@tangle-network/traces 0.11.4 → 0.11.5

package/dist/{chunk-AGPOIWPQ.js → chunk-VTYOCFGF.js}

@@ -766,8 +766,8 @@ function serializeSpans(spans) {
 async function writeOtlpFile(spans, outPath) {
   const { mkdtemp: mkdtemp8, writeFile: writeFile10 } = await import("fs/promises");
   const { tmpdir: tmpdir9 } = await import("os");
-  const { join: join33 } = await import("path");
-  const path = outPath ?? join33(await mkdtemp8(join33(tmpdir9(), "traces-")), "spans.otlp.jsonl");
+  const { join: join34 } = await import("path");
+  const path = outPath ?? join34(await mkdtemp8(join34(tmpdir9(), "traces-")), "spans.otlp.jsonl");
   await writeFile10(path, serializeSpans(spans), "utf8");
   return path;
 }
@@ -7419,7 +7419,7 @@ function zaiChatCaller(options) {
     }
   };
 }
-function clip(text2, limit) {
+function clipText(text2, limit) {
   if (text2.length <= limit) return text2;
   const half = Math.floor(limit / 2);
   return `${text2.slice(0, half)}
@@ -7428,11 +7428,11 @@ ${text2.slice(-half)}`;
 }
 function renderStep(step, marker) {
   const rc = parseRecordedReturncode(step.observation);
-  const output = clip(parseObservationOutput(step.observation).trim(), 1600);
+  const output = clipText(parseObservationOutput(step.observation).trim(), 1600);
   return [
     `### step ${step.step_id}${marker}`,
     "```sh",
-    clip(step.action, 2e3),
+    clipText(step.action, 2e3),
     "```",
     `returncode: ${rc ?? "none recorded"}`,
     output.length > 0 ? `output:
@@ -7441,13 +7441,25 @@ ${output}
 \`\`\`` : "output: (empty)"
   ].join("\n");
 }
-function buildFixPrompt(input) {
+function promptBody(input) {
   const radius = input.contextRadius ?? 3;
   const target = input.steps.find((s) => s.step_id === input.k);
   if (!target) throw new Error(`replay-fix: no step with step_id ${input.k}`);
   const context = input.steps.filter(
     (s) => s.step_id !== input.k && Math.abs(s.step_id - input.k) <= radius
   );
+  return [
+    "## Task the agent was solving",
+    input.taskStatement ? clipText(input.taskStatement, 4e3) : "(no task statement recorded)",
+    "",
+    "## Surrounding steps",
+    ...context.map((s) => renderStep(s, "")),
+    "",
+    "## Failing step to correct",
+    renderStep(target, " (INCORRECT \u2014 correct this one)")
+  ];
+}
+function buildFixPrompt(input) {
   const system = [
     "You repair one failed shell command from a recorded coding-agent trajectory.",
     "The trajectory replays inside the original docker image; every command runs as a fresh /bin/sh subshell from a fixed working directory.",
@@ -7456,19 +7468,62 @@ function buildFixPrompt(input) {
     "The corrected command must accomplish the failing step's intent and exit 0. No prose outside the fenced block."
   ].join("\n");
   const user = [
-    "## Task the agent was solving",
-    input.taskStatement ? clip(input.taskStatement, 4e3) : "(no task statement recorded)",
+    ...promptBody(input),
     "",
-    "## Surrounding steps",
-    ...context.map((s) => renderStep(s, "")),
+    "Output the single corrected replacement for the failing step now."
+  ].join("\n");
+  return { system, user };
+}
+function renderFailedAttempt(prior) {
+  if (prior.command === null) {
+    return [
+      `### attempt ${prior.attempt}`,
+      `model call failed before producing a command: ${prior.llmError ?? "unknown error"}`
+    ].join("\n");
+  }
+  const stdout = (prior.stdoutTail ?? "").trim();
+  const stderr = (prior.stderrTail ?? "").trim();
+  return [
+    `### attempt ${prior.attempt}`,
+    "```sh",
+    clipText(prior.command, 2e3),
+    "```",
+    `exit code: ${prior.exitCode ?? "not executed"}`,
+    stdout.length > 0 ? `stdout:
+\`\`\`
+${stdout}
+\`\`\`` : "stdout: (empty)",
+    stderr.length > 0 ? `stderr:
+\`\`\`
+${stderr}
+\`\`\`` : "stderr: (empty)"
+  ].join("\n");
+}
+function buildRetryFixPrompt(input, priorAttempts, maxScriptCommands = 5) {
+  if (priorAttempts.length === 0) {
+    throw new Error("replay-fix: buildRetryFixPrompt requires at least one prior attempt");
+  }
+  const system = [
+    "You repair one failed shell command from a recorded coding-agent trajectory.",
+    "The trajectory replays inside the original docker image; every command runs as a fresh /bin/sh subshell from a fixed working directory.",
+    "Earlier corrected commands were executed for real and failed; their actual output is included below.",
+    `Reply with a corrected fix inside a single \`\`\`sh fenced block: either one command, or a short script of at most ${maxScriptCommands} commands (one per line).`,
+    "The whole block executes as ONE /bin/sh unit from the fixed working directory and must exit 0.",
+    "Do not repeat a command that already failed. Keep reasoning brief. No prose outside the fenced block."
+  ].join("\n");
+  const user = [
+    ...promptBody(input),
     "",
-    "## Failing step to correct",
-    renderStep(target, " (INCORRECT \u2014 correct this one)"),
+    "## Previous fix attempts (executed for real \u2014 all failed)",
+    ...priorAttempts.map((prior) => renderFailedAttempt(prior)),
     "",
-    "Output the single corrected replacement for the failing step now."
+    `Output a corrected fix now \u2014 one \`\`\`sh block, at most ${maxScriptCommands} commands.`
   ].join("\n");
   return { system, user };
 }
+function countScriptCommands(script) {
+  return script.split("\n").filter((line) => line.trim().length > 0 && !line.trim().startsWith("#")).length;
+}
 function extractFixCommand(content) {
   const blocks = [...content.matchAll(/```(?:sh|bash|shell)?\n([\s\S]*?)```/g)];
   const candidate = blocks.length > 0 ? blocks[blocks.length - 1][1] : content;
@@ -7484,12 +7539,167 @@ async function generateFixCommand(caller, input) {
   if (command === null) {
     return {
       succeeded: false,
-      error: `completion carried no usable command: ${clip(outcome.value.content, 300)}`
+      error: `completion carried no usable command: ${clipText(outcome.value.content, 300)}`
     };
   }
   return { succeeded: true, value: { command, usage: outcome.value.usage } };
 }
 
+// src/replay-fix-loop.ts
+function toFailedAttempt(record2) {
+  return {
+    attempt: record2.attempt,
+    command: record2.command,
+    exitCode: record2.exitCode,
+    stdoutTail: record2.stdoutTail,
+    stderrTail: record2.stderrTail,
+    llmError: record2.llmError ?? record2.armBError
+  };
+}
+async function runFixLoop(caller, input, executor, options) {
+  if (!Number.isInteger(options.maxAttempts) || options.maxAttempts < 1) {
+    throw new Error(
+      `replay-fix-loop: maxAttempts must be a positive integer, got ${options.maxAttempts}`
+    );
+  }
+  const scriptCap = options.maxScriptCommands ?? 5;
+  const tailChars = options.outputTailChars ?? 1600;
+  const attempts = [];
+  let llmCalls = 0;
+  let llmFailures = 0;
+  let promptTokens = 0;
+  let completionTokens = 0;
+  const unexecuted = (attempt, llmError, usage, command, started) => ({
+    attempt,
+    command,
+    llmError,
+    usage,
+    executed: false,
+    exitCode: null,
+    prefixExecuted: null,
+    prefixDivergences: null,
+    failureVanished: null,
+    stdoutTail: null,
+    stderrTail: null,
+    armBError: null,
+    wallMs: Date.now() - started
+  });
+  for (let attempt = 1; attempt <= options.maxAttempts; attempt++) {
+    const started = Date.now();
+    const prompt = attempt === 1 ? buildFixPrompt(input) : buildRetryFixPrompt(input, attempts.map(toFailedAttempt), scriptCap);
+    llmCalls += 1;
+    const outcome = await caller.complete(prompt.system, prompt.user);
+    if (!outcome.succeeded) {
+      llmFailures += 1;
+      attempts.push(unexecuted(attempt, outcome.error, null, null, started));
+      options.onProgress?.(
+        `fix-loop attempt ${attempt}: LLM failed \u2014 ${outcome.error.slice(0, 160)}`
+      );
+      continue;
+    }
+    const usage = outcome.value.usage;
+    promptTokens += usage?.promptTokens ?? 0;
+    completionTokens += usage?.completionTokens ?? 0;
+    const command = extractFixCommand(outcome.value.content);
