, warnings, stats: emptyStats };
   }
   let manifestRaw;
   try {
-    manifestRaw = JSON.parse(await readFile17(manifestPath, "utf8"));
+    manifestRaw = JSON.parse(await readFile18(manifestPath, "utf8"));
   } catch {
     return {
       ok: false,
@@ -38683,11 +38725,11 @@ async function generateDriftCorpus(options) {
   const seedDir = String(options.seed);
   const written = /* @__PURE__ */ new Map();
   written.set(
-    path30.posix.join(seedDir, "gold", "facts.jsonl"),
+    path31.posix.join(seedDir, "gold", "facts.jsonl"),
     toJsonl(corpus.facts)
   );
   written.set(
-    path30.posix.join(seedDir, "gold", "probes.jsonl"),
+    path31.posix.join(seedDir, "gold", "probes.jsonl"),
     toJsonl(corpus.probes)
   );
   const sessionsByUser = /* @__PURE__ */ new Map();
@@ -38698,7 +38740,7 @@ async function generateDriftCorpus(options) {
   }
   for (const [userId, sessions] of [...sessionsByUser.entries()].sort()) {
     written.set(
-      path30.posix.join(seedDir, "users", userId, "sessions.jsonl"),
+      path31.posix.join(seedDir, "users", userId, "sessions.jsonl"),
       toJsonl(sessions)
     );
   }
@@ -38727,23 +38769,23 @@ async function generateDriftCorpus(options) {
     licenses: [{ source: "synthetic", license: "MIT (repo)" }],
     ...options.audit ? { audit: options.audit } : {}
   };
-  const stagingDir = path30.join(options.outDir, `.staging-${options.seed}`);
+  const stagingDir = path31.join(options.outDir, `.staging-${options.seed}`);
   await rm14(stagingDir, { recursive: true, force: true });
   for (const [relPath, content] of written) {
-    const absPath = path30.join(stagingDir, path30.relative(seedDir, relPath));
-    await mkdir13(path30.dirname(absPath), { recursive: true });
+    const absPath = path31.join(stagingDir, path31.relative(seedDir, relPath));
+    await mkdir13(path31.dirname(absPath), { recursive: true });
     await writeFile12(absPath, content, "utf8");
   }
-  const finalSeedDir = path30.join(options.outDir, seedDir);
-  const backupDir = path30.join(options.outDir, `.backup-${options.seed}-${process.pid}`);
+  const finalSeedDir = path31.join(options.outDir, seedDir);
+  const backupDir = path31.join(options.outDir, `.backup-${options.seed}-${process.pid}`);
   const staleSeedDirs = (await readdir7(options.outDir, { withFileTypes: true })).filter((entry) => entry.isDirectory() && /^\d+$/.test(entry.name) && entry.name !== seedDir).map((entry) => ({
-    source: path30.join(options.outDir, entry.name),
-    backup: path30.join(options.outDir, `.backup-stale-${entry.name}-${process.pid}`)
+    source: path31.join(options.outDir, entry.name),
+    backup: path31.join(options.outDir, `.backup-stale-${entry.name}-${process.pid}`)
   }));
   const quarantinedStaleDirs = [];
-  const manifestPath = path30.join(options.outDir, "dataset.manifest.json");
-  const manifestStaging = path30.join(options.outDir, ".staging-manifest.json");
-  const manifestBackup = path30.join(options.outDir, `.backup-manifest-${process.pid}.json`);
+  const manifestPath = path31.join(options.outDir, "dataset.manifest.json");
+  const manifestStaging = path31.join(options.outDir, ".staging-manifest.json");
+  const manifestBackup = path31.join(options.outDir, `.backup-manifest-${process.pid}.json`);
   let hadPrevious = false;
   let replacementInstalled = false;
   let hadPreviousManifest = false;
@@ -38986,7 +39028,7 @@ var MAX_QUESTION_ANSWER_LEAKAGE2 = 0.6;
 var MANIFEST_FILE = "manifest.json";
 var CASES_FILE = "cases.jsonl";
 function canonicalDriftDir() {
-  return path31.resolve(path31.dirname(fileURLToPath2(import.meta.url)), "../../../fixtures/drift-gen-core");
+  return path32.resolve(path32.dirname(fileURLToPath2(import.meta.url)), "../../../fixtures/drift-gen-core");
 }
 var DISTRACTOR_TEMPLATES = Object.freeze([
   { templateId: "dist-employer-1", text: "Marlow Petrov works at Quill Optical." },
@@ -39029,14 +39071,14 @@ function factUserPrefixOk(factId, userId) {
   return factId.startsWith(`gf-${userId}-`);
 }
 async function readJsonlFile(filePath) {
-  const raw = await readFile18(filePath, "utf8");
+  const raw = await readFile19(filePath, "utf8");
   const lines = raw.split("\n").filter((line) => line.trim().length > 0);
   return lines.map((line) => JSON.parse(line));
 }
 async function loadVerifiedDriftCorpus(driftDir, seed) {
-  const label = path31.basename(driftDir);
-  const manifestPath = path31.join(driftDir, "dataset.manifest.json");
-  const manifest = JSON.parse(await readFile18(manifestPath, "utf8"));
+  const label = path32.basename(driftDir);
+  const manifestPath = path32.join(driftDir, "dataset.manifest.json");
+  const manifest = JSON.parse(await readFile19(manifestPath, "utf8"));
   if (typeof manifest.name !== "string" || manifest.name.length === 0) {
     throw new Error(`drift corpus ${label} has no manifest name`);
   }
@@ -39045,17 +39087,17 @@ async function loadVerifiedDriftCorpus(driftDir, seed) {
   }
   const files = manifest.files ?? {};
   const seedDir = String(seed);
-  const wanted = [path31.posix.join(seedDir, "gold", "facts.jsonl"), path31.posix.join(seedDir, "gold", "probes.jsonl")];
+  const wanted = [path32.posix.join(seedDir, "gold", "facts.jsonl"), path32.posix.join(seedDir, "gold", "probes.jsonl")];
   for (const relPath of wanted) {
     const expected = files[relPath];
     if (typeof expected !== "string") {
       throw new Error(`drift manifest is missing a hash for ${relPath}`);
     }
-    if (sha2562(await readFile18(path31.join(driftDir, relPath), "utf8")) !== expected) {
+    if (sha2562(await readFile19(path32.join(driftDir, relPath), "utf8")) !== expected) {
