baro-ai 0.131.0 → 0.132.0

package/dist/cli.mjs

@@ -30070,8 +30070,8 @@ var require_cross_spawn = __commonJS({
 
 // ../baro-memory/dist/vectra-store.js
 import { LocalIndex } from "vectra";
-import { readFileSync as readFileSync17, writeFileSync as writeFileSync8, mkdirSync as mkdirSync11, existsSync as existsSync16, renameSync as renameSync5, rmSync as rmSync4, readdirSync as readdirSync9, statSync as statSync8, lstatSync as lstatSync5 } from "fs";
-import { join as join25 } from "path";
+import { readFileSync as readFileSync17, writeFileSync as writeFileSync8, mkdirSync as mkdirSync11, existsSync as existsSync17, renameSync as renameSync5, rmSync as rmSync4, readdirSync as readdirSync9, statSync as statSync8, lstatSync as lstatSync5 } from "fs";
+import { join as join26 } from "path";
 import { tmpdir as tmpdir8, homedir as homedir7 } from "os";
 async function createMemoryStore(config2) {
   const cfg = { ...DEFAULTS, ...config2 };
@@ -30084,23 +30084,23 @@ async function createMemoryStore(config2) {
   if (cfg.disabled) {
     return new NoOpMemoryStore();
   }
-  const sessionPath = cfg.sessionPath || join25(tmpdir8(), `baro-memory-${process.pid}-${Date.now()}`);
+  const sessionPath = cfg.sessionPath || join26(tmpdir8(), `baro-memory-${process.pid}-${Date.now()}`);
   validateSessionPath(sessionPath);
   mkdirSync11(sessionPath, { recursive: true });
-  const indexPath = join25(sessionPath, "index");
+  const indexPath = join26(sessionPath, "index");
   mkdirSync11(indexPath, { recursive: true });
   const index = new LocalIndex(indexPath);
   if (!await index.isIndexCreated()) {
     await index.createIndex({ version: 1 });
   }
   const transformers = await import("@xenova/transformers");
-  transformers.env.cacheDir = process.env.TRANSFORMERS_CACHE || join25(homedir7(), ".baro", "models");
+  transformers.env.cacheDir = process.env.TRANSFORMERS_CACHE || join26(homedir7(), ".baro", "models");
   const { pipeline: pipeline2 } = transformers;
   const extractor = await pipeline2("feature-extraction", cfg.embeddingModel);
   return new VectraMemoryStore(index, extractor, sessionPath, cfg);
 }
 function validateSessionPath(sessionPath) {
-  const resolved = join25(sessionPath);
+  const resolved = join26(sessionPath);
   if (resolved.includes("..")) {
     throw new Error(`Invalid session path (contains ..): ${resolved}`);
   }
@@ -30118,13 +30118,13 @@ function validateSessionPath(sessionPath) {
 }
 function pruneOldSessions(sessionsDir) {
   try {
-    if (!existsSync16(sessionsDir))
+    if (!existsSync17(sessionsDir))
       return;
     const now = Date.now();
     for (const entry of readdirSync9(sessionsDir)) {
       if (!entry.startsWith("run-"))
         continue;
-      const entryPath = join25(sessionsDir, entry);
+      const entryPath = join26(sessionsDir, entry);
       try {
         const stat3 = lstatSync5(entryPath);
         if (stat3.isSymbolicLink())
@@ -30181,10 +30181,10 @@ var init_vectra_store = __esm({
         this.index = index;
         this.extractor = extractor;
         this.sessionPath = sessionPath;
-        this.indexPath = join25(sessionPath, "index");
-        this.indexFilePath = join25(this.indexPath, "index.json");
-        this.cachePath = join25(sessionPath, "cache.json");
-        this.lockPath = join25(sessionPath, "cache.lock");
+        this.indexPath = join26(sessionPath, "index");
+        this.indexFilePath = join26(this.indexPath, "index.json");
+        this.cachePath = join26(sessionPath, "cache.json");
+        this.lockPath = join26(sessionPath, "cache.lock");
         this.config = config2;
       }
       /**
@@ -30196,7 +30196,7 @@ var init_vectra_store = __esm({
        */
       refreshIndexIfChanged() {
         try {
-          if (!existsSync16(this.indexFilePath))
+          if (!existsSync17(this.indexFilePath))
             return;
           const mtimeMs = statSync8(this.indexFilePath).mtimeMs;
           if (mtimeMs === this.lastIndexMtimeMs)
@@ -30410,7 +30410,7 @@ ${result.content}
        */
       loadCache() {
         try {
-          if (existsSync16(this.cachePath)) {
+          if (existsSync17(this.cachePath)) {
             const raw = readFileSync17(this.cachePath, "utf-8");
             if (raw.trim()) {
               return JSON.parse(raw);
@@ -30437,7 +30437,7 @@ ${result.content}
           }
         } finally {
           try {
-            if (existsSync16(this.lockPath))
+            if (existsSync17(this.lockPath))
               rmSync4(this.lockPath);
           } catch {
           }
@@ -30496,13 +30496,13 @@ var init_dist2 = __esm({
 });
 
 // ../baro-orchestrator/scripts/cli.ts
-import { existsSync as existsSync22, readFileSync as readFileSync23 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync23 } from "fs";
 import { resolve as resolve19 } from "path";
 
 // ../baro-orchestrator/src/orchestrate.ts
-import { existsSync as existsSync21, mkdirSync as mkdirSync16, mkdtempSync as mkdtempSync5, rmSync as rmSync8 } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync16, mkdtempSync as mkdtempSync5, rmSync as rmSync8 } from "fs";
 import { homedir as homedir10, hostname as hostname2, tmpdir as tmpdir14 } from "os";
-import { dirname as dirname14, join as join33 } from "path";
+import { dirname as dirname14, join as join34 } from "path";
 import { fileURLToPath } from "url";
 import { randomUUID as randomUUID10 } from "crypto";
 
@@ -65384,7 +65384,7 @@ var EventProcessor = class {
   }
 };
 function createJoin(resolveRuntime) {
-  return function join34(participant) {
+  return function join35(participant) {
     resolveRuntime().join(participant);
   };
 }
@@ -67175,7 +67175,7 @@ function defineRuntime() {
     }
     return participant;
   }
-  const join34 = createJoin(resolveRuntime);
+  const join35 = createJoin(resolveRuntime);
   const leave = createLeave(resolveRuntime);
   const sendMessage = createSendMessage(resolveRuntime);
   const sendEvent = createSendEvent(resolveRuntime);
@@ -67184,7 +67184,7 @@ function defineRuntime() {
     initializeRuntime,
     resolveRuntime,
     resolveParticipant,
-    join: join34,
+    join: join35,
     leave,
     sendMessage,
     sendEvent,
@@ -71308,13 +71308,13 @@ function extractStderr(e2) {
 
 // ../baro-orchestrator/src/integration/dependency-materializer.ts
 import { createHash as createHash7 } from "crypto";
-import { existsSync as existsSync10, readdirSync as readdirSync4, readFileSync as readFileSync11, symlinkSync } from "fs";
+import { existsSync as existsSync11, readdirSync as readdirSync4, readFileSync as readFileSync11, symlinkSync } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join14, relative as relative6, resolve as resolve9 } from "path";
+import { join as join15, relative as relative6, resolve as resolve9 } from "path";
 
 // ../baro-orchestrator/src/verification/verify.ts
-import { existsSync as existsSync9, lstatSync as lstatSync2, readdirSync as readdirSync3, readFileSync as readFileSync10, realpathSync as realpathSync6, statSync as statSync5 } from "fs";
-import { isAbsolute as isAbsolute4, join as join13, relative as relative5, resolve as resolve8, sep as sep3 } from "path";
+import { existsSync as existsSync10, lstatSync as lstatSync2, readdirSync as readdirSync3, readFileSync as readFileSync10, realpathSync as realpathSync6, statSync as statSync5 } from "fs";
+import { isAbsolute as isAbsolute4, join as join14, relative as relative5, resolve as resolve8, sep as sep3 } from "path";
 
 // ../baro-orchestrator/src/harness/liveness.ts
 function envSecs(name, fallbackSecs) {
@@ -71647,7 +71647,7 @@ function javascriptPackageDirs(root) {
   }
 }
 function changedPathsSince(cwd, base) {
-  const git2 = (args) => execFileSync2("git", args, {
+  const git3 = (args) => execFileSync2("git", args, {
     cwd,
     encoding: "utf8",
     stdio: ["ignore", "pipe", "ignore"],
@@ -71656,10 +71656,10 @@ function changedPathsSince(cwd, base) {
   });
   try {
     const paths = /* @__PURE__ */ new Set();
-    for (const line of git2(["diff", "--name-only", "-z", base]).split("\0")) {
+    for (const line of git3(["diff", "--name-only", "-z", base]).split("\0")) {
       if (line) paths.add(line);
     }
-    for (const line of git2(["ls-files", "--others", "--exclude-standard", "-z"]).split("\0")) {
+    for (const line of git3(["ls-files", "--others", "--exclude-standard", "-z"]).split("\0")) {
       if (line) paths.add(line);
     }
     return [...paths];
@@ -71686,17 +71686,52 @@ function scopeCommandsToChange(commands, paths, root, env = process.env) {
   return { run: run2, notAffected };
 }
 
+// ../baro-orchestrator/src/verification/lockfile-guard.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { existsSync as existsSync4 } from "fs";
+import { join as join6 } from "path";
+var LOCKFILES = ["package-lock.json", "npm-shrinkwrap.json", "pnpm-lock.yaml", "yarn.lock"];
+function git(cwd, args) {
+  try {
+    return execFileSync3("git", args, {
+      cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 15e3
+    });
+  } catch {
+    return null;
+  }
+}
+function pristineLockfiles(cwd) {
+  const changed = git(cwd, ["status", "--porcelain", "-z", "--untracked-files=all"]);
+  if (changed === null) return [];
+  const paths = changed.split("\0").filter(Boolean).map((entry) => entry.slice(3));
+  if (paths.some((path7) => path7 === "package.json" || path7.endsWith("/package.json"))) return [];
+  return LOCKFILES.filter(
+    (file) => existsSync4(join6(cwd, file)) && !paths.includes(file) && git(cwd, ["ls-files", "--error-unmatch", "--", file]) !== null
+  );
+}
+function restoreLockfiles(cwd, pristine) {
+  const restored = [];
+  for (const file of pristine) {
+    if (git(cwd, ["diff", "--quiet", "HEAD", "--", file]) !== null) continue;
+    if (git(cwd, ["checkout", "HEAD", "--", file]) !== null) restored.push(file);
+  }
+  return restored;
+}
+
 // ../baro-orchestrator/src/verification/command-cwd.ts
-import { existsSync as existsSync5 } from "fs";
-import { dirname as dirname5, isAbsolute as isAbsolute2, join as join7, relative as relative2, resolve as resolve5, sep } from "path";
+import { existsSync as existsSync6 } from "fs";
+import { dirname as dirname5, isAbsolute as isAbsolute2, join as join8, relative as relative2, resolve as resolve5, sep } from "path";
 
