codecartographer-pi 0.25.0 → 0.26.0

package/dist/core/broadside.js

@@ -31,3729 +31,28 @@
 // executable surfaces (Pi and MCP), not the pure template. What the template does
 // carry is the reading guide for its output — `.codecarto/broadside/SKILL.md`,
 // served by codecarto_skill under the name `broadside` (see readBroadsideSkill).
-import { createHash } from "node:crypto";
-import { mkdir, readFile, readdir, stat, writeFile } from "node:fs/promises";
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import { join, relative } from "node:path";
-import { atomicWriteFile, GIT_TIMEOUT_MS, pathExists, sleep } from "./utils.js";
-import { describeRedactions, isSecretFile, redactSecrets } from "./secrets.js";
-import { acquireLock } from "./status.js";
-import { loadYamlFile } from "./yaml.js";
-import { packagedWorkspaceDir } from "./workspace.js";
-const execFileAsync = promisify(execFile);
-// ---------- constants ----------
-export const BROADSIDE_MODEL = "google/gemini-3.7-flash:batch";
-export const BROADSIDE_BATCH_URL = "https://openrouter.ai/api/beta/batches";
-export const BROADSIDE_DIR = "broadside"; // relative to .codecarto/
-/** Name Broad-Side answers to on the skill surfaces. Not a post-pipeline skill — see readBroadsideSkill. */
-export const BROADSIDE_SKILL_NAME = "broadside";
-export const BROADSIDE_STATE_FILE = "state.json";
-export const BROADSIDE_CONFIG_FILE = "config.yaml";
-export const BROADSIDE_STATE_SCHEMA_VERSION = 1;
-// Per-token pricing in USD (OpenRouter, google/gemini-3.7-flash:batch).
-// OpenRouter's listed rates for the `:batch` variant, which already carry the
-// batch discount — the sync model is $0.75/$3.75. These were half these values
-// until a live run compared them against the catalog: the batch discount had
-// been applied a second time by hand, so every estimate for the default model
-// came out at half its true cost and `max_cost` bound at twice what the user
-// asked for. They are the offline fallback only; the live catalog wins.
-export const BROADSIDE_INPUT_PRICE_PER_M = 0.375;
-export const BROADSIDE_OUTPUT_PRICE_PER_M = 1.875;
-// OpenRouter's public model catalog; pricing, context, and capabilities live
-// per model id. The benchmarks endpoint adds coding/intelligence indices.
-export const BROADSIDE_MODELS_URL = "https://openrouter.ai/api/v1/models";
-export const BROADSIDE_BENCHMARKS_URL = "https://openrouter.ai/api/v1/benchmarks";
-export const BROADSIDE_CATALOG_CACHE_FILE = "model-catalog.json";
-/**
- * What this repository's own submits learned about batch endpoints: which
- * `:batch` ids OpenRouter accepted a job for and which it refused with
- * "does not have a :batch endpoint". The catalog cannot tell the two apart
- * (#141), so the `models` action annotates its rows from this file.
- */
-export const BROADSIDE_ENDPOINTS_FILE = "batch-endpoints.json";
-export const BROADSIDE_CATALOG_CACHE_TTL_MS = 24 * 60 * 60 * 1000;
-export const BROADSIDE_LENS_IDS = [
-    "architecture",
-    "api",
-    "security",
-    "defect",
-    "conventions",
-    "porting",
-];
-export const BROADSIDE_POLL_INTERVAL_MS = 15_000;
-export const BROADSIDE_DEFAULT_POLL_BUDGET_MS = 25 * 60 * 1000;
-/**
- * The run expense limit in USD a repository gets before it configures one.
- * Pi asks a human before submitting over the estimate; the MCP surface cannot,
- * and shipped with no limit at all, so a host calling submit with the stock
- * config spent whatever the estimate came to (#231). One dollar covers a
- * six-lens run of a repository this size with room to spare; a larger one
- * raises `max_cost` in config.yaml, passes `max_cost` on the call, or sets it
- * to 0 for no limit.
- */
-export const BROADSIDE_DEFAULT_MAX_COST = 1;
-/**
- * The reasoning control every lens request carries: low effort.
- *
- * It used to be a token cap — `max_tokens` at a quarter of the lens's output
- * budget, so three quarters stayed for the answer. Measured live on
- * `google/gemini-3.8-flash:batch` (0.22.0 verification, defect lens, cap
- * 5,800 of a 6,000 budget): the model reasoned 5,218 tokens on the first
- * pass and **11,518 under the same cap** on the doubled-budget retry —
- * thinking scaled with `max_tokens` and the cap changed nothing, both
- * results truncated, and the retry cost twice the original for no JSON.
- * The same lens with `effort: "low"` reasoned 0 tokens, finished with
- * `stop`, returned valid JSON, and cost a twelfth as much. Gemini 3.x
- * models take a thinking *level*, not a budget, and OpenRouter forwards a
- * `max_tokens` cap to them as nothing at all; `effort` is what it can
- * translate for every provider (a level where the provider has levels, a
- * fraction of the budget where it takes a budget). So the default asks for
- * little thinking in the one vocabulary that reaches everyone.
- *
- * Deliberately not `enabled: false`: `google/gemini-3.8-flash:batch` refuses
- * the whole batch with *"Reasoning is mandatory for this endpoint and cannot
- * be disabled"*, turning a partial result into none at all. Low effort works
- * whether or not a provider allows reasoning to be switched off.
- */
-export const BROADSIDE_DEFAULT_REASONING = Object.freeze({ effort: "low" });
-/** The reasoning control a lens request carries when config.yaml sets none. */
-export function defaultReasoningFor() {
-    return { ...BROADSIDE_DEFAULT_REASONING };
-}
-/**
- * The reasoning control a truncated slice is re-submitted with.
- *
- * A truncation on a reasoning-capable model is usually thinking that ate the
- * answer's budget, and doubling `max_tokens` doubles the thinking where the
- * provider ignores a token cap (see {@link BROADSIDE_DEFAULT_REASONING}). The
- * retry therefore asks for low effort as well, replacing a `max_tokens` cap
- * (OpenRouter refuses a request carrying both) and lowering a higher effort.
- * An explicit `enabled: false` and an effort already at or below low are left
- * as they are.
- */
-export function retryReasoningFor(original) {
-    if (original?.enabled === false)
-        return { ...original };
-    if (original?.effort === "minimal" || original?.effort === "low")
-        return { ...original };
-    const { max_tokens: _cap, effort: _effort, ...rest } = original ?? {};
-    return { ...rest, effort: "low" };
-}
-export const BROADSIDE_RUN_SLOTS = ["synthesis", "triage", "retry"];
-/**
- * OpenRouter rejected the API key (HTTP 401/403). Thrown from the catalog
- * lookup rather than swallowed into "could not price" or a silent built-in
- * fallback: a run that cannot authenticate cannot submit either, and the
- * message that reaches the user has to say so (#251).
- */
-export class BroadsideAuthError extends Error {
-    httpStatus;
-    detail;
-    constructor(httpStatus, detail) {
-        super(`OpenRouter rejected the API key (HTTP ${httpStatus}${detail ? `: ${detail}` : ""}). ` +
-            "Check OPENROUTER_API_KEY, the api_key parameter, or api_key in .codecarto/broadside/config.yaml. Nothing was submitted.");
-        this.name = "BroadsideAuthError";
-        this.httpStatus = httpStatus;
-        this.detail = detail;
-    }
-}
-/**
- * `broadside/config.yaml` exists but cannot be used. A file that failed to
- * parse used to be treated exactly like an absent one — defaults, including
- * no spend cap and no lens routing, with no message — so a typo removed the
- * user's own guard (#232). Only an absent file yields defaults now.
- */
-export class BroadsideConfigError extends Error {
-    path;
-    constructor(path, detail) {
-        super(`Broad-Side config ${path} ${detail}. Fix or remove the file; nothing runs on defaults while it is unreadable.`);
-        this.name = "BroadsideConfigError";
-        this.path = path;
-    }
-}
-/**
- * `broadside/state.json` exists but cannot be read. It used to be read as
- * empty and the next checkpoint wrote that empty state over it, losing the
- * batch ids of every in-flight, already-paid run (#233). The corrupt file is
- * preserved beside itself and nothing writes over it until someone looks.
- */
-export class BroadsideStateError extends Error {
-    path;
-    backupPath;
-    constructor(path, backupPath, detail) {
-        super(`Broad-Side state ${path} ${detail}. A copy is preserved at ${backupPath}; the file is not overwritten. ` +
-            "Repair state.json from the copy (each run's batch ids are what collect needs), or move it aside to start fresh.");
-        this.name = "BroadsideStateError";
-        this.path = path;
-        this.backupPath = backupPath;
-    }
-}
-/** Thrown when a confirm hook declines a run. Nothing was submitted. */
-export class BroadsideCancelledError extends Error {
-    constructor(message = "Broad-Side submission cancelled. Nothing was submitted.") {
-        super(message);
-        this.name = "BroadsideCancelledError";
-    }
-}
-// ---------- JSON schemas (one per lens, plus synthesis) ----------
-const SCHEMAS = {
-    architecture: {
-        name: "architecture_report",
-        strict: true,
-        schema: {
-            type: "object",
-            properties: {
-                tech_stack: {
-                    type: "object",
-                    properties: {
-                        language: { type: "string" },
-                        version: { type: "string" },
-                        build_system: { type: "string" },
-                        key_dependencies: { type: "array", items: { type: "string" } },
-                    },
-                    required: ["language", "build_system"],
-                    additionalProperties: false,
-                },
-                module_architecture: {
-                    type: "array",
-                    items: {
-                        type: "object",
-                        properties: {
-                            name: { type: "string" },
-                            role: { type: "string" },
-                            file_count: { type: "integer" },
-                            depends_on: { type: "array", items: { type: "string" } },
-                        },
-                        required: ["name", "role"],
-                        additionalProperties: false,
-                    },
-                },
-                data_flow: { type: "string" },
-                entry_points: { type: "array", items: { type: "string" } },
-                notable_patterns: { type: "array", items: { type: "string" } },
-            },
-            required: ["tech_stack", "module_architecture", "data_flow", "entry_points"],
-            additionalProperties: false,
-        },
-    },
-    api_surface: {
-        name: "api_surface_report",
-        strict: true,
-        schema: {
-            type: "object",
-            properties: {
-                endpoints: {
-                    type: "array",
-                    items: {
-                        type: "object",
-                        properties: {
-                            method: { type: "string" },
-                            path: { type: "string" },
-                            handler: { type: "string" },
-                            auth_required: { type: "boolean" },
-                            description: { type: "string" },
-                        },
-                        required: ["method", "path", "handler", "auth_required"],
-                        additionalProperties: false,
-                    },
-                },
-                data_types: {
-                    type: "array",
-                    items: {
-                        type: "object",
-                        properties: {
-                            name: { type: "string" },
-                            kind: { type: "string" },
-                            fields_summary: { type: "string" },
-                        },
-                        required: ["name", "kind"],
-                        additionalProperties: false,
-                    },
-                },
-                authentication_flow: { type: "string" },
-                error_handling: { type: "string" },
-            },
-            required: ["endpoints"],
-            additionalProperties: false,
-        },
-    },
-    security: {
-        name: "security_review_report",
-        strict: true,
-        schema: {
-            type: "object",
-            properties: {
-                findings: {
-                    type: "array",
-                    items: {
-                        type: "object",
-                        properties: {
-                            severity: { type: "string", enum: ["critical", "high", "medium", "low"] },
-                            category: { type: "string" },
-                            title: { type: "string" },
-                            location: { type: "string" },
-                            description: { type: "string" },
-                        },
-                        required: ["severity", "title", "description"],
-                        additionalProperties: false,
-                    },
-                },
-                overall_assessment: { type: "string" },
-                coverage_note: { type: "string" },
-            },
-            required: ["findings", "overall_assessment"],
-            additionalProperties: false,
-        },
-    },
-    defect_mechanical: {
-        name: "defect_scan_report",
-        strict: true,
-        schema: {
-            type: "object",
-            properties: {
-                module: { type: "string" },
-                findings: {
-                    type: "array",
-                    items: {
-                        type: "object",
-                        properties: {
-                            severity: { type: "string", enum: ["high", "medium", "low"] },
-                            pattern: { type: "string" },
-                            title: { type: "string" },
-                            location: { type: "string" },
-                            description: { type: "string" },
-                            suggestion: { type: "string" },
-                        },
-                        required: ["severity", "pattern", "title", "description"],
-                        additionalProperties: false,
-                    },
-                },
-                patterns_checked: { type: "array", items: { type: "string" } },
-                files_scanned: { type: "integer" },
-                overall_notes: { type: "string" },
-            },
-            required: ["module", "findings", "patterns_checked", "files_scanned"],
-            additionalProperties: false,
-        },
-    },
-    conventions: {
-        name: "conventions_report",
-        strict: true,
-        schema: {
-            type: "object",
-            properties: {
-                module: { type: "string" },
-                naming_conventions: {
-                    type: "object",
-                    properties: {
-                        packages: { type: "string" },
-                        types: { type: "string" },
-                        functions: { type: "string" },
-                        variables: { type: "string" },
-                        files: { type: "string" },
-                        tests: { type: "string" },
-                    },
-                    additionalProperties: false,
-                },
-                error_handling_pattern: { type: "string" },
-                logging_approach: { type: "string" },
-                test_patterns: { type: "string" },
-                code_organization: { type: "string" },
-                idioms: { type: "array", items: { type: "string" } },
-                inconsistencies: {
-                    type: "array",
-                    items: {
-                        type: "object",
-                        properties: {
-                            description: { type: "string" },
-                            locations: { type: "array", items: { type: "string" } },
-                        },
-                        required: ["description"],
-                        additionalProperties: false,
-                    },
-                },
-                promotable_conventions: {
-                    type: "array",
-                    items: {
-                        type: "object",
-                        properties: {
-                            title: { type: "string" },
-                            rule: { type: "string" },
-                            evidence: { type: "string" },
-                        },
-                        required: ["title", "rule"],
-                        additionalProperties: false,
-                    },
-                },
-                files_scanned: { type: "integer" },
-            },
-            required: ["module", "naming_conventions", "files_scanned"],
-            additionalProperties: false,
-        },
-    },
-    porting: {
-        name: "porting_surface_report",
-        strict: true,
-        schema: {
-            type: "object",
-            properties: {
-                module: { type: "string" },
-                platform_coupling: {
-                    type: "array",
-                    items: {
-                        type: "object",
-                        properties: {
-                            platform: { type: "string" },
-                            mechanisms: { type: "array", items: { type: "string" } },
-                            files: { type: "array", items: { type: "string" } },
-                        },
-                        required: ["platform", "mechanisms"],
-                        additionalProperties: false,
-                    },
-                },
-                external_dependencies: {
-                    type: "array",
-                    items: {
-                        type: "object",
-                        properties: {
-                            name: { type: "string" },
-                            role: { type: "string" },
-                            replaceability: { type: "string" },
-                        },
-                        required: ["name"],
-                        additionalProperties: false,
-                    },
-                },
-                build_system_complexity: { type: "string" },
-                porting_risk_areas: {
-                    type: "array",
-                    items: {
-                        type: "object",
-                        properties: {
-                            area: { type: "string" },
-                            risk: { type: "string", enum: ["low", "medium", "high"] },
-                            notes: { type: "string" },
-                        },
-                        required: ["area", "risk"],
-                        additionalProperties: false,
-                    },
-                },
-                files_scanned: { type: "integer" },
-            },
-            required: ["module", "platform_coupling", "files_scanned"],
-            additionalProperties: false,
-        },
-    },
-    synthesis: {
-        name: "synthesis_report",
-        strict: true,
-        schema: {
-            type: "object",
-            properties: {
-                executive_summary: { type: "string" },
-                severity_summary: {
-                    type: "object",
-                    properties: {
-                        critical: { type: "integer" },
-                        high: { type: "integer" },
-                        medium: { type: "integer" },
-                        low: { type: "integer" },
-                    },
-                    required: ["critical", "high", "medium", "low"],
-                    additionalProperties: false,
-                },
-                top_findings: {
-                    type: "array",
-                    items: {
-                        type: "object",
-                        properties: {
-                            title: { type: "string" },
-                            severity: { type: "string" },
-                            source_lens: { type: "string" },
-                            summary: { type: "string" },
-                        },
-                        required: ["title", "severity", "source_lens", "summary"],
-                        additionalProperties: false,
-                    },
-                },
-                module_assessments: {
-                    type: "array",
-                    items: {
-                        type: "object",
-                        properties: {
-                            module: { type: "string" },
-                            quality_notes: { type: "string" },
-                            risk_level: { type: "string", enum: ["low", "medium", "high"] },
-                        },
-                        required: ["module", "risk_level"],
-                        additionalProperties: false,
-                    },
-                },
-                porting_readiness: { type: "string" },
-                gaps_and_unknowns: { type: "array", items: { type: "string" } },
-                coverage: { type: "string" },
-            },
-            required: ["executive_summary", "severity_summary", "top_findings"],
-            additionalProperties: false,
-        },
-    },
-    triage: {
-        name: "triage_report",
-        strict: true,
-        schema: {
-            type: "object",
-            properties: {
-                summary: { type: "string" },
-                items: {
-                    type: "array",
-                    items: {
-                        type: "object",
-                        properties: {
-                            title: { type: "string" },
-                            severity: { type: "string" },
-                            module: { type: "string" },
-                            impact: { type: "string", enum: ["high", "medium", "low"] },
-                            difficulty: { type: "string", enum: ["high", "medium", "low"] },
-                            priority: { type: "string" },
-                            effort_estimate: { type: "string" },
-                            rationale: { type: "string" },
-                        },
-                        required: ["title", "severity", "module", "impact", "difficulty", "priority", "rationale"],
-                        additionalProperties: false,
-                    },
-                },
-                omitted: {
-                    type: "array",
-                    items: { type: "string" },
