@syv-ai/rulecast 0.2.0 → 0.3.0

package/README.md

@@ -92,6 +92,7 @@ A refusal only ever rests on the text the agent is writing, never on a reconstru
 | `rulecast init` | Interactive setup |
 | `rulecast install` / `uninstall` | Add or remove the agent hooks |
 | `rulecast run` | Check staged files, changed files, or everything |
+| `rulecast test` | Run each rule's good/bad examples; `--against` says how much it would flag |
 | `rulecast validate` | Check the config and print diagnostics |
 | `rulecast doctor` | Compile, check the environment, dry-run every rule |
 | `rulecast autoupdate` | Move pinned rule repos to their latest tag |
@@ -102,11 +103,57 @@ A refusal only ever rests on the text the agent is writing, never on a reconstru
 
 `rulecast run` is also how you use rulecast in CI. `--from-ref main` checks only what a branch changed, which matters most for `llm` rules — they judge changed files only.
 
+## Adopting a rule on a codebase that already breaks it
+
+`rulecast run --all-files --summary` tells you how much you already owe:
+
+```text
+backlog: 57 violations in 31 files
+
+  rule                            violations  files
+  python/routes-never-call-crud           57     31
+
+  worst files                     violations
+  app/api/routes/orders.py                12
+  app/api/routes/users.py                  9
+```
+
+Watch the count, not the rate. Here is one real codebase on one rule, on `main`:
+
+| date | violating / total |
+|---|---|
+| 2026-01-15 | 61 / 80 |
+| 2026-06-01 | 58 / 143 |
+| 2026-09-25 | 57 / 194 |
+
+The rate fell from 76% to 29% and the count did not move. New code complied; the old violations were
+never fixed, only diluted. A team watching the percentage would have believed it was winning.
+
+Per-edit enforcement does not touch that stock — it only stops it growing. Fix it a file at a time:
+edits to files that already followed the rule broke it 2% of the time, against 37% in files that
+mostly did not, so a file you clean tends to stay clean. (One rule across 19 files: suggestive, not
+proven.)
+
 If something is configured but quiet, `rulecast doctor` says why: it compiles the config, reports whether each rule's linter, parser, script or API key is actually there, says where the hooks and caches live, and runs every rule against one file it matches.
 
 ## Agents
 
-rulecast ships docs written for coding agents, not for people:
+rulecast ships docs written for coding agents, not for people. Paste this to yours and it will set
+rulecast up itself:
+
+```text
+Set up rulecast in this project. Read
+https://raw.githubusercontent.com/syv-ai/rulecast/v0.3.0/agents/SETUP.md
+and follow it. Show me every file it creates or changes before I commit anything.
+```
+
+If your agent cannot fetch a URL, this is the whole of it: run
+`npx @syv-ai/rulecast init --yes --agent <your agent, e.g. claude-code>`, then show me
+`.rulecast-config.yaml` and the other files it listed. Never edit hook settings by hand —
+`rulecast install` and `rulecast uninstall` own them.
+
+Once it is set up, ask the same agent to draft rules for your own conventions; `init` prints the
+prompt to paste.
 
 - [`agents/SETUP.md`](https://github.com/syv-ai/rulecast/blob/main/agents/SETUP.md) — give this to your agent and it will set rulecast up itself.
 - [`agents/DRAFT-RULES.md`](https://github.com/syv-ai/rulecast/blob/main/agents/DRAFT-RULES.md) — it reads your `AGENTS.md`, proposes one rule per convention that code can visibly break, shows you what each would flag today, and asks you to keep, edit or drop it.
@@ -138,7 +185,7 @@ The budget is what shapes the design: one detector run per kind per event, kinds
 
 0.1. Everything above works and is tested. The config format may still change before 1.0 — `minimum_rulecast_version` exists so a rule can say what it needs.
 
-Next: adapters for Codex, Cursor and OpenCode; Biome; rule tests (good and bad examples run by `rulecast test`); an Azure OpenAI provider.
+Next: adapters for Codex, Cursor and OpenCode; Biome; an Azure OpenAI provider.
 
