@tangle-network/traces 0.11.4 → 0.11.6

package/dist/{chunk-AGPOIWPQ.js → chunk-MEAEXKUV.js}

@@ -3,6 +3,145 @@ function appendAll(target, values) {
   for (const value of values) target.push(value);
 }
 
+// src/attributes.ts
+var ATTR = {
+  /** = the trace/session id. Wire contract (dedup linkage). */
+  SESSION_ID: "tangle.sessionId",
+  /** "cli" marks a CLI upload so the platform can drop a re-upload of a session
+   *  that also streamed live. Wire contract. */
+  INGEST_SOURCE: "tangle.ingest_source",
+  HARNESS: "tangle.harness",
+  CWD: "tangle.cwd",
+  /** THE per-session grouping key the spine derives subjects from
+   *  (`deriveSubjectKey` reads `tangle.subject.key` first). Resolves to the git
+   *  remote (host/owner/repo) when readable, else the cwd path basename. */
+  SUBJECT_KEY: "tangle.subject.key",
+  /** Normalized git remote (e.g. `github.com/tangle-network/agent-dev-container`). */
+  GIT_REPOSITORY: "git.repository",
+  /** Current branch at conversion time. */
+  GIT_BRANCH_NAME: "git.branch",
+  /** HEAD short sha at conversion time. */
+  GIT_COMMIT: "git.commit",
+  /** How traces resolved the session cwd: recorded cwd, repaired cwd, or span path. */
+  REPO_RESOLUTION_SOURCE: "traces.repo_resolution_source",
+  GIT_BRANCH: "tangle.git_branch",
+  HOST: "tangle.host",
+  /** Basename of the session file. (Renamed from the ambiguous `tangle.source`,
+   *  which collided with `tangle.ingest_source`.) */
+  SESSION_FILE: "tangle.session_file",
+  UPLOADED_AT: "tangle.uploaded_at",
+  UPLOADER: "tangle.uploader",
+  REDACTION_VERSION: "redaction.version",
+  REDACTION_COUNT: "redaction.count",
+  /** Upload contract: bounded root summary plus location-only receipt child spans.
+   *  Receipt hashes are deliberate integrity evidence; raw malformed bytes never upload. */
+  SESSION_INTEGRITY: "traces.session.integrity",
+  CORRUPTION_COUNT: "traces.session.corruption_count",
+  CORRUPTION_DIGEST: "traces.session.corruption_digest",
+  CORRUPTION_RECEIPT_VERSION: "traces.session.corruption.receipt_version",
+  CORRUPTION_RECEIPT_KIND: "traces.session.corruption.kind",
+  CORRUPTION_SOURCE_PATH: "traces.session.corruption.source_path",
+  CORRUPTION_LINE_NUMBER: "traces.session.corruption.line_number",
+  CORRUPTION_BYTE_OFFSET: "traces.session.corruption.byte_offset",
+  CORRUPTION_BYTE_LENGTH: "traces.session.corruption.byte_length",
+  CORRUPTION_SHA256: "traces.session.corruption.sha256",
+  RAW_SOURCE_RETENTION: "traces.session.raw_source_retention",
+  /** Container image reference the session executed in (OTel semconv key). */
+  CONTAINER_IMAGE: "container.image.name",
+  /** Immutable image digest (`sha256:…`) — the replay-grade environment pin. */
+  CONTAINER_IMAGE_DIGEST: "container.image.digest",
+  /** Sandbox/container instance id that executed the session. */
+  SANDBOX_ID: "tangle.sandbox.id",
+  /** Recorded execution cwd, verbatim. Unlike `tangle.cwd` it is never
+   *  repaired against the host filesystem — replay verification needs the
+   *  in-container path even when no such path exists on this host. */
+  ENVIRONMENT_CWD: "tangle.environment.cwd"
+};
+var INGEST_SOURCE_CLI = "cli";
+function environmentAttributes(environment) {
+  if (!environment) return {};
+  const attrs = {};
+  if (environment.image) attrs[ATTR.CONTAINER_IMAGE] = environment.image;
+  if (environment.imageDigest) attrs[ATTR.CONTAINER_IMAGE_DIGEST] = environment.imageDigest;
+  if (environment.sandboxId) attrs[ATTR.SANDBOX_ID] = environment.sandboxId;
+  if (environment.cwd) attrs[ATTR.ENVIRONMENT_CWD] = environment.cwd;
+  if (environment.gitCommit) attrs[ATTR.GIT_COMMIT] = environment.gitCommit;
+  return attrs;
+}
+function stampEnvironmentAttrs(spans, environment) {
+  const attrs = environmentAttributes(environment);
+  const keys = Object.keys(attrs);
+  if (keys.length === 0) return;
+  for (const span2 of spans) {
+    for (const key of keys) {
+      if (span2.attributes[key] === void 0) span2.attributes[key] = attrs[key];
+    }
+  }
+}
+function environmentFromSpanAttributes(spans) {
+  const first = (key) => {
+    for (const span2 of spans) {
+      const value = span2.attributes[key];
+      if (typeof value === "string" && value.length > 0) return value;
+    }
+    return void 0;
+  };
+  const image = first(ATTR.CONTAINER_IMAGE);
+  const imageDigest = first(ATTR.CONTAINER_IMAGE_DIGEST);
+  const sandboxId = first(ATTR.SANDBOX_ID);
+  const cwd = first(ATTR.ENVIRONMENT_CWD);
+  if (!image && !imageDigest && !sandboxId && !cwd) return null;
+  return {
+    ...image ? { image } : {},
+    ...imageDigest ? { imageDigest } : {},
+    ...sandboxId ? { sandboxId } : {},
+    cwd: cwd ?? null
+  };
+}
+var DEFAULT_HARNESS = "claude-code";
+var SESSION_ID_ATTRIBUTE_KEYS = [ATTR.SESSION_ID, "session.id", "traces.session.id"];
+function sessionIdFromAttributes(attributes2) {
+  return SESSION_ID_ATTRIBUTE_KEYS.map((key) => attributes2[key]).find(
+    (value) => typeof value === "string" && value.length > 0
+  );
+}
+function indexSessionIdsByTrace(spans) {
+  const candidatesByTrace = /* @__PURE__ */ new Map();
+  for (const span2 of spans) {
+    const candidates = candidatesByTrace.get(span2.trace_id) ?? /* @__PURE__ */ new Set();
+    for (const key of SESSION_ID_ATTRIBUTE_KEYS) {
+      const value = span2.attributes[key];
+      if (typeof value === "string" && value.length > 0) candidates.add(value);
+    }
+    if (candidates.size > 0) candidatesByTrace.set(span2.trace_id, candidates);
+  }
+  const sessionByTrace = /* @__PURE__ */ new Map();
+  const conflicts = [];
+  for (const [traceId, candidates] of candidatesByTrace) {
+    const sessionIds = [...candidates].sort();
+    if (sessionIds.length === 1) {
+      sessionByTrace.set(traceId, sessionIds[0]);
+    } else {
+      conflicts.push({ traceId, sessionIds });
+    }
+  }
+  conflicts.sort((a, b) => a.traceId.localeCompare(b.traceId));
+  return { sessionByTrace, conflicts };
+}
+function stampSessionIdentity(spans, fallbackSessionId) {
+  const { sessionByTrace, conflicts } = indexSessionIdsByTrace(spans);
+  const conflictingTraceIds = new Set(conflicts.map((conflict) => conflict.traceId));
+  const traceIds = new Set(spans.map((span2) => span2.trace_id));
+  const singleTraceId = traceIds.size === 1 ? traceIds.values().next().value : void 0;
+  for (const span2 of spans) {
+    if (conflictingTraceIds.has(span2.trace_id)) continue;
+    const sessionId = sessionByTrace.get(span2.trace_id) ?? singleTraceId ?? fallbackSessionId;
+    if (!sessionIdFromAttributes(span2.attributes)) {
+      span2.attributes[ATTR.SESSION_ID] = sessionId;
+    }
+  }
+}
+
 // src/time.ts
 function parseIsoToEpochMs(ts) {
   if (typeof ts !== "string" || ts.trim().length === 0) {
@@ -31,7 +170,7 @@ function parseSince(value) {
 import { readdir, readFile, stat } from "fs/promises";
 import { basename, join } from "path";
 import {
-  ATTR,
+  ATTR as ATTR2,
   declaredSpanKind,
   resolveSpanKind,
   SPAN_KIND_ATTR_KEYS,
@@ -325,7 +464,7 @@ function readLinks(value, traceId) {
   return links;
 }
 function bridgeContractAttributes(attributes2) {
-  const toolName4 = nonEmptyString(attributes2[ATTR.toolName]);
+  const toolName4 = nonEmptyString(attributes2[ATTR2.toolName]);
   if (toolName4 !== null && nonEmptyString(attributes2[TOOL_NAME]) === null) {
     attributes2[TOOL_NAME] = toolName4;
   }
@@ -385,7 +524,7 @@ function otlpRowToSpan(row, fallbackTraceId) {
   bridgeContractAttributes(attributes2);
   const { kind, declaredRaw, substituted: kindSubstituted } = resolveRowKind(row, attributes2, name);
   if (kindSubstituted) substitute("kind", declaredRaw ?? void 0);
-  attributes2[ATTR.spanKind] = kind;
+  attributes2[ATTR2.spanKind] = kind;
   if (kind === "TOOL") Object.assign(attributes2, capturedToolIo(attributes2));
   const status = isObject(row.status) ? row.status : void 0;
   const statusMessage = nonEmptyString(status?.message);
@@ -725,6 +864,9 @@ function toOpenInferenceSpan(s) {
   for (const k of ["tangle.subject.key", "git.repository", "git.branch", "git.commit", "tangle.cwd", "traces.repo_resolution_source"]) {
     if (a[k] != null) resourceAttrs[k] = a[k];
   }
+  for (const k of ["container.image.name", "container.image.digest", "tangle.sandbox.id", "tangle.environment.cwd"]) {
+    if (a[k] != null) resourceAttrs[k] = a[k];
+  }
   for (const k of ["traces.source.unreadable_rows", "traces.source.unreadable_row_kinds"]) {
     if (a[k] != null) resourceAttrs[k] = a[k];
   }
@@ -764,11 +906,11 @@ function serializeSpans(spans) {
 `;
 }
 async function writeOtlpFile(spans, outPath) {
-  const { mkdtemp: mkdtemp8, writeFile: writeFile10 } = await import("fs/promises");
+  const { mkdtemp: mkdtemp8, writeFile: writeFile12 } = await import("fs/promises");
   const { tmpdir: tmpdir9 } = await import("os");
-  const { join: join33 } = await import("path");
-  const path = outPath ?? join33(await mkdtemp8(join33(tmpdir9(), "traces-")), "spans.otlp.jsonl");
-  await writeFile10(path, serializeSpans(spans), "utf8");
+  const { join: join36 } = await import("path");
+  const path = outPath ?? join36(await mkdtemp8(join36(tmpdir9(), "traces-")), "spans.otlp.jsonl");
+  await writeFile12(path, serializeSpans(spans), "utf8");
   return path;
 }
 