+    if (command === null) {
+      llmFailures += 1;
+      attempts.push(
+        unexecuted(
+          attempt,
+          `completion carried no usable command: ${clipText(outcome.value.content, 300)}`,
+          usage,
+          null,
+          started
+        )
+      );
+      continue;
+    }
+    if (attempt > 1) {
+      const commandLines = countScriptCommands(command);
+      if (commandLines > scriptCap) {
+        llmFailures += 1;
+        attempts.push(
+          unexecuted(
+            attempt,
+            `script exceeds ${scriptCap} command lines (${commandLines})`,
+            usage,
+            null,
+            started
+          )
+        );
+        options.onProgress?.(
+          `fix-loop attempt ${attempt}: rejected script with ${commandLines} command lines`
+        );
+        continue;
+      }
+    }
+    let execution;
+    try {
+      execution = await executor(command, attempt);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      attempts.push({
+        ...unexecuted(attempt, "", usage, command, started),
+        llmError: null,
+        armBError: message.slice(0, 500)
+      });
+      options.onProgress?.(
+        `fix-loop attempt ${attempt}: sandbox error \u2014 ${message.slice(0, 160)}`
+      );
+      return {
+        flipped: false,
+        flippedAtAttempt: null,
+        attempts,
+        aborted: true,
+        llmCalls,
+        llmFailures,
+        promptTokens,
+        completionTokens
+      };
+    }
+    attempts.push({
+      attempt,
+      command,
+      llmError: null,
+      usage,
+      executed: true,
+      exitCode: execution.exitCode,
+      prefixExecuted: execution.prefixExecuted,
+      prefixDivergences: execution.prefixDivergences,
+      failureVanished: execution.failureVanished,
+      stdoutTail: clipText(execution.stdout, tailChars),
+      stderrTail: clipText(execution.stderr, tailChars),
+      armBError: null,
+      wallMs: Date.now() - started
+    });
+    options.onProgress?.(
+      `fix-loop attempt ${attempt}: exit=${execution.exitCode} failureVanished=${execution.failureVanished}`
+    );
+    if (execution.failureVanished) {
+      return {
+        flipped: true,
+        flippedAtAttempt: attempt,
+        attempts,
+        aborted: false,
+        llmCalls,
+        llmFailures,
+        promptTokens,
+        completionTokens
+      };
+    }
+  }
+  return {
+    flipped: false,
+    flippedAtAttempt: null,
+    attempts,
+    aborted: false,
+    llmCalls,
+    llmFailures,
+    promptTokens,
+    completionTokens
+  };
+}
+
 // src/replay-batch.ts
 import { execFile } from "child_process";
 import { createHash as createHash8 } from "crypto";
@@ -7778,9 +7988,10 @@ async function runReplayBatch(options) {
     }
   }
   let llm = null;
-  if (options.fix === "generate") {
+  if (options.fix !== "none") {
     const caller = options.fixCaller;
-    if (!caller) throw new Error("replay-verify-batch: fix=generate requires a fixCaller");
+    if (!caller) throw new Error(`replay-verify-batch: fix=${options.fix} requires a fixCaller`);
+    const fixAttempts = options.fixAttempts ?? 3;
     const maxFixCases = options.maxFixCases ?? 30;
     const seed = options.seed ?? 17;
     const eligible = rows.filter((r) => r.status === "ok" && r.replayed);
@@ -7809,20 +8020,115 @@ async function runReplayBatch(options) {
             armBPrefixExecuted: null,
             armBPrefixDivergences: null,
             failureVanished: null,
-            armBError: null
+            armBError: null,
+            attempts: null,
+            flippedAtAttempt: null
           }
         };
         continue;
       }
       const replayCase = selected.find((c) => c.trajId === row.trajId && c.corpus === row.corpus);
       const label = `fix ${row.corpus}/${row.trajId}`;
-      onProgress(`${label}: generating corrected command`);
-      calls += 1;
-      const generated = await generateFixCommand(caller, {
+      const signature = verdictByTraj.get(row.trajId)?.signature ?? null;
+      const stepTimeoutMs = options.stepTimeoutMs ?? replayCase.recordedStepTimeoutMs ?? 12e4;
+      const promptInput = {
         taskStatement: replayCase.taskStatement,
         steps: replayCase.steps,
         k: replayCase.k
-      });
+      };
+      const caseOut = join21(options.out, caseOutDirName(row));
+      if (options.fix === "loop") {
+        onProgress(`${label}: fix loop (budget ${fixAttempts} attempts)`);
+        const result = await runFixLoop(
+          caller,
+          promptInput,
+          async (command, attempt) => {
+            onProgress(
+              `${label}: attempt ${attempt} arm B \u2014 ${command.split("\n")[0].slice(0, 120)}`
+            );
+            const armB = await executeArmB(
+              replayCase,
+              command,
+              backendFactory(row.derivedImage),
+              signature,
+              stepTimeoutMs,
+              options.prefixLimit,
+              (message) => onProgress(`${label}: attempt ${attempt}: ${message}`)
+            );
+            mkdirSync2(caseOut, { recursive: true });
+            writeFileSync2(
+              join21(caseOut, `armB-attempt${attempt}-result.json`),
+              `${JSON.stringify({ command, ...armB }, null, 2)}
+`
+            );
+            writeFileSync2(
+              join21(caseOut, "armB-result.json"),
+              `${JSON.stringify({ command, attempt, ...armB }, null, 2)}
+`
+            );
+            return armB;
+          },
+          { maxAttempts: fixAttempts, onProgress: (message) => onProgress(`${label}: ${message}`) }
+        );
+        calls += result.llmCalls;
+        failures += result.llmFailures;
+        promptTokens += result.promptTokens;
+        completionTokens += result.completionTokens;
+        const usage = result.promptTokens + result.completionTokens > 0 ? { promptTokens: result.promptTokens, completionTokens: result.completionTokens } : null;
+        const flippedRecord = result.flippedAtAttempt !== null ? result.attempts.find((a) => a.attempt === result.flippedAtAttempt) : null;
+        const summary = flippedRecord ?? [...result.attempts].reverse().find((a) => a.executed) ?? null;
+        const lastRecord = result.attempts.at(-1) ?? null;
+        rows[index] = {
+          ...row,
+          fix: summary ? {
+            attempted: true,
+            sampledOut: false,
+            command: summary.command,
+            llmError: null,
+            usage,
+            armBExit: summary.exitCode,
+            armBPrefixExecuted: summary.prefixExecuted,
+            armBPrefixDivergences: summary.prefixDivergences,
+            failureVanished: summary.failureVanished,
+            armBError: null,
+            attempts: result.attempts,
+            flippedAtAttempt: result.flippedAtAttempt
+          } : result.aborted ? {
+            attempted: true,
+            sampledOut: false,
+            command: lastRecord?.command ?? null,
+            llmError: null,
+            usage,
+            armBExit: null,
+            armBPrefixExecuted: null,
+            armBPrefixDivergences: null,
+            failureVanished: null,
+            armBError: lastRecord?.armBError ?? "sandbox error",
+            attempts: result.attempts,
+            flippedAtAttempt: null
+          } : {
+            attempted: true,
+            sampledOut: false,
+            command: null,
+            llmError: lastRecord?.llmError ?? "no attempt produced a runnable fix",
+            usage,
+            armBExit: null,
+            armBPrefixExecuted: null,
+            armBPrefixDivergences: null,
+            failureVanished: null,
+            armBError: null,
+            attempts: result.attempts,
+            flippedAtAttempt: null
+          }
+        };
+        onProgress(
+          `${label}: loop done \u2014 flipped=${result.flipped}` + (result.flippedAtAttempt !== null ? ` at attempt ${result.flippedAtAttempt}` : "") + ` (${result.llmCalls} calls, ${result.attempts.filter((a) => a.executed).length} arms)`
