@tangle-network/traces 0.15.0 → 0.15.3

package/dist/{chunk-7DOBU7BJ.js → chunk-U4EB4HK7.js}

@@ -1017,9 +1017,9 @@ function serializeSpans(spans) {
 }
 async function writeOtlpFile(spans, outPath) {
   const { mkdtemp: mkdtemp8, writeFile: writeFile13 } = await import("fs/promises");
-  const { tmpdir: tmpdir9 } = await import("os");
-  const { join: join38 } = await import("path");
-  const path = outPath ?? join38(await mkdtemp8(join38(tmpdir9(), "traces-")), "spans.otlp.jsonl");
+  const { tmpdir: tmpdir8 } = await import("os");
+  const { join: join34 } = await import("path");
+  const path = outPath ?? join34(await mkdtemp8(join34(tmpdir8(), "traces-")), "spans.otlp.jsonl");
   await writeFile13(path, serializeSpans(spans), "utf8");
   return path;
 }
@@ -1130,6 +1130,10 @@ var KIND = {
   LLM: "llm",
   TOOL: "tool",
   CHAIN: "custom",
+  EMBEDDING: "custom",
+  RERANKER: "custom",
+  GUARDRAIL: "custom",
+  PROMPT: "custom",
   EVALUATOR: "custom",
   RETRIEVER: "custom",
   UNKNOWN: "custom"
@@ -1818,7 +1822,7 @@ import {
   LLM_INPUT_TOKENS as LLM_INPUT_TOKENS2,
   LLM_OUTPUT_TOKENS as LLM_OUTPUT_TOKENS2
 } from "@tangle-network/agent-eval/trace-attributes";
-import { deriveHexId as deriveHexId2 } from "@tangle-network/agent-trace-contract";
+import { ATTR as ATTR3, deriveHexId as deriveHexId2 } from "@tangle-network/agent-trace-contract";
 
 // src/adapters/claude-subagent-sources.ts
 import { readdir as readdir4, realpath } from "fs/promises";
@@ -1984,7 +1988,10 @@ function selectWorkflowBinding(file, bindings, childStartedAt, explicitToolUseId
       `Cannot link Claude Workflow subagent ${file}: parent call is ambiguous`
     );
   }
-  return latest[0];
+  return {
+    binding: latest[0],
+    confidence: explicitToolUseId || bindings.length === 1 ? "correlated" : "heuristic"
+  };
 }
 
 // src/adapters/claude-subagent-sources.ts
@@ -2092,6 +2099,21 @@ async function collectClaudeSubagentSources(ref, bindings, signal) {
 
 // src/adapters/claude.ts
 var SERVICE2 = "claude-code";
+var AGENT_TOOL_RENAMED_IN = [2, 1, 63];
+function modelFacingToolNames(tools, version) {
+  if (typeof version !== "string" || !atLeast(version, AGENT_TOOL_RENAMED_IN)) return [...tools];
+  return tools.map((name) => name === "Task" ? "Agent" : name);
+}
+function atLeast(version, min) {
+  const parts = version.split(".").map((p) => Number.parseInt(p, 10));
+  if (parts.length < min.length || parts.some((p) => !Number.isFinite(p))) return false;
+  for (let i = 0; i < min.length; i++) {
+    if (parts[i] !== min[i]) return parts[i] > min[i];
+  }
+  return true;
+}
+var TOOL_DEFINITIONS_ATTR = "gen_ai.tool.definitions";
+var RUN_STATUS_ATTR = "run.status";
 var EPOCH = (/* @__PURE__ */ new Date(0)).toISOString();
 var HUMAN_ORIGIN = "human";
 var ORIGIN_EVIDENCE_ATTR = "traces.claude.actor_evidence";
@@ -2788,9 +2810,21 @@ var ClaudeAdapter = class {
     let selectedTurnId;
     let selectedTurnFound = false;
     let active = taskScope === "all";
+    let offeredTools;
+    let runResult;
     for await (const event of readJsonl(ref.path, sessionJsonlOptions(ref, options))) {
       options.signal?.throwIfAborted();
-      if (!discoveredTraceId && event.sessionId) discoveredTraceId = event.sessionId;
+      const eventSessionId = event.sessionId ?? event.session_id;
+      if (!discoveredTraceId && eventSessionId) discoveredTraceId = eventSessionId;
+      if (event.type === "system" && event.subtype === "init" && Array.isArray(event.tools)) {
+        offeredTools = modelFacingToolNames(
+          event.tools.filter((t) => typeof t === "string"),
+          event.claude_code_version
+        );
+      }
+      if (event.type === "result" && typeof event.is_error === "boolean") {
+        runResult = { failed: event.is_error, subtype: event.subtype ?? "unknown" };
+      }
       const accepted = distinctClaudeEvent(event, seen, ref.path, `step${state.step}`);
       if (!accepted) continue;
       indexWorkflowProjection(accepted.projection, workflowIndex);
@@ -2845,6 +2879,13 @@ var ClaudeAdapter = class {
       service: SERVICE2,
       agent: SERVICE2
     });
+    if (offeredTools) {
+      root.attributes[TOOL_DEFINITIONS_ATTR] = JSON.stringify(offeredTools.map((name) => ({ type: "function", name })));
+    }
+    if (runResult) {
+      root.attributes[RUN_STATUS_ATTR] = runResult.failed ? "failed" : "completed";
+      root.status = runResult.failed ? { code: "ERROR", message: `the run ended with ${runResult.subtype}` } : { code: "OK" };
+    }
     const spans = [root];
     appendAll(spans, main.spans);
     await this.foldSubagents(
@@ -2905,13 +2946,14 @@ var ClaudeAdapter = class {
           workflowBindings
         );
         const parsed = await parseClaudeSubagent(ref, traceId, agent, options);
-        const binding = selectWorkflowBinding(
+        const { binding, confidence } = selectWorkflowBinding(
           basename5(file),
           runBindings,
           firstSubagentTimestamp(agent, parsed),
           meta.toolUseId
         );
         agent.parentToolUseId = binding.toolUseId;
+        agent.parentConfidence = confidence;
       }
       agents.push(agent);
     }
@@ -2968,10 +3010,14 @@ var ClaudeAdapter = class {
       const parentAgentMissing = Boolean(
         agent.meta.parentAgentId && !parsedByAgentId.has(agent.meta.parentAgentId)
       );
+      const confidence = parentSpan ? agent.parentConfidence ?? "correlated" : "unknown";
       const task = subagentTaskName(agent);
       const lifecycle = subagentLifecycleSpan(agent, parsed, traceId, parent, task, subDir);
       for (const item of [...parsed.spans, ...lifecycle ? [lifecycle] : []]) {
-        if (item.parent_span_id === `root:${traceId}`) item.parent_span_id = parent;
+        if (item.parent_span_id === `root:${traceId}` || item === lifecycle) {
+          item.parent_span_id = parent;
+          item.attributes[ATTR3.parentConfidence] = confidence;
+        }
         item.attributes[SUBAGENT_SPAN_ATTR] = true;
         if (task) item.attributes[SUBAGENT_TASK_ATTR] = task;
         if (agent.parentToolUseId && !parentSpan) {
@@ -3787,9 +3833,9 @@ function itemCountsJson(counts) {
 }
 function placeInnerSpans(pending, windows) {
   return pending.map((entry) => {
-    const { parent, join: join38 } = joinItem(windows, entry.startMs, entry.endMs);
+    const { parent, join: join34 } = joinItem(windows, entry.startMs, entry.endMs);
     if (parent) entry.span.parent_span_id = parent.span_id;
-    entry.span.attributes["traces.codex.item_join"] = join38;
+    entry.span.attributes["traces.codex.item_join"] = join34;
     return entry.span;
   });
 }
@@ -6434,9 +6480,9 @@ function normalizeRemote(url) {
 }
 async function readGit(cwd) {
   await stat12(`${cwd}/.git`);
-  const { execFile: execFile2 } = await import("child_process");
-  const { promisify: promisify2 } = await import("util");
-  const run = promisify2(execFile2);
+  const { execFile } = await import("child_process");
+  const { promisify } = await import("util");
+  const run = promisify(execFile);
   const git = async (args) => {
     try {
       const { stdout } = await run("git", ["-C", cwd, ...args], { timeout: 5e3 });
@@ -6462,9 +6508,9 @@ async function readGit(cwd) {
   };
 }
 async function gitOutput(cwd, args) {
-  const { execFile: execFile2 } = await import("child_process");
-  const { promisify: promisify2 } = await import("util");
-  const run = promisify2(execFile2);
+  const { execFile } = await import("child_process");
+  const { promisify } = await import("util");
+  const run = promisify(execFile);
   try {
     const { stdout } = await run("git", ["-C", cwd, ...args], { timeout: 5e3 });
     const v = stdout.trim();
@@ -7530,11 +7576,11 @@ function decodeEvidenceRef(value, label, knownSpanUris) {
   }
   const uri = nonEmptyString3(ref.uri, `${label}.uri`);
   if (kind === "span") validateSpanEvidence(uri, knownSpanUris, label);
-  const excerpt2 = optionalString(ref.excerpt, `${label}.excerpt`);
+  const excerpt = optionalString(ref.excerpt, `${label}.excerpt`);
   return {
     kind,
     uri,
-    ...excerpt2 === void 0 ? {} : { excerpt: excerpt2 }
+    ...excerpt === void 0 ? {} : { excerpt }
   };
 }
 function decodeFinding(value, label, knownSpanUris) {
@@ -7741,14 +7787,14 @@ function normalizeFinding(row, analystId, index, context) {
         to: uri
       });
     }
-    const excerpt2 = citation.excerpt === void 0 ? void 0 : normalizeExcerpt(citation.excerpt, span2);
-    if (excerpt2 !== citation.excerpt) {
+    const excerpt = citation.excerpt === void 0 ? void 0 : normalizeExcerpt(citation.excerpt, span2);
+    if (excerpt !== citation.excerpt) {
       context.log?.("finding citation normalized: json-escaped excerpt", {
         analyst_id: analystId,
         uri
       });
     }
-    return excerpt2 === void 0 ? { uri } : { uri, excerpt: excerpt2 };
+    return excerpt === void 0 ? { uri } : { uri, excerpt };
   });
   const normalized = { ...row, evidence: evidence3 };
   const allowed = KIND_EXPECTED_SUBJECTS[analystId];
@@ -7797,10 +7843,10 @@ function decodeComponent(value) {
     return value;
   }
 }
-function normalizeExcerpt(excerpt2, span2) {
-  if (containsText(span2.content, excerpt2)) return excerpt2;
-  const decoded = decodeJsonEscapes(excerpt2);
-  return decoded !== excerpt2 && containsText(span2.content, decoded) ? decoded : excerpt2;
+function normalizeExcerpt(excerpt, span2) {
+  if (containsText(span2.content, excerpt)) return excerpt;
+  const decoded = decodeJsonEscapes(excerpt);
+  return decoded !== excerpt && containsText(span2.content, decoded) ? decoded : excerpt;
 }
 function decodeJsonEscapes(text2) {
   return text2.replace(
@@ -9118,13 +9164,13 @@ import { OtlpFileTraceStore } from "@tangle-network/agent-eval/traces";
 import { isUtf8 as isUtf82 } from "buffer";
 import { createHash as createHash9 } from "crypto";
 import { constants } from "fs";
-import { lstat, open, realpath as realpath3 } from "fs/promises";
+import { lstat as lstat2, open, realpath as realpath3 } from "fs/promises";
 import { dirname as dirname8, isAbsolute as isAbsolute4, join as join20, relative as relative5, resolve as resolve7, sep as sep2 } from "path";
 
 // src/bundle.ts
 import { createHash as createHash8 } from "crypto";
 import { readFileSync as readFileSync2 } from "fs";
-import { copyFile, cp, mkdir as mkdir2, readdir as readdir16, readFile as readFile7, stat as stat14, writeFile as writeFile5 } from "fs/promises";
+import { copyFile, cp, lstat, mkdir as mkdir2, readdir as readdir16, readFile as readFile7, stat as stat14, writeFile as writeFile5 } from "fs/promises";
 import { dirname as dirname7, join as join19, relative as relative4, resolve as resolve6, sep } from "path";
 
 // src/improvement.ts
@@ -9444,7 +9490,7 @@ function validationExitCode(validation) {
 
 // src/loop-analysis.ts
 import {
-  ATTR as ATTR3,
+  ATTR as ATTR4,
   firstNumberAttr,
   firstStringAttr,
   ITERATION_ATTR_KEYS,
@@ -9458,11 +9504,11 @@ function attributes(span2) {
   return span2.attributes;
 }
 function outcomeOf(span2) {
-  const raw = firstStringAttr(attributes(span2), [ATTR3.outcome]);
+  const raw = firstStringAttr(attributes(span2), [ATTR4.outcome]);
   return raw !== void 0 && OUTCOMES.includes(raw) ? raw : null;
 }
 function scoreOf(span2) {
-  return firstNumberAttr(attributes(span2), [ATTR3.score]) ?? null;
+  return firstNumberAttr(attributes(span2), [ATTR4.score]) ?? null;
 }
 function iterationOf(span2) {
   const value = firstNumberAttr(attributes(span2), ITERATION_ATTR_KEYS);
@@ -9535,7 +9581,7 @@ function trendOf(iterations) {
   return {
     trend: "unscored",
     basis: "none",
-    detail: `${iterations.length} round(s) recorded, ${scored.length + graded.length} graded: the trace carries neither ${ATTR3.outcome} nor ${ATTR3.score} on enough rounds to compare them`
+    detail: `${iterations.length} round(s) recorded, ${scored.length + graded.length} graded: the trace carries neither ${ATTR4.outcome} nor ${ATTR4.score} on enough rounds to compare them`
   };
 }
 function analyzeLoopConvergence(spans) {
@@ -9546,7 +9592,7 @@ function analyzeLoopConvergence(spans) {
     const iteration = iterationOf(span2);
     if (iteration === null) continue;
     iterationSpans += 1;
-    const loopId = firstStringAttr(attributes(span2), [ATTR3.loopId]) ?? `(unnamed loop in ${span2.trace_id})`;
+    const loopId = firstStringAttr(attributes(span2), [ATTR4.loopId]) ?? `(unnamed loop in ${span2.trace_id})`;
     const key = `${span2.trace_id}\0${loopId}`;
     const verdict = verdictFor(span2, children);
     const bucket = byLoop.get(key) ?? { traceId: span2.trace_id, iterations: [] };
@@ -10641,8 +10687,8 @@ function renderReport(result, meta) {
         if (f.recommended_action) lines.push(`- **Fix:** ${f.recommended_action}`);
         if (f.validation_plan) lines.push(`- **Check:** ${f.validation_plan}`);
         for (const ev of f.evidence_refs.slice(0, 3)) {
-          const excerpt2 = ev.excerpt ? ` \u2014 \`${ev.excerpt.slice(0, 200)}\`` : "";
-          lines.push(`- **Evidence:** ${ev.kind} ${ev.uri}${excerpt2}`);
+          const excerpt = ev.excerpt ? ` \u2014 \`${ev.excerpt.slice(0, 200)}\`` : "";
+          lines.push(`- **Evidence:** ${ev.kind} ${ev.uri}${excerpt}`);
         }
         lines.push("");
       }
@@ -10966,8 +11012,8 @@ function jsonl(rows) {
   return rows.length === 0 ? "" : `${rows.map((row) => JSON.stringify(row)).join("\n")}
 `;
 }
-function evidence(kind, uri, excerpt2) {
-  return excerpt2 ? { kind, uri, excerpt: excerpt2 } : { kind, uri };
+function evidence(kind, uri, excerpt) {
+  return excerpt ? { kind, uri, excerpt } : { kind, uri };
 }
 function totalReactionSignals(reactions) {
   return Object.values(reactions.signals).reduce((sum, count2) => sum + count2, 0);
@@ -11679,8 +11725,8 @@ async function collectContextRoot(root) {
       if (summary) files.push(summary);
     }
   }
-  const progress = await summarizeFile(join18(evolve, "progress.md"), "other");
-  if (progress) files.push(progress);
+  const progress2 = await summarizeFile(join18(evolve, "progress.md"), "other");
+  if (progress2) files.push(progress2);
   return { root, files: files.sort((a, b) => a.path.localeCompare(b.path)) };
 }
 async function listEvolveRootFiles(evolve) {
@@ -12209,6 +12255,9 @@ var KNOWN_LIMITS = [
   "progress.md is copied whole; no session-dated section extraction is performed",
   "open pull-request state is not captured: the bundler makes no network calls"
 ];
+function sha256Hex(bytes) {
+  return createHash8("sha256").update(bytes).digest("hex");
+}
 function bundlePath(...parts) {
   return parts.join("/");
 }
@@ -12244,9 +12293,9 @@ function sliceJsonlByWindow(text2, windowStartMs, windowEndMs) {
   return { kept, totalRows, unparseableTsRows };
 }
 async function runGitLog(cwd, sinceIso, untilIso) {
-  const { execFile: execFile2 } = await import("child_process");
-  const { promisify: promisify2 } = await import("util");
-  const run = promisify2(execFile2);
+  const { execFile } = await import("child_process");
+  const { promisify } = await import("util");
+  const run = promisify(execFile);
   try {
     const { stdout } = await run(
       "git",
@@ -12549,6 +12598,90 @@ async function readSessionBundleManifest(bundleDir) {
   }
   return manifest;
 }
+function unsafeBundlePath(path) {
+  if (path.length === 0) return "empty path";
+  if (path.includes("\\")) return "contains a backslash";
+  if (path.startsWith("/") || /^[A-Za-z]:/.test(path)) return "is absolute";
+  if (path.split("/").some((part) => part === ".." || part === "." || part === "")) {
+    return 'has an empty, "." or ".." segment';
+  }
+  return null;
+}
+async function nonRegularEntries(root) {
+  const out = [];
+  const pending = [resolve6(root)];
+  while (pending.length > 0) {
+    const dir = pending.pop();
+    for (const entry of await readdir16(dir, { withFileTypes: true })) {
+      const path = join19(dir, entry.name);
+      if (entry.isDirectory()) pending.push(path);
+      else if (!entry.isFile()) out.push(relative4(resolve6(root), path).split(sep).join("/"));
+    }
+  }
+  return out.sort();
+}
+async function verifySessionBundle(bundleDir) {
+  const directory = resolve6(bundleDir);
+  const manifest = await readSessionBundleManifest(directory);
+  const issues = [];
+  const listed = /* @__PURE__ */ new Set();
+  let matched = 0;
+  for (const file of manifest.files) {
+    const unsafe = unsafeBundlePath(file.path);
+    if (unsafe) {
+      issues.push({ kind: "unsafe-path", path: file.path, detail: `manifest path ${unsafe}` });
+      continue;
+    }
+    listed.add(file.path);
+    const info = await lstat(join19(directory, file.path)).catch((error) => {
+      if (isMissingPathError(error)) return null;
+      throw error;
+    });
+    if (!info) {
+      issues.push({ kind: "missing", path: file.path, detail: "listed in the manifest, not on disk" });
+      continue;
+    }
+    if (!info.isFile()) continue;
+    const sha2562 = await fileSha256(join19(directory, file.path));
+    if (info.size !== file.bytes || sha2562 !== file.sha256) {
+      issues.push({
+        kind: "mismatch",
+        path: file.path,
+        detail: `recorded ${file.bytes} bytes sha256 ${file.sha256}, found ${info.size} bytes sha256 ${sha2562}`
+      });
+      continue;
+    }
+    matched += 1;
+  }
+  for (const path of await listSessionBundleFiles(directory)) {
+    if (path === "manifest.json" || listed.has(path)) continue;
+    issues.push({ kind: "unexpected", path, detail: "on disk, not listed in the manifest" });
+  }
+  for (const path of await nonRegularEntries(directory)) {
+    issues.push({ kind: "not-a-file", path, detail: "a symbolic link or special file; a bundle holds regular files only" });
+  }
+  let source;
+  if (manifest.projection) {
+    const sourceManifest = join19(manifest.projection.sourceDirectory, "manifest.json");
+    const bytes = await readFile7(sourceManifest).catch((error) => {
+      if (isMissingPathError(error)) return null;
+      throw error;
+    });
+    source = {
+      directory: manifest.projection.sourceDirectory,
+      status: bytes === null ? "unavailable" : sha256Hex(bytes) === manifest.projection.sourceManifestSha256 ? "match" : "mismatch"
+    };
+  }
+  return {
+    ok: issues.length === 0 && source?.status !== "mismatch",
+    directory,
+    view: manifest.view,
+    listed: manifest.files.length,
+    matched,
+    issues,
+    ...source ? { source } : {}
+  };
+}
 var cachedVersion;
 function tracesPackageVersion() {
   if (cachedVersion) return cachedVersion;
@@ -12578,7 +12711,7 @@ async function openBundleFile(root, file) {
   let current = root;
   for (const part of relative5(root, path).split(sep2)) {
     current = join20(current, part);
-    if ((await lstat(current)).isSymbolicLink()) throw new Error("bundle source symlinks are not permitted");
+    if ((await lstat2(current)).isSymbolicLink()) throw new Error("bundle source symlinks are not permitted");
   }
   if (await realpath3(path) !== path) throw new Error("bundle source resolved outside its declared path");
   const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
@@ -12614,9 +12747,9 @@ async function createBundleSourceReader(directory, spans, options = {}) {
   const maxRecordBytes = options.maxRecordBytes ?? 16 * 1024 * 1024;
   if (!Number.isSafeInteger(maxRecordBytes) || maxRecordBytes < 1) throw new Error("maxRecordBytes must be a positive safe integer");
   options.signal?.throwIfAborted();
-  if ((await lstat(resolve7(directory))).isSymbolicLink()) throw new Error("bundle directory must not be a symlink");
+  if ((await lstat2(resolve7(directory))).isSymbolicLink()) throw new Error("bundle directory must not be a symlink");
   const root = await realpath3(resolve7(directory));
-  if ((await lstat(join20(root, "manifest.json"))).isSymbolicLink()) throw new Error("bundle manifest must not be a symlink");
+  if ((await lstat2(join20(root, "manifest.json"))).isSymbolicLink()) throw new Error("bundle manifest must not be a symlink");
   const manifest = await readSessionBundleManifest(root);
   if (manifest.view !== "full") throw new Error("original source reads require an explicitly authorized full bundle");
   if (!Array.isArray(manifest.files)) throw new Error("bundle manifest has no file receipts");
@@ -13042,7 +13175,7 @@ import { basename as basename14, dirname as dirname10, join as join23, resolve a
 import { createHash as createHash11, randomUUID } from "crypto";
 import {
   link,
-  lstat as lstat2,
+  lstat as lstat3,
   mkdir as mkdir3,
   readFile as readFile8,
   realpath as realpath4,
@@ -13211,7 +13344,7 @@ async function optionalContainedFile(root, candidate) {
 }
 async function assertPathMissing(path) {
   try {
-    await lstat2(path);
+    await lstat3(path);
   } catch (error) {
     if (isErrno(error, "ENOENT")) return;
     throw error;
@@ -13725,54 +13858,18 @@ function validateRevision(value) {
   return value;
 }
 