@@ -796,95 +938,6 @@ function userPromptSpan(o) {
   });
 }
 
-// src/attributes.ts
-var ATTR2 = {
-  /** = the trace/session id. Wire contract (dedup linkage). */
-  SESSION_ID: "tangle.sessionId",
-  /** "cli" marks a CLI upload so the platform can drop a re-upload of a session
-   *  that also streamed live. Wire contract. */
-  INGEST_SOURCE: "tangle.ingest_source",
-  HARNESS: "tangle.harness",
-  CWD: "tangle.cwd",
-  /** THE per-session grouping key the spine derives subjects from
-   *  (`deriveSubjectKey` reads `tangle.subject.key` first). Resolves to the git
-   *  remote (host/owner/repo) when readable, else the cwd path basename. */
-  SUBJECT_KEY: "tangle.subject.key",
-  /** Normalized git remote (e.g. `github.com/tangle-network/agent-dev-container`). */
-  GIT_REPOSITORY: "git.repository",
-  /** Current branch at conversion time. */
-  GIT_BRANCH_NAME: "git.branch",
-  /** HEAD short sha at conversion time. */
-  GIT_COMMIT: "git.commit",
-  /** How traces resolved the session cwd: recorded cwd, repaired cwd, or span path. */
-  REPO_RESOLUTION_SOURCE: "traces.repo_resolution_source",
-  GIT_BRANCH: "tangle.git_branch",
-  HOST: "tangle.host",
-  /** Basename of the session file. (Renamed from the ambiguous `tangle.source`,
-   *  which collided with `tangle.ingest_source`.) */
-  SESSION_FILE: "tangle.session_file",
-  UPLOADED_AT: "tangle.uploaded_at",
-  UPLOADER: "tangle.uploader",
-  REDACTION_VERSION: "redaction.version",
-  REDACTION_COUNT: "redaction.count",
-  /** Upload contract: bounded root summary plus location-only receipt child spans.
-   *  Receipt hashes are deliberate integrity evidence; raw malformed bytes never upload. */
-  SESSION_INTEGRITY: "traces.session.integrity",
-  CORRUPTION_COUNT: "traces.session.corruption_count",
-  CORRUPTION_DIGEST: "traces.session.corruption_digest",
-  CORRUPTION_RECEIPT_VERSION: "traces.session.corruption.receipt_version",
-  CORRUPTION_RECEIPT_KIND: "traces.session.corruption.kind",
-  CORRUPTION_SOURCE_PATH: "traces.session.corruption.source_path",
-  CORRUPTION_LINE_NUMBER: "traces.session.corruption.line_number",
-  CORRUPTION_BYTE_OFFSET: "traces.session.corruption.byte_offset",
-  CORRUPTION_BYTE_LENGTH: "traces.session.corruption.byte_length",
-  CORRUPTION_SHA256: "traces.session.corruption.sha256",
-  RAW_SOURCE_RETENTION: "traces.session.raw_source_retention"
-};
-var INGEST_SOURCE_CLI = "cli";
-var DEFAULT_HARNESS = "claude-code";
-var SESSION_ID_ATTRIBUTE_KEYS = [ATTR2.SESSION_ID, "session.id", "traces.session.id"];
-function sessionIdFromAttributes(attributes2) {
-  return SESSION_ID_ATTRIBUTE_KEYS.map((key) => attributes2[key]).find(
-    (value) => typeof value === "string" && value.length > 0
-  );
-}
-function indexSessionIdsByTrace(spans) {
-  const candidatesByTrace = /* @__PURE__ */ new Map();
-  for (const span2 of spans) {
-    const candidates = candidatesByTrace.get(span2.trace_id) ?? /* @__PURE__ */ new Set();
-    for (const key of SESSION_ID_ATTRIBUTE_KEYS) {
-      const value = span2.attributes[key];
-      if (typeof value === "string" && value.length > 0) candidates.add(value);
-    }
-    if (candidates.size > 0) candidatesByTrace.set(span2.trace_id, candidates);
-  }
-  const sessionByTrace = /* @__PURE__ */ new Map();
-  const conflicts = [];
-  for (const [traceId, candidates] of candidatesByTrace) {
-    const sessionIds = [...candidates].sort();
-    if (sessionIds.length === 1) {
-      sessionByTrace.set(traceId, sessionIds[0]);
-    } else {
-      conflicts.push({ traceId, sessionIds });
-    }
-  }
-  conflicts.sort((a, b) => a.traceId.localeCompare(b.traceId));
-  return { sessionByTrace, conflicts };
-}
-function stampSessionIdentity(spans, fallbackSessionId) {
-  const { sessionByTrace, conflicts } = indexSessionIdsByTrace(spans);
-  const conflictingTraceIds = new Set(conflicts.map((conflict) => conflict.traceId));
-  const traceIds = new Set(spans.map((span2) => span2.trace_id));
-  const singleTraceId = traceIds.size === 1 ? traceIds.values().next().value : void 0;
-  for (const span2 of spans) {
-    if (conflictingTraceIds.has(span2.trace_id)) continue;
-    const sessionId = sessionByTrace.get(span2.trace_id) ?? singleTraceId ?? fallbackSessionId;
-    if (!sessionIdFromAttributes(span2.attributes)) {
-      span2.attributes[ATTR2.SESSION_ID] = sessionId;
-    }
-  }
-}
-
 // src/chat-trajectory.ts
 import { createHash as createHash3 } from "crypto";
 function isChatTrajectoryMessage(value) {
@@ -1907,10 +1960,10 @@ function sessionJsonlOptions(ref, options = {}) {
 function sessionIntegrityAttributes(ref) {
   if (!ref.integrity) return {};
   return {
-    [ATTR2.SESSION_INTEGRITY]: ref.integrity.status,
-    [ATTR2.CORRUPTION_COUNT]: ref.integrity.corruptions.length,
-    [ATTR2.CORRUPTION_DIGEST]: corruptionDigest(ref.integrity.corruptions),
-    [ATTR2.RAW_SOURCE_RETENTION]: "local_source_only"
+    [ATTR.SESSION_INTEGRITY]: ref.integrity.status,
+    [ATTR.CORRUPTION_COUNT]: ref.integrity.corruptions.length,
+    [ATTR.CORRUPTION_DIGEST]: corruptionDigest(ref.integrity.corruptions),
+    [ATTR.RAW_SOURCE_RETENTION]: "local_source_only"
   };
 }
 function corruptionDigest(receipts) {
@@ -1951,15 +2004,15 @@ function stampSessionIntegrity(ref, spans) {
       status: "ERROR",
       service: typeof parent.attributes["service.name"] === "string" ? parent.attributes["service.name"] : ref.harness,
       extra: {
-        [ATTR2.SESSION_INTEGRITY]: ref.integrity.status,
-        [ATTR2.CORRUPTION_RECEIPT_VERSION]: receipt.receiptVersion,
-        [ATTR2.CORRUPTION_RECEIPT_KIND]: receipt.kind,
-        [ATTR2.CORRUPTION_SOURCE_PATH]: receipt.sourcePath,
-        [ATTR2.CORRUPTION_LINE_NUMBER]: receipt.lineNumber,
-        [ATTR2.CORRUPTION_BYTE_OFFSET]: receipt.byteOffset,
-        [ATTR2.CORRUPTION_BYTE_LENGTH]: receipt.byteLength,
-        [ATTR2.CORRUPTION_SHA256]: receipt.sha256,
-        [ATTR2.RAW_SOURCE_RETENTION]: "local_source_only"
+        [ATTR.SESSION_INTEGRITY]: ref.integrity.status,
+        [ATTR.CORRUPTION_RECEIPT_VERSION]: receipt.receiptVersion,
+        [ATTR.CORRUPTION_RECEIPT_KIND]: receipt.kind,
+        [ATTR.CORRUPTION_SOURCE_PATH]: receipt.sourcePath,
+        [ATTR.CORRUPTION_LINE_NUMBER]: receipt.lineNumber,
+        [ATTR.CORRUPTION_BYTE_OFFSET]: receipt.byteOffset,
+        [ATTR.CORRUPTION_BYTE_LENGTH]: receipt.byteLength,
+        [ATTR.CORRUPTION_SHA256]: receipt.sha256,
+        [ATTR.RAW_SOURCE_RETENTION]: "local_source_only"
       }
     }));
     existingSpanIds.add(spanId);
@@ -6236,7 +6289,7 @@ function extractAbsolutePaths(spans) {
 }
 async function resolveRepoAttrs(cwd) {
   if (!cwd) return {};
-  const attrs = { [ATTR2.CWD]: cwd };
+  const attrs = { [ATTR.CWD]: cwd };
   const basename16 = (() => {
     const trimmed = cwd.replace(/\/+$/g, "");
     const idx = trimmed.lastIndexOf("/");
@@ -6249,17 +6302,17 @@ async function resolveRepoAttrs(cwd) {
     const { remote, branch, commit } = await readGit(gitRoot);
     const normalized = remote ? normalizeRemote(remote) : null;
     if (normalized) {
-      attrs[ATTR2.SUBJECT_KEY] = normalized;
-      attrs[ATTR2.GIT_REPOSITORY] = normalized;
-      if (branch) attrs[ATTR2.GIT_BRANCH_NAME] = branch;
-      if (commit) attrs[ATTR2.GIT_COMMIT] = commit;
+      attrs[ATTR.SUBJECT_KEY] = normalized;
+      attrs[ATTR.GIT_REPOSITORY] = normalized;
+      if (branch) attrs[ATTR.GIT_BRANCH_NAME] = branch;
+      if (commit) attrs[ATTR.GIT_COMMIT] = commit;
       return attrs;
     }
-    if (branch) attrs[ATTR2.GIT_BRANCH_NAME] = branch;
-    if (commit) attrs[ATTR2.GIT_COMMIT] = commit;
+    if (branch) attrs[ATTR.GIT_BRANCH_NAME] = branch;
+    if (commit) attrs[ATTR.GIT_COMMIT] = commit;
   } catch {
   }
-  attrs[ATTR2.SUBJECT_KEY] = basename16;
+  attrs[ATTR.SUBJECT_KEY] = basename16;
   return attrs;
 }
 async function repoCandidateForPath(path) {
@@ -6290,12 +6343,12 @@ async function resolveSessionRepoAttrs(cwd, spans) {
     resolved.push({ ...candidate, attrs });
   }
   const byScore = (a, b) => b.score - a.score || a.order - b.order;
-  const withGit = resolved.filter((candidate) => candidate.attrs[ATTR2.GIT_REPOSITORY]).sort(byScore);
-  const selected = withGit[0] ?? resolved.filter((candidate) => candidate.attrs[ATTR2.SUBJECT_KEY]).sort(byScore)[0];
+  const withGit = resolved.filter((candidate) => candidate.attrs[ATTR.GIT_REPOSITORY]).sort(byScore);
+  const selected = withGit[0] ?? resolved.filter((candidate) => candidate.attrs[ATTR.SUBJECT_KEY]).sort(byScore)[0];
   if (!selected) return { attrs: {}, cwd: null, source: "none" };
   return {
-    attrs: { ...selected.attrs, [ATTR2.REPO_RESOLUTION_SOURCE]: selected.source },
-    cwd: selected.attrs[ATTR2.CWD] ?? selected.cwd,
+    attrs: { ...selected.attrs, [ATTR.REPO_RESOLUTION_SOURCE]: selected.source },
+    cwd: selected.attrs[ATTR.CWD] ?? selected.cwd,
     source: selected.source
   };
 }
@@ -6323,9 +6376,9 @@ async function resolutionForWorkdirEvidence(evidence3, cache) {
     return null;
   }
   const attrs = await resolveRepoAttrs(cwd);
-  const resolved = attrs[ATTR2.SUBJECT_KEY] ? {
-    attrs: { ...attrs, [ATTR2.REPO_RESOLUTION_SOURCE]: evidence3.source },
-    cwd: attrs[ATTR2.CWD] ?? cwd,
+  const resolved = attrs[ATTR.SUBJECT_KEY] ? {
+    attrs: { ...attrs, [ATTR.REPO_RESOLUTION_SOURCE]: evidence3.source },
+    cwd: attrs[ATTR.CWD] ?? cwd,
     source: evidence3.source
   } : null;
   cache.set(evidence3.path, resolved);
@@ -6348,7 +6401,7 @@ async function resolveSpanWorkdirRepoAttrs(span2, cache) {
   }
   const byScore = (a, b) => b.score - a.score || a.order - b.order;
   const resolved = [...candidates.values()];
-  const selected = resolved.filter((candidate) => candidate.repo.attrs[ATTR2.GIT_REPOSITORY]).sort(byScore)[0] ?? resolved.filter((candidate) => candidate.repo.attrs[ATTR2.SUBJECT_KEY]).sort(byScore)[0];
+  const selected = resolved.filter((candidate) => candidate.repo.attrs[ATTR.GIT_REPOSITORY]).sort(byScore)[0] ?? resolved.filter((candidate) => candidate.repo.attrs[ATTR.SUBJECT_KEY]).sort(byScore)[0];
   if (!selected) return null;
   return selected.repo;
 }
@@ -6364,7 +6417,7 @@ async function stampSpanWorkdirRepoAttrs(spans) {
 async function awaitWithAbort(operation, signal) {
   if (!signal) return operation;
   signal.throwIfAborted();
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve10, reject) => {
     const stop = () => {
       signal.removeEventListener("abort", stop);
       reject(signal.reason);
@@ -6373,7 +6426,7 @@ async function awaitWithAbort(operation, signal) {
     operation.then(
       (value) => {
         signal.removeEventListener("abort", stop);
-        resolve8(value);
+        resolve10(value);
       },
       (error) => {
         signal.removeEventListener("abort", stop);
@@ -6392,6 +6445,8 @@ async function parseSession(adapter, ref, options = {}) {
   if (spans.length === 0) throw new EmptySessionError(ref.path);
   stampSessionIntegrity(ref, spans);
   stampSessionIdentity(spans, ref.sessionId);
+  stampEnvironmentAttrs(spans, ref.environment);
+  if (ref.cwd === null && ref.environment?.cwd) ref.cwd = ref.environment.cwd;
   const repo = await resolveSessionRepoAttrs(ref.cwd, spans);
   if (repo.cwd) ref.cwd = repo.cwd;
   stampRepoAttrs(spans, repo.attrs);
@@ -6553,6 +6608,7 @@ import {
   OPENINFERENCE_SPAN_KIND as OPENINFERENCE_SPAN_KIND2,
   TOOL_NAME as TOOL_NAME3
 } from "@tangle-network/agent-eval/trace-attributes";
+var POLICY_EVIDENCE_NOTE = "This is normalized coding-agent session evidence for downstream policy mining; it is not an eval campaign cell.";
 function stringAttr(span2, key) {
   const value = span2.attributes[key];
   return typeof value === "string" && value.length > 0 ? value : void 0;
@@ -6563,12 +6619,12 @@ function spanKind(span2) {
 function repoFromSpans(spans) {
   const attrs = {};
   for (const span2 of spans) {
-    attrs.subjectKey ??= stringAttr(span2, ATTR2.SUBJECT_KEY);
-    attrs.repository ??= stringAttr(span2, ATTR2.GIT_REPOSITORY);
-    attrs.branch ??= stringAttr(span2, ATTR2.GIT_BRANCH_NAME);
-    attrs.commit ??= stringAttr(span2, ATTR2.GIT_COMMIT);
-    attrs.cwd ??= stringAttr(span2, ATTR2.CWD);
-    attrs.resolutionSource ??= stringAttr(span2, ATTR2.REPO_RESOLUTION_SOURCE);
+    attrs.subjectKey ??= stringAttr(span2, ATTR.SUBJECT_KEY);
+    attrs.repository ??= stringAttr(span2, ATTR.GIT_REPOSITORY);
+    attrs.branch ??= stringAttr(span2, ATTR.GIT_BRANCH_NAME);
+    attrs.commit ??= stringAttr(span2, ATTR.GIT_COMMIT);
+    attrs.cwd ??= stringAttr(span2, ATTR.CWD);
+    attrs.resolutionSource ??= stringAttr(span2, ATTR.REPO_RESOLUTION_SOURCE);
     if (attrs.subjectKey && attrs.repository && attrs.branch && attrs.commit && attrs.cwd && attrs.resolutionSource) break;
   }
   return attrs;
@@ -6657,7 +6713,7 @@ async function buildPolicyEvidenceRecord(ref, spans, opts = {}) {
       ...opts.otlpPath ? { otlpPath: opts.otlpPath } : {},
       ...opts.sourceSha256 ? { sourceSha256: opts.sourceSha256 } : {},
       notCampaignCell: true,
-      note: "This is normalized coding-agent session evidence for downstream policy mining; it is not an eval campaign cell."
+      note: POLICY_EVIDENCE_NOTE
     }
   };
 }
@@ -7181,11 +7237,11 @@ function parseCorpusFlag(value) {
   if (eq <= 0) throw new Error(`--corpus must be name=<labels>::<prepared>, got: ${value}`);
   const name = value.slice(0, eq);
   const rest = value.slice(eq + 1);
-  const sep2 = rest.indexOf("::");
-  if (sep2 <= 0 || sep2 === rest.length - 2) {
+  const sep3 = rest.indexOf("::");
+  if (sep3 <= 0 || sep3 === rest.length - 2) {
     throw new Error(`--corpus must be name=<labels>::<prepared>, got: ${value}`);
   }
-  return { name, labelsPath: rest.slice(0, sep2), preparedDir: rest.slice(sep2 + 2) };
+  return { name, labelsPath: rest.slice(0, sep3), preparedDir: rest.slice(sep3 + 2) };
 }
 var SUBMIT_ACTION_SIGNATURE = "COMPLETE_TASK_AND_SUBMIT_FINAL_OUTPUT";
 function isSubmitAction(action) {
@@ -7211,7 +7267,7 @@ function goldIncorrectSteps(entry) {
 function findRawTrajFiles(sweRawDir) {
   if (!existsSync2(sweRawDir)) return [];
   const entries = readdirSync2(sweRawDir, { recursive: true, encoding: "utf8" });
-  return entries.filter((relative5) => relative5.endsWith(".traj.json")).map((relative5) => join20(sweRawDir, relative5)).sort();
+  return entries.filter((relative6) => relative6.endsWith(".traj.json")).map((relative6) => join20(sweRawDir, relative6)).sort();
 }
 function cwdFromPwdObservation(steps) {
   for (const step of steps) {
@@ -7419,7 +7475,7 @@ function zaiChatCaller(options) {
     }
   };
 }
-function clip(text2, limit) {
+function clipText(text2, limit) {
   if (text2.length <= limit) return text2;
   const half = Math.floor(limit / 2);
   return `${text2.slice(0, half)}
@@ -7428,11 +7484,11 @@ ${text2.slice(-half)}`;
 }
 function renderStep(step, marker) {
   const rc = parseRecordedReturncode(step.observation);
-  const output = clip(parseObservationOutput(step.observation).trim(), 1600);
+  const output = clipText(parseObservationOutput(step.observation).trim(), 1600);
   return [
     `### step ${step.step_id}${marker}`,
     "```sh",
-    clip(step.action, 2e3),
+    clipText(step.action, 2e3),
     "```",
     `returncode: ${rc ?? "none recorded"}`,
     output.length > 0 ? `output:
@@ -7441,13 +7497,25 @@ ${output}
 \`\`\`` : "output: (empty)"
   ].join("\n");
 }
-function buildFixPrompt(input) {
+function promptBody(input) {
   const radius = input.contextRadius ?? 3;
   const target = input.steps.find((s) => s.step_id === input.k);
   if (!target) throw new Error(`replay-fix: no step with step_id ${input.k}`);
   const context = input.steps.filter(
     (s) => s.step_id !== input.k && Math.abs(s.step_id - input.k) <= radius
   );
+  return [
+    "## Task the agent was solving",
+    input.taskStatement ? clipText(input.taskStatement, 4e3) : "(no task statement recorded)",
+    "",
+    "## Surrounding steps",
+    ...context.map((s) => renderStep(s, "")),
+    "",
+    "## Failing step to correct",
+    renderStep(target, " (INCORRECT \u2014 correct this one)")
+  ];
+}
+function buildFixPrompt(input) {
   const system = [
     "You repair one failed shell command from a recorded coding-agent trajectory.",
     "The trajectory replays inside the original docker image; every command runs as a fresh /bin/sh subshell from a fixed working directory.",
@@ -7456,19 +7524,62 @@ function buildFixPrompt(input) {
     "The corrected command must accomplish the failing step's intent and exit 0. No prose outside the fenced block."
   ].join("\n");
   const user = [
-    "## Task the agent was solving",
-    input.taskStatement ? clip(input.taskStatement, 4e3) : "(no task statement recorded)",
+    ...promptBody(input),
     "",
-    "## Surrounding steps",
-    ...context.map((s) => renderStep(s, "")),
+    "Output the single corrected replacement for the failing step now."
+  ].join("\n");
+  return { system, user };
+}
+function renderFailedAttempt(prior) {
+  if (prior.command === null) {
+    return [
+      `### attempt ${prior.attempt}`,
+      `model call failed before producing a command: ${prior.llmError ?? "unknown error"}`
+    ].join("\n");
+  }
+  const stdout = (prior.stdoutTail ?? "").trim();
+  const stderr = (prior.stderrTail ?? "").trim();
+  return [
+    `### attempt ${prior.attempt}`,
+    "```sh",
+    clipText(prior.command, 2e3),
+    "```",
+    `exit code: ${prior.exitCode ?? "not executed"}`,
+    stdout.length > 0 ? `stdout:
+\`\`\`
+${stdout}
+\`\`\`` : "stdout: (empty)",
+    stderr.length > 0 ? `stderr:
+\`\`\`
+${stderr}
+\`\`\`` : "stderr: (empty)"
+  ].join("\n");
+}
+function buildRetryFixPrompt(input, priorAttempts, maxScriptCommands = 5) {
+  if (priorAttempts.length === 0) {
+    throw new Error("replay-fix: buildRetryFixPrompt requires at least one prior attempt");
+  }
+  const system = [
+    "You repair one failed shell command from a recorded coding-agent trajectory.",
+    "The trajectory replays inside the original docker image; every command runs as a fresh /bin/sh subshell from a fixed working directory.",
+    "Earlier corrected commands were executed for real and failed; their actual output is included below.",
+    `Reply with a corrected fix inside a single \`\`\`sh fenced block: either one command, or a short script of at most ${maxScriptCommands} commands (one per line).`,
+    "The whole block executes as ONE /bin/sh unit from the fixed working directory and must exit 0.",
+    "Do not repeat a command that already failed. Keep reasoning brief. No prose outside the fenced block."
+  ].join("\n");
+  const user = [
+    ...promptBody(input),
     "",
-    "## Failing step to correct",
-    renderStep(target, " (INCORRECT \u2014 correct this one)"),
+    "## Previous fix attempts (executed for real \u2014 all failed)",
+    ...priorAttempts.map((prior) => renderFailedAttempt(prior)),
     "",
-    "Output the single corrected replacement for the failing step now."
+    `Output a corrected fix now \u2014 one \`\`\`sh block, at most ${maxScriptCommands} commands.`
   ].join("\n");
   return { system, user };
 }
+function countScriptCommands(script) {
+  return script.split("\n").filter((line) => line.trim().length > 0 && !line.trim().startsWith("#")).length;
+}
 function extractFixCommand(content) {
   const blocks = [...content.matchAll(/```(?:sh|bash|shell)?\n([\s\S]*?)```/g)];
   const candidate = blocks.length > 0 ? blocks[blocks.length - 1][1] : content;
@@ -7484,43 +7595,198 @@ async function generateFixCommand(caller, input) {
   if (command === null) {
     return {
       succeeded: false,
-      error: `completion carried no usable command: ${clip(outcome.value.content, 300)}`
+      error: `completion carried no usable command: ${clipText(outcome.value.content, 300)}`
     };
   }
   return { succeeded: true, value: { command, usage: outcome.value.usage } };
 }
 