-                    description: "Leads deliberately dropped from the queue and why (duplicates, too vague, out of scope)",
-                },
-            },
-            required: ["summary", "items"],
-            additionalProperties: false,
-        },
-    },
-};
-const TS_PROFILE = {
-    defectPatterns: [
-        "Null/undefined dereference risks (unchecked optional access)",
-        "Error handling gaps (unhandled promise rejections, swallowed catches)",
-        "Resource leaks (unclosed handles, missing cleanup, dangling timers/listeners)",
-        "Race conditions (shared mutable state, async interleavings without guards)",
-        "Integer/precision assumptions in arithmetic",
-        "Unsafe type assumptions (as-casts, any leaks, non-null assertions)",
-        "Panic-prone code (out-of-bounds access, runtime TypeError paths)",
-        "Timezone/locale assumptions",
-    ],
-    conventionCategories: [
-        { key: "packages", label: "modules and imports" },
-        { key: "types", label: "interfaces and type aliases" },
-        { key: "functions", label: "functions (camelCase), components (PascalCase)" },
-        { key: "variables", label: "variables and constants (camelCase)" },
-        { key: "files", label: "file naming (kebab vs camel) and folder organization" },
-        { key: "tests", label: "test files (*.test.ts, describe/it patterns)" },
-    ],
-    idiomHints: ["strict null checks usage", "async/await vs promise chains", "dependency injection patterns"],
-};
-const LANGUAGE_PROFILES = {
-    go: {
-        defectPatterns: [
-            "Nil pointer dereference risks (unchecked returns, missing nil guards)",
-            "Error handling gaps (ignored errors, deferred errors unchecked)",
-            "Resource leaks (unclosed files, connections, goroutines without ctx)",
-            "Race conditions (shared state without sync, channel misuse)",
-            "Integer overflow/underflow in arithmetic or bounds",
-            "Unsafe type assertions without ok check",
-            "Panic-prone code (slice out of bounds, map access without ok)",
-            "Timezone/locale assumptions",
-        ],
-        conventionCategories: [
-            { key: "packages", label: "packages" },
-            { key: "types", label: "types and interfaces" },
-            { key: "functions", label: "functions and methods" },
-            { key: "variables", label: "variables and fields" },
-            { key: "files", label: "file and directory organization" },
-            { key: "tests", label: "test files and table-driven tests" },
-        ],
-        idiomHints: ["error wrapping with %w", "zero-value construction"],
-    },
-    python: {
-        defectPatterns: [
-            "None dereference risks (unchecked optional returns, AttributeError paths)",
-            "Exception handling gaps (bare except, swallowed exceptions, broad catch-all)",
-            "Resource leaks (unclosed files, sockets, connections, context managers)",
-            "Race conditions (shared mutable state, threading without locks, async pitfalls)",
-            "Integer/float precision assumptions in arithmetic",
-            "Unsafe type assumptions (unpacking mismatches, isinstance without fallback)",
-            "Panic-prone code (IndexError/KeyError paths, unbounded slicing)",
-            "Timezone/locale assumptions (naive datetimes)",
-        ],
-        conventionCategories: [
-            { key: "packages", label: "modules and packages" },
-            { key: "types", label: "classes and type hints" },
-            { key: "functions", label: "functions and methods (snake_case vs camelCase)" },
-            { key: "variables", label: "variables and constants" },
-            { key: "files", label: "file and module organization" },
-            { key: "tests", label: "test files (pytest fixtures, naming)" },
-        ],
-        idiomHints: ["dunder method usage", "context manager idioms", "dataclass/pydantic models"],
-    },
-    rust: {
-        defectPatterns: [
-            "Unwrap/expect panics on fallible paths",
-            "Error handling gaps (swallowed Results, lossy conversions)",
-            "Resource leaks (unclosed handles, drop order assumptions)",
-            "Data races and Send/Sync violations (unsafe blocks, interior mutability misuse)",
-            "Integer overflow/underflow (arithmetic, casting)",
-            "Unsafe type assumptions (transmute/casts without invariants)",
-            "Panic-prone code (indexing, slicing, unreachable! in library paths)",
-            "Timezone/locale assumptions",
-        ],
-        conventionCategories: [
-            { key: "packages", label: "crates and modules" },
-            { key: "types", label: "structs, enums, and traits" },
-            { key: "functions", label: "functions and methods (snake_case)" },
-            { key: "variables", label: "variables and constants (SCREAMING_SNAKE)" },
-            { key: "files", label: "module file organization" },
-            { key: "tests", label: "test modules and #[cfg(test)] patterns" },
-        ],
-        idiomHints: ["Result/Option handling with ?", "builder patterns", "trait-based extension"],
-    },
-    typescript: TS_PROFILE,
-    javascript: TS_PROFILE,
-    default: {
-        defectPatterns: [
-            "Null/undefined dereference risks (unchecked optional access)",
-            "Error handling gaps (ignored or swallowed errors)",
-            "Resource leaks (unclosed files, connections, handles)",
-            "Race conditions (shared mutable state without synchronization)",
-            "Integer overflow/underflow in arithmetic or bounds",
-            "Unsafe type assumptions and unchecked casts",
-            "Panic-prone code (out-of-bounds access, missing keys)",
-            "Timezone/locale assumptions",
-        ],
-        conventionCategories: [
-            { key: "packages", label: "modules, packages, or namespaces" },
-            { key: "types", label: "types, classes, and interfaces" },
-            { key: "functions", label: "functions and methods" },
-            { key: "variables", label: "variables and constants" },
-            { key: "files", label: "file and directory organization" },
-            { key: "tests", label: "test files and test organization" },
-        ],
-        idiomHints: [],
-    },
-};
-function languageProfile(language) {
-    return LANGUAGE_PROFILES[language] ?? LANGUAGE_PROFILES.default;
-}
-const LENSES = {
-    architecture: {
-        id: "architecture",
-        name: "Architecture, tech stack & module map",
-        description: "Repo-wide structural analysis from the manifest, entry point, README, and file tree.",
-        schemaName: "architecture",
-        sliceBy: "none",
-        maxChars: 0, // repo-info lens; no file slurping
-        maxTokens: 8000,
-        globsFor: () => [],
-        systemPrompt: () => "You are a senior software architect performing a structural analysis of a " +
-            "codebase. You receive the project manifest, entry point, README excerpt, and " +
-            "file tree. Return a JSON object following the architecture_report schema " +
-            "exactly. All findings must be traceable to the provided files — cite file " +
-            "paths. If you can't determine something, say so rather than guessing.",
-        userPrompt: (info) => {
-            const manifest = info.manifest
-                ? `## ${info.manifest.path}\n\`\`\`\n${info.manifest.content}\n\`\`\`\n\n`
-                : "## Manifest\n[no manifest found]\n\n";
-            return ("Analyze the architecture of this project.\n\n" +
-                manifest +
-                `## Entry point\n\`\`\`\n${info.mainFile || "[missing]"}\n\`\`\`\n\n` +
-                `## README (first 4000 chars)\n${info.readmeFirst || "[missing]"}\n\n` +
-                `## File tree (depth 3, capped)\n${info.fileTree || "[missing]"}\n\n` +
-                "## File counts by extension\n```json\n" +
-                JSON.stringify(info.fileCounts) +
-                "\n```\n\n" +
-                "Return the architecture_report JSON schema.");
-        },
-    },
-    api: {
-        id: "api",
-        name: "API surface audit",
-        description: "Endpoint catalog, request/response types, auth flow, error handling.",
-        schemaName: "api_surface",
-        sliceBy: "none",
-        maxChars: 70_000,
-        maxTokens: 8000,
-        skipTestFiles: true,
-        globsFor: (info) => info.language === "go"
-            ? ["server/**/*.go", "server/*.go", "api/**/*.go", "api/*.go"]
-            : [
-                "server/**",
-                "api/**",
-                "src/server/**",
-                "src/api/**",
-                "mcp-server/**",
-                "**/*routes*",
-                "**/*router*",
-                "**/*handler*",
-                "**/*endpoint*",
-            ],
-        fallbackGlobsFor: (info) => [info.sourceGlob],
-        systemPrompt: () => "You are a senior API auditor. Given source files from an HTTP server, " +
-            "extract every HTTP endpoint (method, path, handler function, auth requirement) " +
-            "and every key request/response data type. Return a JSON object following the " +
-            "api_surface_report schema exactly. Cite specific file:line locations.",
-        userPrompt: (info, source, moduleName) => "Extract the full API surface from these server source files:\n\n" +
-            source +
-            "\n\nReturn the api_surface_report JSON schema.",
-    },
-    security: {
-        id: "security",
-        name: "Security review",
-        description: "Auth, authorization, input validation, TLS, secrets, trust boundaries.",
-        schemaName: "security",
-        sliceBy: "none",
-        maxChars: 70_000,
-        maxTokens: 8000,
-        skipTestFiles: true,
-        globsFor: (info) => info.language === "go"
-            ? ["server/**/*.go", "server/*.go", "**/auth*.go", "**/middleware/**/*.go", "SECURITY.md"]
-            : ["server/**", "**/auth*", "**/middleware/**", "SECURITY.md"],
-        fallbackGlobsFor: (info) => [info.sourceGlob],
-        systemPrompt: () => "You are a security engineer performing a first-pass review of a codebase. " +
-            "Given source files, identify potential security issues — focusing on " +
-            "authentication, authorization, input validation, TLS, secrets handling, " +
-            "and trust boundaries. Return a JSON object following the security_review_report " +
-            "schema. Rate severity as critical/high/medium/low. Be specific: cite file:line. " +
-            "If the provided files don't cover an area, state the gap in coverage_note.",
-        userPrompt: (info, source, moduleName) => "Review these server source files for security issues:\n\n" +
-            source +
-            "\n\nReturn the security_review_report JSON schema.",
-    },
-    defect: {
-        id: "defect",
-        name: "Mechanical defect scan",
-        description: "Nil derefs, error gaps, leaks, races, panics — pattern-based, sliced per module.",
-        schemaName: "defect_mechanical",
-        sliceBy: "auto",
-        maxChars: 60_000,
-        maxTokens: 6000,
-        globsFor: (info) => [info.sourceGlob],
-        systemPrompt: (info) => {
-            const profile = languageProfile(info.language);
-            const patterns = profile.defectPatterns.map((p, i) => `  ${i + 1}. ${p}`).join("\n");
-            return (`You are a senior code reviewer performing an automated defect scan on ${info.language} ` +
-                "source files. Look for these specific patterns:\n" +
-                patterns +
-                "\n\n" +
-                "Return a JSON object following the defect_scan_report schema. " +
-                "Cite file:line for every finding. List which patterns you checked. " +
-                "If the code looks clean for a pattern, say so rather than staying silent. " +
-                "Prefer precision over volume — 3 solid findings beat 15 vague ones.\n\n" +
-                // The verification pass (#143) confirmed 2 of the 12 top findings a
-                // scan produced with the paragraph above alone; the other ten were
-                // casts and assertions every caller satisfied, guards that lived one
-                // call away, or environments the project does not target. The rubric
-                // the verifier applies is asked of the scan itself, up front.
-                "A finding is a reachable failure: name in the description the concrete input, call site, or sequence " +
-                "that reaches it and what then goes wrong. A cast, assertion, `any`, or non-null `!` that every caller " +
-                "you can see satisfies, a hypothetical about a runtime or environment the project does not target, or a " +
-                "style or type-hygiene observation is not a defect — leave it out, or if it is worth a note, report it " +
-                "at severity low under the pattern name `type-hygiene` so it ranks apart from reachable failures. " +
-                "When the guard you looked for may live in another module, say which check you could not find " +
-                "rather than asserting it is absent; severity high or medium is for failures you traced to a trigger.");
-        },
-        userPrompt: (info, source, moduleName) => `Scan this ${info.language} module for mechanical defects.\n\n` +
-            `Module: ${moduleName}\n\n` +
-            "## Source files\n\n" +
-            source +
-            "\n\nReturn the defect_scan_report JSON schema.",
-    },
-    conventions: {
-        id: "conventions",
-        name: "Convention extraction",
-        description: "Naming, error handling, idioms, inconsistencies, promotable conventions.",
-        schemaName: "conventions",
-        sliceBy: "auto",
-        maxChars: 60_000,
-        maxTokens: 6000,
-        globsFor: (info) => [info.sourceGlob],
-        systemPrompt: (info) => {
-            const profile = languageProfile(info.language);
-            const categories = profile.conventionCategories.map((c) => `${c.key} (${c.label})`).join(", ");
-            const idiomHint = profile.idiomHints.length > 0
-                ? ` Keep an eye out for ${info.language} idioms such as ${profile.idiomHints.join(", ")}.`
-                : "";
-            return (`You are a code style analyst extracting conventions from ${info.language} source files. ` +
-                "Catalog naming conventions per category — " + categories + " — plus the dominant " +
-                "error-handling pattern, logging approach, test organization patterns, file/package " +
-                "organization rules, and recurring idioms." + idiomHint +
-                " Also flag inconsistencies — places where the same convention is violated. " +
-                "If you find well-established conventions worth formalizing, list them as " +
-                "promotable_conventions with a title, rule, and evidence from the code. " +
-                "Return a JSON object following the conventions_report schema.");
-        },
-        userPrompt: (info, source, moduleName) => "Extract coding conventions from this module.\n\n" +
-            `Module: ${moduleName}\n\n` +
-            "## Source files\n\n" +
-            source +
-            "\n\nReturn the conventions_report JSON schema.",
-    },
-    porting: {
-        id: "porting",
-        name: "Porting surface assessment",
-        description: "Platform coupling, external deps, build complexity, porting risk areas.",
-        schemaName: "porting",
-        sliceBy: "auto",
-        maxChars: 60_000,
-        maxTokens: 6000,
-        skipTestFiles: true,
-        globsFor: (info) => [
-            info.sourceGlob,
-            "**/*.c",
-            "**/*.h",
-            "**/*.cpp",
-            "**/*.cc",
-            "**/*.m",
-            "**/*.mm",
-            "**/CMakeLists.txt",
-            "**/*.cmake",
-            "go.mod",
-        ],
-        systemPrompt: () => "You are a software portability analyst. Examine source files and " +
-            "identify everything that ties this codebase to a specific platform, OS, " +
-            "architecture, or external dependency. Catalog: platform-specific build tags, " +
-            "FFI usage, OS-specific syscalls, external library bindings, and " +
-            "compile-time constants that encode platform assumptions. " +
-            "For each external dependency, note whether it could be replaced by a " +
-            "cross-platform alternative. Assess the build system complexity. " +
-            "Return a JSON object following the porting_surface_report schema.",
-        userPrompt: (info, source, moduleName) => "Assess porting surface for this module.\n\n" +
-            `Module: ${moduleName}\n\n` +
-            "## Source files\n\n" +
-            source +
-            "\n\nReturn the porting_surface_report JSON schema.",
-    },
-};
-export function getLens(lensId) {
-    return LENSES[lensId];
-}
-export function listLenses() {
-    return BROADSIDE_LENS_IDS.map((id) => LENSES[id]);
-}
-// ---------- repo info ----------
-const SKIP_DIR_NAMES = new Set([
-    ".git",
-    ".github",
-    ".claude",
-    ".opencode",
-    ".codecarto",
-    "node_modules",
-    "vendor",
-    "dist",
-    "build",
-    "target",
-    "testdata",
-    "__pycache__",
-]);
-const SKIP_FILE_EXTENSIONS = new Set([
-    ".png",
-    ".jpg",
-    ".jpeg",
-    ".gif",
-    ".svg",
-    ".ico",
-    ".icns",
-    ".bmp",
-    ".webp",
-    ".mp3",
-    ".mp4",
-    ".mov",
-    ".avi",
-    ".wav",
-    ".ogg",
-    ".zip",
-    ".gz",
-    ".tar",
-    ".bz2",
-    ".xz",
-    ".7z",
-    ".pdf",
-    ".woff",
-    ".woff2",
-    ".ttf",
-    ".eot",
-    ".otf",
-    ".bin",
-    ".exe",
-    ".dll",
-    ".so",
-    ".dylib",
-    ".a",
-    ".o",
-    ".obj",
-    ".class",
-    ".jar",
-    ".war",
-    ".pyc",
-    ".wasm",
-    ".model",
-    ".bpe",
-]);
-/**
- * Manifest files and the languages each one can mean. `package.json` covers
- * both TypeScript and JavaScript; which of the two a repository is comes from
- * counting its source files, not from the manifest.
- */
-const MANIFEST_CANDIDATES = [
-    ["go.mod", ["go"]],
-    ["package.json", ["typescript", "javascript"]],
-    ["Cargo.toml", ["rust"]],
-    ["pyproject.toml", ["python"]],
-    ["setup.py", ["python"]],
-    ["requirements.txt", ["python"]],
-];
-/** The languages Broad-Side can scan; anything else is refused at submit. */
-export const BROADSIDE_LANGUAGES = ["go", "python", "rust", "typescript", "javascript"];
-/** Chars of the entry-point file and the manifest that ride in the architecture prompt (#249). */
-const REPO_INFO_FILE_CAP = 20_000;
-const SOURCE_SPECS = {
-    go: { glob: "**/*.go", exts: [".go"] },
-    python: { glob: "**/*.py", exts: [".py"] },
-    rust: { glob: "**/*.rs", exts: [".rs"] },
-    typescript: { glob: "**/*.ts", exts: [".ts", ".tsx"] },
-    javascript: { glob: "**/*.js", exts: [".js", ".jsx"] },
-};
-/**
- * The files a run scans, and where they came from. Contents are always read
- * from the working tree, so the list is the working tree's too: tracked files
- * plus untracked ones git does not ignore, minus files deleted on disk. The
- * list used to come from `git ls-tree HEAD`, so a run mixed the committed
- * file list with uncommitted contents and never saw an untracked file (#248).
- * A target that is not a git repository gets a bounded walk.
- */
-export async function listRepoFiles(targetDir) {
-    try {
-        const listed = await execFileAsync("git", ["-C", targetDir, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { maxBuffer: 64 * 1024 * 1024, timeout: GIT_TIMEOUT_MS });
-        const deleted = await execFileAsync("git", ["-C", targetDir, "ls-files", "-z", "--deleted"], {
-            maxBuffer: 64 * 1024 * 1024,
-            timeout: GIT_TIMEOUT_MS,
-        });
-        const gone = new Set(deleted.stdout.split("\0").filter(Boolean));
-        const files = listed.stdout.split("\0").filter((path) => path && !gone.has(path));
-        return { files, snapshot: "working-tree" };
-    }
-    catch {
-        return { files: await walkFiles(targetDir, targetDir, 0, 30_000), snapshot: "walk" };
-    }
-}
-async function gitHead(targetDir) {
-    try {
-        const { stdout } = await execFileAsync("git", ["-C", targetDir, "rev-parse", "HEAD"], { maxBuffer: 1024 * 1024, timeout: GIT_TIMEOUT_MS });
-        return stdout.trim() || null;
-    }
-    catch {
-        return null;
-    }
-}
-async function gitDirty(targetDir) {
-    try {
-        const { stdout } = await execFileAsync("git", ["-C", targetDir, "status", "--porcelain"], { maxBuffer: 1024 * 1024, timeout: GIT_TIMEOUT_MS });
-        return stdout.trim().length > 0;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Repo-relative paths changed since `baseHead` (or all files when there is
- * no base). Returns null when the diff cannot be computed (non-git tree,
- * missing base commit) so callers fall back to a full scan.
- */
-async function changedFilesSince(targetDir, baseHead) {
-    if (!baseHead)
-        return null;
-    try {
-        const { stdout } = await execFileAsync("git", ["-C", targetDir, "diff", "--name-only", baseHead, "HEAD"], { maxBuffer: 64 * 1024 * 1024, timeout: GIT_TIMEOUT_MS });
-        return new Set(stdout.split("\n").filter(Boolean));
-    }
-    catch {
-        return null;
-    }
-}
-async function walkFiles(rootDir, dir, depth, remaining) {
-    if (remaining <= 0)
-        return [];
-    let out = [];
-    let entries = [];
-    try {
-        entries = await readdir(dir, { withFileTypes: true });
-    }
-    catch {
-        return out;
-    }
-    for (const entry of entries) {
-        if (entry.name.startsWith("."))
-            continue;
-        if (entry.isDirectory()) {
-            if (SKIP_DIR_NAMES.has(entry.name))
-                continue;
-            if (depth > 8)
-                continue;
-            const children = await walkFiles(rootDir, join(dir, entry.name), depth + 1, remaining - out.length);
-            out = out.concat(children);
-        }
-        else if (entry.isFile()) {
-            // relative() rather than slice(rootDir.length + 1): the hand-rolled
-            // slice cut one character too many whenever rootDir carried a trailing
-            // separator, and mangled every path outright when rootDir was "/".