-// src/replay-verify.ts
-import { mkdirSync, readFileSync as readFileSync3, writeFileSync } from "fs";
-import { join as join24 } from "path";
+// src/replay.ts
+import { readFileSync as readFileSync3 } from "fs";
 import {
-  InMemoryTraceStore as InMemoryTraceStore2,
-  runCounterfactual,
-  TraceEmitter
-} from "@tangle-network/agent-eval";
+  enumerateReplayableCases,
+  parseCorpusFlag,
+  readFindingsFile,
+  replayVerify,
+  runReplayBatch,
+  verifyFindings
+} from "@tangle-network/agent-eval/trajectory-replay";
 import { Sandbox } from "@tangle-network/sandbox";
-function parseRecordedReturncode(observation) {
-  if (!observation) return null;
-  const m = /<returncode>(-?\d+)<\/returncode>/.exec(observation);
-  return m ? Number(m[1]) : null;
-}
-function parseObservationOutput(observation) {
-  if (!observation) return "";
-  const m = /<output>\n?([\s\S]*?)\n?<\/output>/.exec(observation);
-  return m ? m[1] : observation;
-}
-function deriveFailureSignature(observation) {
-  const line = parseObservationOutput(observation).split("\n").find((l) => /\berror\b/i.test(l));
-  return line ? line.trim().slice(0, 200) : null;
-}
-async function ingestCodeTraceBenchSteps(store, steps, caseId) {
-  let tick = 0;
-  const emitter = new TraceEmitter(store, { now: () => ++tick });
-  await emitter.startRun({
-    scenarioId: caseId,
-    tags: { source: "codetracebench-replay", caseId }
-  });
-  for (const step of steps) {
-    if (typeof step.action !== "string" || step.action.length === 0) {
-      throw new Error(`replay-verify: step ${step.step_id} has no action`);
-    }
-    const handle = await emitter.tool({
-      name: `step:${step.step_id}`,
-      toolName: "shell",
-      args: { command: step.action },
-      result: {
-        returncode: parseRecordedReturncode(step.observation),
-        observation: step.observation
-      }
-    });
-    await handle.end();
-  }
-  await emitter.endRun({ pass: true, notes: "recorded trajectory (ingested for replay)" });
-  return { runId: emitter.runId, stepCount: steps.length };
-}
+var DEFAULT_SANDBOX_BASE_URL = "http://127.0.0.1:4097";
 function sandboxReplayBackend(options) {
   const client = new Sandbox({ apiKey: options.apiKey, baseUrl: options.baseUrl });
   return {
@@ -13797,365 +13894,117 @@ function sandboxReplayBackend(options) {
     }
   };
 }
-function wrapActionForExec(action, cwd) {
-  const b64 = Buffer.from(action, "utf8").toString("base64");
-  const quotedCwd = `'${cwd.replaceAll("'", `'\\''`)}'`;
-  return `cd ${quotedCwd} && printf %s ${b64} | base64 -d | sh`;
-}
-function toolCommand(span2) {
-  const args = span2.args;
-  if (!args || typeof args.command !== "string") {
-    throw new Error(`replay-verify: span ${span2.name} carries no command`);
-  }
-  return args.command;
-}
-function recordedReturncodeOf(span2) {
-  const result = span2.result;
-  return typeof result?.returncode === "number" ? result.returncode : null;
-}
-var SandboxCounterfactualRunner = class {
-  constructor(backend, options) {
-    this.backend = backend;
-    this.options = options;
-  }
-  backend;
-  options;
-  lastPrefix = null;
-  lastArm = null;
-  async executeFrom(ctx, emitter) {
-    const { cwd, stepTimeoutMs, prefixLimit, onProgress } = this.options;
-    const session = await this.backend.open();
-    try {
-      const toolSteps = ctx.prefix.filter(
-        (s) => s.span.kind === "tool"
-      );
-      const toExecute = prefixLimit !== void 0 ? toolSteps.slice(0, prefixLimit) : toolSteps;
-      const divergences = [];
-      const prefixStart = Date.now();
-      for (const step of toExecute) {
-        const command = toolCommand(step.span);
-        const expected = recordedReturncodeOf(step.span);
-        const started = Date.now();
-        const result = await session.exec(wrapActionForExec(command, cwd), stepTimeoutMs);
-        const handle = await emitter.sandbox({
-          name: step.span.name,
-          command,
-          exitCode: result.exitCode,
-          wallMs: Date.now() - started
-        });
-        await handle.end();
-        if (expected !== null && expected !== result.exitCode) {
-          divergences.push({
-            step: step.index + 1,
-            expectedReturncode: expected,
-            actualExit: result.exitCode
-          });
-        }
-        onProgress?.(
-          `prefix ${step.span.name}: exit=${result.exitCode}` + (expected !== null && expected !== result.exitCode ? ` (recorded ${expected})` : "")
-        );
-      }
-      this.lastPrefix = {
-        prefixExecuted: toExecute.length,
-        prefixDivergences: divergences,
-        wallMs: Date.now() - prefixStart
-      };
-      if (ctx.mutatedStep.span.kind !== "tool") {
-        throw new Error("replay-verify: mutation target is not a tool span");
-      }
-      const armCommand = toolCommand(ctx.mutatedStep.span);
-      const armStart = Date.now();
-      const armResult = await session.exec(wrapActionForExec(armCommand, cwd), stepTimeoutMs);
-      const armWallMs = Date.now() - armStart;
-      const armHandle = await emitter.sandbox({
-        name: `candidate:${ctx.mutatedStep.span.name}`,
-        command: armCommand,
-        exitCode: armResult.exitCode,
-        wallMs: armWallMs
-      });
-      await armHandle.end();
-      this.lastArm = {
-        command: armCommand,
-        exitCode: armResult.exitCode,
-        stdout: armResult.stdout,
-        stderr: armResult.stderr,
-        wallMs: armWallMs
-      };
-      onProgress?.(`candidate step: exit=${armResult.exitCode} in ${armWallMs}ms`);
-      await emitter.endRun({
-        pass: armResult.exitCode === 0,
-        notes: `prefix ${toExecute.length} steps, ${divergences.length} divergences`
-      });
-    } finally {
-      await session.close();
-    }
-  }
-};
-function excerpt(text2, limit = 2400) {
-  if (text2.length <= limit) return text2;
-  const head = text2.slice(0, limit / 2);
-  const tail = text2.slice(-limit / 2);
-  return `${head}
-\u2026 [${text2.length - limit} chars elided] \u2026
-${tail}`;
-}
-async function replayVerify(options) {
-  const totalStart = Date.now();
-  const steps = JSON.parse(readFileSync3(options.stepsPath, "utf8"));
-  if (!Array.isArray(steps) || steps.length === 0) {
-    throw new Error(`replay-verify: ${options.stepsPath} is not a non-empty steps array`);
-  }
-  const index = options.at - 1;
-  if (index < 0 || index >= steps.length) {
-    throw new Error(`replay-verify: --at ${options.at} out of range [1, ${steps.length}]`);
-  }
-  const target = steps[index];
-  if (target.step_id !== options.at) {
+function sandboxBackendFactory(options) {
+  return (image) => sandboxReplayBackend({ ...options, image });
+}
+async function assertSandboxReachable(baseUrl) {
+  let response;
+  try {
+    response = await fetch(new URL("/health", baseUrl), { signal: AbortSignal.timeout(5e3) });
+  } catch (err) {
     throw new Error(
-      `replay-verify: steps[${index}].step_id=${target.step_id} != --at ${options.at}; steps.json must be ordered with 1-based contiguous step_ids`
+      `verify-findings: sandbox API unreachable at ${baseUrl} \u2014 ${err instanceof Error ? err.message : String(err)}. Executing findings requires a running sandbox orchestrator + SDK adapter (see docs/replay-verify.md); start them or pass --base-url.`
     );
   }
-  const caseId = options.caseId ?? options.stepsPath;
-  const recordedReturncode = parseRecordedReturncode(target.observation);
-  const signature = options.signature ?? deriveFailureSignature(target.observation);
-  const signatureBasis = signature ? "returncode+output-substring" : "returncode-only";
-  const backend = options.backend ?? sandboxReplayBackend({
-    image: options.image,
-    apiKey: requireOption(options.apiKey, "apiKey"),
-    baseUrl: requireOption(options.baseUrl, "baseUrl"),
-    maxLifetimeSeconds: options.maxLifetimeSeconds
-  });
-  const runnerOptions = {
-    cwd: options.cwd,
-    stepTimeoutMs: options.stepTimeoutMs ?? 3e5,
-    prefixLimit: options.prefixLimit,
-    onProgress: options.onProgress
-  };
-  const store = new InMemoryTraceStore2();
-  const { runId } = await ingestCodeTraceBenchSteps(store, steps, caseId);
-  options.onProgress?.(`arm A: replaying ${index} prefix steps then recorded step ${options.at}`);
-  const armARunner = new SandboxCounterfactualRunner(backend, runnerOptions);
-  const armAStart = Date.now();
-  const armAResult = await runCounterfactual(
-    store,
-    runId,
-    { kind: "custom", at: index, describe: "arm-A identity replay", apply: (s) => s },
-    armARunner
-  );
-  const armAMs = Date.now() - armAStart;
-  const armAExec = requireExec(armARunner, "arm A");
-  const armAOutput = `${armAExec.stdout}
-${armAExec.stderr}`;
-  const failureSignatureMatch = recordedReturncode !== null && armAExec.exitCode === recordedReturncode && (signature ? armAOutput.includes(signature) : true);
-  let armBRunner = null;
-  let armBExec = null;
-  let armBRunId = null;
-  let armBMs = null;
-  if (options.fixCommand) {
-    const fixCommand = options.fixCommand;
-    options.onProgress?.(`arm B: replaying prefix then corrected step`);
-    armBRunner = new SandboxCounterfactualRunner(backend, runnerOptions);
-    const armBStart = Date.now();
-    const armBResult = await runCounterfactual(
-      store,
-      runId,
-      {
-        kind: "custom",
-        at: index,
-        describe: "arm-B corrected step",
-        apply: (step) => ({
-          ...step,
-          span: { ...step.span, args: { command: fixCommand } }
-        })
-      },
-      armBRunner
+  if (!response.ok) {
+    throw new Error(
+      `verify-findings: sandbox API at ${baseUrl} answered /health with HTTP ${response.status} \u2014 refusing to run proofs against degraded infrastructure`
     );
-    armBMs = Date.now() - armBStart;
-    armBRunId = armBResult.counterfactualRunId;
-    armBExec = requireExec(armBRunner, "arm B");
-  }
-  const armBOutput = armBExec ? `${armBExec.stdout}
-${armBExec.stderr}` : null;
-  const verdict = {
-    case: caseId,
-    image: options.image,
-    driver: options.driverLabel ?? "docker",
-    k: options.at,
-    cwd: options.cwd,
-    recordedReturncode,
-    signature,
-    signatureBasis,
-    prefixExecuted: armARunner.lastPrefix?.prefixExecuted ?? 0,
-    prefixDivergences: armARunner.lastPrefix?.prefixDivergences ?? [],
-    armA: {
-      command: armAExec.command,
-      exitCode: armAExec.exitCode,
-      wallMs: armAExec.wallMs,
-      prefix: armARunner.lastPrefix,
-      failureSignatureMatch
-    },
-    armB: armBExec && armBRunner ? {
-      command: armBExec.command,
-      exitCode: armBExec.exitCode,
-      wallMs: armBExec.wallMs,
-      prefix: armBRunner.lastPrefix,
-      failureVanished: armBExec.exitCode === 0 && (signature && armBOutput ? !armBOutput.includes(signature) : true)
-    } : null,
-    timings: { armAMs, armBMs, totalMs: Date.now() - totalStart },
-    runIds: {
-      original: runId,
-      armA: armAResult.counterfactualRunId,
-      armB: armBRunId
-    }
-  };
-  mkdirSync(options.out, { recursive: true });
-  writeFileSync(join24(options.out, "replay-verdict.json"), `${JSON.stringify(verdict, null, 2)}
-`);
-  writeFileSync(
-    join24(options.out, "report.md"),
-    renderReport2(verdict, target, armAExec, armBExec)
-  );
-  return verdict;
-}
-function requireOption(value, name) {
-  if (value === void 0) throw new Error(`replay-verify: ${name} is required`);
-  return value;
-}
-function requireExec(runner, arm) {
-  if (!runner.lastArm) throw new Error(`replay-verify: ${arm} finished without executing step k`);
-  return runner.lastArm;
+  }
 }
-function renderReport2(verdict, target, armA, armB) {
-  const lines = [];
-  const divergencePct = verdict.prefixExecuted > 0 ? (verdict.prefixDivergences.length / verdict.prefixExecuted * 100).toFixed(1) : "0.0";
-  lines.push(`# Replay verification \u2014 ${verdict.case}`);
-  lines.push("");
-  lines.push(`- image: \`${verdict.image}\` (driver: ${verdict.driver})`);
-  lines.push(`- error-critical step k = ${verdict.k}, cwd \`${verdict.cwd}\``);
-  lines.push(`- recorded returncode at k: ${verdict.recordedReturncode ?? "none recorded"}`);
-  lines.push(
-    `- failure signature (${verdict.signatureBasis}): ${verdict.signature ? `\`${verdict.signature}\`` : "\u2014"}`
-  );
-  lines.push("");
-  lines.push(`## Prefix replay (steps 1..${verdict.k - 1})`);
-  lines.push("");
-  lines.push(
-    `Executed ${verdict.prefixExecuted} steps; ${verdict.prefixDivergences.length} returncode divergences (${divergencePct}%).`
-  );
-  if (verdict.prefixDivergences.length > 0) {
-    lines.push("");
-    lines.push("| step | recorded rc | replayed exit |");
-    lines.push("| --- | --- | --- |");
-    for (const d of verdict.prefixDivergences) {
-      lines.push(`| ${d.step} | ${d.expectedReturncode} | ${d.actualExit} |`);
+function zaiChatCaller(options) {
+  async function callOnce(system, user, maxTokens) {
+    try {
+      const response = await fetch(`${options.baseUrl.replace(/\/$/, "")}/chat/completions`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${options.apiKey}`, "content-type": "application/json" },
+        body: JSON.stringify({
+          model: options.model,
+          messages: [
+            { role: "system", content: system },
+            { role: "user", content: user }
+          ],
+          temperature: 0,
+          max_tokens: maxTokens
+        }),
+        signal: AbortSignal.timeout(options.timeoutMs ?? 18e4)
+      });
+      const bodyText = await response.text();
+      if (!response.ok) return { succeeded: false, error: `HTTP ${response.status}: ${bodyText.slice(0, 400)}` };
+      const body = JSON.parse(bodyText);
+      if (body.error) return { succeeded: false, error: String(body.error.message ?? "provider error") };
+      const content = body.choices?.[0]?.message?.content;
+      if (typeof content !== "string" || content.length === 0) {
+        return { succeeded: false, error: `empty completion content: ${bodyText.slice(0, 400)}` };
+      }
+      const promptTokens = body.usage?.prompt_tokens;
+      const completionTokens = body.usage?.completion_tokens;
+      const usage = typeof promptTokens === "number" && typeof completionTokens === "number" ? { promptTokens, completionTokens } : null;
+      return { succeeded: true, value: { content, usage } };
+    } catch (err) {
+      return { succeeded: false, error: err instanceof Error ? err.message : String(err) };
     }
   }
-  lines.push("");
-  lines.push("## Arm A \u2014 recorded step k, replayed");
-  lines.push("");
-  lines.push("```sh");
-  lines.push(armA.command);
-  lines.push("```");
-  lines.push("");
-  lines.push(
-    `Exit ${armA.exitCode} in ${armA.wallMs}ms \u2014 failureSignatureMatch: **${verdict.armA.failureSignatureMatch}**`
-  );
-  lines.push("");
-  lines.push("Recorded observation excerpt:");
-  lines.push("");
-  lines.push("```");
-  lines.push(excerpt(parseObservationOutput(target.observation)));
-  lines.push("```");
-  lines.push("");
-  lines.push("Replayed stdout+stderr excerpt:");
-  lines.push("");
-  lines.push("```");
-  lines.push(excerpt(`${armA.stdout}
-${armA.stderr}`.trim()));
-  lines.push("```");
-  if (armB && verdict.armB) {
-    lines.push("");
-    lines.push("## Arm B \u2014 corrected step k");
-    lines.push("");
-    lines.push("```sh");
-    lines.push(armB.command);
-    lines.push("```");
-    lines.push("");
-    lines.push(
-      `Exit ${armB.exitCode} in ${armB.wallMs}ms \u2014 failureVanished: **${verdict.armB.failureVanished}** (prefix re-replayed in a fresh sandbox: ${verdict.armB.prefix.prefixExecuted} steps, ${verdict.armB.prefix.prefixDivergences.length} divergences)`
-    );
-    lines.push("");
-    lines.push("Replayed stdout+stderr excerpt:");
-    lines.push("");
-    lines.push("```");
-    lines.push(excerpt(`${armB.stdout}
-${armB.stderr}`.trim()));
-    lines.push("```");
-  }
-  lines.push("");
-  lines.push("## Timings");
-  lines.push("");
-  lines.push(
-    `arm A ${verdict.timings.armAMs}ms, arm B ${verdict.timings.armBMs ?? "\u2014"}ms, total ${verdict.timings.totalMs}ms.`
-  );
-  lines.push("");
-  return lines.join("\n");
+  return {
+    async complete(system, user) {
+      const baseCap = options.maxTokens ?? 16384;
+      const first = await callOnce(system, user, baseCap);
+      if (first.succeeded || !/finish_reason":"length/.test(first.error)) return first;
+      return callOnce(system, user, baseCap * 2);
+    }
+  };
 }
-function parseReplayVerifyArgs(argv) {
+function parseFlags2(command, argv, switches = []) {
   const values = /* @__PURE__ */ new Map();
+  const corpora = [];
+  const seen = /* @__PURE__ */ new Set();
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     if (arg === "--help" || arg === "-h") return "help";
-    if (!arg.startsWith("--")) throw new Error(`unexpected positional argument: ${arg}`);
+    if (switches.includes(arg)) {
+      seen.add(arg);
+      continue;
+    }
+    if (!arg.startsWith("--")) throw new Error(`${command}: unexpected positional argument: ${arg}`);
     const value = argv[++i];
-    if (value === void 0) throw new Error(`missing value for ${arg}`);
-    values.set(arg, value);
+    if (value === void 0) throw new Error(`${command}: missing value for ${arg}`);
+    if (arg === "--corpus") corpora.push(parseCorpusFlag(value));
+    else values.set(arg, value);
   }
-  const required = (flag) => {
-    const v = values.get(flag);
-    if (v === void 0) throw new Error(`replay-verify: ${flag} is required`);
-    return v;
-  };
-  const optionalNumber = (flag) => {
-    const v = values.get(flag);
-    if (v === void 0) return void 0;
-    const n = Number(v);
-    if (!Number.isFinite(n)) throw new Error(`replay-verify: ${flag} must be a number, got ${v}`);
-    return n;
+  return { values, corpora, switches: seen };
+}
+function flagReader(command, values) {
+  return {
+    required(flag) {
+      const v = values.get(flag);
+      if (v === void 0) throw new Error(`${command}: ${flag} is required`);
+      return v;
+    },
+    number(flag) {
+      const v = values.get(flag);
+      if (v === void 0) return void 0;
+      const n = Number(v);
+      if (!Number.isFinite(n)) throw new Error(`${command}: ${flag} must be a number, got ${v}`);
+      return n;
+    }
   };
-  const stepsPath = required("--steps");
-  const image = required("--image");
-  const at = Number(required("--at"));
-  const cwd = required("--cwd");
-  const out = required("--out");
-  if (!Number.isInteger(at) || at < 1) {
-    throw new Error(`replay-verify: --at must be a positive step_id, got ${values.get("--at")}`);
-  }
-  let fixCommand = values.get("--fix-command");
-  const fixFile = values.get("--fix-command-file");
-  if (fixCommand !== void 0 && fixFile !== void 0) {
-    throw new Error("replay-verify: pass --fix-command or --fix-command-file, not both");
+}
+function sandboxOptions(command, values, requireKey) {
+  const apiKeyEnv = values.get("--api-key-env") ?? "SANDBOX_API_KEY";
+  const apiKey = process.env[apiKeyEnv];
+  if (requireKey && !apiKey) {
+    throw new Error(`${command}: env var ${apiKeyEnv} is empty \u2014 pass --api-key-env or export it`);
   }
-  if (fixFile !== void 0) fixCommand = readFileSync3(fixFile, "utf8").trimEnd();
+  const maxLifetime = flagReader(command, values).number("--max-lifetime");
   return {
-    stepsPath,
-    image,
-    at,
-    fixCommand,
-    cwd,
-    out,
-    caseId: values.get("--case"),
-    signature: values.get("--signature"),
-    stepTimeoutMs: optionalNumber("--step-timeout"),
-    prefixLimit: optionalNumber("--prefix-limit"),
-    driverLabel: values.get("--driver-label"),
-    baseUrl: values.get("--base-url") ?? process.env.SANDBOX_API_URL ?? "http://127.0.0.1:4097",
-    apiKeyEnv: values.get("--api-key-env") ?? "SANDBOX_API_KEY",
-    maxLifetimeSeconds: optionalNumber("--max-lifetime")
+    apiKey: apiKey ?? "",
+    baseUrl: values.get("--base-url") ?? process.env.SANDBOX_API_URL ?? DEFAULT_SANDBOX_BASE_URL,
+    ...maxLifetime === void 0 ? {} : { maxLifetimeSeconds: maxLifetime }
   };
 }
-function replayVerifyUsage() {
-  return `traces replay-verify \u2014 replay a trajectory prefix in a sandbox and execute the counterfactual at step k
+var progress = (message) => process.stderr.write(`${message}
+`);
+var REPLAY_VERIFY_USAGE = `traces replay-verify \u2014 replay a trajectory prefix in a sandbox and execute the counterfactual at step k
 