       throw new Error(`drift corpus file ${relPath} fails its manifest hash`);
     }
   }
-  const factRows = await readJsonlFile(path31.join(driftDir, wanted[0]));
+  const factRows = await readJsonlFile(path32.join(driftDir, wanted[0]));
   const facts = factRows.map((row) => {
     const fact3 = row;
     if (typeof fact3.id !== "string" || typeof fact3.userId !== "string" || typeof fact3.statement !== "string" || typeof fact3.subject !== "string" || typeof fact3.attribute !== "string" || typeof fact3.value !== "string" || typeof fact3.introducedEpoch !== "number") {
@@ -39067,15 +39109,15 @@ async function loadVerifiedDriftCorpus(driftDir, seed) {
   const sessions = [];
   for (const relPath of sessionFiles) {
     const expected = files[relPath];
-    if (sha2562(await readFile18(path31.join(driftDir, relPath), "utf8")) !== expected) {
+    if (sha2562(await readFile19(path32.join(driftDir, relPath), "utf8")) !== expected) {
       throw new Error(`drift corpus file ${relPath} fails its manifest hash`);
     }
-    sessions.push(...await readJsonlFile(path31.join(driftDir, relPath)));
+    sessions.push(...await readJsonlFile(path32.join(driftDir, relPath)));
   }
   sessions.sort((a, b) => a.epoch - b.epoch || compareStrings(a.sessionId, b.sessionId));
   return {
     manifestName: manifest.name,
-    manifestSha256: sha2562(await readFile18(manifestPath, "utf8")),
+    manifestSha256: sha2562(await readFile19(manifestPath, "utf8")),
     facts,
     sessions,
     seed
@@ -39266,7 +39308,7 @@ async function validateStagedMemoryFixture(fixtureDir) {
   if (!dirStat?.isDirectory()) {
     return {
       ok: false,
-      errors: [`fixture directory not found: ${path31.basename(fixtureDir)}`],
+      errors: [`fixture directory not found: ${path32.basename(fixtureDir)}`],
       warnings,
       stats: { users: 0, cases: 0, distractorsPerCase: 0, transitions: 0 }
     };
@@ -39274,8 +39316,8 @@ async function validateStagedMemoryFixture(fixtureDir) {
   if (dirStat.isSymbolicLink()) {
     errors.push("fixture directory must not be a symlink");
   }
-  const manifestPath = path31.join(fixtureDir, MANIFEST_FILE);
-  const rawManifest = await readFile18(manifestPath, "utf8").catch(() => void 0);
+  const manifestPath = path32.join(fixtureDir, MANIFEST_FILE);
+  const rawManifest = await readFile19(manifestPath, "utf8").catch(() => void 0);
   if (rawManifest === void 0) {
     return {
       ok: false,
@@ -39327,7 +39369,7 @@ async function validateStagedMemoryFixture(fixtureDir) {
     errors.push(`manifest.files must hash ${CASES_FILE}`);
   }
   for (const [relPath, expectedHash] of Object.entries(manifest.files)) {
-    const filePath = path31.join(fixtureDir, relPath);
+    const filePath = path32.join(fixtureDir, relPath);
     const stat6 = await lstat5(filePath).catch(() => void 0);
     if (!stat6) {
       errors.push(`fixture file listed in manifest is missing: ${relPath}`);
@@ -39337,11 +39379,11 @@ async function validateStagedMemoryFixture(fixtureDir) {
       errors.push(`fixture file must not be a symlink: ${relPath}`);
       continue;
     }
-    if (sha2562(await readFile18(filePath, "utf8")) !== expectedHash) {
+    if (sha2562(await readFile19(filePath, "utf8")) !== expectedHash) {
       errors.push(`fixture file fails its manifest hash: ${relPath}`);
     }
   }
-  const rawCases = await readFile18(path31.join(fixtureDir, CASES_FILE), "utf8").catch(() => void 0);
+  const rawCases = await readFile19(path32.join(fixtureDir, CASES_FILE), "utf8").catch(() => void 0);
   if (rawCases === void 0) {
     return {
       ok: false,
@@ -39488,9 +39530,9 @@ async function loadStagedMemoryFixture(fixtureDir) {
 ${report.errors.map((e) => `  - ${e}`).join("\n")}`);
   }
   const rawManifest = JSON.parse(
-    await readFile18(path31.join(fixtureDir, MANIFEST_FILE), "utf8")
+    await readFile19(path32.join(fixtureDir, MANIFEST_FILE), "utf8")
   );
-  const rawCases = await readFile18(path31.join(fixtureDir, CASES_FILE), "utf8");
+  const rawCases = await readFile19(path32.join(fixtureDir, CASES_FILE), "utf8");
   const cases = rawCases.split("\n").filter((line) => line.trim()).map((line) => JSON.parse(line));
   return {
     manifest: rawManifest,
@@ -40429,8 +40471,8 @@ function finalizeBenchmarkResultConfig(result, options) {
 }
 
 // src/benchmark.ts
-var DEFAULT_BASELINE_PATH = path32.join(process.cwd(), "benchmarks", "baseline.json");
-var DEFAULT_REPORT_PATH = path32.join(process.cwd(), "benchmarks", "report.json");
+var DEFAULT_BASELINE_PATH = path33.join(process.cwd(), "benchmarks", "baseline.json");
+var DEFAULT_REPORT_PATH = path33.join(process.cwd(), "benchmarks", "report.json");
 var BASELINE_VERSION = 1;
 var DEFAULT_TOLERANCE = 10;
 var DEFAULT_FULL_RUN_COUNT = 5;
@@ -40508,7 +40550,7 @@ async function runBenchmark(benchmarkId, options) {
     if (!willWrapPrimary && !willWrapCross) {
       return void 0;
     }
-    const cacheDir = options.judgeCacheDir ? path32.resolve(expandTildePath3(options.judgeCacheDir)) : options.outputDir ? path32.join(path32.resolve(expandTildePath3(options.outputDir)), "judge-cache") : void 0;
+    const cacheDir = options.judgeCacheDir ? path33.resolve(expandTildePath3(options.judgeCacheDir)) : options.outputDir ? path33.join(path33.resolve(expandTildePath3(options.outputDir)), "judge-cache") : void 0;
     if (cacheDir === void 0) {
       return void 0;
     }
@@ -40707,7 +40749,7 @@ function loadBaseline(baselinePath) {
   return raw;
 }
 function saveBaseline(baselinePath, baseline) {
-  fs.mkdirSync(path32.dirname(baselinePath), { recursive: true });