+        );
+        continue;
+      }
+      onProgress(`${label}: generating corrected command`);
+      calls += 1;
+      const generated = await generateFixCommand(caller, promptInput);
       if (!generated.succeeded) {
         failures += 1;
         rows[index] = {
@@ -7837,7 +8143,9 @@ async function runReplayBatch(options) {
             armBPrefixExecuted: null,
             armBPrefixDivergences: null,
             failureVanished: null,
-            armBError: null
+            armBError: null,
+            attempts: null,
+            flippedAtAttempt: null
           }
         };
         onProgress(`${label}: LLM failed \u2014 ${generated.error.slice(0, 200)}`);
@@ -7845,8 +8153,6 @@ async function runReplayBatch(options) {
       }
       promptTokens += generated.value.usage?.promptTokens ?? 0;
       completionTokens += generated.value.usage?.completionTokens ?? 0;
-      const signature = verdictByTraj.get(row.trajId)?.signature ?? null;
-      const stepTimeoutMs = options.stepTimeoutMs ?? replayCase.recordedStepTimeoutMs ?? 12e4;
       onProgress(`${label}: arm B \u2014 ${generated.value.command.split("\n")[0].slice(0, 120)}`);
       try {
         const armB = await executeArmB(
@@ -7870,10 +8176,11 @@ async function runReplayBatch(options) {
             armBPrefixExecuted: armB.prefixExecuted,
             armBPrefixDivergences: armB.prefixDivergences,
             failureVanished: armB.failureVanished,
-            armBError: null
+            armBError: null,
+            attempts: null,
+            flippedAtAttempt: armB.failureVanished ? 1 : null
           }
         };
-        const caseOut = join21(options.out, caseOutDirName(row));
         mkdirSync2(caseOut, { recursive: true });
         writeFileSync2(
           join21(caseOut, "armB-result.json"),
@@ -7895,7 +8202,9 @@ async function runReplayBatch(options) {
             armBPrefixExecuted: null,
             armBPrefixDivergences: null,
             failureVanished: null,
-            armBError: message.slice(0, 500)
+            armBError: message.slice(0, 500),
+            attempts: null,
+            flippedAtAttempt: null
           }
         };
         onProgress(`${label}: arm B error \u2014 ${message.slice(0, 200)}`);
@@ -7920,6 +8229,15 @@ async function runReplayBatch(options) {
     (r) => r.recordedReturncodeAtK !== null && r.recordedReturncodeAtK !== 0
   );
   const flippedNonzeroRc = armBNonzeroRc.filter((r) => r.fix.failureVanished === true);
+  const attempt1Executed = rows.filter(
+    (r) => r.fix?.attempts?.find((a) => a.attempt === 1)?.executed === true
+  );
+  const flippedAt1 = rows.filter((r) => r.fix?.flippedAtAttempt === 1);
+  const flipsByAttempt = {};
+  for (const row of rows) {
+    const at = row.fix?.flippedAtAttempt;
+    if (typeof at === "number") flipsByAttempt[String(at)] = (flipsByAttempt[String(at)] ?? 0) + 1;
+  }
   const excludedByReason = {};
   for (const excluded of enumeration.excluded) {
     excludedByReason[excluded.reason] = (excludedByReason[excluded.reason] ?? 0) + 1;
@@ -7959,16 +8277,22 @@ async function runReplayBatch(options) {
         denominator: selected.length,
         value: rate(signatureStrict.length, selected.length)
       },
-      fixFlipRate: options.fix === "generate" ? {
+      fixFlipRate: options.fix !== "none" ? {
         numerator: flipped.length,
         denominator: armBExecuted.length,
         value: rate(flipped.length, armBExecuted.length)
       } : null,
-      fixFlipRateNonzeroRc: options.fix === "generate" ? {
+      fixFlipRateNonzeroRc: options.fix !== "none" ? {
         numerator: flippedNonzeroRc.length,
         denominator: armBNonzeroRc.length,
         value: rate(flippedNonzeroRc.length, armBNonzeroRc.length)
-      } : null
+      } : null,
+      fixFlipAttempt1: options.fix === "loop" ? {
+        numerator: flippedAt1.length,
+        denominator: attempt1Executed.length,
+        value: rate(flippedAt1.length, attempt1Executed.length)
+      } : null,
+      flipsByAttempt: options.fix === "loop" ? flipsByAttempt : null
     },
     llm,
     excluded: enumeration.excluded,
@@ -8012,6 +8336,15 @@ function renderBatchReport(report) {
       `- Fix-flip rate on recorded-rc\u22600 cases: ${pct(headline.fixFlipRateNonzeroRc.value)} (${headline.fixFlipRateNonzeroRc.numerator}/${headline.fixFlipRateNonzeroRc.denominator}; real recorded failures \u2014 a gold step recorded with rc 0 flips vacuously).`
     );
   }
+  if (headline.fixFlipAttempt1) {
+    lines.push(
+      `- Fix-flip@1: ${pct(headline.fixFlipAttempt1.value)} (${headline.fixFlipAttempt1.numerator}/${headline.fixFlipAttempt1.denominator} cases whose attempt 1 executed \u2014 the one-shot-comparable number).`
+    );
+  }
+  if (headline.flipsByAttempt && Object.keys(headline.flipsByAttempt).length > 0) {
+    const parts = Object.entries(headline.flipsByAttempt).sort((a, b) => Number(a[0]) - Number(b[0])).map(([attempt, count2]) => `attempt ${attempt}: ${count2}`);
+    lines.push(`- Flips by attempt: ${parts.join(", ")}.`);
+  }
   lines.push("");
   lines.push("## Enumeration");
   lines.push("");
@@ -8060,7 +8393,7 @@ function renderBatchReport(report) {
   );
   for (const row of report.cases) {
     const fix = row.fix;
-    const fixCell = !fix ? "\u2014" : fix.sampledOut ? "sampled-out" : fix.llmError ? "llm-failed" : fix.armBError ? "armB-error" : "generated";
+    const fixCell = !fix ? "\u2014" : fix.sampledOut ? "sampled-out" : fix.llmError ? "llm-failed" : fix.armBError ? "armB-error" : fix.attempts ? fix.flippedAtAttempt !== null ? `flip@${fix.flippedAtAttempt}` : `exhausted(${fix.attempts.length})` : "generated";
     lines.push(
       [
         row.corpus,
@@ -8122,13 +8455,20 @@ function parseReplayBatchArgs(argv) {
     return n;
   };
   const fix = values.get("--fix") ?? "none";
-  if (fix !== "none" && fix !== "generate") {
-    throw new Error(`replay-verify-batch: --fix must be none or generate, got ${fix}`);
+  if (fix !== "none" && fix !== "generate" && fix !== "loop") {
+    throw new Error(`replay-verify-batch: --fix must be none, generate, or loop, got ${fix}`);
+  }
+  const fixAttempts = optionalNumber("--fix-attempts") ?? 3;
+  if (!Number.isInteger(fixAttempts) || fixAttempts < 1) {
+    throw new Error(
+      `replay-verify-batch: --fix-attempts must be a positive integer, got ${values.get("--fix-attempts")}`
+    );
   }
   return {
     corpora,
     out: out ?? ".",
     fix,
+    fixAttempts,
     fixModel: values.get("--fix-model") ?? "glm-5.2",
     fixBaseUrl: values.get("--fix-base-url") ?? "https://api.z.ai/api/coding/paas/v4",
     fixApiKeyEnv: values.get("--fix-api-key-env") ?? "ZAI_GLM_API_KEY",
@@ -8150,7 +8490,7 @@ function replayBatchUsage() {
 Usage:
   traces replay-verify-batch \\
       --corpus NAME=<labels.json>::<prepared-dir> [--corpus ...] \\
-      --out DIR [--fix none|generate] [--enumerate-only] \\
+      --out DIR [--fix none|generate|loop] [--fix-attempts 3] [--enumerate-only] \\
       [--fix-model glm-5.2] [--fix-base-url URL] [--fix-api-key-env ZAI_GLM_API_KEY] \\
       [--max-fix-cases 30] [--seed 17] [--step-timeout MS] [--prefix-limit N] \\
       [--case-filter SUBSTRING] [--case-limit N] \\
@@ -8169,6 +8509,13 @@ Usage:
   --max-fix-cases, seeded sample beyond it) and executes the corrected command
   as arm B in a fresh sandbox.
 
+  --fix loop iterates: attempt 1 is the one-shot prompt; when an arm fails
+  (nonzero exit or the failure signature persists) or the model call fails,
+  the next prompt carries every prior command with its REAL executed
+  stdout/stderr, up to --fix-attempts attempts (default 3). Retries may
+  answer with a short script (<=5 commands) executed as one /bin/sh unit.
+  Every attempt runs in its own fresh sandbox with the same replayed prefix.
+
 Outputs batch-report.json, batch-report.md, cases.jsonl (incremental), and one
 directory per case with the full replay-verify artifacts.
 See docs/replay-verify.md for orchestrator setup and honest limits.