 Usage:
   traces replay-verify --steps STEPS.json --image IMG --at K --cwd DIR --out DIR \\
@@ -14173,1928 +14022,153 @@ Usage:
                      line of the recorded observation containing "error")
   --prefix-limit     execute at most N prefix steps (weakens fidelity; reported)
   --step-timeout     per-exec timeout in ms (default 300000)
-  --base-url         sandbox API url (default $SANDBOX_API_URL or http://127.0.0.1:4097)
+  --base-url         sandbox API url (default $SANDBOX_API_URL or ${DEFAULT_SANDBOX_BASE_URL})
   --api-key-env      env var holding the sandbox API key (default SANDBOX_API_KEY)
 
 Requires a running sandbox orchestrator; only SWE-style trajectories that carry a
 docker image are replayable. See docs/replay-verify.md for setup and limits.
 `;
-}
 async function cmdReplayVerify(argv) {
-  const parsed = parseReplayVerifyArgs(argv);
+  const parsed = parseFlags2("replay-verify", argv);
   if (parsed === "help") {
-    process.stdout.write(replayVerifyUsage());
+    process.stdout.write(REPLAY_VERIFY_USAGE);
     return;
   }
-  const apiKey = process.env[parsed.apiKeyEnv];
-  if (!apiKey) {
-    throw new Error(
-      `replay-verify: env var ${parsed.apiKeyEnv} is empty \u2014 pass --api-key-env or export it`
-    );
+  const { values } = parsed;
+  const flags = flagReader("replay-verify", values);
+  const at = Number(flags.required("--at"));
+  if (!Number.isInteger(at) || at < 1) {
+    throw new Error(`replay-verify: --at must be a positive step_id, got ${values.get("--at")}`);
+  }
+  const fixFile = values.get("--fix-command-file");
+  if (values.has("--fix-command") && fixFile !== void 0) {
+    throw new Error("replay-verify: pass --fix-command or --fix-command-file, not both");
   }
+  const fixCommand = fixFile === void 0 ? values.get("--fix-command") : readFileSync3(fixFile, "utf8").trimEnd();
+  const image = flags.required("--image");
+  const out = flags.required("--out");
   const verdict = await replayVerify({
-    stepsPath: parsed.stepsPath,
-    image: parsed.image,
-    at: parsed.at,
-    fixCommand: parsed.fixCommand,
-    cwd: parsed.cwd,
-    out: parsed.out,
-    caseId: parsed.caseId,
-    signature: parsed.signature,
-    stepTimeoutMs: parsed.stepTimeoutMs,
-    prefixLimit: parsed.prefixLimit,
-    driverLabel: parsed.driverLabel,
-    baseUrl: parsed.baseUrl,
-    apiKey,
-    maxLifetimeSeconds: parsed.maxLifetimeSeconds,
-    onProgress: (message) => process.stderr.write(`${message}
-`)
+    stepsPath: flags.required("--steps"),
+    image,
+    at,
+    fixCommand,
+    cwd: flags.required("--cwd"),
+    out,
+    caseId: values.get("--case"),
+    signature: values.get("--signature"),
+    stepTimeoutMs: flags.number("--step-timeout"),
+    prefixLimit: flags.number("--prefix-limit"),
+    driverLabel: values.get("--driver-label"),
+    backend: sandboxReplayBackend({ ...sandboxOptions("replay-verify", values, true), image }),
+    onProgress: progress
   });
   process.stdout.write(`${JSON.stringify(verdict, null, 2)}
 `);
   const verdictLine = verdict.armB ? `armA.failureSignatureMatch=${verdict.armA.failureSignatureMatch} armB.failureVanished=${verdict.armB.failureVanished}` : `armA.failureSignatureMatch=${verdict.armA.failureSignatureMatch}`;
-  process.stderr.write(
-    `replay-verify: ${verdictLine} (${verdict.prefixDivergences.length}/${verdict.prefixExecuted} prefix divergences) \u2192 ${parsed.out}
-`
+  progress(
+    `replay-verify: ${verdictLine} (${verdict.prefixDivergences.length}/${verdict.prefixExecuted} prefix divergences) \u2192 ${out}`
   );
 }
+var REPLAY_BATCH_USAGE = `traces replay-verify-batch \u2014 measure replayability and fix-flip rates across gold-labeled corpora
 