-            const rel = relative(rootDir, join(dir, entry.name)).split("\\").join("/");
-            out.push(rel);
-        }
-    }
-    return out;
-}
-function sourceFileCount(language, fileCounts) {
-    return (SOURCE_SPECS[language]?.exts ?? []).reduce((sum, ext) => sum + (fileCounts[ext] ?? 0), 0);
-}
-/**
- * The language the lenses scan as. The manifests present name the candidates
- * (all of them, not the first one found: a Python service with a
- * `package.json` for its docs tooling is not a TypeScript repository), and
- * among candidates the one with the most source files wins; without a
- * manifest, the language with the most source files; without any source
- * file, `unknown` — which submit refuses rather than scanning nothing and
- * paying for it (#250). Ties keep manifest order.
- */
-function detectLanguage(fileCounts, manifestPaths) {
-    const candidates = [];
-    for (const [candidate, languages] of MANIFEST_CANDIDATES) {
-        if (!manifestPaths.includes(candidate))
-            continue;
-        for (const language of languages)
-            if (!candidates.includes(language))
-                candidates.push(language);
-    }
-    const pool = candidates.length > 0 ? candidates : [...BROADSIDE_LANGUAGES];
-    let best = null;
-    let bestCount = -1;
-    for (const language of pool) {
-        const count = sourceFileCount(language, fileCounts);
-        if (count > bestCount) {
-            best = language;
-            bestCount = count;
-        }
-    }
-    if (bestCount > 0)
-        return best;
-    // A manifest with no source files behind it still names the language;
-    // submit reports the empty count. No manifest and no source: unknown.
-    return candidates[0] ?? "unknown";
-}
-/** Cut a file that rides whole in a prompt down to the cap, saying so (#249). */
-function capForPrompt(content, cap) {
-    if (content.length <= cap)
-        return content;
-    return `${content.slice(0, cap)}\n… [truncated: ${cap.toLocaleString()} of ${content.length.toLocaleString()} chars shown]\n`;
-}
-export async function collectRepoInfo(targetDir, opts = {}) {
-    const redact = opts.redact ?? true;
-    const { files: allFiles, snapshot } = await listRepoFiles(targetDir);
-    // Named credential stores are out of every lens (isSlurpable); listed here
-    // so the submit report can say so.
-    const secretFilesSkipped = allFiles.filter((path) => isSecretFile(path)).sort();
-    let redactedValues = 0;
-    // The entry point, manifest, and README ride in the architecture prompt
-    // as text, so they get the same pass the slices do (#252).
-    const clean = (text) => {
-        if (!redact)
-            return text;
-        const redaction = redactSecrets(text);
-        redactedValues += redaction.count;
-        return redaction.text;
-    };
-    const fileCounts = {};
-    for (const f of allFiles) {
-        const slash = f.lastIndexOf("/");
-        const base = slash >= 0 ? f.slice(slash + 1) : f;
-        const dot = base.lastIndexOf(".");
-        const ext = dot > 0 ? base.slice(dot).toLowerCase() : "(no ext)";
-        fileCounts[ext] = (fileCounts[ext] ?? 0) + 1;
-    }
-    const sortedCounts = {};
-    for (const [ext, n] of Object.entries(fileCounts).sort((a, b) => b[1] - a[1])) {
-        sortedCounts[ext] = n;
-    }
-    // Every manifest present counts toward language detection; the first one
-    // found is the one the architecture prompt shows.
-    const manifestPaths = [];
-    for (const [candidate] of MANIFEST_CANDIDATES) {
-        if (await pathExists(join(targetDir, candidate)))
-            manifestPaths.push(candidate);
-    }
-    const language = detectLanguage(sortedCounts, manifestPaths);
-    // Show the manifest that belongs to the detected language when there is
-    // one, so a polyglot repo's prompt does not open with the other stack's file.
-    const manifestPath = manifestPaths.find((path) => MANIFEST_CANDIDATES.find(([candidate]) => candidate === path)?.[1].includes(language))
-        ?? manifestPaths[0]
-        ?? null;
-    let manifest = null;
-    if (manifestPath) {
-        try {
-            manifest = { path: manifestPath, content: capForPrompt(clean(await readFile(join(targetDir, manifestPath), "utf8")), REPO_INFO_FILE_CAP) };
-        }
-        catch {
-            manifest = null;
-        }
-    }
-    // Read whole and unbounded before, and then estimated at a flat 6,000
-    // chars: a large entry point shipped in full while the cap was checked
-    // against a number that had nothing to do with it (#249).
-    let mainFile = "";
-    for (const candidate of ["main.go", "main.py", "src/main.rs", "src/index.ts", "index.ts", "src/index.js", "index.js"]) {
-        const p = join(targetDir, candidate);
-        if (await pathExists(p)) {
-            try {
-                mainFile = capForPrompt(clean(await readFile(p, "utf8")), REPO_INFO_FILE_CAP);
-            }
-            catch {
-                mainFile = "";
-            }
-            break;
-        }
-    }
-    let readmeFirst = "";
-    const readmePath = join(targetDir, "README.md");
-    if (await pathExists(readmePath)) {
-        try {
-            readmeFirst = clean((await readFile(readmePath, "utf8")).slice(0, 4000));
-        }
-        catch {
-            readmeFirst = "";
-        }
-    }
-    const fileTree = buildFileTree(allFiles);
-    // An unknown language used to fall through to Go's globs, so the code
-    // lenses matched nothing and the run paid for empty batches (#250).
-    const sourceSpec = SOURCE_SPECS[language] ?? { glob: "", exts: [] };
-    const name = targetDir.split(/[\\/]/).filter(Boolean).pop() ?? "repo";
-    const sourceFiles = allFiles.filter((path) => isSlurpable(path) && sourceSpec.exts.some((ext) => path.toLowerCase().endsWith(ext))).length;
-    return {
-        name,
-        path: targetDir,
-        language,
-        manifest,
-        mainFile,
-        readmeFirst,
-        fileTree,
-        fileCounts: sortedCounts,
-        sourceGlob: sourceSpec.glob,
-        sourceExts: sourceSpec.exts,
-        sourceFileCount: sourceFiles,
-        snapshot,
-        secretFilesSkipped,
-        redactedValues,
-    };
-}
-function buildFileTree(allFiles, maxDepth = 3, maxLines = 200) {
-    const lines = [];
-    let count = 0;
-    for (const f of allFiles) {
-        if (f.split("/").length - 1 > maxDepth)
-            continue;
-        if (f.startsWith(".git/") || f.startsWith(".github/"))
-            continue;
-        if (f.endsWith(".sum") || f.endsWith(".lock"))
-            continue;
-        lines.push(f);
-        count += 1;
-        if (count >= maxLines) {
-            lines.push(`... (${allFiles.length} total files, showing first ${maxLines})`);
-            break;
-        }
-    }
-    return lines.join("\n");
-}
-// ---------- glob matching & file slurping ----------
-function globToRegExp(glob) {
-    let re = "";
-    for (let i = 0; i < glob.length; i++) {
-        const c = glob[i];
-        if (c === "*") {
-            if (glob[i + 1] === "*") {
-                // `**/` matches zero or more directories; a trailing `**`
-                // matches anything including slashes.
-                if (glob[i + 2] === "/") {
-                    re += "(?:.*/)?";
-                    i += 2;
-                }
-                else {
-                    re += ".*";
-                    i += 1;
-                }
-            }
-            else {
-                re += "[^/]*";
-            }
-        }
-        else if (c === "?") {
-            re += "[^/]";
-        }
-        else {
-            re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
-        }
-    }
-    return new RegExp(`^${re}$`);
-}
-function matchesAnyGlob(path, globs) {
-    for (const glob of globs) {
-        if (globToRegExp(glob).test(path))
-            return true;
-    }
-    return false;
-}
-export function isSlurpable(relPath) {
-    // A credential store is never a lens input, whatever its globs say (#252).
-    if (isSecretFile(relPath))
-        return false;
-    const segments = relPath.split("/");
-    for (const seg of segments) {
-        if (SKIP_DIR_NAMES.has(seg))
-            return false;
-    }
-    const slash = relPath.lastIndexOf("/");
-    const base = slash >= 0 ? relPath.slice(slash + 1) : relPath;
-    const dot = base.lastIndexOf(".");
-    if (dot > 0 && SKIP_FILE_EXTENSIONS.has(base.slice(dot).toLowerCase()))
-        return false;
-    return true;
-}
-function sanitizeId(segment) {
-    return segment.replace(/[^a-zA-Z0-9_-]+/g, "-").replace(/^-+|-+$/g, "") || "root";
-}
-function topLevelModule(relPath) {
-    const slash = relPath.indexOf("/");
-    return slash >= 0 ? relPath.slice(0, slash) : "root";
-}
-function isTestFile(relPath) {
-    const base = relPath.slice(relPath.lastIndexOf("/") + 1);
-    return /[._](test|spec)\.[a-z]+$/i.test(base) || base.includes("_test.");
-}
-/**
- * "auto" slicing: directory-slice when the repo is large enough that a
- * single whole-repo slice would overflow the lens's char cap, otherwise a
- * single slice. The threshold is the lens's own cap — a repo whose matching
- * files fit in one slice gains nothing from per-module splitting, and a
- * small repo pays for it in extra requests.
- */
-function resolveSliceMode(lens, files, totalChars) {
-    if (lens.sliceBy !== "auto")
-        return lens.sliceBy;
-    return totalChars > lens.maxChars ? "directory" : "none";
-}
-function collectFilesMatching(allFiles, lens, globs) {
-    if (globs.length === 0)
-        return [];
-    const out = [];
-    for (const f of allFiles) {
-        if (!isSlurpable(f))
-            continue;
-        if (lens.skipTestFiles && isTestFile(f))
-            continue;
-        if (!matchesAnyGlob(f, globs))
-            continue;
-        out.push({ relPath: f, moduleName: topLevelModule(f) });
-    }
-    return out;
-}
-/** Code in any language Broad-Side scans as, whatever this repo's is. */
-const SOURCE_EXTENSIONS = new Set(Object.values(SOURCE_SPECS).flatMap((spec) => spec.exts));
-function isSourceFile(relPath) {
-    const dot = relPath.lastIndexOf(".");
-    return dot > relPath.lastIndexOf("/") && SOURCE_EXTENSIONS.has(relPath.slice(dot).toLowerCase());
-}
-/** `a, b, c and 4 more` — a matched-file list short enough for a status line. */
-function listSome(paths, max = 3) {
-    if (paths.length <= max)
-        return paths.join(", ");
-    return `${paths.slice(0, max).join(", ")} and ${paths.length - max} more`;
-}
-/**
- * The files a lens will read: its targeted globs, or — when those match no
- * source file and the lens declares a fallback — the fallback globs on top
- * of whatever did match, with a sentence saying so (#319). The sentence
- * travels to the estimate, the batch entry, and the prompt, so a fallback
- * scan is never a silent one.
- *
- * "No source file" rather than "no file": a policy document or a config
- * file under a targeted path satisfies the globs and leaves the lens with
- * nothing to review, and the coverage note it writes back is the only sign.
- */
-export function selectLensFiles(allFiles, lens, info) {
-    const globs = lens.globsFor(info).filter(Boolean);
-    const targeted = collectFilesMatching(allFiles, lens, globs);
-    if (globs.length === 0 || !lens.fallbackGlobsFor)
-        return { files: targeted };
-    if (targeted.some((f) => isSourceFile(f.relPath)))
-        return { files: targeted };
-    const fallbackGlobs = lens.fallbackGlobsFor(info).filter(Boolean);
-    const matched = new Set(targeted.map((f) => f.relPath));
-    const sources = collectFilesMatching(allFiles, lens, fallbackGlobs).filter((f) => !matched.has(f.relPath));
-    if (sources.length === 0)
-        return { files: targeted };
-    const excluded = lens.skipTestFiles ? "test files excluded" : "";
-    const scanned = `scanned all ${info.language} sources (${fallbackGlobs.join(", ")})`;
-    return {
-        // What did match rides first: the policy the model is about to check
-        // the code against, ahead of the code.
-        files: [...targeted, ...sources],
-        fallback: targeted.length === 0
-            ? `no files matched ${globs.join(", ")}${excluded ? ` (${excluded})` : ""}; ${scanned} instead`
-            : `no source files matched ${globs.join(", ")} (only ${listSome(targeted.map((f) => f.relPath))}` +
-                `${excluded ? `; ${excluded}` : ""}); ${scanned} as well`,
-    };
-}
-function collectLensFiles(allFiles, lens, info) {
-    return selectLensFiles(allFiles, lens, info).files;
-}
-async function slurpFileList(targetDir, files, maxChars, redact = true) {
-    const slices = [];
-    let currentModule = "";
-    let parts = [];
-    let running = 0;
-    let fileCount = 0;
-    let filePaths = [];
-    let redactedValues = 0;
-    let redactedFiles = [];
-    const flush = () => {
-        if (parts.length === 0)
-            return;
-        slices.push({
-            moduleName: currentModule,
-            content: parts.join("\n"),
-            fileCount,
-            chars: running,
-            files: filePaths,
-            redactedValues,
-            redactedFiles,
-        });
-        parts = [];
-        running = 0;
-        fileCount = 0;
-        filePaths = [];
-        redactedValues = 0;
-        redactedFiles = [];
-    };
-    for (const file of files) {
-        let content = "";
-        try {
-            content = await readFile(join(targetDir, file.relPath), "utf8");
-        }
-        catch (error) {
-            // The listing is the working tree's, so this is a race with a
-            // concurrent delete rather than a listed-but-deleted file; skip it.
-            if (error.code === "ENOENT")
-                continue;
-            content = "[BINARY or UNREADABLE]";
-        }
-        if (redact) {
-            // Before the slice is built, so the count and the chars the estimate
-            // sees are of what is actually sent (#252).
-            const redaction = redactSecrets(content);
-            if (redaction.count > 0) {
-                content = redaction.text;
-                redactedValues += redaction.count;
-                redactedFiles.push(file.relPath);
-            }
-        }
-        const block = `=== ${file.relPath} ===\n${content}\n`;
-        if (file.moduleName !== currentModule && parts.length > 0) {
-            flush();
-        }
-        currentModule = file.moduleName;
-        if (running + block.length > maxChars && parts.length > 0) {
-            // Slice is full: flush it and start another slice for the same module
-            // rather than truncating, so big modules get full coverage.
-            flush();
-            currentModule = file.moduleName;
-        }
-        parts.push(block);
-        running += block.length;
-        fileCount += 1;
-        filePaths.push(file.relPath);
-    }
-    flush();
-    return slices;
-}
-export async function gatherSlices(targetDir, lens, info, opts = {}) {
-    const redact = opts.redact ?? true;
-    if (lens.sliceBy === "none" && lens.globsFor(info).length === 0) {
-        // Repo-info lens (architecture): the prompt is built from info alone.
-        return [{ moduleName: "root", content: "", fileCount: 0, chars: 0, files: [] }];
-    }
-    const { files: allFiles } = await listRepoFiles(targetDir);
-    const { files, fallback } = selectLensFiles(allFiles, lens, info);
-    const totalChars = await sumFileSizes(targetDir, files);
-    const mode = resolveSliceMode(lens, files, totalChars);
-    const slices = mode === "none"
-        // Whole-repo slice: one module named after the repo, so a small
-        // repo produces a single request instead of one per directory.
-        ? await slurpFileList(targetDir, files.map((f) => ({ ...f, moduleName: info.name })), lens.maxChars, redact)
-        : await slurpFileList(targetDir, files, lens.maxChars, redact);
-    if (fallback)
-        for (const slice of slices)
-            slice.fallback = fallback;
-    return slices;
-}
-async function sumFileSizes(targetDir, files) {
-    let total = 0;
-    for (const f of files) {
-        try {
-            total += (await stat(join(targetDir, f.relPath))).size;
-        }
-        catch {
-            // Unreadable file — slurpFileList substitutes a placeholder.
-        }
-    }
-    return total;
-}
-// ---------- request building ----------
-export function buildBatchRequest(lens, info, slice, index, sliceCount, model = BROADSIDE_MODEL, maxTokensOverride, reasoningOverride) {
-    const moduleTag = sanitizeId(slice.moduleName);
-    const customId = sliceCount > 1 ? `${lens.id}-${moduleTag}-${index + 1}` : `${lens.id}-${moduleTag}`;
-    return {
-        custom_id: customId,
-        body: {
-            model,
-            messages: [
-                { role: "system", content: lens.systemPrompt(info) },
-                {
-                    role: "user",
-                    content: 
-                    // A fallback scan is not "server source files": say what it is,
-                    // so the model judges the trust boundary wherever it appears
-                    // and does not report the missing server/ as a finding (#319).
-                    (slice.fallback
-                        ? `NOTE: this repository has no source files under the paths this lens usually reads (${slice.fallback}). ` +
-                            "What follows is every source file it has, after anything those paths did match; locate the trust boundary and the request-handling code wherever they live.\n\n"
-                        : "") + lens.userPrompt(info, slice.content, slice.moduleName),
-                },
-            ],
-            response_format: { type: "json_schema", json_schema: SCHEMAS[lens.schemaName] },
-            max_tokens: maxTokensOverride ?? lens.maxTokens,
-            // Always sent, never inherited: an absent field means the model's
-            // own default, and that default is what truncated the JSON.
-            reasoning: reasoningOverride ?? lens.reasoning ?? defaultReasoningFor(),
-        },
-    };
-}
-/**
- * Pre-flight cost estimate for one lens.
- *
- * Every slice is its own batch request, so both halves scale with the slice
- * count. The output half used to be a single `maxTokens * 0.75` for the whole
- * lens no matter how many requests it sent — on a repository that sliced into
- * 13 modules that budgeted one request's output and shipped thirteen, and a
- * live run came in at roughly 3x its estimate. Since this number is what
- * `max_cost` binds against, under-counting it lets a run outspend the cap the
- * user set.
- *
- * @param info - Repo info, when the caller has it: lets the estimate include
- *   the system prompt and JSON schema each request carries. Omitted, the
- *   estimate covers slice content only, which is what the old signature did.
- */
-export function estimateCost(lens, slices, pricing, maxTokensOverride, info) {
-    // With repo info, size each request from the user prompt that would be
-    // sent, which is what the architecture lens is made of: it used to be
-    // estimated at a flat 6,000 chars while the entry point, manifest, README
-    // excerpt and file tree it carries ran to whatever they ran to (#249).
-    // Without info, the slice content alone is what the old signature covered.
-    const sliceChars = slices.reduce((sum, s) => sum + (info ? lens.userPrompt(info, s.content, s.moduleName).length : lens.maxChars === 0 ? 6000 : s.chars), 0);
-    // The system prompt and the response schema ride on every request, so they
-    // are paid once per slice rather than once per lens.
-    const perRequestOverhead = info
-        ? (lens.systemPrompt(info)?.length ?? 0) + JSON.stringify(SCHEMAS[lens.schemaName] ?? {}).length
-        : 0;
-    const inputTokens = Math.ceil((sliceChars + perRequestOverhead * slices.length) / 4);
-    const outputTokens = slices.length * Math.ceil((maxTokensOverride ?? lens.maxTokens) * 0.75);
-    const cost = (inputTokens / 1_000_000) * pricing.inputPerM +
-        (outputTokens / 1_000_000) * pricing.outputPerM;
-    return { inputTokens, outputTokens, cost };
-}
-// ---------- state & config ----------
-export function broadsideDirFor(cwd) {
-    return join(cwd, ".codecarto", BROADSIDE_DIR);
-}
-/**
- * Read the Broad-Side reading guide.