 ## License
 

package/dist/{chunk-RODZRI7B.js → chunk-7KUPYT35.js}

@@ -1,4 +1,5 @@
 import {
+  BACKLOG_HINT,
   DeadlineError,
   LLM_PROVIDERS,
   VERSION,
@@ -23,7 +24,7 @@ import {
   sectionRange,
   sectionText,
   templateBindings
-} from "./chunk-ZEFEQKG5.js";
+} from "./chunk-HZUATJ53.js";
 
 // src/core/config/load.ts
 import { readFile } from "fs/promises";
@@ -34,9 +35,11 @@ import { parse } from "yaml";
 import { z } from "zod";
 var STAGES = ["touch", "edit", "verify"];
 var RULE_ID = /^[a-z0-9-]+(\/[a-z0-9-]+)*$/;
+var RULE_SCOPES = ["instance", "container"];
 var idSchema = z.string().regex(RULE_ID, "must be lowercase segments separated by /");
 var versionSchema = z.string().regex(/^\d+\.\d+\.\d+$/, "must be a version like 0.2.0");
 var stagesSchema = z.array(z.enum(STAGES)).nonempty();
+var exampleSchema = z.object({ path: z.string().min(1), code: z.string() }).strict();
 var ruleKeys = {
   alias: idSchema.optional(),
   name: z.string().min(1).optional(),
@@ -49,10 +52,18 @@ var ruleKeys = {
   stages: stagesSchema.optional(),
   minimum_rulecast_version: versionSchema.optional(),
   severity: z.enum(["error", "warning"]).optional(),
+  /**
+   * What the convention belongs to (§8). `instance`: the token the detector matched, classified by
+   * whether the agent's edit touched it. `container`: the node the match spans, classified by
+   * whether that node already violated the rule at the baseline.
+   */
+  scope: z.enum(RULE_SCOPES).optional(),
   refuse_write: z.boolean().optional(),
   detect: z.record(z.unknown()).refine((value) => Object.keys(value).length === 1, "must name exactly one detector").optional(),
   message: z.string().optional(),
-  context: z.array(referenceInputSchema).optional()
+  context: z.array(referenceInputSchema).optional(),
+  /** Code the rule must flag (`bad`) and must not (`good`), run by `rulecast test`. */
+  examples: z.object({ good: z.array(exampleSchema).default([]), bad: z.array(exampleSchema).default([]) }).strict().optional()
 };
 var overrideSchema = z.object({ id: idSchema, ...ruleKeys }).strict();
 var ruleSchema = overrideSchema.extend({ name: z.string().min(1) });
@@ -655,14 +666,16 @@ import { createHash as createHash3 } from "crypto";
 
 // src/core/baseline/changes.ts
 import { diffArrays } from "diff";
-function changedLines(before, after) {
-  const ranges = [];
+function diffLines(before, after) {
+  const changed = [];
+  const runs = [];
   const mark = (start, end) => {
-    const previous = ranges.at(-1);
+    const previous = changed.at(-1);
     if (previous && start <= previous[1] + 1) previous[1] = Math.max(previous[1], end);
-    else ranges.push([start, end]);
+    else changed.push([start, end]);
   };
   let line = 1;
+  let baselineLine = 1;
   for (const part of diffArrays(Array.from(before), Array.from(after))) {
     const count = part.count ?? part.value.length;
     if (part.added) {
@@ -673,11 +686,17 @@ function changedLines(before, after) {
         const at = Math.min(line, after.length);
         mark(at, at);
       }
+      baselineLine += count;
     } else {
+      runs.push({ beforeStart: baselineLine, afterStart: line, count });
       line += count;
+      baselineLine += count;
     }
   }
-  return ranges;
+  return { changed, map: { runs, afterLines: after.length } };
+}
+function identityMap(lines) {
+  return { runs: lines === 0 ? [] : [{ beforeStart: 1, afterStart: 1, count: lines }], afterLines: lines };
 }
 