-// src/replay-batch.ts
-import { execFile } from "child_process";
-import { createHash as createHash8 } from "crypto";
-import { appendFileSync, mkdirSync as mkdirSync2, mkdtempSync, writeFileSync as writeFileSync2 } from "fs";
-import { tmpdir as tmpdir3 } from "os";
-import { join as join21 } from "path";
-import { promisify } from "util";
-import {
-  InMemoryTraceStore as InMemoryTraceStore3,
-  runCounterfactual as runCounterfactual2
-} from "@tangle-network/agent-eval";
-var execFileAsync = promisify(execFile);
-function derivedImageTag(image, cwd) {
-  const digest = createHash8("sha256").update(`${image}
-${cwd}`).digest("hex").slice(0, 12);
-  return `ctb-replay:${digest}-uid1000`;
-}
-function dockerImagePreparer(options = {}) {
-  const pullTimeoutMs = options.pullTimeoutMs ?? 12e5;
-  const buildTimeoutMs = options.buildTimeoutMs ?? 9e5;
-  const imageExists = async (tag) => {
-    try {
-      await execFileAsync("docker", ["image", "inspect", tag], { maxBuffer: 8 * 1024 * 1024 });
-      return true;
-    } catch {
-      return false;
-    }
+// src/replay-fix-loop.ts
+function toFailedAttempt(record2) {
+  return {
+    attempt: record2.attempt,
+    command: record2.command,
+    exitCode: record2.exitCode,
+    stdoutTail: record2.stdoutTail,
+    stderrTail: record2.stderrTail,
+    llmError: record2.llmError ?? record2.armBError
   };
-  const errorTail = (err) => {
-    const raw = err && typeof err === "object" && "stderr" in err && typeof err.stderr === "string" && err.stderr.length > 0 ? err.stderr : err instanceof Error ? err.message : String(err);
-    return raw.trim().split("\n").slice(-3).join(" | ").slice(0, 400);
+}
+async function runFixLoop(caller, input, executor, options) {
+  if (!Number.isInteger(options.maxAttempts) || options.maxAttempts < 1) {
+    throw new Error(
+      `replay-fix-loop: maxAttempts must be a positive integer, got ${options.maxAttempts}`
+    );
+  }
+  const scriptCap = options.maxScriptCommands ?? 5;
+  const tailChars = options.outputTailChars ?? 1600;
+  const attempts = [];
+  let llmCalls = 0;
+  let llmFailures = 0;
+  let promptTokens = 0;
+  let completionTokens = 0;
+  const unexecuted = (attempt, llmError, usage, command, started) => ({
+    attempt,
+    command,
+    llmError,
+    usage,
+    executed: false,
+    exitCode: null,
+    prefixExecuted: null,
+    prefixDivergences: null,
+    failureVanished: null,
+    stdoutTail: null,
+    stderrTail: null,
+    armBError: null,
+    wallMs: Date.now() - started
+  });
+  for (let attempt = 1; attempt <= options.maxAttempts; attempt++) {
+    const started = Date.now();
+    const prompt = attempt === 1 ? buildFixPrompt(input) : buildRetryFixPrompt(input, attempts.map(toFailedAttempt), scriptCap);
+    llmCalls += 1;
+    const outcome = await caller.complete(prompt.system, prompt.user);
+    if (!outcome.succeeded) {
+      llmFailures += 1;
+      attempts.push(unexecuted(attempt, outcome.error, null, null, started));
+      options.onProgress?.(
+        `fix-loop attempt ${attempt}: LLM failed \u2014 ${outcome.error.slice(0, 160)}`
+      );
+      continue;
+    }
+    const usage = outcome.value.usage;
+    promptTokens += usage?.promptTokens ?? 0;
+    completionTokens += usage?.completionTokens ?? 0;
+    const command = extractFixCommand(outcome.value.content);
+    if (command === null) {
+      llmFailures += 1;
+      attempts.push(
+        unexecuted(
+          attempt,
+          `completion carried no usable command: ${clipText(outcome.value.content, 300)}`,
+          usage,
+          null,
+          started
+        )
+      );
+      continue;
+    }
+    if (attempt > 1) {
+      const commandLines = countScriptCommands(command);
+      if (commandLines > scriptCap) {
+        llmFailures += 1;
+        attempts.push(
+          unexecuted(
+            attempt,
+            `script exceeds ${scriptCap} command lines (${commandLines})`,
+            usage,
+            null,
+            started
+          )
+        );
+        options.onProgress?.(
+          `fix-loop attempt ${attempt}: rejected script with ${commandLines} command lines`
+        );
+        continue;
+      }
+    }
+    let execution;
+    try {
+      execution = await executor(command, attempt);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      attempts.push({
+        ...unexecuted(attempt, "", usage, command, started),
+        llmError: null,
+        armBError: message.slice(0, 500)
+      });
+      options.onProgress?.(
+        `fix-loop attempt ${attempt}: sandbox error \u2014 ${message.slice(0, 160)}`
+      );
+      return {
+        flipped: false,
+        flippedAtAttempt: null,
+        attempts,
+        aborted: true,
+        llmCalls,
+        llmFailures,
+        promptTokens,
+        completionTokens
+      };
+    }
+    attempts.push({
+      attempt,
+      command,
+      llmError: null,
+      usage,
+      executed: true,
+      exitCode: execution.exitCode,
+      prefixExecuted: execution.prefixExecuted,
+      prefixDivergences: execution.prefixDivergences,
+      failureVanished: execution.failureVanished,
+      stdoutTail: clipText(execution.stdout, tailChars),
+      stderrTail: clipText(execution.stderr, tailChars),
+      armBError: null,
+      wallMs: Date.now() - started
+    });
+    options.onProgress?.(
+      `fix-loop attempt ${attempt}: exit=${execution.exitCode} failureVanished=${execution.failureVanished}`
+    );
+    if (execution.failureVanished) {
+      return {
+        flipped: true,
+        flippedAtAttempt: attempt,
+        attempts,
+        aborted: false,
+        llmCalls,
+        llmFailures,
+        promptTokens,
+        completionTokens
+      };
+    }
+  }
+  return {
+    flipped: false,
+    flippedAtAttempt: null,
+    attempts,
+    aborted: false,
+    llmCalls,
+    llmFailures,
+    promptTokens,
+    completionTokens
+  };
+}
+
+// src/replay-batch.ts
+import { execFile } from "child_process";
+import { createHash as createHash8 } from "crypto";
+import { appendFileSync, mkdirSync as mkdirSync2, mkdtempSync, writeFileSync as writeFileSync2 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join21 } from "path";
+import { promisify } from "util";
+import {
+  InMemoryTraceStore as InMemoryTraceStore3,
+  runCounterfactual as runCounterfactual2
+} from "@tangle-network/agent-eval";
+var execFileAsync = promisify(execFile);
+function derivedImageTag(image, cwd) {
+  const digest = createHash8("sha256").update(`${image}
+${cwd}`).digest("hex").slice(0, 12);
+  return `ctb-replay:${digest}-uid1000`;
+}
+function dockerImagePreparer(options = {}) {
+  const pullTimeoutMs = options.pullTimeoutMs ?? 12e5;
+  const buildTimeoutMs = options.buildTimeoutMs ?? 9e5;
+  const imageExists = async (tag) => {
+    try {
+      await execFileAsync("docker", ["image", "inspect", tag], { maxBuffer: 8 * 1024 * 1024 });
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const errorTail = (err) => {
+    const raw = err && typeof err === "object" && "stderr" in err && typeof err.stderr === "string" && err.stderr.length > 0 ? err.stderr : err instanceof Error ? err.message : String(err);
+    return raw.trim().split("\n").slice(-3).join(" | ").slice(0, 400);
   };
   return {
     async ensure(image, cwd) {
@@ -7778,9 +8044,10 @@ async function runReplayBatch(options) {
     }
   }
   let llm = null;
-  if (options.fix === "generate") {
+  if (options.fix !== "none") {
     const caller = options.fixCaller;
-    if (!caller) throw new Error("replay-verify-batch: fix=generate requires a fixCaller");
+    if (!caller) throw new Error(`replay-verify-batch: fix=${options.fix} requires a fixCaller`);
+    const fixAttempts = options.fixAttempts ?? 3;
     const maxFixCases = options.maxFixCases ?? 30;
     const seed = options.seed ?? 17;
     const eligible = rows.filter((r) => r.status === "ok" && r.replayed);
@@ -7809,20 +8076,115 @@ async function runReplayBatch(options) {
             armBPrefixExecuted: null,
             armBPrefixDivergences: null,
             failureVanished: null,
-            armBError: null
+            armBError: null,
+            attempts: null,
+            flippedAtAttempt: null
           }
         };
         continue;
       }
       const replayCase = selected.find((c) => c.trajId === row.trajId && c.corpus === row.corpus);
       const label = `fix ${row.corpus}/${row.trajId}`;
-      onProgress(`${label}: generating corrected command`);
-      calls += 1;
-      const generated = await generateFixCommand(caller, {
+      const signature = verdictByTraj.get(row.trajId)?.signature ?? null;
+      const stepTimeoutMs = options.stepTimeoutMs ?? replayCase.recordedStepTimeoutMs ?? 12e4;
+      const promptInput = {
         taskStatement: replayCase.taskStatement,
         steps: replayCase.steps,
         k: replayCase.k
-      });
+      };
+      const caseOut = join21(options.out, caseOutDirName(row));
+      if (options.fix === "loop") {
+        onProgress(`${label}: fix loop (budget ${fixAttempts} attempts)`);
+        const result = await runFixLoop(
+          caller,
+          promptInput,
+          async (command, attempt) => {
+            onProgress(
+              `${label}: attempt ${attempt} arm B \u2014 ${command.split("\n")[0].slice(0, 120)}`
+            );
+            const armB = await executeArmB(
+              replayCase,
+              command,
+              backendFactory(row.derivedImage),
+              signature,
+              stepTimeoutMs,
+              options.prefixLimit,
+              (message) => onProgress(`${label}: attempt ${attempt}: ${message}`)
+            );
+            mkdirSync2(caseOut, { recursive: true });
+            writeFileSync2(
+              join21(caseOut, `armB-attempt${attempt}-result.json`),
+              `${JSON.stringify({ command, ...armB }, null, 2)}
+`
+            );
+            writeFileSync2(
+              join21(caseOut, "armB-result.json"),
+              `${JSON.stringify({ command, attempt, ...armB }, null, 2)}
+`
+            );
+            return armB;
+          },
+          { maxAttempts: fixAttempts, onProgress: (message) => onProgress(`${label}: ${message}`) }
+        );
+        calls += result.llmCalls;
+        failures += result.llmFailures;
+        promptTokens += result.promptTokens;
+        completionTokens += result.completionTokens;
+        const usage = result.promptTokens + result.completionTokens > 0 ? { promptTokens: result.promptTokens, completionTokens: result.completionTokens } : null;
+        const flippedRecord = result.flippedAtAttempt !== null ? result.attempts.find((a) => a.attempt === result.flippedAtAttempt) : null;
+        const summary = flippedRecord ?? [...result.attempts].reverse().find((a) => a.executed) ?? null;
+        const lastRecord = result.attempts.at(-1) ?? null;
+        rows[index] = {
+          ...row,
+          fix: summary ? {
+            attempted: true,
+            sampledOut: false,
+            command: summary.command,
+            llmError: null,
+            usage,
+            armBExit: summary.exitCode,
+            armBPrefixExecuted: summary.prefixExecuted,
+            armBPrefixDivergences: summary.prefixDivergences,
+            failureVanished: summary.failureVanished,
+            armBError: null,
+            attempts: result.attempts,
+            flippedAtAttempt: result.flippedAtAttempt
+          } : result.aborted ? {
+            attempted: true,
+            sampledOut: false,
+            command: lastRecord?.command ?? null,
+            llmError: null,
+            usage,
+            armBExit: null,
+            armBPrefixExecuted: null,
+            armBPrefixDivergences: null,
+            failureVanished: null,
+            armBError: lastRecord?.armBError ?? "sandbox error",
+            attempts: result.attempts,
+            flippedAtAttempt: null
+          } : {
+            attempted: true,
+            sampledOut: false,
+            command: null,
+            llmError: lastRecord?.llmError ?? "no attempt produced a runnable fix",
+            usage,
+            armBExit: null,
+            armBPrefixExecuted: null,
+            armBPrefixDivergences: null,
+            failureVanished: null,
+            armBError: null,
+            attempts: result.attempts,
+            flippedAtAttempt: null
+          }
+        };
+        onProgress(
+          `${label}: loop done \u2014 flipped=${result.flipped}` + (result.flippedAtAttempt !== null ? ` at attempt ${result.flippedAtAttempt}` : "") + ` (${result.llmCalls} calls, ${result.attempts.filter((a) => a.executed).length} arms)`
+        );
+        continue;
+      }
+      onProgress(`${label}: generating corrected command`);
+      calls += 1;
+      const generated = await generateFixCommand(caller, promptInput);
       if (!generated.succeeded) {
         failures += 1;
         rows[index] = {
@@ -7837,7 +8199,9 @@ async function runReplayBatch(options) {
             armBPrefixExecuted: null,
             armBPrefixDivergences: null,
             failureVanished: null,
-            armBError: null
+            armBError: null,
+            attempts: null,
+            flippedAtAttempt: null
           }
         };
         onProgress(`${label}: LLM failed \u2014 ${generated.error.slice(0, 200)}`);
@@ -7845,8 +8209,6 @@ async function runReplayBatch(options) {
       }
       promptTokens += generated.value.usage?.promptTokens ?? 0;
       completionTokens += generated.value.usage?.completionTokens ?? 0;
-      const signature = verdictByTraj.get(row.trajId)?.signature ?? null;
-      const stepTimeoutMs = options.stepTimeoutMs ?? replayCase.recordedStepTimeoutMs ?? 12e4;
       onProgress(`${label}: arm B \u2014 ${generated.value.command.split("\n")[0].slice(0, 120)}`);
       try {
         const armB = await executeArmB(
@@ -7870,10 +8232,11 @@ async function runReplayBatch(options) {
             armBPrefixExecuted: armB.prefixExecuted,
             armBPrefixDivergences: armB.prefixDivergences,
             failureVanished: armB.failureVanished,
-            armBError: null
+            armBError: null,
+            attempts: null,
+            flippedAtAttempt: armB.failureVanished ? 1 : null
           }
         };
-        const caseOut = join21(options.out, caseOutDirName(row));
         mkdirSync2(caseOut, { recursive: true });
         writeFileSync2(
           join21(caseOut, "armB-result.json"),
@@ -7895,7 +8258,9 @@ async function runReplayBatch(options) {
             armBPrefixExecuted: null,
             armBPrefixDivergences: null,
             failureVanished: null,
-            armBError: message.slice(0, 500)
+            armBError: message.slice(0, 500),
+            attempts: null,
+            flippedAtAttempt: null
           }
         };
         onProgress(`${label}: arm B error \u2014 ${message.slice(0, 200)}`);
@@ -7920,6 +8285,15 @@ async function runReplayBatch(options) {
     (r) => r.recordedReturncodeAtK !== null && r.recordedReturncodeAtK !== 0
   );
   const flippedNonzeroRc = armBNonzeroRc.filter((r) => r.fix.failureVanished === true);
+  const attempt1Executed = rows.filter(
+    (r) => r.fix?.attempts?.find((a) => a.attempt === 1)?.executed === true
+  );
+  const flippedAt1 = rows.filter((r) => r.fix?.flippedAtAttempt === 1);
+  const flipsByAttempt = {};
+  for (const row of rows) {
+    const at = row.fix?.flippedAtAttempt;
+    if (typeof at === "number") flipsByAttempt[String(at)] = (flipsByAttempt[String(at)] ?? 0) + 1;
+  }
   const excludedByReason = {};
   for (const excluded of enumeration.excluded) {
     excludedByReason[excluded.reason] = (excludedByReason[excluded.reason] ?? 0) + 1;
@@ -7959,16 +8333,22 @@ async function runReplayBatch(options) {
         denominator: selected.length,
         value: rate(signatureStrict.length, selected.length)
       },
-      fixFlipRate: options.fix === "generate" ? {
+      fixFlipRate: options.fix !== "none" ? {
         numerator: flipped.length,
         denominator: armBExecuted.length,
         value: rate(flipped.length, armBExecuted.length)
       } : null,
-      fixFlipRateNonzeroRc: options.fix === "generate" ? {
+      fixFlipRateNonzeroRc: options.fix !== "none" ? {
         numerator: flippedNonzeroRc.length,
         denominator: armBNonzeroRc.length,
         value: rate(flippedNonzeroRc.length, armBNonzeroRc.length)
-      } : null
+      } : null,
+      fixFlipAttempt1: options.fix === "loop" ? {
+        numerator: flippedAt1.length,
+        denominator: attempt1Executed.length,
+        value: rate(flippedAt1.length, attempt1Executed.length)
+      } : null,
+      flipsByAttempt: options.fix === "loop" ? flipsByAttempt : null
     },
     llm,
     excluded: enumeration.excluded,
@@ -8012,6 +8392,15 @@ function renderBatchReport(report) {
       `- Fix-flip rate on recorded-rc\u22600 cases: ${pct(headline.fixFlipRateNonzeroRc.value)} (${headline.fixFlipRateNonzeroRc.numerator}/${headline.fixFlipRateNonzeroRc.denominator}; real recorded failures \u2014 a gold step recorded with rc 0 flips vacuously).`
     );
   }
+  if (headline.fixFlipAttempt1) {
+    lines.push(
+      `- Fix-flip@1: ${pct(headline.fixFlipAttempt1.value)} (${headline.fixFlipAttempt1.numerator}/${headline.fixFlipAttempt1.denominator} cases whose attempt 1 executed \u2014 the one-shot-comparable number).`
+    );
+  }
+  if (headline.flipsByAttempt && Object.keys(headline.flipsByAttempt).length > 0) {
+    const parts = Object.entries(headline.flipsByAttempt).sort((a, b) => Number(a[0]) - Number(b[0])).map(([attempt, count2]) => `attempt ${attempt}: ${count2}`);
+    lines.push(`- Flips by attempt: ${parts.join(", ")}.`);
+  }
   lines.push("");
   lines.push("## Enumeration");
   lines.push("");
@@ -8043,9 +8432,9 @@ function renderBatchReport(report) {
     lines.push("");
     lines.push("| corpus | trajectory | image | error |");
     lines.push("| --- | --- | --- | --- |");
-    for (const failure of report.pullFailures) {
+    for (const failure2 of report.pullFailures) {
       lines.push(
-        `| ${failure.corpus} | ${failure.trajId} | \`${failure.image}\` | ${failure.error.replaceAll("|", "\\|")} |`
+        `| ${failure2.corpus} | ${failure2.trajId} | \`${failure2.image}\` | ${failure2.error.replaceAll("|", "\\|")} |`
       );
     }
   }
@@ -8060,7 +8449,7 @@ function renderBatchReport(report) {
   );
   for (const row of report.cases) {
     const fix = row.fix;
-    const fixCell = !fix ? "\u2014" : fix.sampledOut ? "sampled-out" : fix.llmError ? "llm-failed" : fix.armBError ? "armB-error" : "generated";
+    const fixCell = !fix ? "\u2014" : fix.sampledOut ? "sampled-out" : fix.llmError ? "llm-failed" : fix.armBError ? "armB-error" : fix.attempts ? fix.flippedAtAttempt !== null ? `flip@${fix.flippedAtAttempt}` : `exhausted(${fix.attempts.length})` : "generated";
     lines.push(
       [
         row.corpus,
@@ -8122,13 +8511,20 @@ function parseReplayBatchArgs(argv) {
     return n;
   };
   const fix = values.get("--fix") ?? "none";
-  if (fix !== "none" && fix !== "generate") {
-    throw new Error(`replay-verify-batch: --fix must be none or generate, got ${fix}`);
+  if (fix !== "none" && fix !== "generate" && fix !== "loop") {
+    throw new Error(`replay-verify-batch: --fix must be none, generate, or loop, got ${fix}`);
+  }
+  const fixAttempts = optionalNumber("--fix-attempts") ?? 3;
+  if (!Number.isInteger(fixAttempts) || fixAttempts < 1) {
+    throw new Error(
+      `replay-verify-batch: --fix-attempts must be a positive integer, got ${values.get("--fix-attempts")}`
+    );
   }
   return {
     corpora,
     out: out ?? ".",
     fix,
+    fixAttempts,
     fixModel: values.get("--fix-model") ?? "glm-5.2",
     fixBaseUrl: values.get("--fix-base-url") ?? "https://api.z.ai/api/coding/paas/v4",
     fixApiKeyEnv: values.get("--fix-api-key-env") ?? "ZAI_GLM_API_KEY",
@@ -8150,7 +8546,7 @@ function replayBatchUsage() {
 Usage:
   traces replay-verify-batch \\
       --corpus NAME=<labels.json>::<prepared-dir> [--corpus ...] \\
-      --out DIR [--fix none|generate] [--enumerate-only] \\
+      --out DIR [--fix none|generate|loop] [--fix-attempts 3] [--enumerate-only] \\
       [--fix-model glm-5.2] [--fix-base-url URL] [--fix-api-key-env ZAI_GLM_API_KEY] \\
       [--max-fix-cases 30] [--seed 17] [--step-timeout MS] [--prefix-limit N] \\
       [--case-filter SUBSTRING] [--case-limit N] \\
@@ -8169,6 +8565,13 @@ Usage:
   --max-fix-cases, seeded sample beyond it) and executes the corrected command
   as arm B in a fresh sandbox.
 
+  --fix loop iterates: attempt 1 is the one-shot prompt; when an arm fails
+  (nonzero exit or the failure signature persists) or the model call fails,
+  the next prompt carries every prior command with its REAL executed
+  stdout/stderr, up to --fix-attempts attempts (default 3). Retries may
+  answer with a short script (<=5 commands) executed as one /bin/sh unit.
+  Every attempt runs in its own fresh sandbox with the same replayed prefix.
+
 Outputs batch-report.json, batch-report.md, cases.jsonl (incremental), and one
 directory per case with the full replay-verify artifacts.
 See docs/replay-verify.md for orchestrator setup and honest limits.
@@ -8213,7 +8616,7 @@ async function cmdReplayVerifyBatch(argv) {
     );
   }
   let fixCaller;
-  if (parsed.fix === "generate") {
+  if (parsed.fix !== "none") {
     const fixApiKey = process.env[parsed.fixApiKeyEnv];
     if (!fixApiKey) {
       throw new Error(
@@ -8232,6 +8635,7 @@ async function cmdReplayVerifyBatch(argv) {
     baseUrl: parsed.baseUrl,
     apiKey,
     fix: parsed.fix,
+    fixAttempts: parsed.fixAttempts,
     fixCaller,
     fixModelLabel: parsed.fixModel,
     maxFixCases: parsed.maxFixCases,
@@ -8251,6 +8655,573 @@ async function cmdReplayVerifyBatch(argv) {
   );
 }
 