-// src/replay-corpus.ts
-import { existsSync as existsSync2, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
-import { join as join25 } from "path";
-function parseCorpusFlag(value) {
-  const eq = value.indexOf("=");
-  if (eq <= 0) throw new Error(`--corpus must be name=<labels>::<prepared>, got: ${value}`);
-  const name = value.slice(0, eq);
-  const rest = value.slice(eq + 1);
-  const sep4 = rest.indexOf("::");
-  if (sep4 <= 0 || sep4 === rest.length - 2) {
-    throw new Error(`--corpus must be name=<labels>::<prepared>, got: ${value}`);
+Usage:
+  traces replay-verify-batch \\
+      --corpus NAME=<labels.json>::<prepared-dir> [--corpus ...] \\
+      --out DIR [--fix none|generate|loop] [--fix-attempts 3] [--enumerate-only] \\
+      [--fix-model glm-5.2] [--fix-base-url URL] [--fix-api-key-env ZAI_GLM_API_KEY] \\
+      [--max-fix-cases 30] [--seed 17] [--step-timeout MS] [--prefix-limit N] \\
+      [--case-filter SUBSTRING] [--case-limit N] \\
+      [--base-url URL] [--api-key-env SANDBOX_API_KEY] [--max-lifetime SECONDS]
+
+  Replayable = the raw trajectory carries info.docker_config.base_image AND the
+  labels mark at least one gold incorrect step that is a real mid-trajectory
+  action. Excluded cases and image pull failures are report rows, never
+  skipped silently. --enumerate-only prints the enumeration without touching a
+  sandbox.
+
+  --fix generate runs ONE LLM call per arm-A-reproduced case (cap
+  --max-fix-cases, seeded sample beyond it) and executes the corrected command
+  as arm B in a fresh sandbox. --fix loop feeds each failed attempt's REAL
+  executed output into the next prompt, up to --fix-attempts attempts.
+
+Outputs batch-report.json, batch-report.md, cases.jsonl (incremental), and one
+directory per case with the full replay-verify artifacts.
+See docs/replay-verify.md for orchestrator setup and honest limits.
+`;
+async function cmdReplayVerifyBatch(argv) {
+  const parsed = parseFlags2("replay-verify-batch", argv, ["--enumerate-only"]);
+  if (parsed === "help") {
+    process.stdout.write(REPLAY_BATCH_USAGE);
+    return;
   }
-  return { name, labelsPath: rest.slice(0, sep4), preparedDir: rest.slice(sep4 + 2) };
-}
-var SUBMIT_ACTION_SIGNATURE = "COMPLETE_TASK_AND_SUBMIT_FINAL_OUTPUT";
-function isSubmitAction(action) {
-  return action.includes(SUBMIT_ACTION_SIGNATURE);
-}
-function readLabelEntries(labelsPath) {
-  const parsed = JSON.parse(readFileSync4(labelsPath, "utf8"));
-  if (!Array.isArray(parsed)) throw new Error(`${labelsPath} is not a JSON array of label entries`);
-  for (const entry of parsed) {
-    if (typeof entry.traj_id !== "string") {
-      throw new Error(`${labelsPath} has an entry without a string traj_id`);
-    }
+  const { values, corpora } = parsed;
+  const flags = flagReader("replay-verify-batch", values);
+  if (corpora.length === 0) {
+    throw new Error("replay-verify-batch: at least one --corpus name=<labels>::<prepared> is required");
   }
-  return parsed;
-}
-function goldIncorrectSteps(entry) {
-  const ids = /* @__PURE__ */ new Set();
-  for (const stage of entry.incorrect_stages ?? []) {
-    for (const id of stage.incorrect_step_ids ?? []) ids.add(id);
+  if (parsed.switches.has("--enumerate-only")) {
+    const enumeration = enumerateReplayableCases(corpora);
+    const replayable = enumeration.replayable.map((c) => ({
+      corpus: c.corpus,
+      trajId: c.trajId,
+      image: c.image,
+      cwd: c.cwd,
+      cwdSource: c.cwdSource,
+      k: c.k,
+      submitGoldsSkipped: c.submitGoldsSkipped,
+      recordedReturncodeAtK: c.recordedReturncodeAtK,
+      goldIncorrectSteps: c.goldIncorrectSteps
+    }));
+    const report2 = { labelEntries: enumeration.labelEntryCount, replayable, excluded: enumeration.excluded };
+    process.stdout.write(`${JSON.stringify(report2, null, 2)}
+`);
+    return;
   }
-  return [...ids].sort((a, b) => a - b);
-}
-function findRawTrajFiles(sweRawDir) {
-  if (!existsSync2(sweRawDir)) return [];
-  const entries = readdirSync2(sweRawDir, { recursive: true, encoding: "utf8" });
-  return entries.filter((relative7) => relative7.endsWith(".traj.json")).map((relative7) => join25(sweRawDir, relative7)).sort();
-}
-function cwdFromPwdObservation(steps) {
-  for (const step of steps) {
-    if (step.action.trim() !== "pwd") continue;
-    const line = parseObservationOutput(step.observation).split("\n").map((l) => l.trim()).find((l) => l.startsWith("/"));
-    if (line) return line;
+  const out = flags.required("--out");
+  const fix = values.get("--fix") ?? "none";
+  if (fix !== "none" && fix !== "generate" && fix !== "loop") {
+    throw new Error(`replay-verify-batch: --fix must be none, generate, or loop, got ${fix}`);
   }
-  return null;
-}
-function taskStatementOf(preparedDir, trajId, raw) {
-  const taskPath = join25(preparedDir, "normalized", trajId, "task.md");
-  if (existsSync2(taskPath)) {
-    const text2 = readFileSync4(taskPath, "utf8").trim();
-    if (text2.length > 0) return text2;
+  const fixAttempts = flags.number("--fix-attempts") ?? 3;
+  if (!Number.isInteger(fixAttempts) || fixAttempts < 1) {
+    throw new Error(`replay-verify-batch: --fix-attempts must be a positive integer, got ${fixAttempts}`);
   }
-  const userMessage = raw.messages?.find((m) => m.role === "user");
-  if (typeof userMessage?.content === "string" && userMessage.content.trim().length > 0) {
-    return userMessage.content.trim();
+  const fixModel = values.get("--fix-model") ?? "glm-5.2";
+  let fixCaller;
+  if (fix !== "none") {
+    const fixApiKeyEnv = values.get("--fix-api-key-env") ?? "ZAI_GLM_API_KEY";
+    const fixApiKey = process.env[fixApiKeyEnv];
+    if (!fixApiKey) {
+      throw new Error(`replay-verify-batch: env var ${fixApiKeyEnv} is empty \u2014 pass --fix-api-key-env or export it`);
+    }
+    fixCaller = zaiChatCaller({
+      baseUrl: values.get("--fix-base-url") ?? "https://api.z.ai/api/coding/paas/v4",
+      apiKey: fixApiKey,
+      model: fixModel
+    });
   }
-  return null;
+  const report = await runReplayBatch({
+    corpora,
+    out,
+    fix,
+    fixAttempts,
+    fixCaller,
+    fixModelLabel: fixModel,
+    maxFixCases: flags.number("--max-fix-cases") ?? 30,
+    seed: flags.number("--seed") ?? 17,
+    stepTimeoutMs: flags.number("--step-timeout"),
+    prefixLimit: flags.number("--prefix-limit"),
+    caseFilter: values.get("--case-filter"),
+    caseLimit: flags.number("--case-limit"),
+    backendFactory: sandboxBackendFactory(sandboxOptions("replay-verify-batch", values, true)),
+    onProgress: progress
+  });
+  const { replayabilityRate, fixFlipRate } = report.headline;
+  progress(
+    `replay-verify-batch: replayability ${replayabilityRate.numerator}/${replayabilityRate.denominator}` + (fixFlipRate ? `, fix-flip ${fixFlipRate.numerator}/${fixFlipRate.denominator}` : "") + ` \u2192 ${out}`
+  );
 }
-function resolveCaseResources(corpus, trajId) {
-  const sweRawDir = join25(corpus.preparedDir, "extracted", trajId, "swe_raw");
-  const rawFiles = findRawTrajFiles(sweRawDir);
-  if (rawFiles.length === 0) {
-    return { resolved: false, reason: "no-swe-raw-trajectory", detail: sweRawDir };
-  }
-  if (rawFiles.length > 1) {
-    return { resolved: false, reason: "ambiguous-swe-raw-trajectory", detail: rawFiles.join(", ") };
-  }
-  let raw;
-  try {
-    raw = JSON.parse(readFileSync4(rawFiles[0], "utf8"));
-  } catch (err) {
-    return {
-      resolved: false,
-      reason: "unreadable-raw-trajectory",
-      detail: `${rawFiles[0]}: ${err instanceof Error ? err.message : String(err)}`
-    };
-  }
-  const dockerConfig = raw.info?.docker_config;
-  const image = dockerConfig?.base_image;
-  if (typeof image !== "string" || image.length === 0) {
-    return { resolved: false, reason: "no-docker-image", detail: rawFiles[0] };
-  }
-  const stepsPath = join25(corpus.preparedDir, "normalized", trajId, "steps.json");
-  if (!existsSync2(stepsPath)) {
-    return { resolved: false, reason: "missing-steps-json", detail: stepsPath };
-  }
-  const steps = JSON.parse(readFileSync4(stepsPath, "utf8"));
-  const runConfigCwd = raw.info?.config?.environment?.cwd;
-  const dockerCwd = dockerConfig?.cwd;
-  let cwd;
-  let cwdSource;
-  if (typeof runConfigCwd === "string" && runConfigCwd.length > 0) {
-    cwd = runConfigCwd;
-    cwdSource = "run-config";
-  } else if (typeof dockerCwd === "string" && dockerCwd.length > 0) {
-    cwd = dockerCwd;
-    cwdSource = "docker-config";
-  } else {
-    const observed = cwdFromPwdObservation(steps);
-    if (!observed) return { resolved: false, reason: "cwd-underivable" };
-    cwd = observed;
-    cwdSource = "pwd-observation";
-  }
-  const recordedTimeout = raw.info?.config?.environment?.timeout;
-  return {
-    resolved: true,
-    resources: {
-      corpus: corpus.name,
-      trajId,
-      stepsPath,
-      steps,
-      taskStatement: taskStatementOf(corpus.preparedDir, trajId, raw),
-      image,
-      cwd,
-      cwdSource,
-      recordedStepTimeoutMs: typeof recordedTimeout === "number" && recordedTimeout > 0 ? recordedTimeout * 1e3 : null
-    }
-  };
-}
-function enumerateReplayableCases(corpora) {
-  const replayable = [];
-  const excluded = [];
-  let labelEntryCount = 0;
-  for (const corpus of corpora) {
-    for (const entry of readLabelEntries(corpus.labelsPath)) {
-      labelEntryCount += 1;
-      const trajId = entry.traj_id;
-      const resolution = resolveCaseResources(corpus, trajId);
-      if (!resolution.resolved) {
-        excluded.push({ corpus: corpus.name, trajId, reason: resolution.reason, detail: resolution.detail });
-        continue;
-      }
-      const gold = goldIncorrectSteps(entry);
-      if (gold.length === 0) {
-        excluded.push({ corpus: corpus.name, trajId, reason: "no-gold-incorrect-step" });
-        continue;
-      }
-      const resources = resolution.resources;
-      let submitGoldsSkipped = 0;
-      let target = null;
-      let missingGoldId = null;
-      for (const goldId of gold) {
-        const step = resources.steps.find((s) => s.step_id === goldId);
-        if (!step) {
-          missingGoldId = goldId;
-          break;
-        }
-        if (isSubmitAction(step.action)) {
-          submitGoldsSkipped += 1;
-          continue;
-        }
-        target = step;
-        break;
-      }
-      if (missingGoldId !== null) {
-        excluded.push({
-          corpus: corpus.name,
-          trajId,
-          reason: "gold-step-outside-steps",
-          detail: `k=${missingGoldId}, steps=${resources.steps.length}`
-        });
-        continue;
-      }
-      if (!target) {
-        excluded.push({
-          corpus: corpus.name,
-          trajId,
-          reason: "gold-only-submit-step",
-          detail: `${submitGoldsSkipped} gold step(s), all submit commands`
-        });
-        continue;
-      }
-      replayable.push({
-        ...resources,
-        goldIncorrectSteps: gold,
-        k: target.step_id,
-        submitGoldsSkipped,
-        recordedReturncodeAtK: parseRecordedReturncode(target.observation)
-      });
-    }
-  }
-  return { replayable, excluded, labelEntryCount };
-}
-
-// src/replay-fix.ts
-function zaiChatCaller(options) {
-  const fetchImpl = options.fetchImpl ?? fetch;
-  return {
-    async complete(system, user) {
-      const baseCap = options.maxTokens ?? 16384;
-      let lastError = "empty completion content";
-      for (const cap of [baseCap, baseCap * 2]) {
-        const outcome = await callOnce(cap);
-        if (outcome.succeeded) return outcome;
-        lastError = outcome.error;
-        if (!/finish_reason":"length/.test(outcome.error)) return outcome;
-      }
-      return { succeeded: false, error: lastError };
-      async function callOnce(maxTokens) {
-        const controller = new AbortController();
-        const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? 18e4);
-        try {
-          const response = await fetchImpl(`${options.baseUrl.replace(/\/$/, "")}/chat/completions`, {
-            method: "POST",
-            headers: {
-              authorization: `Bearer ${options.apiKey}`,
-              "content-type": "application/json"
-            },
-            body: JSON.stringify({
-              model: options.model,
-              messages: [
-                { role: "system", content: system },
-                { role: "user", content: user }
-              ],
-              temperature: 0,
-              max_tokens: maxTokens
-            }),
-            signal: controller.signal
-          });
-          const bodyText = await response.text();
-          if (!response.ok) {
-            return { succeeded: false, error: `HTTP ${response.status}: ${bodyText.slice(0, 400)}` };
-          }
-          const body = JSON.parse(bodyText);
-          if (body.error) {
-            return { succeeded: false, error: String(body.error.message ?? "provider error") };
-          }
-          const content = body.choices?.[0]?.message?.content;
-          if (typeof content !== "string" || content.length === 0) {
-            return { succeeded: false, error: `empty completion content: ${bodyText.slice(0, 400)}` };
-          }
-          const promptTokens = body.usage?.prompt_tokens;
-          const completionTokens = body.usage?.completion_tokens;
-          const usage = typeof promptTokens === "number" && typeof completionTokens === "number" ? { promptTokens, completionTokens } : null;
-          return { succeeded: true, value: { content, usage } };
-        } catch (err) {
-          return { succeeded: false, error: err instanceof Error ? err.message : String(err) };
-        } finally {
-          clearTimeout(timer);
-        }
-      }
-    }
-  };
-}
-function clipText(text2, limit) {
-  if (text2.length <= limit) return text2;
-  const half = Math.floor(limit / 2);
-  return `${text2.slice(0, half)}
-\u2026 [${text2.length - limit} chars elided] \u2026
-${text2.slice(-half)}`;
-}
-function renderStep(step, marker) {
-  const rc = parseRecordedReturncode(step.observation);
-  const output = clipText(parseObservationOutput(step.observation).trim(), 1600);
-  return [
-    `### step ${step.step_id}${marker}`,
-    "```sh",
-    clipText(step.action, 2e3),
-    "```",
-    `returncode: ${rc ?? "none recorded"}`,
-    output.length > 0 ? `output:
-\`\`\`
-${output}
-\`\`\`` : "output: (empty)"
-  ].join("\n");
-}
-function promptBody(input) {
-  const radius = input.contextRadius ?? 3;
-  const target = input.steps.find((s) => s.step_id === input.k);
-  if (!target) throw new Error(`replay-fix: no step with step_id ${input.k}`);
-  const context = input.steps.filter(
-    (s) => s.step_id !== input.k && Math.abs(s.step_id - input.k) <= radius
-  );
-  return [
-    "## Task the agent was solving",
-    input.taskStatement ? clipText(input.taskStatement, 4e3) : "(no task statement recorded)",
-    "",
-    "## Surrounding steps",
-    ...context.map((s) => renderStep(s, "")),
-    "",
-    "## Failing step to correct",
-    renderStep(target, " (INCORRECT \u2014 correct this one)")
-  ];
-}
-function buildFixPrompt(input) {
-  const system = [
-    "You repair one failed shell command from a recorded coding-agent trajectory.",
-    "The trajectory replays inside the original docker image; every command runs as a fresh /bin/sh subshell from a fixed working directory.",
-    "You are given the failing step, its recorded output, surrounding steps, and the task statement.",
-    "Reply with exactly ONE corrected shell command (compound commands with && or pipes are fine) inside a single ```sh fenced block.",
-    "The corrected command must accomplish the failing step's intent and exit 0. No prose outside the fenced block."
-  ].join("\n");
-  const user = [
-    ...promptBody(input),
-    "",
-    "Output the single corrected replacement for the failing step now."
-  ].join("\n");
-  return { system, user };
-}
-function renderFailedAttempt(prior) {
-  if (prior.command === null) {
-    return [
-      `### attempt ${prior.attempt}`,
-      `model call failed before producing a command: ${prior.llmError ?? "unknown error"}`
-    ].join("\n");
-  }
-  const stdout = (prior.stdoutTail ?? "").trim();
-  const stderr = (prior.stderrTail ?? "").trim();
-  return [
-    `### attempt ${prior.attempt}`,
-    "```sh",
-    clipText(prior.command, 2e3),
-    "```",
-    `exit code: ${prior.exitCode ?? "not executed"}`,
-    stdout.length > 0 ? `stdout:
-\`\`\`
-${stdout}
-\`\`\`` : "stdout: (empty)",
-    stderr.length > 0 ? `stderr:
-\`\`\`
-${stderr}
-\`\`\`` : "stderr: (empty)"
-  ].join("\n");
-}
-function buildRetryFixPrompt(input, priorAttempts, maxScriptCommands = 5) {
-  if (priorAttempts.length === 0) {
-    throw new Error("replay-fix: buildRetryFixPrompt requires at least one prior attempt");
-  }
-  const system = [
-    "You repair one failed shell command from a recorded coding-agent trajectory.",
-    "The trajectory replays inside the original docker image; every command runs as a fresh /bin/sh subshell from a fixed working directory.",
-    "Earlier corrected commands were executed for real and failed; their actual output is included below.",
-    `Reply with a corrected fix inside a single \`\`\`sh fenced block: either one command, or a short script of at most ${maxScriptCommands} commands (one per line).`,
-    "The whole block executes as ONE /bin/sh unit from the fixed working directory and must exit 0.",
-    "Do not repeat a command that already failed. Keep reasoning brief. No prose outside the fenced block."
-  ].join("\n");
-  const user = [
-    ...promptBody(input),
-    "",
-    "## Previous fix attempts (executed for real \u2014 all failed)",
-    ...priorAttempts.map((prior) => renderFailedAttempt(prior)),
-    "",
-    `Output a corrected fix now \u2014 one \`\`\`sh block, at most ${maxScriptCommands} commands.`
-  ].join("\n");
-  return { system, user };
-}
-function countScriptCommands(script) {
-  return script.split("\n").filter((line) => line.trim().length > 0 && !line.trim().startsWith("#")).length;
-}
-function extractFixCommand(content) {
-  const blocks = [...content.matchAll(/```(?:sh|bash|shell)?\n([\s\S]*?)```/g)];
-  const candidate = blocks.length > 0 ? blocks[blocks.length - 1][1] : content;
-  const command = candidate.trim();
-  if (command.length === 0 || command.includes("```")) return null;
-  return command;
-}
-async function generateFixCommand(caller, input) {
-  const { system, user } = buildFixPrompt(input);
-  const outcome = await caller.complete(system, user);
-  if (!outcome.succeeded) return outcome;
-  const command = extractFixCommand(outcome.value.content);
-  if (command === null) {
-    return {
-      succeeded: false,
-      error: `completion carried no usable command: ${clipText(outcome.value.content, 300)}`
-    };
-  }
-  return { succeeded: true, value: { command, usage: outcome.value.usage } };
-}
-
-// src/replay-fix-loop.ts
-function toFailedAttempt(record2) {
-  return {
-    attempt: record2.attempt,
-    command: record2.command,
-    exitCode: record2.exitCode,
-    stdoutTail: record2.stdoutTail,
-    stderrTail: record2.stderrTail,
-    llmError: record2.llmError ?? record2.armBError
-  };
-}
-async function runFixLoop(caller, input, executor, options) {
-  if (!Number.isInteger(options.maxAttempts) || options.maxAttempts < 1) {
-    throw new Error(
-      `replay-fix-loop: maxAttempts must be a positive integer, got ${options.maxAttempts}`
-    );
-  }
-  const scriptCap = options.maxScriptCommands ?? 5;
-  const tailChars = options.outputTailChars ?? 1600;
-  const attempts = [];
-  let llmCalls = 0;
-  let llmFailures = 0;
-  let promptTokens = 0;
-  let completionTokens = 0;
-  const unexecuted = (attempt, llmError, usage, command, started) => ({
-    attempt,
-    command,
-    llmError,
-    usage,
-    executed: false,
-    exitCode: null,
-    prefixExecuted: null,
-    prefixDivergences: null,
-    failureVanished: null,
-    stdoutTail: null,
-    stderrTail: null,
-    armBError: null,
-    wallMs: Date.now() - started
-  });
-  for (let attempt = 1; attempt <= options.maxAttempts; attempt++) {
-    const started = Date.now();
-    const prompt = attempt === 1 ? buildFixPrompt(input) : buildRetryFixPrompt(input, attempts.map(toFailedAttempt), scriptCap);
-    llmCalls += 1;
-    const outcome = await caller.complete(prompt.system, prompt.user);
-    if (!outcome.succeeded) {
-      llmFailures += 1;
-      attempts.push(unexecuted(attempt, outcome.error, null, null, started));
-      options.onProgress?.(
-        `fix-loop attempt ${attempt}: LLM failed \u2014 ${outcome.error.slice(0, 160)}`
-      );
-      continue;
-    }
-    const usage = outcome.value.usage;
-    promptTokens += usage?.promptTokens ?? 0;
-    completionTokens += usage?.completionTokens ?? 0;
-    const command = extractFixCommand(outcome.value.content);
-    if (command === null) {
-      llmFailures += 1;
-      attempts.push(
-        unexecuted(
-          attempt,
-          `completion carried no usable command: ${clipText(outcome.value.content, 300)}`,
-          usage,
-          null,
-          started
-        )
-      );
-      continue;
-    }
-    if (attempt > 1) {
-      const commandLines = countScriptCommands(command);
-      if (commandLines > scriptCap) {
-        llmFailures += 1;
-        attempts.push(
-          unexecuted(
-            attempt,
-            `script exceeds ${scriptCap} command lines (${commandLines})`,
-            usage,
-            null,
-            started
-          )
-        );
-        options.onProgress?.(
-          `fix-loop attempt ${attempt}: rejected script with ${commandLines} command lines`
-        );
-        continue;
-      }
-    }
-    let execution;
-    try {
-      execution = await executor(command, attempt);
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      attempts.push({
-        ...unexecuted(attempt, "", usage, command, started),
-        llmError: null,
-        armBError: message.slice(0, 500)
-      });
-      options.onProgress?.(
-        `fix-loop attempt ${attempt}: sandbox error \u2014 ${message.slice(0, 160)}`
-      );
-      return {
-        flipped: false,
-        flippedAtAttempt: null,
-        attempts,
-        aborted: true,
-        llmCalls,
-        llmFailures,
-        promptTokens,
-        completionTokens
-      };
-    }
-    attempts.push({
-      attempt,
-      command,
-      llmError: null,
-      usage,
-      executed: true,
-      exitCode: execution.exitCode,
-      prefixExecuted: execution.prefixExecuted,
-      prefixDivergences: execution.prefixDivergences,
-      failureVanished: execution.failureVanished,
-      stdoutTail: clipText(execution.stdout, tailChars),
-      stderrTail: clipText(execution.stderr, tailChars),
-      armBError: null,
-      wallMs: Date.now() - started
-    });
-    options.onProgress?.(
-      `fix-loop attempt ${attempt}: exit=${execution.exitCode} failureVanished=${execution.failureVanished}`
-    );
-    if (execution.failureVanished) {
-      return {
-        flipped: true,
-        flippedAtAttempt: attempt,
-        attempts,
-        aborted: false,
-        llmCalls,
-        llmFailures,
-        promptTokens,
-        completionTokens
-      };
-    }
-  }
-  return {
-    flipped: false,
-    flippedAtAttempt: null,
-    attempts,
-    aborted: false,
-    llmCalls,
-    llmFailures,
-    promptTokens,
-    completionTokens
-  };
-}
-
-// src/replay-batch.ts
-import { execFile } from "child_process";
-import { createHash as createHash12 } from "crypto";
-import { appendFileSync, mkdirSync as mkdirSync2, mkdtempSync, writeFileSync as writeFileSync2 } from "fs";
-import { tmpdir as tmpdir5 } from "os";
-import { join as join26 } from "path";
-import { promisify } from "util";
-import {
-  InMemoryTraceStore as InMemoryTraceStore3,
-  runCounterfactual as runCounterfactual2
-} from "@tangle-network/agent-eval";
-var execFileAsync = promisify(execFile);
-function derivedImageTag(image, cwd) {
-  const digest = createHash12("sha256").update(`${image}
-${cwd}`).digest("hex").slice(0, 12);
-  return `ctb-replay:${digest}-uid1000`;
-}
-function dockerImagePreparer(options = {}) {
-  const pullTimeoutMs = options.pullTimeoutMs ?? 12e5;
-  const buildTimeoutMs = options.buildTimeoutMs ?? 9e5;
-  const imageExists = async (tag) => {
-    try {
-      await execFileAsync("docker", ["image", "inspect", tag], { maxBuffer: 8 * 1024 * 1024 });
-      return true;
-    } catch {
-      return false;
-    }
-  };
-  const errorTail = (err) => {
-    const raw = err && typeof err === "object" && "stderr" in err && typeof err.stderr === "string" && err.stderr.length > 0 ? err.stderr : err instanceof Error ? err.message : String(err);
-    return raw.trim().split("\n").slice(-3).join(" | ").slice(0, 400);
-  };
-  return {
-    async ensure(image, cwd) {
-      if (cwd === "/") {
-        if (await imageExists(image)) {
-          return { succeeded: true, value: { derivedImage: image, pulled: false, built: false } };
-        }
-        try {
-          await execFileAsync("docker", ["pull", image], {
-            timeout: pullTimeoutMs,
-            maxBuffer: 32 * 1024 * 1024
-          });
-        } catch (err) {
-          return { succeeded: false, error: `pull ${image}: ${errorTail(err)}` };
-        }
-        return { succeeded: true, value: { derivedImage: image, pulled: true, built: false } };
-      }
-      const derived = derivedImageTag(image, cwd);
-      if (await imageExists(derived)) {
-        return { succeeded: true, value: { derivedImage: derived, pulled: false, built: false } };
-      }
-      let pulled = false;
-      if (!await imageExists(image)) {
-        try {
-          await execFileAsync("docker", ["pull", image], {
-            timeout: pullTimeoutMs,
-            maxBuffer: 32 * 1024 * 1024
-          });
-          pulled = true;
-        } catch (err) {
-          return { succeeded: false, error: `pull ${image}: ${errorTail(err)}` };
-        }
-      }
-      const contextDir = mkdtempSync(join26(tmpdir5(), "ctb-replay-image-"));
-      const quotedCwd = `'${cwd.replaceAll("'", `'\\''`)}'`;
-      writeFileSync2(
-        join26(contextDir, "Dockerfile"),
-        `FROM ${image}
-RUN chown -R 1000:1000 ${quotedCwd}
-`
-      );
-      try {
-        await execFileAsync("docker", ["build", "-t", derived, contextDir], {
-          timeout: buildTimeoutMs,
-          maxBuffer: 32 * 1024 * 1024
-        });
-      } catch (err) {
-        return { succeeded: false, error: `build ${derived} from ${image}: ${errorTail(err)}` };
-      }
-      return { succeeded: true, value: { derivedImage: derived, pulled, built: true } };
-    }
-  };
-}
-function mulberry32(seed) {
-  let state = seed >>> 0;
-  return () => {
-    state = state + 1831565813 >>> 0;
-    let t = state;
-    t = Math.imul(t ^ t >>> 15, t | 1);
-    t ^= t + Math.imul(t ^ t >>> 7, t | 61);
-    return ((t ^ t >>> 14) >>> 0) / 4294967296;
-  };
-}
-function seededSample(items, size, seed) {
-  const pool = [...items];
-  const random = mulberry32(seed);
-  for (let i = pool.length - 1; i > 0; i--) {
-    const j = Math.floor(random() * (i + 1));
-    [pool[i], pool[j]] = [pool[j], pool[i]];
-  }
-  return new Set(pool.slice(0, size));
-}
-function caseOutDirName(row) {
-  return `${row.corpus}--${row.trajId}`.replaceAll(/[^A-Za-z0-9._-]/g, "_").slice(0, 180);
-}
-async function executeArmB(replayCase, fixCommand, backend, signature, stepTimeoutMs, prefixLimit, onProgress) {
-  const store = new InMemoryTraceStore3();
-  const { runId } = await ingestCodeTraceBenchSteps(store, replayCase.steps, replayCase.trajId);
-  const runner = new SandboxCounterfactualRunner(backend, {
-    cwd: replayCase.cwd,
-    stepTimeoutMs,
-    prefixLimit,
-    onProgress
-  });
-  await runCounterfactual2(
-    store,
-    runId,
-    {
-      kind: "custom",
-      at: replayCase.k - 1,
-      describe: "arm-B corrected step",
-      apply: (step) => ({
-        ...step,
-        span: { ...step.span, args: { command: fixCommand } }
-      })
-    },
-    runner
-  );
-  const exec = runner.lastArm;
-  if (!exec) throw new Error("arm B finished without executing the corrected step");
-  const output = `${exec.stdout}
-${exec.stderr}`;
-  return {
-    exitCode: exec.exitCode,
-    prefixExecuted: runner.lastPrefix?.prefixExecuted ?? 0,
-    prefixDivergences: runner.lastPrefix?.prefixDivergences.length ?? 0,
-    failureVanished: exec.exitCode === 0 && (signature ? !output.includes(signature) : true),
-    stdout: exec.stdout,
-    stderr: exec.stderr
-  };
-}
-function rate(numerator, denominator) {
-  return denominator > 0 ? numerator / denominator : null;
-}
-async function runReplayBatch(options) {
-  const onProgress = options.onProgress ?? (() => {
-  });
-  const enumeration = enumerateReplayableCases(options.corpora);
-  let selected = enumeration.replayable;
-  if (options.caseFilter) {
-    selected = selected.filter((c) => c.trajId.includes(options.caseFilter));
-  }
-  if (options.caseLimit !== void 0) selected = selected.slice(0, options.caseLimit);
-  onProgress(
-    `enumerated ${enumeration.labelEntryCount} label entries \u2192 ${enumeration.replayable.length} replayable, ${enumeration.excluded.length} excluded; executing ${selected.length}`
-  );
-  const preparer = options.preparer ?? dockerImagePreparer();
-  const backendFactory = options.backendFactory ?? ((derivedImage) => sandboxReplayBackend({
-    image: derivedImage,
-    apiKey: requireOption2(options.apiKey, "apiKey"),
-    baseUrl: requireOption2(options.baseUrl, "baseUrl"),
-    maxLifetimeSeconds: options.maxLifetimeSeconds ?? 3600
-  }));
-  mkdirSync2(options.out, { recursive: true });
-  const progressPath = join26(options.out, "cases.jsonl");
-  const rows = [];
-  const pullFailures = [];
-  const verdictByTraj = /* @__PURE__ */ new Map();
-  for (const [index, replayCase] of selected.entries()) {
-    const caseStart = Date.now();
-    const label = `[${index + 1}/${selected.length}] ${replayCase.corpus}/${replayCase.trajId}`;
-    onProgress(`${label}: preparing image ${replayCase.image}`);
-    const preparation = await preparer.ensure(replayCase.image, replayCase.cwd);
-    const base = {
-      corpus: replayCase.corpus,
-      trajId: replayCase.trajId,
-      image: replayCase.image,
-      cwd: replayCase.cwd,
-      cwdSource: replayCase.cwdSource,
-      k: replayCase.k,
-      stepCount: replayCase.steps.length,
-      goldIncorrectSteps: replayCase.goldIncorrectSteps,
-      submitGoldsSkipped: replayCase.submitGoldsSkipped,
-      recordedReturncodeAtK: replayCase.recordedReturncodeAtK
-    };
-    if (!preparation.succeeded) {
-      pullFailures.push({
-        corpus: replayCase.corpus,
-        trajId: replayCase.trajId,
-        image: replayCase.image,
-        error: preparation.error
-      });
-      const row = {
-        ...base,
-        derivedImage: null,
-        signature: null,
-        status: "image-unavailable",
-        error: preparation.error,
-        imagePulled: false,
-        imageBuilt: false,
-        prefixExecuted: null,
-        prefixDivergences: null,
-        prefixDivergencePct: null,
-        armAExit: null,
-        armAReturncodeMatch: false,
-        armASignatureMatch: false,
-        replayed: false,
-        fix: null,
-        wallMs: Date.now() - caseStart
-      };
-      rows.push(row);
-      appendFileSync(progressPath, `${JSON.stringify(row)}
-`);
-      onProgress(`${label}: image unavailable \u2014 ${preparation.error}`);
-      continue;
-    }
-    const { derivedImage, pulled, built } = preparation.value;
-    const stepTimeoutMs = options.stepTimeoutMs ?? replayCase.recordedStepTimeoutMs ?? 12e4;
-    const caseOut = join26(options.out, caseOutDirName(replayCase));
-    onProgress(`${label}: arm A on ${derivedImage} (k=${replayCase.k}, timeout ${stepTimeoutMs}ms)`);
-    try {
-      const verdict = await replayVerify({
-        stepsPath: replayCase.stepsPath,
-        image: derivedImage,
-        at: replayCase.k,
-        cwd: replayCase.cwd,
-        out: caseOut,
-        caseId: replayCase.trajId,
-        stepTimeoutMs,
-        prefixLimit: options.prefixLimit,
-        backend: backendFactory(derivedImage),
-        onProgress: (message) => onProgress(`${label}: ${message}`)
-      });
-      verdictByTraj.set(replayCase.trajId, verdict);
-      const divergencePct = verdict.prefixExecuted > 0 ? verdict.prefixDivergences.length / verdict.prefixExecuted * 100 : 0;
-      const returncodeMatch = verdict.recordedReturncode !== null && verdict.armA.exitCode === verdict.recordedReturncode;
-      const row = {
-        ...base,
-        derivedImage,
-        signature: verdict.signature,
-        status: "ok",
-        error: null,
-        imagePulled: pulled,
-        imageBuilt: built,
-        prefixExecuted: verdict.prefixExecuted,
-        prefixDivergences: verdict.prefixDivergences.length,
-        prefixDivergencePct: Number(divergencePct.toFixed(1)),
-        armAExit: verdict.armA.exitCode,
-        armAReturncodeMatch: returncodeMatch,
-        armASignatureMatch: verdict.armA.failureSignatureMatch,
-        replayed: divergencePct <= 10 && returncodeMatch,
-        fix: null,
-        wallMs: Date.now() - caseStart
-      };
-      rows.push(row);
-      appendFileSync(progressPath, `${JSON.stringify(row)}
-`);
-      onProgress(
-        `${label}: armA exit=${verdict.armA.exitCode} rcMatch=${returncodeMatch} divergences=${verdict.prefixDivergences.length}/${verdict.prefixExecuted}`
-      );
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      const row = {
-        ...base,
-        derivedImage,
-        signature: null,
-        status: "replay-error",
-        error: message.slice(0, 500),
-        imagePulled: pulled,
-        imageBuilt: built,
-        prefixExecuted: null,
-        prefixDivergences: null,
-        prefixDivergencePct: null,
-        armAExit: null,
-        armAReturncodeMatch: false,
-        armASignatureMatch: false,
-        replayed: false,
-        fix: null,
-        wallMs: Date.now() - caseStart
-      };
-      rows.push(row);
-      appendFileSync(progressPath, `${JSON.stringify(row)}
-`);
-      onProgress(`${label}: replay error \u2014 ${message.slice(0, 200)}`);
-    }
-  }
-  let llm = null;
-  if (options.fix !== "none") {
-    const caller = options.fixCaller;
-    if (!caller) throw new Error(`replay-verify-batch: fix=${options.fix} requires a fixCaller`);
-    const fixAttempts = options.fixAttempts ?? 3;
-    const maxFixCases = options.maxFixCases ?? 30;
-    const seed = options.seed ?? 17;
-    const eligible = rows.filter((r) => r.status === "ok" && r.replayed);
-    const sampled = eligible.length > maxFixCases ? seededSample(eligible, maxFixCases, seed) : new Set(eligible);
-    if (eligible.length > maxFixCases) {
-      onProgress(
-        `fix phase: ${eligible.length} eligible > cap ${maxFixCases}; seeded sample (seed=${seed})`
-      );
-    }
-    let calls = 0;
-    let failures = 0;
-    let promptTokens = 0;
-    let completionTokens = 0;
-    for (const row of eligible) {
-      const index = rows.indexOf(row);
-      if (!sampled.has(row)) {
-        rows[index] = {
-          ...row,
-          fix: {
-            attempted: false,
-            sampledOut: true,
-            command: null,
-            llmError: null,
-            usage: null,
-            armBExit: null,
-            armBPrefixExecuted: null,
-            armBPrefixDivergences: null,
-            failureVanished: null,
-            armBError: null,
-            attempts: null,
-            flippedAtAttempt: null
-          }
-        };
-        continue;
-      }
-      const replayCase = selected.find((c) => c.trajId === row.trajId && c.corpus === row.corpus);
-      const label = `fix ${row.corpus}/${row.trajId}`;
-      const signature = verdictByTraj.get(row.trajId)?.signature ?? null;
-      const stepTimeoutMs = options.stepTimeoutMs ?? replayCase.recordedStepTimeoutMs ?? 12e4;
-      const promptInput = {
-        taskStatement: replayCase.taskStatement,
-        steps: replayCase.steps,
-        k: replayCase.k
-      };
-      const caseOut = join26(options.out, caseOutDirName(row));
-      if (options.fix === "loop") {
-        onProgress(`${label}: fix loop (budget ${fixAttempts} attempts)`);
-        const result = await runFixLoop(
-          caller,
-          promptInput,
-          async (command, attempt) => {
-            onProgress(
-              `${label}: attempt ${attempt} arm B \u2014 ${command.split("\n")[0].slice(0, 120)}`
-            );
-            const armB = await executeArmB(
-              replayCase,
-              command,
-              backendFactory(row.derivedImage),
-              signature,
-              stepTimeoutMs,
-              options.prefixLimit,
-              (message) => onProgress(`${label}: attempt ${attempt}: ${message}`)
-            );
-            mkdirSync2(caseOut, { recursive: true });
-            writeFileSync2(
-              join26(caseOut, `armB-attempt${attempt}-result.json`),
-              `${JSON.stringify({ command, ...armB }, null, 2)}
-`
-            );
-            writeFileSync2(
-              join26(caseOut, "armB-result.json"),
-              `${JSON.stringify({ command, attempt, ...armB }, null, 2)}
-`
-            );
-            return armB;
-          },
-          { maxAttempts: fixAttempts, onProgress: (message) => onProgress(`${label}: ${message}`) }
-        );
-        calls += result.llmCalls;
-        failures += result.llmFailures;
-        promptTokens += result.promptTokens;
-        completionTokens += result.completionTokens;
-        const usage = result.promptTokens + result.completionTokens > 0 ? { promptTokens: result.promptTokens, completionTokens: result.completionTokens } : null;
-        const flippedRecord = result.flippedAtAttempt !== null ? result.attempts.find((a) => a.attempt === result.flippedAtAttempt) : null;
-        const summary = flippedRecord ?? [...result.attempts].reverse().find((a) => a.executed) ?? null;
-        const lastRecord = result.attempts.at(-1) ?? null;
-        rows[index] = {
-          ...row,
-          fix: summary ? {
-            attempted: true,
-            sampledOut: false,
-            command: summary.command,
-            llmError: null,
-            usage,
-            armBExit: summary.exitCode,
-            armBPrefixExecuted: summary.prefixExecuted,
-            armBPrefixDivergences: summary.prefixDivergences,
-            failureVanished: summary.failureVanished,
-            armBError: null,
-            attempts: result.attempts,
-            flippedAtAttempt: result.flippedAtAttempt
-          } : result.aborted ? {
-            attempted: true,