+  fs.mkdirSync(path33.dirname(baselinePath), { recursive: true });
   fs.writeFileSync(baselinePath, `${JSON.stringify(baseline, null, 2)}
 `);
 }
@@ -40937,7 +40979,7 @@ function generateReport(results, reportPath) {
     totalDurationMs: results.reduce((sum, result) => sum + result.totalDurationMs, 0)
   };
   if (reportPath) {
-    fs.mkdirSync(path32.dirname(reportPath), { recursive: true });
+    fs.mkdirSync(path33.dirname(reportPath), { recursive: true });
     fs.writeFileSync(reportPath, `${JSON.stringify(report, null, 2)}
 `);
   }
@@ -41361,8 +41403,8 @@ var LOCOMO_CATEGORY_ORDER2 = ["single_hop", "multi_hop", "temporal", "open_domai
 var LOCOMO_TASK_CATEGORY_PATTERN2 = /-(single_hop|multi_hop|temporal|open_domain|adversarial)$/;
 var SOURCE_TURN_PATTERN = /^\[([^,\]\s]+),\s*turn\s+(\d+),\s*([^,\]]+?)(?:,\s*score\s+[^\]]+)?\]/i;
 var SHA256_PATTERN = /^[a-f0-9]{64}$/;
-function sanitizeLoComoResultReference(path43) {
-  const reference = basename2(path43).replace(/[\u0000-\u001f\u007f`]/g, "_");
+function sanitizeLoComoResultReference(path44) {
+  const reference = basename2(path44).replace(/[\u0000-\u001f\u007f`]/g, "_");
   if (!reference) throw new Error("Result path must identify a file.");
   return reference;
 }
@@ -42920,50 +42962,50 @@ function assertMemoryIdRef(value) {
     throw new Error("LoCoMo retrieval trace requires a valid content-free memoryIdRef.");
   }
 }
-function assertJsonConfig(value, path43 = "retrievalConfig") {
+function assertJsonConfig(value, path44 = "retrievalConfig") {
   if (value === null || typeof value === "string" || typeof value === "boolean") return value;
   if (typeof value === "number") {
-    if (!Number.isFinite(value)) throw new Error(`${path43} must contain only finite JSON numbers.`);
+    if (!Number.isFinite(value)) throw new Error(`${path44} must contain only finite JSON numbers.`);
     return value;
   }
   if (Array.isArray(value)) {
-    return value.map((entry, index) => assertJsonConfig(entry, `${path43}[${index}]`));
+    return value.map((entry, index) => assertJsonConfig(entry, `${path44}[${index}]`));
   }
   if (!value || typeof value !== "object") {
-    throw new Error(`${path43} must be JSON-serializable and provider-free.`);
+    throw new Error(`${path44} must be JSON-serializable and provider-free.`);
   }
   const output = {};
   for (const key of Object.keys(value).sort()) {
     const child = value[key];
     if (key === "openaiApiKey") {
       if (child !== false) {
-        throw new Error(`${path43}.${key} must be exactly false for provider-free capture.`);
+        throw new Error(`${path44}.${key} must be exactly false for provider-free capture.`);
       }
       output[key] = false;
       continue;
     }
     if (isSecretKey(key)) {
-      throw new Error(`${path43}.${key} contains secret-bearing configuration.`);
+      throw new Error(`${path44}.${key} contains secret-bearing configuration.`);
     }
     if (child === void 0) continue;
     if (/^(?:gatewayConfig|gatewayAgentId|fastGatewayAgentId|internalProvider|llmProvider|llmModel)$/iu.test(key) || key === "modelSource" && child !== "plugin") {
-      throw new Error(`${path43}.${key} is provider-capable configuration.`);
+      throw new Error(`${path44}.${key} is provider-capable configuration.`);
     }
-    output[key] = assertJsonConfig(child, `${path43}.${key}`);
+    output[key] = assertJsonConfig(child, `${path44}.${key}`);
   }
   return output;
 }
-function sanitizeProviderFreeRetrievalConfig(value, path43 = "retrievalConfig") {
+function sanitizeProviderFreeRetrievalConfig(value, path44 = "retrievalConfig") {
   if (value === null || typeof value === "string" || typeof value === "boolean") return value;
   if (typeof value === "number") {
-    if (!Number.isFinite(value)) throw new Error(`${path43} must contain only finite JSON numbers.`);
+    if (!Number.isFinite(value)) throw new Error(`${path44} must contain only finite JSON numbers.`);
     return value;
   }
   if (Array.isArray(value)) {
-    return value.map((entry, index) => sanitizeProviderFreeRetrievalConfig(entry, `${path43}[${index}]`));
+    return value.map((entry, index) => sanitizeProviderFreeRetrievalConfig(entry, `${path44}[${index}]`));
   }
   if (!value || typeof value !== "object") {
-    throw new Error(`${path43} must be JSON-serializable.`);
+    throw new Error(`${path44} must be JSON-serializable.`);
   }
   const output = {};
   for (const key of Object.keys(value).sort()) {
@@ -42972,7 +43014,7 @@ function sanitizeProviderFreeRetrievalConfig(value, path43 = "retrievalConfig")
     if (isSecretKey(key) || /^(?:gatewayConfig|gatewayAgentId|fastGatewayAgentId|internalProvider|llmProvider|llmModel)$/iu.test(key) || key === "modelSource") {
       continue;
     }
-    output[key] = sanitizeProviderFreeRetrievalConfig(child, `${path43}.${key}`);
+    output[key] = sanitizeProviderFreeRetrievalConfig(child, `${path44}.${key}`);
   }
   return output;
 }
@@ -42980,10 +43022,10 @@ function sanitizeProviderFreeRetrievalConfig(value, path43 = "retrievalConfig")
 // src/result-summary.ts
 import { existsSync as existsSync2 } from "fs";
 import { readdir as readdir8 } from "fs/promises";
-import path33 from "path";
+import path34 from "path";
 
 // src/integrity/sealed-qrels.ts
-import { readFile as readFile19 } from "fs/promises";
+import { readFile as readFile20 } from "fs/promises";
 function isSealedQrelsArtifact(value) {
   if (!value || typeof value !== "object") {
     return false;
@@ -43053,7 +43095,7 @@ function parseSealedQrels(raw, options = {}) {
   };
 }