 // ../baro-orchestrator/src/integration/integration-worktree.ts
-import { existsSync as existsSync4, readdirSync as readdirSync2, realpathSync as realpathSync3, rmSync, rmdirSync } from "fs";
+import { existsSync as existsSync5, readdirSync as readdirSync2, realpathSync as realpathSync3, rmSync, rmdirSync } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { basename as basename6, dirname as dirname4, join as join6, resolve as resolve4 } from "path";
+import { basename as basename6, dirname as dirname4, join as join7, resolve as resolve4 } from "path";
 var INTEGRATION_WORKTREE_DIRNAME = "__run";
 function integrationWorktreePath(runId, repoRoot) {
-  return join6(
+  return join7(
     tmpdir2(),
     "baro-worktrees",
     runId,
@@ -71738,28 +71773,28 @@ var IntegrationWorktree = class {
     const { goalBranch } = this.opts;
     const release = await this.opts.gitGate.acquire();
     try {
-      await git(["worktree", "prune"], repoRoot);
-      const hostBranchAtStart = await git(["branch", "--show-current"], repoRoot) || null;
-      const hostHeadAtStart = await git(["rev-parse", "HEAD"], repoRoot);
-      const startPoint = this.opts.baseRef ? await git(["rev-parse", "--verify", `${this.opts.baseRef}^{commit}`], repoRoot) : hostHeadAtStart;
+      await git2(["worktree", "prune"], repoRoot);
+      const hostBranchAtStart = await git2(["branch", "--show-current"], repoRoot) || null;
+      const hostHeadAtStart = await git2(["rev-parse", "HEAD"], repoRoot);
+      const startPoint = this.opts.baseRef ? await git2(["rev-parse", "--verify", `${this.opts.baseRef}^{commit}`], repoRoot) : hostHeadAtStart;
       const registered = await this.isRegistered();
       let reused = false;
-      if (registered && existsSync4(integrationRoot)) {
-        const branch = await git(["branch", "--show-current"], integrationRoot).catch((error) => {
+      if (registered && existsSync5(integrationRoot)) {
+        const branch = await git2(["branch", "--show-current"], integrationRoot).catch((error) => {
           if (isRepositoryCommandTimeout(error)) throw error;
           return null;
         });
         reused = branch === goalBranch;
       }
       if (!reused) {
-        if (registered || existsSync4(integrationRoot)) {
+        if (registered || existsSync5(integrationRoot)) {
           await gitQuiet(["worktree", "remove", "--force", integrationRoot], repoRoot);
-          if (existsSync4(integrationRoot)) {
+          if (existsSync5(integrationRoot)) {
             rmSync(integrationRoot, { recursive: true, force: true });
           }
-          await git(["worktree", "prune"], repoRoot);
+          await git2(["worktree", "prune"], repoRoot);
         }
-        const branchExists = await git(
+        const branchExists = await git2(
           ["show-ref", "--verify", "--quiet", `refs/heads/${goalBranch}`],
           repoRoot
         ).then(
@@ -71770,7 +71805,7 @@ var IntegrationWorktree = class {
           }
         );
         if (branchExists) await this.releaseStaleHolders(goalBranch);
-        await git(
+        await git2(
           branchExists ? ["worktree", "add", integrationRoot, goalBranch] : ["worktree", "add", "-b", goalBranch, integrationRoot, startPoint],
           repoRoot
         );
@@ -71783,7 +71818,7 @@ var IntegrationWorktree = class {
       } else {
         this.log(`[git] local-only; not pushing ${goalBranch}`);
       }
-      const baseSha = await git(["rev-parse", "HEAD"], integrationRoot);
+      const baseSha = await git2(["rev-parse", "HEAD"], integrationRoot);
       this.prepared = {
         integrationRoot,
         baseSha,
@@ -71810,12 +71845,12 @@ var IntegrationWorktree = class {
     try {
       release = await this.opts.gitGate.acquire();
       await gitQuiet(["worktree", "remove", "--force", integrationRoot], repoRoot);
-      if (existsSync4(integrationRoot)) {
+      if (existsSync5(integrationRoot)) {
         rmSync(integrationRoot, { recursive: true, force: true });
       }
       await gitQuiet(["worktree", "prune"], repoRoot);
       for (const dir of [dirname4(integrationRoot), dirname4(dirname4(integrationRoot))]) {
-        if (existsSync4(dir) && readdirSync2(dir).length === 0) rmdirSync(dir);
+        if (existsSync5(dir) && readdirSync2(dir).length === 0) rmdirSync(dir);
       }
     } catch (error) {
       this.log(
@@ -71849,7 +71884,7 @@ var IntegrationWorktree = class {
     let release = null;
     try {
       release = await this.opts.gitGate.acquire();
-      const current = await git(["branch", "--show-current"], repoRoot);
+      const current = await git2(["branch", "--show-current"], repoRoot);
       if (!prepared.hostBranchAtStart || current !== prepared.hostBranchAtStart) {
         return untouched(
           "not_on_base_branch",
@@ -71868,13 +71903,13 @@ var IntegrationWorktree = class {
           `uncommitted changes on [${paths.join(", ")}]; merge ${goalBranch} manually`
         );
       }
-      const head = await git(["rev-parse", "HEAD"], repoRoot);
-      const goalSha = await git(["rev-parse", `refs/heads/${goalBranch}`], repoRoot);
+      const head = await git2(["rev-parse", "HEAD"], repoRoot);
+      const goalSha = await git2(["rev-parse", `refs/heads/${goalBranch}`], repoRoot);
       if (head === goalSha) {
         return untouched("up_to_date", `${current} already at ${goalBranch}`);
       }
       try {
-        await git(["merge-base", "--is-ancestor", head, goalSha], repoRoot);
+        await git2(["merge-base", "--is-ancestor", head, goalSha], repoRoot);
       } catch (error) {
         if (!(error instanceof RepositoryCommandError) || error.code !== 1) throw error;
         return untouched(
@@ -71882,7 +71917,7 @@ var IntegrationWorktree = class {
           `${current} has diverged from ${goalBranch}`
         );
       }
-      await git(["merge", "--ff-only", goalSha], repoRoot);
+      await git2(["merge", "--ff-only", goalSha], repoRoot);
       return { kind: "fast_forwarded", from: head, to: goalSha };
     } catch (error) {
       return untouched("error", errMsg(error));
@@ -71898,7 +71933,7 @@ var IntegrationWorktree = class {
    * the user's and stays, with git's own error.
    */
   async releaseStaleHolders(goalBranch) {
-    const listing = await git(["worktree", "list", "--porcelain"], this.repoRoot);
+    const listing = await git2(["worktree", "list", "--porcelain"], this.repoRoot);
     const own = canonicalPath(this.integrationRoot);
     for (const entry of listing.split(/\n\s*\n/u)) {
       const lines = entry.split("\n");
@@ -71908,17 +71943,17 @@ var IntegrationWorktree = class {
       if (canonicalPath(path7) === own || !isIntegrationWorktreeRoot(path7)) continue;
       this.log(`[integration] releasing ${goalBranch} from a stopped run's worktree ${path7}`);
       await gitQuiet(["worktree", "remove", "--force", path7], this.repoRoot);
-      if (existsSync4(path7)) rmSync(path7, { recursive: true, force: true });
+      if (existsSync5(path7)) rmSync(path7, { recursive: true, force: true });
     }
-    await git(["worktree", "prune"], this.repoRoot);
+    await git2(["worktree", "prune"], this.repoRoot);
   }
   async isRegistered() {
-    const listing = await git(["worktree", "list", "--porcelain"], this.repoRoot);
+    const listing = await git2(["worktree", "list", "--porcelain"], this.repoRoot);
     const target = canonicalPath(this.integrationRoot);
     return listing.split("\n").filter((line) => line.startsWith("worktree ")).some((line) => canonicalPath(line.slice("worktree ".length)) === target);
   }
 };
-async function git(args, cwd) {
+async function git2(args, cwd) {
   const { stdout } = await runRepositoryCommand("git", args, { cwd });
   return stdout.trim();
 }
@@ -71935,7 +71970,7 @@ function canonicalPath(path7) {
     return realpathSync3(absolute);
   } catch {
     const parent = dirname4(absolute);
-    return parent === absolute ? absolute : join6(canonicalPath(parent), basename6(absolute));
+    return parent === absolute ? absolute : join7(canonicalPath(parent), basename6(absolute));
   }
 }
 function untouched(reason, detail) {
@@ -71975,10 +72010,10 @@ function remappableWorktreeRoot(runCwd, candidate) {
   const at = parts.lastIndexOf("baro-worktrees");
   if (at < 0 || parts.length < at + 4) return null;
   const root = parts.slice(0, at + 4).join(sep);
-  return sameDirectory(dirname5(dirname5(root)), dirname5(dirname5(runCwd))) || !existsSync5(root) ? root : null;
+  return sameDirectory(dirname5(dirname5(root)), dirname5(dirname5(runCwd))) || !existsSync6(root) ? root : null;
 }
 function integrationCwdResolver(integrationRoot, repoRoot) {
-  return () => existsSync5(integrationRoot) ? integrationRoot : repoRoot;
+  return () => existsSync6(integrationRoot) ? integrationRoot : repoRoot;
 }
 function spawnRunCwd(cwd, hostRepoRoot, resolveRunCwd) {
   if (resolveRunCwd) return resolveRunCwd();
@@ -71998,8 +72033,8 @@ function resolveCommandCwd(runCwd, commandCwd) {
   }
   const worktreeRoot = remappableWorktreeRoot(runCanonical, canonical);
   if (worktreeRoot) {
-    const remapped = join7(runCwd, relative2(worktreeRoot, canonical));
-    if (existsSync5(remapped)) return remapped;
+    const remapped = join8(runCwd, relative2(worktreeRoot, canonical));
+    if (existsSync6(remapped)) return remapped;
   }
   return runCwd;
 }
@@ -72007,14 +72042,14 @@ function resolveCommandCwd(runCwd, commandCwd) {
 // ../baro-orchestrator/src/verification/command-timing.ts
 import { createHash as createHash5, randomUUID as randomUUID3 } from "crypto";
 import { mkdirSync as mkdirSync4, readFileSync as readFileSync6, realpathSync as realpathSync4, renameSync as renameSync2, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname6, join as join9, relative as relative3, resolve as resolve6 } from "path";
+import { dirname as dirname6, join as join10, relative as relative3, resolve as resolve6 } from "path";
 
 // ../baro-orchestrator/src/runtime/baro-home.ts
 import { homedir as homedir3 } from "os";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 function baroHome() {
   const override = process.env.BARO_HOME;
-  return override ? override : join8(homedir3(), ".baro");
+  return override ? override : join9(homedir3(), ".baro");
 }
 
 // ../baro-orchestrator/src/verification/command-timing.ts
@@ -72024,7 +72059,7 @@ function commandKey(cmd, root) {
   return `${rel || "."}::${[cmd.tool, ...cmd.args].join(" ")}`;
 }
 function timingsFile() {
-  return join9(baroHome(), "verification-timings.json");
+  return join10(baroHome(), "verification-timings.json");
 }
 function repoId(repoRoot) {
   let canonical = resolve6(repoRoot);
@@ -72058,7 +72093,7 @@ function recordTiming(repoRoot, key, ms) {
 }
 function declaredTimeoutsSecs(root) {
   try {
-    const pkg = JSON.parse(readFileSync6(join9(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync6(join10(root, "package.json"), "utf8"));
     const raw = pkg.baro?.verification?.commandTimeoutsSecs;
     if (!raw || typeof raw !== "object") return {};
     const out = {};
@@ -72097,25 +72132,25 @@ function createCeilingResolver(root, repoRoot, floorMs) {
 
 // ../baro-orchestrator/src/verification/jvm-commands.ts
 import { spawnSync } from "child_process";
-import { accessSync, constants, existsSync as existsSync6, statSync as statSync2 } from "fs";
-import { delimiter, join as join10 } from "path";
+import { accessSync, constants, existsSync as existsSync7, statSync as statSync2 } from "fs";
+import { delimiter, join as join11 } from "path";
 function detectJvmCommands(cwd, probe2 = {}) {
   const platform = probe2.platform ?? process.platform;
   const env = probe2.env ?? process.env;
   const windows = platform === "win32";
   const hasBuildFile = [...MAVEN_FILES, ...GRADLE_FILES].some(
-    (name) => existsSync6(join10(cwd, name))
+    (name) => existsSync7(join11(cwd, name))
   );
   if (!hasBuildFile) return [];
   if (!(probe2.javaRuns ?? javaRuns)(env)) return [];
   const commands = [];
-  if (MAVEN_FILES.some((name) => existsSync6(join10(cwd, name)))) {
+  if (MAVEN_FILES.some((name) => existsSync7(join11(cwd, name)))) {
     const tool = wrapperOrTool(cwd, windows ? "mvnw.cmd" : "mvnw", "mvn", env, windows);
     if (tool) {
       commands.push({ label: "mvn test", tool, args: ["-B", "test"] });
     }
   }
-  if (GRADLE_FILES.some((name) => existsSync6(join10(cwd, name)))) {
+  if (GRADLE_FILES.some((name) => existsSync7(join11(cwd, name)))) {
     const tool = wrapperOrTool(cwd, windows ? "gradlew.bat" : "gradlew", "gradle", env, windows);
     if (tool) {
       commands.push({
@@ -72135,7 +72170,7 @@ var GRADLE_FILES = [
   "settings.gradle.kts"
 ];
 function javaRuns(env) {
-  const java = env.JAVA_HOME ? join10(env.JAVA_HOME, "bin", "java") : "java";
+  const java = env.JAVA_HOME ? join11(env.JAVA_HOME, "bin", "java") : "java";
   try {
     return spawnSync(java, ["-version"], {
       env,
@@ -72183,20 +72218,20 @@ var JVM_BUILDS = [
   }
 ];
 function isMavenRepository(cwd) {
-  return MAVEN_FILES.some((name) => existsSync6(join10(cwd, name)));
+  return MAVEN_FILES.some((name) => existsSync7(join11(cwd, name)));
 }
 function isGradleRepository(cwd) {
-  return GRADLE_FILES.some((name) => existsSync6(join10(cwd, name)));
+  return GRADLE_FILES.some((name) => existsSync7(join11(cwd, name)));
 }
 function wrapperOrTool(cwd, wrapper, tool, env, windows) {
-  if (isFile(join10(cwd, wrapper))) return windows ? `.\\${wrapper}` : `./${wrapper}`;
+  if (isFile(join11(cwd, wrapper))) return windows ? `.\\${wrapper}` : `./${wrapper}`;
   return onPath(tool, env, windows) ? tool : null;
 }
 function onPath(tool, env, windows) {
   const dirs = (env.PATH ?? env.Path ?? "").split(windows ? ";" : delimiter);
   const names = windows ? [`${tool}.cmd`, `${tool}.bat`, `${tool}.exe`] : [tool];
   return dirs.some(
-    (dir) => dir.length > 0 && names.some((name) => isExecutable(join10(dir, name), windows))
+    (dir) => dir.length > 0 && names.some((name) => isExecutable(join11(dir, name), windows))
   );
 }
 function isFile(path7) {
@@ -72374,13 +72409,13 @@ function formatDeclaredBudgetEvidence(evidence) {
 