 // src/core/baseline/hash.ts
@@ -716,21 +735,28 @@ function snapshotOf(text) {
 
 // src/core/baseline/baseline.ts
 async function computeChanges(root, files, sources) {
-  const changes = /* @__PURE__ */ new Map();
+  const changes = { sets: /* @__PURE__ */ new Map(), maps: /* @__PURE__ */ new Map(), fromCommit: /* @__PURE__ */ new Map() };
   for (const file of files) {
     if (!sources.snapshots.has(file) && !sources.fallbackCommit) continue;
     let before = sources.snapshots.get(file) ?? null;
+    let commitText = null;
     if (!before && sources.fallbackCommit) {
-      const text = await fileAtCommit(root, sources.fallbackCommit, file);
-      before = text === null ? null : snapshotOf(text);
+      commitText = await fileAtCommit(root, sources.fallbackCommit, file);
+      before = commitText === null ? null : snapshotOf(commitText);
     }
     if (!before) continue;
     const current = await readSourceFile(root, file);
     if (current === null) continue;
+    if (commitText !== null) changes.fromCommit.set(file, commitText);
     const after = snapshotOf(current);
-    changes.set(file, {
-      changedLines: after.fileHash === before.fileHash ? [] : changedLines(before.lines, after.lines)
-    });
+    if (after.fileHash === before.fileHash) {
+      changes.sets.set(file, { changedLines: [] });
+      changes.maps.set(file, identityMap(after.lines.length));
+      continue;
+    }
+    const diff = diffLines(before.lines, after.lines);
+    changes.sets.set(file, { changedLines: diff.changed });
+    changes.maps.set(file, diff.map);
   }
   return changes;
 }
@@ -740,6 +766,151 @@ function isNew(match, changes) {
   return change.changedLines.some(([start, end]) => match.line <= end && match.endLine >= start);
 }
 