 async function loadSealedQrels(filePath, options = {}) {
-  const raw = await readFile19(filePath, "utf8");
+  const raw = await readFile20(filePath, "utf8");
   return parseSealedQrels(raw, options);
 }
 function serializeSealedQrels(artifact) {
@@ -43310,7 +43352,7 @@ async function loadBenchmarkResultSummaries(resultsDir) {
     if (!entry.isFile() || !entry.name.endsWith(".json")) {
       continue;
     }
-    const filePath = path33.join(resultsDir, entry.name);
+    const filePath = path34.join(resultsDir, entry.name);
     try {
       const result = await loadBenchmarkResult(filePath);
       summaries.push(summarizeBenchmarkResult(result, filePath));
@@ -43330,7 +43372,7 @@ async function loadBenchmarkResultSummaries(resultsDir) {
 }
 
 // src/benchmarks/custom/loader.ts
-import { readFile as readFile20 } from "fs/promises";
+import { readFile as readFile21 } from "fs/promises";
 import { parse as parseYaml } from "yaml";
 var CUSTOM_SCORING_VALUES = /* @__PURE__ */ new Set([
   "exact_match",
@@ -43350,7 +43392,7 @@ function parseCustomBenchmark(source) {
 async function loadCustomBenchmarkFile(filePath) {
   let source;
   try {
-    source = await readFile20(filePath, "utf8");
+    source = await readFile21(filePath, "utf8");
   } catch (error) {
     throw new Error(
       `Failed to read custom benchmark file ${filePath}: ${formatError(error)}`
@@ -43458,7 +43500,7 @@ function formatError(error) {
 
 // src/benchmarks/custom/runner.ts
 import { randomUUID as randomUUID35 } from "crypto";
-import path34 from "path";
+import path35 from "path";
 import { expandTildePath as expandTildePath4 } from "@remnic/core";
 async function runCustomBenchmarkFile(filePath, options) {
   const spec = await loadCustomBenchmarkFile(filePath);
@@ -43471,7 +43513,7 @@ async function runCustomBenchmarkFile(filePath, options) {
   let cacheRestore;
   let cacheCounters;
   if (spec.scoring === "llm_judge" && runOptions.system.judge !== void 0 && !runOptions.noJudgeCache && (runOptions.judgeProvider ?? null) !== null) {
-    const cacheDir = runOptions.judgeCacheDir ? path34.resolve(expandTildePath4(runOptions.judgeCacheDir)) : runOptions.outputDir ? path34.join(path34.resolve(expandTildePath4(runOptions.outputDir)), "judge-cache") : void 0;
+    const cacheDir = runOptions.judgeCacheDir ? path35.resolve(expandTildePath4(runOptions.judgeCacheDir)) : runOptions.outputDir ? path35.join(path35.resolve(expandTildePath4(runOptions.outputDir)), "judge-cache") : void 0;
     if (cacheDir !== void 0) {
       const originalJudge = runOptions.system.judge;
       const wrapped = wrapJudgeWithCache({
@@ -43672,7 +43714,7 @@ async function scoreTask(scoring, options, question, actual, expected) {
   }
 }
 function createCustomBenchmarkDefinition(benchmark, filePath) {
-  const id = `custom:${slugify(path34.basename(filePath, path34.extname(filePath)) || benchmark.name)}`;
+  const id = `custom:${slugify(path35.basename(filePath, path35.extname(filePath)) || benchmark.name)}`;
   return {
     id,
     title: benchmark.name,
@@ -44543,8 +44585,8 @@ var chatFixture = {
 
 // src/judges/calibration-slice.ts
 import { createHash as createHash19, randomBytes as randomBytes2 } from "crypto";
-import { chmod as chmod2, lstat as lstat6, mkdir as mkdir15, open as open2, readFile as readFile21, rename as rename5, unlink as unlink3, writeFile as writeFile14 } from "fs/promises";
-import path35 from "path";
+import { chmod as chmod2, lstat as lstat6, mkdir as mkdir15, open as open2, readFile as readFile22, rename as rename5, unlink as unlink3, writeFile as writeFile14 } from "fs/promises";
+import path36 from "path";
 
 // src/judges/cohen-kappa.ts
 var DEFAULT_KAPPA_BOOTSTRAP_SAMPLES = 2e3;
@@ -44844,7 +44886,7 @@ async function loadOrInitializeCheckpoint(benchmarkId, provenance, sliceQuestion
     throw new Error("runJudgeCalibration: checkpoint ordered-question-id hash does not match the validated source.");
   }
   await ensurePrivateDirectory(provenance.dir);
-  const checkpointPath = path35.join(provenance.dir, `${sanitizeCalibrationSegment(benchmarkId)}.checkpoint.json`);
+  const checkpointPath = path36.join(provenance.dir, `${sanitizeCalibrationSegment(benchmarkId)}.checkpoint.json`);
   const lockPath = `${checkpointPath}.lock`;
   let lockHandle;
   try {
@@ -44892,7 +44934,7 @@ async function loadOrInitializeCheckpoint(benchmarkId, provenance, sliceQuestion
     try {
       const info = await lstat6(checkpointPath);
       if (!info.isFile() || info.isSymbolicLink()) throw new Error("checkpoint path is not a regular file");
-      raw = await readFile21(checkpointPath, "utf8");
+      raw = await readFile22(checkpointPath, "utf8");
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
       const state = { schemaVersion: 2, contractHash, contract, completed: {} };
@@ -44968,7 +45010,7 @@ async function writeJudgeCalibrationState(result, calibrationDir, identities, pr
     ...provenance ? provenance : {},
     ...identities ? identities : {}
   };
-  const filePath = path35.join(calibrationDir, `${sanitizeCalibrationSegment(result.benchmarkId)}.json`);
+  const filePath = path36.join(calibrationDir, `${sanitizeCalibrationSegment(result.benchmarkId)}.json`);
   const tempPath = `${filePath}.${randomBytes2(6).toString("hex")}.tmp`;
   await writeFile14(tempPath, `${JSON.stringify(state, null, 2)}
 `, { encoding: "utf8", mode: 384 });
@@ -44982,10 +45024,10 @@ async function writeJudgeCalibrationState(result, calibrationDir, identities, pr
   return filePath;
 }
 async function loadJudgeCalibrationState(benchmarkId, calibrationDir) {