 // ../baro-orchestrator/src/verification/declared-verification.ts
 import {
-  existsSync as existsSync7,
+  existsSync as existsSync8,
   readFileSync as readFileSync7,
   realpathSync as realpathSync5,
   statSync as statSync3
 } from "fs";
 import { createHash as createHash6 } from "crypto";
-import { dirname as dirname7, isAbsolute as isAbsolute3, join as join11, relative as relative4, resolve as resolve7, sep as sep2 } from "path";
+import { dirname as dirname7, isAbsolute as isAbsolute3, join as join12, relative as relative4, resolve as resolve7, sep as sep2 } from "path";
 var MAX_COMMAND_LENGTH = 1e3;
 var SAFE_SCRIPT_NAME = /^[A-Za-z0-9_.:-]+$/;
 var TRUSTED_PACKAGE_SCRIPTS = /* @__PURE__ */ new Set(["build", "typecheck", "test", "lint"]);
@@ -72664,8 +72699,8 @@ function translateNpxRstest(cwd, requirement, parsed, managers) {
       "npx rstest focus paths contain an unsafe, non-path, or escaping value"
     );
   }
-  const manifestPath = join11(cwd, "package.json");
-  const manifest = existsSync7(manifestPath) ? readManifest(manifestPath) : null;
+  const manifestPath = join12(cwd, "package.json");
+  const manifest = existsSync8(manifestPath) ? readManifest(manifestPath) : null;
   if (!manifest || !exactRstestScript(manifest.scripts?.test)) {
     return incomplete(
       requirement,
@@ -72688,8 +72723,8 @@ function translateNpxRstest(cwd, requirement, parsed, managers) {
   };
 }
 function trustedScriptAlias(cwd, tokens2) {
-  const manifestPath = join11(cwd, "package.json");
-  if (!existsSync7(manifestPath)) return null;
+  const manifestPath = join12(cwd, "package.json");
+  if (!existsSync8(manifestPath)) return null;
   const manifest = readManifest(manifestPath);
   if (!manifest?.scripts) return null;
   const normalized = tokens2.join(" ");
@@ -72751,7 +72786,7 @@ function extractWorkspaceSelector(rest) {
 }
 function resolveWorkspaceAuthority(cwd, name, managers) {
   const declaredWorkspaces = readManifest(
-    join11(cwd, "package.json")
+    join12(cwd, "package.json")
   )?.workspaces;
   const packages = declaredWorkspaces?.packages;
   if (!Array.isArray(declaredWorkspaces) && !Array.isArray(packages)) {
@@ -72767,7 +72802,7 @@ function resolveWorkspaceAuthority(cwd, name, managers) {
   );
   if (byPath) return { authority: byPath };
   const byName = candidates.find(
-    (manager) => readManifest(join11(manager.cwd, "package.json"))?.name === name
+    (manager) => readManifest(join12(manager.cwd, "package.json"))?.name === name
   );
   if (byName) return { authority: byName };
   const known = [...new Set(candidates.map(repoRelative))].sort();
@@ -72782,7 +72817,7 @@ function resolveScriptWorkspace(cwd, script, managers, changedFiles) {
   })).sort((a, b) => a.rel < b.rel ? -1 : a.rel > b.rel ? 1 : 0);
   if (candidates.length === 0) return null;
   const declaring = candidates.filter(
-    (candidate) => typeof readManifest(join11(candidate.authority.cwd, "package.json"))?.scripts?.[script] === "string"
+    (candidate) => typeof readManifest(join12(candidate.authority.cwd, "package.json"))?.scripts?.[script] === "string"
   );
   if (declaring.length === 1) return declaring[0];
   if (declaring.length === 0) {
@@ -72862,8 +72897,8 @@ function translatePackage(cwd, requirement, parsed, managers) {
     }
     workspace = resolved.authority;
   }
-  const manifestPath = join11(workspace?.cwd ?? cwd, "package.json");
-  const manifest = existsSync7(manifestPath) ? readManifest(manifestPath) : null;
+  const manifestPath = join12(workspace?.cwd ?? cwd, "package.json");
+  const manifest = existsSync8(manifestPath) ? readManifest(manifestPath) : null;
   if (!manifest) {
     return incomplete(
       requirement,
@@ -72936,7 +72971,7 @@ function escapesRoot(cwd, candidate) {
   if (fromRoot === ".." || fromRoot.startsWith(`..${sep2}`) || isAbsolute3(fromRoot)) return true;
   try {
     let existingAncestor = absolute;
-    while (!existsSync7(existingAncestor)) {
+    while (!existsSync8(existingAncestor)) {
       const parent = dirname7(existingAncestor);
       if (parent === existingAncestor) return true;
       existingAncestor = parent;
@@ -72966,7 +73001,7 @@ function safeFocusedArg(cwd, value) {
   )) return false;
   const possiblePath = value.includes("=") ? value.slice(value.indexOf("=") + 1) : value;
   if (URI_SCHEME.test(value) || URI_SCHEME.test(possiblePath) || isAbsolute3(possiblePath) || /^[A-Za-z]:\//.test(possiblePath) || possiblePath.startsWith("@") || possiblePath.includes("://") || hasParentTraversal(possiblePath)) return false;
-  const pathLike = possiblePath.includes("/") || possiblePath.startsWith(".") || existsSync7(resolve7(cwd, possiblePath));
+  const pathLike = possiblePath.includes("/") || possiblePath.startsWith(".") || existsSync8(resolve7(cwd, possiblePath));
   return !(pathLike && escapesRoot(cwd, possiblePath));
 }
 function safeRstestFocusPath(cwd, value) {
@@ -73077,7 +73112,7 @@ function canonicalCargoArgs(tokens2) {
   return canonical;
 }
 function translateCargo(cwd, requirement, parsed) {
-  if (!existsSync7(join11(cwd, "Cargo.toml"))) {
+  if (!existsSync8(join12(cwd, "Cargo.toml"))) {
     return incomplete(
       requirement,
       "declared cargo test requires Cargo.toml at the repository root"
@@ -73212,7 +73247,7 @@ function containedPath(cwd, candidate, requireFile) {
   if (escapesRoot(cwd, candidate)) {
     return { reason: `declared node path resolves outside repository: '${candidate}'` };
   }
-  if (!existsSync7(absolute)) {
+  if (!existsSync8(absolute)) {
     return { reason: `declared node path does not exist: '${candidate}'` };
   }
   try {
@@ -73257,7 +73292,7 @@ function translateNode(cwd, requirement, parsed, manifestRoot = cwd) {
     flagArgs.push(flag, inlineValue);
     if (!token.includes("=")) index += 1;
   }
-  if (mode === void 0 && candidates.length === 1 && !existsSync7(join11(cwd, "package.json")) && !existsSync7(join11(manifestRoot, "package.json"))) {
+  if (mode === void 0 && candidates.length === 1 && !existsSync8(join12(cwd, "package.json")) && !existsSync8(join12(manifestRoot, "package.json"))) {
     const contained = containedPath(cwd, candidates[0], true);
     if (!contained.path) {
       return incomplete(
@@ -73326,7 +73361,7 @@ function translateComposer(cwd, requirement, parsed) {
   if (!SAFE_SCRIPT_NAME.test(script)) {
     return incomplete(requirement, `unsafe composer script name '${script}'`);
   }
-  const manifest = readJsonObject(join11(cwd, "composer.json"));
+  const manifest = readJsonObject(join12(cwd, "composer.json"));
   if (!manifest) {
     return incomplete(
       requirement,
@@ -73386,7 +73421,7 @@ function translatePytest(cwd, requirement, parsed) {
       return incomplete(requirement, contained.reason ?? `unsafe pytest path '${token}'`);
     }
     args.push([contained.path, ...nodeParts].join("::"));
-    containedPaths.push({ path: join11(cwd, contained.path), requireFile: false });
+    containedPaths.push({ path: join12(cwd, contained.path), requireFile: false });
   }
   return {
     label: parsed.normalized,
@@ -73407,7 +73442,7 @@ function translatePhpunit(cwd, requirement, parsed) {
   const rest = parsed.tokens.slice(1);
   const args = [];
   const containedPaths = [
-    { path: join11(cwd, binary.path), requireFile: true }
+    { path: join12(cwd, binary.path), requireFile: true }
   ];
   for (let index = 0; index < rest.length; index += 1) {
     const token = rest[index];
@@ -73440,7 +73475,7 @@ function translatePhpunit(cwd, requirement, parsed) {
       }
       args.push(token, contained.path);
       containedPaths.push({
-        path: join11(cwd, contained.path),
+        path: join12(cwd, contained.path),
         requireFile: true
       });
       index += 1;
@@ -73456,7 +73491,7 @@ function translatePhpunit(cwd, requirement, parsed) {
       }
       args.push(contained.path);
       containedPaths.push({
-        path: join11(cwd, contained.path),
+        path: join12(cwd, contained.path),
         requireFile: false
       });
       continue;
@@ -73468,7 +73503,7 @@ function translatePhpunit(cwd, requirement, parsed) {
   }
   return {
     label: ["vendor/bin/phpunit", ...rest].join(" "),
-    tool: join11(cwd, binary.path),
+    tool: join12(cwd, binary.path),
     args,
     containedPaths
   };
@@ -73486,7 +73521,7 @@ function translateDdev(cwd, requirement, parsed, packageManagers, insideDdev) {
   if (parsed.tokens.length < 3) {
     return incomplete(requirement, "ddev exec requires a command to run");
   }
-  if (!existsSync7(join11(cwd, ".ddev", "config.yaml"))) {
+  if (!existsSync8(join12(cwd, ".ddev", "config.yaml"))) {
     return incomplete(
       requirement,
       "declared ddev test requires .ddev/config.yaml in the repository root"
@@ -73532,12 +73567,12 @@ function message(error) {
 }
 