@@ -8213,7 +8560,7 @@ async function cmdReplayVerifyBatch(argv) {
     );
   }
   let fixCaller;
-  if (parsed.fix === "generate") {
+  if (parsed.fix !== "none") {
     const fixApiKey = process.env[parsed.fixApiKeyEnv];
     if (!fixApiKey) {
       throw new Error(
@@ -8232,6 +8579,7 @@ async function cmdReplayVerifyBatch(argv) {
     baseUrl: parsed.baseUrl,
     apiKey,
     fix: parsed.fix,
+    fixAttempts: parsed.fixAttempts,
     fixCaller,
     fixModelLabel: parsed.fixModel,
     maxFixCases: parsed.maxFixCases,
@@ -8251,6 +8599,573 @@ async function cmdReplayVerifyBatch(argv) {
   );
 }
 
+// src/replay-wire.ts
+var SUBJECT_PATTERN = /^incorrect-steps-(\d+)-(\d+)-(escaped|unescaped)-consequence-(\d+)$/;
+function parseIncorrectStepsSubject(subject) {
+  const match = SUBJECT_PATTERN.exec(subject);
+  if (!match) return null;
+  return {
+    firstStep: Number(match[1]),
+    lastStep: Number(match[2]),
+    escapeStatus: match[3],
+    consequenceStep: Number(match[4])
+  };
+}
+function resolveFindingInvocation(finding2, corpora) {
+  const subject = parseIncorrectStepsSubject(finding2.subject);
+  if (!subject) {
+    throw new Error(
+      `replay-wire: subject '${finding2.subject}' is not incorrect-steps-<first>-<last>-<escaped|unescaped>-consequence-<step>`
+    );
+  }
+  const failures = [];
+  for (const corpus of corpora) {
+    const resolution = resolveCaseResources(corpus, finding2.trajId);
+    if (resolution.resolved) {
+      const at = subject.firstStep;
+      const step = resolution.resources.steps.find((s) => s.step_id === at);
+      if (!step) {
+        throw new Error(
+          `replay-wire: finding step ${at} is outside ${finding2.trajId} (${resolution.resources.steps.length} steps)`
+        );
+      }
+      return { resources: resolution.resources, subject, at };
+    }
+    failures.push(`${corpus.name}: ${resolution.reason}`);
+  }
+  throw new Error(
+    `replay-wire: trajectory ${finding2.trajId} is not replayable in any corpus \u2014 ${failures.join("; ")}`
+  );
+}
+async function replayVerifyFinding(finding2, options) {
+  if (options.fixCaller && options.fixCommand !== void 0) {
+    throw new Error("replay-wire: pass fixCaller or fixCommand, not both");
+  }
+  const invocation = resolveFindingInvocation(finding2, options.corpora);
+  let fixCommand = options.fixCommand ?? null;
+  if (options.fixCaller) {
+    const generated = await generateFixCommand(options.fixCaller, {
+      taskStatement: invocation.resources.taskStatement,
+      steps: invocation.resources.steps,
+      k: invocation.at
+    });
+    if (!generated.succeeded) {
+      throw new Error(`replay-wire: fix generation failed \u2014 ${generated.error}`);
+    }
+    fixCommand = generated.value.command;
+  }
+  const verdict = await replayVerify({
+    stepsPath: invocation.resources.stepsPath,
+    image: invocation.resources.image,
+    at: invocation.at,
+    fixCommand: fixCommand ?? void 0,
+    cwd: invocation.resources.cwd,
+    out: options.out,
+    caseId: invocation.resources.trajId,
+    stepTimeoutMs: options.stepTimeoutMs ?? invocation.resources.recordedStepTimeoutMs ?? void 0,
+    prefixLimit: options.prefixLimit,
+    backend: options.backend,
+    apiKey: options.apiKey,
+    baseUrl: options.baseUrl,
+    onProgress: options.onProgress
+  });
+  return { invocation, fixCommand, verdict };
+}
+
+// src/analyze-verify.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { join as join22 } from "path";
+var SINGLE_STEP_SUBJECT = /^incorrect-step-(\d+)$/;
+function findingReplayStep(finding2) {
+  const fromMetadata = finding2.metadata?.block_first_step;
+  if (typeof fromMetadata === "number" && Number.isInteger(fromMetadata) && fromMetadata >= 1) {
+    return fromMetadata;
+  }
+  const subject = finding2.subject ?? "";
+  const wire = parseIncorrectStepsSubject(subject);
+  if (wire) return wire.firstStep;
+  const single = SINGLE_STEP_SUBJECT.exec(subject);
+  if (single) return Number(single[1]);
+  return null;
+}
+var TRACE_EVIDENCE_URI = /^trace:\/\/([^/]+)\//;
+function findingTrajectoryId(finding2) {
+  for (const ref of finding2.evidence_refs ?? []) {
+    if (typeof ref.uri !== "string") continue;
+    const match = TRACE_EVIDENCE_URI.exec(ref.uri);
+    if (match) return match[1];
+  }
+  return null;
+}
+function checkStep(steps, at) {
+  const step = steps.find((s) => s.step_id === at);
+  if (!step) {
+    return { ok: false, reason: `step ${at} is outside the trajectory (${steps.length} steps)` };
+  }
+  if (isSubmitAction(step.action)) {
+    return {
+      ok: false,
+      reason: `step ${at} is the submit action \u2014 a submit decision has no executable failure to replay`
+    };
+  }
+  const recordedReturncode = parseRecordedReturncode(step.observation);
+  if (recordedReturncode === null) {
+    return {
+      ok: false,
+      reason: `step ${at} recorded no returncode \u2014 there is no executable failure signature to reproduce`
+    };
+  }
+  return { ok: true, recordedReturncode };
+}
+function resolveFindingReplayability(finding2, source) {
+  const at = findingReplayStep(finding2);
+  if (at === null) {
+    return {
+      replayable: false,
+      reason: `subject '${finding2.subject ?? "(none)"}' names no trajectory step (expected incorrect-step-<n>, incorrect-steps-<f>-<l>-\u2026, or metadata.block_first_step)`
+    };
+  }
+  if (source.kind === "direct") {
+    const trajId2 = findingTrajectoryId(finding2);
+    if (trajId2 && source.caseId && trajId2 !== source.caseId) {
+      return {
+        replayable: false,
+        reason: `finding cites trajectory '${trajId2}' but the supplied steps are case '${source.caseId}'`
+      };
+    }
+    let steps;
+    try {
+      steps = JSON.parse(readFileSync4(source.stepsPath, "utf8"));
+    } catch (err) {
+      throw new Error(
+        `verify-findings: cannot read steps file ${source.stepsPath} \u2014 ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    if (!Array.isArray(steps) || steps.length === 0) {
+      throw new Error(`verify-findings: ${source.stepsPath} is not a non-empty steps array`);
+    }
+    const step = checkStep(steps, at);
+    if (!step.ok) return { replayable: false, reason: step.reason };
+    return {
+      replayable: true,
+      resolved: {
+        caseId: source.caseId ?? trajId2 ?? source.stepsPath,
+        stepsPath: source.stepsPath,
+        image: source.image,
+        cwd: source.cwd,
+        at,
+        recordedReturncode: step.recordedReturncode,
+        recordedStepTimeoutMs: null
+      }
+    };
+  }
+  const trajId = findingTrajectoryId(finding2);
+  if (!trajId) {
+    return {
+      replayable: false,
+      reason: "finding carries no trace://<trajectory>/ evidence ref naming its trajectory"
+    };
+  }
+  const failures = [];
+  for (const corpus of source.corpora) {
+    const resolution = resolveCaseResources(corpus, trajId);
+    if (!resolution.resolved) {
+      failures.push(`${corpus.name}: ${resolution.reason}${resolution.detail ? ` (${resolution.detail})` : ""}`);
+      continue;
+    }
+    const step = checkStep(resolution.resources.steps, at);
+    if (!step.ok) return { replayable: false, reason: step.reason };
+    return {
+      replayable: true,
+      resolved: {
+        caseId: trajId,
+        stepsPath: resolution.resources.stepsPath,
+        image: resolution.resources.image,
+        cwd: resolution.resources.cwd,
+        at,
+        recordedReturncode: step.recordedReturncode,
+        recordedStepTimeoutMs: resolution.resources.recordedStepTimeoutMs
+      }
+    };
+  }
+  return {
+    replayable: false,
+    reason: `trajectory ${trajId} is not replayable in any corpus \u2014 ${failures.join("; ")}`
+  };
+}
+function classifyVerdict(verdict) {
+  if (!verdict.armA.failureSignatureMatch) return "divergent";
+  if (verdict.armB?.failureVanished) return "fix-flipped";
+  return "reproduced";
+}
+var DEFAULT_SANDBOX_BASE_URL = "http://127.0.0.1:4097";
+async function assertSandboxReachable(baseUrl) {
+  let response;
+  try {
+    response = await fetch(new URL("/health", baseUrl), { signal: AbortSignal.timeout(5e3) });
+  } catch (err) {
+    throw new Error(
+      `verify-findings: sandbox API unreachable at ${baseUrl} \u2014 ${err instanceof Error ? err.message : String(err)}. Executing findings requires a running sandbox orchestrator + SDK adapter (see docs/replay-verify.md); start them or pass --base-url.`
+    );
+  }
+  if (!response.ok) {
+    throw new Error(
+      `verify-findings: sandbox API at ${baseUrl} answered /health with HTTP ${response.status} \u2014 refusing to run proofs against degraded infrastructure`
+    );
+  }
+}
+function receiptExecution(verdict) {
+  return {
+    image: verdict.image,
+    cwd: verdict.cwd,
+    recordedReturncode: verdict.recordedReturncode,
+    signature: verdict.signature,
+    signatureBasis: verdict.signatureBasis,
+    armA: {
+      command: verdict.armA.command,
+      exitCode: verdict.armA.exitCode,