+// src/core/baseline/fingerprint.ts
+function mapRange(map, [start, end]) {
+  let first = null;
+  let last = 0;
+  for (const run2 of map.runs) {
+    const from = Math.max(start, run2.beforeStart);
+    const to = Math.min(end, run2.beforeStart + run2.count - 1);
+    if (from > to) continue;
+    if (first === null) first = run2.afterStart + (from - run2.beforeStart);
+    last = run2.afterStart + (to - run2.beforeStart);
+  }
+  return first === null ? null : [first, last];
+}
+function classify(match, scope, rule, changes, fingerprints) {
+  const instance = () => isNew(match, changes.sets) ? "new" : "preexisting";
+  if (scope === "instance") return instance();
+  const recorded = fingerprints.get(match.file)?.get(rule);
+  const map = changes.maps.get(match.file);
+  if (recorded === void 0 || map === void 0) return instance();
+  for (const range of recorded) {
+    const mapped = mapRange(map, range);
+    if (mapped !== null && match.line <= mapped[1] && match.endLine >= mapped[0]) return "preexisting";
+  }
+  return "new";
+}
+
+// src/core/detection/budget.ts
+function applyFileBudget(kind, selections, maxFiles, recent) {
+  const ofKind = selections.filter((selection) => selection.rule.detector?.kind === kind);
+  const files = [...new Set(ofKind.flatMap((selection) => selection.files))];
+  if (files.length <= maxFiles) return { selections, skipped: [] };
+  const rank = new Map(recent.map((file, index) => [file, index]));
+  const ordered = [...files].sort((a, b) => (rank.get(a) ?? recent.length) - (rank.get(b) ?? recent.length));
+  const keep = new Set(ordered.slice(0, maxFiles));
+  return {
+    selections: selections.map(
+      (selection) => selection.rule.detector?.kind === kind ? { ...selection, files: selection.files.filter((file) => keep.has(file)) } : selection
+    ).filter((selection) => selection.files.length > 0),
+    skipped: ordered.slice(maxFiles)
+  };
+}
+async function applySizeCeiling(selections, maxBytes, bounded, sizeOf) {
+  const files = [...new Set(selections.filter((one) => bounded(one.rule.detector.kind)).flatMap((one) => one.files))];
+  if (files.length === 0) return { selections, skipped: [] };
+  const sizes = await Promise.all(files.map(async (file) => [file, await sizeOf(file)]));
+  const over = new Set(sizes.filter(([, size]) => size !== null && size > maxBytes).map(([file]) => file));
+  if (over.size === 0) return { selections, skipped: [] };
+  return {
+    selections: selections.map(
+      (selection) => bounded(selection.rule.detector.kind) ? { ...selection, files: selection.files.filter((file) => !over.has(file)) } : selection
+    ).filter((selection) => selection.files.length > 0),
+    skipped: files.filter((file) => over.has(file))
+  };
+}
+
+// src/core/detection/run.ts
+var TIMED_OUT = /* @__PURE__ */ Symbol("timed out");
+async function runDetection(input) {
+  const output = { findings: [], errors: [], timedOut: [] };
+  const byKind = /* @__PURE__ */ new Map();
+  for (const selection of input.selections) {
+    const kind = selection.rule.detector.kind;
+    const group = byKind.get(kind);
+    if (group === void 0) byKind.set(kind, [selection]);
+    else group.push(selection);
+  }
+  const controller = new AbortController();
+  const deadline = new Promise((resolve) => {
+    controller.signal.addEventListener("abort", () => resolve(TIMED_OUT), { once: true });
+  });
+  const timer = setTimeout(() => controller.abort(), input.timeoutMs);
+  const deadlineAt = Date.now() + input.timeoutMs;
+  const late = () => Date.now() > deadlineAt;
+  const perKind = await Promise.all(
+    [...byKind].map(async ([kind, selections]) => {
+      const detector = input.registry.get(kind);
+      if (!detector) return { status: "error", kind, selections, message: `detector "${kind}" is not registered` };
+      try {
+        const rules = await Promise.all(
+          selections.map(async ({ rule, files }) => ({
+            id: rule.id,
+            config: rule.detector.config,
+            files,
+            context: await input.contextFor(rule)
+          }))
+        );
+        const result = await Promise.race([
+          detector.run({
+            event: input.event,
+            rules,
+            read: input.read,
+            changes: input.changes,
+            cache: input.cacheFor(kind),
+            settings: input.settings,
+            cwd: input.root,
+            signal: controller.signal,
+            deadlineAt
+          }),
+          deadline
+        ]);
+        if (result === TIMED_OUT || late()) return { status: "timedOut", kind, selections };
+        return { status: "ok", kind, selections, result };
+      } catch (error) {
+        if (error instanceof DeadlineError || controller.signal.aborted || late()) {
+          return { status: "timedOut", kind, selections };
+        }
+        return { status: "error", kind, selections, message: errorMessage(error) };
+      }
+    })
+  );
+  clearTimeout(timer);
+  for (const outcome of perKind) {
+    const ids = outcome.selections.map((selection) => selection.rule.id);
+    if (outcome.status === "timedOut") {
+      output.timedOut.push({ kind: outcome.kind, rules: ids });
+      continue;
+    }
+    if (outcome.status === "error") {
+      output.errors.push({ kind: outcome.kind, rules: ids, message: outcome.message });
+      continue;
+    }
+    const result = outcome.result;
+    const rulesById = new Map(outcome.selections.map((selection) => [selection.rule.id, selection.rule]));
+    const stray = result.findings.find((finding) => !rulesById.has(finding.rule));
+    const wholeRun = result.errors.find((error) => error.rule === null);
+    if (stray || wholeRun) {
+      const message = stray ? `detector reported unknown rule "${stray.rule}"` : wholeRun.message;
+      output.errors.push({ kind: outcome.kind, rules: ids, message });
+      continue;
+    }
+    const failed = /* @__PURE__ */ new Map();
+    for (const error of result.errors) failed.set(error.rule, error.message);
+    for (const finding of result.findings) {
+      const rule = rulesById.get(finding.rule);
+      const missing = rule.detector.captures.find((name) => typeof finding.match.captures[name] !== "string");
+      if (missing && !failed.has(rule.id)) failed.set(rule.id, `match is missing declared capture "${missing}"`);
+    }
+    for (const [rule, message] of failed) output.errors.push({ kind: outcome.kind, rules: [rule], message });
+    for (const finding of result.findings) {
+      if (!failed.has(finding.rule)) output.findings.push({ rule: rulesById.get(finding.rule), match: finding.match });
+    }
+  }
+  return output;
+}
+
 // src/core/baseline/store.ts
 import path7 from "path";
 