 // ../baro-orchestrator/src/verification/node-test-script.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
+import { join as join13 } from "path";
 function defaultReadPackageJson(cwd) {
   if (cwd === void 0) return null;
-  const path7 = join12(cwd, "package.json");
-  if (!existsSync8(path7)) return null;
+  const path7 = join13(cwd, "package.json");
+  if (!existsSync9(path7)) return null;
   try {
     return JSON.parse(readFileSync8(path7, "utf8"));
   } catch {
@@ -74032,9 +74067,9 @@ function malformedDeclaredPackageManager(value) {
 function detectPackageManager(cwd, manifest, hasPnpmWorkspace) {
   const declared = declaredPackageManager(manifest?.packageManager);
   if (declared) return declared.manager;
-  if (existsSync9(join13(cwd, "pnpm-lock.yaml")) || hasPnpmWorkspace) return "pnpm";
-  if (existsSync9(join13(cwd, "package-lock.json"))) return "npm";
-  if (existsSync9(join13(cwd, "yarn.lock"))) return "yarn";
+  if (existsSync10(join14(cwd, "pnpm-lock.yaml")) || hasPnpmWorkspace) return "pnpm";
+  if (existsSync10(join14(cwd, "package-lock.json"))) return "npm";
+  if (existsSync10(join14(cwd, "yarn.lock"))) return "yarn";
   return "npm";
 }
 function packageManagerCommand(pm, declared, script, trailingArgs = []) {
@@ -74066,8 +74101,8 @@ function workspacePatterns(workspaces) {
   return [];
 }
 function pnpmWorkspacePatterns(cwd) {
-  const path7 = join13(cwd, "pnpm-workspace.yaml");
-  if (!existsSync9(path7)) return [];
+  const path7 = join14(cwd, "pnpm-workspace.yaml");
+  if (!existsSync10(path7)) return [];
   const patterns = [];
   let inPackages = false;
   for (const line of readFileSync10(path7, "utf8").split(/\r?\n/)) {
@@ -74090,20 +74125,20 @@ function workspacePackageDirs(cwd, workspaces) {
   const addIfPackage = (candidate) => {
     const absolute = resolve8(candidate);
     const fromRoot = relative5(root, absolute);
-    if (fromRoot === "" || fromRoot === ".." || fromRoot.startsWith(`..${sep3}`) || isAbsolute4(fromRoot) || !existsSync9(join13(absolute, "package.json"))) return;
+    if (fromRoot === "" || fromRoot === ".." || fromRoot.startsWith(`..${sep3}`) || isAbsolute4(fromRoot) || !existsSync10(join14(absolute, "package.json"))) return;
     dirs.add(absolute);
   };
   for (const rawPattern of workspacePatterns(workspaces)) {
     const pattern = rawPattern.replace(/\\/g, "/").replace(/\/$/, "");
     if (!pattern.includes("*")) {
-      addIfPackage(join13(root, pattern));
+      addIfPackage(join14(root, pattern));
       continue;
     }
     if (!pattern.endsWith("/*") || pattern.slice(0, -2).includes("*")) continue;
-    const parent = join13(root, pattern.slice(0, -2));
-    if (!existsSync9(parent)) continue;
+    const parent = join14(root, pattern.slice(0, -2));
+    if (!existsSync10(parent)) continue;
     for (const entry of readdirSync3(parent, { withFileTypes: true })) {
-      if (entry.isDirectory()) addIfPackage(join13(parent, entry.name));
+      if (entry.isDirectory()) addIfPackage(join14(parent, entry.name));
     }
   }
   return [...dirs].sort();
@@ -74115,9 +74150,9 @@ function supportedWorkspacePattern(pattern) {
 function detectCommands(cwd) {
   const cmds = [];
   const javascriptPackageManagers = [];
-  const pkgPath = join13(cwd, "package.json");
-  const hasPackageManifest = existsSync9(pkgPath);
-  const hasPnpmWorkspace = existsSync9(join13(cwd, "pnpm-workspace.yaml"));
+  const pkgPath = join14(cwd, "package.json");
+  const hasPackageManifest = existsSync10(pkgPath);
+  const hasPnpmWorkspace = existsSync10(join14(cwd, "pnpm-workspace.yaml"));
   if (hasPackageManifest || hasPnpmWorkspace) {
     const manifest = hasPackageManifest ? readPackageManifest(pkgPath) : null;
     if (hasPackageManifest && !manifest) {
@@ -74175,7 +74210,7 @@ function detectCommands(cwd) {
     );
     const workspaces = workspaceDirs2.map((workspaceCwd) => ({
       cwd: workspaceCwd,
-      manifest: readPackageManifest(join13(workspaceCwd, "package.json"))
+      manifest: readPackageManifest(join14(workspaceCwd, "package.json"))
     }));
     if (!managerResolutionFailed) {
       const managerSnapshot = {
@@ -74221,11 +74256,11 @@ function detectCommands(cwd) {
       }
     }
   }
-  if (existsSync9(join13(cwd, "Cargo.toml"))) {
+  if (existsSync10(join14(cwd, "Cargo.toml"))) {
     cmds.push({ label: "cargo build", tool: "cargo", args: ["build"] });
     cmds.push({ label: "cargo test", tool: "cargo", args: ["test"] });
   }
-  if (existsSync9(join13(cwd, "go.mod"))) {
+  if (existsSync10(join14(cwd, "go.mod"))) {
     cmds.push({ label: "go build ./...", tool: "go", args: ["build", "./..."] });
     cmds.push({ label: "go test ./...", tool: "go", args: ["test", "./..."] });
   }
@@ -74233,18 +74268,18 @@ function detectCommands(cwd) {
   return { commands: cmds, javascriptPackageManagers };
 }
 function staleDependencyReasons(cwd) {
-  const pkgPath = join13(cwd, "package.json");
-  if (!existsSync9(pkgPath)) return [];
+  const pkgPath = join14(cwd, "package.json");
+  if (!existsSync10(pkgPath)) return [];
   const manifest = readPackageManifest(pkgPath);
   if (!manifest) return [];
   const reasons = [];
-  const nodeModules = join13(cwd, "node_modules");
+  const nodeModules = join14(cwd, "node_modules");
   const declaresDependencies = hasEntries(manifest.dependencies) || hasEntries(manifest.devDependencies);
   const workspaceDirs2 = workspacePackageDirs(cwd, [
     ...workspacePatterns(manifest.workspaces),
     ...pnpmWorkspacePatterns(cwd)
   ]);
-  if (!existsSync9(nodeModules)) {
+  if (!existsSync10(nodeModules)) {
     if (declaresDependencies || workspaceDirs2.length > 0) {
       reasons.push("node_modules is missing");
     }
@@ -74252,9 +74287,9 @@ function staleDependencyReasons(cwd) {
   }
   if (linkedOutOfTree(nodeModules, cwd)) return [];
   for (const dir of workspaceDirs2) {
-    const name = readPackageManifest(join13(dir, "package.json"))?.name;
+    const name = readPackageManifest(join14(dir, "package.json"))?.name;
     if (typeof name !== "string" || !name) continue;
-    if (!existsSync9(join13(nodeModules, name))) {
+    if (!existsSync10(join14(nodeModules, name))) {
       reasons.push(`workspace ${name} is not linked in node_modules`);
     }
   }
@@ -74262,12 +74297,12 @@ function staleDependencyReasons(cwd) {
     "node_modules/.package-lock.json",
     "node_modules/.modules.yaml",
     "node_modules/.yarn-integrity"
-  ].map((relativePath) => join13(cwd, relativePath)).find((path7) => existsSync9(path7));
+  ].map((relativePath) => join14(cwd, relativePath)).find((path7) => existsSync10(path7));
   if (marker) {
     const installedAt = statSync5(marker).mtimeMs;
     for (const file of ["package.json", "package-lock.json", "pnpm-lock.yaml", "yarn.lock"]) {
-      const path7 = join13(cwd, file);
-      if (existsSync9(path7) && statSync5(path7).mtimeMs > installedAt + 1e3) {
+      const path7 = join14(cwd, file);
+      if (existsSync10(path7) && statSync5(path7).mtimeMs > installedAt + 1e3) {
         reasons.push(`${file} changed after the last install`);
       }
     }
@@ -74287,9 +74322,9 @@ function hasEntries(value) {
   return typeof value === "object" && value !== null && Object.keys(value).length > 0;
 }
 function dependencyRefreshCommand(cwd, reasons) {
-  const manifest = readPackageManifest(join13(cwd, "package.json"));
+  const manifest = readPackageManifest(join14(cwd, "package.json"));
   const declared = declaredPackageManager(manifest?.packageManager);
-  const pm = detectPackageManager(cwd, manifest, existsSync9(join13(cwd, "pnpm-workspace.yaml")));
+  const pm = detectPackageManager(cwd, manifest, existsSync10(join14(cwd, "pnpm-workspace.yaml")));
   const yarnMajor = declared?.manager === "yarn" ? Number.parseInt(declared.version.match(/^\d+/)?.[0] ?? "", 10) : Number.NaN;
   const command = pm === "yarn" && yarnMajor >= 2 ? { tool: "corepack", args: ["yarn", "install"] } : pm === "npm" ? { tool: "npm", args: ["install", "--no-audit", "--no-fund"] } : { tool: pm, args: ["install"] };
   return {
@@ -74461,7 +74496,7 @@ function createVerifyPlan(cwd, options = {}) {
         origin: "declared"
       }))
     ],
-    (commandCwd) => readPackageManifest(join13(commandCwd ?? cwd, "package.json"))
+    (commandCwd) => readPackageManifest(join14(commandCwd ?? cwd, "package.json"))
   );
   return freezeVerifyPlan(
     boundedDeclaredCommands(
@@ -74703,7 +74738,7 @@ async function runCmd(cwd, c, hostRepoRoot, ceiling, signal, resolveRunCwd) {
     };
   }
   const commandCwd = resolveCommandCwd(spawnRunCwd(cwd, hostRepoRoot, resolveRunCwd), c.cwd);
-  if (!existsSync9(commandCwd)) {
+  if (!existsSync10(commandCwd)) {
     return {
       status: "failed",
       durationMs: 0,
@@ -74813,7 +74848,7 @@ async function applyRemedy(remedy, ctx) {
     spawnRunCwd(ctx.cwd, ctx.hostRepoRoot, ctx.options.resolveRunCwd),
     void 0
   ) : ctx.cwd;
-  if (!existsSync9(join13(cwd, "package.json"))) return;
+  if (!existsSync10(join14(cwd, "package.json"))) return;
   const install2 = dependencyRefreshCommand(cwd, [`retry remedy: ${ctx.reason}`]);
   await runCmd(
     cwd,
@@ -74849,6 +74884,7 @@ async function verifyBuild(cwd, options = {}) {
   if (stale.length > 0) {
     throwIfAborted(options.signal);
     const install2 = dependencyRefreshCommand(cwd, stale);
+    const pristine = pristineLockfiles(cwd);
     emitActivity({
       type: "activity",
       id: "_verify",
@@ -74874,6 +74910,15 @@ async function verifyBuild(cwd, options = {}) {
       ran = true;
       failures.push({ cmd: install2.label, tail: outcome.tail });
     }
+    const restored = restoreLockfiles(cwd, pristine);
+    if (restored.length > 0) {
+      emitActivity({
+        type: "activity",
+        id: "_verify",
+        kind: "warn",
+        text: `restored ${restored.join(", ")}: the dependency refresh rewrote it, and the change touched no package.json`
+      });
+    }
   }
   for (const c of scoped.run) {
     throwIfAborted(options.signal);
@@ -74981,7 +75026,7 @@ function creditSkippedDeclaredRequirements(specs, results) {
 // ../baro-orchestrator/src/integration/dependency-materializer.ts
 var LOCKFILE_NAMES = ["package-lock.json", "npm-shrinkwrap.json"];
 function npmCachePath(env = process.env) {
-  return env.npm_config_cache ?? env.NPM_CONFIG_CACHE ?? join14(homedir4(), ".npm");
+  return env.npm_config_cache ?? env.NPM_CONFIG_CACHE ?? join15(homedir4(), ".npm");
 }
 async function materializeDependencies(options) {
   const { hostRoot, integrationRoot } = options;
@@ -75001,7 +75046,7 @@ async function materializeDependencies(options) {
   const workspaces = [];
   let rootMatch = false;
   for (const dir of [root, ...workspaceDirs(root)]) {
-    const hostDir = join14(hostRoot, relative6(root, dir));
+    const hostDir = join15(hostRoot, relative6(root, dir));
     const match = lockfileMatch(dir, hostDir);
     if (dir === root) rootMatch = match === true;
     workspaces.push(await materializeWorkspace(dir, hostDir, match ?? rootMatch, runInstall));
@@ -75009,18 +75054,18 @@ async function materializeDependencies(options) {
   return { workspaces };
 }
 async function materializeWorkspace(dir, hostDir, match, runInstall) {
-  if (!existsSync10(join14(dir, "package.json"))) {
+  if (!existsSync11(join15(dir, "package.json"))) {
     return { dir, action: "skipped", reason: "no package.json" };
   }
-  const nodeModules = join14(dir, "node_modules");
-  const hostNodeModules = join14(hostDir, "node_modules");
-  if (match && existsSync10(hostNodeModules) && !existsSync10(nodeModules)) {
+  const nodeModules = join15(dir, "node_modules");
+  const hostNodeModules = join15(hostDir, "node_modules");
+  if (match && existsSync11(hostNodeModules) && !existsSync11(nodeModules)) {
     const linked = linkNodeModules(hostNodeModules, nodeModules);
     if (linked === "linked") return { dir, action: "linked", reason: "lockfile matches host" };
     if (linked === "exists") return alreadyPresent(dir);
     return install(dir, runInstall, "symlink unsupported");
   }
-  if (existsSync10(nodeModules)) return alreadyPresent(dir);
+  if (existsSync11(nodeModules)) return alreadyPresent(dir);
   return install(dir, runInstall, match ? "host has no node_modules" : "lockfile differs from host");
 }
 function alreadyPresent(dir) {
@@ -75080,8 +75125,8 @@ function nestedLockedPackages(root, depth = 3) {
     }
     for (const entry of entries) {
       if (!entry.isDirectory() || NESTED_SCAN_SKIP.has(entry.name) || entry.name.startsWith(".")) continue;
-      const child = join14(dir, entry.name);
-      if (existsSync10(join14(child, "package.json")) && LOCKFILE_NAMES.some((name) => existsSync10(join14(child, name)))) {
+      const child = join15(dir, entry.name);
+      if (existsSync11(join15(child, "package.json")) && LOCKFILE_NAMES.some((name) => existsSync11(join15(child, name)))) {
         found.push(child);
       }
       scan(child, left - 1);
@@ -75092,17 +75137,17 @@ function nestedLockedPackages(root, depth = 3) {
 }
 function readWorkspacesField(dir) {
   try {
-    const manifest = JSON.parse(readFileSync11(join14(dir, "package.json"), "utf8"));
+    const manifest = JSON.parse(readFileSync11(join15(dir, "package.json"), "utf8"));
     return manifest.workspaces;
   } catch {
     return void 0;
   }
 }
 function lockfileMatch(dir, hostDir) {
-  const name = LOCKFILE_NAMES.find((candidate) => existsSync10(join14(dir, candidate)));
+  const name = LOCKFILE_NAMES.find((candidate) => existsSync11(join15(dir, candidate)));
   if (!name) return null;
-  const local = sha256(join14(dir, name));
-  return local !== null && local === sha256(join14(hostDir, name));
+  const local = sha256(join15(dir, name));
+  return local !== null && local === sha256(join15(hostDir, name));
 }
 function sha256(path7) {
   try {
@@ -75147,7 +75192,7 @@ function capRunDiff(diff) {
 import { createHash as createHash8 } from "crypto";
 import {
   appendFileSync,
-  existsSync as existsSync11,
+  existsSync as existsSync12,
   mkdirSync as mkdirSync5,
   readFileSync as readFileSync12,
   readdirSync as readdirSync5,
@@ -75156,7 +75201,7 @@ import {
   symlinkSync as symlinkSync2
 } from "fs";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname8, join as join15, resolve as resolve10 } from "path";
+import { dirname as dirname8, join as join16, resolve as resolve10 } from "path";
 