+      wallMs: verdict.armA.wallMs,
+      failureSignatureMatch: verdict.armA.failureSignatureMatch
+    },
+    armB: verdict.armB ? {
+      command: verdict.armB.command,
+      exitCode: verdict.armB.exitCode,
+      wallMs: verdict.armB.wallMs,
+      failureVanished: verdict.armB.failureVanished
+    } : null,
+    prefixExecuted: verdict.prefixExecuted,
+    prefixDivergences: verdict.prefixDivergences.length,
+    totalMs: verdict.timings.totalMs
+  };
+}
+function writeReceipt(receiptDir, finding2, verification, execution) {
+  const receipt = {
+    schema_version: "1.0.0",
+    produced_at: (/* @__PURE__ */ new Date()).toISOString(),
+    finding_id: verification.finding_id,
+    analyst_id: finding2.analyst_id ?? null,
+    subject: verification.subject,
+    claim: typeof finding2.claim === "string" ? finding2.claim.slice(0, 600) : null,
+    trajectory_id: verification.trajectory_id,
+    step: verification.step,
+    verified: verification.verified,
+    reason: verification.reason,
+    execution,
+    verdict_path: verification.verdict_path,
+    deduplicated_with: verification.deduplicated_with
+  };
+  writeFileSync3(join22(receiptDir, "receipt.json"), `${JSON.stringify(receipt, null, 2)}
+`);
+}
+function receiptDirName(index, finding2) {
+  const id = typeof finding2.finding_id === "string" && finding2.finding_id.length > 0 ? finding2.finding_id.replace(/[^A-Za-z0-9_-]/g, "_") : "finding";
+  return `${String(index + 1).padStart(3, "0")}-${id}`;
+}
+async function verifyFindings(findings, options) {
+  if (findings.length === 0) throw new Error("verify-findings: no findings to verify");
+  mkdirSync3(options.out, { recursive: true });
+  const resolutions = findings.map((finding2) => resolveFindingReplayability(finding2, options.source));
+  const baseUrl = options.baseUrl ?? DEFAULT_SANDBOX_BASE_URL;
+  if (resolutions.some((resolution) => resolution.replayable) && !options.backend) {
+    if (!options.apiKey) {
+      throw new Error(
+        "verify-findings: replayable findings need a sandbox API key \u2014 export SANDBOX_API_KEY or pass --api-key-env"
+      );
+    }
+    await assertSandboxReachable(baseUrl);
+  }
+  const preparer = options.source.kind === "corpus" && !options.backend ? options.source.preparer ?? dockerImagePreparer() : null;
+  const preparedImages = /* @__PURE__ */ new Map();
+  const executedByKey = /* @__PURE__ */ new Map();
+  const verifications = [];
+  let executions = 0;
+  for (let index = 0; index < findings.length; index++) {
+    const finding2 = findings[index];
+    const resolution = resolutions[index];
+    const receiptDir = join22(options.out, receiptDirName(index, finding2));
+    mkdirSync3(receiptDir, { recursive: true });
+    const identity = {
+      finding_id: finding2.finding_id ?? null,
+      subject: finding2.subject ?? null,
+      trajectory_id: findingTrajectoryId(finding2)
+    };
+    if (!resolution.replayable) {
+      const verification2 = {
+        ...identity,
+        step: findingReplayStep(finding2),
+        verified: "not-replayable",
+        reason: resolution.reason,
+        receipt: receiptDir,
+        verdict_path: null,
+        deduplicated_with: null
+      };
+      writeReceipt(receiptDir, finding2, verification2, null);
+      verifications.push(verification2);
+      options.onProgress?.(`${identity.finding_id ?? `finding ${index + 1}`}: not-replayable \u2014 ${resolution.reason}`);
+      continue;
+    }
+    const resolved = resolution.resolved;
+    const dedupeKey = `${resolved.caseId}::${resolved.at}::${options.fixCommand ?? ""}`;
+    const prior = executedByKey.get(dedupeKey);
+    if (prior) {
+      const verification2 = {
+        ...identity,
+        step: resolved.at,
+        verified: prior.verified,
+        reason: prior.reason,
+        receipt: receiptDir,
+        verdict_path: prior.verdict_path,
+        deduplicated_with: prior.receipt
+      };
+      const priorVerdict = prior.verdict_path ? JSON.parse(readFileSync4(prior.verdict_path, "utf8")) : null;
+      writeReceipt(receiptDir, finding2, verification2, priorVerdict ? receiptExecution(priorVerdict) : null);
+      verifications.push(verification2);
+      options.onProgress?.(
+        `${identity.finding_id ?? `finding ${index + 1}`}: ${prior.verified} (shares proof with ${prior.finding_id ?? prior.receipt})`
+      );
+      continue;
+    }
+    let image = resolved.image;
+    if (preparer) {
+      const preparationKey = `${resolved.image}::${resolved.cwd}`;
+      let preparation = preparedImages.get(preparationKey);
+      if (!preparation) {
+        const ensured = await preparer.ensure(resolved.image, resolved.cwd);
+        preparation = ensured.succeeded ? { succeeded: true, image: ensured.value.derivedImage } : { succeeded: false, error: ensured.error };
+        preparedImages.set(preparationKey, preparation);
+      }
+      if (!preparation.succeeded) {
+        const verification2 = {
+          ...identity,
+          step: resolved.at,
+          verified: "not-replayable",
+          reason: `replay image could not be prepared \u2014 ${preparation.error}`,
+          receipt: receiptDir,
+          verdict_path: null,
+          deduplicated_with: null
+        };
+        writeReceipt(receiptDir, finding2, verification2, null);
+        verifications.push(verification2);
+        options.onProgress?.(`${identity.finding_id ?? `finding ${index + 1}`}: not-replayable \u2014 image preparation failed`);
+        continue;
+      }
+      image = preparation.image;
+    }
+    options.onProgress?.(
+      `${identity.finding_id ?? `finding ${index + 1}`}: executing arm A at step ${resolved.at} of ${resolved.caseId} on ${image}`
+    );
+    const verdict = await replayVerify({
+      stepsPath: resolved.stepsPath,
+      image,
+      at: resolved.at,
+      fixCommand: options.fixCommand,
+      cwd: resolved.cwd,
+      out: receiptDir,
+      caseId: resolved.caseId,
+      stepTimeoutMs: options.stepTimeoutMs ?? resolved.recordedStepTimeoutMs ?? void 0,
+      prefixLimit: options.prefixLimit,
+      backend: options.backend,
+      apiKey: options.apiKey,
+      baseUrl,
+      maxLifetimeSeconds: options.maxLifetimeSeconds,
+      onProgress: options.onProgress
+    });
+    executions += 1;
+    const verification = {
+      ...identity,
+      step: resolved.at,
+      verified: classifyVerdict(verdict),
+      reason: null,
+      receipt: receiptDir,
+      verdict_path: join22(receiptDir, "replay-verdict.json"),
+      deduplicated_with: null
+    };
+    executedByKey.set(dedupeKey, verification);
+    writeReceipt(receiptDir, finding2, verification, receiptExecution(verdict));
+    verifications.push(verification);
+    options.onProgress?.(`${identity.finding_id ?? `finding ${index + 1}`}: ${verification.verified}`);
+  }
+  const counts = {
+    reproduced: 0,
+    "fix-flipped": 0,
+    divergent: 0,
+    "not-replayable": 0
+  };
+  for (const verification of verifications) counts[verification.verified] += 1;
+  const run = { out: options.out, verifications, counts, executions };
+  writeFileSync3(
+    join22(options.out, "verifications.json"),
+    `${JSON.stringify({ schema_version: "1.0.0", ...run }, null, 2)}
+`
+  );
+  return run;
+}
+function verdictCell(verification) {
+  switch (verification.verified) {
+    case "reproduced":
+      return "**VERIFIED** \u2014 reproduced";
+    case "fix-flipped":
+      return "**VERIFIED** \u2014 fix-flipped";
+    case "divergent":
+      return "DIVERGENT \u2014 recorded failure did not reproduce";
+    case "not-replayable":
+      return `UNVERIFIABLE \u2014 ${verification.reason ?? "no reason recorded"}`;
+  }
+}
+function renderVerifiedFindingsSection(run) {
+  const lines = ["## Verified findings (executed replay)", ""];
+  const total = run.verifications.length;
+  lines.push(
+    `${total} finding(s) \u2192 ${run.counts.reproduced} reproduced, ${run.counts["fix-flipped"]} fix-flipped, ${run.counts.divergent} divergent, ${run.counts["not-replayable"]} not replayable (${run.executions} sandbox execution(s); findings accusing the same step share one proof).`
+  );
+  lines.push("");
+  lines.push("| Finding | Subject | Step | Verdict | Receipt |");
+  lines.push("|---|---|---:|---|---|");
+  for (const verification of run.verifications) {
+    const shared = verification.deduplicated_with ? " (shared proof)" : "";
+    lines.push(
+      `| \`${verification.finding_id ?? "\u2014"}\` | \`${verification.subject ?? "\u2014"}\` | ${verification.step ?? "\u2014"} | ${verdictCell(verification)} | \`${verification.receipt}\`${shared} |`
+    );
+  }
+  lines.push("");
+  lines.push(
+    "VERIFIED = the accused step was re-executed in a sandbox after replaying the trajectory prefix, and the recorded failure signature reproduced (fix-flipped: a corrected command additionally made it vanish). Each receipt directory carries receipt.json and, when executed, replay-verdict.json + report.md with real stdout/stderr."