@@ -819,22 +990,74 @@ function startRecord(commit) {
 function snapshotRecord(file, snapshot) {
   return { t: "snapshot", file, fileHash: snapshot.fileHash, lines: encodeLines(snapshot.lines) };
 }
+function fingerprintRecord(file, rule, ranges) {
+  return { t: "fingerprint", file, rule, ranges };
+}
 async function appendBaseline(sessionDir2, records) {
   await appendRecords(storeFile(sessionDir2), records);
 }
 async function readBaseline(sessionDir2) {
-  const state = { started: false, startCommit: null, snapshots: /* @__PURE__ */ new Map() };
+  const state = { started: false, startCommit: null, snapshots: /* @__PURE__ */ new Map(), fingerprints: /* @__PURE__ */ new Map() };
   for (const record of await readRecords(storeFile(sessionDir2))) {
     if (record.t === "start" && !state.started) {
       state.started = true;
       state.startCommit = record.commit;
     } else if (record.t === "snapshot" && !state.snapshots.has(record.file)) {
       state.snapshots.set(record.file, { fileHash: record.fileHash, lines: decodeLines(record.lines) });
+    } else if (record.t === "fingerprint") {
+      const byRule = state.fingerprints.get(record.file) ?? /* @__PURE__ */ new Map();
+      state.fingerprints.set(record.file, byRule);
+      if (!byRule.has(record.rule)) byRule.set(record.rule, record.ranges);
     }
   }
   return state;
 }
 
+// src/core/baseline/record.ts
+async function recordFingerprints(input) {
+  if (!input.rules.some((rule) => rule.scope === "container")) return [];
+  const guards = (kind) => input.registry.get(kind)?.guards === true;
+  let selections = selectDetectorRules(input.rules, input.event, input.files, input.disabled).filter(
+    (selection) => selection.rule.scope === "container" && selection.rule.detector.kind !== "llm" && (input.source === "disk" || guards(selection.rule.detector.kind))
+  );
+  if (input.ceiling) {
+    const applied = await applySizeCeiling(selections, input.ceiling.maxFileBytes, guards, input.ceiling.sizeOf);
+    selections = applied.selections;
+  }
+  if (selections.length === 0) return [];
+  const output = await runDetection({
+    root: input.root,
+    event: input.event,
+    selections,
+    // No change set: the baseline content is being measured whole, and there is nothing it is a
+    // change from. A detector that reads `changes` treats an absent file as entirely new, which is
+    // exactly right here.
+    changes: /* @__PURE__ */ new Map(),
+    read: input.read,
+    registry: input.registry,
+    cacheFor: input.cacheFor,
+    contextFor: input.contextFor,
+    settings: input.settings,
+    timeoutMs: input.timeoutMs
+  });
+  const unmeasured = /* @__PURE__ */ new Set();
+  for (const error of output.errors) for (const rule of error.rules) unmeasured.add(rule);
+  for (const timeout of output.timedOut) for (const rule of timeout.rules) unmeasured.add(rule);
+  const key = (file, rule) => `${file}\0${rule}`;
+  const ranges = /* @__PURE__ */ new Map();
+  for (const { rule, match } of output.findings) {
+    const found = ranges.get(key(match.file, rule.id));
+    if (found === void 0) ranges.set(key(match.file, rule.id), [[match.line, match.endLine]]);
+    else found.push([match.line, match.endLine]);
+  }
+  const records = [];
+  for (const { rule, files } of selections) {
+    if (unmeasured.has(rule.id)) continue;
+    for (const file of files) records.push(fingerprintRecord(file, rule.id, ranges.get(key(file, rule.id)) ?? []));
+  }
+  return records;
+}
+
 // src/core/delivery/persist.ts
 import { mkdirSync as mkdirSync2, readdirSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
 import path8 from "path";
@@ -913,125 +1136,6 @@ function createReferenceResolver(root) {
   };
 }
 