- *
- * It is deliberately not a post-pipeline skill under `.codecarto/skills/`: a
- * scout run is read *before* or *during* the interactive pipeline, and the
- * post-pipeline machinery gates on a completed run and wraps its prompt in
- * post-pipeline framing that would be false here. It is also readable on a
- * repository that has scout state and no workspace at all, which is why this
- * falls back to the packaged copy.
- *
- * @param cwd - Absolute path to the target repository.
- * @returns the skill text and the path it came from.
- * @throws when neither the workspace copy nor the packaged copy exists.
- */
-export async function readBroadsideSkill(cwd) {
-    const candidates = [
-        join(broadsideDirFor(cwd), "SKILL.md"),
-        join(packagedWorkspaceDir, BROADSIDE_DIR, "SKILL.md"),
-    ];
-    for (const path of candidates) {
-        if (await pathExists(path))
-            return { path, content: await readFile(path, "utf8") };
-    }
-    throw new Error(`Broad-Side skill not found at ${candidates.join(" or ")}. Reinstall codecartographer-pi.`);
-}
-export function defaultBroadsideState() {
-    return { schema_version: BROADSIDE_STATE_SCHEMA_VERSION, runs: [] };
-}
-export async function loadBroadsideState(broadsideDir) {
-    const statePath = join(broadsideDir, BROADSIDE_STATE_FILE);
-    if (!(await pathExists(statePath)))
-        return defaultBroadsideState();
-    const text = await readFile(statePath, "utf8");
-    let raw;
-    try {
-        raw = JSON.parse(text);
-    }
-    catch (error) {
-        throw new BroadsideStateError(statePath, await preserveCorruptState(statePath, text), `could not be parsed (${error instanceof Error ? error.message : String(error)})`);
-    }
-    if (!raw || typeof raw !== "object" || !Array.isArray(raw.runs)) {
-        throw new BroadsideStateError(statePath, await preserveCorruptState(statePath, text), "is not a state file (expected an object with a runs array)");
-    }
-    return raw;
-}
-/**
- * Copy an unreadable state file to `state.json.corrupt-<hash>` beside it,
- * named by content so repeated loads do not multiply copies. Returns the
- * copy's path (the existing one, when the same content was preserved before).
- */
-async function preserveCorruptState(statePath, text) {
-    const digest = createHash("sha1").update(text).digest("hex").slice(0, 8);
-    const backupPath = `${statePath}.corrupt-${digest}`;
-    if (!(await pathExists(backupPath)))
-        await writeFile(backupPath, text, "utf8");
-    return backupPath;
-}
-/**
- * Overwrite `state.json` wholesale with `state`.
- *
- * Prefer {@link persistBroadsideRun} anywhere a live operation is recording its
- * own progress — this entry point replaces the file, so any run a concurrent
- * process recorded in the meantime is erased. It remains the right call for
- * seeding a fresh workspace and for test fixtures, where "make the file exactly
- * this" is the intent.
- */
-export async function saveBroadsideState(broadsideDir, state) {
-    await mkdir(broadsideDir, { recursive: true });
-    const statePath = join(broadsideDir, BROADSIDE_STATE_FILE);
-    const lock = await acquireLock(`${statePath}.lock`);
-    try {
-        await writeBroadsideStateFile(statePath, state);
-    }
-    finally {
-        await lock.release();
-    }
-}
-/** Serialize through a temp file so a crash mid-write cannot truncate state.json. */
-async function writeBroadsideStateFile(statePath, state) {
-    await atomicWriteFile(statePath, `${JSON.stringify(state, null, "\t")}\n`);
-}
-/**
- * Read-modify-write `state.json` under a lock.
- *
- * The lock is held only for the read-modify-write, never for the surrounding
- * operation: a `collect` can poll for the better part of an hour, and holding
- * the lock across that would push every concurrent caller past the 5s lock
- * timeout.
- */
-export async function updateBroadsideStateAtomically(broadsideDir, mutate) {
-    await mkdir(broadsideDir, { recursive: true });
-    const statePath = join(broadsideDir, BROADSIDE_STATE_FILE);
-    const lock = await acquireLock(`${statePath}.lock`);
-    try {
-        const state = await loadBroadsideState(broadsideDir);
-        await mutate(state);
-        await writeBroadsideStateFile(statePath, state);
-        return state;
-    }
-    finally {
-        await lock.release();
-    }
-}
-/**
- * Record one run's current shape, merged into whatever is on disk *now*.
- *
- * Broad-Side operations are long-lived and hold their state in memory while
- * they poll. Writing that snapshot back wholesale silently erased any run a
- * concurrent operation had recorded since it was loaded, orphaning that run's
- * paid results on disk — present as files, invisible to `list`, and unreachable
- * by `collect`, which finds its run by position in `state.runs`. Observed live:
- * a submit at 23:35 was erased by a collect that had loaded state before it and
- * wrote back at 00:08.
- *
- * Merging by run id also self-heals: a run erased by an older writer is
- * restored the next time its own operation checkpoints.
- */
-export async function persistBroadsideRun(broadsideDir, run) {
-    return updateBroadsideStateAtomically(broadsideDir, (state) => {
-        const index = state.runs.findIndex((candidate) => candidate.id === run.id);
-        if (index === -1)
-            state.runs.push(run);
-        else
-            state.runs[index] = run;
-    });
-}
-/** Where a lens batch entry stands, for keeping the more advanced of two. */
-function batchEntryRank(entry) {
-    if (!entry)
-        return -1;
-    if (BROADSIDE_TERMINAL_ENTRY_STATUSES.includes(entry.status))
-        return 2;
-    if (entry.batchId)
-        return 1;
-    return 0;
-}
-/** Where a post-pass entry stands: unclaimed, claimed, submitted, settled. */
-function passEntryRank(entry) {
-    if (!entry || entry.status === "pending")
-        return 0;
-    if (entry.status === "submitted")
-        return entry.batchId ? 2 : 1;
-    return 3;
-}
-/** Where the retry pass stands: absent, claimed, submitted, settled. */
-function retryEntryRank(entry) {
-    if (!entry)
-        return 0;
-    if (entry.status === "submitted")
-        return entry.batches.length > 0 ? 2 : 1;
-    return 3;
-}
-/**
- * Record a collect's view of its run, keeping whatever is further along on
- * disk (#322).
- *
- * Two collects on one run each hold the run in memory and each used to write
- * the whole thing back, so the last writer replaced the other's post-pass
- * entries with its own — and both had submitted their own post-passes, since
- * each decided from the copy it loaded at entry. This writer merges slot by
- * slot: a post-pass or retry entry that is further along on disk (claimed
- * over pending, submitted over claimed, settled over submitted) wins and is
- * copied into `run`, so the caller reports what is true; a lens entry never
- * goes backwards from terminal to polling. A tie keeps this collect's copy,
- * so the collect that settled a pass records its cost. Submitting is guarded
- * separately by {@link claimRunSlot}.
- */
-export async function persistBroadsideRunMerging(broadsideDir, run) {
-    return updateBroadsideStateAtomically(broadsideDir, (state) => {
-        const index = state.runs.findIndex((candidate) => candidate.id === run.id);
-        const onDisk = index === -1 ? undefined : state.runs[index];
-        if (onDisk) {
-            if (passEntryRank(onDisk.synthesis) > passEntryRank(run.synthesis))
-                run.synthesis = onDisk.synthesis;
-            if (passEntryRank(onDisk.triage) > passEntryRank(run.triage))
-                run.triage = onDisk.triage;
-            if (retryEntryRank(onDisk.retry) > retryEntryRank(run.retry))
-                run.retry = onDisk.retry;
-            // A verification pass another process recorded is never dropped by
-            // a collect that never knew about it; a newer pass replaces an older.
-            if (onDisk.verify && (!run.verify || onDisk.verify.at > run.verify.at))
-                run.verify = onDisk.verify;
-            for (const [lensId, theirs] of Object.entries(onDisk.batches)) {
-                if (theirs && batchEntryRank(theirs) > batchEntryRank(run.batches[lensId]))
-                    run.batches[lensId] = theirs;
-            }
-        }
-        if (index === -1)
-            state.runs.push(run);
-        else
-            state.runs[index] = run;
-    });
-}
-/**
- * Claim one spending slot of a run for this collect (#322).
- *
- * Read-modify-write under the state lock: if the slot on disk is still
- * unclaimed (`pending`, or absent for the retry), it is marked `submitted`
- * with no batch id *before* any network call and `true` comes back — this
- * collect owns it and may submit. Otherwise another collect got there first:
- * its entry is copied into `run` and `false` comes back. An adopted entry
- * with a batch id can be polled (polling is idempotent); one without an id
- * is a claim whose owner has not recorded the id yet, and is reported as in
- * flight elsewhere.
- */
-export async function claimRunSlot(broadsideDir, run, slot) {
-    let owned = false;
-    const claimedAt = new Date().toISOString();
-    await updateBroadsideStateAtomically(broadsideDir, (state) => {
-        const index = state.runs.findIndex((candidate) => candidate.id === run.id);
-        const onDisk = index === -1 ? undefined : state.runs[index];
-        const theirs = onDisk?.[slot];
-        const unclaimed = slot === "retry" ? theirs === undefined : theirs?.status === "pending";
-        if (onDisk && !unclaimed) {
-            run[slot] = theirs;
-            owned = false;
-            return;
-        }
-        owned = true;
-        if (slot === "retry") {
-            run.retry = { status: "submitted", batches: [], claimedAt };
-        }
-        else {
-            run[slot] = { ...run[slot], status: "submitted", batchId: undefined };
-        }
-        if (!onDisk) {
-            state.runs.push(run);
-        }
-        else {
-            onDisk[slot] = run[slot];
-        }
-    });
-    return owned;
-}
-/**
- * Put a run's settled post-passes back to `pending` on disk so the next
- * claim re-runs them (#338). A pass another collect has in flight is left
- * alone — its result is still coming. The replaced results' cost moves to
- * `retiredCost`, so the run's total keeps counting money it spent. Returns
- * the passes that were reset, in the order they will be re-run.
- */
-export async function resetRunPostPasses(broadsideDir, run, wanted) {
-    const reset = [];
-    await updateBroadsideStateAtomically(broadsideDir, (state) => {
-        const index = state.runs.findIndex((candidate) => candidate.id === run.id);
-        const onDisk = index === -1 ? run : state.runs[index];
-        for (const kind of ["synthesis", "triage"]) {
-            if (!wanted[kind])
-                continue;
-            const theirs = onDisk[kind] ?? { status: "pending" };
-            if (theirs.status !== "completed" && theirs.status !== "failed") {
-                // pending: nothing to reset; submitted: in flight elsewhere.
-                run[kind] = theirs;
-                continue;
-            }
-            if (theirs.cost)
-                onDisk.retiredCost = (onDisk.retiredCost ?? 0) + theirs.cost;
-            onDisk[kind] = { status: "pending" };
-            run[kind] = onDisk[kind];
-            run.retiredCost = onDisk.retiredCost;
-            reset.push(kind);
-        }
-        if (index === -1)
-            state.runs.push(run);
-    });
-    return reset;
-}
-/** Read a `reasoning:` block from config.yaml, ignoring anything malformed. */
-function parseReasoningConfig(raw) {
-    if (raw === false)
-        return { enabled: false };
-    if (raw === true)
-        return { enabled: true };
-    if (!raw || typeof raw !== "object")
-        return null;
-    const value = raw;
-    const out = {};
-    if (typeof value.enabled === "boolean")
-        out.enabled = value.enabled;
-    if (value.effort === "minimal" || value.effort === "low" || value.effort === "medium" || value.effort === "high")
-        out.effort = value.effort;
-    if (typeof value.max_tokens === "number" && value.max_tokens > 0)
-        out.max_tokens = value.max_tokens;
-    return Object.keys(out).length > 0 ? out : null;
-}
-export async function loadBroadsideConfig(broadsideDir) {
-    const configPath = join(broadsideDir, BROADSIDE_CONFIG_FILE);
-    let raw = {};
-    if (await pathExists(configPath)) {
-        let parsed;
-        try {
-            parsed = await loadYamlFile(configPath);
-        }
-        catch (error) {
-            throw new BroadsideConfigError(configPath, `could not be parsed (${error instanceof Error ? error.message : String(error)})`);
-        }
-        if (parsed !== null && parsed !== undefined) {
-            if (typeof parsed !== "object" || Array.isArray(parsed))
-                throw new BroadsideConfigError(configPath, "is not a YAML mapping");
-            raw = parsed;
-        }
-        // OpenRouter accepts `reasoning.effort` or `reasoning.max_tokens`, not
-        // both: a request carrying both is refused per request *after* the batch
-        // is accepted, so every lens fails at $0 with the reason in each
-        // result's error. Seen live on 0.22.0 with the two keys set together.
-        // Refuse here, where the file can be fixed, rather than submit a run
-        // that cannot produce a result.
-        const reasoning = raw.reasoning;
-        if (reasoning && typeof reasoning === "object" && !Array.isArray(reasoning)) {
-            const value = reasoning;
-            const hasEffort = typeof value.effort === "string";
-            const hasBudget = typeof value.max_tokens === "number" && value.max_tokens > 0;
-            if (hasEffort && hasBudget) {
-                throw new BroadsideConfigError(configPath, 'sets both reasoning.effort and reasoning.max_tokens; OpenRouter accepts one or the other ("Only one of reasoning.effort and reasoning.max_tokens can be specified"), and every lens request would fail after the batch is accepted. Keep one');
-            }
-        }
-    }
-    return buildBroadsideConfig(raw);
-}
-/** The shipped defaults: what an absent config.yaml means. */
-export function defaultBroadsideConfig() {
-    return buildBroadsideConfig({});
-}
-function buildBroadsideConfig(raw) {
-    const lenses = Array.isArray(raw.default_lenses)
-        ? (raw.default_lenses.filter((l) => BROADSIDE_LENS_IDS.includes(l)))
-        : [];
-    const rawPricing = (raw.pricing ?? {});
-    const inputOverride = typeof rawPricing.input_per_m === "number" ? rawPricing.input_per_m : undefined;
-    const outputOverride = typeof rawPricing.output_per_m === "number" ? rawPricing.output_per_m : undefined;
-    // A malformed value falls back to the shipped default rather than failing
-    // the run: config.yaml is hand-edited, and a typo in a poll budget must not
-    // cost a user their batches.
-    const flag = (key, fallback) => typeof raw[key] === "boolean" ? raw[key] : fallback;
-    // An override for an unknown lens id is dropped rather than carried: it can
-    // only be a typo, and a silently-ignored key that looks applied is worse
-    // than one that never appears.
-    const lensModels = {};
-    const rawLensModels = (raw.lens_models ?? {});
-    for (const lensId of BROADSIDE_LENS_IDS) {
-        const value = rawLensModels[lensId];
-        if (typeof value === "string" && value.trim())
-            lensModels[lensId] = value.trim();
-    }
-    return {
-        model: typeof raw.model === "string" && raw.model.trim() ? raw.model.trim() : BROADSIDE_MODEL,
-        apiKey: typeof raw.api_key === "string" ? raw.api_key.trim() : "",
-        defaultLenses: lenses.length > 0 ? lenses : [...BROADSIDE_LENS_IDS],
-        // Absent: the shipped default. An explicit 0 is "no limit", spelled out
-        // on purpose; a negative or non-numeric value is not a limit at all.
-        maxCost: typeof raw.max_cost === "number" && raw.max_cost >= 0 ? raw.max_cost : BROADSIDE_DEFAULT_MAX_COST,
-        pricing: inputOverride !== undefined && outputOverride !== undefined
-            ? { inputPerM: inputOverride, outputPerM: outputOverride }
-            : null,
-        lensModels,
-        // An escape hatch, not a knob to reach for: a model whose reasoning is
-        // worth paying for needs its lens maxTokens raised to cover both the
-        // thinking and the answer, or the JSON truncates exactly as before.
-        reasoning: parseReasoningConfig(raw.reasoning),
-        incremental: flag("incremental", false),
-        retryTruncated: flag("retry_truncated", true),
-        includeSynthesis: flag("include_synthesis", true),
-        includeTriage: flag("include_triage", true),
-        waitSeconds: typeof raw.wait_seconds === "number" && raw.wait_seconds > 0 ? raw.wait_seconds : 0,
-        redactSecrets: flag("redact_secrets", true),
-    };
-}
-// ---------- model catalog, pricing, benchmarks ----------
-/** The catalog cache schema this build writes; a file from another is not read. */
-export const BROADSIDE_CATALOG_CACHE_SCHEMA = 3;
-async function readCatalogCache(broadsideDir) {
-    const cachePath = join(broadsideDir, BROADSIDE_CATALOG_CACHE_FILE);
-    if (!(await pathExists(cachePath)))
-        return null;
-    try {
-        const parsed = JSON.parse(await readFile(cachePath, "utf8"));
-        if (!parsed || typeof parsed !== "object" || !parsed.models || typeof parsed.models !== "object")
-            return null;
-        if (parsed.schema_version !== BROADSIDE_CATALOG_CACHE_SCHEMA && parsed.schema_version !== 2)
-            return null;
-        return parsed;
-    }
-    catch {
-        return null;
-    }
-}
-/** When a cached entry was fetched: its own stamp, or the file's for a schema-2 cache. */
-function catalogEntryFetchedAt(cache, model) {
-    const stamp = cache.models[model]?.fetched_at ?? cache.fetched_at;
-    return new Date(stamp).getTime();
-}
-async function writeCatalogCache(broadsideDir, cache) {
-    await mkdir(broadsideDir, { recursive: true });
-    await writeFile(join(broadsideDir, BROADSIDE_CATALOG_CACHE_FILE), `${JSON.stringify(cache, null, "\t")}\n`, "utf8");
-}
-const BROADSIDE_ENDPOINTS_SCHEMA = 1;
-export async function readBatchEndpoints(broadsideDir) {
-    const path = join(broadsideDir, BROADSIDE_ENDPOINTS_FILE);
-    if (!(await pathExists(path)))
-        return {};
-    try {
-        const parsed = JSON.parse(await readFile(path, "utf8"));
-        if (!parsed || typeof parsed !== "object" || parsed.schema_version !== BROADSIDE_ENDPOINTS_SCHEMA)
-            return {};
-        if (!parsed.models || typeof parsed.models !== "object")
-            return {};
-        const out = {};
-        for (const [model, record] of Object.entries(parsed.models)) {
-            if (!record || typeof record !== "object")
-                continue;
-            if (record.status !== "accepted" && record.status !== "rejected")
-                continue;
-            if (typeof record.at !== "string")
-                continue;
-            out[model] = { status: record.status, at: record.at, ...(typeof record.error === "string" && { error: record.error }) };
-        }
-        return out;
-    }
-    catch {
-        // An unreadable memory is an empty one: it only annotates a listing.
-        return {};
-    }
-}
-/**
- * The refusal OpenRouter returns for a catalog id that has no batch endpoint
- * behind it. Matched loosely: the message is the only signal there is.
- */
-const NO_BATCH_ENDPOINT_RE = /does not have a :batch endpoint/i;
-/** The refusal for a full per-account concurrent batch-job quota. */
-const BATCH_QUOTA_RE = /job-submission-count/i;
-/**
- * Remember what a submit learned about each model it posted to. An accepted
- * job proves the endpoint exists; a "does not have a :batch endpoint"
- * refusal proves it does not. Any other rejection (quota, malformed request,
- * auth) says nothing about the endpoint and leaves the record alone.