-  const filePath = path35.join(calibrationDir, `${sanitizeCalibrationSegment(benchmarkId)}.json`);
+  const filePath = path36.join(calibrationDir, `${sanitizeCalibrationSegment(benchmarkId)}.json`);
   let raw;
   try {
-    raw = await readFile21(filePath, "utf8");
+    raw = await readFile22(filePath, "utf8");
   } catch {
     return void 0;
   }
@@ -45077,9 +45119,9 @@ function sanitizeCalibrationSegment(value) {
 }
 
 // src/benchmarks/remnic/procedural-recall/ablation.ts
-import { mkdir as mkdir16, mkdtemp as mkdtemp12, rm as rm16, writeFile as writeFile15, readFile as readFile22 } from "fs/promises";
+import { mkdir as mkdir16, mkdtemp as mkdtemp12, rm as rm16, writeFile as writeFile15, readFile as readFile23 } from "fs/promises";
 import os8 from "os";
-import path36 from "path";
+import path37 from "path";
 import {
   StorageManager as StorageManager4,
   parseConfig as parseConfig5,
@@ -45111,7 +45153,7 @@ async function runSide(scenarios, proceduralEnabled) {
   const observed = [];
   for (const scenario of scenarios) {
     const dir = await mkdtemp12(
-      path36.join(os8.tmpdir(), "remnic-bench-proc-ablation-")
+      path37.join(os8.tmpdir(), "remnic-bench-proc-ablation-")
     );
     try {
       const storage = new StorageManager4(dir);
@@ -45132,7 +45174,7 @@ ${body}`,
       );
       const config = parseConfig5({
         memoryDir: dir,
-        workspaceDir: path36.join(dir, "ws"),
+        workspaceDir: path37.join(dir, "ws"),
         openaiApiKey: "bench-key",
         procedural: {
           enabled: proceduralEnabled,
@@ -45207,7 +45249,7 @@ async function runProceduralAblation(options) {
   };
 }
 async function loadAblationFixture(fixturePath) {
-  const raw = await readFile22(fixturePath, "utf8");
+  const raw = await readFile23(fixturePath, "utf8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -45303,7 +45345,7 @@ async function runProceduralAblationCli(args) {
     random: args.random,
     seed: args.seed
   });
-  const outDir = path36.dirname(path36.resolve(args.outPath));
+  const outDir = path37.dirname(path37.resolve(args.outPath));
   await mkdir16(outDir, { recursive: true });
   await writeFile15(args.outPath, JSON.stringify(artifact, null, 2) + "\n", "utf8");
   return artifact;
@@ -46420,19 +46462,19 @@ function createMitigatedTarget(config) {
 
 // src/security/injection-suite/runner.ts
 import { createHash as createHash22 } from "crypto";
-import { mkdir as mkdir19, readFile as readFile25, writeFile as writeFile18 } from "fs/promises";
-import path39 from "path";
+import { mkdir as mkdir19, readFile as readFile26, writeFile as writeFile18 } from "fs/promises";
+import path40 from "path";
 
 // src/security/injection-suite/claims.ts
 import { hostname } from "os";
-import { mkdir as mkdir18, readFile as readFile24, rename as rename7, rm as rm17, stat as stat4, utimes, writeFile as writeFile17 } from "fs/promises";
-import path38 from "path";
+import { mkdir as mkdir18, readFile as readFile25, rename as rename7, rm as rm17, stat as stat4, utimes, writeFile as writeFile17 } from "fs/promises";
+import path39 from "path";
 import { randomUUID as randomUUID37 } from "crypto";
 
 // src/security/injection-suite/store.ts
 import { createHash as createHash20, randomUUID as randomUUID36 } from "crypto";
-import { mkdir as mkdir17, readFile as readFile23, rename as rename6, writeFile as writeFile16 } from "fs/promises";
-import path37 from "path";
+import { mkdir as mkdir17, readFile as readFile24, rename as rename6, writeFile as writeFile16 } from "fs/promises";
+import path38 from "path";
 
 // src/security/injection-suite/types.ts
 var INJECTION_SUITE_VERSION = "h5-injection-suite-v1";
@@ -46472,17 +46514,17 @@ var InjectionSuiteRowStore = class {
   outputDir;
   checkpointsDir;
   constructor(outputDir) {
-    this.outputDir = path37.resolve(outputDir);
-    this.checkpointsDir = path37.join(this.outputDir, "checkpoints");
+    this.outputDir = path38.resolve(outputDir);
+    this.checkpointsDir = path38.join(this.outputDir, "checkpoints");
   }
   checkpointPath(identity) {
-    return path37.join(this.checkpointsDir, `${buildInjectionSuiteRowKey(identity)}.json`);
+    return path38.join(this.checkpointsDir, `${buildInjectionSuiteRowKey(identity)}.json`);
   }
   async load(identity) {
     const rowKey = buildInjectionSuiteRowKey(identity);
     let raw;
     try {
-      raw = await readFile23(this.checkpointPath(identity), "utf8");
+      raw = await readFile24(this.checkpointPath(identity), "utf8");
     } catch (error) {
       if (error.code === "ENOENT") return { kind: "MISSING" };
       return { kind: "MALFORMED", error: error instanceof Error ? error : new Error(String(error)) };
@@ -46539,7 +46581,7 @@ var InjectionSuiteClaimLock = class {
   heartbeatMs;
   heartbeats = /* @__PURE__ */ new Map();
   lockPath(rowKey) {
-    return path38.join(this.checkpointsDir, `${rowKey}.lock`);
+    return path39.join(this.checkpointsDir, `${rowKey}.lock`);
   }
   async tryClaim(identity) {
     const rowKey = buildInjectionSuiteRowKey(identity);
@@ -46565,7 +46607,7 @@ var InjectionSuiteClaimLock = class {
       claimedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     try {
-      await writeFile17(path38.join(lockPath, "owner.json"), `${JSON.stringify(owner)}
+      await writeFile17(path39.join(lockPath, "owner.json"), `${JSON.stringify(owner)}
 `, {
         flag: "wx"
       });
@@ -46579,8 +46621,8 @@ var InjectionSuiteClaimLock = class {
   async release(claim) {
     this.stopHeartbeat(claim.lockPath);
     try {
-      const ownerPath = path38.join(claim.lockPath, "owner.json");