-// src/core/detection/budget.ts
-function applyFileBudget(kind, selections, maxFiles, recent) {
-  const ofKind = selections.filter((selection) => selection.rule.detector?.kind === kind);
-  const files = [...new Set(ofKind.flatMap((selection) => selection.files))];
-  if (files.length <= maxFiles) return { selections, skipped: [] };
-  const rank = new Map(recent.map((file, index) => [file, index]));
-  const ordered = [...files].sort((a, b) => (rank.get(a) ?? recent.length) - (rank.get(b) ?? recent.length));
-  const keep = new Set(ordered.slice(0, maxFiles));
-  return {
-    selections: selections.map(
-      (selection) => selection.rule.detector?.kind === kind ? { ...selection, files: selection.files.filter((file) => keep.has(file)) } : selection
-    ).filter((selection) => selection.files.length > 0),
-    skipped: ordered.slice(maxFiles)
-  };
-}
-async function applySizeCeiling(selections, maxBytes, bounded, sizeOf) {
-  const files = [...new Set(selections.filter((one) => bounded(one.rule.detector.kind)).flatMap((one) => one.files))];
-  if (files.length === 0) return { selections, skipped: [] };
-  const sizes = await Promise.all(files.map(async (file) => [file, await sizeOf(file)]));
-  const over = new Set(sizes.filter(([, size]) => size !== null && size > maxBytes).map(([file]) => file));
-  if (over.size === 0) return { selections, skipped: [] };
-  return {
-    selections: selections.map(
-      (selection) => bounded(selection.rule.detector.kind) ? { ...selection, files: selection.files.filter((file) => !over.has(file)) } : selection
-    ).filter((selection) => selection.files.length > 0),
-    skipped: files.filter((file) => over.has(file))
-  };
-}
-
-// src/core/detection/run.ts
-var TIMED_OUT = /* @__PURE__ */ Symbol("timed out");
-async function runDetection(input) {
-  const output = { findings: [], errors: [], timedOut: [] };
-  const byKind = /* @__PURE__ */ new Map();
-  for (const selection of input.selections) {
-    const kind = selection.rule.detector.kind;
-    const group = byKind.get(kind);
-    if (group === void 0) byKind.set(kind, [selection]);
-    else group.push(selection);
-  }
-  const controller = new AbortController();
-  const deadline = new Promise((resolve) => {
-    controller.signal.addEventListener("abort", () => resolve(TIMED_OUT), { once: true });
-  });
-  const timer = setTimeout(() => controller.abort(), input.timeoutMs);
-  const deadlineAt = Date.now() + input.timeoutMs;
-  const late = () => Date.now() > deadlineAt;
-  const perKind = await Promise.all(
-    [...byKind].map(async ([kind, selections]) => {
-      const detector = input.registry.get(kind);
-      if (!detector) return { status: "error", kind, selections, message: `detector "${kind}" is not registered` };
-      try {
-        const rules = await Promise.all(
-          selections.map(async ({ rule, files }) => ({
-            id: rule.id,
-            config: rule.detector.config,
-            files,
-            context: await input.contextFor(rule)
-          }))
-        );
-        const result = await Promise.race([
-          detector.run({
-            event: input.event,
-            rules,
-            read: input.read,
-            changes: input.changes,
-            cache: input.cacheFor(kind),
-            settings: input.settings,
-            cwd: input.root,
-            signal: controller.signal,
-            deadlineAt
-          }),
-          deadline
-        ]);
-        if (result === TIMED_OUT || late()) return { status: "timedOut", kind, selections };
-        return { status: "ok", kind, selections, result };
-      } catch (error) {
-        if (error instanceof DeadlineError || controller.signal.aborted || late()) {
-          return { status: "timedOut", kind, selections };
-        }
-        return { status: "error", kind, selections, message: errorMessage(error) };
-      }
-    })
-  );
-  clearTimeout(timer);