+  );
+  lines.push("");
+  return lines.join("\n");
+}
+function readFindingsFile(path) {
+  const parsed = JSON.parse(readFileSync4(path, "utf8"));
+  const array = Array.isArray(parsed) ? parsed : parsed && typeof parsed === "object" && Array.isArray(parsed.findings) ? parsed.findings : null;
+  if (!array) {
+    throw new Error(`${path} is neither a findings array nor an object with a findings array`);
+  }
+  for (const entry of array) {
+    if (!entry || typeof entry !== "object") {
+      throw new Error(`${path}: every finding must be an object, got ${JSON.stringify(entry)}`);
+    }
+  }
+  return array;
+}
+function verifyFindingsUsage() {
+  return `traces verify-findings \u2014 execute analyst findings as sandbox replay proofs
+
+Usage:
+  traces verify-findings --findings FINDINGS.json --out DIR \\
+      ( --steps STEPS.json --image IMG --cwd DIR [--case ID]
+      | --corpus name=<labels.json>::<preparedDir> [--corpus ...] ) \\
+      [--fix-command CMD] [--step-timeout MS] [--prefix-limit N] \\
+      [--base-url URL] [--api-key-env VAR] [--max-lifetime SECONDS]
+
+  --findings         JSON array of analyst findings (or an object with a findings
+                     array) \u2014 the shape agent-eval analysts emit: subject
+                     incorrect-step-<n>, metadata.block_first_step, trace:// evidence
+  --out              receipt root; one directory per finding + verifications.json
+  --steps/--image/--cwd
+                     verify against one trajectory; the image must be replay-ready
+                     (uid-1000 derived), exactly like traces replay-verify
+  --case             trajectory id of --steps; findings citing other trajectories
+                     are honestly marked not-replayable
+  --corpus           resolve each finding's trajectory in CodeTraceBench corpora;
+                     images are derived via the batch uid-1000 preparer (docker)
+  --fix-command      corrected step for arm B; a reproduced finding whose fix
+                     flips becomes fix-flipped
+  --base-url         sandbox API url (default $SANDBOX_API_URL or ${DEFAULT_SANDBOX_BASE_URL})
+  --api-key-env      env var holding the sandbox API key (default SANDBOX_API_KEY)
+
+Every finding gets a verdict: reproduced | fix-flipped | divergent | not-replayable,
+with a receipt directory carrying the executed evidence or the precise reason.
+Requires a running sandbox orchestrator when any finding is replayable \u2014 infra
+absence is an error, never a silent skip. See docs/replay-verify.md for setup.
+`;
+}
+function parseVerifyFindingsArgs(argv) {
+  const values = /* @__PURE__ */ new Map();
+  const corpora = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--help" || arg === "-h") return "help";
+    if (!arg.startsWith("--")) throw new Error(`unexpected positional argument: ${arg}`);
+    const value = argv[++i];
+    if (value === void 0) throw new Error(`missing value for ${arg}`);
+    if (arg === "--corpus") {
+      corpora.push(parseCorpusFlag(value));
+      continue;
+    }
+    values.set(arg, value);
+  }
+  const required = (flag) => {
+    const v = values.get(flag);
+    if (v === void 0) throw new Error(`verify-findings: ${flag} is required`);
+    return v;
+  };
+  const optionalNumber = (flag) => {
+    const v = values.get(flag);
+    if (v === void 0) return void 0;
+    const n = Number(v);
+    if (!Number.isFinite(n)) throw new Error(`verify-findings: ${flag} must be a number, got ${v}`);
+    return n;
+  };
+  const findingsPath = required("--findings");
+  const out = required("--out");
+  const direct = values.has("--steps") || values.has("--image") || values.has("--cwd");
+  if (direct && corpora.length > 0) {
+    throw new Error("verify-findings: pass --steps/--image/--cwd or --corpus, not both");
+  }
+  let source;
+  if (direct) {
+    source = {
+      kind: "direct",
+      stepsPath: required("--steps"),
+      image: required("--image"),
+      cwd: required("--cwd"),
+      ...values.has("--case") ? { caseId: values.get("--case") } : {}
+    };
+  } else if (corpora.length > 0) {
+    source = { kind: "corpus", corpora };
+  } else {
+    throw new Error("verify-findings: a replay source is required \u2014 --steps/--image/--cwd or --corpus");
+  }
+  return {
+    findingsPath,
+    source,
+    out,
+    fixCommand: values.get("--fix-command"),
+    stepTimeoutMs: optionalNumber("--step-timeout"),
+    prefixLimit: optionalNumber("--prefix-limit"),
+    baseUrl: values.get("--base-url") ?? process.env.SANDBOX_API_URL ?? DEFAULT_SANDBOX_BASE_URL,
+    apiKeyEnv: values.get("--api-key-env") ?? "SANDBOX_API_KEY",
+    maxLifetimeSeconds: optionalNumber("--max-lifetime")
+  };
+}
+async function cmdVerifyFindings(argv) {
+  const parsed = parseVerifyFindingsArgs(argv);
+  if (parsed === "help") {
+    process.stdout.write(verifyFindingsUsage());
+    return;
+  }
+  const findings = readFindingsFile(parsed.findingsPath);
+  const apiKey = process.env[parsed.apiKeyEnv];
+  const run = await verifyFindings(findings, {
+    source: parsed.source,
+    out: parsed.out,
+    fixCommand: parsed.fixCommand,
+    stepTimeoutMs: parsed.stepTimeoutMs,
+    prefixLimit: parsed.prefixLimit,
+    apiKey,
+    baseUrl: parsed.baseUrl,
+    maxLifetimeSeconds: parsed.maxLifetimeSeconds,
+    onProgress: (message) => process.stderr.write(`${message}
+`)
+  });
+  process.stdout.write(`${JSON.stringify(run, null, 2)}
+`);
+  process.stderr.write(
+    `verify-findings: ${run.verifications.length} finding(s) \u2192 ${run.counts.reproduced} reproduced, ${run.counts["fix-flipped"]} fix-flipped, ${run.counts.divergent} divergent, ${run.counts["not-replayable"]} not-replayable (${run.executions} execution(s)) \u2192 ${run.out}
+`
+  );
+}
+
 // src/external.ts
 import { spawn } from "child_process";
 import { readdir as readdir14, readFile as readFile7 } from "fs/promises";
@@ -9015,18 +9930,18 @@ function commandRedactor(spec) {
 import { createHash as createHash9 } from "crypto";
 import { mkdir as mkdir3, mkdtemp as mkdtemp3, readFile as readFile8, readdir as readdir15, writeFile as writeFile4 } from "fs/promises";
 import { endianness, tmpdir as tmpdir4 } from "os";
-import { join as join22, resolve as resolve6 } from "path";
+import { join as join23, resolve as resolve6 } from "path";
 var HODOSCOPE_VERSION = "0.2.4";
 async function writeHodoscopeInput(otlpPath, options = {}) {
   const explicitDirectory = options.directory ? resolve6(options.directory) : void 0;
-  const directory = explicitDirectory ?? await mkdtemp3(join22(tmpdir4(), "traces-hodoscope-input-"));
+  const directory = explicitDirectory ?? await mkdtemp3(join23(tmpdir4(), "traces-hodoscope-input-"));
   if (explicitDirectory) {
     await mkdir3(directory, { recursive: true });
     if ((await readdir15(directory)).length > 0) {
       throw new Error(`Hodoscope explicit directory must be empty: ${directory}`);
     }
   }
-  const samples = join22(directory, "samples");
+  const samples = join23(directory, "samples");
   await mkdir3(samples);
   const rows = [];
   for await (const value of readJsonl(otlpPath)) rows.push(parseOpenInferenceRow(value));
@@ -9052,7 +9967,7 @@ async function writeHodoscopeInput(otlpPath, options = {}) {
     }
     actionCount += actions;
     const file = `${createHash9("sha256").update(traceId).digest("hex").slice(0, 24)}.json`;
-    await writeFile4(join22(samples, file), `${JSON.stringify(trajectory, null, 2)}
+    await writeFile4(join23(samples, file), `${JSON.stringify(trajectory, null, 2)}
 `, "utf8");
   }
   return {
@@ -9076,10 +9991,10 @@ function hodoscopeAnalyzer(options = {}) {
     async analyze(otlpPath, runOptions2 = {}) {
       const outputRoot = options.outputDir ? resolve6(options.outputDir) : tmpdir4();
       await mkdir3(outputRoot, { recursive: true });
-      const directory = await mkdtemp3(join22(outputRoot, "traces-hodoscope-"));