 // ../baro-orchestrator/src/execution/gate-registry.ts
 var EVIDENCE_CAPTURE = {
@@ -75344,7 +75389,7 @@ var WorktreeManager = class {
     this.repoRoot = repoRoot;
     this.gate = gate;
     this.runId = runId;
-    this.baseDir = join15(tmpdir3(), "baro-worktrees", runId);
+    this.baseDir = join16(tmpdir3(), "baro-worktrees", runId);
     this.linkDepDirs = opts.linkDepDirs ?? true;
     this.integrationRoot = opts.integrationRoot ?? repoRoot;
     this.log = opts.onLog ?? ((line) => process.stderr.write(`[worktree] ${line}
@@ -75479,7 +75524,7 @@ var WorktreeManager = class {
     if (name === INTEGRATION_WORKTREE_DIRNAME) {
       throw new Error("story id collides with the integration worktree directory");
     }
-    return join15(this.baseDir, name, worktreeLeafName(this.repoRoot));
+    return join16(this.baseDir, name, worktreeLeafName(this.repoRoot));
   }
   /** Seal the manager before factories drain. An already-running create
    * remains serialized by GitGate; queued/future creates stop at the gate. */
@@ -75794,7 +75839,7 @@ var WorktreeManager = class {
     try {
       const path7 = this.paths.get(storyId);
       const branch = this.branchOf(storyId);
-      if (!path7 || !existsSync11(path7) || !this.preserved.has(storyId)) {
+      if (!path7 || !existsSync12(path7) || !this.preserved.has(storyId)) {
         const recorded = await this.resolvedRecoveryRef(storyId);
         if (recorded) {
           this.log(
@@ -75817,7 +75862,7 @@ var WorktreeManager = class {
       const backup = await this.createRecoveryBranch(storyId, branch);
       this.recordRecoveryRef(storyId, backup);
       await this.removeWorktreeQuiet(path7, "releasePreserved");
-      if (existsSync11(path7)) {
+      if (existsSync12(path7)) {
         throw new Error(`could not release preserved worktree for story ${storyId}`);
       }
       this.paths.delete(storyId);
@@ -75864,7 +75909,7 @@ var WorktreeManager = class {
     try {
       const path7 = this.paths.get(storyId);
       const branch = this.branchOf(storyId);
-      if (!path7 || !existsSync11(path7)) {
+      if (!path7 || !existsSync12(path7)) {
         if (preserveForRecovery) {
           let branchHead;
           try {
@@ -76139,7 +76184,7 @@ var WorktreeManager = class {
           );
           continue;
         }
-        if (this.preserved.has(storyId) && existsSync11(path7)) {
+        if (this.preserved.has(storyId) && existsSync12(path7)) {
           let status = "";
           try {
             ;
@@ -76284,7 +76329,7 @@ var WorktreeManager = class {
     const scan = (rel, depth) => {
       let entries;
       try {
-        entries = readdirSync5(join15(root, rel) || root, { withFileTypes: true });
+        entries = readdirSync5(join16(root, rel) || root, { withFileTypes: true });
       } catch {
         return;
       }
@@ -76302,7 +76347,7 @@ var WorktreeManager = class {
       if (depth <= 0) return;
       for (const e2 of entries) {
         if (e2.isDirectory() && !SCAN_SKIP.has(e2.name) && !e2.name.startsWith(".")) {
-          scan(rel ? join15(rel, e2.name) : e2.name, depth - 1);
+          scan(rel ? join16(rel, e2.name) : e2.name, depth - 1);
         }
       }
     };
@@ -76354,15 +76399,15 @@ ${missing.join("\n")}
   }
   symlinkDepDirs(worktreePath) {
     for (const { rel, dir } of this.depLocations()) {
-      const shared = join15(this.repoRoot, rel, dir);
-      const dest = join15(worktreePath, rel, dir);
-      if (existsSync11(dest)) continue;
+      const shared = join16(this.repoRoot, rel, dir);
+      const dest = join16(worktreePath, rel, dir);
+      if (existsSync12(dest)) continue;
       try {
-        if (!existsSync11(shared)) mkdirSync5(shared, { recursive: true });
-        mkdirSync5(join15(worktreePath, rel), { recursive: true });
+        if (!existsSync12(shared)) mkdirSync5(shared, { recursive: true });
+        mkdirSync5(join16(worktreePath, rel), { recursive: true });
         symlinkSync2(shared, dest, "junction");
       } catch (e2) {
-        this.log(`could not symlink ${join15(rel, dir)} into worktree (${errMsg3(e2)})`);
+        this.log(`could not symlink ${join16(rel, dir)} into worktree (${errMsg3(e2)})`);
       }
     }
   }
@@ -76393,7 +76438,7 @@ ${missing.join("\n")}
       );
       return;
     }
-    const resetSpecs = this.depLocations().map(({ rel, dir }) => join15(rel, dir));
+    const resetSpecs = this.depLocations().map(({ rel, dir }) => join16(rel, dir));
     if (resetSpecs.length) await execQuiet("git", ["reset", "-q", "--", ...resetSpecs], worktreePath);
     let staged = [];
     let diffFailed = false;
@@ -76439,7 +76484,7 @@ ${missing.join("\n")}
   async commitFailedWork(storyId, worktreePath) {
     try {
       await runRepositoryCommand("git", ["add", "-A"], { cwd: worktreePath });
-      const resetSpecs = this.depLocations().map(({ rel, dir }) => join15(rel, dir));
+      const resetSpecs = this.depLocations().map(({ rel, dir }) => join16(rel, dir));
       if (resetSpecs.length > 0) {
         await execQuiet(
           "git",
@@ -76521,7 +76566,7 @@ ${missing.join("\n")}
   async releaseLogicalStory(storyId, path7, branch) {
     await this.secureRecoveryMaterial(storyId, "release_logical_story");
     await this.removeWorktreeQuiet(path7, "releaseLogicalStory");
-    if (existsSync11(path7)) {
+    if (existsSync12(path7)) {
       throw new Error(`could not release worktree for story ${storyId}`);
     }
     this.paths.delete(storyId);
@@ -76570,7 +76615,7 @@ ${missing.join("\n")}
   }
   async removeWorktreeQuiet(path7, reason) {
     await execQuiet("git", ["worktree", "remove", "--force", path7], this.repoRoot);
-    if (existsSync11(path7)) {
+    if (existsSync12(path7)) {
       this.log(`force-removed worktree ${path7} after git refused (${reason})`);
       rmSyncQuiet(path7);
     } else {
@@ -76622,9 +76667,9 @@ ${missing.join("\n")}
       ["branch", "--list", branch, "--format=%(refname:short)"],
       { cwd: this.repoRoot }
     );
-    if (existsSync11(path7) || remainingBranch.trim()) {
+    if (existsSync12(path7) || remainingBranch.trim()) {
       throw new Error(
-        `residual setup state remains` + (existsSync11(path7) ? ` at ${path7}` : "") + (remainingBranch.trim() ? ` on branch ${branch}` : "")
+        `residual setup state remains` + (existsSync12(path7) ? ` at ${path7}` : "") + (remainingBranch.trim() ? ` on branch ${branch}` : "")
       );
     }
   }
@@ -78375,7 +78420,7 @@ function formatRoute(route) {
 
 // ../baro-orchestrator/src/execution/auditor.ts
 import { createHmac, randomBytes as randomBytes2 } from "crypto";
-import { appendFileSync as appendFileSync2, chmodSync as chmodSync2, existsSync as existsSync12, mkdirSync as mkdirSync6 } from "fs";
+import { appendFileSync as appendFileSync2, chmodSync as chmodSync2, existsSync as existsSync13, mkdirSync as mkdirSync6 } from "fs";
 import { dirname as dirname9 } from "path";
 
 // ../baro-orchestrator/src/events/define.ts
@@ -78638,7 +78683,7 @@ var Auditor = class extends BusMember {
     this.filter = opts.filter;
     try {
       mkdirSync6(dirname9(this.path), { recursive: true });
-      if (existsSync12(this.path)) chmodSync2(this.path, 384);
+      if (existsSync13(this.path)) chmodSync2(this.path, 384);
     } catch (e2) {
       this.disable(`mkdir failed: ${e2?.message ?? String(e2)}`);
     }
@@ -79609,7 +79654,7 @@ function correlationKey(correlation) {
 // ../baro-orchestrator/src/execution/collaboration-bridge.ts
 import {
   appendFileSync as appendFileSync3,
-  existsSync as existsSync13,
+  existsSync as existsSync14,
   mkdirSync as mkdirSync7,
   lstatSync as lstatSync3,
   readFileSync as readFileSync14,
@@ -79622,7 +79667,7 @@ import { randomBytes as randomBytes3, randomUUID as randomUUID5 } from "crypto";
 import {
   createServer
 } from "http";
-import { basename as basename8, join as join16 } from "path";
+import { basename as basename8, join as join17 } from "path";
 