-            sampledOut: false,
-            command: lastRecord?.command ?? null,
-            llmError: null,
-            usage,
-            armBExit: null,
-            armBPrefixExecuted: null,
-            armBPrefixDivergences: null,
-            failureVanished: null,
-            armBError: lastRecord?.armBError ?? "sandbox error",
-            attempts: result.attempts,
-            flippedAtAttempt: null
-          } : {
-            attempted: true,
-            sampledOut: false,
-            command: null,
-            llmError: lastRecord?.llmError ?? "no attempt produced a runnable fix",
-            usage,
-            armBExit: null,
-            armBPrefixExecuted: null,
-            armBPrefixDivergences: null,
-            failureVanished: null,
-            armBError: null,
-            attempts: result.attempts,
-            flippedAtAttempt: null
-          }
-        };
-        onProgress(
-          `${label}: loop done \u2014 flipped=${result.flipped}` + (result.flippedAtAttempt !== null ? ` at attempt ${result.flippedAtAttempt}` : "") + ` (${result.llmCalls} calls, ${result.attempts.filter((a) => a.executed).length} arms)`
-        );
-        continue;
-      }
-      onProgress(`${label}: generating corrected command`);
-      calls += 1;
-      const generated = await generateFixCommand(caller, promptInput);
-      if (!generated.succeeded) {
-        failures += 1;
-        rows[index] = {
-          ...row,
-          fix: {
-            attempted: true,
-            sampledOut: false,
-            command: null,
-            llmError: generated.error,
-            usage: null,
-            armBExit: null,
-            armBPrefixExecuted: null,
-            armBPrefixDivergences: null,
-            failureVanished: null,
-            armBError: null,
-            attempts: null,
-            flippedAtAttempt: null
-          }
-        };
-        onProgress(`${label}: LLM failed \u2014 ${generated.error.slice(0, 200)}`);
-        continue;
-      }
-      promptTokens += generated.value.usage?.promptTokens ?? 0;
-      completionTokens += generated.value.usage?.completionTokens ?? 0;
-      onProgress(`${label}: arm B \u2014 ${generated.value.command.split("\n")[0].slice(0, 120)}`);
-      try {
-        const armB = await executeArmB(
-          replayCase,
-          generated.value.command,
-          backendFactory(row.derivedImage),
-          signature,
-          stepTimeoutMs,
-          options.prefixLimit,
-          (message) => onProgress(`${label}: ${message}`)
-        );
-        rows[index] = {
-          ...row,
-          fix: {
-            attempted: true,
-            sampledOut: false,
-            command: generated.value.command,
-            llmError: null,
-            usage: generated.value.usage,
-            armBExit: armB.exitCode,
-            armBPrefixExecuted: armB.prefixExecuted,
-            armBPrefixDivergences: armB.prefixDivergences,
-            failureVanished: armB.failureVanished,
-            armBError: null,
-            attempts: null,
-            flippedAtAttempt: armB.failureVanished ? 1 : null
-          }
-        };
-        mkdirSync2(caseOut, { recursive: true });
-        writeFileSync2(
-          join26(caseOut, "armB-result.json"),
-          `${JSON.stringify({ command: generated.value.command, ...armB }, null, 2)}
-`
-        );
-        onProgress(`${label}: armB exit=${armB.exitCode} failureVanished=${armB.failureVanished}`);
-      } catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        rows[index] = {
-          ...row,
-          fix: {
-            attempted: true,
-            sampledOut: false,
-            command: generated.value.command,
-            llmError: null,
-            usage: generated.value.usage,
-            armBExit: null,
-            armBPrefixExecuted: null,
-            armBPrefixDivergences: null,
-            failureVanished: null,
-            armBError: message.slice(0, 500),
-            attempts: null,
-            flippedAtAttempt: null
-          }
-        };
-        onProgress(`${label}: arm B error \u2014 ${message.slice(0, 200)}`);
-      }
-    }
-    llm = {
-      model: options.fixModelLabel ?? "unknown",
-      calls,
-      failures,
-      promptTokens,
-      completionTokens
-    };
-  }
-  const executedRows = rows.filter((r) => r.status === "ok");
-  const replayed = executedRows.filter((r) => r.replayed);
-  const signatureStrict = executedRows.filter(
-    (r) => r.replayed && r.armASignatureMatch
-  );
-  const armBExecuted = rows.filter((r) => r.fix?.attempted && r.fix.failureVanished !== null);
-  const flipped = armBExecuted.filter((r) => r.fix.failureVanished === true);
-  const armBNonzeroRc = armBExecuted.filter(
-    (r) => r.recordedReturncodeAtK !== null && r.recordedReturncodeAtK !== 0
-  );
-  const flippedNonzeroRc = armBNonzeroRc.filter((r) => r.fix.failureVanished === true);
-  const attempt1Executed = rows.filter(
-    (r) => r.fix?.attempts?.find((a) => a.attempt === 1)?.executed === true
-  );
-  const flippedAt1 = rows.filter((r) => r.fix?.flippedAtAttempt === 1);
-  const flipsByAttempt = {};
-  for (const row of rows) {
-    const at = row.fix?.flippedAtAttempt;
-    if (typeof at === "number") flipsByAttempt[String(at)] = (flipsByAttempt[String(at)] ?? 0) + 1;
-  }
-  const excludedByReason = {};
-  for (const excluded of enumeration.excluded) {
-    excludedByReason[excluded.reason] = (excludedByReason[excluded.reason] ?? 0) + 1;
-  }
-  const submitGoldsByCorpus = {};
-  const submitEntry = (corpus) => submitGoldsByCorpus[corpus] ??= { submitOnlyCases: 0, goldsSkippedWithinReplayable: 0 };
-  for (const excluded of enumeration.excluded) {
-    if (excluded.reason === "gold-only-submit-step") submitEntry(excluded.corpus).submitOnlyCases += 1;
-  }
-  for (const replayCase of enumeration.replayable) {
-    if (replayCase.submitGoldsSkipped > 0) {
-      submitEntry(replayCase.corpus).goldsSkippedWithinReplayable += replayCase.submitGoldsSkipped;
-    }
-  }
-  const report = {
-    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    corpora: options.corpora.map((c) => ({
-      name: c.name,
-      labelsPath: c.labelsPath,
-      preparedDir: c.preparedDir
-    })),
-    totals: {
-      labelEntries: enumeration.labelEntryCount,
-      replayable: enumeration.replayable.length,
-      executed: selected.length,
-      excludedByReason,
-      submitGoldsByCorpus
-    },
-    headline: {
-      replayabilityRate: {
-        numerator: replayed.length,
-        denominator: selected.length,
-        value: rate(replayed.length, selected.length)
-      },
-      signatureStrictRate: {
-        numerator: signatureStrict.length,
-        denominator: selected.length,
-        value: rate(signatureStrict.length, selected.length)
-      },
-      fixFlipRate: options.fix !== "none" ? {
-        numerator: flipped.length,
-        denominator: armBExecuted.length,
-        value: rate(flipped.length, armBExecuted.length)
-      } : null,
-      fixFlipRateNonzeroRc: options.fix !== "none" ? {
-        numerator: flippedNonzeroRc.length,
-        denominator: armBNonzeroRc.length,
-        value: rate(flippedNonzeroRc.length, armBNonzeroRc.length)
-      } : null,
-      fixFlipAttempt1: options.fix === "loop" ? {
-        numerator: flippedAt1.length,
-        denominator: attempt1Executed.length,
-        value: rate(flippedAt1.length, attempt1Executed.length)
-      } : null,
-      flipsByAttempt: options.fix === "loop" ? flipsByAttempt : null
-    },
-    llm,
-    excluded: enumeration.excluded,
-    pullFailures,
-    cases: rows
-  };
-  writeFileSync2(join26(options.out, "batch-report.json"), `${JSON.stringify(report, null, 2)}
-`);
-  writeFileSync2(join26(options.out, "batch-report.md"), renderBatchReport(report));
-  return report;
-}
-function requireOption2(value, name) {
-  if (value === void 0) throw new Error(`replay-verify-batch: ${name} is required`);
-  return value;
-}
-function pct(value) {
-  return value === null ? "\u2014" : `${(value * 100).toFixed(1)}%`;
-}
-function renderBatchReport(report) {
-  const lines = [];
-  const { headline, totals } = report;
-  lines.push("# Replay-verify batch report");
-  lines.push("");
-  lines.push(`Generated ${report.generatedAt}.`);
-  lines.push("");
-  lines.push("## Headline");
-  lines.push("");
-  lines.push(
-    `- **Replayability rate: ${pct(headline.replayabilityRate.value)}** (${headline.replayabilityRate.numerator}/${headline.replayabilityRate.denominator} replayable cases where the prefix replayed with \u226410% returncode divergence AND arm A reproduced the recorded returncode at the gold step k).`
-  );
-  lines.push(
-    `- Signature-strict rate: ${pct(headline.signatureStrictRate.value)} (${headline.signatureStrictRate.numerator}/${headline.signatureStrictRate.denominator}; additionally requires the recorded error substring in arm A output).`
-  );
-  if (headline.fixFlipRate) {
-    lines.push(
-      `- **Fix-flip rate: ${pct(headline.fixFlipRate.value)}** (${headline.fixFlipRate.numerator}/${headline.fixFlipRate.denominator} arm-B-executed cases where the generated fix made the failure vanish).`
-    );
-  }
-  if (headline.fixFlipRateNonzeroRc) {
-    lines.push(
-      `- Fix-flip rate on recorded-rc\u22600 cases: ${pct(headline.fixFlipRateNonzeroRc.value)} (${headline.fixFlipRateNonzeroRc.numerator}/${headline.fixFlipRateNonzeroRc.denominator}; real recorded failures \u2014 a gold step recorded with rc 0 flips vacuously).`
-    );
-  }
-  if (headline.fixFlipAttempt1) {
-    lines.push(
-      `- Fix-flip@1: ${pct(headline.fixFlipAttempt1.value)} (${headline.fixFlipAttempt1.numerator}/${headline.fixFlipAttempt1.denominator} cases whose attempt 1 executed \u2014 the one-shot-comparable number).`
-    );
-  }
-  if (headline.flipsByAttempt && Object.keys(headline.flipsByAttempt).length > 0) {
-    const parts = Object.entries(headline.flipsByAttempt).sort((a, b) => Number(a[0]) - Number(b[0])).map(([attempt, count2]) => `attempt ${attempt}: ${count2}`);
-    lines.push(`- Flips by attempt: ${parts.join(", ")}.`);
-  }
-  lines.push("");
-  lines.push("## Enumeration");
-  lines.push("");
-  lines.push(
-    `${totals.labelEntries} label entries across ${report.corpora.length} corpora \u2192 ${totals.replayable} replayable (SWE-style docker image + \u22651 gold incorrect step), ${totals.executed} executed.`
-  );
-  lines.push("");
-  lines.push("| exclusion reason | count |");
-  lines.push("| --- | --- |");
-  for (const [reason, count2] of Object.entries(totals.excludedByReason).sort((a, b) => b[1] - a[1])) {
-    lines.push(`| ${reason} | ${count2} |`);
-  }
-  const submitEntries = Object.entries(totals.submitGoldsByCorpus);
-  if (submitEntries.length > 0) {
-    lines.push("");
-    lines.push(
-      "Submit-command golds are never counterfactual targets (a gold on the submit step marks a bad submit decision, not a failed command):"
-    );
-    lines.push("");
-    lines.push("| corpus | cases excluded (all golds = submit) | golds skipped within replayable cases |");
-    lines.push("| --- | --- | --- |");
-    for (const [corpus, stats] of submitEntries.sort((a, b) => a[0].localeCompare(b[0]))) {
-      lines.push(`| ${corpus} | ${stats.submitOnlyCases} | ${stats.goldsSkippedWithinReplayable} |`);
-    }
-  }
-  if (report.pullFailures.length > 0) {
-    lines.push("");
-    lines.push("## Image pull/build failures");
-    lines.push("");
-    lines.push("| corpus | trajectory | image | error |");
-    lines.push("| --- | --- | --- | --- |");
-    for (const failure2 of report.pullFailures) {
-      lines.push(
-        `| ${failure2.corpus} | ${failure2.trajId} | \`${failure2.image}\` | ${failure2.error.replaceAll("|", "\\|")} |`
-      );
-    }
-  }
-  lines.push("");
-  lines.push("## Per-case results");
-  lines.push("");
-  lines.push(
-    "| corpus | trajectory | k | rc@k | prefix | div | div% | armA exit | rc match | sig match | replayed | fix | armB exit | vanished | wall s |"
-  );
-  lines.push(
-    "| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |"
-  );
-  for (const row of report.cases) {
-    const fix = row.fix;
-    const fixCell = !fix ? "\u2014" : fix.sampledOut ? "sampled-out" : fix.llmError ? "llm-failed" : fix.armBError ? "armB-error" : fix.attempts ? fix.flippedAtAttempt !== null ? `flip@${fix.flippedAtAttempt}` : `exhausted(${fix.attempts.length})` : "generated";
-    lines.push(
-      [
-        row.corpus,
-        row.trajId.length > 48 ? `${row.trajId.slice(0, 45)}\u2026` : row.trajId,
-        row.k,
-        row.recordedReturncodeAtK ?? "null",
-        row.prefixExecuted ?? "\u2014",
-        row.prefixDivergences ?? "\u2014",
-        row.prefixDivergencePct ?? "\u2014",
-        row.status === "ok" ? row.armAExit : row.status,
-        row.armAReturncodeMatch ? "yes" : "no",
-        row.armASignatureMatch ? "yes" : "no",
-        row.replayed ? "**yes**" : "no",
-        fixCell,
-        fix?.armBExit ?? "\u2014",
-        fix?.failureVanished === null || fix === null ? "\u2014" : fix.failureVanished ? "**yes**" : "no",
-        (row.wallMs / 1e3).toFixed(1)
-      ].join(" | ")
-    );
-  }
-  if (report.llm) {
-    lines.push("");
-    lines.push("## LLM fix generation");
-    lines.push("");
-    lines.push(
-      `Model ${report.llm.model}: ${report.llm.calls} calls (${report.llm.failures} failed), ${report.llm.promptTokens} prompt + ${report.llm.completionTokens} completion tokens.`
-    );
-  }
-  lines.push("");
-  return lines.join("\n");
-}
-function parseReplayBatchArgs(argv) {
-  const corpora = [];
-  const values = /* @__PURE__ */ new Map();
-  let enumerateOnly = false;
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === "--help" || arg === "-h") return "help";
-    if (arg === "--enumerate-only") {
-      enumerateOnly = true;
-      continue;
-    }
-    if (!arg.startsWith("--")) throw new Error(`unexpected positional argument: ${arg}`);
-    const value = argv[++i];
-    if (value === void 0) throw new Error(`missing value for ${arg}`);
-    if (arg === "--corpus") corpora.push(parseCorpusFlag(value));
-    else values.set(arg, value);
-  }
-  if (corpora.length === 0) {
-    throw new Error("replay-verify-batch: at least one --corpus name=<labels>::<prepared> is required");
-  }
-  const out = values.get("--out");
-  if (!out && !enumerateOnly) throw new Error("replay-verify-batch: --out is required");
-  const optionalNumber = (flag) => {
-    const v = values.get(flag);
-    if (v === void 0) return void 0;
-    const n = Number(v);
-    if (!Number.isFinite(n)) throw new Error(`replay-verify-batch: ${flag} must be a number, got ${v}`);
-    return n;
-  };
-  const fix = values.get("--fix") ?? "none";
-  if (fix !== "none" && fix !== "generate" && fix !== "loop") {
-    throw new Error(`replay-verify-batch: --fix must be none, generate, or loop, got ${fix}`);
-  }
-  const fixAttempts = optionalNumber("--fix-attempts") ?? 3;
-  if (!Number.isInteger(fixAttempts) || fixAttempts < 1) {
-    throw new Error(
-      `replay-verify-batch: --fix-attempts must be a positive integer, got ${values.get("--fix-attempts")}`
-    );
-  }
-  return {
-    corpora,
-    out: out ?? ".",
-    fix,
-    fixAttempts,
-    fixModel: values.get("--fix-model") ?? "glm-5.2",
-    fixBaseUrl: values.get("--fix-base-url") ?? "https://api.z.ai/api/coding/paas/v4",
-    fixApiKeyEnv: values.get("--fix-api-key-env") ?? "ZAI_GLM_API_KEY",
-    maxFixCases: optionalNumber("--max-fix-cases") ?? 30,
-    seed: optionalNumber("--seed") ?? 17,
-    stepTimeoutMs: optionalNumber("--step-timeout"),
-    prefixLimit: optionalNumber("--prefix-limit"),
-    caseFilter: values.get("--case-filter"),
-    caseLimit: optionalNumber("--case-limit"),
-    baseUrl: values.get("--base-url") ?? process.env.SANDBOX_API_URL ?? "http://127.0.0.1:4097",
-    apiKeyEnv: values.get("--api-key-env") ?? "SANDBOX_API_KEY",
-    maxLifetimeSeconds: optionalNumber("--max-lifetime"),
-    enumerateOnly
-  };
-}
-function replayBatchUsage() {
-  return `traces replay-verify-batch \u2014 measure replayability and fix-flip rates across gold-labeled corpora
-
-Usage:
-  traces replay-verify-batch \\
-      --corpus NAME=<labels.json>::<prepared-dir> [--corpus ...] \\
-      --out DIR [--fix none|generate|loop] [--fix-attempts 3] [--enumerate-only] \\
-      [--fix-model glm-5.2] [--fix-base-url URL] [--fix-api-key-env ZAI_GLM_API_KEY] \\
-      [--max-fix-cases 30] [--seed 17] [--step-timeout MS] [--prefix-limit N] \\
-      [--case-filter SUBSTRING] [--case-limit N] \\
-      [--base-url URL] [--api-key-env SANDBOX_API_KEY] [--max-lifetime SECONDS]
-
-  Replayable = the raw trajectory carries info.docker_config.base_image AND the
-  labels mark at least one gold incorrect step that is a real mid-trajectory
-  action. k = the first such gold step; golds whose action is the agent's
-  submit command (COMPLETE_TASK_AND_SUBMIT_FINAL_OUTPUT) are skipped and
-  counted, and cases whose golds are all submit steps are excluded as
-  gold-only-submit-step. Excluded cases and image pull failures are report
-  rows, never skipped silently. --enumerate-only prints the enumeration
-  without touching a sandbox.
-
-  --fix generate runs ONE LLM call per arm-A-reproduced case (cap
-  --max-fix-cases, seeded sample beyond it) and executes the corrected command
-  as arm B in a fresh sandbox.
-
-  --fix loop iterates: attempt 1 is the one-shot prompt; when an arm fails
-  (nonzero exit or the failure signature persists) or the model call fails,
-  the next prompt carries every prior command with its REAL executed
-  stdout/stderr, up to --fix-attempts attempts (default 3). Retries may
-  answer with a short script (<=5 commands) executed as one /bin/sh unit.
-  Every attempt runs in its own fresh sandbox with the same replayed prefix.
-
-Outputs batch-report.json, batch-report.md, cases.jsonl (incremental), and one
-directory per case with the full replay-verify artifacts.
-See docs/replay-verify.md for orchestrator setup and honest limits.
-`;
-}
-async function cmdReplayVerifyBatch(argv) {
-  const parsed = parseReplayBatchArgs(argv);
-  if (parsed === "help") {
-    process.stdout.write(replayBatchUsage());
-    return;
-  }
-  if (parsed.enumerateOnly) {
-    const enumeration = enumerateReplayableCases(parsed.corpora);
-    process.stdout.write(
-      `${JSON.stringify(
-        {
-          labelEntries: enumeration.labelEntryCount,
-          replayable: enumeration.replayable.map((c) => ({
-            corpus: c.corpus,
-            trajId: c.trajId,
-            image: c.image,
-            cwd: c.cwd,
-            cwdSource: c.cwdSource,
-            k: c.k,
-            submitGoldsSkipped: c.submitGoldsSkipped,
-            recordedReturncodeAtK: c.recordedReturncodeAtK,
-            goldIncorrectSteps: c.goldIncorrectSteps
-          })),
-          excluded: enumeration.excluded
-        },
-        null,
-        2
-      )}
-`
-    );
-    return;
-  }
-  const apiKey = process.env[parsed.apiKeyEnv];
-  if (!apiKey) {
-    throw new Error(
-      `replay-verify-batch: env var ${parsed.apiKeyEnv} is empty \u2014 pass --api-key-env or export it`
-    );
-  }
-  let fixCaller;
-  if (parsed.fix !== "none") {
-    const fixApiKey = process.env[parsed.fixApiKeyEnv];
-    if (!fixApiKey) {
-      throw new Error(
-        `replay-verify-batch: env var ${parsed.fixApiKeyEnv} is empty \u2014 pass --fix-api-key-env or export it`
-      );
-    }
-    fixCaller = zaiChatCaller({
-      baseUrl: parsed.fixBaseUrl,
-      apiKey: fixApiKey,
-      model: parsed.fixModel
-    });
-  }
-  const report = await runReplayBatch({
-    corpora: parsed.corpora,
-    out: parsed.out,
-    baseUrl: parsed.baseUrl,
-    apiKey,
-    fix: parsed.fix,
-    fixAttempts: parsed.fixAttempts,
-    fixCaller,
-    fixModelLabel: parsed.fixModel,
-    maxFixCases: parsed.maxFixCases,
-    seed: parsed.seed,
-    stepTimeoutMs: parsed.stepTimeoutMs,
-    prefixLimit: parsed.prefixLimit,
-    caseFilter: parsed.caseFilter,
-    caseLimit: parsed.caseLimit,
-    maxLifetimeSeconds: parsed.maxLifetimeSeconds,
-    onProgress: (message) => process.stderr.write(`${message}
-`)
-  });
-  const { replayabilityRate, fixFlipRate } = report.headline;
-  process.stderr.write(
-    `replay-verify-batch: replayability ${replayabilityRate.numerator}/${replayabilityRate.denominator}` + (fixFlipRate ? `, fix-flip ${fixFlipRate.numerator}/${fixFlipRate.denominator}` : "") + ` \u2192 ${parsed.out}
-`
-  );
-}
-
-// src/replay-wire.ts
-var SUBJECT_PATTERN = /^incorrect-steps-(\d+)-(\d+)-(escaped|unescaped)-consequence-(\d+)$/;
-function parseIncorrectStepsSubject(subject) {
-  const match = SUBJECT_PATTERN.exec(subject);
-  if (!match) return null;
-  return {
-    firstStep: Number(match[1]),
-    lastStep: Number(match[2]),
-    escapeStatus: match[3],
-    consequenceStep: Number(match[4])
-  };
-}
-function resolveFindingInvocation(finding2, corpora) {
-  const subject = parseIncorrectStepsSubject(finding2.subject);
-  if (!subject) {
-    throw new Error(
-      `replay-wire: subject '${finding2.subject}' is not incorrect-steps-<first>-<last>-<escaped|unescaped>-consequence-<step>`
-    );
-  }
-  const failures = [];
-  for (const corpus of corpora) {
-    const resolution = resolveCaseResources(corpus, finding2.trajId);
-    if (resolution.resolved) {
-      const at = subject.firstStep;
-      const step = resolution.resources.steps.find((s) => s.step_id === at);
-      if (!step) {
-        throw new Error(
-          `replay-wire: finding step ${at} is outside ${finding2.trajId} (${resolution.resources.steps.length} steps)`
-        );
-      }
-      return { resources: resolution.resources, subject, at };
-    }
-    failures.push(`${corpus.name}: ${resolution.reason}`);
-  }
-  throw new Error(
-    `replay-wire: trajectory ${finding2.trajId} is not replayable in any corpus \u2014 ${failures.join("; ")}`
-  );
-}
-async function replayVerifyFinding(finding2, options) {
-  if (options.fixCaller && options.fixCommand !== void 0) {
-    throw new Error("replay-wire: pass fixCaller or fixCommand, not both");
-  }
-  const invocation = resolveFindingInvocation(finding2, options.corpora);
-  let fixCommand = options.fixCommand ?? null;
-  if (options.fixCaller) {
-    const generated = await generateFixCommand(options.fixCaller, {
-      taskStatement: invocation.resources.taskStatement,
-      steps: invocation.resources.steps,
-      k: invocation.at
-    });
-    if (!generated.succeeded) {
-      throw new Error(`replay-wire: fix generation failed \u2014 ${generated.error}`);
-    }
-    fixCommand = generated.value.command;
-  }
-  const verdict = await replayVerify({
-    stepsPath: invocation.resources.stepsPath,
-    image: invocation.resources.image,
-    at: invocation.at,
-    fixCommand: fixCommand ?? void 0,
-    cwd: invocation.resources.cwd,
-    out: options.out,
-    caseId: invocation.resources.trajId,
-    stepTimeoutMs: options.stepTimeoutMs ?? invocation.resources.recordedStepTimeoutMs ?? void 0,
-    prefixLimit: options.prefixLimit,
-    backend: options.backend,
-    apiKey: options.apiKey,
-    baseUrl: options.baseUrl,
-    onProgress: options.onProgress
-  });
-  return { invocation, fixCommand, verdict };
-}
-
-// src/analyze-verify.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join27 } from "path";
-var SINGLE_STEP_SUBJECT = /^incorrect-step-(\d+)$/;
-function findingReplayStep(finding2) {
-  const fromMetadata = finding2.metadata?.block_first_step;
-  if (typeof fromMetadata === "number" && Number.isInteger(fromMetadata) && fromMetadata >= 1) {
-    return fromMetadata;
-  }
-  const subject = finding2.subject ?? "";
-  const wire = parseIncorrectStepsSubject(subject);
-  if (wire) return wire.firstStep;
-  const single = SINGLE_STEP_SUBJECT.exec(subject);
-  if (single) return Number(single[1]);
-  return null;
-}
-var TRACE_EVIDENCE_URI = /^trace:\/\/([^/]+)\//;
-function findingTrajectoryId(finding2) {
-  for (const ref of finding2.evidence_refs ?? []) {
-    if (typeof ref.uri !== "string") continue;
-    const match = TRACE_EVIDENCE_URI.exec(ref.uri);
-    if (match) return match[1];
-  }
-  return null;
-}
-function checkStep(steps, at) {
-  const step = steps.find((s) => s.step_id === at);
-  if (!step) {
-    return { ok: false, reason: `step ${at} is outside the trajectory (${steps.length} steps)` };
-  }
-  if (isSubmitAction(step.action)) {
-    return {
-      ok: false,
-      reason: `step ${at} is the submit action \u2014 a submit decision has no executable failure to replay`
-    };
-  }
-  const recordedReturncode = parseRecordedReturncode(step.observation);
-  if (recordedReturncode === null) {
-    return {
-      ok: false,
-      reason: `step ${at} recorded no returncode \u2014 there is no executable failure signature to reproduce`
-    };
-  }
-  return { ok: true, recordedReturncode };
-}
-function resolveFindingReplayability(finding2, source) {
-  const at = findingReplayStep(finding2);
-  if (at === null) {
-    return {
-      replayable: false,
-      reason: `subject '${finding2.subject ?? "(none)"}' names no trajectory step (expected incorrect-step-<n>, incorrect-steps-<f>-<l>-\u2026, or metadata.block_first_step)`
-    };
-  }
-  if (source.kind === "direct") {
-    const trajId2 = findingTrajectoryId(finding2);
-    if (trajId2 && source.caseId && trajId2 !== source.caseId) {
-      return {
-        replayable: false,
-        reason: `finding cites trajectory '${trajId2}' but the supplied steps are case '${source.caseId}'`
-      };
-    }
-    let steps;
-    try {
-      steps = JSON.parse(readFileSync5(source.stepsPath, "utf8"));
-    } catch (err) {
-      throw new Error(
-        `verify-findings: cannot read steps file ${source.stepsPath} \u2014 ${err instanceof Error ? err.message : String(err)}`
-      );
-    }
-    if (!Array.isArray(steps) || steps.length === 0) {
-      throw new Error(`verify-findings: ${source.stepsPath} is not a non-empty steps array`);
-    }
-    const step = checkStep(steps, at);
-    if (!step.ok) return { replayable: false, reason: step.reason };
-    return {
-      replayable: true,
-      resolved: {
-        caseId: source.caseId ?? trajId2 ?? source.stepsPath,
-        stepsPath: source.stepsPath,
-        image: source.image,
-        cwd: source.cwd,
-        at,
-        recordedReturncode: step.recordedReturncode,
-        recordedStepTimeoutMs: null
-      }
-    };
-  }
-  const trajId = findingTrajectoryId(finding2);
-  if (!trajId) {
-    return {
-      replayable: false,
-      reason: "finding carries no trace://<trajectory>/ evidence ref naming its trajectory"
-    };
-  }
-  const failures = [];
-  for (const corpus of source.corpora) {
-    const resolution = resolveCaseResources(corpus, trajId);
-    if (!resolution.resolved) {
-      failures.push(`${corpus.name}: ${resolution.reason}${resolution.detail ? ` (${resolution.detail})` : ""}`);
-      continue;
-    }
-    const step = checkStep(resolution.resources.steps, at);
-    if (!step.ok) return { replayable: false, reason: step.reason };
-    return {
-      replayable: true,
-      resolved: {
-        caseId: trajId,
-        stepsPath: resolution.resources.stepsPath,
-        image: resolution.resources.image,
-        cwd: resolution.resources.cwd,
-        at,
-        recordedReturncode: step.recordedReturncode,
-        recordedStepTimeoutMs: resolution.resources.recordedStepTimeoutMs
-      }
-    };
-  }
-  return {
-    replayable: false,
-    reason: `trajectory ${trajId} is not replayable in any corpus \u2014 ${failures.join("; ")}`
-  };
-}
-function classifyVerdict(verdict) {
-  if (!verdict.armA.failureSignatureMatch) return "divergent";
-  if (verdict.armB?.failureVanished) return "fix-flipped";
-  return "reproduced";
-}
-var DEFAULT_SANDBOX_BASE_URL = "http://127.0.0.1:4097";
-async function assertSandboxReachable(baseUrl) {
-  let response;
-  try {
-    response = await fetch(new URL("/health", baseUrl), { signal: AbortSignal.timeout(5e3) });
-  } catch (err) {
-    throw new Error(
-      `verify-findings: sandbox API unreachable at ${baseUrl} \u2014 ${err instanceof Error ? err.message : String(err)}. Executing findings requires a running sandbox orchestrator + SDK adapter (see docs/replay-verify.md); start them or pass --base-url.`
-    );
-  }
-  if (!response.ok) {
-    throw new Error(
-      `verify-findings: sandbox API at ${baseUrl} answered /health with HTTP ${response.status} \u2014 refusing to run proofs against degraded infrastructure`
-    );
-  }
-}
-function receiptExecution(verdict) {
-  return {
-    image: verdict.image,
-    cwd: verdict.cwd,
-    recordedReturncode: verdict.recordedReturncode,
-    signature: verdict.signature,
-    signatureBasis: verdict.signatureBasis,
-    armA: {
-      command: verdict.armA.command,
-      exitCode: verdict.armA.exitCode,
-      wallMs: verdict.armA.wallMs,
-      failureSignatureMatch: verdict.armA.failureSignatureMatch
-    },
-    armB: verdict.armB ? {
-      command: verdict.armB.command,
-      exitCode: verdict.armB.exitCode,
-      wallMs: verdict.armB.wallMs,
-      failureVanished: verdict.armB.failureVanished
-    } : null,
-    prefixExecuted: verdict.prefixExecuted,
-    prefixDivergences: verdict.prefixDivergences.length,
-    totalMs: verdict.timings.totalMs
-  };
-}
-function writeReceipt(receiptDir, finding2, verification, execution) {
-  const receipt = {
-    schema_version: "1.0.0",
-    produced_at: (/* @__PURE__ */ new Date()).toISOString(),
-    finding_id: verification.finding_id,
-    analyst_id: finding2.analyst_id ?? null,
-    subject: verification.subject,
-    claim: typeof finding2.claim === "string" ? finding2.claim.slice(0, 600) : null,
-    trajectory_id: verification.trajectory_id,
-    step: verification.step,
-    verified: verification.verified,
-    reason: verification.reason,
-    execution,
-    verdict_path: verification.verdict_path,
-    deduplicated_with: verification.deduplicated_with
-  };
-  writeFileSync3(join27(receiptDir, "receipt.json"), `${JSON.stringify(receipt, null, 2)}
-`);
-}
-function receiptDirName(index, finding2) {
-  const id = typeof finding2.finding_id === "string" && finding2.finding_id.length > 0 ? finding2.finding_id.replace(/[^A-Za-z0-9_-]/g, "_") : "finding";
-  return `${String(index + 1).padStart(3, "0")}-${id}`;
-}
-async function verifyFindings(findings, options) {
-  if (findings.length === 0) throw new Error("verify-findings: no findings to verify");
-  mkdirSync3(options.out, { recursive: true });
-  const resolutions = findings.map((finding2) => resolveFindingReplayability(finding2, options.source));
-  const baseUrl = options.baseUrl ?? DEFAULT_SANDBOX_BASE_URL;
-  if (resolutions.some((resolution) => resolution.replayable) && !options.backend) {
-    if (!options.apiKey) {
-      throw new Error(
-        "verify-findings: replayable findings need a sandbox API key \u2014 export SANDBOX_API_KEY or pass --api-key-env"
-      );
-    }
-    await assertSandboxReachable(baseUrl);
-  }
-  const preparer = options.source.kind === "corpus" && !options.backend ? options.source.preparer ?? dockerImagePreparer() : null;
-  const preparedImages = /* @__PURE__ */ new Map();
-  const executedByKey = /* @__PURE__ */ new Map();
-  const verifications = [];
-  let executions = 0;
-  for (let index = 0; index < findings.length; index++) {
-    const finding2 = findings[index];
-    const resolution = resolutions[index];
-    const receiptDir = join27(options.out, receiptDirName(index, finding2));
-    mkdirSync3(receiptDir, { recursive: true });
-    const identity2 = {
-      finding_id: finding2.finding_id ?? null,
-      subject: finding2.subject ?? null,
-      trajectory_id: findingTrajectoryId(finding2)
-    };
-    if (!resolution.replayable) {
-      const verification2 = {
-        ...identity2,
-        step: findingReplayStep(finding2),
-        verified: "not-replayable",
-        reason: resolution.reason,
-        receipt: receiptDir,
-        verdict_path: null,
-        deduplicated_with: null
-      };
-      writeReceipt(receiptDir, finding2, verification2, null);
-      verifications.push(verification2);
-      options.onProgress?.(`${identity2.finding_id ?? `finding ${index + 1}`}: not-replayable \u2014 ${resolution.reason}`);
-      continue;
-    }
-    const resolved = resolution.resolved;
-    const dedupeKey = `${resolved.caseId}::${resolved.at}::${options.fixCommand ?? ""}`;
-    const prior = executedByKey.get(dedupeKey);
-    if (prior) {
-      const verification2 = {
-        ...identity2,
-        step: resolved.at,
-        verified: prior.verified,
-        reason: prior.reason,
-        receipt: receiptDir,
-        verdict_path: prior.verdict_path,
-        deduplicated_with: prior.receipt
-      };
-      const priorVerdict = prior.verdict_path ? JSON.parse(readFileSync5(prior.verdict_path, "utf8")) : null;
-      writeReceipt(receiptDir, finding2, verification2, priorVerdict ? receiptExecution(priorVerdict) : null);
-      verifications.push(verification2);
-      options.onProgress?.(
-        `${identity2.finding_id ?? `finding ${index + 1}`}: ${prior.verified} (shares proof with ${prior.finding_id ?? prior.receipt})`
-      );
-      continue;
-    }
-    let image = resolved.image;
-    if (preparer) {
-      const preparationKey = `${resolved.image}::${resolved.cwd}`;
-      let preparation = preparedImages.get(preparationKey);
-      if (!preparation) {
-        const ensured = await preparer.ensure(resolved.image, resolved.cwd);
-        preparation = ensured.succeeded ? { succeeded: true, image: ensured.value.derivedImage } : { succeeded: false, error: ensured.error };
-        preparedImages.set(preparationKey, preparation);
-      }
-      if (!preparation.succeeded) {
-        const verification2 = {
-          ...identity2,
-          step: resolved.at,
-          verified: "not-replayable",
-          reason: `replay image could not be prepared \u2014 ${preparation.error}`,
-          receipt: receiptDir,
-          verdict_path: null,
-          deduplicated_with: null
-        };
-        writeReceipt(receiptDir, finding2, verification2, null);
-        verifications.push(verification2);
-        options.onProgress?.(`${identity2.finding_id ?? `finding ${index + 1}`}: not-replayable \u2014 image preparation failed`);
-        continue;
-      }
-      image = preparation.image;
-    }
-    options.onProgress?.(
-      `${identity2.finding_id ?? `finding ${index + 1}`}: executing arm A at step ${resolved.at} of ${resolved.caseId} on ${image}`
-    );
-    const verdict = await replayVerify({
-      stepsPath: resolved.stepsPath,
-      image,
-      at: resolved.at,
-      fixCommand: options.fixCommand,
-      cwd: resolved.cwd,
-      out: receiptDir,
-      caseId: resolved.caseId,
-      stepTimeoutMs: options.stepTimeoutMs ?? resolved.recordedStepTimeoutMs ?? void 0,
-      prefixLimit: options.prefixLimit,
-      backend: options.backend,
-      apiKey: options.apiKey,
-      baseUrl,
-      maxLifetimeSeconds: options.maxLifetimeSeconds,
-      onProgress: options.onProgress
-    });
-    executions += 1;
-    const verification = {
-      ...identity2,
-      step: resolved.at,
-      verified: classifyVerdict(verdict),
-      reason: null,
-      receipt: receiptDir,
-      verdict_path: join27(receiptDir, "replay-verdict.json"),
-      deduplicated_with: null
-    };
-    executedByKey.set(dedupeKey, verification);
-    writeReceipt(receiptDir, finding2, verification, receiptExecution(verdict));
-    verifications.push(verification);
-    options.onProgress?.(`${identity2.finding_id ?? `finding ${index + 1}`}: ${verification.verified}`);
-  }
-  const counts = {
-    reproduced: 0,
-    "fix-flipped": 0,
-    divergent: 0,
-    "not-replayable": 0
-  };
-  for (const verification of verifications) counts[verification.verified] += 1;
-  const run = { out: options.out, verifications, counts, executions };
-  writeFileSync3(
-    join27(options.out, "verifications.json"),
-    `${JSON.stringify({ schema_version: "1.0.0", ...run }, null, 2)}
-`
-  );
-  return run;
-}
-function verdictCell(verification) {
-  switch (verification.verified) {
-    case "reproduced":
-      return "**VERIFIED** \u2014 reproduced";
-    case "fix-flipped":
-      return "**VERIFIED** \u2014 fix-flipped";
-    case "divergent":
-      return "DIVERGENT \u2014 recorded failure did not reproduce";
-    case "not-replayable":
-      return `UNVERIFIABLE \u2014 ${verification.reason ?? "no reason recorded"}`;
-  }
-}
-function renderVerifiedFindingsSection(run) {
-  const lines = ["## Verified findings (executed replay)", ""];
-  const total = run.verifications.length;
-  lines.push(
-    `${total} finding(s) \u2192 ${run.counts.reproduced} reproduced, ${run.counts["fix-flipped"]} fix-flipped, ${run.counts.divergent} divergent, ${run.counts["not-replayable"]} not replayable (${run.executions} sandbox execution(s); findings accusing the same step share one proof).`
-  );
-  lines.push("");
-  lines.push("| Finding | Subject | Step | Verdict | Receipt |");
-  lines.push("|---|---|---:|---|---|");
-  for (const verification of run.verifications) {
-    const shared = verification.deduplicated_with ? " (shared proof)" : "";
-    lines.push(
-      `| \`${verification.finding_id ?? "\u2014"}\` | \`${verification.subject ?? "\u2014"}\` | ${verification.step ?? "\u2014"} | ${verdictCell(verification)} | \`${verification.receipt}\`${shared} |`
-    );
-  }
-  lines.push("");
-  lines.push(
-    "VERIFIED = the accused step was re-executed in a sandbox after replaying the trajectory prefix, and the recorded failure signature reproduced (fix-flipped: a corrected command additionally made it vanish). Each receipt directory carries receipt.json and, when executed, replay-verdict.json + report.md with real stdout/stderr."
-  );
-  lines.push("");
-  return lines.join("\n");
-}
-function readFindingsFile(path) {
-  const parsed = JSON.parse(readFileSync5(path, "utf8"));
-  const array = Array.isArray(parsed) ? parsed : parsed && typeof parsed === "object" && Array.isArray(parsed.findings) ? parsed.findings : null;
-  if (!array) {
-    throw new Error(`${path} is neither a findings array nor an object with a findings array`);
-  }
-  for (const entry of array) {
-    if (!entry || typeof entry !== "object") {
-      throw new Error(`${path}: every finding must be an object, got ${JSON.stringify(entry)}`);
-    }
-  }
-  return array;
-}
-function verifyFindingsUsage() {
-  return `traces verify-findings \u2014 execute analyst findings as sandbox replay proofs
+var VERIFY_FINDINGS_USAGE = `traces verify-findings \u2014 execute analyst findings as sandbox replay proofs
 