+// src/replay-wire.ts
+var SUBJECT_PATTERN = /^incorrect-steps-(\d+)-(\d+)-(escaped|unescaped)-consequence-(\d+)$/;
+function parseIncorrectStepsSubject(subject) {
+  const match = SUBJECT_PATTERN.exec(subject);
+  if (!match) return null;
+  return {
+    firstStep: Number(match[1]),
+    lastStep: Number(match[2]),
+    escapeStatus: match[3],
+    consequenceStep: Number(match[4])
+  };
+}
+function resolveFindingInvocation(finding2, corpora) {
+  const subject = parseIncorrectStepsSubject(finding2.subject);
+  if (!subject) {
+    throw new Error(
+      `replay-wire: subject '${finding2.subject}' is not incorrect-steps-<first>-<last>-<escaped|unescaped>-consequence-<step>`
+    );
+  }
+  const failures = [];
+  for (const corpus of corpora) {
+    const resolution = resolveCaseResources(corpus, finding2.trajId);
+    if (resolution.resolved) {
+      const at = subject.firstStep;
+      const step = resolution.resources.steps.find((s) => s.step_id === at);
+      if (!step) {
+        throw new Error(
+          `replay-wire: finding step ${at} is outside ${finding2.trajId} (${resolution.resources.steps.length} steps)`
+        );
+      }
+      return { resources: resolution.resources, subject, at };
+    }
+    failures.push(`${corpus.name}: ${resolution.reason}`);
+  }
+  throw new Error(
+    `replay-wire: trajectory ${finding2.trajId} is not replayable in any corpus \u2014 ${failures.join("; ")}`
+  );
+}
+async function replayVerifyFinding(finding2, options) {
+  if (options.fixCaller && options.fixCommand !== void 0) {
+    throw new Error("replay-wire: pass fixCaller or fixCommand, not both");
+  }
+  const invocation = resolveFindingInvocation(finding2, options.corpora);
+  let fixCommand = options.fixCommand ?? null;
+  if (options.fixCaller) {
+    const generated = await generateFixCommand(options.fixCaller, {
+      taskStatement: invocation.resources.taskStatement,
+      steps: invocation.resources.steps,
+      k: invocation.at
+    });
+    if (!generated.succeeded) {
+      throw new Error(`replay-wire: fix generation failed \u2014 ${generated.error}`);
+    }
+    fixCommand = generated.value.command;
+  }
+  const verdict = await replayVerify({
+    stepsPath: invocation.resources.stepsPath,
+    image: invocation.resources.image,
+    at: invocation.at,
+    fixCommand: fixCommand ?? void 0,
+    cwd: invocation.resources.cwd,
+    out: options.out,
+    caseId: invocation.resources.trajId,
+    stepTimeoutMs: options.stepTimeoutMs ?? invocation.resources.recordedStepTimeoutMs ?? void 0,
+    prefixLimit: options.prefixLimit,
+    backend: options.backend,
+    apiKey: options.apiKey,
+    baseUrl: options.baseUrl,
+    onProgress: options.onProgress
+  });
+  return { invocation, fixCommand, verdict };
+}
+
+// src/analyze-verify.ts
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { join as join22 } from "path";
+var SINGLE_STEP_SUBJECT = /^incorrect-step-(\d+)$/;
+function findingReplayStep(finding2) {
+  const fromMetadata = finding2.metadata?.block_first_step;
+  if (typeof fromMetadata === "number" && Number.isInteger(fromMetadata) && fromMetadata >= 1) {
+    return fromMetadata;
+  }
+  const subject = finding2.subject ?? "";
+  const wire = parseIncorrectStepsSubject(subject);
+  if (wire) return wire.firstStep;
+  const single = SINGLE_STEP_SUBJECT.exec(subject);
+  if (single) return Number(single[1]);
+  return null;
+}
+var TRACE_EVIDENCE_URI = /^trace:\/\/([^/]+)\//;
+function findingTrajectoryId(finding2) {
+  for (const ref of finding2.evidence_refs ?? []) {
+    if (typeof ref.uri !== "string") continue;
+    const match = TRACE_EVIDENCE_URI.exec(ref.uri);
+    if (match) return match[1];
+  }
+  return null;
+}
+function checkStep(steps, at) {
+  const step = steps.find((s) => s.step_id === at);
+  if (!step) {
+    return { ok: false, reason: `step ${at} is outside the trajectory (${steps.length} steps)` };
+  }
+  if (isSubmitAction(step.action)) {
+    return {
+      ok: false,
+      reason: `step ${at} is the submit action \u2014 a submit decision has no executable failure to replay`
+    };
+  }
+  const recordedReturncode = parseRecordedReturncode(step.observation);
+  if (recordedReturncode === null) {
+    return {
+      ok: false,
+      reason: `step ${at} recorded no returncode \u2014 there is no executable failure signature to reproduce`
+    };
+  }
+  return { ok: true, recordedReturncode };
+}
+function resolveFindingReplayability(finding2, source) {
+  const at = findingReplayStep(finding2);
+  if (at === null) {
+    return {
+      replayable: false,
+      reason: `subject '${finding2.subject ?? "(none)"}' names no trajectory step (expected incorrect-step-<n>, incorrect-steps-<f>-<l>-\u2026, or metadata.block_first_step)`
+    };
+  }
+  if (source.kind === "direct") {
+    const trajId2 = findingTrajectoryId(finding2);
+    if (trajId2 && source.caseId && trajId2 !== source.caseId) {
+      return {
+        replayable: false,
+        reason: `finding cites trajectory '${trajId2}' but the supplied steps are case '${source.caseId}'`
+      };
+    }
+    let steps;
+    try {
+      steps = JSON.parse(readFileSync4(source.stepsPath, "utf8"));
+    } catch (err) {
+      throw new Error(
+        `verify-findings: cannot read steps file ${source.stepsPath} \u2014 ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    if (!Array.isArray(steps) || steps.length === 0) {
+      throw new Error(`verify-findings: ${source.stepsPath} is not a non-empty steps array`);
+    }
+    const step = checkStep(steps, at);
+    if (!step.ok) return { replayable: false, reason: step.reason };
+    return {
+      replayable: true,
+      resolved: {
+        caseId: source.caseId ?? trajId2 ?? source.stepsPath,
+        stepsPath: source.stepsPath,
+        image: source.image,
+        cwd: source.cwd,
+        at,
+        recordedReturncode: step.recordedReturncode,
+        recordedStepTimeoutMs: null
+      }
+    };
+  }
+  const trajId = findingTrajectoryId(finding2);
+  if (!trajId) {
+    return {
+      replayable: false,
+      reason: "finding carries no trace://<trajectory>/ evidence ref naming its trajectory"
+    };
+  }
+  const failures = [];
+  for (const corpus of source.corpora) {
+    const resolution = resolveCaseResources(corpus, trajId);
+    if (!resolution.resolved) {
+      failures.push(`${corpus.name}: ${resolution.reason}${resolution.detail ? ` (${resolution.detail})` : ""}`);
+      continue;
+    }
+    const step = checkStep(resolution.resources.steps, at);
+    if (!step.ok) return { replayable: false, reason: step.reason };
+    return {
+      replayable: true,
+      resolved: {
+        caseId: trajId,
+        stepsPath: resolution.resources.stepsPath,
+        image: resolution.resources.image,
+        cwd: resolution.resources.cwd,
+        at,
+        recordedReturncode: step.recordedReturncode,
+        recordedStepTimeoutMs: resolution.resources.recordedStepTimeoutMs
+      }
+    };
+  }
+  return {
+    replayable: false,
+    reason: `trajectory ${trajId} is not replayable in any corpus \u2014 ${failures.join("; ")}`
+  };
+}
+function classifyVerdict(verdict) {
+  if (!verdict.armA.failureSignatureMatch) return "divergent";
+  if (verdict.armB?.failureVanished) return "fix-flipped";
+  return "reproduced";
+}
+var DEFAULT_SANDBOX_BASE_URL = "http://127.0.0.1:4097";
+async function assertSandboxReachable(baseUrl) {
+  let response;
+  try {
+    response = await fetch(new URL("/health", baseUrl), { signal: AbortSignal.timeout(5e3) });
+  } catch (err) {
+    throw new Error(
+      `verify-findings: sandbox API unreachable at ${baseUrl} \u2014 ${err instanceof Error ? err.message : String(err)}. Executing findings requires a running sandbox orchestrator + SDK adapter (see docs/replay-verify.md); start them or pass --base-url.`
+    );
+  }
+  if (!response.ok) {
+    throw new Error(
+      `verify-findings: sandbox API at ${baseUrl} answered /health with HTTP ${response.status} \u2014 refusing to run proofs against degraded infrastructure`
+    );
+  }
+}
+function receiptExecution(verdict) {
+  return {
+    image: verdict.image,
+    cwd: verdict.cwd,
+    recordedReturncode: verdict.recordedReturncode,
+    signature: verdict.signature,
+    signatureBasis: verdict.signatureBasis,
+    armA: {
+      command: verdict.armA.command,
+      exitCode: verdict.armA.exitCode,
+      wallMs: verdict.armA.wallMs,
+      failureSignatureMatch: verdict.armA.failureSignatureMatch
+    },
+    armB: verdict.armB ? {
+      command: verdict.armB.command,
+      exitCode: verdict.armB.exitCode,
+      wallMs: verdict.armB.wallMs,
+      failureVanished: verdict.armB.failureVanished
+    } : null,
+    prefixExecuted: verdict.prefixExecuted,
+    prefixDivergences: verdict.prefixDivergences.length,
+    totalMs: verdict.timings.totalMs
+  };
+}
+function writeReceipt(receiptDir, finding2, verification, execution) {
+  const receipt = {
+    schema_version: "1.0.0",
+    produced_at: (/* @__PURE__ */ new Date()).toISOString(),
+    finding_id: verification.finding_id,
+    analyst_id: finding2.analyst_id ?? null,
+    subject: verification.subject,
+    claim: typeof finding2.claim === "string" ? finding2.claim.slice(0, 600) : null,
+    trajectory_id: verification.trajectory_id,
+    step: verification.step,
+    verified: verification.verified,
+    reason: verification.reason,
+    execution,
+    verdict_path: verification.verdict_path,
+    deduplicated_with: verification.deduplicated_with
+  };
+  writeFileSync3(join22(receiptDir, "receipt.json"), `${JSON.stringify(receipt, null, 2)}
+`);
+}
+function receiptDirName(index, finding2) {
+  const id = typeof finding2.finding_id === "string" && finding2.finding_id.length > 0 ? finding2.finding_id.replace(/[^A-Za-z0-9_-]/g, "_") : "finding";
+  return `${String(index + 1).padStart(3, "0")}-${id}`;
+}
+async function verifyFindings(findings, options) {
+  if (findings.length === 0) throw new Error("verify-findings: no findings to verify");
+  mkdirSync3(options.out, { recursive: true });
+  const resolutions = findings.map((finding2) => resolveFindingReplayability(finding2, options.source));
+  const baseUrl = options.baseUrl ?? DEFAULT_SANDBOX_BASE_URL;
+  if (resolutions.some((resolution) => resolution.replayable) && !options.backend) {
+    if (!options.apiKey) {
+      throw new Error(
+        "verify-findings: replayable findings need a sandbox API key \u2014 export SANDBOX_API_KEY or pass --api-key-env"
+      );
+    }
+    await assertSandboxReachable(baseUrl);
+  }
+  const preparer = options.source.kind === "corpus" && !options.backend ? options.source.preparer ?? dockerImagePreparer() : null;
+  const preparedImages = /* @__PURE__ */ new Map();
+  const executedByKey = /* @__PURE__ */ new Map();
+  const verifications = [];
+  let executions = 0;
+  for (let index = 0; index < findings.length; index++) {
+    const finding2 = findings[index];
+    const resolution = resolutions[index];
+    const receiptDir = join22(options.out, receiptDirName(index, finding2));
+    mkdirSync3(receiptDir, { recursive: true });
+    const identity = {
+      finding_id: finding2.finding_id ?? null,
+      subject: finding2.subject ?? null,
+      trajectory_id: findingTrajectoryId(finding2)
+    };
+    if (!resolution.replayable) {
+      const verification2 = {
+        ...identity,
+        step: findingReplayStep(finding2),
+        verified: "not-replayable",
+        reason: resolution.reason,
+        receipt: receiptDir,
+        verdict_path: null,
+        deduplicated_with: null
+      };
+      writeReceipt(receiptDir, finding2, verification2, null);
+      verifications.push(verification2);
+      options.onProgress?.(`${identity.finding_id ?? `finding ${index + 1}`}: not-replayable \u2014 ${resolution.reason}`);
+      continue;
+    }
+    const resolved = resolution.resolved;
+    const dedupeKey = `${resolved.caseId}::${resolved.at}::${options.fixCommand ?? ""}`;
+    const prior = executedByKey.get(dedupeKey);
+    if (prior) {
+      const verification2 = {
+        ...identity,
+        step: resolved.at,
+        verified: prior.verified,
+        reason: prior.reason,
+        receipt: receiptDir,
+        verdict_path: prior.verdict_path,
+        deduplicated_with: prior.receipt
+      };
+      const priorVerdict = prior.verdict_path ? JSON.parse(readFileSync4(prior.verdict_path, "utf8")) : null;
+      writeReceipt(receiptDir, finding2, verification2, priorVerdict ? receiptExecution(priorVerdict) : null);
+      verifications.push(verification2);
+      options.onProgress?.(
+        `${identity.finding_id ?? `finding ${index + 1}`}: ${prior.verified} (shares proof with ${prior.finding_id ?? prior.receipt})`
+      );
+      continue;
+    }
+    let image = resolved.image;
+    if (preparer) {
+      const preparationKey = `${resolved.image}::${resolved.cwd}`;
+      let preparation = preparedImages.get(preparationKey);
+      if (!preparation) {
+        const ensured = await preparer.ensure(resolved.image, resolved.cwd);
+        preparation = ensured.succeeded ? { succeeded: true, image: ensured.value.derivedImage } : { succeeded: false, error: ensured.error };
+        preparedImages.set(preparationKey, preparation);
+      }
+      if (!preparation.succeeded) {
+        const verification2 = {
+          ...identity,
+          step: resolved.at,
+          verified: "not-replayable",
+          reason: `replay image could not be prepared \u2014 ${preparation.error}`,
+          receipt: receiptDir,
+          verdict_path: null,
+          deduplicated_with: null
+        };
+        writeReceipt(receiptDir, finding2, verification2, null);
+        verifications.push(verification2);
+        options.onProgress?.(`${identity.finding_id ?? `finding ${index + 1}`}: not-replayable \u2014 image preparation failed`);
+        continue;
+      }
+      image = preparation.image;
+    }
+    options.onProgress?.(
+      `${identity.finding_id ?? `finding ${index + 1}`}: executing arm A at step ${resolved.at} of ${resolved.caseId} on ${image}`
+    );
+    const verdict = await replayVerify({
+      stepsPath: resolved.stepsPath,
+      image,
+      at: resolved.at,
+      fixCommand: options.fixCommand,
+      cwd: resolved.cwd,
+      out: receiptDir,
+      caseId: resolved.caseId,
+      stepTimeoutMs: options.stepTimeoutMs ?? resolved.recordedStepTimeoutMs ?? void 0,
+      prefixLimit: options.prefixLimit,
+      backend: options.backend,
+      apiKey: options.apiKey,
+      baseUrl,
+      maxLifetimeSeconds: options.maxLifetimeSeconds,
+      onProgress: options.onProgress
+    });
+    executions += 1;
+    const verification = {
+      ...identity,
+      step: resolved.at,
+      verified: classifyVerdict(verdict),
+      reason: null,
+      receipt: receiptDir,
+      verdict_path: join22(receiptDir, "replay-verdict.json"),
+      deduplicated_with: null
+    };
+    executedByKey.set(dedupeKey, verification);
+    writeReceipt(receiptDir, finding2, verification, receiptExecution(verdict));
+    verifications.push(verification);
+    options.onProgress?.(`${identity.finding_id ?? `finding ${index + 1}`}: ${verification.verified}`);
+  }
+  const counts = {
+    reproduced: 0,
+    "fix-flipped": 0,
+    divergent: 0,
+    "not-replayable": 0
+  };
+  for (const verification of verifications) counts[verification.verified] += 1;
+  const run = { out: options.out, verifications, counts, executions };
+  writeFileSync3(
+    join22(options.out, "verifications.json"),
+    `${JSON.stringify({ schema_version: "1.0.0", ...run }, null, 2)}
+`
+  );
+  return run;
+}
+function verdictCell(verification) {
+  switch (verification.verified) {
+    case "reproduced":
+      return "**VERIFIED** \u2014 reproduced";
+    case "fix-flipped":
+      return "**VERIFIED** \u2014 fix-flipped";
+    case "divergent":
+      return "DIVERGENT \u2014 recorded failure did not reproduce";
+    case "not-replayable":
+      return `UNVERIFIABLE \u2014 ${verification.reason ?? "no reason recorded"}`;
+  }
+}
+function renderVerifiedFindingsSection(run) {
+  const lines = ["## Verified findings (executed replay)", ""];
+  const total = run.verifications.length;
+  lines.push(
+    `${total} finding(s) \u2192 ${run.counts.reproduced} reproduced, ${run.counts["fix-flipped"]} fix-flipped, ${run.counts.divergent} divergent, ${run.counts["not-replayable"]} not replayable (${run.executions} sandbox execution(s); findings accusing the same step share one proof).`
+  );
+  lines.push("");
+  lines.push("| Finding | Subject | Step | Verdict | Receipt |");
+  lines.push("|---|---|---:|---|---|");
+  for (const verification of run.verifications) {
+    const shared = verification.deduplicated_with ? " (shared proof)" : "";
+    lines.push(
+      `| \`${verification.finding_id ?? "\u2014"}\` | \`${verification.subject ?? "\u2014"}\` | ${verification.step ?? "\u2014"} | ${verdictCell(verification)} | \`${verification.receipt}\`${shared} |`
+    );
+  }
+  lines.push("");
+  lines.push(
+    "VERIFIED = the accused step was re-executed in a sandbox after replaying the trajectory prefix, and the recorded failure signature reproduced (fix-flipped: a corrected command additionally made it vanish). Each receipt directory carries receipt.json and, when executed, replay-verdict.json + report.md with real stdout/stderr."
+  );
+  lines.push("");
+  return lines.join("\n");
+}
+function readFindingsFile(path) {
+  const parsed = JSON.parse(readFileSync4(path, "utf8"));
+  const array = Array.isArray(parsed) ? parsed : parsed && typeof parsed === "object" && Array.isArray(parsed.findings) ? parsed.findings : null;
+  if (!array) {
+    throw new Error(`${path} is neither a findings array nor an object with a findings array`);
+  }
+  for (const entry of array) {
+    if (!entry || typeof entry !== "object") {
+      throw new Error(`${path}: every finding must be an object, got ${JSON.stringify(entry)}`);
+    }
+  }
+  return array;
+}
+function verifyFindingsUsage() {
+  return `traces verify-findings \u2014 execute analyst findings as sandbox replay proofs
+
+Usage:
+  traces verify-findings --findings FINDINGS.json --out DIR \\
+      ( --steps STEPS.json --image IMG --cwd DIR [--case ID]
+      | --corpus name=<labels.json>::<preparedDir> [--corpus ...] ) \\
+      [--fix-command CMD] [--step-timeout MS] [--prefix-limit N] \\
+      [--base-url URL] [--api-key-env VAR] [--max-lifetime SECONDS]
+
+  --findings         JSON array of analyst findings (or an object with a findings
+                     array) \u2014 the shape agent-eval analysts emit: subject
+                     incorrect-step-<n>, metadata.block_first_step, trace:// evidence
+  --out              receipt root; one directory per finding + verifications.json
+  --steps/--image/--cwd
+                     verify against one trajectory; the image must be replay-ready
+                     (uid-1000 derived), exactly like traces replay-verify
+  --case             trajectory id of --steps; findings citing other trajectories
+                     are honestly marked not-replayable
+  --corpus           resolve each finding's trajectory in CodeTraceBench corpora;
+                     images are derived via the batch uid-1000 preparer (docker)
+  --fix-command      corrected step for arm B; a reproduced finding whose fix
+                     flips becomes fix-flipped
+  --base-url         sandbox API url (default $SANDBOX_API_URL or ${DEFAULT_SANDBOX_BASE_URL})
+  --api-key-env      env var holding the sandbox API key (default SANDBOX_API_KEY)
+
+Every finding gets a verdict: reproduced | fix-flipped | divergent | not-replayable,
+with a receipt directory carrying the executed evidence or the precise reason.
+Requires a running sandbox orchestrator when any finding is replayable \u2014 infra
+absence is an error, never a silent skip. See docs/replay-verify.md for setup.
+`;
+}
+function parseVerifyFindingsArgs(argv) {
+  const values = /* @__PURE__ */ new Map();
+  const corpora = [];
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === "--help" || arg === "-h") return "help";
+    if (!arg.startsWith("--")) throw new Error(`unexpected positional argument: ${arg}`);
+    const value = argv[++i];
+    if (value === void 0) throw new Error(`missing value for ${arg}`);
+    if (arg === "--corpus") {
+      corpora.push(parseCorpusFlag(value));
+      continue;
+    }
+    values.set(arg, value);
+  }
+  const required = (flag) => {
+    const v = values.get(flag);
+    if (v === void 0) throw new Error(`verify-findings: ${flag} is required`);
+    return v;
+  };
+  const optionalNumber = (flag) => {
+    const v = values.get(flag);
+    if (v === void 0) return void 0;
+    const n = Number(v);
+    if (!Number.isFinite(n)) throw new Error(`verify-findings: ${flag} must be a number, got ${v}`);
+    return n;
+  };
+  const findingsPath = required("--findings");
+  const out = required("--out");
+  const direct = values.has("--steps") || values.has("--image") || values.has("--cwd");
+  if (direct && corpora.length > 0) {
+    throw new Error("verify-findings: pass --steps/--image/--cwd or --corpus, not both");
+  }
+  let source;
+  if (direct) {
+    source = {
+      kind: "direct",
+      stepsPath: required("--steps"),
+      image: required("--image"),
+      cwd: required("--cwd"),
+      ...values.has("--case") ? { caseId: values.get("--case") } : {}
+    };
+  } else if (corpora.length > 0) {
+    source = { kind: "corpus", corpora };
+  } else {
+    throw new Error("verify-findings: a replay source is required \u2014 --steps/--image/--cwd or --corpus");
+  }
+  return {
+    findingsPath,
+    source,
+    out,
+    fixCommand: values.get("--fix-command"),
+    stepTimeoutMs: optionalNumber("--step-timeout"),
+    prefixLimit: optionalNumber("--prefix-limit"),
+    baseUrl: values.get("--base-url") ?? process.env.SANDBOX_API_URL ?? DEFAULT_SANDBOX_BASE_URL,
+    apiKeyEnv: values.get("--api-key-env") ?? "SANDBOX_API_KEY",
+    maxLifetimeSeconds: optionalNumber("--max-lifetime")
+  };
+}
+async function cmdVerifyFindings(argv) {
+  const parsed = parseVerifyFindingsArgs(argv);
+  if (parsed === "help") {
+    process.stdout.write(verifyFindingsUsage());
+    return;
+  }
+  const findings = readFindingsFile(parsed.findingsPath);
+  const apiKey = process.env[parsed.apiKeyEnv];
+  const run = await verifyFindings(findings, {
+    source: parsed.source,
+    out: parsed.out,
+    fixCommand: parsed.fixCommand,
+    stepTimeoutMs: parsed.stepTimeoutMs,
+    prefixLimit: parsed.prefixLimit,
+    apiKey,
+    baseUrl: parsed.baseUrl,
+    maxLifetimeSeconds: parsed.maxLifetimeSeconds,
+    onProgress: (message) => process.stderr.write(`${message}
+`)
+  });
+  process.stdout.write(`${JSON.stringify(run, null, 2)}
+`);
+  process.stderr.write(
+    `verify-findings: ${run.verifications.length} finding(s) \u2192 ${run.counts.reproduced} reproduced, ${run.counts["fix-flipped"]} fix-flipped, ${run.counts.divergent} divergent, ${run.counts["not-replayable"]} not-replayable (${run.executions} execution(s)) \u2192 ${run.out}
+`
+  );
+}
+
 // src/external.ts
 import { spawn } from "child_process";
 import { readdir as readdir14, readFile as readFile7 } from "fs/promises";
@@ -8529,13 +9500,13 @@ function terminateWindowsProcessTree(child) {
     forceKill(child);
     return Promise.resolve();
   }
-  return new Promise((resolve8) => {
+  return new Promise((resolve10) => {
     let finished = false;
     const finish = () => {
       if (finished) return;
       finished = true;
       forceKill(child);
-      resolve8();
+      resolve10();
     };
     let killer;
     try {
@@ -8562,7 +9533,7 @@ function signalProcess(pid, signal) {
   }
 }
 function readProcessTableWithPs() {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve10, reject) => {
     let child;
     try {
       child = spawn("ps", ["-A", "-o", "pid=", "-o", "ppid="], {
@@ -8616,7 +9587,7 @@ function readProcessTableWithPs() {
           reject(new Error("ps: returned no process records"));
           return;
         }
-        resolve8(rows);
+        resolve10(rows);
       });
     });
   });
@@ -8626,10 +9597,10 @@ async function readLinuxProcProcessTable() {
   const rows = await Promise.all(
     entries.filter((entry) => entry.isDirectory() && /^\d+$/.test(entry.name)).map(async (entry) => {
       try {
-        const stat17 = await readFile7(`/proc/${entry.name}/stat`, "utf8");
-        const commandEnd = stat17.lastIndexOf(")");
+        const stat18 = await readFile7(`/proc/${entry.name}/stat`, "utf8");
+        const commandEnd = stat18.lastIndexOf(")");
         if (commandEnd < 0) return void 0;
-        const fields = stat17.slice(commandEnd + 1).trim().split(/\s+/);
+        const fields = stat18.slice(commandEnd + 1).trim().split(/\s+/);
         const pid = Number(entry.name);
         const parentPid = Number(fields[1]);
         if (!Number.isSafeInteger(pid) || pid < 1 || !Number.isSafeInteger(parentPid) || parentPid < 0) {
@@ -8691,7 +9662,7 @@ async function terminatePosixProcessTree(child) {
   }
   const rootPid = child.pid;
   const descendants = /* @__PURE__ */ new Map();
-  let failure;
+  let failure2;
   try {
     signalProcess(-rootPid, "SIGSTOP");
     signalProcess(rootPid, "SIGSTOP");
@@ -8708,7 +9679,7 @@ async function terminatePosixProcessTree(child) {
       previous = signature;
     }
   } catch (error) {
-    failure = error;
+    failure2 = error;
   } finally {
     for (const processEntry of [...descendants.values()].sort(
       (left, right) => right.depth - left.depth
@@ -8716,18 +9687,18 @@ async function terminatePosixProcessTree(child) {
       try {
         signalProcess(processEntry.pid, "SIGKILL");
       } catch (error) {
-        failure ??= error;
+        failure2 ??= error;
       }
     }
     try {
       signalProcess(-rootPid, "SIGKILL");
     } catch (error) {
-      failure ??= error;
+      failure2 ??= error;
     }
     forceKill(child);
   }
-  if (failure) {
-    throw failure instanceof Error ? failure : new Error(String(failure));
+  if (failure2) {
+    throw failure2 instanceof Error ? failure2 : new Error(String(failure2));
   }
 }
 function terminateProcessTree(child) {
@@ -8751,7 +9722,7 @@ function runCommand(command, args = [], opts = {}) {
     throw new RangeError("maxBuffer must be a positive safe integer");
   }
   if (opts.signal?.aborted) return Promise.reject(abortError(opts.signal));
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve10, reject) => {
     let child;
     try {
       child = spawn(command, [...args], { detached: process.platform !== "win32" });
@@ -8783,7 +9754,7 @@ function runCommand(command, args = [], opts = {}) {
       } else if (spawnError) {
         reject(spawnError);
       } else {
-        resolve8({ stdout: out, stderr: err, code: closeCode });
+        resolve10({ stdout: out, stderr: err, code: closeCode });
       }
     };
     function requestTermination(error) {
@@ -9015,18 +9986,18 @@ function commandRedactor(spec) {
 import { createHash as createHash9 } from "crypto";
 import { mkdir as mkdir3, mkdtemp as mkdtemp3, readFile as readFile8, readdir as readdir15, writeFile as writeFile4 } from "fs/promises";
 import { endianness, tmpdir as tmpdir4 } from "os";
-import { join as join22, resolve as resolve6 } from "path";
+import { join as join23, resolve as resolve6 } from "path";
 var HODOSCOPE_VERSION = "0.2.4";
 async function writeHodoscopeInput(otlpPath, options = {}) {
   const explicitDirectory = options.directory ? resolve6(options.directory) : void 0;
-  const directory = explicitDirectory ?? await mkdtemp3(join22(tmpdir4(), "traces-hodoscope-input-"));
+  const directory = explicitDirectory ?? await mkdtemp3(join23(tmpdir4(), "traces-hodoscope-input-"));
   if (explicitDirectory) {
     await mkdir3(directory, { recursive: true });
     if ((await readdir15(directory)).length > 0) {
       throw new Error(`Hodoscope explicit directory must be empty: ${directory}`);
     }
   }
-  const samples = join22(directory, "samples");
+  const samples = join23(directory, "samples");
   await mkdir3(samples);
   const rows = [];
   for await (const value of readJsonl(otlpPath)) rows.push(parseOpenInferenceRow(value));
@@ -9052,7 +10023,7 @@ async function writeHodoscopeInput(otlpPath, options = {}) {
     }
     actionCount += actions;
     const file = `${createHash9("sha256").update(traceId).digest("hex").slice(0, 24)}.json`;
-    await writeFile4(join22(samples, file), `${JSON.stringify(trajectory, null, 2)}
+    await writeFile4(join23(samples, file), `${JSON.stringify(trajectory, null, 2)}
 `, "utf8");
   }
   return {
@@ -9076,10 +10047,10 @@ function hodoscopeAnalyzer(options = {}) {
     async analyze(otlpPath, runOptions2 = {}) {
       const outputRoot = options.outputDir ? resolve6(options.outputDir) : tmpdir4();
       await mkdir3(outputRoot, { recursive: true });
-      const directory = await mkdtemp3(join22(outputRoot, "traces-hodoscope-"));
-      const input = join22(directory, "input");
-      const analysisFile = join22(directory, "analysis.hodoscope.json");
-      const samplesFile = join22(directory, "samples.json");
+      const directory = await mkdtemp3(join23(outputRoot, "traces-hodoscope-"));
+      const input = join23(directory, "input");
+      const analysisFile = join23(directory, "analysis.hodoscope.json");
+      const samplesFile = join23(directory, "samples.json");
       try {
         const prepared = await writeHodoscopeInput(otlpPath, {
           directory: input,
@@ -9698,6 +10669,425 @@ function assertPositiveInteger(name, value) {
   }
 }
 