 // ../baro-orchestrator/scripts/collaboration-inbox-path.mjs
 var INBOX_NAME_PREFIX = "agent-";
@@ -81546,14 +81591,14 @@ var CollaborationBridge = class extends SerializedObserver {
   constructor(opts) {
     super();
     this.opts = opts;
-    this.outboxDir = join16(opts.sessionDir, "outbox");
-    this.challengeInflightDir = opts.challengeInflightDir ?? join16(opts.sessionDir, "challenge-inflight");
+    this.outboxDir = join17(opts.sessionDir, "outbox");
+    this.challengeInflightDir = opts.challengeInflightDir ?? join17(opts.sessionDir, "challenge-inflight");
     if (opts.goalInvariantIds && (opts.goalInvariantIds.some((id) => !validGoalInvariantId(id)) || new Set(opts.goalInvariantIds).size !== opts.goalInvariantIds.length)) {
       throw new Error("collaboration bridge goal invariant ids are invalid");
     }
     this.allowedGoalInvariantIds = opts.goalInvariantIds ? new Set(opts.goalInvariantIds) : null;
-    this.inboxDir = join16(opts.sessionDir, "inbox");
-    this.decisionsDir = join16(opts.sessionDir, "decisions");
+    this.inboxDir = join17(opts.sessionDir, "inbox");
+    this.decisionsDir = join17(opts.sessionDir, "decisions");
     mkdirSync7(this.challengeInflightDir, { recursive: true });
     if (opts.unsafeAllowFilesystemTransport === true) {
       mkdirSync7(this.outboxDir, { recursive: true });
@@ -81898,7 +81943,7 @@ var CollaborationBridge = class extends SerializedObserver {
         }
         this.publishAvailableInflightChallenges();
         if (this.opts.unsafeAllowFilesystemTransport === true) {
-          if (!existsSync13(this.outboxDir)) {
+          if (!existsSync14(this.outboxDir)) {
             this.stopPolling();
             return;
           }
@@ -81910,9 +81955,9 @@ var CollaborationBridge = class extends SerializedObserver {
     });
   }
   consumeAvailableOutbox() {
-    if (!existsSync13(this.outboxDir)) return;
+    if (!existsSync14(this.outboxDir)) return;
     const files = readdirSync6(this.outboxDir).filter((name) => name.endsWith(".json")).sort();
-    for (const name of files) this.consume(join16(this.outboxDir, name));
+    for (const name of files) this.consume(join17(this.outboxDir, name));
   }
   consume(path7) {
     let removeOutboxRecord = true;
@@ -82021,7 +82066,7 @@ var CollaborationBridge = class extends SerializedObserver {
           );
           return { deliveryGaps };
         }
-        const inflightPath = join16(
+        const inflightPath = join17(
           this.challengeInflightDir,
           `${randomUUID5()}.json`
         );
@@ -82067,12 +82112,12 @@ var CollaborationBridge = class extends SerializedObserver {
     if (persisted) {
       return sameChallenge2(candidate, persisted) ? "duplicate" : `challenge id ${candidate.challengeId} conflicts with persisted evidence`;
     }
-    if (existsSync13(this.challengeInflightDir)) {
+    if (existsSync14(this.challengeInflightDir)) {
       for (const name of readdirSync6(this.challengeInflightDir)) {
         if (!name.endsWith(".json")) continue;
         try {
           const retained = this.readInflightChallenge(
-            join16(this.challengeInflightDir, name)
+            join17(this.challengeInflightDir, name)
           );
           if (retained.challengeId !== candidate.challengeId) continue;
           return sameChallenge2(candidate, retained) ? "duplicate" : `challenge id ${candidate.challengeId} conflicts with retained evidence`;
@@ -82107,12 +82152,12 @@ var CollaborationBridge = class extends SerializedObserver {
     }
   }
   publishAvailableInflightChallenges() {
-    if (!existsSync13(this.challengeInflightDir)) return;
+    if (!existsSync14(this.challengeInflightDir)) return;
     const files = readdirSync6(this.challengeInflightDir).filter((name) => name.endsWith(".json")).sort();
     for (const name of files) {
       try {
         this.publishInflightChallenge(
-          join16(this.challengeInflightDir, name),
+          join17(this.challengeInflightDir, name),
           false
         );
       } catch (error) {
@@ -82163,10 +82208,10 @@ var CollaborationBridge = class extends SerializedObserver {
         ...challenge.storyId ? { storyId: challenge.storyId } : {}
       });
     }
-    if (!existsSync13(this.challengeInflightDir)) return;
+    if (!existsSync14(this.challengeInflightDir)) return;
     const files = readdirSync6(this.challengeInflightDir).filter((name) => name.endsWith(".json")).sort();
     for (const name of files) {
-      const path7 = join16(this.challengeInflightDir, name);
+      const path7 = join17(this.challengeInflightDir, name);
       try {
         const retained = this.readInflightChallenge(path7);
         const persisted = receipt.projection.challenges.some(
@@ -82489,13 +82534,13 @@ var CollaborationBridge = class extends SerializedObserver {
   resetInbox(agentId) {
     if (this.opts.unsafeAllowFilesystemTransport !== true) return;
     try {
-      unlinkSync3(join16(this.inboxDir, inboxFilenameForAgentId(agentId)));
+      unlinkSync3(join17(this.inboxDir, inboxFilenameForAgentId(agentId)));
     } catch {
     }
   }
   writeUnsafeInbox(agentId, value) {
     appendFileSync3(
-      join16(this.inboxDir, inboxFilenameForAgentId(agentId)),
+      join17(this.inboxDir, inboxFilenameForAgentId(agentId)),
       JSON.stringify({ ts: (/* @__PURE__ */ new Date()).toISOString(), ...asRecord(value) }) + "\n"
     );
   }
@@ -82630,9 +82675,9 @@ var CollaborationBridge = class extends SerializedObserver {
   writeDecision(proposalId, decision) {
     if (this.opts.unsafeAllowFilesystemTransport !== true) return;
     const name = safeName(proposalId);
-    const path7 = join16(this.decisionsDir, `${name}.json`);
-    if (existsSync13(path7)) return;
-    const pending = join16(
+    const path7 = join17(this.decisionsDir, `${name}.json`);
+    if (existsSync14(path7)) return;
+    const pending = join17(
       this.decisionsDir,
       `.${name}.${randomUUID5()}.tmp`
     );
@@ -90666,9 +90711,9 @@ var ClaudeStreamResultCollector = class {
 // ../baro-orchestrator/src/harness/critic-cli-isolation.ts
 import { mkdtemp, rm } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 async function withIsolatedCriticCwd(run2) {
-  const cwd = await mkdtemp(join17(tmpdir4(), "baro-critic-"));
+  const cwd = await mkdtemp(join18(tmpdir4(), "baro-critic-"));
   try {
     return await run2(cwd);
   } finally {
@@ -91710,7 +91755,7 @@ function hashField(hash, label, value) {
 function errorCode(error) {
   return typeof error === "object" && error !== null && typeof error.code === "string" ? error.code : null;
 }
-async function prepareCriticEvaluation(criteria, resultText, agentId, source) {
+async function prepareCriticEvaluation(criteria, resultText, agentId, source, establishedFor) {
   const beforeFingerprint = await repositoryFingerprintFor(agentId, source);
   const [commandEvidence, repositoryEvidence, decisionDocument, publishedNotes, altitude, writeSurface] = await Promise.all([
     commandEvidenceFor(agentId, source),
@@ -91732,6 +91777,7 @@ async function prepareCriticEvaluation(criteria, resultText, agentId, source) {
       (issue2) => /repository (?:evidence|target)/i.test(issue2)
     ) ? [fingerprintIssue] : []
   ];
+  const established = issues.length === 0 && afterFingerprint.value && establishedFor ? establishedFor(afterFingerprint.value).filter((criterion) => criteria.includes(criterion)) : [];
   const segments = splitAcceptanceContract(criteria);
   let offset = 0;
   const prompts = segments.map((segmentCriteria, index) => {
@@ -91745,7 +91791,8 @@ async function prepareCriticEvaluation(criteria, resultText, agentId, source) {
       publishedNotes,
       source?.hostRunsWholeTreeVerification === true,
       altitude.section,
-      writeSurface
+      writeSurface,
+      established.filter((criterion) => segmentCriteria.includes(criterion))
     );
     offset += segmentCriteria.length;
     return prompt;
@@ -91764,7 +91811,8 @@ async function prepareCriticEvaluation(criteria, resultText, agentId, source) {
     status: issues.length > 0 ? "inconclusive" : "ready",
     issues,
     staleCommands: staleCommandsToRerun(commandEvidence, issues),
-    repositoryFingerprint: issues.length === 0 ? afterFingerprint.value : null
+    repositoryFingerprint: issues.length === 0 ? afterFingerprint.value : null,
+    established
   };
 }
 function mergeSegmentVerdicts(verdicts) {
@@ -91806,7 +91854,7 @@ function inconclusiveEvidenceVerdict(issues) {
     violatedCriteria: ["[acceptance evidence unavailable]"]
   };
 }
-function buildEvalPrompt(criteria, resultText, commandEvidence = null, repositoryEvidence = null, decisionDocument = null, segment, publishedNotes = [], hostRunsWholeTreeVerification = false, altitudeSection = null, writeSurface = null) {
+function buildEvalPrompt(criteria, resultText, commandEvidence = null, repositoryEvidence = null, decisionDocument = null, segment, publishedNotes = [], hostRunsWholeTreeVerification = false, altitudeSection = null, writeSurface = null, established = []) {
   const criteriaList = renderCompleteAcceptanceContract(
     criteria,
     segment?.offset ?? 0
@@ -91857,6 +91905,7 @@ function buildEvalPrompt(criteria, resultText, commandEvidence = null, repositor
     ] : [],
     criteriaList,
     "",
+    ...establishedSection(criteria, established, segment?.offset ?? 0),
     "## Baro-captured command/test evidence",
     commandEvidence ? boundText(
       redactSensitiveText(commandEvidence),
@@ -91891,6 +91940,15 @@ function buildEvalPrompt(criteria, resultText, commandEvidence = null, repositor
   }
   return prompt;
 }
+function establishedSection(criteria, established, offset) {
+  const numbers = criteria.map((criterion, index) => established.includes(criterion) ? offset + index + 1 : null).filter((number3) => number3 !== null);
+  if (numbers.length === 0) return [];
+  return [
+    "## Already established",
+    `An earlier review of this exact workspace content (identical changed-file bytes) found criteria ${numbers.join(", ")} satisfied. They stand: do not re-judge them or list them as violated, even when the evidence that proved them no longer appears below. Judge the other criteria as usual.`,
+    ""
+  ];
+}
 var MAX_WRITE_SURFACE_PATHS = 60;
 async function writeSurfaceFor(agentId, source) {
   if (!source?.writeSurface) return null;
@@ -92545,6 +92603,43 @@ function errorMessage(error) {
   return error?.message ?? String(error);
 }
 
+// ../baro-orchestrator/src/acceptance/criterion-ledger.ts
+var CriterionLedger = class {
+  entries = /* @__PURE__ */ new Map();
+  established(agentId, fingerprint) {
+    const entry = this.entries.get(agentId);
+    return fingerprint && entry?.fingerprint === fingerprint ? [...entry.passed] : [];
+  }
+  record(agentId, fingerprint, criteria, evaluation) {
+    if (!fingerprint || (evaluation.status ?? "evaluated") !== "evaluated") return;
+    if (evaluation.verdict === "fail" && evaluation.violatedCriteria.length === 0) return;
+    const failed = /* @__PURE__ */ new Set([
+      ...evaluation.violatedCriteria,
+      ...(evaluation.contractConflicts ?? []).map(({ criterion }) => criterion)
+    ]);
+    const entry = this.entries.get(agentId);
+    const passed = entry?.fingerprint === fingerprint ? entry.passed : /* @__PURE__ */ new Set();
+    for (const criterion of criteria) {
+      if (!failed.has(criterion)) passed.add(criterion);
+    }
+    this.entries.set(agentId, { fingerprint, passed });
+  }
+};
+function honorEstablished(evaluation, established) {
+  if (established.length === 0 || evaluation.verdict !== "fail") return evaluation;
+  if ((evaluation.status ?? "evaluated") !== "evaluated") return evaluation;
+  const settled = new Set(established);
+  const violated = evaluation.violatedCriteria.filter((criterion) => !settled.has(criterion));
+  if (violated.length === evaluation.violatedCriteria.length) return evaluation;
+  const note = `(Baro: ${evaluation.violatedCriteria.length - violated.length} listed violation(s) were criteria an earlier review of this exact content already found satisfied; they stand.)`;
+  return {
+    ...evaluation,
+    verdict: violated.length === 0 ? "pass" : "fail",
+    violatedCriteria: violated,
+    reasoning: `${evaluation.reasoning} ${note}`.trim()
+  };
+}
+
 // ../baro-orchestrator/src/acceptance/critic-pending.ts
 async function drainCriticPending(pending) {
   while (pending.size > 0) {
@@ -92570,6 +92665,7 @@ var OneShotCritic = class extends BusMember {
   }
   terminalAuthorities;
   maxEmissionsPerAgent;
+  ledger = new CriterionLedger();
   targets;
   runId;
   evidence;
@@ -92627,21 +92723,28 @@ var OneShotCritic = class extends BusMember {
           criteria,
           resultText,
           agentId,
-          this.evidence
+          this.evidence,
+          (fingerprint) => this.ledger.established(agentId, fingerprint)
         );
         repositoryFingerprint2 = preparation.repositoryFingerprint;
         staleCommands = preparation.staleCommands;
         preparationReady = preparation.status === "ready";
-        evaluation = preparationReady ? applyContractConflicts(
-          mergeSegmentVerdicts(
-            await Promise.all(
-              preparation.prompts.map(
-                (prompt) => this.evaluate(prompt, agentId, turn)
+        evaluation = preparationReady ? honorEstablished(
+          applyContractConflicts(
+            mergeSegmentVerdicts(
+              await Promise.all(
+                preparation.prompts.map(
+                  (prompt) => this.evaluate(prompt, agentId, turn)
+                )
               )
-            )
+            ),
+            criteria
           ),
-          criteria
+          preparation.established
         ) : inconclusiveEvidenceVerdict(preparation.issues);
+        if (preparationReady) {
+          this.ledger.record(agentId, repositoryFingerprint2, criteria, evaluation);
+        }
       } catch (error) {
         evaluation = {
           status: "inconclusive",
@@ -93166,13 +93269,13 @@ var CriticTargetRegistry = class extends BusMember {
 };
 
 // ../baro-orchestrator/src/harness/os-sandbox.ts
-import { accessSync as accessSync3, constants as constants4, existsSync as existsSync15, mkdtempSync, realpathSync as realpathSync9 } from "fs";
+import { accessSync as accessSync3, constants as constants4, existsSync as existsSync16, mkdtempSync, realpathSync as realpathSync9 } from "fs";
 import { homedir as homedir6, tmpdir as tmpdir5 } from "os";
-import { delimiter as delimiter2, join as join20, resolve as resolve14 } from "path";
+import { delimiter as delimiter2, join as join21, resolve as resolve14 } from "path";
 import { spawn as spawn3 } from "child_process";
 