- */
-export async function recordBatchEndpoints(broadsideDir, outcomes) {
-    const at = new Date().toISOString();
-    const updates = {};
-    for (const { model, batchId, error } of outcomes) {
-        if (batchId) {
-            updates[model] = { status: "accepted", at };
-            continue;
-        }
-        const message = describeBatchError(error);
-        if (message && NO_BATCH_ENDPOINT_RE.test(message)) {
-            updates[model] = { status: "rejected", at, error: message };
-        }
-    }
-    if (Object.keys(updates).length === 0)
-        return;
-    const models = { ...(await readBatchEndpoints(broadsideDir)), ...updates };
-    await mkdir(broadsideDir, { recursive: true });
-    const file = { schema_version: BROADSIDE_ENDPOINTS_SCHEMA, models };
-    await atomicWriteFile(join(broadsideDir, BROADSIDE_ENDPOINTS_FILE), `${JSON.stringify(file, null, "\t")}\n`);
-}
-function parseCatalogEntry(raw) {
-    const id = String(raw.id ?? "");
-    if (!id)
-        return null;
-    const p = (raw.pricing ?? {});
-    const input = typeof p.prompt === "string" ? Number(p.prompt) : NaN;
-    const output = typeof p.completion === "string" ? Number(p.completion) : NaN;
-    if (!Number.isFinite(input) || !Number.isFinite(output))
-        return null;
-    const cached = typeof p.cached_input === "string" ? Number(p.cached_input) : NaN;
-    const topProvider = (raw.top_provider ?? {});
-    const contextLength = typeof raw.context_length === "number" ? raw.context_length : undefined;
-    const maxCompletion = typeof topProvider.max_completion_tokens === "number" ? topProvider.max_completion_tokens : undefined;
-    return {
-        id,
-        name: String(raw.name ?? id),
-        inputPerM: input * 1_000_000,
-        outputPerM: output * 1_000_000,
-        cachedInputPerM: Number.isFinite(cached) ? cached * 1_000_000 : undefined,
-        contextLength,
-        maxCompletionTokens: maxCompletion,
-        supportedParameters: Array.isArray(raw.supported_parameters)
-            ? raw.supported_parameters.map((entry) => String(entry))
-            : [],
-        expirationDate: typeof raw.expiration_date === "string" ? raw.expiration_date : null,
-    };
-}
-export function builtInCatalogEntry(model) {
-    // The default model's rates are compile-time constants; its capabilities
-    // are asserted from the shipped configuration (1M context, 64K output,
-    // structured outputs used by every lens).
-    if (model !== BROADSIDE_MODEL)
-        return null;
-    return {
-        id: BROADSIDE_MODEL,
-        name: "Google: Gemini 3.7 Flash (batch)",
-        inputPerM: BROADSIDE_INPUT_PRICE_PER_M,
-        outputPerM: BROADSIDE_OUTPUT_PRICE_PER_M,
-        contextLength: 1_048_576,
-        maxCompletionTokens: 65_536,
-        supportedParameters: ["tools", "structured_outputs", "json_schema", "response_format"],
-        expirationDate: null,
-    };
-}
-export function builtInPricing(model) {
-    const entry = builtInCatalogEntry(model);
-    if (!entry)
-        return null;
-    return { inputPerM: entry.inputPerM, outputPerM: entry.outputPerM, source: "built-in" };
-}
-export async function resolveCatalogEntry(broadsideDir, config, model, apiKey, fetcher = fetch) {
-    // Manual overrides always win for pricing — the user is asserting a rate,
-    // and a config assertion is cheaper to respect than to second-guess.
-    // Capabilities stay unknown in that case: nothing is refused, nothing
-    // is clamped, and the submit text says the pricing came from config.
-    if (config.pricing) {
-        return {
-            model,
-            source: "config",
-            entry: {
-                id: model,
-                name: model,
-                inputPerM: config.pricing.inputPerM,
-                outputPerM: config.pricing.outputPerM,
-                supportedParameters: [],
-            },
-        };
-    }
-    // On-disk cache first, then the live catalog — for the default model too.
-    // Hardcoded rates used to short-circuit here, which meant a stale constant
-    // could never self-correct even though the catalog was already being
-    // fetched for every other model. The authoritative source wins; the
-    // constants below are what we fall back to when the network is unavailable.
-    const cache = await readCatalogCache(broadsideDir);
-    const cached = cache?.models[model];
-    if (cache && cached && Date.now() - catalogEntryFetchedAt(cache, model) < BROADSIDE_CATALOG_CACHE_TTL_MS) {
-        return { model, source: "cache", entry: cached };
-    }
-    // What went wrong when the live lookup produced nothing, for the error
-    // below: a 401 and a dead network used to read the same — "could not
-    // resolve per-token pricing" — or, for the default model, nothing at all.
-    let live = null;
-    let catalogFailure = null;
-    try {
-        const resp = await fetcher(BROADSIDE_MODELS_URL, {
-            method: "GET",
-            headers: { Authorization: `Bearer ${apiKey}` },
-            signal: AbortSignal.timeout(30_000),
-        });
-        if (resp.status === 401 || resp.status === 403) {
-            throw new BroadsideAuthError(resp.status, await responseDetail(resp));
-        }
-        if (resp.ok === false) {
-            catalogFailure = `the model catalog request failed (HTTP ${resp.status}${await responseDetail(resp).then((d) => (d ? `: ${d}` : ""))})`;
-        }
-        else {
-            const data = (await resp.json());
-            const hit = (data.data ?? []).find((m) => String(m.id) === model);
-            if (hit)
-                live = parseCatalogEntry(hit);
-            else
-                catalogFailure = `the model catalog has no entry for "${model}"`;
-        }
-    }
-    catch (error) {
-        if (error instanceof BroadsideAuthError)
-            throw error;
-        live = null;
-        catalogFailure = `the model catalog could not be fetched (${error instanceof Error ? error.message : String(error)})`;
-    }
-    if (live) {
-        const now = new Date().toISOString();
-        const updated = {
-            schema_version: BROADSIDE_CATALOG_CACHE_SCHEMA,
-            fetched_at: now,
-            // Other entries keep their own stamps (a schema-2 file's entries
-            // inherit the file's, once, on this upgrade); only this model is fresh.
-            models: Object.fromEntries(Object.entries(cache?.models ?? {}).map(([id, entry]) => [id, { ...entry, fetched_at: entry.fetched_at ?? cache.fetched_at }])),
-        };
-        updated.models[model] = { ...live, fetched_at: now };
-        await writeCatalogCache(broadsideDir, updated);
-        return { model, source: "live", entry: live };
-    }
-    // Offline fallback: the default model's rates and capabilities are known at
-    // compile time, so a network failure does not have to stop a run.
-    const builtIn = builtInCatalogEntry(model);
-    if (builtIn)
-        return { model, source: "built-in", entry: builtIn };
-    throw new Error(`Could not resolve per-token pricing for batch model "${model}": ${catalogFailure ?? "no catalog entry"}. ` +
-        "Set pricing.input_per_m and pricing.output_per_m in .codecarto/broadside/config.yaml " +
-        "(USD per million tokens), or check the model id against https://openrouter.ai/models?variant=batch.");
-}
-/** A short, safe excerpt of an error response body for a message. */
-async function responseDetail(resp) {
-    try {
-        if (typeof resp.text === "function") {
-            const text = (await resp.text()).trim();
-            try {
-                const parsed = JSON.parse(text);
-                const message = typeof parsed?.error === "string" ? parsed.error : parsed?.error?.message;
-                if (typeof message === "string" && message)
-                    return message.slice(0, 200);
-            }
-            catch {
-                // not JSON; fall through to the raw excerpt
-            }
-            return text.replace(/\s+/g, " ").slice(0, 200);
-        }
-        if (typeof resp.json === "function") {
-            const parsed = (await resp.json());
-            const message = typeof parsed?.error === "string" ? parsed.error : parsed?.error?.message;
-            return typeof message === "string" ? message.slice(0, 200) : "";
-        }
-    }
-    catch {
-        // an unreadable body adds nothing to the message
-    }
-    return "";
-}
-export async function resolveModelPricing(broadsideDir, config, model, apiKey, fetcher = fetch) {
-    const { source, entry } = await resolveCatalogEntry(broadsideDir, config, model, apiKey, fetcher);
-    if (!entry)
-        throw new Error(`No pricing resolved for ${model}.`);
-    return { inputPerM: entry.inputPerM, outputPerM: entry.outputPerM, source };
-}
-/** Base slug with the OpenRouter variant suffix (e.g. `:batch`) stripped. */
-function baseSlug(modelId) {
-    const idx = modelId.indexOf(":");
-    return idx >= 0 ? modelId.slice(0, idx) : modelId;
-}
-export async function fetchCodingBenchmarks(apiKey, fetcher = fetch) {
-    try {
-        const resp = await fetcher(`${BROADSIDE_BENCHMARKS_URL}?source=artificial-analysis&task_type=coding`, {
-            method: "GET",
-            headers: { Authorization: `Bearer ${apiKey}` },
-            signal: AbortSignal.timeout(30_000),
-        });
-        const data = (await resp.json());
-        const byBaseSlug = {};
-        for (const row of data.data ?? []) {
-            const slug = baseSlug(String(row.model_permaslug ?? ""));
-            if (!slug)
-                continue;
-            const toIndex = (v) => (typeof v === "number" && Number.isFinite(v) ? v : undefined);
-            byBaseSlug[slug] = {
-                codingIndex: toIndex(row.coding_index),
-                intelligenceIndex: toIndex(row.intelligence_index),
-            };
-        }
-        return { byBaseSlug, meta: data.meta ?? {} };
-    }
-    catch {
-        return null;
-    }
-}
-export async function listBatchModels(broadsideDir, config, apiKey, opts = {}) {
-    const fetcher = opts.fetcher ?? fetch;
-    const resp = await fetcher(BROADSIDE_MODELS_URL, {
-        method: "GET",
-        headers: { Authorization: `Bearer ${apiKey}` },
-        signal: AbortSignal.timeout(30_000),
-    });
-    const data = (await resp.json());
-    const entries = [];
-    const seen = new Set();
-    for (const raw of data.data ?? []) {
-        const entry = parseCatalogEntry(raw);
-        if (!entry || seen.has(entry.id))
-            continue;
-        seen.add(entry.id);
-        if (!entry.id.endsWith(":batch"))
-            continue;
-        entries.push(entry);
-    }
-    entries.sort((a, b) => a.inputPerM + a.outputPerM - (b.inputPerM + b.outputPerM));
-    // Persist the catalog so the next submit's pricing resolution hits cache.
-    const fetchedAt = new Date().toISOString();
-    const cache = { schema_version: BROADSIDE_CATALOG_CACHE_SCHEMA, fetched_at: fetchedAt, models: {} };
-    for (const entry of entries)
-        cache.models[entry.id] = { ...entry, fetched_at: fetchedAt };
-    await writeCatalogCache(broadsideDir, cache);
-    const benchmarks = opts.includeBenchmarks ? await fetchCodingBenchmarks(apiKey, fetcher) : null;
-    const endpoints = await readBatchEndpoints(broadsideDir);
-    return { entries, source: "live", benchmarks, defaultModel: config.model, endpoints };
-}
-export async function submitBatch(batchRequests, apiKey, fetcher = fetch, model = BROADSIDE_MODEL) {
-    // The OpenRouter batch endpoint stream-parses the body and requires
-    // `endpoint` and `model` to serialize before `requests` — key order matters.
-    const payload = {
-        endpoint: "/v1/chat/completions",
-        model,
-        requests: batchRequests,
-    };
-    const resp = await fetcher(BROADSIDE_BATCH_URL, {
-        method: "POST",
-        headers: {
-            Authorization: `Bearer ${apiKey}`,
-            "Content-Type": "application/json",
-        },
-        body: JSON.stringify(payload),
-        signal: AbortSignal.timeout(30_000),
-    });
-    const data = (await resp.json());
-    if (resp.status !== 202) {
-        return { batchId: "", status: "rejected", error: data };
-    }
-    return { batchId: String(data.id), status: String(data.status) };
-}
-export async function fetchBatch(batchId, apiKey, fetcher = fetch) {
-    const resp = await fetcher(`${BROADSIDE_BATCH_URL}/${batchId}`, {
-        method: "GET",
-        headers: { Authorization: `Bearer ${apiKey}` },
-        signal: AbortSignal.timeout(30_000),
-    });
-    let data;
-    try {
-        data = (await resp.json());
-    }
-    catch (error) {
-        // A gateway error page is not JSON. It used to throw out of here and
-        // be retried as if the network were down; keep the status instead.
-        data = { error: `non-JSON response (${error instanceof Error ? error.message : String(error)})` };
-    }
-    if (!data || typeof data !== "object")
-        data = { error: "empty response" };
-    // Surface the HTTP status so the poller can bail fast on auth expiry
-    // instead of retrying a dead key for the whole budget.
-    data.http_status = resp.status;
-    return data;
-}
-/**
- * Batch statuses that will never produce a result.
- *
- * Deliberately excludes the synthetic `timeout` this module returns when a poll
- * budget expires: that batch is still running server-side and has already been
- * charged, so callers must come back for it rather than retire it.
- */
-export const BROADSIDE_DEAD_BATCH_STATUSES = ["failed", "expired", "cancelled", "auth-failed"];
-/**
- * Batch entry statuses collect never polls again: the dead ones above, plus
- * `completed`, plus the two a submit assigns without a batch (`skipped`: no
- * matching files; `rejected`: the provider refused it). The 0.19.1 changelog
- * called the dead set "a named constant rather than two hand-maintained
- * lists"; this set was still three literal copies (self-audit sem 5.8).
- */
-export const BROADSIDE_TERMINAL_ENTRY_STATUSES = ["completed", ...BROADSIDE_DEAD_BATCH_STATUSES, "skipped", "rejected"];
-export async function pollBatchUntilTerminal(batchId, apiKey, opts = {}) {
-    const deadline = Date.now() + (opts.deadlineMs ?? BROADSIDE_DEFAULT_POLL_BUDGET_MS);
-    const intervalMs = opts.pollIntervalMs ?? BROADSIDE_POLL_INTERVAL_MS;
-    const fetcher = opts.fetcher ?? fetch;
-    // A poll that runs out of budget without one good response is not a slow
-    // batch. The last thing that went wrong rides on the timeout so the report
-    // can tell a dead network or a failing gateway from a batch still running.
-    let lastError = null;
-    let sawBatch = false;
-    const timedOut = () => ({
-        id: batchId,
-        status: "timeout",
-        ...(lastError && !sawBatch && { error: `no successful poll response; last error: ${lastError}` }),
-        ...(lastError && sawBatch && { last_error: lastError }),
-    });
-    for (;;) {
-        if (opts.signal?.aborted)
-            return { ...timedOut(), aborted: true };
-        let batch;
-        try {
-            batch = await fetchBatch(batchId, apiKey, fetcher);
-        }
-        catch (error) {
-            lastError = `fetch failed (${error instanceof Error ? error.message : String(error)})`;
-            if (Date.now() >= deadline)
-                return timedOut();
-            await sleep(intervalMs);
-            continue;
-        }
-        const httpStatus = Number(batch.http_status ?? 200);
-        if (httpStatus === 401 || httpStatus === 403) {
-            return { id: batchId, status: "auth-failed", error: batch.error ?? batch };
-        }
-        if (httpStatus >= 400) {
-            // A gateway or server error: retry within the budget, remembered.
-            const detail = typeof batch.error === "string" ? batch.error : JSON.stringify(batch.error ?? "");
-            lastError = `HTTP ${httpStatus}${detail ? ` (${detail.slice(0, 200)})` : ""}`;
-            if (Date.now() >= deadline)
-                return timedOut();
-            await sleep(intervalMs);
-            continue;
-        }
-        sawBatch = true;
-        const status = String(batch.status ?? "unknown");
-        const counts = (batch.request_counts ?? {});
-        opts.onStatus?.(status, counts);
-        if (status === "completed" || BROADSIDE_DEAD_BATCH_STATUSES.includes(status))
-            return batch;
-        if (Date.now() >= deadline)
-            return timedOut();
-        await sleepUnlessAborted(intervalMs, opts.signal);
-    }
-}
-/** Sleep, but wake at once when the signal fires so an abort is not a poll interval late. */
-function sleepUnlessAborted(ms, signal) {
-    if (!signal)
-        return sleep(ms);
-    if (signal.aborted)
-        return Promise.resolve();
-    return new Promise((resolve) => {
-        const timer = setTimeout(() => {
-            signal.removeEventListener("abort", onAbort);
-            resolve();
-        }, ms);
-        const onAbort = () => {
-            clearTimeout(timer);
-            resolve();
-        };
-        signal.addEventListener("abort", onAbort, { once: true });
-    });
-}
-/**
- * Poll several batch ids in parallel against one shared deadline. Collect
- * previously polled one lens at a time, so a slow first lens serialized the
- * wall clock for lenses that had already finished server-side (#136). The
- * onStatus callback identifies the lens so progress output stays readable
- * even while the polls interleave.
- */
-export async function pollBatchesConcurrently(entries, apiKey, opts = {}) {
-    const results = new Map();
-    const deadlineMs = opts.deadlineMs ?? BROADSIDE_DEFAULT_POLL_BUDGET_MS;
-    await Promise.all(entries.map(async ({ lensId, batchId }) => {
-        const batch = await pollBatchUntilTerminal(batchId, apiKey, {
-            deadlineMs,
-            fetcher: opts.fetcher,
-            pollIntervalMs: opts.pollIntervalMs,
-            signal: opts.signal,
-            onStatus: (status, counts) => opts.onStatus?.(lensId, status, counts),
-        });
-        results.set(batchId, batch);
-    }));
-    return results;
-}
-// ---------- run orchestration ----------
-export async function runBroadsideSubmit(cwd, apiKey, opts = {}) {
-    const lensIds = opts.lenses ?? BROADSIDE_LENS_IDS;
-    const broadsideDir = broadsideDirFor(cwd);
-    const model = opts.model ?? BROADSIDE_MODEL;
-    // Resolve a catalog entry per distinct model before anything is submitted:
-    // the guardrail must know real per-token rates, and every lens requires
-    // structured-output support that not all batch models offer. Lenses may run
-    // on different models (config `lens_models`), so each one is pre-flighted.
-    const config = await loadBroadsideConfig(broadsideDir);
-    const redact = config.redactSecrets;
-    const info = await collectRepoInfo(cwd, { redact });
-    // Before pricing, before the network, before any state write: a run on a
-    // language the lenses cannot scan used to submit empty batches and pay for
-    // them (#250).