+// src/analyst-engine-prime.ts
+import { createHash as createHash10 } from "crypto";
+import { request as httpRequest } from "http";
+import { request as httpsRequest } from "https";
+var DEFAULT_BRIDGE_URL = "http://localhost:4181";
+var DEFAULT_MODEL = "prime/zai/glm-5.2";
+var DEFAULT_TIMEOUT_MS = 12e5;
+var DEFAULT_MAX_INLINE_CHARS = 36e4;
+var DEFAULT_PER_ATTRIBUTE_CHAR_CAP = 1200;
+var DEFAULT_QUESTION = "Diagnose this trajectory: identify concrete agent failures, wasted work, and unsupported claims.";
+var MAX_FINDINGS = 10;
+var MAX_SPAN_IDS_PER_FINDING = 8;
+var SEVERITIES = /* @__PURE__ */ new Set(["critical", "high", "medium", "low", "info"]);
+var ANALYST_ID = "prime";
+function positiveIntegerEnv(name) {
+  const raw = process.env[name];
+  if (raw === void 0 || raw === "") return void 0;
+  const value = Number(raw);
+  if (!Number.isSafeInteger(value) || value < 1) {
+    throw new TypeError(`${name} must be a positive integer, got '${raw}'`);
+  }
+  return value;
+}
+function finiteOrNull(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function normalizeUsage(raw) {
+  if (!raw || typeof raw !== "object") return { calls: null, tokens: null, estimated: false };
+  const usage = raw;
+  const input = finiteOrNull(usage.prompt_tokens);
+  const output = finiteOrNull(usage.completion_tokens);
+  return {
+    calls: finiteOrNull(usage.model_requests),
+    tokens: input === null && output === null ? null : { input, output },
+    estimated: usage.estimated === true
+  };
+}
+function mergeUsage(a, b) {
+  const calls = a.calls !== null && b.calls !== null ? a.calls + b.calls : null;
+  const tokens3 = a.tokens !== null && b.tokens !== null && a.tokens.input !== null && b.tokens.input !== null && a.tokens.output !== null && b.tokens.output !== null ? { input: a.tokens.input + b.tokens.input, output: a.tokens.output + b.tokens.output } : null;
+  return { calls, tokens: tokens3, estimated: a.estimated || b.estimated };
+}
+function renderUsage(usage) {
+  const calls = usage.calls === null ? "uncaptured" : String(usage.calls);
+  const input = usage.tokens?.input ?? "uncaptured";
+  const output = usage.tokens?.output ?? "uncaptured";
+  const estimated = usage.estimated ? " (bridge-estimated)" : "";
+  return `usage: calls=${calls} input_tokens=${input} output_tokens=${output}${estimated}; cost=uncaptured (no pricing table)`;
+}
+function capAttributeValue(value, cap) {
+  const rendered = JSON.stringify(value);
+  if (rendered === void 0 || rendered.length <= cap) return value;
+  if (typeof value === "string") return `${value.slice(0, cap)}\u2026[truncated ${value.length - cap} chars]`;
+  return `[omitted non-string attribute: ${rendered.length} JSON chars]`;
+}
+function capRowAttributes(row, cap) {
+  const attributes2 = row.attributes;
+  if (!attributes2 || typeof attributes2 !== "object" || Array.isArray(attributes2)) return row;
+  const capped = {};
+  for (const [key, value] of Object.entries(attributes2)) {
+    capped[key] = capAttributeValue(value, cap);
+  }
+  return { ...row, attributes: capped };
+}
+async function projectArtifact(otlpPath, maxInlineChars, perAttributeCharCap, signal) {
+  const rows = [];
+  const spanTraces = /* @__PURE__ */ new Map();
+  let index = 0;
+  for await (const value of readJsonl(otlpPath, { signal })) {
+    const label = `${otlpPath}:${index + 1}`;
+    if (value === null || typeof value !== "object" || Array.isArray(value)) {
+      throw new TypeError(`${label} must contain an object`);
+    }
+    const row = value;
+    if (typeof row.trace_id !== "string" || row.trace_id.length === 0) {
+      throw new TypeError(`${label}.trace_id must be a non-empty string`);
+    }
+    if (typeof row.span_id !== "string" || row.span_id.length === 0) {
+      throw new TypeError(`${label}.span_id must be a non-empty string`);
+    }
+    rows.push(row);
+    const traces = spanTraces.get(row.span_id) ?? /* @__PURE__ */ new Set();
+    traces.add(row.trace_id);
+    spanTraces.set(row.span_id, traces);
+    index += 1;
+  }
+  if (rows.length === 0) throw new Error(`${otlpPath} contains no spans`);
+  const traceCount = new Set(rows.map((row) => row.trace_id)).size;
+  let projected = rows;
+  let rendered = JSON.stringify(projected);
+  const delivery = {
+    mode: "inline-json",
+    perAttributeCharCap: null,
+    renderedChars: rendered.length
+  };
+  if (rendered.length > maxInlineChars) {
+    projected = rows.map((row) => capRowAttributes(row, perAttributeCharCap));
+    rendered = JSON.stringify(projected);
+    delivery.perAttributeCharCap = perAttributeCharCap;
+    delivery.renderedChars = rendered.length;
+  }
+  if (rendered.length > maxInlineChars) {
+    throw new Error(
+      `trajectory renders to ${rendered.length} chars even at per-attribute cap ${perAttributeCharCap} (budget ${maxInlineChars}); inline delivery impossible`
+    );
+  }
+  return { rows: projected, rendered, delivery, traceCount, spanTraces };
+}
+var OUTPUT_CONTRACT_LINES = [
+  "OUTPUT CONTRACT (you have no trace tools and no REPL):",
+  "You are a one-shot analyst. Every fact you need is in the TRAJECTORY JSON below.",
+  "Do not run shell commands, do not read or write files, do not use any tools.",
+  "Reply with EXACTLY one fenced ```json code block and no other fenced block. The JSON object has exactly two fields:",
+  '  "answer": string \u2014 ONE short sentence (max 300 chars) summarizing your verdict.',
+  '  "findings": array (possibly empty) of finding rows, each exactly:',
+  '    {"span_ids": [string, ...],',
+  '     "severity": "critical"|"high"|"medium"|"low"|"info",',
+  '     "area": string (short kebab-case topic, max 40 chars),',
+  '     "claim": string (ONE short sentence, max 200 chars),',
+  '     "action": string (optional, ONE short imperative sentence, max 200 chars),',
+  '     "confidence": number 0..1}',
+  "Do NOT include a rationale field. Keep every string SHORT \u2014 long strings get corrupted in transport and void your work.",
+  `Report at most ${MAX_FINDINGS} findings; a finding cites 1..${MAX_SPAN_IDS_PER_FINDING} span_ids, each copied VERBATIM from a span in the trajectory below.`,
+  '"findings" is [] only for a clean trajectory.'
+];
+function buildPrompt(question, projection) {
+  return [
+    `QUESTION: ${question}`,
+    "",
+    ...OUTPUT_CONTRACT_LINES,
+    "",
+    `TRAJECTORY (${projection.traceCount} trace(s); ${projection.rows.length} spans; full OpenInference span projection as JSON):`,
+    projection.rendered
+  ].join("\n");
+}
+function buildRepairPrompt(parseDefect, previousReply) {
+  return [
+    "Your previous reply to a trace-analysis task was structurally malformed and could not be parsed",
+    `(${parseDefect}). Below is your previous reply verbatim. Re-emit ONLY the corrected JSON \u2014 one`,
+    "fenced ```json block, no other text, no tools. The JSON object has exactly two fields:",
+    '  "answer": string (ONE short sentence, max 300 chars)',
+    '  "findings": array (possibly empty) of {"span_ids": [string, ...],',
+    '   "severity": "critical"|"high"|"medium"|"low"|"info", "area": string (max 40 chars),',
+    '   "claim": string (max 200 chars), "action": string (optional, max 200 chars), "confidence": number 0..1}',
+    "No rationale field. Keep every string SHORT. Preserve the span ids and verdicts of your previous reply exactly; shorten prose freely.",
+    "",
+    "PREVIOUS REPLY:",
+    previousReply
+  ].join("\n");
+}
+function tryParseObject(text2) {
+  try {
+    const value = JSON.parse(text2.trim());
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function extractJsonObject(text2) {
+  const direct = tryParseObject(text2);
+  if (direct) return direct;
+  const fenced = [...text2.matchAll(/```(?:json)?\s*\n?([\s\S]*?)```/g)];
+  for (let i = fenced.length - 1; i >= 0; i -= 1) {
+    const candidate = tryParseObject(fenced[i][1]);
+    if (candidate) return candidate;
+  }
+  const start = text2.indexOf("{");
+  const end = text2.lastIndexOf("}");
+  if (start >= 0 && end > start) {
+    const candidate = tryParseObject(text2.slice(start, end + 1));
+    if (candidate) return candidate;
+  }
+  return null;
+}
+function parseDefectOf(parsed) {
+  if (parsed === null) return "no parseable JSON object";
+  if (!Array.isArray(parsed.findings)) return 'JSON has no "findings" array';
+  return null;
+}
+function findingRowDefect(row, spanTraces) {
+  if (!row || typeof row !== "object" || Array.isArray(row)) return "row is not an object";
+  const record2 = row;
+  if (!Array.isArray(record2.span_ids) || record2.span_ids.length === 0) {
+    return "span_ids must be a non-empty array";
+  }
+  const spanIds = [];
+  for (const id of record2.span_ids) {
+    if (typeof id !== "string" || id.length === 0) return "span_ids must contain non-empty strings";
+    const traces = spanTraces.get(id);
+    if (!traces) return `span_id '${id}' is not in the trajectory`;
+    if (traces.size > 1) return `span_id '${id}' is ambiguous across ${traces.size} traces`;
+    if (!spanIds.includes(id)) spanIds.push(id);
+  }
+  if (spanIds.length > MAX_SPAN_IDS_PER_FINDING) {
+    return `span_ids cites ${spanIds.length} distinct spans (cap ${MAX_SPAN_IDS_PER_FINDING})`;
+  }
+  if (typeof record2.severity !== "string" || !SEVERITIES.has(record2.severity)) {
+    return "severity outside the analyst severity enum";
+  }
+  if (typeof record2.area !== "string" || record2.area.trim().length === 0 || record2.area.length > 200) {
+    return "area must be a 1-200 char string";
+  }
+  if (typeof record2.claim !== "string" || record2.claim.trim().length === 0 || record2.claim.length > 2e3) {
+    return "claim must be a 1-2000 char string";
+  }
+  if (record2.action !== void 0 && (typeof record2.action !== "string" || record2.action.trim().length === 0 || record2.action.length > 2e3)) {
+    return "action must be a 1-2000 char string when present";
+  }
+  if (typeof record2.confidence !== "number" || !Number.isFinite(record2.confidence) || record2.confidence < 0 || record2.confidence > 1) {
+    return "confidence must be 0..1";
+  }
+  return {
+    spanIds,
+    severity: record2.severity,
+    area: record2.area.trim(),
+    claim: record2.claim.trim(),
+    ...typeof record2.action === "string" ? { action: record2.action.trim() } : {},
+    confidence: record2.confidence
+  };
+}
+function toAnalystFinding(row, index, spanTraces, model, producedAt) {
+  const uris = row.spanIds.map((spanId) => {
+    const traces = spanTraces.get(spanId);
+    return spanEvidenceUri([...traces][0], spanId);
+  });
+  const findingId = `prime-${createHash10("sha256").update(`${index}
+${row.claim}
+${uris.join("\n")}`).digest("hex").slice(0, 12)}`;
+  return {
+    schema_version: "1.0.0",
+    finding_id: findingId,
+    analyst_id: ANALYST_ID,
+    produced_at: producedAt,
+    severity: row.severity,
+    area: row.area,
+    claim: row.claim,
+    evidence_refs: uris.map((uri) => ({ kind: "span", uri })),
+    confidence: row.confidence,
+    ...row.action ? { recommended_action: row.action } : {},
+    metadata: { engine: ANALYST_ID, model }
+  };
+}
+var httpJsonTransport = ({ url, body, signal }) => {
+  const target = new URL(url);
+  if (target.protocol !== "http:" && target.protocol !== "https:") {
+    throw new TypeError(`bridge URL must be http: or https:, got ${target.protocol}`);
+  }
+  const requestFn = target.protocol === "https:" ? httpsRequest : httpRequest;
+  const payload = JSON.stringify(body);
+  return new Promise((resolve10, reject) => {
+    const req = requestFn(
+      {
+        hostname: target.hostname,
+        port: target.port,
+        path: `${target.pathname}${target.search}`,
+        method: "POST",
+        headers: { "content-type": "application/json", "content-length": Buffer.byteLength(payload) },
+        signal
+      },
+      (res) => {
+        const chunks = [];
+        res.on("data", (chunk) => chunks.push(chunk));
+        res.on("end", () => resolve10({ status: res.statusCode ?? 0, text: Buffer.concat(chunks).toString("utf8") }));
+        res.on("error", reject);
+      }
+    );
+    req.on("error", reject);
+    req.end(payload);
+  });
+};
+var PrimeBridgeError = class extends Error {
+};
+async function callBridge(transport, url, model, content, timeoutMs, callerSignal, turn) {
+  const controller = new AbortController();
+  const timer = setTimeout(
+    () => controller.abort(new Error(`${turn}bridge call exceeded ${timeoutMs}ms`)),
+    timeoutMs
+  );
+  const onCallerAbort = () => controller.abort(callerSignal.reason);
+  callerSignal?.addEventListener("abort", onCallerAbort, { once: true });
+  if (callerSignal?.aborted) onCallerAbort();
+  let response;
+  try {
+    response = await transport({
+      url,
+      body: { model, messages: [{ role: "user", content }] },
+      signal: controller.signal
+    });
+  } catch (error) {
+    const reason = controller.signal.aborted ? controller.signal.reason : error;
+    throw new PrimeBridgeError(
+      `${turn}bridge transport failure: ${reason instanceof Error ? reason.message : String(reason)}`
+    );
+  } finally {
+    clearTimeout(timer);
+    callerSignal?.removeEventListener("abort", onCallerAbort);
+  }
+  if (response.status !== 200) {
+    throw new PrimeBridgeError(`${turn}bridge HTTP ${response.status}: ${response.text.slice(0, 500)}`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(response.text);
+  } catch {
+    throw new PrimeBridgeError(`${turn}bridge returned unparseable JSON (${response.text.length} bytes)`);
+  }
+  const record2 = parsed;
+  const replyContent = record2.choices?.[0]?.message?.content;
+  if (typeof replyContent !== "string" || replyContent.length === 0) {
+    throw new PrimeBridgeError(`${turn}bridge reply carries no message content`);
+  }
+  return { content: replyContent, usage: normalizeUsage(record2.usage) };
+}
+function failure(output, error) {
+  return { analyzer: ANALYST_ID, kind: "report", ok: false, output, error };
+}
+function primeAnalyzer(opts = {}) {
+  const bridgeUrl = (opts.bridgeUrl ?? process.env.TRACES_PRIME_BRIDGE_URL ?? DEFAULT_BRIDGE_URL).replace(/\/+$/, "");
+  const model = opts.model ?? process.env.TRACES_PRIME_MODEL ?? DEFAULT_MODEL;
+  const timeoutMs = opts.timeoutMs ?? positiveIntegerEnv("TRACES_PRIME_TIMEOUT_MS") ?? DEFAULT_TIMEOUT_MS;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1) {
+    throw new RangeError("timeoutMs must be a positive safe integer");
+  }
+  const maxInlineChars = opts.maxInlineChars ?? DEFAULT_MAX_INLINE_CHARS;
+  const perAttributeCharCap = opts.perAttributeCharCap ?? DEFAULT_PER_ATTRIBUTE_CHAR_CAP;
+  if (!Number.isSafeInteger(maxInlineChars) || maxInlineChars < 1) {
+    throw new RangeError("maxInlineChars must be a positive safe integer");
+  }
+  if (!Number.isSafeInteger(perAttributeCharCap) || perAttributeCharCap < 1) {
+    throw new RangeError("perAttributeCharCap must be a positive safe integer");
+  }
+  const repairEnabled = opts.repair ?? true;
+  const transport = opts.transport ?? httpJsonTransport;
+  const url = `${bridgeUrl}/v1/chat/completions`;
+  return {
+    name: ANALYST_ID,
+    async analyze(otlpPath, analyzeOpts = {}) {
+      let projection;
+      try {
+        projection = await projectArtifact(otlpPath, maxInlineChars, perAttributeCharCap, analyzeOpts.signal);
+      } catch (error) {
+        return failure("", error instanceof Error ? error.message : String(error));
+      }
+      const question = analyzeOpts.prompt ?? opts.defaultPrompt ?? DEFAULT_QUESTION;
+      const deliveryLine = `delivery: ${projection.delivery.mode} (${projection.delivery.renderedChars} chars, per-attribute cap ${projection.delivery.perAttributeCharCap ?? "none"})`;
+      let reply;
+      try {
+        reply = await callBridge(
+          transport,
+          url,
+          model,
+          buildPrompt(question, projection),
+          timeoutMs,
+          analyzeOpts.signal,
+          ""
+        );
+      } catch (error) {
+        if (!(error instanceof PrimeBridgeError)) throw error;
+        return failure("", `${error.message}; ${deliveryLine}`);
+      }
+      let usage = reply.usage;
+      let parsed = extractJsonObject(reply.content);
+      let parseDefect = parseDefectOf(parsed);
+      let repairAttempted = false;
+      if (parseDefect !== null && repairEnabled) {
+        repairAttempted = true;
+        let repairReply;
+        try {
+          repairReply = await callBridge(
+            transport,
+            url,
+            model,
+            buildRepairPrompt(parseDefect, reply.content),
+            timeoutMs,
+            analyzeOpts.signal,
+            "repair-turn "
+          );
+        } catch (error) {
+          if (!(error instanceof PrimeBridgeError)) throw error;
+          return failure(reply.content, `${error.message}; ${renderUsage(usage)}`);
+        }
+        usage = mergeUsage(usage, repairReply.usage);
+        parsed = extractJsonObject(repairReply.content);
+        parseDefect = parseDefectOf(parsed);
+      }
+      if (parseDefect !== null) {
+        return failure(
+          reply.content,
+          `${parseDefect} in prime reply${repairAttempted ? " even after the bounded repair turn" : ""}; ` + renderUsage(usage)
+        );
+      }
+      const rows = parsed.findings.slice(0, MAX_FINDINGS);
+      const overflow = parsed.findings.length - rows.length;
+      const producedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const rejected = [];
+      const findings = [];
+      rows.forEach((row, index) => {
+        const decoded = findingRowDefect(row, projection.spanTraces);
+        if (typeof decoded === "string") {
+          rejected.push(`rejected[${index}]: ${decoded}`);
+          return;
+        }
+        findings.push(toAnalystFinding(decoded, index, projection.spanTraces, model, producedAt));
+      });
+      const answer = typeof parsed.answer === "string" ? parsed.answer : null;
+      const output = [
+        ...answer ? [`answer: ${answer}`] : [],
+        `findings: ${findings.length} mapped, ${rejected.length} rejected` + (overflow > 0 ? `, ${overflow} over the ${MAX_FINDINGS}-finding cap dropped` : ""),
+        ...rejected,
+        deliveryLine,
+        `repair: ${repairAttempted ? "attempted (succeeded)" : "not needed"}`,
+        renderUsage(usage),
+        ...findings.length === 0 ? ["zero findings \u2014 an honest null, not a failure"] : []
+      ].join("\n");
+      return { analyzer: ANALYST_ID, kind: "findings", ok: true, output, findings };
+    }
+  };
+}
+
 // src/redact.ts
 import { DEFAULT_REDACTION_RULES, redactValue } from "@tangle-network/agent-eval/traces";
 var CODING_REDACTION_RULES = [
@@ -9788,10 +11178,10 @@ async function applyRedactor(spans, redactor) {
 }
 