 Usage:
   traces verify-findings --findings FINDINGS.json --out DIR \\
@@ -16111,7 +14185,7 @@ Usage:
                      verify against one trajectory; the image must be replay-ready
                      (uid-1000 derived), exactly like traces replay-verify
   --case             trajectory id of --steps; findings citing other trajectories
-                     are honestly marked not-replayable
+                     are marked not-replayable
   --corpus           resolve each finding's trajectory in CodeTraceBench corpora;
                      images are derived via the batch uid-1000 preparer (docker)
   --fix-command      corrected step for arm B; a reproduced finding whose fix
@@ -16124,110 +14198,83 @@ with a receipt directory carrying the executed evidence or the precise reason.
 Requires a running sandbox orchestrator when any finding is replayable \u2014 infra
 absence is an error, never a silent skip. See docs/replay-verify.md for setup.
 `;
+function verifyFindingsInSandbox(findings, options) {
+  if (findings.length === 0) throw new Error("verify-findings: no findings to verify");
+  const { sandbox, ...rest } = options;
+  return verifyFindings(findings, {
+    ...rest,
+    backendFactory: sandboxBackendFactory(sandbox),
+    preflight: async () => {
+      if (!sandbox.apiKey) {
+        throw new Error(
+          "verify-findings: replayable findings need a sandbox API key \u2014 export SANDBOX_API_KEY or pass --api-key-env"
+        );
+      }
+      await assertSandboxReachable(sandbox.baseUrl);
+    },
+    onProgress: progress
+  });
 }
-function parseVerifyFindingsArgs(argv) {
-  const values = /* @__PURE__ */ new Map();
-  const corpora = [];
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (arg === "--help" || arg === "-h") return "help";
-    if (!arg.startsWith("--")) throw new Error(`unexpected positional argument: ${arg}`);
-    const value = argv[++i];
-    if (value === void 0) throw new Error(`missing value for ${arg}`);
-    if (arg === "--corpus") {
-      corpora.push(parseCorpusFlag(value));
-      continue;
-    }
-    values.set(arg, value);
+async function cmdVerifyFindings(argv) {
+  const parsed = parseFlags2("verify-findings", argv);
+  if (parsed === "help") {
+    process.stdout.write(VERIFY_FINDINGS_USAGE);
+    return;
   }
-  const required = (flag) => {
-    const v = values.get(flag);
-    if (v === void 0) throw new Error(`verify-findings: ${flag} is required`);
-    return v;
-  };
-  const optionalNumber = (flag) => {
-    const v = values.get(flag);
-    if (v === void 0) return void 0;
-    const n = Number(v);
-    if (!Number.isFinite(n)) throw new Error(`verify-findings: ${flag} must be a number, got ${v}`);
-    return n;
-  };
-  const findingsPath = required("--findings");
-  const out = required("--out");
+  const { values, corpora } = parsed;
+  const flags = flagReader("verify-findings", values);
+  const findingsPath = flags.required("--findings");
+  const out = flags.required("--out");
   const direct = values.has("--steps") || values.has("--image") || values.has("--cwd");
   if (direct && corpora.length > 0) {
     throw new Error("verify-findings: pass --steps/--image/--cwd or --corpus, not both");
   }
   let source;
   if (direct) {
+    const caseId = values.get("--case");
     source = {
       kind: "direct",
-      stepsPath: required("--steps"),
-      image: required("--image"),
-      cwd: required("--cwd"),
-      ...values.has("--case") ? { caseId: values.get("--case") } : {}
+      stepsPath: flags.required("--steps"),
+      image: flags.required("--image"),
+      cwd: flags.required("--cwd"),
+      ...caseId === void 0 ? {} : { caseId }
     };
   } else if (corpora.length > 0) {
     source = { kind: "corpus", corpora };
   } else {
     throw new Error("verify-findings: a replay source is required \u2014 --steps/--image/--cwd or --corpus");
   }
-  return {
-    findingsPath,
+  const run = await verifyFindingsInSandbox(readFindingsFile(findingsPath), {
     source,
     out,
+    sandbox: sandboxOptions("verify-findings", values, false),
     fixCommand: values.get("--fix-command"),
-    stepTimeoutMs: optionalNumber("--step-timeout"),
-    prefixLimit: optionalNumber("--prefix-limit"),
-    baseUrl: values.get("--base-url") ?? process.env.SANDBOX_API_URL ?? DEFAULT_SANDBOX_BASE_URL,
-    apiKeyEnv: values.get("--api-key-env") ?? "SANDBOX_API_KEY",
-    maxLifetimeSeconds: optionalNumber("--max-lifetime")
-  };
-}
-async function cmdVerifyFindings(argv) {
-  const parsed = parseVerifyFindingsArgs(argv);
-  if (parsed === "help") {
-    process.stdout.write(verifyFindingsUsage());
-    return;
-  }
-  const findings = readFindingsFile(parsed.findingsPath);
-  const apiKey = process.env[parsed.apiKeyEnv];
-  const run = await verifyFindings(findings, {
-    source: parsed.source,
-    out: parsed.out,
-    fixCommand: parsed.fixCommand,
-    stepTimeoutMs: parsed.stepTimeoutMs,
-    prefixLimit: parsed.prefixLimit,
-    apiKey,
-    baseUrl: parsed.baseUrl,
-    maxLifetimeSeconds: parsed.maxLifetimeSeconds,
-    onProgress: (message) => process.stderr.write(`${message}
-`)
+    stepTimeoutMs: flags.number("--step-timeout"),
+    prefixLimit: flags.number("--prefix-limit")
   });
   process.stdout.write(`${JSON.stringify(run, null, 2)}
 `);
-  process.stderr.write(
-    `verify-findings: ${run.verifications.length} finding(s) \u2192 ${run.counts.reproduced} reproduced, ${run.counts["fix-flipped"]} fix-flipped, ${run.counts.divergent} divergent, ${run.counts["not-replayable"]} not-replayable (${run.executions} execution(s)) \u2192 ${run.out}
-`
+  progress(
+    `verify-findings: ${run.verifications.length} finding(s) \u2192 ${run.counts.reproduced} reproduced, ${run.counts["fix-flipped"]} fix-flipped, ${run.counts.divergent} divergent, ${run.counts["not-replayable"]} not-replayable (${run.executions} execution(s)) \u2192 ${run.out}`
   );
 }
 