-      const owner = JSON.parse(await readFile24(ownerPath, "utf8"));
+      const ownerPath = path39.join(claim.lockPath, "owner.json");
+      const owner = JSON.parse(await readFile25(ownerPath, "utf8"));
       if (owner.ownerToken !== claim.ownerToken) return;
       await rename7(ownerPath, `${ownerPath}.released-${claim.ownerToken}`);
     } catch {
@@ -46595,7 +46637,7 @@ var InjectionSuiteClaimLock = class {
     await rm17(released, { recursive: true, force: true });
   }
   async assertOwner(claim) {
-    const owner = JSON.parse(await readFile24(path38.join(claim.lockPath, "owner.json"), "utf8"));
+    const owner = JSON.parse(await readFile25(path39.join(claim.lockPath, "owner.json"), "utf8"));
     if (owner.ownerToken !== claim.ownerToken) {
       throw new Error(`lost injection-suite claim ${claim.rowKey}`);
     }
@@ -46603,7 +46645,7 @@ var InjectionSuiteClaimLock = class {
   startHeartbeat(lockPath) {
     this.stopHeartbeat(lockPath);
     const timer = setInterval(() => {
-      void utimes(path38.join(lockPath, "owner.json"), /* @__PURE__ */ new Date(), /* @__PURE__ */ new Date()).catch(() => void 0);
+      void utimes(path39.join(lockPath, "owner.json"), /* @__PURE__ */ new Date(), /* @__PURE__ */ new Date()).catch(() => void 0);
     }, this.heartbeatMs);
     timer.unref?.();
     this.heartbeats.set(lockPath, timer);
@@ -46614,11 +46656,11 @@ var InjectionSuiteClaimLock = class {
     clearInterval(timer);
   }
   async reclaimIfExpired(lockPath) {
-    const ownerPath = path38.join(lockPath, "owner.json");
+    const ownerPath = path39.join(lockPath, "owner.json");
     let leaseMs = this.leaseMs;
     let stampMs;
     try {
-      const owner = JSON.parse(await readFile24(ownerPath, "utf8"));
+      const owner = JSON.parse(await readFile25(ownerPath, "utf8"));
       if (typeof owner.leaseMs === "number" && owner.leaseMs > 0) leaseMs = owner.leaseMs;
       stampMs = (await stat4(ownerPath)).mtimeMs;
     } catch {
@@ -46713,13 +46755,83 @@ function buildRecallPrompt(identity, variant) {
 function trimSlash(url) {
   return url.replace(/\/+$/, "");
 }
-async function postJson(url, body, timeoutMs) {
+function parseCompatUrl(baseUrl) {
+  try {
+    const parsed = new URL(baseUrl);
+    let hostname2 = parsed.hostname.trim().toLowerCase();
+    while (hostname2.endsWith(".")) hostname2 = hostname2.slice(0, -1);
+    if (hostname2.length === 0) return void 0;
+    return { protocol: parsed.protocol.toLowerCase(), hostname: hostname2 };
+  } catch {
+    return void 0;
+  }
+}
+var OPENAI_API_HOSTS = Object.freeze(["api.openai.com"]);
+var NVIDIA_API_HOSTS = Object.freeze(["integrate.api.nvidia.com"]);
+function isExactAllowlistedHost(hostname2, allowlist) {
+  return allowlist.includes(hostname2);
+}
+function isHttps(protocol) {
+  return protocol === "https:";
+}
+function isLoopbackHttpHost(hostname2) {
+  return hostname2 === "127.0.0.1" || hostname2 === "localhost";
+}
+function requireHttps(protocol, message) {
+  if (!isHttps(protocol)) {
+    throw new InjectionSuiteHostFault(message);
+  }
+}
+function nonEmptyEnv(name) {
+  const raw = process.env[name];
+  if (typeof raw !== "string") return void 0;
+  const trimmed = raw.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function requireEnvToken(envName, message) {
+  const token = nonEmptyEnv(envName);
+  if (token === void 0) {
+    throw new InjectionSuiteHostFault(message);
+  }
+  return token;
+}
+function resolveOpenAiCompatToken(baseUrl) {
+  const parsed = parseCompatUrl(baseUrl);
+  if (parsed === void 0) {
+    throw new InjectionSuiteHostFault("openai-compat requires a valid http(s) base URL");
+  }
+  const { protocol, hostname: hostname2 } = parsed;
+  if (isExactAllowlistedHost(hostname2, NVIDIA_API_HOSTS)) {
+    requireHttps(protocol, "openai-compat NVIDIA host requires https");
+    return requireEnvToken(
+      "NVIDIA_API_KEY",
+      "openai-compat NVIDIA host requires NVIDIA_API_KEY"
+    );
+  }
+  if (isExactAllowlistedHost(hostname2, OPENAI_API_HOSTS)) {
+    requireHttps(protocol, "openai-compat OpenAI host requires https");
+    return requireEnvToken(
+      "OPENAI_API_KEY",
+      "openai-compat OpenAI host requires OPENAI_API_KEY"
+    );
+  }
+  if (!isHttps(protocol) && !isLoopbackHttpHost(hostname2)) {
+    throw new InjectionSuiteHostFault(
+      "openai-compat custom host requires https (loopback HTTP is allowed only for 127.0.0.1 or localhost)"
+    );
+  }
+  return requireEnvToken(
+    "REMNIC_OPENAI_COMPAT_API_KEY",
+    "openai-compat unknown host requires REMNIC_OPENAI_COMPAT_API_KEY (or a known host: api.openai.com / integrate.api.nvidia.com); do not reuse OPENAI_API_KEY or NVIDIA_API_KEY"
+  );
+}
+async function postJson(url, body, timeoutMs, extraHeaders) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), timeoutMs);
   try {
     const response = await fetch(url, {
       method: "POST",
-      headers: { "content-type": "application/json" },
+      headers: { "content-type": "application/json", ...extraHeaders },
       body: JSON.stringify(body),
       signal: controller.signal
     });
@@ -46740,11 +46852,17 @@ async function completeChat(options, prompt) {
   const model = options.model ?? DEFAULT_OLLAMA_MODEL;
   if (options.kind === "openai-compat") {
     const base2 = trimSlash(options.baseUrl ?? DEFAULT_OPENAI_COMPAT_BASE_URL);
-    const json2 = await postJson(`${base2}/chat/completions`, {
-      model,
-      messages: [{ role: "user", content: prompt }],
-      temperature: 0
-    }, timeoutMs);
+    const token = resolveOpenAiCompatToken(base2);
+    const json2 = await postJson(