 // src/file-export.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { mkdtemp as mkdtemp4, readFile as readFile9, writeFile as writeFile5 } from "fs/promises";
 import { tmpdir as tmpdir5 } from "os";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 import {
   firstNumberAttr,
   LLM_CACHED_TOKEN_ATTR_KEYS,
@@ -9826,7 +11216,7 @@ function stableJson(value) {
   });
 }
 function hashId(value, chars = 16) {
-  return createHash10("sha256").update(stableJson(value)).digest("hex").slice(0, chars);
+  return createHash11("sha256").update(stableJson(value)).digest("hex").slice(0, chars);
 }
 function isoTime2(value) {
   if (typeof value === "string") {
@@ -9987,12 +11377,12 @@ function policyEvidenceToSpans(records) {
       "traces.provenance.evidence_kind": record2.provenance.evidenceKind,
       "traces.provenance.otlp_path": record2.provenance.otlpPath,
       "traces.provenance.source_sha256": record2.provenance.sourceSha256,
-      [ATTR2.SUBJECT_KEY]: record2.repo.subjectKey,
-      [ATTR2.GIT_REPOSITORY]: record2.repo.repository,
-      [ATTR2.GIT_BRANCH_NAME]: record2.repo.branch,
-      [ATTR2.GIT_COMMIT]: record2.repo.commit,
-      [ATTR2.CWD]: record2.repo.cwd ?? record2.session.cwd,
-      [ATTR2.REPO_RESOLUTION_SOURCE]: record2.repo.resolutionSource
+      [ATTR.SUBJECT_KEY]: record2.repo.subjectKey,
+      [ATTR.GIT_REPOSITORY]: record2.repo.repository,
+      [ATTR.GIT_BRANCH_NAME]: record2.repo.branch,
+      [ATTR.GIT_COMMIT]: record2.repo.commit,
+      [ATTR.CWD]: record2.repo.cwd ?? record2.session.cwd,
+      [ATTR.REPO_RESOLUTION_SOURCE]: record2.repo.resolutionSource
     };
     return span({
       traceId,
@@ -10089,6 +11479,54 @@ function eventKind(row, type) {
   if (lowered.includes("llm") || lowered === "token") return { kind: "LLM" };
   return { kind: "CHAIN" };
 }
+function sandboxEventsEnvironment(context, rows) {
+  const ready = rows.find((row) => eventType(row) === "runtime.ready");
+  const readyData = ready && isObject5(ready.data) ? ready.data : void 0;
+  const pick = (keys) => findStringKey(context, keys, 2) ?? (readyData ? findStringKey(readyData, keys, 2) : void 0);
+  const image = pick(["image"]);
+  const imageDigest = pick(["imageDigest", "image_digest"]);
+  const sandboxId = pick(["sandboxId", "sandbox_id"]);
+  const cwd = pick(["cwd", "workspaceRoot", "workspace_root"]);
+  if (!image && !imageDigest && !sandboxId && !cwd) return null;
+  return {
+    ...image ? { image } : {},
+    ...imageDigest ? { imageDigest } : {},
+    ...sandboxId ? { sandboxId } : {},
+    cwd: cwd ?? null
+  };
+}
+function llmEventUsage(row) {
+  const num = (keys) => {
+    for (const key of keys) {
+      const direct = numberValue(row[key]);
+      if (direct !== void 0) return direct;
+      for (const nest of ["data", "usage", "tokenUsage"]) {
+        const container = row[nest];
+        if (!isObject5(container)) continue;
+        const value = numberValue(container[key]);
+        if (value !== void 0) return value;
+        for (const inner of ["usage", "tokenUsage"]) {
+          const deep = container[inner];
+          if (isObject5(deep)) {
+            const deepValue = numberValue(deep[key]);
+            if (deepValue !== void 0) return deepValue;
+          }
+        }
+      }
+    }
+    return void 0;
+  };
+  const model = findStringKey(row, ["model"], 3);
+  const inputTokens = num(["prompt_tokens", "input_tokens", "inputTokens"]);
+  const outputTokens = num(["completion_tokens", "output_tokens", "outputTokens"]);
+  const costUsd = num(["totalCostUsd", "total_cost_usd", "costUsd", "cost_usd"]);
+  return {
+    ...model ? { model } : {},
+    ...inputTokens !== void 0 ? { inputTokens } : {},
+    ...outputTokens !== void 0 ? { outputTokens } : {},
+    ...costUsd !== void 0 ? { costUsd } : {}
+  };
+}
 function sandboxEventsToSpans(rows, wrapper) {
   const context = wrapper ?? {};
   const sessionId = findStringKey(context, ["session_id", "sessionId"], 3) ?? findStringKey(rows, ["session_id", "sessionId"], 4);
@@ -10159,13 +11597,15 @@ function sandboxEventsToSpans(rows, wrapper) {
       tool: kind === "TOOL" ? tool ?? type : null,
       step: index,
       content: capText(stableJson(row)),
-      extra
+      extra,
+      ...kind === "LLM" ? llmEventUsage(row) : {}
     }));
   });
+  stampEnvironmentAttrs(spans, sandboxEventsEnvironment(context, rows) ?? void 0);
   if (!sessionId) return spans;
   return spans.map((item) => ({
     ...item,
-    attributes: { ...item.attributes, [ATTR2.SESSION_ID]: sessionId }
+    attributes: { ...item.attributes, [ATTR.SESSION_ID]: sessionId }
   }));
 }
 function statusCode2(value) {
@@ -10244,7 +11684,7 @@ function intelligenceSpansToSpans(rows) {
     };
     copyDefined(extra, {
       "traces.row.id": stringValue3(row.id),
-      [ATTR2.SESSION_ID]: sessionId,
+      [ATTR.SESSION_ID]: sessionId,
       "session.id": sessionId,
       "run.id": stringValue3(row.run_id),
       "thread.id": stringValue3(row.thread_id),
@@ -10387,7 +11827,7 @@ async function exportTraceEvidenceFile(inputPath, opts = {}) {
 }
 async function writeTraceEvidenceExportFile(inputPath, outPath, opts = {}) {
   const result = await exportTraceEvidenceFile(inputPath, opts);
-  const path = outPath ?? join23(await mkdtemp4(join23(tmpdir5(), "traces-export-")), "spans.openinference.jsonl");
+  const path = outPath ?? join24(await mkdtemp4(join24(tmpdir5(), "traces-export-")), "spans.openinference.jsonl");
   await writeFile5(path, serializeSpans(result.spans), "utf8");
   return { ...result, path };
 }
@@ -10395,7 +11835,7 @@ async function writeTraceEvidenceExportFile(inputPath, outPath, opts = {}) {
 // src/inspect.ts
 import { mkdtemp as mkdtemp5, readFile as readFile10, writeFile as writeFile6 } from "fs/promises";
 import { tmpdir as tmpdir6 } from "os";
-import { basename as basename13, join as join24 } from "path";
+import { basename as basename13, join as join25 } from "path";
 var severityRank = {
   high: 0,
   medium: 1,
@@ -10684,14 +12124,14 @@ async function readSessionIndexFile(path) {
   return parsed;
 }
 async function writeInspectionReportFile(report, outPath) {
-  const path = outPath ?? join24(await mkdtemp5(join24(tmpdir6(), "traces-inspect-")), "inspection-report.md");
+  const path = outPath ?? join25(await mkdtemp5(join25(tmpdir6(), "traces-inspect-")), "inspection-report.md");
   await writeFile6(path, renderInspectionReport(report), "utf8");
   return path;
 }
 
 // src/adoption.ts
 import { readFile as readFile11 } from "fs/promises";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 function toolName2(s) {
   const n = s.attributes["tool.name"];
   if (typeof n === "string") return n;
@@ -10811,7 +12251,7 @@ async function readLoopRuns(cwds, sessionIds) {
     seenCwds.add(cwd);
     const firstSourceByRun = /* @__PURE__ */ new Map();
     for (const artifactDir of [".agent", ".evolve"]) {
-      const path = join25(cwd, artifactDir, "skill-runs.jsonl");
+      const path = join26(cwd, artifactDir, "skill-runs.jsonl");
       let raw;
       try {
         raw = await readFile11(path, "utf8");
@@ -11619,6 +13059,47 @@ var SEVERITY_BADGE2 = {
   low: "\u{1F535} LOW",
   info: "\u2139\uFE0F  INFO"
 };
+function sessionReportSource(ref, spans, sessionIdOverride) {
+  const root = spans.find((item) => item.parent_span_id === null) ?? spans[0];
+  const prompt = spans.find(
+    (item) => item.name === "user.prompt" && item.attributes[ACTOR_ATTR] === "human"
+  ) ?? spans.find((item) => item.name === "user.prompt") ?? spans.find(
+    (item) => item.attributes["span.type"] === "interaction" && typeof item.attributes.content === "string"
+  );
+  const content = typeof prompt?.attributes.content === "string" ? prompt.attributes.content : "";
+  const firstLine = content.split(/\r?\n/, 1)[0].trim();
+  const subject = firstLine.length > 240 ? `${firstLine.slice(0, 240)}\u2026 [+${firstLine.length - 240} chars]` : firstLine;
+  const role = root?.attributes["traces.session.role"];
+  const parentSessionId = root?.attributes["traces.parent_session_id"];
+  const relationship = describeSessionRelationship(ref, spans);
+  const corruptionDigest2 = root?.attributes[ATTR.CORRUPTION_DIGEST];
+  const sessionId = [
+    sessionIdOverride,
+    root ? sessionIdFromAttributes(root.attributes) : void 0,
+    root?.trace_id,
+    ref.sessionId
+  ].find((value) => typeof value === "string" && value.length > 0);
+  return {
+    sessionId,
+    path: ref.path,
+    subject,
+    role: role === "operator" || role === "child" ? role : "unknown",
+    ...typeof parentSessionId === "string" ? { parentSessionId } : {},
+    childSessionIds: relationship.childSessionIds,
+    ...relationship.depth !== void 0 ? { depth: relationship.depth } : {},
+    ...relationship.agentNickname ? { agentNickname: relationship.agentNickname } : {},
+    ...relationship.agentRole ? { agentRole: relationship.agentRole } : {},
+    ...relationship.agentPath ? { agentPath: relationship.agentPath } : {},
+    ...relationship.taskScope ? { taskScope: relationship.taskScope } : {},
+    ...relationship.turnId ? { turnId: relationship.turnId } : {},
+    integrity: ref.integrity?.status ?? "complete",
+    ...ref.integrity ? {
+      corruptionCount: ref.integrity.corruptions.length,
+      ...typeof corruptionDigest2 === "string" ? { corruptionDigest: corruptionDigest2 } : {},
+      corruptions: ref.integrity.corruptions.slice(0, CORRUPTION_RECEIPT_DISPLAY_LIMIT)
+    } : {}
+  };
+}
 function deterministicSummaryText(summary) {
   const parts = [];
   if (summary.stuckLoops > 0) parts.push(`${summary.stuckLoops} stuck loop(s)`);
@@ -12223,7 +13704,7 @@ function renderAdoption(ar) {
 // src/improvement.ts
 import { access, mkdir as mkdir4, mkdtemp as mkdtemp6, writeFile as writeFile7 } from "fs/promises";
 import { tmpdir as tmpdir7 } from "os";
-import { dirname as dirname7, join as join26, resolve as resolve7 } from "path";
+import { dirname as dirname7, join as join27, resolve as resolve7 } from "path";
 import { pathToFileURL } from "url";
 import {
   AnalystRegistry,
@@ -12730,13 +14211,13 @@ async function runTraceStoreInvestigation(opts) {
   };
 }
 async function writeTraceImprovementArtifacts(result, outDir) {
-  const directory = outDir ? resolve7(outDir) : await mkdtemp6(join26(tmpdir7(), "traces-improvement-"));
+  const directory = outDir ? resolve7(outDir) : await mkdtemp6(join27(tmpdir7(), "traces-improvement-"));
   await mkdir4(directory, { recursive: true });
   const paths = {
     directory,
-    result: join26(directory, "result.json"),
-    evidence: join26(directory, "evidence.jsonl"),
-    report: join26(directory, "report.md"),
+    result: join27(directory, "result.json"),
+    evidence: join27(directory, "evidence.jsonl"),
+    report: join27(directory, "report.md"),
     traces: result.otlpPath
   };
   const { report, ...machineResult } = result;
@@ -12748,11 +14229,11 @@ async function writeTraceImprovementArtifacts(result, outDir) {
   return paths;
 }
 async function runTraceImprovement(opts) {
-  const directory = opts.outDir ? resolve7(opts.outDir) : await mkdtemp6(join26(tmpdir7(), "traces-improvement-"));
+  const directory = opts.outDir ? resolve7(opts.outDir) : await mkdtemp6(join27(tmpdir7(), "traces-improvement-"));
   await mkdir4(directory, { recursive: true });
   const investigation = await runTraceInvestigation({
     ...opts,
-    otlpOutPath: opts.otlpOutPath ?? join26(directory, "traces.otlp.jsonl")
+    otlpOutPath: opts.otlpOutPath ?? join27(directory, "traces.otlp.jsonl")
   });
   const result = {
     ...investigation,
@@ -12769,27 +14250,27 @@ async function saveReport(path, report) {
 }
 
 // src/live.ts
-import { createHash as createHash11 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 var VERIFY_RE = /\b(test|tests|vitest|jest|pytest|go test|cargo test|tsc|typecheck|lint|biome|eslint|build|check:invariants|preflight)\b/i;
 var CHANGE_RE = /\b(apply_patch|edit|write|create|delete|rename|replace|update|git apply|sed -i|perl -pi|tee\s|cat\s+>)/i;
 var CLAIM_DONE_RE = /\b(done|fixed|complete|completed|implemented|merged|verified|all green|tests pass|ready|works now)\b/i;
-var sleep = (ms2, signal) => new Promise((resolve8) => {
+var sleep = (ms2, signal) => new Promise((resolve10) => {
   if (signal?.aborted) {
-    resolve8();
+    resolve10();
     return;
   }
   const onAbort = () => {
     clearTimeout(t);
-    resolve8();
+    resolve10();
   };
   const t = setTimeout(() => {
     signal?.removeEventListener("abort", onAbort);
-    resolve8();
+    resolve10();
   }, ms2);
   signal?.addEventListener("abort", onAbort, { once: true });
 });
 function hash(parts) {
-  return createHash11("sha256").update(parts.join("\0")).digest("hex").slice(0, 16);
+  return createHash12("sha256").update(parts.join("\0")).digest("hex").slice(0, 16);
 }
 function asString(value) {
   if (typeof value === "string" && value.trim()) return value;
@@ -13195,7 +14676,7 @@ async function streamSessions(opts) {
 
 // src/supervisor-run-context.ts
 import { readFile as readFile12, stat as stat14 } from "fs/promises";
-import { basename as basename14, join as join27 } from "path";
+import { basename as basename14, join as join28 } from "path";
 import { materializeTreeView } from "@tangle-network/agent-runtime/kernel";
 import {
   NO_SOURCE_LIMITS
@@ -13356,10 +14837,10 @@ function parseInstant(v) {
   return Number.isFinite(t) ? t : null;
 }
 async function readFileRunContext(runDir, opts = {}) {
-  const journalText = await readMaybe(join27(runDir, SPAWN_JOURNAL_FILE));
+  const journalText = await readMaybe(join28(runDir, SPAWN_JOURNAL_FILE));
   const journal = readRunContextJournal(journalText);
-  const coordination = readCoordinationLog(await readMaybe(join27(runDir, COORDINATION_LOG_FILE)));
-  const result = await readMaybe(join27(runDir, RESULT_FILE));
+  const coordination = readCoordinationLog(await readMaybe(join28(runDir, COORDINATION_LOG_FILE)));
+  const result = await readMaybe(join28(runDir, RESULT_FILE));
   return {
     runRef: runDir,
     instanceId: opts.instanceId !== void 0 ? opts.instanceId : journal.root,
@@ -13382,7 +14863,7 @@ async function readFileRunContext(runDir, opts = {}) {
     harnessWorkerTokens: null,
     harnessMissingReason: "the file run context journals each child\u2019s own settled spend, so no external harness join is used",
     limits: sourceLimits(journal, coordination),
-    rootTranscriptRef: journal.present ? join27(runDir, SPAWN_JOURNAL_FILE) : null,
+    rootTranscriptRef: journal.present ? join28(runDir, SPAWN_JOURNAL_FILE) : null,
     traceCommand: `traces watch ${runDir}`
   };
 }
@@ -13390,7 +14871,7 @@ function fileRunContextSupervisorRunReader(runDir, opts = {}) {
   return { runRef: runDir, read: () => readFileRunContext(runDir, opts) };
 }
 async function isFileRunContextDir(runDir) {
-  return stat14(join27(runDir, SPAWN_JOURNAL_FILE)).then((s) => s.isFile()).catch(() => false);
+  return stat14(join28(runDir, SPAWN_JOURNAL_FILE)).then((s) => s.isFile()).catch(() => false);
 }
 function flattenJournal(journal) {
   return journal.events.map((event) => {
@@ -13536,9 +15017,9 @@ function mergeRolls(a, b) {
   };
 }
 async function readRunContextSnapshot(runDir) {
-  const journal = readRunContextJournal(await readMaybe(join27(runDir, SPAWN_JOURNAL_FILE)));
-  const coordination = readCoordinationLog(await readMaybe(join27(runDir, COORDINATION_LOG_FILE)));
-  const resultText = await readMaybe(join27(runDir, RESULT_FILE));
+  const journal = readRunContextJournal(await readMaybe(join28(runDir, SPAWN_JOURNAL_FILE)));
+  const coordination = readCoordinationLog(await readMaybe(join28(runDir, COORDINATION_LOG_FILE)));
+  const resultText = await readMaybe(join28(runDir, RESULT_FILE));
   const result = parseResult(resultText);
   const view = safeTreeView(journal.events);
   const nodes = view === null ? [] : orderNodes(view, journal);
@@ -13721,7 +15202,7 @@ function wrap(text2, indent) {
 
 // src/run-span-tree.ts
 import { readdir as readdir16 } from "fs/promises";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 import {
   firstNumberAttr as firstNumberAttr3,
   LLM_COST_ATTR_KEYS as LLM_COST_ATTR_KEYS2,
@@ -13994,7 +15475,7 @@ async function findSpanSourceFiles(dir) {
   const found = [];
   const entries = await readdir16(dir, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
-    const child = join28(dir, entry.name);
+    const child = join29(dir, entry.name);
     if (entry.isFile()) {
       if (SPAN_FILE_PATTERN.test(entry.name)) found.push(child);
       continue;
@@ -14002,7 +15483,7 @@ async function findSpanSourceFiles(dir) {
     if (!entry.isDirectory()) continue;
     const nested = await readdir16(child, { withFileTypes: true }).catch(() => []);
     for (const inner of nested) {
-      if (inner.isFile() && SPAN_FILE_PATTERN.test(inner.name)) found.push(join28(child, inner.name));
+      if (inner.isFile() && SPAN_FILE_PATTERN.test(inner.name)) found.push(join29(child, inner.name));
     }
   }
   return found.sort();
@@ -14010,7 +15491,7 @@ async function findSpanSourceFiles(dir) {
 
 // src/supervisor-run-watch.ts
 import { readdir as readdir17 } from "fs/promises";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 function budget(node) {
   const parts = [`${int(node.budget.maxIterations)}it`, `${int(node.budget.maxTokens)}tok`];
   if (node.budget.maxUsd !== void 0) parts.push(`$${node.budget.maxUsd.toFixed(2)}`);
@@ -14154,7 +15635,7 @@ async function resolveRunContextDir(dir) {
   const candidates = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const child = join29(dir, entry.name);
+    const child = join30(dir, entry.name);
     if (await isFileRunContextDir(child)) candidates.push(child);
   }
   if (candidates.length === 1) return candidates[0];
@@ -14259,13 +15740,13 @@ function aborted(signal) {
   return signal !== void 0 && signal.aborted;
 }
 function sleep2(msDelay, signal) {
-  return new Promise((resolve8) => {
-    const timer = setTimeout(resolve8, msDelay);
+  return new Promise((resolve10) => {
+    const timer = setTimeout(resolve10, msDelay);
     signal?.addEventListener(
       "abort",
       () => {
         clearTimeout(timer);
-        resolve8();
+        resolve10();
       },
       { once: true }
     );
@@ -14605,11 +16086,11 @@ async function collectSessionWorkflow(adapter, seeds, options = {}) {
 }
 