 // ../baro-orchestrator/src/execution/shell-containment.ts
-import { execFileSync as execFileSync3 } from "child_process";
+import { execFileSync as execFileSync4 } from "child_process";
 import * as fs4 from "fs";
 import * as path4 from "path";
 function gitDiscoveryBounds() {
@@ -93186,12 +93289,12 @@ function shellContainmentRefusal(cwd, command, access) {
   return reason === null ? null : `${shellContainmentGateToken()} ${reason}`;
 }
 function shellAccessContext(cwd, options) {
-  const git2 = gitSandboxPaths(cwd);
+  const git3 = gitSandboxPaths(cwd);
   return {
-    git: git2,
+    git: git3,
     dependencyTargets: dependencySymlinkTargets(
       cwd,
-      git2.commonWorktreeRoot
+      git3.commonWorktreeRoot
     ),
     collaboration: resolveCollaborationShellAccess(options.collaboration),
     writeSandbox: hasMacosWriteSandbox()
@@ -93217,7 +93320,7 @@ function gitSandboxPaths(cwd) {
   const { timeout, maxBuffer } = gitDiscoveryBounds();
   try {
     const gitDir = fs4.realpathSync.native(
-      execFileSync3("git", ["rev-parse", "--absolute-git-dir"], {
+      execFileSync4("git", ["rev-parse", "--absolute-git-dir"], {
         cwd,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"],
@@ -93225,7 +93328,7 @@ function gitSandboxPaths(cwd) {
         maxBuffer
       }).trim()
     );
-    const commonRaw = execFileSync3(
+    const commonRaw = execFileSync4(
       "git",
       ["rev-parse", "--path-format=absolute", "--git-common-dir"],
       {
@@ -93240,7 +93343,7 @@ function gitSandboxPaths(cwd) {
     const paths = [gitDir, path4.join(commonDir, "objects")];
     let branch = "";
     try {
-      branch = execFileSync3("git", ["symbolic-ref", "--quiet", "HEAD"], {
+      branch = execFileSync4("git", ["symbolic-ref", "--quiet", "HEAD"], {
         cwd,
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"],
@@ -93924,7 +94027,7 @@ function importAliases() {
   const imports = [
     [spelled(() => fs4), "fs"],
     [spelled(() => path4), "path"],
-    [spelled(() => execFileSync3), "execFileSync"]
+    [spelled(() => execFileSync4), "execFileSync"]
   ];
   return imports.filter(([alias, name]) => alias !== void 0 && alias !== name).map(([alias, name]) => `const ${alias} = ${name}`);
 }
@@ -93932,13 +94035,13 @@ function importAliases() {
 // ../baro-orchestrator/src/harness/package-cache.ts
 import { mkdirSync as mkdirSync8, readdirSync as readdirSync8, realpathSync as realpathSync8 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 function storyPackageCache(env = process.env, worktreeRoot = null) {
   const configured = env.BARO_PACKAGE_CACHE?.trim();
-  const requested = configured ? configured : join19(homedir5(), ".baro", "cache", "packages");
+  const requested = configured ? configured : join20(homedir5(), ".baro", "cache", "packages");
   mkdirSync8(requested, { recursive: true });
   const root = realpathSync8(requested);
-  const at = (name) => join19(root, name);
+  const at = (name) => join20(root, name);
   return {
     root,
     env: {
@@ -93957,7 +94060,7 @@ function storyPackageCache(env = process.env, worktreeRoot = null) {
 }
 function storyCargoTargetDir(cacheRoot, worktreeRoot) {
   const repository = gitSandboxPaths(worktreeRoot).commonWorktreeRoot ?? worktreeRoot;
-  const dir = join19(cacheRoot, "cargo-target", repositoryCacheKey(repository));
+  const dir = join20(cacheRoot, "cargo-target", repositoryCacheKey(repository));
   mkdirSync8(dir, { recursive: true });
   return dir;
 }
@@ -93973,7 +94076,7 @@ function sharedDependencyTargets(worktreeRoot, depth = 4) {
       return;
     }
     for (const entry of entries) {
-      const full = join19(dir, entry.name);
+      const full = join20(dir, entry.name);
       if (SHARED_DEPENDENCY_DIRS.has(entry.name)) {
         if (entry.isSymbolicLink()) {
           try {
@@ -94017,14 +94120,14 @@ function confinedSpawn(lane, binary, args, worktreeRoot, env = process.env) {
   if (env.BARO_UNSAFE_NO_SANDBOX === "1" || !resolvesToExecutable(binary, env.PATH)) {
     return { binary, args: [...args], env: credentialEnv };
   }
-  if (process.platform !== "darwin" || !existsSync15("/usr/bin/sandbox-exec")) {
+  if (process.platform !== "darwin" || !existsSync16("/usr/bin/sandbox-exec")) {
     return {
       refusal: `the ${lane} lane needs an OS sandbox, and baro has none for it on ${process.platform} yet; use the Claude lane (sandboxed by Claude Code), or set BARO_UNSAFE_NO_SANDBOX=1 to run it unconfined`
     };
   }
   const home = homedir6();
   const cache = storyPackageCache(env, worktreeRoot);
-  const scratch = realpathSync9(mkdtempSync(join20(tmpdir5(), `baro-${lane}-tmp-`)));
+  const scratch = realpathSync9(mkdtempSync(join21(tmpdir5(), `baro-${lane}-tmp-`)));
   const writable = [
     ...worktreeRoot === null ? [] : [
       realpathSync9(resolve14(worktreeRoot)),
@@ -94034,13 +94137,13 @@ function confinedSpawn(lane, binary, args, worktreeRoot, env = process.env) {
     scratch,
     "/dev/null",
     cache.root,
-    ...(LANE_STATE[lane] ?? []).map((dir) => join20(home, dir))
+    ...(LANE_STATE[lane] ?? []).map((dir) => join21(home, dir))
   ];
   return {
     binary: "/usr/bin/sandbox-exec",
     args: [
       "-p",
-      seatbeltProfile(writable, CREDENTIAL_READ_DENY.map((dir) => join20(home, dir))),
+      seatbeltProfile(writable, CREDENTIAL_READ_DENY.map((dir) => join21(home, dir))),
       binary,
       ...args
     ],
@@ -94048,7 +94151,7 @@ function confinedSpawn(lane, binary, args, worktreeRoot, env = process.env) {
   };
 }
 function resolvesToExecutable(binary, pathValue) {
-  const candidates = binary.includes("/") ? [binary] : (pathValue ?? "").split(delimiter2).filter(Boolean).map((dir) => join20(dir, binary));
+  const candidates = binary.includes("/") ? [binary] : (pathValue ?? "").split(delimiter2).filter(Boolean).map((dir) => join21(dir, binary));
   return candidates.some((candidate) => {
     try {
       accessSync3(candidate, constants4.X_OK);
@@ -95702,6 +95805,7 @@ var CriticOpenAI = class extends BusMember {
   terminalAuthorities;
   model;
   billingCoordinator;
+  ledger = new CriterionLedger();
   emissions = /* @__PURE__ */ new Map();
   turnCount = /* @__PURE__ */ new Map();
   seenTerminalIds = /* @__PURE__ */ new Set();
@@ -95755,18 +95859,25 @@ var CriticOpenAI = class extends BusMember {
         criteria,
         resultText,
         agentId,
-        this.opts.evidence
+        this.opts.evidence,
+        (fingerprint) => this.ledger.established(agentId, fingerprint)
       );
-      const evaluation = preparation.status === "ready" ? applyContractConflicts(
-        mergeSegmentVerdicts(
-          await Promise.all(
-            preparation.prompts.map(
-              (prompt) => this.evaluate(prompt, agentId, turn, correlation)
+      const evaluation = preparation.status === "ready" ? honorEstablished(
+        applyContractConflicts(
+          mergeSegmentVerdicts(
+            await Promise.all(
+              preparation.prompts.map(
+                (prompt) => this.evaluate(prompt, agentId, turn, correlation)
+              )
             )
-          )
+          ),
+          criteria
         ),
-        criteria
+        preparation.established
       ) : inconclusiveEvidenceVerdict(preparation.issues);
+      if (preparation.status === "ready") {
+        this.ledger.record(agentId, preparation.repositoryFingerprint, criteria, evaluation);
+      }
       const { verdict, reasoning, violatedCriteria } = evaluation;
       const status = evaluation.status ?? "evaluated";
       if (preparation.status === "ready" && !this.billingCoordinator) {
@@ -96025,7 +96136,7 @@ function withTimeout(promise, ms, message3) {
 
 // ../baro-orchestrator/src/harness/opencode/one-shot.ts
 import { writeFile as writeFile2 } from "fs/promises";
-import { join as join21 } from "path";
+import { join as join22 } from "path";
 
 // ../baro-orchestrator/src/harness/opencode/cli-version.ts
 import { spawnSync as spawnSync2 } from "child_process";
@@ -96474,7 +96585,7 @@ async function installSafeEvaluatorAgent(cwd, systemPrompt) {
       }
     }
   };
-  const path7 = join21(cwd, "opencode.json");
+  const path7 = join22(cwd, "opencode.json");
   const content = `${JSON.stringify(config2)}
 `;
   await writeFile2(
@@ -97135,7 +97246,7 @@ var CriticPi = class extends OneShotCritic {
 // ../baro-orchestrator/src/harness/devin/one-shot.ts
 import { mkdtempSync as mkdtempSync2, mkdirSync as mkdirSync9, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
 import { tmpdir as tmpdir6 } from "os";
-import { join as join22 } from "path";
+import { join as join23 } from "path";
 
 // ../baro-orchestrator/src/harness/cli-participant.ts
 var import_cross_spawn3 = __toESM(require_cross_spawn(), 1);
@@ -98074,9 +98185,9 @@ You have no tools and no files: answer from the text below alone.
 ${prompt}`;
 }
 function isolatedEvaluatorDir() {
-  const dir = mkdtempSync2(join22(tmpdir6(), "baro-devin-eval-"));
-  mkdirSync9(join22(dir, ".devin"));
-  writeFileSync6(join22(dir, ".devin", "config.json"), JSON.stringify(DENY_ALL_TOOLS));
+  const dir = mkdtempSync2(join23(tmpdir6(), "baro-devin-eval-"));
+  mkdirSync9(join23(dir, ".devin"));
+  writeFileSync6(join23(dir, ".devin", "config.json"), JSON.stringify(DENY_ALL_TOOLS));
   return dir;
 }
 function describeExit(summary) {
@@ -98985,7 +99096,7 @@ import { spawn as spawnProcess } from "child_process";
 import { createInterface as createInterface2 } from "readline";
 import { mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
 import { tmpdir as tmpdir7 } from "os";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 
 // ../baro-orchestrator/src/telemetry/claude-model-usage.ts
 function primaryClaudeModel(modelUsage) {
@@ -99916,7 +100027,7 @@ function execClaude(binary, args, opts) {
   }).then(({ stdout }) => stdout);
 }
 async function withIsolatedHarnessCwd(prefix, run2) {
-  const cwd = await mkdtemp2(join23(tmpdir7(), prefix));
+  const cwd = await mkdtemp2(join24(tmpdir7(), prefix));
   try {
     return await run2(cwd);
   } finally {
@@ -99949,7 +100060,7 @@ function providerCallSignal(callerSignal, timeoutMs) {
 
 // ../baro-orchestrator/src/integration/finalizer.ts
 import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync7 } from "fs";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 
 // ../baro-orchestrator/src/verification/prd-declared-tests.ts
 import { readFileSync as readFileSync16 } from "fs";
@@ -100535,14 +100646,14 @@ var Finalizer = class extends BusMember {
     const runtimeAmendments = renderRuntimeAmendments(prd);
     if (adrs.length === 0 && !runtimeAmendments) return;
     try {
-      const dir = join24(this.opts.integrationRoot, "adr");
+      const dir = join25(this.opts.integrationRoot, "adr");
       mkdirSync10(dir, { recursive: true });
       const generatedPaths = [];
       for (const a of adrs) {
         const num = a.num.padStart(4, "0");
         const fileName = `${num}-${slugify(a.title)}.md`;
         writeFileSync7(
-          join24(dir, fileName),
+          join25(dir, fileName),
           `# ADR-${num}: ${a.title}
 
 ${a.body}
@@ -100552,7 +100663,7 @@ ${a.body}
       }
       if (runtimeAmendments) {
         writeFileSync7(
-          join24(dir, "runtime-amendments.md"),
+          join25(dir, "runtime-amendments.md"),
           runtimeAmendments
         );
         generatedPaths.push("adr/runtime-amendments.md");
@@ -105843,10 +105954,10 @@ var LocalRepositoryAgent = class extends BusMember {
 // ../baro-orchestrator/src/execution/memory-librarian.ts
 import { appendFileSync as appendFileSync4, mkdirSync as mkdirSync12 } from "fs";
 import { homedir as homedir8 } from "os";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 var DEBUG = process.env.BARO_DEBUG?.includes("memory") ?? false;
-var LOG_DIR = join26(homedir8(), ".baro", "runs");
-var LOG_FILE = join26(LOG_DIR, `memory-${Date.now()}.log`);
+var LOG_DIR = join27(homedir8(), ".baro", "runs");
+var LOG_FILE = join27(LOG_DIR, `memory-${Date.now()}.log`);
 try {
   mkdirSync12(LOG_DIR, { recursive: true });
 } catch {
@@ -106728,7 +106839,7 @@ var PlanningFeed = class extends BusMember {
 };
 
 // ../baro-orchestrator/src/execution/prd-status-writer.ts
-import { existsSync as existsSync17 } from "fs";
+import { existsSync as existsSync18 } from "fs";
 function createPrdStatusWriter({
   prdPath,
   load = loadPrd,
@@ -106738,7 +106849,7 @@ function createPrdStatusWriter({
   const warnedUnknown = /* @__PURE__ */ new Set();
   const warnedWriteFailure = /* @__PURE__ */ new Set();
   const apply = (storyId, mutate) => {
-    if (!existsSync17(prdPath)) return;
+    if (!existsSync18(prdPath)) return;
     try {
       const prd = load(prdPath);
       if (!prd.userStories.some((story) => story.id === storyId)) {
@@ -107234,7 +107345,7 @@ var ClaudeLaneAdapter = class {
 };
 