-      const input = join22(directory, "input");
-      const analysisFile = join22(directory, "analysis.hodoscope.json");
-      const samplesFile = join22(directory, "samples.json");
+      const directory = await mkdtemp3(join23(outputRoot, "traces-hodoscope-"));
+      const input = join23(directory, "input");
+      const analysisFile = join23(directory, "analysis.hodoscope.json");
+      const samplesFile = join23(directory, "samples.json");
       try {
         const prepared = await writeHodoscopeInput(otlpPath, {
           directory: input,
@@ -9791,7 +10706,7 @@ async function applyRedactor(spans, redactor) {
 import { createHash as createHash10 } from "crypto";
 import { mkdtemp as mkdtemp4, readFile as readFile9, writeFile as writeFile5 } from "fs/promises";
 import { tmpdir as tmpdir5 } from "os";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 import {
   firstNumberAttr,
   LLM_CACHED_TOKEN_ATTR_KEYS,
@@ -10387,7 +11302,7 @@ async function exportTraceEvidenceFile(inputPath, opts = {}) {
 }
 async function writeTraceEvidenceExportFile(inputPath, outPath, opts = {}) {
   const result = await exportTraceEvidenceFile(inputPath, opts);
-  const path = outPath ?? join23(await mkdtemp4(join23(tmpdir5(), "traces-export-")), "spans.openinference.jsonl");
+  const path = outPath ?? join24(await mkdtemp4(join24(tmpdir5(), "traces-export-")), "spans.openinference.jsonl");
   await writeFile5(path, serializeSpans(result.spans), "utf8");
   return { ...result, path };
 }
@@ -10395,7 +11310,7 @@ async function writeTraceEvidenceExportFile(inputPath, outPath, opts = {}) {
 // src/inspect.ts
 import { mkdtemp as mkdtemp5, readFile as readFile10, writeFile as writeFile6 } from "fs/promises";
 import { tmpdir as tmpdir6 } from "os";
-import { basename as basename13, join as join24 } from "path";
+import { basename as basename13, join as join25 } from "path";
 var severityRank = {
   high: 0,
   medium: 1,
@@ -10684,14 +11599,14 @@ async function readSessionIndexFile(path) {
   return parsed;
 }
 async function writeInspectionReportFile(report, outPath) {
-  const path = outPath ?? join24(await mkdtemp5(join24(tmpdir6(), "traces-inspect-")), "inspection-report.md");
+  const path = outPath ?? join25(await mkdtemp5(join25(tmpdir6(), "traces-inspect-")), "inspection-report.md");
   await writeFile6(path, renderInspectionReport(report), "utf8");
   return path;
 }
 
 // src/adoption.ts
 import { readFile as readFile11 } from "fs/promises";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 function toolName2(s) {
   const n = s.attributes["tool.name"];
   if (typeof n === "string") return n;
@@ -10811,7 +11726,7 @@ async function readLoopRuns(cwds, sessionIds) {
     seenCwds.add(cwd);
     const firstSourceByRun = /* @__PURE__ */ new Map();
     for (const artifactDir of [".agent", ".evolve"]) {
-      const path = join25(cwd, artifactDir, "skill-runs.jsonl");
+      const path = join26(cwd, artifactDir, "skill-runs.jsonl");
       let raw;
       try {
         raw = await readFile11(path, "utf8");
@@ -12223,7 +13138,7 @@ function renderAdoption(ar) {
 // src/improvement.ts
 import { access, mkdir as mkdir4, mkdtemp as mkdtemp6, writeFile as writeFile7 } from "fs/promises";
 import { tmpdir as tmpdir7 } from "os";
-import { dirname as dirname7, join as join26, resolve as resolve7 } from "path";
+import { dirname as dirname7, join as join27, resolve as resolve7 } from "path";
 import { pathToFileURL } from "url";
 import {
   AnalystRegistry,
@@ -12730,13 +13645,13 @@ async function runTraceStoreInvestigation(opts) {
   };
 }
 async function writeTraceImprovementArtifacts(result, outDir) {
-  const directory = outDir ? resolve7(outDir) : await mkdtemp6(join26(tmpdir7(), "traces-improvement-"));
+  const directory = outDir ? resolve7(outDir) : await mkdtemp6(join27(tmpdir7(), "traces-improvement-"));
   await mkdir4(directory, { recursive: true });
   const paths = {
     directory,
-    result: join26(directory, "result.json"),
-    evidence: join26(directory, "evidence.jsonl"),
-    report: join26(directory, "report.md"),
+    result: join27(directory, "result.json"),
+    evidence: join27(directory, "evidence.jsonl"),
+    report: join27(directory, "report.md"),
     traces: result.otlpPath
   };
   const { report, ...machineResult } = result;
@@ -12748,11 +13663,11 @@ async function writeTraceImprovementArtifacts(result, outDir) {
   return paths;
 }
 async function runTraceImprovement(opts) {
-  const directory = opts.outDir ? resolve7(opts.outDir) : await mkdtemp6(join26(tmpdir7(), "traces-improvement-"));
+  const directory = opts.outDir ? resolve7(opts.outDir) : await mkdtemp6(join27(tmpdir7(), "traces-improvement-"));
   await mkdir4(directory, { recursive: true });
   const investigation = await runTraceInvestigation({
     ...opts,
-    otlpOutPath: opts.otlpOutPath ?? join26(directory, "traces.otlp.jsonl")
+    otlpOutPath: opts.otlpOutPath ?? join27(directory, "traces.otlp.jsonl")
   });
   const result = {
     ...investigation,
@@ -13195,7 +14110,7 @@ async function streamSessions(opts) {
 
 // src/supervisor-run-context.ts
 import { readFile as readFile12, stat as stat14 } from "fs/promises";
-import { basename as basename14, join as join27 } from "path";
+import { basename as basename14, join as join28 } from "path";
 import { materializeTreeView } from "@tangle-network/agent-runtime/kernel";
 import {
   NO_SOURCE_LIMITS
@@ -13356,10 +14271,10 @@ function parseInstant(v) {
   return Number.isFinite(t) ? t : null;
 }
 async function readFileRunContext(runDir, opts = {}) {
-  const journalText = await readMaybe(join27(runDir, SPAWN_JOURNAL_FILE));
+  const journalText = await readMaybe(join28(runDir, SPAWN_JOURNAL_FILE));
   const journal = readRunContextJournal(journalText);
-  const coordination = readCoordinationLog(await readMaybe(join27(runDir, COORDINATION_LOG_FILE)));
-  const result = await readMaybe(join27(runDir, RESULT_FILE));
+  const coordination = readCoordinationLog(await readMaybe(join28(runDir, COORDINATION_LOG_FILE)));
+  const result = await readMaybe(join28(runDir, RESULT_FILE));
   return {
     runRef: runDir,
     instanceId: opts.instanceId !== void 0 ? opts.instanceId : journal.root,
@@ -13382,7 +14297,7 @@ async function readFileRunContext(runDir, opts = {}) {
     harnessWorkerTokens: null,
     harnessMissingReason: "the file run context journals each child\u2019s own settled spend, so no external harness join is used",
     limits: sourceLimits(journal, coordination),
-    rootTranscriptRef: journal.present ? join27(runDir, SPAWN_JOURNAL_FILE) : null,
+    rootTranscriptRef: journal.present ? join28(runDir, SPAWN_JOURNAL_FILE) : null,
     traceCommand: `traces watch ${runDir}`
   };
 }
@@ -13390,7 +14305,7 @@ function fileRunContextSupervisorRunReader(runDir, opts = {}) {
   return { runRef: runDir, read: () => readFileRunContext(runDir, opts) };
 }
 async function isFileRunContextDir(runDir) {
-  return stat14(join27(runDir, SPAWN_JOURNAL_FILE)).then((s) => s.isFile()).catch(() => false);
+  return stat14(join28(runDir, SPAWN_JOURNAL_FILE)).then((s) => s.isFile()).catch(() => false);
 }
 function flattenJournal(journal) {
   return journal.events.map((event) => {
@@ -13536,9 +14451,9 @@ function mergeRolls(a, b) {
   };
 }
 async function readRunContextSnapshot(runDir) {
-  const journal = readRunContextJournal(await readMaybe(join27(runDir, SPAWN_JOURNAL_FILE)));
-  const coordination = readCoordinationLog(await readMaybe(join27(runDir, COORDINATION_LOG_FILE)));
-  const resultText = await readMaybe(join27(runDir, RESULT_FILE));
+  const journal = readRunContextJournal(await readMaybe(join28(runDir, SPAWN_JOURNAL_FILE)));
+  const coordination = readCoordinationLog(await readMaybe(join28(runDir, COORDINATION_LOG_FILE)));
+  const resultText = await readMaybe(join28(runDir, RESULT_FILE));
   const result = parseResult(resultText);
   const view = safeTreeView(journal.events);