 // src/session-selection.ts
-import { createHash as createHash12 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { createReadStream as createReadStream2 } from "fs";
 async function fileSha256(path, signal) {
   signal?.throwIfAborted();
-  const hash2 = createHash12("sha256");
+  const hash2 = createHash13("sha256");
   try {
     for await (const chunk of createReadStream2(path, { signal })) {
       signal?.throwIfAborted();
@@ -14637,7 +16118,7 @@ async function sourceSnapshot(adapter, ref, signal) {
     signal?.throwIfAborted();
     files.push({ path, sha256: await fileSha256(path, signal) });
   }
-  const sha2562 = files.length === 1 ? files[0].sha256 : createHash12("sha256").update(JSON.stringify(files)).digest("hex");
+  const sha2562 = files.length === 1 ? files[0].sha256 : createHash13("sha256").update(JSON.stringify(files)).digest("hex");
   return { sha256: sha2562, files };
 }
 function summarizeWorkflows(workflows) {
@@ -14734,7 +16215,7 @@ async function collectSessionSelection(groups, options = {}) {
 // src/session-index.ts
 import { mkdtemp as mkdtemp7, readdir as readdir18, readFile as readFile13, stat as stat16, writeFile as writeFile8 } from "fs/promises";
 import { tmpdir as tmpdir8 } from "os";
-import { dirname as dirname8, join as join30 } from "path";
+import { dirname as dirname8, join as join31 } from "path";
 function indexRow(record2) {
   return {
     session: record2.session,
@@ -14807,7 +16288,7 @@ async function findContextRoot(cwd) {
   if (!s) return null;
   if (!s.isDirectory()) current = dirname8(current);
   for (; ; ) {
-    if (await pathStat2(join30(current, ".git")) || await dirExists(join30(current, ".evolve")) || await fileExists(join30(current, "AGENTS.md")) || await fileExists(join30(current, "CLAUDE.md"))) {
+    if (await pathStat2(join31(current, ".git")) || await dirExists(join31(current, ".evolve")) || await fileExists(join31(current, "AGENTS.md")) || await fileExists(join31(current, "CLAUDE.md"))) {
       return current;
     }
     const parent = dirname8(current);
@@ -14875,7 +16356,7 @@ async function walkMarkdown(root, kind, maxFiles = 100) {
     }
     for (const entry of entries) {
       if (out.length >= maxFiles) return;
-      const path = join30(dir, entry.name);
+      const path = join31(dir, entry.name);
       if (entry.isDirectory()) {
         await walk(path);
       } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -14890,22 +16371,38 @@ async function walkMarkdown(root, kind, maxFiles = 100) {
 async function collectContextRoot(root) {
   const files = [];
   for (const name of ["AGENTS.md", "CLAUDE.md", "GEMINI.md"]) {
-    const summary = await summarizeFile(join30(root, name), "instruction-doc");
+    const summary = await summarizeFile(join31(root, name), "instruction-doc");
     if (summary) files.push(summary);
   }
-  const evolve = join30(root, ".evolve");
+  const evolve = join31(root, ".evolve");
   for (const name of ["skill-runs.jsonl", "governor.jsonl", "experiments.jsonl"]) {
-    const summary = await summarizeFile(join30(evolve, name), "evolve-jsonl");
+    const summary = await summarizeFile(join31(evolve, name), "evolve-jsonl");
     if (summary) files.push(summary);
   }
-  for (const name of ["scorecard.json"]) {
-    const summary = await summarizeFile(join30(evolve, name), "evolve-json");
+  for (const name of ["scorecard.json", "current.json"]) {
+    const summary = await summarizeFile(join31(evolve, name), "evolve-json");
     if (summary) files.push(summary);
   }
-  files.push(...await walkMarkdown(join30(evolve, "reflections"), "reflection"));
-  files.push(...await walkMarkdown(join30(evolve, "handoffs"), "handoff"));
+  files.push(...await walkMarkdown(join31(evolve, "reflections"), "reflection"));
+  files.push(...await walkMarkdown(join31(evolve, "handoffs"), "handoff"));
+  for (const name of await listEvolveRootFiles(evolve)) {
+    if (/^handoff-.*\.md$/.test(name)) {
+      const summary = await summarizeFile(join31(evolve, name), "handoff");
+      if (summary) files.push(summary);
+    }
+  }
+  const progress = await summarizeFile(join31(evolve, "progress.md"), "other");
+  if (progress) files.push(progress);
   return { root, files: files.sort((a, b) => a.path.localeCompare(b.path)) };
 }
+async function listEvolveRootFiles(evolve) {
+  try {
+    const entries = await readdir18(evolve, { withFileTypes: true });
+    return entries.filter((entry) => entry.isFile()).map((entry) => entry.name).sort();
+  } catch {
+    return [];
+  }
+}
 async function collectContextIndex(records) {
   const rootSet = /* @__PURE__ */ new Set();
   for (const record2 of records) {
@@ -14949,19 +16446,646 @@ function serializeSessionIndex(index) {
 `;
 }
 async function writeSessionIndexFile(index, outPath) {
-  const path = outPath ?? join30(await mkdtemp7(join30(tmpdir8(), "traces-index-")), "session-index.json");
+  const path = outPath ?? join31(await mkdtemp7(join31(tmpdir8(), "traces-index-")), "session-index.json");
   await writeFile8(path, serializeSessionIndex(index), "utf8");
   return path;
 }
 
+// src/bundle.ts
+import { createHash as createHash14 } from "crypto";
+import { readFileSync as readFileSync5 } from "fs";
+import { cp, mkdir as mkdir5, readdir as readdir19, readFile as readFile14, stat as stat17, writeFile as writeFile9 } from "fs/promises";
+import { join as join32, relative as relative5, resolve as resolve8, sep as sep2 } from "path";
+var SESSION_WINDOW_PAD_MS = 15 * 60 * 1e3;
+var KNOWN_LIMITS = [
+  "'what was decided' is prose-only: handoff, progress, and reflection files are copied as markdown with no structured decision extraction",
+  "'what was measured' is split between experiments.jsonl free-text fields and progress/handoff markdown tables",
+  "session-to-ledger join is by timestamp/cwd inference: ledger rows are window-sliced, not linked by transcript path",
+  "progress.md is copied whole; no session-dated section extraction is performed",
+  "open pull-request state is not captured: the bundler makes no network calls"
+];
+function sha256Hex(bytes) {
+  return createHash14("sha256").update(bytes).digest("hex");
+}
+function bundlePath(...parts) {
+  return parts.join("/");
+}
+async function statOrNull(path) {
+  try {
+    return await stat17(path);
+  } catch (error) {
+    if (isMissingPathError(error)) return null;
+    if (error.code === "ENOTDIR") return null;
+    throw error;
+  }
+}
+function sliceJsonlByWindow(text2, windowStartMs, windowEndMs) {
+  const kept = [];
+  let totalRows = 0;
+  let unparseableTsRows = 0;
+  for (const line of text2.split("\n")) {
+    if (!line.trim()) continue;
+    totalRows += 1;
+    let tsMs = Number.NaN;
+    try {
+      const row = JSON.parse(line);
+      const ts = row !== null && typeof row === "object" && !Array.isArray(row) ? row.ts : void 0;
+      if (typeof ts === "string") tsMs = Date.parse(ts);
+    } catch {
+    }
+    if (Number.isNaN(tsMs)) {
+      unparseableTsRows += 1;
+      continue;
+    }
+    if (tsMs >= windowStartMs && tsMs <= windowEndMs) kept.push(line);
+  }
+  return { kept, totalRows, unparseableTsRows };
+}
+async function runGitLog(cwd, sinceIso, untilIso) {
+  const { execFile: execFile2 } = await import("child_process");
+  const { promisify: promisify2 } = await import("util");
+  const run = promisify2(execFile2);
+  try {
+    const { stdout } = await run(
+      "git",
+      ["-C", cwd, "log", `--since=${sinceIso}`, `--until=${untilIso}`, "--date=iso-strict", "--pretty=format:%H %ad %an %s"],
+      { timeout: 5e3 }
+    );
+    return { succeeded: true, stdout };
+  } catch (error) {
+    return { succeeded: false, error: error instanceof Error ? error.message.split("\n", 1)[0] : String(error) };
+  }
+}
+async function listSessionBundleFiles(root) {
+  const out = [];
+  const pending = [resolve8(root)];
+  while (pending.length > 0) {
+    const dir = pending.pop();
+    for (const entry of await readdir19(dir, { withFileTypes: true })) {
+      const path = join32(dir, entry.name);
+      if (entry.isDirectory()) pending.push(path);
+      else if (entry.isFile()) out.push(relative5(resolve8(root), path).split(sep2).join("/"));
+    }
+  }
+  return out.sort();
+}
+async function sliceLedgerJsonl(ctx, name) {
+  const source = join32(ctx.evolveDir, name);
+  const s = await statOrNull(source);
+  if (!s?.isFile()) {
+    ctx.absent.push({ path: bundlePath("ledger", name), reason: `no ${name} at ${source}` });
+    return;
+  }
+  const text2 = await readFile14(source, "utf8");
+  const target = join32(ctx.ledgerDir, name);
+  if (ctx.windowStartMs === null || ctx.windowEndMs === null) {
+    await writeFile9(target, text2, "utf8");
+    ctx.slices.push({ path: bundlePath("ledger", name), source, rule: "copied-whole" });
+    return;
+  }
+  const slice = sliceJsonlByWindow(text2, ctx.windowStartMs, ctx.windowEndMs);
+  await writeFile9(target, slice.kept.length > 0 ? `${slice.kept.join("\n")}
+` : "", "utf8");
+  ctx.slices.push({
+    path: bundlePath("ledger", name),
+    source,
+    rule: "session-window-rows",
+    totalRows: slice.totalRows,
+    keptRows: slice.kept.length,
+    unparseableTsRows: slice.unparseableTsRows
+  });
+}
+async function copyLedgerWhole(ctx, name) {
+  const source = join32(ctx.evolveDir, name);
+  const s = await statOrNull(source);
+  if (!s?.isFile()) {
+    ctx.absent.push({ path: bundlePath("ledger", name), reason: `no ${name} at ${source}` });
+    return;
+  }
+  await cp(source, join32(ctx.ledgerDir, name));
+  ctx.slices.push({ path: bundlePath("ledger", name), source, rule: "copied-whole" });
+}
+async function copyLatestHandoff(ctx) {
+  let names;
+  try {
+    names = (await readdir19(ctx.evolveDir, { withFileTypes: true })).filter((entry) => entry.isFile() && /^handoff-.*\.md$/.test(entry.name)).map((entry) => entry.name).sort();
+  } catch {
+    names = [];
+  }
+  const latest = names[names.length - 1];
+  if (!latest) {
+    ctx.absent.push({
+      path: bundlePath("ledger", "handoff-*.md"),
+      reason: `no flat handoff-*.md files in ${ctx.evolveDir}`
+    });
+    return;
+  }
+  const source = join32(ctx.evolveDir, latest);
+  await cp(source, join32(ctx.ledgerDir, latest));
+  ctx.slices.push({ path: bundlePath("ledger", latest), source, rule: "latest-by-name" });
+}
+async function copyWindowReflections(ctx) {
+  const reflectionsDir = join32(ctx.evolveDir, "reflections");
+  const s = await statOrNull(reflectionsDir);
+  if (!s?.isDirectory()) {
+    ctx.absent.push({
+      path: bundlePath("ledger", "reflections"),
+      reason: `no reflections directory at ${reflectionsDir}`
+    });
+    return;
+  }
+  const names = (await readdir19(reflectionsDir, { withFileTypes: true })).filter((entry) => entry.isFile() && entry.name.endsWith(".md")).map((entry) => entry.name).sort();
+  const windowed = ctx.windowStartMs === null || ctx.windowEndMs === null ? names : names.filter((name) => {
+    const date = name.match(/(\d{4}-\d{2}-\d{2})/)?.[1];
+    if (!date) return false;
+    const startDate = new Date(ctx.windowStartMs).toISOString().slice(0, 10);
+    const endDate = new Date(ctx.windowEndMs).toISOString().slice(0, 10);
+    return date >= startDate && date <= endDate;
+  });
+  if (windowed.length === 0) {
+    ctx.absent.push({
+      path: bundlePath("ledger", "reflections"),
+      reason: `no reflections dated inside the session window in ${reflectionsDir}`
+    });
+    return;
+  }
+  await mkdir5(join32(ctx.ledgerDir, "reflections"), { recursive: true });
+  const rule = ctx.windowStartMs === null ? "copied-whole" : "session-window-dated-files";
+  for (const name of windowed) {
+    const source = join32(reflectionsDir, name);
+    await cp(source, join32(ctx.ledgerDir, "reflections", name));
+    ctx.slices.push({ path: bundlePath("ledger", "reflections", name), source, rule });
+  }
+}
+async function assembleSessionBundle(opts) {
+  const { adapter, ref } = opts;
+  const generatedAt = opts.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  let transcriptBytes;
+  try {
+    transcriptBytes = await readFile14(ref.path);
+  } catch (error) {
+    if (isMissingPathError(error)) {
+      throw new Error(
+        `session transcript not found at ${ref.path} \u2014 a bundle cannot be assembled without its transcript`
+      );
+    }
+    throw error;
+  }
+  const transcriptSha256 = sha256Hex(transcriptBytes);
+  const spans = await parseSession(adapter, ref, { signal: opts.signal });
+  const outDir = resolve8(opts.outDir);
+  await mkdir5(outDir, { recursive: true });
+  if ((await readdir19(outDir)).length > 0) {
+    throw new Error(
+      `bundle output directory ${outDir} is not empty \u2014 pass a new directory so one bundle holds exactly one session`
+    );
+  }
+  const absent = [];
+  const slices = [];
+  await mkdir5(join32(outDir, "session"), { recursive: true });
+  await writeFile9(join32(outDir, "session", "transcript.jsonl"), transcriptBytes);
+  const subagentsSource = join32(ref.path.replace(/\.jsonl$/, ""), "subagents");
+  if ((await statOrNull(subagentsSource))?.isDirectory()) {
+    await cp(subagentsSource, join32(outDir, "session", "subagents"), { recursive: true });
+  } else {
+    absent.push({ path: bundlePath("session", "subagents"), reason: `no subagents directory at ${subagentsSource}` });
+  }
+  await mkdir5(join32(outDir, "derived"), { recursive: true });
+  const otlpPath = join32(outDir, "derived", "trace.otlp.jsonl");
+  const investigation = await runTraceInvestigation({
+    spans,
+    harness: ref.harness,
+    sources: [sessionReportSource(ref, spans)],
+    cwds: ref.cwd ? [ref.cwd] : [],
+    minLoopOccurrences: opts.minLoopOccurrences,
+    otlpOutPath: otlpPath,
+    generatedAt,
+    signal: opts.signal,
+    log: opts.log
+  });
+  await writeFile9(join32(outDir, "derived", "report.md"), investigation.report, "utf8");
+  const evidence3 = await buildPolicyEvidenceRecord(ref, spans, {
+    generatedAt,
+    minLoopOccurrences: opts.minLoopOccurrences,
+    // Bundle-relative pointer: the bundle must stay internally valid when moved.
+    otlpPath: bundlePath("derived", "trace.otlp.jsonl"),
+    sourceSha256: transcriptSha256
+  });
+  await writeFile9(join32(outDir, "derived", "evidence.jsonl"), serializePolicyEvidence([evidence3]), "utf8");
+  const index = await buildSessionIndexFromRows([{ ref, spans }], {
+    generatedAt,
+    minLoopOccurrences: opts.minLoopOccurrences,
+    selection: { command: "bundle", harness: ref.harness, session: ref.sessionId }
+  });
+  await writeFile9(join32(outDir, "derived", "session-index.json"), serializeSessionIndex(index), "utf8");
+  const { firstSpanAt, lastSpanAt } = evidence3.metrics;
+  const windowStartMs = firstSpanAt !== null ? Date.parse(firstSpanAt) - SESSION_WINDOW_PAD_MS : null;
+  const windowEndMs = lastSpanAt !== null ? Date.parse(lastSpanAt) + SESSION_WINDOW_PAD_MS : null;
+  const contextRoot = await findContextRoot(ref.cwd);
+  if (!contextRoot) {
+    absent.push({ path: "ledger", reason: `no context root found from session cwd ${ref.cwd ?? "(unknown)"}` });
+  } else {
+    const evolveDir = join32(contextRoot, ".evolve");
+    if (!(await statOrNull(evolveDir))?.isDirectory()) {
+      absent.push({ path: "ledger", reason: `no .evolve ledger at ${evolveDir}` });
+    } else {
+      const ledgerDir = join32(outDir, "ledger");
+      await mkdir5(ledgerDir, { recursive: true });
+      const ctx = { evolveDir, ledgerDir, windowStartMs, windowEndMs, slices, absent };
+      await sliceLedgerJsonl(ctx, "experiments.jsonl");
+      await sliceLedgerJsonl(ctx, "skill-runs.jsonl");
+      await copyLedgerWhole(ctx, "current.json");
+      await copyLedgerWhole(ctx, "scorecard.json");
+      await copyLedgerWhole(ctx, "progress.md");
+      await copyLatestHandoff(ctx);
+      await copyWindowReflections(ctx);
+    }
+  }
+  const gitLogPath = bundlePath("repo", "git-log.txt");
+  if (!ref.cwd) {
+    absent.push({ path: gitLogPath, reason: "session has no recorded cwd to read git history from" });
+  } else if (windowStartMs === null || windowEndMs === null) {
+    absent.push({ path: gitLogPath, reason: "session window unavailable (spans carry no timestamps)" });
+  } else {
+    const log = await runGitLog(ref.cwd, new Date(windowStartMs).toISOString(), new Date(windowEndMs).toISOString());
+    if (log.succeeded) {
+      await mkdir5(join32(outDir, "repo"), { recursive: true });
+      await writeFile9(join32(outDir, "repo", "git-log.txt"), log.stdout ? `${log.stdout}
+` : "", "utf8");
+    } else {
+      absent.push({ path: gitLogPath, reason: `git log failed in ${ref.cwd}: ${log.error}` });
+    }
+  }
+  const files = await hashSessionBundleFiles(outDir);
+  const manifest = {
+    schemaVersion: 2,
+    kind: "traces.session_bundle",
+    view: "full",
+    createdAt: generatedAt,
+    provenance: {
+      sessionId: ref.sessionId,
+      harness: ref.harness,
+      cwd: ref.cwd,
+      transcriptPath: resolve8(ref.path),
+      transcriptSha256,
+      contextRoot,
+      tracesVersion: tracesPackageVersion(),
+      sessionWindow: { firstSpanAt, lastSpanAt, padMs: SESSION_WINDOW_PAD_MS }
+    },
+    files,
+    absent,
+    // The full view is the whole record: it drops nothing, and says so rather
+    // than leaving a reader to infer completeness from a missing field.
+    excluded: [],
+    ledgerSlices: slices,
+    knownLimits: KNOWN_LIMITS
+  };
+  const manifestPath = await writeSessionBundleManifest(outDir, manifest);
+  return { directory: outDir, manifestPath, manifest };
+}
+async function hashSessionBundleFiles(root) {
+  const files = [];
+  for (const path of await listSessionBundleFiles(root)) {
+    const bytes = await readFile14(join32(root, path));
+    files.push({ path, bytes: bytes.length, sha256: sha256Hex(bytes) });
+  }
+  return files;
+}
+async function writeSessionBundleManifest(outDir, manifest) {
+  const manifestPath = join32(outDir, "manifest.json");
+  await writeFile9(manifestPath, `${JSON.stringify(manifest, null, 2)}
+`, "utf8");
+  return manifestPath;
+}
+async function readSessionBundleManifest(bundleDir) {
+  const path = join32(resolve8(bundleDir), "manifest.json");
+  let text2;
+  try {
+    text2 = await readFile14(path, "utf8");
+  } catch (error) {
+    if (isMissingPathError(error)) {
+      throw new Error(`no manifest.json at ${path} \u2014 ${bundleDir} is not a traces session bundle`);
+    }
+    throw error;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text2);
+  } catch (error) {
+    throw new Error(`${path} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`);
+  }
+  const manifest = parsed;
+  if (manifest?.kind !== "traces.session_bundle") {
+    throw new Error(`${path} has kind ${JSON.stringify(manifest?.kind)}, expected "traces.session_bundle"`);
+  }
+  if (manifest.schemaVersion !== 2) {
+    throw new Error(
+      `${path} is bundle schemaVersion ${JSON.stringify(manifest.schemaVersion)}; this traces reads 2. Re-run \`traces bundle\` to assemble it with the view-aware manifest.`
+    );
+  }
+  if (manifest.view !== "full" && manifest.view !== "evidence-only") {
+    throw new Error(`${path} has view ${JSON.stringify(manifest.view)}, expected "full" or "evidence-only"`);
+  }
+  return manifest;
+}
+var cachedVersion;
+function tracesPackageVersion() {
+  if (cachedVersion) return cachedVersion;
+  const pkg = JSON.parse(
+    readFileSync5(new URL("../package.json", import.meta.url), "utf8")
+  );
+  if (typeof pkg.version !== "string" || !pkg.version) throw new Error("package.json is missing version");
+  cachedVersion = pkg.version;
+  return cachedVersion;
+}
+
+// src/bundle-view.ts
+import { createHash as createHash15 } from "crypto";
+import { mkdir as mkdir6, readdir as readdir20, readFile as readFile15, writeFile as writeFile10 } from "fs/promises";
+import { dirname as dirname9, join as join33, resolve as resolve9 } from "path";
+var EVIDENCE_ONLY_ALLOW_LIST = [
+  {
+    path: "derived/session-index.json",
+    owned: true,
+    carries: "per-session counts, tool names, models, and nearby-context file metadata"
+  },
+  {
+    path: "derived/evidence.jsonl",
+    owned: true,
+    carries: "execution statistics, token and tool totals, loop and error counts"
+  },
+  {
+    path: "ledger/current.json",
+    owned: false,
+    carries: "the repo ledger current-state record"
+  },
+  {
+    path: "ledger/scorecard.json",
+    owned: false,
+    carries: "the repo ledger scorecard rows"
+  },
+  {
+    path: "ledger/skill-runs.jsonl",
+    owned: false,
+    carries: "skill-run rows: skill name, timestamp, and outcome fields"
+  }
+];
+var EXCLUSION_RULES = [
+  {
+    matches: (path) => path === "session/transcript.jsonl" || path.startsWith("session/"),
+    rule: "session-source",
+    reason: "raw session text: the transcript and any subagent transcript hold every word the session wrote, including the shell call that authored an earlier report"
+  },
+  {
+    matches: (path) => path === "derived/report.md",
+    rule: "session-text-derived",
+    reason: "the deterministic report quotes the session verbatim: the first prompt line and evidence excerpts per finding"
+  },
+  {
+    matches: (path) => path === "derived/trace.otlp.jsonl",
+    rule: "session-text-derived",
+    reason: "spans carry input.value, output.value and content: the full prompt and response text of every turn"
+  },
+  {
+    matches: (path) => path === "ledger/progress.md",
+    rule: "authored-prose",
+    reason: "progress notes are written at session close and restate what the session concluded"
+  },
+  {
+    matches: (path) => /^ledger\/handoff-.*\.md$/.test(path),
+    rule: "authored-prose",
+    reason: "a handoff is the session conclusion in prose"
+  },
+  {
+    matches: (path) => path.startsWith("ledger/reflections/"),
+    rule: "authored-prose",
+    reason: "a reflection is the session conclusion in prose"
+  },
+  {
+    matches: (path) => path === "ledger/experiments.jsonl",
+    rule: "authored-prose",
+    reason: "experiment rows carry free-text verdict and note fields that restate what the session concluded"
+  },
+  {
+    matches: (path) => path === "repo/git-log.txt",
+    rule: "authored-prose",
+    reason: "commit subjects are prose the session authored"
+  },
+  {
+    matches: () => true,
+    rule: "not-allow-listed",
+    reason: "the evidence-only view carries an explicit allow-list of counted artifacts, and this path is not on it"
+  }
+];
+var SIGNATURE_WORDS = 8;
+var MIN_WORD_TOKENS = 7;
+function scrubIdentifiers(line) {
+  return line.replace(/[a-z][a-z0-9+.-]*:\/\/\S*/gi, " ").replace(/\/?(?:[\w.@+~-]+\/)+[\w.@+~-]*/g, " ").replace(/\b[0-9a-f-]{8,}\b/gi, " ");
+}
+var PACKAGE_CONSTANT_PROSE = [POLICY_EVIDENCE_NOTE];
+function stripPackageConstants(text2) {
+  let out = text2;
+  for (const constant of PACKAGE_CONSTANT_PROSE) out = out.split(constant).join(" ");
+  return out;
+}
+function collectJsonStrings(value, into) {
+  if (typeof value === "string") into.push(value);
+  else if (Array.isArray(value)) for (const item of value) collectJsonStrings(item, into);
+  else if (value !== null && typeof value === "object") {
+    for (const item of Object.values(value)) collectJsonStrings(item, into);
+  }
+}
+function proseFragments(line) {
+  const trimmed = line.trim();
+  if (trimmed.startsWith("{") || trimmed.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(trimmed);
+      const strings = [];
+      collectJsonStrings(parsed, strings);
+      return strings;
+    } catch {
+    }
+  }
+  return [line];
+}
+function sessionTextSignatures(text2) {
+  const out = /* @__PURE__ */ new Set();
+  for (const line of stripPackageConstants(text2).split("\n")) {
+    for (const fragment of proseFragments(line)) {
+      const words = scrubIdentifiers(fragment).toLowerCase().replace(/[^a-z0-9]+/g, " ").trim().split(" ").filter(Boolean);
+      for (let i = 0; i + SIGNATURE_WORDS <= words.length; i++) {
+        const window = words.slice(i, i + SIGNATURE_WORDS);
+        if (window.filter((word) => /^[a-z]+$/.test(word)).length < MIN_WORD_TOKENS) continue;
+        out.add(window.join(" "));
+      }
+    }
+  }
+  return out;
+}
+async function findSessionTextLeaks(opts) {
+  const index = /* @__PURE__ */ new Map();
+  const carried = [];
+  for (const path of opts.carriedPaths) {
+    const signatures = sessionTextSignatures(await readFile15(join33(opts.viewDir, path), "utf8"));
+    carried.push({ path, signatures: signatures.size });
+    for (const signature of signatures) if (!index.has(signature)) index.set(signature, path);
+  }
+  const hits = /* @__PURE__ */ new Map();
+  const comparedSources = [];
+  let sourceSignatures = 0;
+  for (const sourcePath of opts.excludedPaths) {
+    const signatures = sessionTextSignatures(await readFile15(join33(opts.sourceDir, sourcePath), "utf8"));
+    comparedSources.push(sourcePath);
+    sourceSignatures += signatures.size;
+    for (const signature of signatures) {
+      const viewPath = index.get(signature);
+      if (viewPath === void 0) continue;
+      const hit = hits.get(viewPath) ?? { matched: /* @__PURE__ */ new Set(), sources: /* @__PURE__ */ new Set(), example: signature };
+      hit.matched.add(signature);
+      hit.sources.add(sourcePath);
+      hits.set(viewPath, hit);
+    }
+  }
+  const leaks = [...hits].map(([viewPath, hit]) => ({
+    viewPath,
+    sources: [...hit.sources].sort(),
+    signatures: hit.matched.size,
+    example: hit.example
+  }));
+  return { leaks, carried, comparedSources, sourceSignatures };
+}
+function classifyEvidenceOnlyPath(path) {
+  const allowed = EVIDENCE_ONLY_ALLOW_LIST.find((entry) => entry.path === path);
+  if (allowed) return { carried: true, owned: allowed.owned, carries: allowed.carries };
+  const rule = EXCLUSION_RULES.find((entry) => entry.matches(path));
+  return { carried: false, rule: rule.rule, reason: rule.reason };
+}
+var EVIDENCE_ONLY_LIMITS = [
+  "the exclusion is verbatim-tight, not paraphrase-tight: a conclusion restated in different words inside a carried artifact is not detectable by content signatures",
+  "ledger prose (progress, handoffs, reflections) and experiment free-text fields are excluded whole; a measured experiment result is readable only from the full bundle, under audit rules",
+  "the view carries counts, names, identifiers, timestamps and hashes; a question that needs the words of a turn cannot be answered from it"
+];
+async function projectSessionBundle(opts) {
+  if (opts.view !== "evidence-only") {
+    throw new Error(
+      `unsupported bundle view ${JSON.stringify(opts.view)}. The full view IS the bundle \`traces bundle\` assembles, so there is nothing to project into it; the projectable view is "evidence-only".`
+    );
+  }
+  const generatedAt = opts.generatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const sourceDir = resolve9(opts.bundleDir);
+  const source = await readSessionBundleManifest(sourceDir);
+  if (source.view !== "full") {
+    throw new Error(
+      `${sourceDir} is already the ${source.view} view \u2014 project from the full bundle, not from a view of it`
+    );
+  }
+  const outDir = resolve9(opts.outDir);
+  await mkdir6(outDir, { recursive: true });
+  if ((await readdir20(outDir)).length > 0) {
+    throw new Error(
+      `view output directory ${outDir} is not empty \u2014 pass a new directory so one directory holds exactly one view`
+    );
+  }
+  const sourceHashes = new Map(source.files.map((file) => [file.path, file]));
+  const carriedPaths = [];
+  const carries = /* @__PURE__ */ new Map();
+  const excluded = [];
+  const candidates = [];
+  for (const path of await listSessionBundleFiles(sourceDir)) {
+    if (path === "manifest.json") continue;
+    const bytes = await readFile15(join33(sourceDir, path));
+    const sha2562 = createHash15("sha256").update(bytes).digest("hex");
+    const recorded = sourceHashes.get(path);
+    if (!recorded) {
+      throw new Error(
+        `${join33(sourceDir, path)} is not listed in the bundle manifest \u2014 the bundle changed after assembly and cannot be projected; re-run \`traces bundle\``
+      );
+    }
+    if (recorded.sha256 !== sha2562) {
+      throw new Error(
+        `${join33(sourceDir, path)} does not match its manifest hash (${recorded.sha256} recorded, ${sha2562} on disk) \u2014 the bundle changed after assembly and cannot be projected; re-run \`traces bundle\``
+      );
+    }
+    const verdict = classifyEvidenceOnlyPath(path);
+    if (!verdict.carried) {
+      excluded.push({ path, bytes: bytes.length, sha256: sha2562, rule: verdict.rule, reason: verdict.reason });
+      continue;
+    }
+    candidates.push({ path, bytes, sha256: sha2562, carries: verdict.carries, owned: verdict.owned });
+  }
+  const report = await findSessionTextLeaks({
+    viewDir: sourceDir,
+    sourceDir,
+    carriedPaths: candidates.map((candidate) => candidate.path),
+    excludedPaths: excluded.map((entry) => entry.path)
+  });
+  const leakByPath = new Map(report.leaks.map((leak) => [leak.viewPath, leak]));
+  const ownedLeak = report.leaks.find((leak) => candidates.some((c) => c.path === leak.viewPath && c.owned));
+  if (ownedLeak) {
+    throw new Error(
+      `${ownedLeak.viewPath} repeats ${ownedLeak.signatures} ${SIGNATURE_WORDS}-word run(s) found in ${ownedLeak.sources.join(", ")}, for example "${ownedLeak.example}". That artifact is derived by traces and must carry counts only, so this is a defect in the derivation, not a property of the session. No view was written.`
+    );
+  }
+  for (const candidate of candidates) {
+    const leak = leakByPath.get(candidate.path);
+    if (leak) {
+      excluded.push({
+        path: candidate.path,
+        bytes: candidate.bytes.length,
+        sha256: candidate.sha256,
+        rule: "content-signature",
+        reason: `the content check found ${leak.signatures} ${SIGNATURE_WORDS}-word run(s) this file shares with ${leak.sources.join(", ")}; carrying it would put back text the view removes`,
+        contentMatch: { signatures: leak.signatures, sources: leak.sources }
+      });
+      continue;
+    }
+    const target = join33(outDir, candidate.path);
+    await mkdir6(dirname9(target), { recursive: true });
+    await writeFile10(target, candidate.bytes);
+    carriedPaths.push(candidate.path);
+    carries.set(candidate.path, candidate.carries);
+  }
+  const leakCheck = {
+    signatureWords: SIGNATURE_WORDS,
+    comparedSources: report.comparedSources,
+    sourceSignatures: report.sourceSignatures,
+    carried: report.carried.filter((entry) => carries.has(entry.path)).map((entry) => ({
+      path: entry.path,
+      carries: carries.get(entry.path),
+      signatures: entry.signatures
+    })),
+    matches: 0
+  };
+  const sourceManifestBytes = await readFile15(join33(sourceDir, "manifest.json"));
+  const manifest = {
+    schemaVersion: 2,
+    kind: "traces.session_bundle",
+    view: "evidence-only",
+    createdAt: generatedAt,
+    provenance: source.provenance,
+    files: await hashSessionBundleFiles(outDir),
+    absent: source.absent,
+    excluded,
+    ledgerSlices: source.ledgerSlices.filter((slice) => carriedPaths.includes(slice.path)),
+    knownLimits: [...source.knownLimits, ...EVIDENCE_ONLY_LIMITS],
+    projection: {
+      sourceDirectory: sourceDir,
+      sourceManifestSha256: createHash15("sha256").update(sourceManifestBytes).digest("hex"),
+      leakCheck
+    }
+  };
+  const manifestPath = await writeSessionBundleManifest(outDir, manifest);
+  return { directory: outDir, manifestPath, manifest, leakCheck };
+}
+
 // src/upload-state.ts
-import { mkdir as mkdir5, readFile as readFile14, writeFile as writeFile9 } from "fs/promises";
+import { mkdir as mkdir7, readFile as readFile16, writeFile as writeFile11 } from "fs/promises";
 import { homedir as homedir12 } from "os";
-import { dirname as dirname9, join as join31 } from "path";
+import { dirname as dirname10, join as join34 } from "path";
 import { contentHash } from "@tangle-network/agent-eval";
 function stateFile() {
-  const base = process.env.XDG_STATE_HOME ?? join31(homedir12(), ".local", "state");
-  return join31(base, "tangle-traces", "uploaded.json");
+  const base = process.env.XDG_STATE_HOME ?? join34(homedir12(), ".local", "state");
+  return join34(base, "tangle-traces", "uploaded.json");
 }
 function uploadKey(harness, sessionId) {
   return `${harness}:${sessionId}`;
@@ -14974,15 +17098,15 @@ function outboundHash(events, identity) {
 }
 async function loadState() {
   try {
-    return JSON.parse(await readFile14(stateFile(), "utf8"));
+    return JSON.parse(await readFile16(stateFile(), "utf8"));
   } catch {
     return {};
   }
 }
 async function saveState(state) {
   const f = stateFile();
-  await mkdir5(dirname9(f), { recursive: true });
-  await writeFile9(f, `${JSON.stringify(state, null, 2)}
+  await mkdir7(dirname10(f), { recursive: true });
+  await writeFile11(f, `${JSON.stringify(state, null, 2)}
 `, "utf8");
 }
 function alreadyUploaded(state, harness, sessionId, hash2) {
@@ -14990,10 +17114,10 @@ function alreadyUploaded(state, harness, sessionId, hash2) {
 }
 