 // ../baro-orchestrator/src/planning/adapters/codebase-tools.ts
-import { execFileSync as execFileSync4 } from "child_process";
+import { execFileSync as execFileSync5 } from "child_process";
 import * as fs5 from "fs";
 import * as os from "os";
 import * as path5 from "path";
@@ -107248,7 +107359,7 @@ import {
   rmSync as rmSync5,
   writeFileSync as writeFileSync9
 } from "fs";
-import { delimiter as delimiter3, join as join27, resolve as resolve16 } from "path";
+import { delimiter as delimiter3, join as join28, resolve as resolve16 } from "path";
 function publishCommandRefusal(command) {
   const segments = String(command).split(/&&|\|\||[;|\n]/u).map((segment) => segment.trim()).filter((segment) => segment.length > 0);
   for (const segment of segments) {
@@ -107311,7 +107422,7 @@ function shQuote(value) {
 function findExecutable(name, pathValue, exclude) {
   for (const dir of pathValue.split(delimiter3)) {
     if (!dir || resolve16(dir) === resolve16(exclude)) continue;
-    const candidate = join27(dir, name);
+    const candidate = join28(dir, name);
     try {
       accessSync4(candidate, constants6.X_OK);
       return candidate;
@@ -107323,7 +107434,7 @@ function findExecutable(name, pathValue, exclude) {
 function materializePublishGuardBin(dir, pathValue = process.env.PATH ?? "") {
   mkdirSync13(dir, { recursive: true });
   const realGit = findExecutable("git", pathValue, dir) ?? "/usr/bin/git";
-  const refusalsPath = shQuote(join27(dir, GUARD_REFUSALS_FILE));
+  const refusalsPath = shQuote(join28(dir, GUARD_REFUSALS_FILE));
   const refuse = [
     `esc=$(printf '%s' "$cmd" | sed 's/\\\\/\\\\\\\\/g; s/"/\\\\"/g' | tr '\\n\\t\\r' '   ')`,
     `printf '{"command":"%s"}\\n' "$esc" >> ${refusalsPath}`,
@@ -107331,7 +107442,7 @@ function materializePublishGuardBin(dir, pathValue = process.env.PATH ?? "") {
     `exit 1`
   ].join("\n");
   writeFileSync9(
-    join27(dir, "gh"),
+    join28(dir, "gh"),
     `#!/bin/sh
 cmd="gh $*"
 ${refuse}
@@ -107339,7 +107450,7 @@ ${refuse}
     { mode: 493 }
   );
   writeFileSync9(
-    join27(dir, "git"),
+    join28(dir, "git"),
     [
       "#!/usr/bin/env node",
       'const { spawnSync } = require("node:child_process")',
@@ -107350,7 +107461,7 @@ ${refuse}
       'const command = ["git", ...args].join(" ")',
       "const refusal = publishCommandRefusal(command)",
       "if (refusal) {",
-      `    try { appendFileSync(${JSON.stringify(join27(dir, GUARD_REFUSALS_FILE))}, JSON.stringify({ command, reason: refusal }) + "\\n") } catch {}`,
+      `    try { appendFileSync(${JSON.stringify(join28(dir, GUARD_REFUSALS_FILE))}, JSON.stringify({ command, reason: refusal }) + "\\n") } catch {}`,
       '    process.stderr.write(refusal + "\\n")',
       "    process.exit(1)",
       "}",
@@ -107362,7 +107473,7 @@ ${refuse}
   );
 }
 function drainGuardRefusals(dir) {
-  const file = join27(dir, GUARD_REFUSALS_FILE);
+  const file = join28(dir, GUARD_REFUSALS_FILE);
   let text3;
   try {
     text3 = readFileSync18(file, "utf8");
@@ -107992,13 +108103,13 @@ function trespassNotice(cwd, surface) {
   if (!surface || Object.keys(surface.ownedElsewhere).length === 0) return "";
   let changed;
   try {
-    const tracked = execFileSync4("git", ["diff", "--name-only", "HEAD"], {
+    const tracked = execFileSync5("git", ["diff", "--name-only", "HEAD"], {
       cwd,
       encoding: "utf8",
       timeout: GIT_DISCOVERY_TIMEOUT_MS,
       maxBuffer: GIT_DISCOVERY_MAX_BUFFER
     });
-    const untracked = execFileSync4(
+    const untracked = execFileSync5(
       "git",
       ["ls-files", "--others", "--exclude-standard"],
       {
@@ -108017,7 +108128,7 @@ function trespassNotice(cwd, surface) {
   const undone = /* @__PURE__ */ new Set();
   for (const target of trespasses) {
     try {
-      execFileSync4("git", ["checkout", "--", target], {
+      execFileSync5("git", ["checkout", "--", target], {
         cwd,
         timeout: GIT_DISCOVERY_TIMEOUT_MS
       });
@@ -111479,7 +111590,7 @@ var CodexCliParticipant = class _CodexCliParticipant extends CliParticipant {
 
 // ../baro-orchestrator/src/harness/one-shot/story-agent.ts
 import { tmpdir as tmpdir10 } from "os";
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 import { setTimeout as setTimeoutPromise } from "timers/promises";
 
 // ../baro-orchestrator/src/harness/activity-monitor.ts
@@ -112502,7 +112613,7 @@ var OneShotStoryAgent = class extends BusMember {
     }
     const originalPath = process.env.PATH;
     if (!this.publishGuardDir) {
-      const dir = join29(
+      const dir = join30(
         tmpdir10(),
         `baro-publish-guard-${this.spec.id}-${process.pid}`
       );
@@ -114754,14 +114865,14 @@ var DevinStoryAgent = class extends OneShotStoryAgent {
 
 // ../baro-orchestrator/src/harness/claude/story-agent.ts
 import { tmpdir as tmpdir12 } from "os";
-import { dirname as dirname13, join as join31 } from "path";
+import { dirname as dirname13, join as join32 } from "path";
 import { setTimeout as setTimeoutPromise2 } from "timers/promises";
 
 // ../baro-orchestrator/src/harness/claude/hook-bridge.ts
-import { execFileSync as execFileSync5 } from "child_process";
+import { execFileSync as execFileSync6 } from "child_process";
 import {
   copyFileSync,
-  existsSync as existsSync20,
+  existsSync as existsSync21,
   mkdirSync as mkdirSync15,
   mkdtempSync as mkdtempSync4,
   readFileSync as readFileSync21,
@@ -114770,7 +114881,7 @@ import {
   writeFileSync as writeFileSync11
 } from "fs";
 import { tmpdir as tmpdir11 } from "os";
-import { dirname as dirname12, join as join30 } from "path";
+import { dirname as dirname12, join as join31 } from "path";
 var HOOK_SCRIPT = `#!/usr/bin/env node
 // Materialized by baro (hook-bridge.ts). The advisory post-bash hook never
 // breaks the agent; the guarding pre-bash and pre-write hooks fail closed:
@@ -114985,11 +115096,11 @@ function materializeStoryHooks(dir, surface, collab, worktreeRoot) {
   });
 }
 function refreshStoryHookSurface(dir, surface, collab) {
-  if (!existsSync20(join30(dir, "surface.json"))) return;
+  if (!existsSync21(join31(dir, "surface.json"))) return;
   writeSurfaceFile(dir, surface, collab);
 }
 function writeSurfaceFile(dir, surface, collab) {
-  const file = join30(dir, "surface.json");
+  const file = join31(dir, "surface.json");
   const staged = `${file}.${process.pid}.tmp`;
   writeFileSync11(
     staged,
@@ -115006,8 +115117,8 @@ function writeSurfaceFile(dir, surface, collab) {
   renameSync6(staged, file);
 }
 function assertHookContainsShell(hookPath) {
-  const probe2 = mkdtempSync4(join30(tmpdir11(), "baro-hook-probe-"));
-  const run2 = (command) => execFileSync5(process.execPath, [join30(probe2, "hook.mjs"), "pre-bash"], {
+  const probe2 = mkdtempSync4(join31(tmpdir11(), "baro-hook-probe-"));
+  const run2 = (command) => execFileSync6(process.execPath, [join31(probe2, "hook.mjs"), "pre-bash"], {
     input: JSON.stringify({ tool_input: { command }, cwd: probe2 }),
     encoding: "utf8",
     timeout: 1e4
@@ -115017,12 +115128,12 @@ function assertHookContainsShell(hookPath) {
   let publishing = "";
   try {
     const dir = dirname12(hookPath);
-    copyFileSync(hookPath, join30(probe2, "hook.mjs"));
-    const settings = JSON.parse(readFileSync21(join30(dir, "containment.json"), "utf8"));
-    writeFileSync11(join30(probe2, "containment.json"), JSON.stringify({ ...settings, osSandbox: false }));
+    copyFileSync(hookPath, join31(probe2, "hook.mjs"));
+    const settings = JSON.parse(readFileSync21(join31(dir, "containment.json"), "utf8"));
+    writeFileSync11(join31(probe2, "containment.json"), JSON.stringify({ ...settings, osSandbox: false }));
     escaping = run2("cd .. && ls");
     inside = run2("ls");
-    writeFileSync11(join30(probe2, "containment.json"), JSON.stringify(settings));
+    writeFileSync11(join31(probe2, "containment.json"), JSON.stringify(settings));
     publishing = run2("git push origin HEAD");
   } finally {
     rmSync7(probe2, { recursive: true, force: true });
@@ -115128,11 +115239,11 @@ function loopbackHostPort(endpoint) {
   }
 }
 function writeHookSettings(dir, containment) {
-  const hookPath = join30(dir, "hook.mjs");
+  const hookPath = join31(dir, "hook.mjs");
   writeFileSync11(hookPath, HOOK_SCRIPT, { mode: 493 });
   const sandbox = containment.worktreeRoot ? claudeStorySandbox(containment.worktreeRoot, containment.brokerEndpoint) : null;
   writeFileSync11(
-    join30(dir, "containment.json"),
+    join31(dir, "containment.json"),
     JSON.stringify(
       {
         worktreeRoot: containment.worktreeRoot ?? null,
@@ -115146,7 +115257,7 @@ function writeHookSettings(dir, containment) {
     )
   );
   assertHookContainsShell(hookPath);
-  const settingsPath = join30(dir, "settings.json");
+  const settingsPath = join31(dir, "settings.json");
   const hook = (mode) => ({
     hooks: [
       {
@@ -115464,7 +115575,7 @@ var StoryAgent = class extends BusMember {
     this.transition("running", `attempt ${attempt}`);
     this.currentProviderCapacitySignal = void 0;
     this.settingsPath ??= this.spec.cliSettingsPath ?? materializePublishGuardHooks(
-      join31(tmpdir12(), `baro-hooks-${this.spec.id}-${process.pid}`),
+      join32(tmpdir12(), `baro-hooks-${this.spec.id}-${process.pid}`),
       this.spec.cwd
     );
     const claude = new ClaudeCliParticipant(this.spec.id, {
@@ -115738,7 +115849,7 @@ function failureSummary2(failure) {
 
 // ../baro-orchestrator/src/execution/story-executor.ts
 import { tmpdir as tmpdir13 } from "os";
-import { join as join32 } from "path";
+import { join as join33 } from "path";
 var LocalStoryExecutor = class {
   supportsCooperativeSuspend(route) {
     return laneQuiescenceWitness(route.backend) === "self" ? true : PROCESS_TREE_CAPABILITIES.cooperativeQuiescenceObservation;
@@ -115754,7 +115865,7 @@ var LocalStoryExecutor = class {
       leaseId: req.leaseId,
       generation: req.generation
     };
-    const hookDir = join32(tmpdir13(), `baro-hooks-${req.storyId}-${process.pid}`);
+    const hookDir = join33(tmpdir13(), `baro-hooks-${req.storyId}-${process.pid}`);
     const hookCollab = {
       command: opts.collaboration?.commandPath ?? "agent-collab",
       capability: "note",
@@ -120241,7 +120352,7 @@ async function orchestrate(config2) {
     const useLibrarian = config2.withLibrarian ?? true;
     const useSentry = config2.withSentry ?? true;
     const useMemory = config2.withMemory ?? true;
-    const sessionsDir = join33(homedir10(), ".baro", "sessions");
+    const sessionsDir = join34(homedir10(), ".baro", "sessions");
     if (useMemory) {
       try {
         const { pruneOldSessions: pruneOldSessions2 } = await Promise.resolve().then(() => (init_dist2(), dist_exports));
@@ -120265,15 +120376,15 @@ async function orchestrate(config2) {
       new URL("../scripts/agent-collab.mjs", import.meta.url)
     );
     const collaborationEpoch = randomUUID10();
-    const collectiveSessionRoot = join33(sessionsDir, runId, "collective");
+    const collectiveSessionRoot = join34(sessionsDir, runId, "collective");
     const collaborationGoalInvariantIds = deriveGoalContract(loadPrd(config2.prdPath).goalEnvelope)?.invariants.map((invariant) => invariant.id) ?? [];
     const collaborationConfig = {
-      commandPath: existsSync21(bundledCollaborationCommand) ? bundledCollaborationCommand : developmentCollaborationCommand,
-      sessionDir: join33(
+      commandPath: existsSync22(bundledCollaborationCommand) ? bundledCollaborationCommand : developmentCollaborationCommand,
+      sessionDir: join34(
         collectiveSessionRoot,
         collaborationEpoch
       ),
-      challengeInflightDir: join33(
+      challengeInflightDir: join34(
         collectiveSessionRoot,
         "challenge-inflight"
       )
@@ -120699,7 +120810,7 @@ async function orchestrate(config2) {
       let responder = config2.goalReviewResponder;
       if (!responder) {
         goalReviewRuntimeCwd = mkdtempSync5(
-          join33(tmpdir14(), "baro-goal-review-runtime-")
+          join34(tmpdir14(), "baro-goal-review-runtime-")
         );
         responder = createDialogueResponder({
           backend: criticLlm,
@@ -120889,7 +121000,7 @@ async function orchestrate(config2) {
       const dialogueBackend = resolveDialogueBackend(config2.dialogueLlm, llm);
       let responder = config2.dialogueResponder;
       if (!responder) {
-        dialogueRuntimeCwd = mkdtempSync5(join33(tmpdir14(), "baro-dialogue-runtime-"));
+        dialogueRuntimeCwd = mkdtempSync5(join34(tmpdir14(), "baro-dialogue-runtime-"));
         responder = createDialogueResponder({
           backend: dialogueBackend,
           cwd: dialogueRuntimeCwd,
@@ -121856,7 +121967,7 @@ async function main() {
   }
   const cwd = resolve19(args.cwd);
   const prdPath = resolve19(cwd, args.prd);
-  if (!existsSync22(prdPath)) {
+  if (!existsSync23(prdPath)) {
     process.stderr.write(`[cli] PRD not found: ${prdPath}
 `);
     process.exit(2);