-  for (const outcome of perKind) {
-    const ids = outcome.selections.map((selection) => selection.rule.id);
-    if (outcome.status === "timedOut") {
-      output.timedOut.push({ kind: outcome.kind, rules: ids });
-      continue;
-    }
-    if (outcome.status === "error") {
-      output.errors.push({ kind: outcome.kind, rules: ids, message: outcome.message });
-      continue;
-    }
-    const result = outcome.result;
-    const rulesById = new Map(outcome.selections.map((selection) => [selection.rule.id, selection.rule]));
-    const stray = result.findings.find((finding) => !rulesById.has(finding.rule));
-    const wholeRun = result.errors.find((error) => error.rule === null);
-    if (stray || wholeRun) {
-      const message = stray ? `detector reported unknown rule "${stray.rule}"` : wholeRun.message;
-      output.errors.push({ kind: outcome.kind, rules: ids, message });
-      continue;
-    }
-    const failed = /* @__PURE__ */ new Map();
-    for (const error of result.errors) failed.set(error.rule, error.message);
-    for (const finding of result.findings) {
-      const rule = rulesById.get(finding.rule);
-      const missing = rule.detector.captures.find((name) => typeof finding.match.captures[name] !== "string");
-      if (missing && !failed.has(rule.id)) failed.set(rule.id, `match is missing declared capture "${missing}"`);
-    }
-    for (const [rule, message] of failed) output.errors.push({ kind: outcome.kind, rules: [rule], message });
-    for (const finding of result.findings) {
-      if (!failed.has(finding.rule)) output.findings.push({ rule: rulesById.get(finding.rule), match: finding.match });
-    }
-  }
-  return output;
-}
-
 // src/core/detection/proposal.ts
 function propose(current, intent) {
   if (intent.content !== void 0) {
@@ -1140,6 +1244,7 @@ var ITEM_OVERHEAD = 64;
 var HEADER_OVERHEAD = 128;
 var OVERFLOW_NOTICE = 256;
 var REFERENCE_OVERHEAD = 96;
+var BACKLOG_HEADING = "backlog in files you touched (not from your edit):";
 var WARNING_SHARE = 0.15;
 var moreWarnings = (count) => `\u2026and ${count} more (run rulecast validate)`;
 function locationOf(spec) {
@@ -1351,6 +1456,7 @@ async function decide(input) {
     used += size;
     context.push({ t: "delivered", path: resolved.spec.path, anchor: resolved.spec.anchor, hash: resolved.hash });
   }
+  if (delivery.preexistingSummary.length > 0) used += BACKLOG_HEADING.length + BACKLOG_HINT.length + ITEM_OVERHEAD;
   const summariesKept = [];
   for (const summary of delivery.preexistingSummary) {
     if (!fits(summary.rule.length + summary.file.length + ITEM_OVERHEAD)) {
@@ -1589,7 +1695,12 @@ async function runPipeline(options) {
     if (session) await appendContext(session.dir, session.agent, [{ t: "reset" }]);
     if (!session || restoredFiles === 0) return { delivery: emptyDelivery(), failed, deadlineMissed };
   }
-  let baseline = { started: false, startCommit: null, snapshots: /* @__PURE__ */ new Map() };
+  let baseline = {
+    started: false,
+    startCommit: null,
+    snapshots: /* @__PURE__ */ new Map(),
+    fingerprints: /* @__PURE__ */ new Map()
+  };
   if (session && event.kind !== "reset" && event.kind !== "guard") {
     const dir = session.dir;
     baseline = await readingStore(() => readBaseline(dir), baseline);
@@ -1644,10 +1755,32 @@ async function runPipeline(options) {
     if (event.completeRead) agentRead = event.files[0] ?? null;
     if (session) {
       const records = [];
+      const snapshotted = [];
       for (const file of relevant(event.files)) {
         if (baseline.snapshots.has(file)) continue;
         const text = await readSourceFile(root, file);
-        if (text !== null) records.push(snapshotRecord(file, snapshotOf(text)));
+        if (text === null) continue;
+        records.push(snapshotRecord(file, snapshotOf(text)));
+        snapshotted.push(file);
+      }
+      if (snapshotted.length > 0) {
+        records.push(
+          ...await recordFingerprints({