 // src/upload.ts
-import { readFile as readFile15 } from "fs/promises";
+import { readFile as readFile17 } from "fs/promises";
 import { createRequire as createRequire2 } from "module";
 import { hostname as hostname2 } from "os";
-import { basename as basename15, join as join32 } from "path";
+import { basename as basename15, join as join35 } from "path";
 import { hostedClientFromEnv } from "@tangle-network/agent-eval/hosted";
 import { REDACTION_VERSION } from "@tangle-network/agent-eval/traces";
 var require2 = createRequire2(import.meta.url);
@@ -15017,7 +17141,7 @@ async function planUpload(opts = {}) {
 async function gitBranch(cwd) {
   if (!cwd) return void 0;
   try {
-    const head = await readFile15(join32(cwd, ".git", "HEAD"), "utf8");
+    const head = await readFile17(join35(cwd, ".git", "HEAD"), "utf8");
     const m = head.match(/^ref:\s*refs\/heads\/(.+)$/m);
     return m?.[1]?.trim();
   } catch {
@@ -15026,16 +17150,16 @@ async function gitBranch(cwd) {
 }
 async function sessionMeta(item) {
   const meta = {
-    [ATTR2.HARNESS]: item.ref.harness,
-    [ATTR2.SESSION_FILE]: basename15(item.ref.path),
-    [ATTR2.HOST]: hostname2(),
-    [ATTR2.UPLOADER]: `tangle-traces@${TRACES_VERSION}`,
-    [ATTR2.REDACTION_VERSION]: REDACTION_VERSION,
-    [ATTR2.REDACTION_COUNT]: item.redaction.redactionCount
-  };
-  if (item.ref.cwd) meta[ATTR2.CWD] = item.ref.cwd;
+    [ATTR.HARNESS]: item.ref.harness,
+    [ATTR.SESSION_FILE]: basename15(item.ref.path),
+    [ATTR.HOST]: hostname2(),
+    [ATTR.UPLOADER]: `tangle-traces@${TRACES_VERSION}`,
+    [ATTR.REDACTION_VERSION]: REDACTION_VERSION,
+    [ATTR.REDACTION_COUNT]: item.redaction.redactionCount
+  };
+  if (item.ref.cwd) meta[ATTR.CWD] = item.ref.cwd;
   const branch = await gitBranch(item.ref.cwd);
-  if (branch) meta[ATTR2.GIT_BRANCH] = branch;
+  if (branch) meta[ATTR.GIT_BRANCH] = branch;
   return meta;
 }
 var msToNano = (epochMs) => (BigInt(epochMs) * 1000000n).toString();
@@ -15046,8 +17170,8 @@ function toTraceSpanEvents(spans, rootMeta) {
       if (typeof v === "string" || typeof v === "number" || typeof v === "boolean") attributes2[k] = v;
       else if (v != null) attributes2[k] = JSON.stringify(v);
     }
-    attributes2[ATTR2.SESSION_ID] = s.trace_id;
-    attributes2[ATTR2.INGEST_SOURCE] = INGEST_SOURCE_CLI;
+    attributes2[ATTR.SESSION_ID] = s.trace_id;
+    attributes2[ATTR.INGEST_SOURCE] = INGEST_SOURCE_CLI;
     if (s.parent_span_id === null) Object.assign(attributes2, rootMeta);
     const startMs = parseIsoToEpochMs(s.start_time);
     const endMs = Math.max(startMs, parseIsoToEpochMs(s.end_time));
@@ -15106,7 +17230,7 @@ async function prepareOutbound(plan, opts, uploadedAt) {
     const key = uploadKey(item.ref.harness, item.ref.sessionId);
     const previous = plan.state[key];
     const meta = await sessionMeta(item);
-    const eventsAt = (timestamp) => toTraceSpanEvents(item.spans, { ...meta, [ATTR2.UPLOADED_AT]: timestamp });
+    const eventsAt = (timestamp) => toTraceSpanEvents(item.spans, { ...meta, [ATTR.UPLOADED_AT]: timestamp });
     let eventTimestamp2 = previous?.uploadedAt ?? uploadedAt;
     let events = eventsAt(eventTimestamp2);
     let hash2 = outboundHash(events, identity);
@@ -15184,6 +17308,15 @@ async function executeUpload(plan, opts = {}) {
 
 export {
   appendAll,
+  ATTR,
+  INGEST_SOURCE_CLI,
+  environmentAttributes,
+  stampEnvironmentAttrs,
+  environmentFromSpanAttributes,
+  DEFAULT_HARNESS,
+  sessionIdFromAttributes,
+  indexSessionIdsByTrace,
+  stampSessionIdentity,
   parseIsoToEpochMs,
   parseSince,
   resolveOtlpInputFiles,
@@ -15200,12 +17333,6 @@ export {
   capText,
   ACTOR_ATTR,
   userPromptSpan,
-  ATTR2 as ATTR,
-  INGEST_SOURCE_CLI,
-  DEFAULT_HARNESS,
-  sessionIdFromAttributes,
-  indexSessionIdsByTrace,
-  stampSessionIdentity,
   isChatTrajectoryMessage,
   isChatTrajectory,
   chatTrajectoryToSpans,
@@ -15258,6 +17385,7 @@ export {
   scanSessions,
   SessionWorkflowError,
   describeSessionRelationship,
+  POLICY_EVIDENCE_NOTE,
   buildPolicyEvidenceRecord,
   collectPolicyEvidence,
   serializePolicyEvidence,
@@ -15281,9 +17409,13 @@ export {
   resolveCaseResources,
   enumerateReplayableCases,
   zaiChatCaller,
+  clipText,
   buildFixPrompt,
+  buildRetryFixPrompt,
+  countScriptCommands,
   extractFixCommand,
   generateFixCommand,
+  runFixLoop,
   derivedImageTag,
   dockerImagePreparer,
   seededSample,
@@ -15292,6 +17424,21 @@ export {
   parseReplayBatchArgs,
   replayBatchUsage,
   cmdReplayVerifyBatch,
+  parseIncorrectStepsSubject,
+  resolveFindingInvocation,
+  replayVerifyFinding,
+  findingReplayStep,
+  findingTrajectoryId,
+  resolveFindingReplayability,
+  classifyVerdict,
+  DEFAULT_SANDBOX_BASE_URL,
+  assertSandboxReachable,
+  verifyFindings,
+  renderVerifiedFindingsSection,
+  readFindingsFile,
+  verifyFindingsUsage,
+  parseVerifyFindingsArgs,
+  cmdVerifyFindings,
   runCommand,
   commandAnalyzer,
   haloAnalyzer,
@@ -15299,6 +17446,8 @@ export {
   commandRedactor,
   writeHodoscopeInput,
   hodoscopeAnalyzer,
+  httpJsonTransport,
+  primeAnalyzer,
   CODING_REDACTION_RULES,
   TRACES_REDACTION_RULES,
   redactSpans,
@@ -15329,7 +17478,7 @@ export {
   analyzeSteeringChain,
   REACTIONS,
   analyzeReactions,
-  CORRUPTION_RECEIPT_DISPLAY_LIMIT,
+  sessionReportSource,
   buildTraceFindingPacket,
   loadTracesConfig,
   mergeTracesConfig,
@@ -15386,10 +17535,20 @@ export {
   collectSessionWorkflow,
   collectSessionSelection,
   buildSessionIndex,
+  findContextRoot,
   buildSessionIndexFromRows,
   collectSessionIndex,
   serializeSessionIndex,
   writeSessionIndexFile,
+  listSessionBundleFiles,
+  assembleSessionBundle,
+  hashSessionBundleFiles,
+  writeSessionBundleManifest,
+  readSessionBundleManifest,
+  sessionTextSignatures,
+  findSessionTextLeaks,
+  classifyEvidenceOnlyPath,
+  projectSessionBundle,
   uploadKey,
   sessionHash,
   outboundHash,