-    if (info.language === "unknown") {
-        throw new Error(`Broad-Side could not tell what language this repository is: no ${MANIFEST_CANDIDATES.map(([candidate]) => candidate).join(", ")} ` +
-            `and no source files in a language the lenses can scan (${BROADSIDE_LANGUAGES.join(", ")}). Nothing was submitted.`);
-    }
-    if (info.sourceFileCount === 0) {
-        throw new Error(`Broad-Side found no ${info.language} source files to scan (detected from ${info.manifest?.path ?? "the file counts"}; ` +
-            `the lenses look for ${info.sourceExts.join(", ")}). Nothing was submitted.`);
-    }
-    const lensModels = { ...config.lensModels, ...opts.lensModels };
-    const modelForLens = (lensId) => lensModels[lensId] ?? model;
-    const resolved = new Map();
-    for (const candidate of new Set([model, ...lensIds.map(modelForLens)])) {
-        const catalog = await resolveCatalogEntry(broadsideDir, config, candidate, apiKey, opts.fetcher);
-        const entry = catalog.entry;
-        const supportsStructuredOutputs = entry.supportedParameters.length === 0 ||
-            entry.supportedParameters.some((p) => ["structured_outputs", "json_schema", "response_format", "structuredoutputs"].includes(p.toLowerCase()));
-        if (!supportsStructuredOutputs) {
-            throw new Error(`Batch model "${candidate}" does not advertise structured-output support ` +
-                `(supported_parameters: ${entry.supportedParameters.join(", ") || "unknown"}), but every ` +
-                "Broad-Side lens requires json_schema response_format. Choose another batch model " +
-                "(codecarto_broadside action 'models') or pass a pricing override only if you know it works.");
-        }
-        resolved.set(candidate, {
-            entry,
-            supportsStructuredOutputs,
-            pricing: { inputPerM: entry.inputPerM, outputPerM: entry.outputPerM, source: catalog.source },
-            // Respect the provider's completion ceiling: a request asking for more
-            // output than the model can produce fails the whole batch.
-            ...(entry.maxCompletionTokens !== undefined && { outputCap: entry.maxCompletionTokens }),
-        });
-    }
-    const pricing = resolved.get(model).pricing;
-    const outputCap = resolved.get(model).outputCap;
-    const defaultEntry = resolved.get(model).entry;
-    const limit = opts.maxCost ?? config.maxCost;
-    // Incremental re-scouting (#142): diff against the previous run's HEAD
-    // and scan only the modules whose files changed. Falls back to a full
-    // scan when there is no prior run, the tree is dirty, or the diff fails.
-    const sourceHead = await gitHead(cwd);
-    const sourceDirty = await gitDirty(cwd);
-    let baseHead = null;
-    let changed = null;
-    const incrementalOutcome = {
-        requested: opts.incremental === true,
-        applied: false,
-        baseHead: null,
-    };
-    if (opts.incremental) {
-        const state = await loadBroadsideState(broadsideDir);
-        // The baseline is the most recent run that recorded a HEAD — a
-        // submit-only run (never collected) is still a valid committed base.
-        const previous = [...state.runs].reverse().find((r) => r.sourceHead);
-        if (sourceDirty) {
-            incrementalOutcome.reason = "dirty-worktree";
-        }
-        else if (!previous?.sourceHead) {
-            incrementalOutcome.reason = "no-baseline";
-        }
-        else {
-            baseHead = previous.sourceHead;
-            changed = await changedFilesSince(cwd, baseHead);
-            incrementalOutcome.baseHead = baseHead;
-            if (changed)
-                incrementalOutcome.applied = true;
-            else
-                incrementalOutcome.reason = "diff-failed";
-        }
-    }
-    // Slice offline first so the estimate covers every request we would send.
-    const slicesByLens = new Map();
-    // Why a lens ended up with nothing to submit, for the report (see below).
-    const skipReasons = new Map();
-    let estimatedInputTokens = 0;
-    let estimatedOutputTokens = 0;
-    let estimatedTotalCost = 0;
-    const perLensEstimate = [];
-    // What the redaction pass did across every lens's slices, for the run
-    // record and the report: a value in a file shared by two lenses counts
-    // once per lens it was sent in, files once each.
-    let redactedValues = info.redactedValues;
-    const redactedFiles = new Set();
-    for (const lensId of lensIds) {
-        const lens = getLens(lensId);
-        let slices = await gatherSlices(cwd, lens, info, { redact });
-        for (const slice of slices) {
-            redactedValues += slice.redactedValues ?? 0;
-            for (const file of slice.redactedFiles ?? [])
-                redactedFiles.add(file);
-        }
-        const matchedBeforeIncremental = slices.length;
-        if (changed) {
-            // Repo-info slices (empty files, e.g. architecture) always run;
-            // file-backed slices run only when one of their files changed.
-            slices = slices.filter((s) => s.files.length === 0 || s.files.some((f) => changed.has(f)));
-        }
-        slicesByLens.set(lensId, slices);
-        if (slices.length === 0) {
-            const globs = lens.globsFor(info).filter(Boolean);
-            const fallbackGlobs = lens.fallbackGlobsFor?.(info).filter(Boolean) ?? [];
-            skipReasons.set(lensId, globs.length === 0
-                ? "the lens has no file patterns for this language"
-                : matchedBeforeIncremental > 0
-                    ? "incremental: none of this lens's files changed since the previous run"
-                    : `no files matched ${globs.join(", ")}` +
-                        (fallbackGlobs.length > 0 ? ` or the fallback ${fallbackGlobs.join(", ")}` : "") +
-                        (lens.skipTestFiles ? " (test files excluded)" : ""));
-        }
-        const lensModel = modelForLens(lensId);
-        const { pricing: lensPricing, outputCap: lensOutputCap } = resolved.get(lensModel);
-        const maxTokens = lensOutputCap ? Math.min(lens.maxTokens, lensOutputCap) : lens.maxTokens;
-        const estimate = estimateCost(lens, slices, lensPricing, maxTokens, info);
-        estimatedInputTokens += estimate.inputTokens;
-        estimatedOutputTokens += estimate.outputTokens;
-        estimatedTotalCost += estimate.cost;
-        perLensEstimate.push({
-            lens,
-            cost: estimate.cost,
-            maxTokens,
-            lensModel,
-            lensPricing,
-            ...(lensOutputCap !== undefined && { lensOutputCap }),
-        });
-    }
-    const exceedsLimit = limit > 0 && estimatedTotalCost > limit;
-    if (opts.confirm) {
-        const approved = await opts.confirm({
-            model,
-            pricing,
-            lenses: perLensEstimate.map(({ lens, cost, maxTokens, lensModel, lensPricing }) => {
-                const fallback = (slicesByLens.get(lens.id) ?? []).find((slice) => slice.fallback)?.fallback;
-                return {
-                    lensId: lens.id,
-                    name: lens.name,
-                    slices: (slicesByLens.get(lens.id) ?? []).length,
-                    maxTokens,
-                    cost,
-                    model: lensModel,
-                    pricing: lensPricing,
-                    ...(fallback && { fallback }),
-                };
-            }),
-            mixedModels: perLensEstimate.some(({ lensModel }) => lensModel !== model),
-            totalCost: estimatedTotalCost,
-            inputTokens: estimatedInputTokens,
-            outputTokens: estimatedOutputTokens,
-            maxCost: limit,
-            exceedsLimit,
-            baseHead,
-            sourceDirty,
-            incremental: incrementalOutcome,
-            ...(outputCap !== undefined && { outputCap }),
-        });
-        if (!approved)
-            throw new BroadsideCancelledError();
-    }
-    else if (exceedsLimit && !opts.force) {
-        const breakdown = perLensEstimate
-            .map(({ lens, cost, lensModel }) => `  ${lens.name}: ~$${cost.toFixed(4)}${lensModel === model ? "" : ` (${lensModel})`}`)
-            .join("\n");
-        throw new Error(`Estimated Broad-Side cost ~$${estimatedTotalCost.toFixed(4)} exceeds the run limit ` +
-            `$${limit.toFixed(2)}. Nothing was submitted.\nBreakdown:\n${breakdown}\n` +
-            `Pass force: true to submit anyway, or raise max_cost in .codecarto/broadside/config.yaml.`);
-    }
-    // Read before anything is posted: a state.json that cannot be read refuses
-    // the run here (#233), while persistBroadsideRun below merges by run id.
-    await loadBroadsideState(broadsideDir);
-    const runId = new Date().toISOString().replace(/[:.]/g, "-");
-    const run = {
-        id: runId,
-        createdAt: new Date().toISOString(),
-        model,
-        lenses: [...lensIds],
-        status: "in-flight",
-        outputDir: runId,
-        batches: {},
-        synthesis: { status: "pending" },
-        triage: { status: "pending" },
-        pricing,
-        maxCost: limit > 0 ? limit : undefined,
-        outputCap,
-        sourceHead,
-        sourceDirty,
-        baseHead,
-        snapshot: info.snapshot,
-        language: info.language,
-        redaction: {
-            enabled: redact,
-            values: redactedValues,
-            files: redactedFiles.size,
-            skippedFiles: info.secretFilesSkipped.length,
-        },
-    };
-    await persistBroadsideRun(broadsideDir, run);
-    const requestsByCustomId = {};
-    const submissions = [];
-    // Submit from the estimate rather than recomputing: the user approved that
-    // breakdown, so the request that fires must be the one that was priced.
-    for (const priced of perLensEstimate) {
-        const { lens, maxTokens, lensModel, lensOutputCap } = priced;
-        const lensId = lens.id;
-        const slices = slicesByLens.get(lensId) ?? [];
-        const requests = slices.map((sl, i) => buildBatchRequest(lens, info, sl, i, slices.length, lensModel, maxTokens, config.reasoning ?? undefined));
-        for (const request of requests)
-            requestsByCustomId[request.custom_id] = request;
-        const fallback = slices.find((slice) => slice.fallback)?.fallback;
-        const entry = {
-            batchId: "",
-            requests: requests.length,
-            status: "submitting",
-            submittedAt: new Date().toISOString(),
-            estimatedCost: priced.cost,
-            // A scan of the fallback scope is recorded as such (#319).
-            ...(fallback && { fallback }),
-            // Recorded per lens so collect's truncation retry re-submits against
-            // the model and ceiling this lens actually used, not the run default.
-            ...(lensModel !== model && { model: lensModel }),
-            ...(lensOutputCap !== undefined && { outputCap: lensOutputCap }),
-        };
-        run.batches[lensId] = entry;
-        if (requests.length === 0) {
-            // No files matched the lens's globs. That is a coverage gap to
-            // report, not a batch to submit — the API rejects empty batches.
-            // Name the globs: a JavaScript service whose server lives at
-            // src/server.js gets no security review (that lens reads server/**,
-            // **/auth*, **/middleware/**), and "skipped (0 request(s))" alone
-            // read as an empty repository rather than a lens that looked in
-            // the wrong place.
-            entry.status = "skipped";
-            const reason = skipReasons.get(lensId);
-            if (reason)
-                entry.reason = reason;
-            continue;
-        }
-        submissions.push((async () => {
-            // A network-level throw (DNS, abort, TLS) must not strand the
-            // entry in "submitting" forever — allSettled would swallow the
-            // rejection and collect would never see a terminal status.
-            try {
-                const { batchId, status, error } = await submitBatch(requests, apiKey, opts.fetcher, lensModel);
-                entry.batchId = batchId;
-                entry.status = status;
-                if (error)
-                    entry.error = error;
-            }
-            catch (error) {
-                entry.status = "rejected";
-                entry.error = error instanceof Error ? error.message : String(error);
-            }
-        })());
-    }
-    await Promise.allSettled(submissions);
-    // A run with no batch behind it has nothing in flight. Every lens was
-    // skipped or refused, so no poll will ever complete it; leaving it
-    // "in-flight" had status listing a refused run above the completed ones
-    // with synthesis and triage "pending" forever.
-    if (!Object.values(run.batches).some((entry) => entry.batchId))
-        run.status = "failed";
-    await persistBroadsideRun(broadsideDir, run);
-    // What the provider just said about each model's batch endpoint outlives
-    // the run: the `models` action reads it back (#141).
-    await recordBatchEndpoints(broadsideDir, lensIds
-        .map((lensId) => run.batches[lensId])
-        .filter((entry) => Boolean(entry) && entry.status !== "skipped")
-        .map((entry) => ({ model: entry.model ?? model, batchId: entry.batchId, error: entry.error })));
-    // Persist the exact request bodies so collect can re-submit a truncated
-    // slice (bumped output cap) without re-walking the repo (#133). The run
-    // dir is created here rather than waiting for collect so a crash between
-    // submit and collect still leaves the retry input on disk.
-    const runDir = join(broadsideDir, runId);
-    await mkdir(runDir, { recursive: true });
-    await writeFile(join(runDir, "requests.json"), `${JSON.stringify(requestsByCustomId, null, "\t")}\n`, "utf8");
-    return {
-        runId,
-        outputDir: join(".codecarto", BROADSIDE_DIR, runId),
-        batches: run.batches,
-        estimatedTotalCost,
-        estimatedInputTokens,
-        estimatedOutputTokens,
-        pricing,
-        maxCost: limit > 0 ? limit : undefined,
-        // modelInfo describes the run's default model. Per-lens overrides are
-        // recorded on their own batch entries.
-        modelInfo: {
-            contextLength: defaultEntry.contextLength,
-            maxCompletionTokens: defaultEntry.maxCompletionTokens,
-            supportsStructuredOutputs: defaultEntry.supportedParameters.length === 0
-                ? undefined
-                : resolved.get(model).supportsStructuredOutputs,
-            expirationDate: defaultEntry.expirationDate ?? null,
-        },
-        incremental: incrementalOutcome,
-        repo: {
-            language: info.language,
-            sourceFiles: info.sourceFileCount,
-            snapshot: info.snapshot,
-            sourceHead,
-            sourceDirty,
-        },
-        redaction: {
-            enabled: redact,
-            values: redactedValues,
-            files: redactedFiles.size,
-            skippedFiles: info.secretFilesSkipped,
-        },
-    };
-}
-function extractContent(result) {
-    const response = result.response;
-    if (!response?.body)
-        return null;
-    const body = response.body;
-    const choices = body.choices;
-    const message = choices?.[0]?.message;
-    return typeof message?.content === "string" ? message.content : null;
-}
-/**
- * Parse lens content as JSON, tolerating the markdown code fences some models
- * wrap structured output in (the same tolerance OpenRouter's headless-agent
- * scaffold ships for --output-schema). Returns null when the content is not
- * JSON at all — which for a strict json_schema request means the output was
- * truncated at max_tokens, not that the model chose prose.
- */
-export function parseLensJson(content) {
-    const trimmed = content.trim();
-    const fenced = /^```(?:json)?\s*\n?([\s\S]*?)\n?```\s*$/.exec(trimmed);
-    const candidate = fenced ? fenced[1].trim() : trimmed;
-    if (!candidate.startsWith("{") && !candidate.startsWith("["))
-        return null;
-    try {
-        return JSON.parse(candidate);
-    }
-    catch {
-        return null;
-    }
-}
-export async function saveLensResults(runDir, lensId, batch) {
-    const results = Array.isArray(batch.results) ? batch.results : [];
-    const out = [];
-    for (const result of results) {
-        const customId = String(result.custom_id ?? "unknown");
-        const content = extractContent(result);
-        if (content === null) {
-            if (result.error) {
-                await writeFile(join(runDir, `${sanitizeId(customId)}.error.json`), `${JSON.stringify(result.error, null, "\t")}\n`, "utf8");
-            }
-            continue;
-        }
-        const parsed = parseLensJson(content);
-        const truncated = parsed === null;
-        if (parsed !== null) {
-            await writeFile(join(runDir, `${sanitizeId(customId)}.json`), `${JSON.stringify(parsed, null, "\t")}\n`, "utf8");
-        }
-        else {
-            // Save the raw bytes verbatim so nothing is lost, but name the
-            // gap: an unparseable strict-schema response is a truncation.
-            await writeFile(join(runDir, `${sanitizeId(customId)}.json`), `${content}\n`, "utf8");
-        }
-        await writeFile(join(runDir, `${sanitizeId(customId)}.md`), renderFindingsMarkdown(content), "utf8");
-        out.push({
-            lensId,
-            customId,
-            moduleName: String(customId).replace(/^[a-z]+-/, ""),
-            content,
-            raw: result,
-            truncated,
-        });
-    }
-    return out;
-}
-/**
- * Rebuild lens results from what a previous collect already wrote to disk.
- *
- * The post-passes are gated on having lens findings in hand, and a collect
- * only holds the ones *it* polled. When an earlier collect saved every lens
- * and then died before synthesis and triage ran — the batch window is long
- * and a poll can easily be interrupted — the next collect finds every lens
- * already terminal, skips them all, and would otherwise reach the post-pass
- * gate with nothing to hand it. Reading the saved results back is what makes
- * "a resumed collect can finish whichever is still pending" true.
- */
-export async function loadSavedLensResults(runDir, lenses) {
-    if (!(await pathExists(runDir)))
-        return [];
-    const reserved = new Set(["requests.json", "run-meta.json", "synthesis.json", "triage.json"]);
-    const out = [];
-    // Longest lens id first: no id is a prefix of another today, but ordering
-    // keeps that from becoming a silent misattribution if one ever is.
-    const ordered = [...lenses].sort((a, b) => b.length - a.length);
-    for (const name of (await readdir(runDir)).sort()) {
-        if (!name.endsWith(".json") || name.endsWith(".error.json") || reserved.has(name) || name.startsWith("raw-"))
-            continue;
-        const customId = name.slice(0, -".json".length);
-        const lensId = ordered.find((id) => customId === id || customId.startsWith(`${id}-`));
-        if (!lensId)
-            continue;
-        const content = await readFile(join(runDir, name), "utf8").catch(() => null);
-        if (content === null)
-            continue;
-        out.push({
-            lensId,
-            customId,
-            moduleName: customId.replace(/^[a-z]+-/, ""),
-            content,
-            raw: {},
-            truncated: parseLensJson(content) === null,
-        });
-    }
-    return out;
-}
-async function loadStoredRequests(runDir) {
-    const path = join(runDir, "requests.json");
-    if (!(await pathExists(path)))
-        return {};
-    try {
-        const parsed = JSON.parse(await readFile(path, "utf8"));
-        return parsed && typeof parsed === "object" ? parsed : {};
-    }
-    catch {
-        return {};
-    }
-}
-/**
- * The verdicts a verify pass left in the run directory, or null when none
- * has run (#338). A file that does not parse is treated as absent: the
- * post-passes then run from the findings alone, which is what they did
- * before verdicts existed, and `status` shows the pass carried no verdicts.
- */
-export async function loadPostPassVerdicts(runDir) {
-    const path = join(runDir, "verified.json");
-    if (!(await pathExists(path)))
-        return null;
-    try {
-        const parsed = JSON.parse(await readFile(path, "utf8"));
-        const findings = Array.isArray(parsed.findings) ? parsed.findings : [];
-        const verdicts = findings
-            .filter((f) => typeof f.title === "string" && typeof f.verdict === "string")
-            .map((f) => ({
-            lensId: String(f.lensId ?? ""),
-            customId: String(f.customId ?? ""),
-            severity: String(f.severity ?? ""),
-            title: String(f.title),
-            location: String(f.location ?? ""),
-            verdict: String(f.verdict),
-            confidence: String(f.confidence ?? ""),
-            evidence: Array.isArray(f.evidence)
-                ? f.evidence.map((e) => ({ file: String(e.file ?? ""), lines: String(e.lines ?? ""), note: String(e.note ?? "") }))
-                : [],
-            reasoning: String(f.reasoning ?? ""),
-        }));
-        return verdicts.length > 0 ? verdicts : null;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * The verdicts as a section of the post-pass user message: one line per
- * finding with the verdict, the evidence the verifier cited, and its
- * reasoning, so the pass can rank on them rather than on the batch model's
- * own severities (#338).