+      `${base2}/chat/completions`,
+      {
+        model,
+        messages: [{ role: "user", content: prompt }],
+        temperature: 0
+      },
+      timeoutMs,
+      { Authorization: `Bearer ${token}` }
+    );
     const text2 = json2.choices?.[0]?.message?.content;
     if (typeof text2 !== "string") throw new InjectionSuiteHostFault("openai-compat response missing content");
     return text2;
@@ -46897,19 +47015,19 @@ async function executeRow(identity, variant, input) {
 }
 async function readRunMetadata(outputDir) {
   try {
-    return JSON.parse(await readFile25(path39.join(outputDir, "run.json"), "utf8"));
+    return JSON.parse(await readFile26(path40.join(outputDir, "run.json"), "utf8"));
   } catch (error) {
     if (error.code === "ENOENT") return void 0;
     throw error;
   }
 }
 async function appendEpisode(outputDir, row) {
-  await writeFile18(path39.join(outputDir, "episodes.jsonl"), `${JSON.stringify(row)}
+  await writeFile18(path40.join(outputDir, "episodes.jsonl"), `${JSON.stringify(row)}
 `, { flag: "a" });
 }
 async function ensureEpisode(outputDir, row) {
   try {
-    const existing = await readFile25(path39.join(outputDir, "episodes.jsonl"), "utf8");
+    const existing = await readFile26(path40.join(outputDir, "episodes.jsonl"), "utf8");
     if (existing.includes(row.rowKey)) return;
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
@@ -46948,7 +47066,7 @@ async function runInjectionSuiteCliCommand(input) {
       limit: input.limit ?? null
     };
     try {
-      await writeFile18(path39.join(input.outputDir, "run.json"), `${JSON.stringify(metadata, null, 2)}
+      await writeFile18(path40.join(input.outputDir, "run.json"), `${JSON.stringify(metadata, null, 2)}
 `, {
         flag: "wx"
       });
@@ -47194,7 +47312,7 @@ import { performance as performance2 } from "perf_hooks";
 import { mkdtemp as mkdtemp13, rm as rm18 } from "fs/promises";
 import { statSync } from "fs";
 import { tmpdir as tmpdir7 } from "os";
-import path40 from "path";
+import path41 from "path";
 import os9 from "os";
 import {
   GraphStore
@@ -47291,15 +47409,15 @@ async function runCodingGraphBenchmark(config = {}) {
   const sampleRss = () => {
     peakRss = Math.max(peakRss, process.memoryUsage().rss);
   };
-  const dir = await mkdtemp13(path40.join(tmpdir7(), "coding-graph-bench-"));
-  const dbPath = path40.join(dir, "bench.sqlite");
+  const dir = await mkdtemp13(path41.join(tmpdir7(), "coding-graph-bench-"));
+  const dbPath = path41.join(dir, "bench.sqlite");
   try {
     const store = await GraphStore.open({ dbPath });
     try {
       const FULL_INDEX_SAMPLES = 3;
       const fullIndexSamples = [];
       for (let s = 0; s < FULL_INDEX_SAMPLES; s++) {
-        const sampleStore = s === 0 ? store : await GraphStore.open({ dbPath: path40.join(dir, `bench-warm-${s}.sqlite`) });
+        const sampleStore = s === 0 ? store : await GraphStore.open({ dbPath: path41.join(dir, `bench-warm-${s}.sqlite`) });
         const fi = await timeAsync(() => sampleStore.upsertFileBatch(storeFiles));
         if (!fi.result.ok) {
           if (sampleStore !== store) await sampleStore.close();
@@ -47622,7 +47740,7 @@ function buildBaselineFromReport(report, note) {
 // src/coding-graph/repeated-failure-report.ts
 import { constants } from "fs";
 import { lstat as lstat7, mkdir as mkdir20, open as open3 } from "fs/promises";
-import path41 from "path";
+import path42 from "path";
 import { writeFileAtomically } from "@remnic/core/maintenance/atomic-file";
 import { z as z4 } from "zod";
 
@@ -48250,20 +48368,20 @@ var SOURCE_ARTIFACTS = [
 async function readArtifactLeaf(filePath) {
   const leaf = await lstat7(filePath);
   if (!leaf.isFile()) {
-    throw new Error(`paper artifact leaf must be a regular file: ${path41.basename(filePath)}`);
+    throw new Error(`paper artifact leaf must be a regular file: ${path42.basename(filePath)}`);
   }
   let handle;
   try {
     handle = await open3(filePath, constants.O_RDONLY | constants.O_NOFOLLOW);
   } catch (error) {
     if (error.code === "ELOOP") {
-      throw new Error(`paper artifact leaf must be a regular file: ${path41.basename(filePath)}`);
+      throw new Error(`paper artifact leaf must be a regular file: ${path42.basename(filePath)}`);
     }
     throw error;
   }
   try {
     if (!(await handle.stat()).isFile()) {
-      throw new Error(`paper artifact leaf must be a regular file: ${path41.basename(filePath)}`);
+      throw new Error(`paper artifact leaf must be a regular file: ${path42.basename(filePath)}`);
     }
     return await handle.readFile();
   } finally {
@@ -48467,7 +48585,7 @@ async function assertArtifactMayBeWritten(filePath, content) {
   try {
     const prior = await readArtifactLeaf(filePath);
     if (!prior.equals(Buffer.from(content))) {
-      throw new Error(`paper writer refuses to overwrite changed paper artifact: ${path41.basename(filePath)}`);
+      throw new Error(`paper writer refuses to overwrite changed paper artifact: ${path42.basename(filePath)}`);
     }
     return false;
   } catch (error) {
@@ -48476,7 +48594,7 @@ async function assertArtifactMayBeWritten(filePath, content) {
   }
 }
 async function writeRepeatedFailurePaperArtifacts(options) {
-  const runDir = path41.resolve(options.runDir);
+  const runDir = path42.resolve(options.runDir);
   const reproManifest = await verifyRunManifest(runDir);
   const source = await readSourceArtifacts(runDir);
   const runJson = JSON.parse(source["run.json"]);
@@ -48494,7 +48612,7 @@ async function writeRepeatedFailurePaperArtifacts(options) {