   const nodes = view === null ? [] : orderNodes(view, journal);
@@ -13721,7 +14636,7 @@ function wrap(text2, indent) {
 
 // src/run-span-tree.ts
 import { readdir as readdir16 } from "fs/promises";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 import {
   firstNumberAttr as firstNumberAttr3,
   LLM_COST_ATTR_KEYS as LLM_COST_ATTR_KEYS2,
@@ -13994,7 +14909,7 @@ async function findSpanSourceFiles(dir) {
   const found = [];
   const entries = await readdir16(dir, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
-    const child = join28(dir, entry.name);
+    const child = join29(dir, entry.name);
     if (entry.isFile()) {
       if (SPAN_FILE_PATTERN.test(entry.name)) found.push(child);
       continue;
@@ -14002,7 +14917,7 @@ async function findSpanSourceFiles(dir) {
     if (!entry.isDirectory()) continue;
     const nested = await readdir16(child, { withFileTypes: true }).catch(() => []);
     for (const inner of nested) {
-      if (inner.isFile() && SPAN_FILE_PATTERN.test(inner.name)) found.push(join28(child, inner.name));
+      if (inner.isFile() && SPAN_FILE_PATTERN.test(inner.name)) found.push(join29(child, inner.name));
     }
   }
   return found.sort();
@@ -14010,7 +14925,7 @@ async function findSpanSourceFiles(dir) {
 
 // src/supervisor-run-watch.ts
 import { readdir as readdir17 } from "fs/promises";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 function budget(node) {
   const parts = [`${int(node.budget.maxIterations)}it`, `${int(node.budget.maxTokens)}tok`];
   if (node.budget.maxUsd !== void 0) parts.push(`$${node.budget.maxUsd.toFixed(2)}`);
@@ -14154,7 +15069,7 @@ async function resolveRunContextDir(dir) {
   const candidates = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const child = join29(dir, entry.name);
+    const child = join30(dir, entry.name);
     if (await isFileRunContextDir(child)) candidates.push(child);
   }
   if (candidates.length === 1) return candidates[0];
@@ -14734,7 +15649,7 @@ async function collectSessionSelection(groups, options = {}) {
 // src/session-index.ts
 import { mkdtemp as mkdtemp7, readdir as readdir18, readFile as readFile13, stat as stat16, writeFile as writeFile8 } from "fs/promises";
 import { tmpdir as tmpdir8 } from "os";
-import { dirname as dirname8, join as join30 } from "path";
+import { dirname as dirname8, join as join31 } from "path";
 function indexRow(record2) {
   return {
     session: record2.session,
@@ -14807,7 +15722,7 @@ async function findContextRoot(cwd) {
   if (!s) return null;
   if (!s.isDirectory()) current = dirname8(current);
   for (; ; ) {
-    if (await pathStat2(join30(current, ".git")) || await dirExists(join30(current, ".evolve")) || await fileExists(join30(current, "AGENTS.md")) || await fileExists(join30(current, "CLAUDE.md"))) {
+    if (await pathStat2(join31(current, ".git")) || await dirExists(join31(current, ".evolve")) || await fileExists(join31(current, "AGENTS.md")) || await fileExists(join31(current, "CLAUDE.md"))) {
       return current;
     }
     const parent = dirname8(current);
@@ -14875,7 +15790,7 @@ async function walkMarkdown(root, kind, maxFiles = 100) {
     }
     for (const entry of entries) {
       if (out.length >= maxFiles) return;
-      const path = join30(dir, entry.name);
+      const path = join31(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(path);
       } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -14890,20 +15805,20 @@ async function walkMarkdown(root, kind, maxFiles = 100) {
 async function collectContextRoot(root) {
   const files = [];
   for (const name of ["AGENTS.md", "CLAUDE.md", "GEMINI.md"]) {
-    const summary = await summarizeFile(join30(root, name), "instruction-doc");
+    const summary = await summarizeFile(join31(root, name), "instruction-doc");
     if (summary) files.push(summary);
   }
-  const evolve = join30(root, ".evolve");
+  const evolve = join31(root, ".evolve");
   for (const name of ["skill-runs.jsonl", "governor.jsonl", "experiments.jsonl"]) {
-    const summary = await summarizeFile(join30(evolve, name), "evolve-jsonl");
+    const summary = await summarizeFile(join31(evolve, name), "evolve-jsonl");
     if (summary) files.push(summary);
   }
   for (const name of ["scorecard.json"]) {
-    const summary = await summarizeFile(join30(evolve, name), "evolve-json");
+    const summary = await summarizeFile(join31(evolve, name), "evolve-json");
     if (summary) files.push(summary);
   }
-  files.push(...await walkMarkdown(join30(evolve, "reflections"), "reflection"));
-  files.push(...await walkMarkdown(join30(evolve, "handoffs"), "handoff"));
+  files.push(...await walkMarkdown(join31(evolve, "reflections"), "reflection"));
+  files.push(...await walkMarkdown(join31(evolve, "handoffs"), "handoff"));
   return { root, files: files.sort((a, b) => a.path.localeCompare(b.path)) };
 }
 async function collectContextIndex(records) {
@@ -14949,7 +15864,7 @@ function serializeSessionIndex(index) {
 `;
 }
 async function writeSessionIndexFile(index, outPath) {
-  const path = outPath ?? join30(await mkdtemp7(join30(tmpdir8(), "traces-index-")), "session-index.json");
+  const path = outPath ?? join31(await mkdtemp7(join31(tmpdir8(), "traces-index-")), "session-index.json");
   await writeFile8(path, serializeSessionIndex(index), "utf8");
   return path;
 }
@@ -14957,11 +15872,11 @@ async function writeSessionIndexFile(index, outPath) {
 // src/upload-state.ts
 import { mkdir as mkdir5, readFile as readFile14, writeFile as writeFile9 } from "fs/promises";
 import { homedir as homedir12 } from "os";
-import { dirname as dirname9, join as join31 } from "path";
+import { dirname as dirname9, join as join32 } from "path";
 import { contentHash } from "@tangle-network/agent-eval";
 function stateFile() {
-  const base = process.env.XDG_STATE_HOME ?? join31(homedir12(), ".local", "state");
-  return join31(base, "tangle-traces", "uploaded.json");
+  const base = process.env.XDG_STATE_HOME ?? join32(homedir12(), ".local", "state");
+  return join32(base, "tangle-traces", "uploaded.json");
 }
 function uploadKey(harness, sessionId) {
   return `${harness}:${sessionId}`;
@@ -14993,7 +15908,7 @@ function alreadyUploaded(state, harness, sessionId, hash2) {
 import { readFile as readFile15 } from "fs/promises";
 import { createRequire as createRequire2 } from "module";
 import { hostname as hostname2 } from "os";
-import { basename as basename15, join as join32 } from "path";
+import { basename as basename15, join as join33 } from "path";
 import { hostedClientFromEnv } from "@tangle-network/agent-eval/hosted";
 import { REDACTION_VERSION } from "@tangle-network/agent-eval/traces";
 var require2 = createRequire2(import.meta.url);
@@ -15017,7 +15932,7 @@ async function planUpload(opts = {}) {
 async function gitBranch(cwd) {
   if (!cwd) return void 0;
   try {
-    const head = await readFile15(join32(cwd, ".git", "HEAD"), "utf8");
+    const head = await readFile15(join33(cwd, ".git", "HEAD"), "utf8");
     const m = head.match(/^ref:\s*refs\/heads\/(.+)$/m);
     return m?.[1]?.trim();
   } catch {
@@ -15281,9 +16196,13 @@ export {
   resolveCaseResources,
   enumerateReplayableCases,
   zaiChatCaller,
+  clipText,
   buildFixPrompt,
+  buildRetryFixPrompt,
+  countScriptCommands,
   extractFixCommand,
   generateFixCommand,
+  runFixLoop,
   derivedImageTag,
   dockerImagePreparer,
   seededSample,
@@ -15292,6 +16211,21 @@ export {
   parseReplayBatchArgs,
   replayBatchUsage,
   cmdReplayVerifyBatch,
+  parseIncorrectStepsSubject,
+  resolveFindingInvocation,
+  replayVerifyFinding,
+  findingReplayStep,
+  findingTrajectoryId,
+  resolveFindingReplayability,
+  classifyVerdict,
+  DEFAULT_SANDBOX_BASE_URL,
+  assertSandboxReachable,
+  verifyFindings,
+  renderVerifiedFindingsSection,
+  readFindingsFile,
+  verifyFindingsUsage,
+  parseVerifyFindingsArgs,
+  cmdVerifyFindings,
   runCommand,
   commandAnalyzer,
   haloAnalyzer,