- */
-export function renderPostPassVerdicts(verdicts) {
-    const counts = new Map();
-    for (const v of verdicts)
-        counts.set(v.verdict, (counts.get(v.verdict) ?? 0) + 1);
-    const tally = [...counts.entries()].map(([verdict, n]) => `${n} ${verdict}`).join(", ");
-    const lines = [
-        "",
-        `## Verification verdicts (${verdicts.length} finding(s) read against the source by a read-only-tools pass: ${tally})`,
-        "",
-        "A verdict outranks the batch severity of the finding it names. `confirmed` means the verifier found a reachable " +
-            "failure and named its trigger; `not-a-defect` means the claim is literally true of the code but nothing reaches the " +
-            "failure it describes; `discarded` means the claim is wrong about the code; `unclear` means the code alone could not " +
-            "settle it; `error` means the pass could not read it — treat that finding as unverified. Findings not listed here " +
-            "were not read and stay unverified leads.",
-        "",
-    ];
-    for (const v of verdicts) {
-        const evidence = v.evidence.map((e) => `${e.file}${e.lines ? `:${e.lines}` : ""}${e.note ? ` (${e.note})` : ""}`).join("; ");
-        lines.push(`- [${v.verdict}${v.confidence ? `, ${v.confidence} confidence` : ""}] ${v.lensId}/${v.customId} — [${v.severity}] ${v.title}` +
-            `${v.location ? ` @ ${v.location}` : ""}` +
-            `${v.reasoning ? `\n  Reasoning: ${v.reasoning.replace(/\s+/g, " ").trim()}` : ""}` +
-            `${evidence ? `\n  Evidence: ${evidence}` : ""}`);
-    }
-    lines.push("");
-    return lines.join("\n");
-}
-const SYNTHESIS_VERDICT_INSTRUCTIONS = " A verification pass has read some of the findings against the source; its verdicts follow the reports. " +
-    "Lead top_findings with the confirmed findings and begin each such summary with 'verified: confirmed — ' and the " +
-    "trigger the verifier named; keep an unclear one with 'verified: unclear — '. A discarded or not-a-defect finding " +
-    "does not appear in top_findings and is not counted in severity_summary. Say in the executive summary how many " +
-    "findings were verified and how the verdicts split; findings the pass did not read remain unverified, and the " +
-    "summary says so of them, not of the confirmed ones.";
-const TRIAGE_VERDICT_INSTRUCTIONS = " A verification pass has read some of the findings against the source; its verdicts follow the findings. " +
-    "A confirmed finding ranks above every unverified finding of the same or lower severity: put the confirmed " +
-    "findings at the top of the queue and begin each one's rationale with 'verified: confirmed — ' and the trigger " +
-    "the verifier named. Keep an unclear finding in the queue with 'verified: unclear — ' in its rationale. Do not " +
-    "queue a discarded or not-a-defect finding: list each in omitted, beginning with 'verified: discarded — ' or " +
-    "'verified: not a defect — ' and the reason the pass gave. Findings the pass did not read stay unverified leads, " +
-    "and the summary says how many verdicts the queue was built from.";
-function buildSynthesisRequest(findingsText, truncatedNote, model, verdicts = null) {
-    return {
-        custom_id: "synthesis",
-        body: {
-            model,
-            messages: [
-                {
-                    role: "system",
-                    content: "You are a technical editor synthesizing multiple analysis reports about a single " +
-                        "codebase into one coherent summary. The reports come from different lenses — " +
-                        "architecture, API surface, security review, defect scanning, convention extraction, " +
-                        "and porting assessment. Cross-reference findings across lenses: if a security issue " +
-                        "also appears as a defect, merge them. Produce a JSON object following the " +
-                        "synthesis_report schema. Prioritize the most actionable findings. " +
-                        "Be honest about gaps — if a lens found nothing, say 'no issues found' rather than " +
-                        "inventing problems. These are scouting signals from a batch model, not verified " +
-                        "claims; note that in the summary." +
-                        (verdicts ? SYNTHESIS_VERDICT_INSTRUCTIONS : ""),
-                },
-                {
-                    role: "user",
-                    content: "Synthesize these analysis reports into a single summary.\n\n" +
-                        findingsText +
-                        truncatedNote +
-                        (verdicts ? renderPostPassVerdicts(verdicts) : "") +
-                        "\nReturn the synthesis_report JSON schema.",
-                },
-            ],
-            response_format: { type: "json_schema", json_schema: SCHEMAS.synthesis },
-            max_tokens: 12_000,
-        },
-    };
-}
-function buildTriageRequest(findingsText, truncatedNote, model, verdicts = null) {
-    return {
-        custom_id: "triage",
-        body: {
-            model,
-            messages: [
-                {
-                    role: "system",
-                    content: "You are a senior engineering lead turning unverified scouting findings into a " +
-                        "prioritized work order. Given the findings below, produce a JSON object following " +
-                        "the triage_report schema. Score every lead by impact and fix difficulty, assign a " +
-                        "priority (P0 urgent/safety-critical to P3 nice-to-have), give a rough effort " +
-                        "estimate, group the queue by module where sensible, and justify each call in the " +
-                        "rationale. Merge duplicate leads instead of listing them twice. Drop leads that are " +
-                        "too vague to act on and record each drop in omitted with the reason. These findings " +
-                        "are UNVERIFIED scouting signals from a cheap batch model: the queue is a starting " +
-                        "point for re-verification, not a commitment — say so in the summary, and never " +
-                        "inflate a severity you cannot see evidence for." +
-                        (verdicts ? TRIAGE_VERDICT_INSTRUCTIONS : ""),
-                },
-                {
-                    role: "user",
-                    content: "Triage these scouting findings into a prioritized work order.\n\n" +
-                        findingsText +
-                        truncatedNote +
-                        (verdicts ? renderPostPassVerdicts(verdicts) : "") +
-                        "\nReturn the triage_report JSON schema.",
-                },
-            ],
-            response_format: { type: "json_schema", json_schema: SCHEMAS.triage },
-            max_tokens: 10_000,
-        },
-    };
-}
-function parseTriageItems(content) {
-    try {
-        const parsed = JSON.parse(content);
-        const items = Array.isArray(parsed.items) ? parsed.items : [];
-        return items
-            .filter((item) => typeof item.title === "string")
-            .map((item) => ({
-            title: String(item.title),
-            severity: String(item.severity ?? "unknown"),
-            module: String(item.module ?? "unknown"),
-            impact: (["high", "medium", "low"].includes(String(item.impact)) ? String(item.impact) : "medium"),
-            difficulty: (["high", "medium", "low"].includes(String(item.difficulty)) ? String(item.difficulty) : "medium"),
-            priority: String(item.priority ?? "?"),
-            effort_estimate: String(item.effort_estimate ?? ""),
-            rationale: String(item.rationale ?? ""),
-        }));
-    }
-    catch {
-        return [];
-    }
-}
-export async function runBroadsideCollect(cwd, apiKey, opts = {}) {
-    const broadsideDir = broadsideDirFor(cwd);
-    const state = await loadBroadsideState(broadsideDir);
-    const run = opts.runId ? state.runs.find((candidate) => candidate.id === opts.runId) : state.runs[state.runs.length - 1];
-    if (!run) {
-        if (opts.runId) {
-            const known = state.runs.map((candidate) => candidate.id);
-            throw new Error(`No Broad-Side run with id ${opts.runId}. ` +
-                (known.length > 0 ? `Recorded runs: ${known.join(", ")}.` : "No runs are recorded; call codecarto_broadside with action 'submit' first."));
-        }
-        throw new Error("No Broad-Side run recorded. Call codecarto_broadside with action 'submit' first.");
-    }
-    const runDir = join(broadsideDir, run.outputDir);
-    await mkdir(runDir, { recursive: true });
-    // The spending slots this collect has claimed (#322); only a claimed slot
-    // is ever submitted from here. Every write-back merges with the file, so a
-    // slot another collect has moved further along is never overwritten.
-    const owned = new Set();
-    const persist = () => persistBroadsideRunMerging(broadsideDir, run);
-    const aborted = () => opts.signal?.aborted === true;
-    const deadline = Date.now() + (opts.waitMs ?? BROADSIDE_DEFAULT_POLL_BUDGET_MS);
-    let totalCost = 0;
-    let resultCount = 0;
-    let truncatedCount = 0;
-    const lensOutcomes = {};
-    const allLensResults = [];
-    // Terminal entries are settled already; everything else polls in parallel
-    // against one shared deadline (#136), then results save in lens order so
-    // output layout stays deterministic.
-    const inFlight = [];
-    for (const lensId of run.lenses) {
-        const entry = run.batches[lensId];
-        if (!entry || !entry.batchId) {
-            lensOutcomes[lensId] = { status: entry?.status ?? "failed", resultCount: 0 };
-            continue;
-        }
-        if (BROADSIDE_TERMINAL_ENTRY_STATUSES.includes(entry.status)) {
-            totalCost += entry.cost ?? 0;
-            resultCount += entry.resultCount ?? 0;
-            lensOutcomes[lensId] = { status: entry.status, cost: entry.cost, resultCount: entry.resultCount };
-            continue;
-        }
-        inFlight.push({ lensId, batchId: entry.batchId });
-    }
-    const polled = await pollBatchesConcurrently(inFlight, apiKey, {
-        deadlineMs: Math.max(0, deadline - Date.now()),
-        fetcher: opts.fetcher,
-        pollIntervalMs: opts.pollIntervalMs,
-        signal: opts.signal,
-        onStatus: opts.onStatus,
-    });
-    for (const { lensId } of inFlight) {
-        const entry = run.batches[lensId];
-        if (!entry)
-            continue;
-        const batch = polled.get(entry.batchId) ?? { id: entry.batchId, status: "timeout" };
-        const status = String(batch.status ?? "unknown");
-        entry.status = status;
-        if (status === "completed") {
-            const usage = (batch.usage ?? {});
-            const cost = typeof usage.cost === "number" ? usage.cost : undefined;
-            entry.cost = cost;
-            entry.completedAt = new Date().toISOString();
-            const stored = await saveLensResults(runDir, lensId, batch);
-            entry.resultCount = stored.length;
-            const truncated = stored.filter((s) => s.truncated).length;
-            allLensResults.push(...stored);
-            resultCount += stored.length;
-            truncatedCount += truncated;
-            totalCost += cost ?? 0;
-            await writeFile(join(runDir, `raw-${lensId}.json`), `${JSON.stringify(batch, null, "\t")}\n`, "utf8");
-            // A batch can complete with every request failed — the account's
-            // concurrent-job quota filling after acceptance does exactly this.
-            // The per-request errors are on disk as `<id>.error.json`, but a
-            // lens reporting "completed, 0 result(s)" with the reason buried
-            // there read as an empty repository rather than a refused run.
-            const results = Array.isArray(batch.results) ? batch.results : [];
-            const failed = results.filter((r) => r.error && extractContent(r) === null);
-            const allFailed = stored.length === 0 && failed.length > 0
-                ? `all ${failed.length} request(s) failed: ${explainBatchError(failed[0].error)}`
-                : null;
-            if (allFailed)
-                entry.error = allFailed;
-            lensOutcomes[lensId] = { status, cost: entry.cost, resultCount: entry.resultCount, truncated, ...(allFailed && { error: allFailed }) };
-        }
-        else {
-            // Every non-completed outcome still has to reach the report.
-            // `lensOutcomes` is what the caller renders, and this branch used to
-            // require `batch.error` — but the commonest failure here is the
-            // synthetic `{ status: "timeout" }` the poll returns when its budget
-            // expires with the batch still in flight, and that carries no error.
-            // A lens that never came back was therefore omitted entirely,
-            // indistinguishable in the output from one that was never requested.
-            if (batch.error)
-                entry.error = batch.error;
-            const error = explainBatchError(batch.error);
-            lensOutcomes[lensId] = { status, cost: entry.cost, resultCount: entry.resultCount, ...(error && { error }) };
-        }
-        await persist();
-    }
-    // #133: re-submit truncated slices once with a bumped output cap and low
-    // reasoning effort. Batch requests are pure, so re-running is always safe;
-    // the aim is to recover coverage the first pass lost to a max_tokens
-    // cutoff, not to loop forever. Low effort because the cutoff is usually
-    // thinking, and a doubled budget doubled the thinking where a token cap
-    // was ignored (see retryReasoningFor).
-    //
-    // All bumped requests for one model go out as ONE batch, and the batches
-    // (one per model, since a batch carries a single model) are polled
-    // together against the shared deadline. Each truncated slice used to be
-    // submitted and polled to terminal before the next was submitted, so a
-    // model that truncated 11 of 13 slices turned a five-minute collect into
-    // eleven sequential round trips — the serialization #136 removed from the
-    // lens pass, still present here (#206). Grouping also keeps the retry to
-    // one job per model against OpenRouter's 16-concurrent-job quota.
-    let retriedCount = 0;
-    let retryElsewhere = false;
-    // A collect that polled nothing — every lens already terminal — still owes
-    // the retry if the collect that saved the results never got to it (it
-    // died, or its client did: #322). Read the saved results back and let the
-    // claim decide; a recovered slice re-parses clean, so this costs nothing
-    // once the retry has run.
-    if (opts.retryTruncated !== false && allLensResults.length === 0 && !aborted()) {
-        const everyLensTerminal = run.lenses.every((lensId) => {
-            const entry = run.batches[lensId];
-            return entry && BROADSIDE_TERMINAL_ENTRY_STATUSES.includes(entry.status);
-        });
-        if (everyLensTerminal) {
-            const restored = await loadSavedLensResults(runDir, run.lenses);
-            if (restored.some((s) => s.truncated)) {
-                allLensResults.push(...restored);
-                truncatedCount = restored.filter((s) => s.truncated).length;
-            }
-        }
-    }
-    if (opts.retryTruncated !== false && truncatedCount > 0 && !aborted()) {
-        // Claim the pass before spending: a second collect on this run finds the
-        // claim and leaves the retry to the first (#322). A retry another
-        // collect has already settled is not run again — its truncation is
-        // what it is.
-        if (await claimRunSlot(broadsideDir, run, "retry"))
-            owned.add("retry");
-        else if (run.retry?.status === "submitted")
-            retryElsewhere = true;
-    }
-    if (opts.retryTruncated !== false && truncatedCount > 0 && owned.has("retry")) {
-        const requestsByCustomId = await loadStoredRequests(runDir);
-        const byModel = new Map();
-        for (const stored of allLensResults) {
-            if (!stored.truncated)
-                continue;
-            const original = requestsByCustomId[stored.customId];
-            if (!original)
-                continue;
-            const lensEntry = run.batches[stored.lensId];
-            // A lens may have run on its own model (config `lens_models`), with its
-            // own completion ceiling. Re-submitting against the run default would
-            // change the model mid-run and could exceed that lens's real ceiling.
-            const lensModel = lensEntry?.model ?? run.model;
-            const lensCap = lensEntry?.outputCap ?? run.outputCap;
-            const previousMax = original.body.max_tokens ?? getLens(stored.lensId).maxTokens;
-            const bumpedMax = lensCap ? Math.min(previousMax * 2, lensCap) : previousMax * 2;
-            if (bumpedMax <= previousMax)
-                continue; // already at the ceiling
-            const group = byModel.get(lensModel) ?? { requests: [], slices: new Map() };
-            group.requests.push({
-                ...original,
-                body: { ...original.body, max_tokens: bumpedMax, reasoning: retryReasoningFor(original.body.reasoning) },
-            });
-            group.slices.set(stored.customId, stored);
-            byModel.set(lensModel, group);
-        }
-        // Submit every group, then poll whatever was accepted, together.
-        const submitted = [];
-        for (const [model, group] of byModel) {
-            if (aborted())
-                break;
-            try {
-                const { batchId, error } = await submitBatch(group.requests, apiKey, opts.fetcher, model);
-                if (!error && batchId)
-                    submitted.push({ model, batchId });
-            }
-            catch {
-                // A retry batch that fails to submit leaves its slices' original
-                // truncated results in place — nothing is lost.
-            }
-        }
-        // Record the ids under the claim so a later collect can see what was
-        // paid for, even if this one never returns. No group at all means every
-        // truncated slice was already at its model's ceiling: nothing to retry.
-        run.retry = {
-            ...run.retry,
-            batches: submitted,
-            status: submitted.length > 0 ? "submitted" : byModel.size === 0 ? "completed" : "failed",
-        };
-        await persist();
-        const polled = await pollBatchesConcurrently(submitted.map(({ model, batchId }) => ({ lensId: `retry:${model}`, batchId })), apiKey, {
-            // Share the caller's deadline. Each of these polls used to start a
-            // fresh 25-minute budget, so `wait_seconds` bounded only the lens
-            // poll and a collect could run for the caller's budget plus fifty
-            // minutes.
-            deadlineMs: Math.max(0, deadline - Date.now()),
-            fetcher: opts.fetcher,
-            pollIntervalMs: opts.pollIntervalMs,
-            signal: opts.signal,
-            onStatus: opts.onStatus,
-        });
-        for (const { model, batchId } of submitted) {
-            const batch = polled.get(batchId);
-            if (!batch || batch.status !== "completed")
-                continue;
-            const group = byModel.get(model);
-            const usage = (batch.usage ?? {});
-            // Kept on the entry, not just added to this collect's running total:
-            // a later collect on the run used to report a total without it.
-            if (typeof usage.cost === "number")
-                run.retry = { ...run.retry, cost: (run.retry?.cost ?? 0) + usage.cost };
-            const results = Array.isArray(batch.results) ? batch.results : [];
-            for (const result of results) {
-                const stored = group.slices.get(String(result.custom_id ?? ""));
-                if (!stored)
-                    continue;
-                const content = extractContent(result);
-                if (content === null)
-                    continue;
-                const parsed = parseLensJson(content);
-                if (parsed === null)
-                    continue; // still no good
-                await writeFile(join(runDir, `${sanitizeId(stored.customId)}.json`), `${JSON.stringify(parsed, null, "\t")}\n`, "utf8");
-                await writeFile(join(runDir, `${sanitizeId(stored.customId)}.md`), renderFindingsMarkdown(content), "utf8");
-                stored.content = content;
-                stored.truncated = false;
-                retriedCount += 1;
-            }
-        }
-        // Every retry batch reached a terminal status, or the poll ran out.
-        if (submitted.length > 0 && submitted.every(({ batchId }) => polled.get(batchId)?.status === "completed")) {
-            run.retry = { ...run.retry, status: "completed" };
-        }
-        truncatedCount = allLensResults.filter((s) => s.truncated).length;
-        for (const [lensId, outcome] of Object.entries(lensOutcomes)) {
-            if (outcome.truncated !== undefined) {
-                outcome.truncated = allLensResults.filter((s) => s.lensId === lensId && s.truncated).length;
-            }
-        }
-        await persist();
-    }
-    // Synthesis + triage: cross-lens post-passes, only after every lens batch
-    // is terminal. Triage turns the leads into a prioritized work order.
-    run.triage ??= { status: "pending" };
-    let topFindings = [];
-    let topTriageItems = [];
-    const wantSynthesis = opts.includeSynthesis !== false;
-    const wantTriage = opts.includeTriage !== false;
-    // A regenerate resets the wanted, settled passes to pending on disk first —
-    // the merging persist keeps whatever is further along on disk, so an
-    // in-memory reset alone would be undone by the next persist (#338).