 // src/hodoscope.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash12 } from "crypto";
 import { mkdir as mkdir5, mkdtemp as mkdtemp5, readFile as readFile11, readdir as readdir17, writeFile as writeFile7 } from "fs/promises";
-import { endianness, tmpdir as tmpdir6 } from "os";
-import { join as join28, resolve as resolve10 } from "path";
+import { endianness, tmpdir as tmpdir5 } from "os";
+import { join as join24, resolve as resolve10 } from "path";
 var HODOSCOPE_VERSION = "0.2.4";
 async function writeHodoscopeInput(otlpPath, options = {}) {
   const explicitDirectory = options.directory ? resolve10(options.directory) : void 0;
-  const directory = explicitDirectory ?? await mkdtemp5(join28(tmpdir6(), "traces-hodoscope-input-"));
+  const directory = explicitDirectory ?? await mkdtemp5(join24(tmpdir5(), "traces-hodoscope-input-"));
   if (explicitDirectory) {
     await mkdir5(directory, { recursive: true });
     if ((await readdir17(directory)).length > 0) {
       throw new Error(`Hodoscope explicit directory must be empty: ${directory}`);
     }
   }
-  const samples = join28(directory, "samples");
+  const samples = join24(directory, "samples");
   await mkdir5(samples);
   const rows = [];
   for await (const value of readJsonl(otlpPath)) rows.push(parseOpenInferenceRow(value));
@@ -16252,8 +14299,8 @@ async function writeHodoscopeInput(otlpPath, options = {}) {
       throw new Error(`Hodoscope trace '${traceId}' contains no assistant actions`);
     }
     actionCount += actions;
-    const file = `${createHash13("sha256").update(traceId).digest("hex").slice(0, 24)}.json`;
-    await writeFile7(join28(samples, file), `${JSON.stringify(trajectory, null, 2)}
+    const file = `${createHash12("sha256").update(traceId).digest("hex").slice(0, 24)}.json`;
+    await writeFile7(join24(samples, file), `${JSON.stringify(trajectory, null, 2)}
 `, "utf8");
   }
   return {
@@ -16275,12 +14322,12 @@ function hodoscopeAnalyzer(options = {}) {
   return {
     name: "hodoscope",
     async analyze(otlpPath, runOptions2 = {}) {
-      const outputRoot = options.outputDir ? resolve10(options.outputDir) : tmpdir6();
+      const outputRoot = options.outputDir ? resolve10(options.outputDir) : tmpdir5();
       await mkdir5(outputRoot, { recursive: true });
-      const directory = await mkdtemp5(join28(outputRoot, "traces-hodoscope-"));
-      const input = join28(directory, "input");
-      const analysisFile = join28(directory, "analysis.hodoscope.json");
-      const samplesFile = join28(directory, "samples.json");
+      const directory = await mkdtemp5(join24(outputRoot, "traces-hodoscope-"));
+      const input = join24(directory, "input");
+      const analysisFile = join24(directory, "analysis.hodoscope.json");
+      const samplesFile = join24(directory, "samples.json");
       try {
         const prepared = await writeHodoscopeInput(otlpPath, {
           directory: input,
@@ -16900,7 +14947,7 @@ function assertPositiveInteger(name, value) {
 }
 