     throw new Error("paper report preregistration does not match run metadata");
   }
   const committedFixtureDir = await resolveCommittedH6FixtureDirectory();
-  const committedDecisionRuleBytes = (await readArtifactLeaf(path41.join(committedFixtureDir, "decision-rule.json"))).toString("utf8");
+  const committedDecisionRuleBytes = (await readArtifactLeaf(path42.join(committedFixtureDir, "decision-rule.json"))).toString("utf8");
   if (decisionRuleBytes !== committedDecisionRuleBytes) {
     throw new Error("paper report decision rule differs from the frozen committed artifact");
   }
@@ -48853,7 +48971,7 @@ async function writeRepeatedFailurePaperArtifacts(options) {
   await Promise.all(writeStates.map(async (artifact) => {
     const bytes = await readArtifactLeaf(artifact.artifactPath);
     if (!bytes.equals(Buffer.from(artifact.content))) {
-      throw new Error(`paper artifact verification failed: ${path41.basename(artifact.artifactPath)}`);
+      throw new Error(`paper artifact verification failed: ${path42.basename(artifact.artifactPath)}`);
     }
   }));
   const artifactPaths = writeStates.map((artifact) => artifact.artifactPath);
@@ -48866,15 +48984,15 @@ async function writeRepeatedFailurePaperArtifacts(options) {
 }
 async function runRepeatedFailurePaperReportCliCommand(options) {
   try {
-    const { replayRepeatedFailureStatistics: replayRepeatedFailureStatistics2 } = await import("./repeated-failure-suite-runner-ONGURPYC.js");
+    const { replayRepeatedFailureStatistics: replayRepeatedFailureStatistics2 } = await import("./repeated-failure-suite-runner-Q62JLDON.js");
     const replay = await replayRepeatedFailureStatistics2(options);
     if (replay.exitCode !== 0) return replay;
     const result = await writeRepeatedFailurePaperArtifacts(options);
     return {
       exitCode: 0,
       output: JSON.stringify({
-        reportPath: path41.relative(path41.resolve(options.runDir), result.reportPath),
-        manifestPath: path41.relative(path41.resolve(options.runDir), result.manifestPath)
+        reportPath: path42.relative(path42.resolve(options.runDir), result.reportPath),
+        manifestPath: path42.relative(path42.resolve(options.runDir), result.manifestPath)
       })
     };
   } catch (error) {
@@ -48884,8 +49002,8 @@ async function runRepeatedFailurePaperReportCliCommand(options) {
 
 // src/attribute-cli.ts
 import { QmdClient } from "@remnic/core";
-import { lstat as lstat8, readdir as readdir9, readFile as readFile26 } from "fs/promises";
-import path42 from "path";
+import { lstat as lstat8, readdir as readdir9, readFile as readFile27 } from "fs/promises";
+import path43 from "path";
 function parseFrontmatter2(fileContent) {
   const lines = fileContent.split(/\r?\n/);
   if (lines.length > 0 && lines[0].trim() === "---") {
@@ -48949,7 +49067,7 @@ async function scanMemoryDir(dirPath) {
       if (entry.isSymbolicLink()) {
         continue;
       }
-      const fullPath = path42.join(currentDir, entry.name);
+      const fullPath = path43.join(currentDir, entry.name);
       try {
         const stats = await lstat8(fullPath);
         if (stats.isSymbolicLink()) {
@@ -48961,9 +49079,9 @@ async function scanMemoryDir(dirPath) {
           }
           await walk(fullPath, depth + 1);
         } else if (stats.isFile() && entry.name.endsWith(".md")) {
-          const content = await readFile26(fullPath, "utf8");
+          const content = await readFile27(fullPath, "utf8");
           const { id, body } = parseFrontmatter2(content);
-          const relPath = path42.relative(dirPath, fullPath);
+          const relPath = path43.relative(dirPath, fullPath);
           memories.push({
             id: id ?? relPath,
             content: body.trim()
@@ -48981,24 +49099,24 @@ async function scanMemoryDir(dirPath) {
   return memories;
 }
 async function resolveQmdMemory(memoryDir, collection, resultPath) {
-  const root = path42.resolve(memoryDir);
+  const root = path43.resolve(memoryDir);
   const candidates = /* @__PURE__ */ new Set();
   const addCandidate = (candidate) => {
-    const resolved = path42.resolve(candidate);
-    const relative = path42.relative(root, resolved);
-    if (relative !== ".." && !relative.startsWith(`..${path42.sep}`) && !path42.isAbsolute(relative)) {
+    const resolved = path43.resolve(candidate);
+    const relative = path43.relative(root, resolved);
+    if (relative !== ".." && !relative.startsWith(`..${path43.sep}`) && !path43.isAbsolute(relative)) {
       candidates.add(resolved);
     }
   };
   const addRelative = (relativePath) => {
     const normalized = relativePath.replace(/\\/g, "/").replace(/^\/+/, "");
     if (!normalized) return;
-    addCandidate(path42.join(root, normalized));
+    addCandidate(path43.join(root, normalized));
     if (/^\d{4}-\d{2}-\d{2}\//.test(normalized)) {
-      addCandidate(path42.join(root, "facts", normalized));
+      addCandidate(path43.join(root, "facts", normalized));
     }
   };
-  if (path42.isAbsolute(resultPath)) {
+  if (path43.isAbsolute(resultPath)) {
     addCandidate(resultPath);
   } else {
     addRelative(resultPath);
@@ -49012,7 +49130,7 @@ async function resolveQmdMemory(memoryDir, collection, resultPath) {
     try {
       const stats = await lstat8(candidate);
       if (!stats.isFile() || stats.isSymbolicLink()) continue;
-      const parsed = parseFrontmatter2(await readFile26(candidate, "utf8"));
+      const parsed = parseFrontmatter2(await readFile27(candidate, "utf8"));
       if (!parsed.id || parsed.id.trim().length === 0) {
         throw new Error("QMD result has no canonical frontmatter id");
       }