+            root,
+            files: snapshotted,
+            rules: project.rules,
+            disabled,
+            registry,
+            read: (file) => readSourceFile(root, file),
+            cacheFor: (kind) => diskCache(detectorCacheDir(stateDir, kind)),
+            contextFor: (rule) => resolveRuleContext(resolver, rule.context),
+            settings: { llm: config.llm },
+            event: "edit",
+            source: "disk",
+            timeoutMs: config.timeouts.editDeadlineMs,
+            ceiling: { maxFileBytes: config.maxFileBytes, sizeOf: (file) => fileBytes(root, file) }
+          })
+        );
       }
       await appendBaseline(session.dir, records);
     }
@@ -1669,10 +1802,36 @@ async function runPipeline(options) {
       }
       if (event.files.length === 0 && session) files = relevant(view.work.edited);
     }
-    const changes = await computeChanges(root, files, { snapshots, fallbackCommit });
+    const baselineChanges = await computeChanges(root, files, { snapshots, fallbackCommit });
+    const changes = baselineChanges.sets;
     if (event.kind === "verify" && session && !event.baseCommit) {
       files = files.filter((file) => changes.get(file)?.changedLines.length !== 0);
     }
+    if (event.kind === "verify" && baselineChanges.fromCommit.size > 0) {
+      const texts = baselineChanges.fromCommit;
+      const missing = [...texts.keys()].filter((file) => !baseline.fingerprints.has(file));
+      const records = missing.length === 0 ? [] : await recordFingerprints({
+        root,
+        files: missing,
+        rules: project.rules,
+        disabled,
+        registry,
+        read: async (file) => texts.get(file) ?? null,
+        cacheFor: (kind) => diskCache(detectorCacheDir(stateDir, kind)),
+        contextFor: (rule) => resolveRuleContext(resolver, rule.context),
+        settings: { llm: config.llm },
+        event: "verify",
+        source: "memory",
+        timeoutMs: config.timeouts.verifyMs
+      });
+      for (const record of records) {
+        if (record.t !== "fingerprint") continue;
+        const byRule = baseline.fingerprints.get(record.file) ?? /* @__PURE__ */ new Map();
+        baseline.fingerprints.set(record.file, byRule);
+        byRule.set(record.rule, record.ranges);
+      }
+      if (session && records.length > 0) await appendBaseline(session.dir, records);
+    }
     const skip = options.skipDetectorKinds ?? /* @__PURE__ */ new Set();
     let selections = selectDetectorRules(project.rules, event.kind, files, disabled).filter(
       (selection) => !skip.has(selection.rule.detector.kind) && (options.onlyRules?.has(selection.rule.id) ?? true)
@@ -1710,7 +1869,7 @@ async function runPipeline(options) {
     findings = output.findings.map(({ rule, match }) => ({
       rule,
       match,
-      status: isNew(match, changes) ? "new" : "preexisting"
+      status: classify(match, rule.scope, rule.id, baselineChanges, baseline.fingerprints)
     }));
     for (const error of output.errors) {
       failed = true;
@@ -1732,7 +1891,7 @@ async function runPipeline(options) {
         failed = true;
         warnings.push({
           key: `timeout:${timeout.kind}:${timeout.rules.join(",")}`,
-          // Naming the lever matters: dogfooding measured a single haiku call on a 135-line file
+          // Naming the lever matters: a field trial measured a single haiku call on a 135-line file
           // at 89 s against a 60 s default, and "timed out" alone leaves nobody knowing what to do.
           text: `${timeout.kind} detector timed out after ${config.timeouts.verifyMs} ms for ${timeout.rules.join(", ")}. Raise timeouts.verify_ms${timeout.kind === "llm" ? " (an llm rule on a large file can need 120000 or more)" : ""}.`
         });
@@ -1812,5 +1971,7 @@ export {
   cachedRepos,
   fetchingRepos,
   fixedRepo,
+  resolveRuleContext,
+  createReferenceResolver,
   runPipeline
 };