 // src/analyst-engine-prime.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash13 } from "crypto";
 import { request as httpRequest } from "http";
 import { request as httpsRequest } from "https";
 var DEFAULT_BRIDGE_URL = "http://localhost:4181";
@@ -17124,7 +15171,7 @@ function toAnalystFinding(row, index, spanTraces, model, producedAt) {
     const traces = spanTraces.get(spanId);
     return spanEvidenceUri([...traces][0], spanId);
   });
-  const findingId = `prime-${createHash14("sha256").update(`${index}
+  const findingId = `prime-${createHash13("sha256").update(`${index}
 ${row.claim}
 ${uris.join("\n")}`).digest("hex").slice(0, 12)}`;
   return {
@@ -17408,10 +15455,10 @@ async function applyRedactor(spans, redactor) {
 }
 
 // src/file-export.ts
-import { createHash as createHash15 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 import { mkdtemp as mkdtemp6, readFile as readFile12, writeFile as writeFile8 } from "fs/promises";
-import { tmpdir as tmpdir7 } from "os";
-import { join as join29 } from "path";
+import { tmpdir as tmpdir6 } from "os";
+import { join as join25 } from "path";
 import {
   firstNumberAttr as firstNumberAttr2,
   LLM_CACHED_TOKEN_ATTR_KEYS,
@@ -17446,7 +15493,7 @@ function stableJson(value) {
   });
 }
 function hashId(value, chars = 16) {
-  return createHash15("sha256").update(stableJson(value)).digest("hex").slice(0, chars);
+  return createHash14("sha256").update(stableJson(value)).digest("hex").slice(0, chars);
 }
 function isoTime2(value) {
   if (typeof value === "string") {
@@ -17757,6 +15804,10 @@ function llmEventUsage(row) {
     ...costUsd !== void 0 ? { costUsd } : {}
   };
 }
+function toolPartId(row) {
+  const part = objectValue2(objectValue2(row.data)?.part) ?? objectValue2(row.part);
+  return part && part.type === "tool" ? stringValue3(part.id) : void 0;
+}
 function sandboxEventsToSpans(rows, wrapper) {
   const context = wrapper ?? {};
   const sessionId = findStringKey(context, ["session_id", "sessionId"], 3) ?? findStringKey(rows, ["session_id", "sessionId"], 4);
@@ -17788,12 +15839,32 @@ function sandboxEventsToSpans(rows, wrapper) {
       }
     })
   ];
+  const lastEventOfPart = /* @__PURE__ */ new Map();
+  const firstTimeOfPart = /* @__PURE__ */ new Map();
+  const errorOfPart = /* @__PURE__ */ new Map();
+  rows.forEach((row, index) => {
+    const part = toolPartId(row);
+    if (part === void 0) return;
+    lastEventOfPart.set(part, index);
+    const time = eventTimestamp(row);
+    const first = firstTimeOfPart.get(part);
+    if (time && (first === void 0 || time < first)) firstTimeOfPart.set(part, time);
+    const status = eventStatus(row, eventType(row) ?? "event");
+    if (status.status === "ERROR") errorOfPart.set(part, status);
+  });
+  const mergedToolEvents = rows.filter((row, index) => {
+    const part = toolPartId(row);
+    return part !== void 0 && lastEventOfPart.get(part) !== index;
+  }).length;
+  if (mergedToolEvents > 0) spans[0].attributes["traces.event.tool_part_updates_merged"] = mergedToolEvents;
   let previousTime = rootStart;
   rows.forEach((row, index) => {
+    const part = toolPartId(row);
+    if (part !== void 0 && lastEventOfPart.get(part) !== index) return;
     const type = eventType(row) ?? "event";
-    const time = eventTimestamp(row) ?? previousTime;
+    const time = (part !== void 0 ? firstTimeOfPart.get(part) : void 0) ?? eventTimestamp(row) ?? previousTime;
     previousTime = time;
-    const { status, message } = eventStatus(row, type);
+    const { status, message } = (part !== void 0 ? errorOfPart.get(part) : void 0) ?? eventStatus(row, type);
     const { kind, tool } = eventKind(row, type);
     const name = kind === "TOOL" && tool ? `tool.${tool}` : `event.${type}`;
     const toolInput2 = kind === "TOOL" ? eventValue(row, ["toolInput", "tool_input", "input", "args", "arguments", "full_command"]) : void 0;
@@ -17808,6 +15879,7 @@ function sandboxEventsToSpans(rows, wrapper) {
       }) : {}
     };
     copyDefined(extra, {
+      "traces.event.part_id": part,
       "traces.event.id": stringValue3(row.id),
       "traces.event.raw_type": stringValue3(row.type),
       "traces.event.raw_event": stringValue3(row.event)
@@ -18057,15 +16129,15 @@ async function exportTraceEvidenceFile(inputPath, opts = {}) {
 }
 async function writeTraceEvidenceExportFile(inputPath, outPath, opts = {}) {
   const result = await exportTraceEvidenceFile(inputPath, opts);
-  const path = outPath ?? join29(await mkdtemp6(join29(tmpdir7(), "traces-export-")), "spans.openinference.jsonl");
+  const path = outPath ?? join25(await mkdtemp6(join25(tmpdir6(), "traces-export-")), "spans.openinference.jsonl");
   await writeFile8(path, serializeSpans(result.spans), "utf8");
   return { ...result, path };
 }
 
 // src/inspect.ts
 import { mkdtemp as mkdtemp7, readFile as readFile13, writeFile as writeFile9 } from "fs/promises";
-import { tmpdir as tmpdir8 } from "os";
-import { basename as basename15, join as join30 } from "path";
+import { tmpdir as tmpdir7 } from "os";
+import { basename as basename15, join as join26 } from "path";
 var severityRank2 = {
   high: 0,
   medium: 1,
@@ -18081,7 +16153,7 @@ function sessionLabel(row) {
   const id = row.session.sessionId.length > 12 ? row.session.sessionId.slice(0, 12) : row.session.sessionId;
   return `${row.session.harness}:${id} (${repoLabel(row)})`;
 }
-function pct2(value) {
+function pct(value) {
   return `${(value * 100).toFixed(value >= 0.1 ? 0 : 1)}%`;
 }
 function topToolErrors(row) {
@@ -18160,7 +16232,7 @@ function addSessionFindings(index, findings) {
       area: "session",
       title: `High tool-error count/rate in ${errorSessions.length}/${index.totals.sessions} session(s)`,
       impact: errors,
-      evidence: errorSessions.slice(0, 5).map((row) => `${sessionLabel(row)}: ${row.metrics.erroredToolCallCount}/${row.metrics.toolCallCount} tool errors (${pct2(row.metrics.toolErrorRate)}); ${topToolErrors(row)}`),
+      evidence: errorSessions.slice(0, 5).map((row) => `${sessionLabel(row)}: ${row.metrics.erroredToolCallCount}/${row.metrics.toolCallCount} tool errors (${pct(row.metrics.toolErrorRate)}); ${topToolErrors(row)}`),
       next: "Fix the most common failing command/tool first, then rerun `traces index` to confirm the error count drops.",
       refs: errorSessions.slice(0, 5).map((row) => row.session.path)
     });
@@ -18354,13 +16426,13 @@ async function readSessionIndexFile(path) {
   return parsed;
 }
 async function writeInspectionReportFile(report, outPath) {
-  const path = outPath ?? join30(await mkdtemp7(join30(tmpdir8(), "traces-inspect-")), "inspection-report.md");
+  const path = outPath ?? join26(await mkdtemp7(join26(tmpdir7(), "traces-inspect-")), "inspection-report.md");
   await writeFile9(path, renderInspectionReport(report), "utf8");
   return path;
 }
 
 // src/live.ts
-import { createHash as createHash16 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 var VERIFY_RE = /\b(test|tests|vitest|jest|pytest|go test|cargo test|tsc|typecheck|lint|biome|eslint|build|check:invariants|preflight)\b/i;
 var CHANGE_RE = /\b(apply_patch|edit|write|create|delete|rename|replace|update|git apply|sed -i|perl -pi|tee\s|cat\s+>)/i;
 var CLAIM_DONE_RE = /\b(done|fixed|complete|completed|implemented|merged|verified|all green|tests pass|ready|works now)\b/i;
@@ -18380,7 +16452,7 @@ var sleep = (ms2, signal) => new Promise((resolve13) => {
   signal?.addEventListener("abort", onAbort, { once: true });
 });
 function hash(parts) {
-  return createHash16("sha256").update(parts.join("\0")).digest("hex").slice(0, 16);
+  return createHash15("sha256").update(parts.join("\0")).digest("hex").slice(0, 16);
 }
 function asString(value) {
   if (typeof value === "string" && value.trim()) return value;
@@ -18788,7 +16860,7 @@ async function streamSessions(opts) {
 
 // src/supervisor-run-context.ts
 import { readFile as readFile14, stat as stat16 } from "fs/promises";
-import { basename as basename16, join as join31 } from "path";
+import { basename as basename16, join as join27 } from "path";
 import { materializeTreeView } from "@tangle-network/agent-runtime/kernel";
 import {
   readRuntimeSupervisorRun
@@ -18950,14 +17022,14 @@ function parseInstant(v) {
 }
 async function readFileRunContext(runDir, opts = {}) {
   const sources = await readRuntimeSupervisorRun(runDir);
-  const coordination = readCoordinationLog(await readMaybe(join31(runDir, COORDINATION_LOG_FILE)));
+  const coordination = readCoordinationLog(await readMaybe(join27(runDir, COORDINATION_LOG_FILE)));
   return {
     ...sources,
     instanceId: opts.instanceId !== void 0 ? opts.instanceId : sources.instanceId,
     arm: opts.arm !== void 0 ? opts.arm : basename16(runDir),
     workers: sources.workers !== null && coordination.present ? workerSources(sources.workers, coordination) : sources.workers,
     ...sources.journal !== null ? {
-      rootTranscriptRef: join31(runDir, SPAWN_JOURNAL_FILE),
+      rootTranscriptRef: join27(runDir, SPAWN_JOURNAL_FILE),
       traceCommand: `traces watch ${runDir}`
     } : {}
   };
@@ -18966,7 +17038,7 @@ function fileRunContextSupervisorRunReader(runDir, opts = {}) {
   return { runRef: runDir, read: () => readFileRunContext(runDir, opts) };
 }
 async function isFileRunContextDir(runDir) {
-  return stat16(join31(runDir, SPAWN_JOURNAL_FILE)).then((s) => s.isFile()).catch(() => false);
+  return stat16(join27(runDir, SPAWN_JOURNAL_FILE)).then((s) => s.isFile()).catch(() => false);
 }
 function parseJsonObject(text2) {
   if (text2 === null) return null;
@@ -19032,9 +17104,9 @@ function mergeRolls(a, b) {
   };
 }
 async function readRunContextSnapshot(runDir) {
-  const journal = readRunContextJournal(await readMaybe(join31(runDir, SPAWN_JOURNAL_FILE)));
-  const coordination = readCoordinationLog(await readMaybe(join31(runDir, COORDINATION_LOG_FILE)));
-  const resultText = await readMaybe(join31(runDir, RESULT_FILE));
+  const journal = readRunContextJournal(await readMaybe(join27(runDir, SPAWN_JOURNAL_FILE)));
+  const coordination = readCoordinationLog(await readMaybe(join27(runDir, COORDINATION_LOG_FILE)));
+  const resultText = await readMaybe(join27(runDir, RESULT_FILE));
   const result = parseResult(resultText);
   const view = safeTreeView(journal.events);
   const nodes = view === null ? [] : orderNodes(view, journal);
@@ -19217,7 +17289,7 @@ function wrap(text2, indent) {
 
 // src/run-span-tree.ts
 import { readdir as readdir18 } from "fs/promises";
-import { join as join32 } from "path";
+import { join as join28 } from "path";
 import {
   firstNumberAttr as firstNumberAttr3,
   LLM_COST_ATTR_KEYS as LLM_COST_ATTR_KEYS2,
@@ -19492,7 +17564,7 @@ async function findSpanSourceFiles(dir) {
   const found = [];
   const entries = await readdir18(dir, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
-    const child = join32(dir, entry.name);
+    const child = join28(dir, entry.name);
     if (entry.isFile()) {
       if (SPAN_FILE_PATTERN.test(entry.name)) found.push(child);
       continue;
@@ -19500,7 +17572,7 @@ async function findSpanSourceFiles(dir) {
     if (!entry.isDirectory()) continue;
     const nested = await readdir18(child, { withFileTypes: true }).catch(() => []);
     for (const inner of nested) {
-      if (inner.isFile() && SPAN_FILE_PATTERN.test(inner.name)) found.push(join32(child, inner.name));
+      if (inner.isFile() && SPAN_FILE_PATTERN.test(inner.name)) found.push(join28(child, inner.name));
     }
   }
   return found.sort();
@@ -19508,7 +17580,7 @@ async function findSpanSourceFiles(dir) {
 
 // src/supervisor-run-watch.ts
 import { readdir as readdir19 } from "fs/promises";
-import { join as join33 } from "path";
+import { join as join29 } from "path";
 function budget(node) {
   const parts = [`${int(node.budget.maxIterations)}it`, `${int(node.budget.maxTokens)}tok`];
   if (node.budget.maxUsd !== void 0) parts.push(`$${node.budget.maxUsd.toFixed(2)}`);
@@ -19652,7 +17724,7 @@ async function resolveRunContextDir(dir) {
   const candidates = [];
   for (const entry of entries) {
     if (!entry.isDirectory()) continue;
-    const child = join33(dir, entry.name);
+    const child = join29(dir, entry.name);
     if (await isFileRunContextDir(child)) candidates.push(child);
   }
   if (candidates.length === 1) return candidates[0];
@@ -19988,7 +18060,7 @@ function parseJsonAnswer(text2) {
 
 // src/ask.ts
 import { mkdir as mkdir6, readFile as readFile15, writeFile as writeFile10 } from "fs/promises";
-import { join as join34, resolve as resolve11 } from "path";
+import { join as join30, resolve as resolve11 } from "path";
 import { performance } from "perf_hooks";
 import { CostCeilingReachedError, CostLedger } from "@tangle-network/agent-eval";
 import {
@@ -20543,8 +18615,8 @@ async function writeTraceQuestionsArtifacts(result, outDir) {
   await mkdir6(directory, { recursive: true });
   const paths = {
     directory,
-    result: join34(directory, "answers.json"),
-    report: join34(directory, "report.md"),
+    result: join30(directory, "answers.json"),
+    report: join30(directory, "report.md"),
     traces: result.otlpPath
   };
   const { report, ...machine } = result;
@@ -20606,9 +18678,9 @@ async function watchSessions(opts) {
 }
 
 // src/bundle-view.ts
-import { createHash as createHash17 } from "crypto";
+import { createHash as createHash16 } from "crypto";
 import { mkdir as mkdir7, readdir as readdir20, readFile as readFile16, writeFile as writeFile11 } from "fs/promises";
-import { dirname as dirname11, join as join35, resolve as resolve12 } from "path";
+import { dirname as dirname11, join as join31, resolve as resolve12 } from "path";
 var EVIDENCE_ONLY_ALLOW_LIST = [
   {
     path: "derived/session-index.json",
@@ -20732,7 +18804,7 @@ async function findSessionTextLeaks(opts) {
   const index = /* @__PURE__ */ new Map();
   const carried = [];
   for (const path of opts.carriedPaths) {
-    const signatures = sessionTextSignatures(await readFile16(join35(opts.viewDir, path), "utf8"));
+    const signatures = sessionTextSignatures(await readFile16(join31(opts.viewDir, path), "utf8"));
     carried.push({ path, signatures: signatures.size });
     for (const signature of signatures) if (!index.has(signature)) index.set(signature, path);
   }
@@ -20740,7 +18812,7 @@ async function findSessionTextLeaks(opts) {
   const comparedSources = [];
   let sourceSignatures = 0;
   for (const sourcePath of opts.excludedPaths) {
-    const signatures = sessionTextSignatures(await readFile16(join35(opts.sourceDir, sourcePath), "utf8"));
+    const signatures = sessionTextSignatures(await readFile16(join31(opts.sourceDir, sourcePath), "utf8"));
     comparedSources.push(sourcePath);
     sourceSignatures += signatures.size;
     for (const signature of signatures) {
@@ -20799,17 +18871,17 @@ async function projectSessionBundle(opts) {
   const candidates = [];
   for (const path of await listSessionBundleFiles(sourceDir)) {
     if (path === "manifest.json") continue;
-    const bytes = await readFile16(join35(sourceDir, path));
-    const sha2562 = createHash17("sha256").update(bytes).digest("hex");
+    const bytes = await readFile16(join31(sourceDir, path));
+    const sha2562 = createHash16("sha256").update(bytes).digest("hex");
     const recorded = sourceHashes.get(path);
     if (!recorded) {
       throw new Error(
-        `${join35(sourceDir, path)} is not listed in the bundle manifest \u2014 the bundle changed after assembly and cannot be projected; re-run \`traces bundle\``
+        `${join31(sourceDir, path)} is not listed in the bundle manifest \u2014 the bundle changed after assembly and cannot be projected; re-run \`traces bundle\``
       );
     }
     if (recorded.sha256 !== sha2562) {
       throw new Error(
-        `${join35(sourceDir, path)} does not match its manifest hash (${recorded.sha256} recorded, ${sha2562} on disk) \u2014 the bundle changed after assembly and cannot be projected; re-run \`traces bundle\``
+        `${join31(sourceDir, path)} does not match its manifest hash (${recorded.sha256} recorded, ${sha2562} on disk) \u2014 the bundle changed after assembly and cannot be projected; re-run \`traces bundle\``
       );
     }
     const verdict = classifyEvidenceOnlyPath(path);
@@ -20845,7 +18917,7 @@ async function projectSessionBundle(opts) {
       });
       continue;
     }
-    const target = join35(outDir, candidate.path);
+    const target = join31(outDir, candidate.path);
     await mkdir7(dirname11(target), { recursive: true });
     await writeFile11(target, candidate.bytes);
     carriedPaths.push(candidate.path);
@@ -20862,7 +18934,7 @@ async function projectSessionBundle(opts) {
     })),
     matches: 0
   };
-  const sourceManifestBytes = await readFile16(join35(sourceDir, "manifest.json"));
+  const sourceManifestBytes = await readFile16(join31(sourceDir, "manifest.json"));
   const manifest = {
     schemaVersion: 2,
     kind: "traces.session_bundle",
@@ -20876,7 +18948,7 @@ async function projectSessionBundle(opts) {
     knownLimits: [...source.knownLimits, ...EVIDENCE_ONLY_LIMITS],
     projection: {
       sourceDirectory: sourceDir,
-      sourceManifestSha256: createHash17("sha256").update(sourceManifestBytes).digest("hex"),
+      sourceManifestSha256: createHash16("sha256").update(sourceManifestBytes).digest("hex"),
       leakCheck
     }
   };
@@ -20887,11 +18959,11 @@ async function projectSessionBundle(opts) {
 // src/upload-state.ts
 import { mkdir as mkdir8, readFile as readFile17, writeFile as writeFile12 } from "fs/promises";
 import { homedir as homedir12 } from "os";
-import { dirname as dirname12, join as join36 } from "path";
+import { dirname as dirname12, join as join32 } from "path";
 import { contentHash } from "@tangle-network/agent-eval";
 function stateFile() {
-  const base = process.env.XDG_STATE_HOME ?? join36(homedir12(), ".local", "state");
-  return join36(base, "tangle-traces", "uploaded.json");
+  const base = process.env.XDG_STATE_HOME ?? join32(homedir12(), ".local", "state");
+  return join32(base, "tangle-traces", "uploaded.json");
 }
 function uploadKey(harness, sessionId) {
   return `${harness}:${sessionId}`;
@@ -20923,7 +18995,7 @@ function alreadyUploaded(state, harness, sessionId, hash2) {
 import { readFile as readFile18 } from "fs/promises";
 import { createRequire as createRequire2 } from "module";
 import { hostname as hostname2 } from "os";
-import { basename as basename17, join as join37 } from "path";
+import { basename as basename17, join as join33 } from "path";
 import { hostedClientFromEnv } from "@tangle-network/agent-eval/hosted";
 import { REDACTION_VERSION } from "@tangle-network/agent-eval/traces";
 var require2 = createRequire2(import.meta.url);
@@ -20947,7 +19019,7 @@ async function planUpload(opts = {}) {
 async function gitBranch(cwd) {
   if (!cwd) return void 0;
   try {
-    const head = await readFile18(join37(cwd, ".git", "HEAD"), "utf8");
+    const head = await readFile18(join33(cwd, ".git", "HEAD"), "utf8");
     const m = head.match(/^ref:\s*refs\/heads\/(.+)$/m);
     return m?.[1]?.trim();
   } catch {
@@ -21275,60 +19347,20 @@ export {
   hashSessionBundleFiles,
   writeSessionBundleManifest,
   readSessionBundleManifest,
+  verifySessionBundle,
   createBundleSourceReader,
   assertOutsideSourceBundle,
   isChatTrajectoryMessage,
   isChatTrajectory,
   chatTrajectoryToSpans,
   importCodeTraceBench,
-  parseRecordedReturncode,
-  parseObservationOutput,
-  deriveFailureSignature,
-  ingestCodeTraceBenchSteps,
+  DEFAULT_SANDBOX_BASE_URL,
   sandboxReplayBackend,
-  wrapActionForExec,
-  SandboxCounterfactualRunner,
-  replayVerify,
-  parseReplayVerifyArgs,
-  replayVerifyUsage,
-  cmdReplayVerify,
-  parseCorpusFlag,
-  SUBMIT_ACTION_SIGNATURE,
-  isSubmitAction,
-  readLabelEntries,
-  goldIncorrectSteps,
-  resolveCaseResources,
-  enumerateReplayableCases,
+  assertSandboxReachable,
   zaiChatCaller,
-  clipText,
-  buildFixPrompt,
-  buildRetryFixPrompt,
-  countScriptCommands,
-  extractFixCommand,
-  generateFixCommand,
-  runFixLoop,
-  derivedImageTag,
-  dockerImagePreparer,
-  seededSample,
-  runReplayBatch,
-  renderBatchReport,
-  parseReplayBatchArgs,
-  replayBatchUsage,
+  cmdReplayVerify,
   cmdReplayVerifyBatch,
-  parseIncorrectStepsSubject,
-  resolveFindingInvocation,
-  replayVerifyFinding,
-  findingReplayStep,
-  findingTrajectoryId,
-  resolveFindingReplayability,
-  classifyVerdict,
-  DEFAULT_SANDBOX_BASE_URL,
-  assertSandboxReachable,
-  verifyFindings,
-  renderVerifiedFindingsSection,
-  readFindingsFile,
-  verifyFindingsUsage,
-  parseVerifyFindingsArgs,
+  verifyFindingsInSandbox,
   cmdVerifyFindings,
   writeHodoscopeInput,
   hodoscopeAnalyzer,