-    let regenerated = [];
-    if (opts.regeneratePostPasses) {
-        if (!wantSynthesis && !wantTriage) {
-            throw new Error("Nothing to regenerate: both post-passes are disabled for this collect.");
-        }
-        const lensesSettled = run.lenses.every((lensId) => {
-            const entry = run.batches[lensId];
-            return entry && BROADSIDE_TERMINAL_ENTRY_STATUSES.includes(entry.status);
-        });
-        if (!lensesSettled) {
-            throw new Error(`Cannot regenerate the post-passes of run ${run.id}: its lens batches are still running — collect them first.`);
-        }
-        regenerated = await resetRunPostPasses(broadsideDir, run, { synthesis: wantSynthesis, triage: wantTriage });
-    }
-    // A resumed collect polls nothing — every lens is already terminal — so the
-    // findings the post-passes need have to come back off disk, or a run whose
-    // first collect was interrupted could never produce its executive report
-    // and work order, however many times it was re-run.
-    const postPassUnfinished = (entry) => entry.status === "pending" || entry.status === "submitted";
-    if ((wantSynthesis || wantTriage) && allLensResults.length === 0
-        && (postPassUnfinished(run.synthesis) || postPassUnfinished(run.triage))) {
-        const restored = await loadSavedLensResults(runDir, run.lenses);
-        if (restored.length > 0) {
-            allLensResults.push(...restored);
-            truncatedCount = restored.filter((s) => s.truncated).length;
-        }
-    }
-    if ((wantSynthesis || wantTriage) && allLensResults.length > 0) {
-        const allTerminal = run.lenses.every((lensId) => {
-            const entry = run.batches[lensId];
-            return entry && BROADSIDE_TERMINAL_ENTRY_STATUSES.includes(entry.status);
-        });
-        if (allTerminal && (postPassUnfinished(run.synthesis) || postPassUnfinished(run.triage))) {
-            const findingsText = allLensResults
-                .map((r) => `## ${r.lensId} — ${r.customId}\n\n${r.content}\n`)
-                .join("\n");
-            // A verify pass that ran before this point leaves its verdicts in the
-            // run directory; the post-passes rank on them when present (#338).
-            const verdicts = await loadPostPassVerdicts(runDir);
-            const truncatedNote = truncatedCount > 0
-                ? `\n\nNOTE: ${truncatedCount} lens result(s) were truncated at the output token limit and are ` +
-                    "not included above. Any gap they would have covered is unrepresented — do not treat " +
-                    "silence on a module as a clean bill.\n"
-                : "";
-            // Both post-passes consume the same findings; they run as two
-            // batches (different response_format schemas cannot share one)
-            // submitted together and polled in turn.
-            // Claim each wanted, still-pending pass before building its request:
-            // a second collect on this run adopts the first one's entry instead
-            // of submitting its own (#322). An abort submits nothing further.
-            const passes = [];
-            for (const kind of ["synthesis", "triage"]) {
-                const want = kind === "synthesis" ? wantSynthesis : wantTriage;
-                if (!want || aborted())
-                    continue;
-                if ((kind === "synthesis" ? run.synthesis : run.triage).status !== "pending")
-                    continue;
-                if (!(await claimRunSlot(broadsideDir, run, kind)))
-                    continue;
-                owned.add(kind);
-                const entry = kind === "synthesis" ? run.synthesis : run.triage;
-                if (verdicts)
-                    entry.verdicts = verdicts.length;
-                else
-                    delete entry.verdicts;
-                passes.push({
-                    kind,
-                    request: kind === "synthesis"
-                        ? buildSynthesisRequest(findingsText, truncatedNote, run.model, verdicts)
-                        : buildTriageRequest(findingsText, truncatedNote, run.model, verdicts),
-                    entry,
-                });
-            }
-            const submitted = new Map();
-            // A pass can be left at "submitted" when an earlier collect returned
-            // before its batch reached a terminal status — the batch still runs
-            // and is still charged, so the result exists and is simply unclaimed.
-            // Nothing above would ever look at it again: the pass list is built
-            // from "pending" entries only. Poll those regardless of the want
-            // flags, because the spend already happened and discarding a
-            // finished result is worse than saving one the caller opted out of.
-            for (const kind of ["synthesis", "triage"]) {
-                const entry = kind === "synthesis" ? run.synthesis : run.triage;
-                if (entry.status !== "submitted" || !entry.batchId)
-                    continue;
-                if (submitted.has(entry.batchId))
-                    continue;
-                submitted.set(entry.batchId, {
-                    batchId: entry.batchId,
-                    pass: { kind, request: undefined, entry },
-                });
-            }
-            await Promise.allSettled(passes.map(async (pass) => {
-                pass.entry.status = "submitted";
-                try {
-                    const { batchId, error } = await submitBatch([pass.request], apiKey, opts.fetcher, run.model);
-                    if (error) {
-                        pass.entry.status = "failed";
-                        return;
-                    }
-                    pass.entry.batchId = batchId;
-                    submitted.set(batchId, { batchId, pass });
-                }
-                catch {
-                    pass.entry.status = "failed";
-                }
-            }));
-            await persist();
-            // Poll both passes together against the shared deadline. Polled in
-            // turn, the first pass could spend the whole budget and leave the
-            // second a single poll (0.22.1 live run: triage settled, synthesis
-            // left running though it had been submitted at the same moment).
-            // A pass whose poll runs out stays `submitted`, so the batch is
-            // already paid for and a later collect claims its result.
-            const polledPasses = await pollBatchesConcurrently([...submitted.values()].map(({ batchId, pass }) => ({ lensId: pass.kind, batchId })), apiKey, {
-                deadlineMs: Math.max(0, deadline - Date.now()),
-                fetcher: opts.fetcher,
-                pollIntervalMs: opts.pollIntervalMs,
-                signal: opts.signal,
-                onStatus: opts.onStatus,
-            });
-            for (const { batchId, pass } of submitted.values()) {
-                const batch = polledPasses.get(batchId) ?? { id: batchId, status: "timeout" };
-                if (batch.status === "completed") {
-                    const usage = (batch.usage ?? {});
-                    const cost = typeof usage.cost === "number" ? usage.cost : undefined;
-                    pass.entry.status = "completed";
-                    pass.entry.cost = cost;
-                    const results = Array.isArray(batch.results) ? batch.results : [];
-                    const content = results.length > 0 ? extractContent(results[0]) : null;
-                    if (content !== null) {
-                        await writeFile(join(runDir, `${pass.kind}.json`), `${content}\n`, "utf8");
-                        await writeFile(join(runDir, `${pass.kind}.md`), renderFindingsMarkdown(content), "utf8");
-                        if (pass.kind === "synthesis") {
-                            topFindings = parseSynthesisTopFindings(content);
-                        }
-                        else {
-                            topTriageItems = parseTriageItems(content);
-                        }
-                    }
-                }
-                else if (BROADSIDE_DEAD_BATCH_STATUSES.includes(String(batch.status))) {
-                    // The batch will never produce a result, so retire the pass.
-                    // This used to require `batch.error`, leaving an expired or
-                    // cancelled batch parked at "submitted" forever — and since a
-                    // resumed collect re-polls anything still "submitted", it
-                    // would re-poll a dead batch on every future run.
-                    pass.entry.status = "failed";
-                    if (batch.error)
-                        pass.entry.error = batch.error instanceof Error ? batch.error.message : String(batch.error);
-                }
-                // A "timeout" is deliberately left at "submitted": the batch is
-                // still running server-side and has already been paid for, so a
-                // later collect should claim its result rather than discard it.
-                await persist();
-            }
-        }
-    }
-    const terminal = run.lenses.every((lensId) => {
-        const entry = run.batches[lensId];
-        return entry && BROADSIDE_TERMINAL_ENTRY_STATUSES.includes(entry.status);
-    });
-    run.status = terminal ? (resultCount > 0 ? "completed" : "failed") : "partial";
-    // The run's total is the sum of what its entries record, not of what this
-    // collect happened to poll: a repeat collect used to report — and persist
-    // — a total without the post-passes and the retry an earlier collect had
-    // settled, so the recorded cost of a run went down each time it was read.
-    totalCost += (run.retry?.cost ?? 0) + (run.synthesis.cost ?? 0) + (run.triage.cost ?? 0) + (run.retiredCost ?? 0);
-    run.totalCost = totalCost;
-    await persist();
-    await writeFile(join(runDir, "run-meta.json"), `${JSON.stringify({
-        experimental: true,
-        method: "Broad-Side (OpenRouter Batch API)",
-        model: run.model,
-        pricing: run.pricing,
-        max_cost: run.maxCost,
-        run_id: run.id,
-        created_at: run.createdAt,
-        status: run.status,
-        total_cost: totalCost,
-        result_count: resultCount,
-        truncated_count: truncatedCount,
-        retried_count: retriedCount,
-        synthesis: run.synthesis,
-        triage: run.triage,
-        lenses: run.lenses,
-        // Which lens ran on which model. Absent means the run default —
-        // a reader comparing two runs needs to know a lens changed model.
-        lens_models: Object.fromEntries(Object.entries(run.batches)
-            .filter(([, batch]) => batch?.model)
-            .map(([lensId, batch]) => [lensId, batch.model])),
-        disclaimer: "Findings are unverified scouting signals from a batch model, not validated claims. " +
-            "Re-verify every file:line lead with the interactive pipeline or by hand.",
-    }, null, "\t")}\n`, "utf8");
-    return {
-        runId: run.id,
-        status: run.status,
-        totalCost,
-        resultCount,
-        truncatedCount,
-        retriedCount,
-        ...(retryElsewhere && { retryElsewhere: true }),
-        lensOutcomes,
-        synthesis: run.synthesis,
-        triage: run.triage,
-        topFindings,
-        topTriageItems,
-        ...(regenerated.length > 0 && { regenerated }),
-    };
-}
-export async function runBroadsideStatus(cwd) {
-    const broadsideDir = broadsideDirFor(cwd);
-    const state = await loadBroadsideState(broadsideDir);
-    return { state };
-}
-// ---------- rendering ----------
-export function renderFindingsMarkdown(content) {
-    const parsed = parseLensJson(content);
-    if (parsed === null)
-        return content;
-    return formatAsMarkdown(parsed);
-}
-function formatAsMarkdown(value, depth = 0) {
-    const indent = "\t".repeat(depth);
-    if (Array.isArray(value)) {
-        const lines = [];
-        for (let i = 0; i < value.length; i++) {
-            const item = value[i];
-            if (item && typeof item === "object") {
-                const title = (item.title ?? item.name ?? item.module ?? item.area ?? item.platform ?? "");
-                lines.push(`${indent}${i + 1}. ${title}`);
-                lines.push(formatAsMarkdown(item, depth + 1));
-            }
-            else {
-                lines.push(`${indent}- ${String(item)}`);
-            }
-        }
-        return lines.join("\n");
-    }
-    if (value && typeof value === "object") {
-        const lines = [];
-        for (const [key, entryValue] of Object.entries(value)) {
-            if (entryValue && typeof entryValue === "object") {
-                lines.push(`${indent}**${key}**:`);
-                lines.push(formatAsMarkdown(entryValue, depth + 1));
-            }
-            else {
-                lines.push(`${indent}- **${key}**: ${String(entryValue)}`);
-            }
-        }
-        return lines.join("\n");
-    }
-    return `${indent}${String(value)}`;
-}
-function parseSynthesisTopFindings(content) {
-    try {
-        const parsed = JSON.parse(content);
-        const findings = Array.isArray(parsed.top_findings)
-            ? parsed.top_findings
-            : [];
-        return findings
-            .filter((f) => typeof f.title === "string")
-            .map((f) => ({
-            title: String(f.title),
-            severity: String(f.severity ?? "unknown"),
-            sourceLens: String(f.source_lens ?? "unknown"),
-            summary: String(f.summary ?? ""),
-        }));
-    }
-    catch {
-        return [];
-    }
-}
-// ---------- formatting helpers for tool output ----------
-export function describeIncrementalFallback(reason) {
-    switch (reason) {
-        case "dirty-worktree":
-            return "the working tree has uncommitted changes, so there is no committed state to diff against";
-        case "no-baseline":
-            return "no earlier run recorded a commit to diff against";
-        case "diff-failed":
-            return "the diff against the previous run's commit could not be read";
-        default:
-            return "no baseline was available";
-    }
-}
-export function estimateSubmitText(result, lenses) {
-    // Count the lenses that actually got a batch, not every lens considered. A
-    // lens with nothing to scan is reported as `skipped (0 request(s))` two
-    // lines below, so counting it here made the header contradict its own body:
-    // a Rust CLI with no server surface reported "submitted 6 batch(es)" over a
-    // list showing four batches and two skips.
-    const entries = Object.values(result.batches ?? {});
-    const submittedCount = entries.filter((entry) => entry.batchId).length;
-    const withoutBatch = entries.length - submittedCount;
-    const lines = [
-        withoutBatch > 0
-            ? `Broad-Side submitted ${submittedCount} batch(es); ${withoutBatch} lens(es) produced none (see below).`
-            : `Broad-Side submitted ${submittedCount} batch(es).`,
-    ];
-    for (const lens of lenses) {
-        const entry = result.batches[lens.id];
-        if (!entry)
-            continue;
-        const status = entry.batchId ? `batch ${entry.batchId}` : entry.status;
-        const override = entry.model ? ` on ${entry.model}` : "";
-        // A rejected lens says why: the message is the only way to tell a
-        // catalog id with no batch endpoint from a full job quota, and both
-        // used to read as a bare "rejected". A skipped lens names the globs
-        // that matched nothing.
-        const reason = !entry.batchId && entry.error
-            ? ` — ${explainBatchError(entry.error)}`
-            : !entry.batchId && entry.reason
-                ? ` — ${entry.reason}`
-                : entry.fallback
-                    ? ` — ${entry.fallback}`
-                    : "";
-        lines.push(`  ${lens.name}: ${status} (${entry.requests} request(s), ~$${entry.estimatedCost.toFixed(4)})${override}${reason}`);
-    }
-    if (result.repo) {
-        const head = result.repo.sourceHead ? ` at ${result.repo.sourceHead.slice(0, 8)}${result.repo.sourceDirty ? " (dirty)" : ""}` : "";
-        const source = result.repo.snapshot === "working-tree" ? `working tree${head}` : "directory walk (not a git repository)";
-        lines.push(`Scanned as ${result.repo.language}: ${result.repo.sourceFiles} source file(s) from the ${source}.`);
-    }
-    if (result.redaction) {
-        const line = result.redaction.enabled
-            ? describeRedactions(result.redaction.values, result.redaction.files, result.redaction.skippedFiles)
-            : "Before upload: secret redaction is OFF (redact_secrets: false in config.yaml); files were sent as they are.";
-        if (line)
-            lines.push(line);
-    }
-    const incremental = result.incremental;
-    if (incremental?.requested) {
-        lines.push(incremental.applied
-            ? `Incremental: scanning only what changed since ${(incremental.baseHead ?? "").slice(0, 8)}.`
-            : `Incremental: requested but NOT applied — ${describeIncrementalFallback(incremental.reason)}. Every module was scanned, at full cost.`);
-    }
-    lines.push(`Estimated total: ~$${result.estimatedTotalCost.toFixed(4)}`, `Pricing: $${result.pricing.inputPerM.toFixed(4)}/M in, $${result.pricing.outputPerM.toFixed(4)}/M out (${result.pricing.source})`);
-    if (result.modelInfo.contextLength) {
-        lines.push(`Model: ${result.modelInfo.contextLength.toLocaleString()} context, ${result.modelInfo.maxCompletionTokens?.toLocaleString() ?? "?"} max output`);
-    }
-    if (result.modelInfo.supportsStructuredOutputs === false) {
-        lines.push("Warning: model does not advertise structured-output support; lens JSON may be unreliable.");
-    }
-    if (result.modelInfo.expirationDate) {
-        lines.push(`Warning: this model is deprecated (expires ${result.modelInfo.expirationDate}).`);
-    }
-    if (result.maxCost) {
-        lines.push(`Run limit: $${result.maxCost.toFixed(2)} (enforced on estimate; pass force to override)`);
-    }
-    lines.push(`Results will land in ${result.outputDir}/`, "Call codecarto_broadside with action 'collect' once batches finish, or pass wait_seconds on submit to block.", "Disclaimer: Broad-Side findings are unverified scouting signals from a batch model, not validated claims.");
-    return lines.join("\n");
-}
-export function modelsText(entries, opts) {
-    const endpoints = opts.endpoints ?? {};
-    const lines = [
-        `Batch models on OpenRouter (${entries.length}, cheapest first).`,
-        // The catalog over-reports: it returns a `:batch` id for models whose
-        // Batch API refuses the job, with nothing in the entry to tell them
-        // apart (#141). Say so before the table, not after it.
-        "Advisory: this is the catalog's list of :batch ids, not a list of working batch endpoints. Some ids are refused at submit " +
-            "(\"does not have a :batch endpoint\"), at no cost. Rows tagged [no batch endpoint …] or [batch OK …] carry what this " +
-            "repository's own submits found; an untagged row has not been tried here.",
-        "",
-        "id | $/M in | $/M out | ctx | max out | structured | coding idx",
-    ];
-    for (const entry of entries) {
-        const bench = opts.benchmarks?.byBaseSlug[baseSlug(entry.id)];
-        const structured = entry.supportedParameters.length === 0
-            ? "?"
-            : entry.supportedParameters.some((p) => ["structured_outputs", "json_schema", "response_format", "structuredoutputs"].includes(p.toLowerCase()))
-                ? "yes"
-                : "no";
-        const coding = bench?.codingIndex !== undefined ? bench.codingIndex.toFixed(1) : "-";
-        const ctx = entry.contextLength
-            ? entry.contextLength >= 1_000_000
-                ? `${(entry.contextLength / 1_000_000).toFixed(1)}M`
-                : `${(entry.contextLength / 1024).toFixed(0)}k`
-            : "?";
-        const out = entry.maxCompletionTokens ? `${(entry.maxCompletionTokens / 1024).toFixed(0)}k` : "?";
-        const tag = entry.id === opts.defaultModel ? "  (default)" : "";
-        const exp = entry.expirationDate ? "  [deprecated]" : "";
-        const record = endpoints[entry.id];
-        const seen = record
-            ? record.status === "rejected"
-                ? `  [no batch endpoint, refused ${record.at.slice(0, 10)}]`
-                : `  [batch OK ${record.at.slice(0, 10)}]`
-            : "";
-        lines.push(`${entry.id}${tag}${exp}${seen} | ${entry.inputPerM.toFixed(3)} | ${entry.outputPerM.toFixed(3)} | ${ctx} | ${out} | ${structured} | ${coding}`);
-    }
-    if (opts.benchmarks?.meta.as_of) {
-        lines.push("", `Benchmarks: Artificial Analysis coding index (as of ${String(opts.benchmarks.meta.as_of)}).`);
-    }
-    lines.push("", "Choose with the model parameter (--model= on Pi) for one run, lens_models (--lens-model=LENS:ID) per lens, or the model key in " +
-        ".codecarto/broadside/config.yaml for the repository. Higher coding index ≠ better scout: precision, context, structured-output " +
-        "support, and whether the model spends its output budget reasoning (see reasoning: in config.yaml) matter most here. " +
-        "A refused submit costs nothing, so probe an untried model on one lens first.");
-    return lines.join("\n");
-}
-/** One line of a batch's error field, whatever shape the provider gave it. */
-function describeBatchError(error) {
-    if (error === undefined || error === null || error === "")
-        return null;
-    if (typeof error === "string")
-        return error.slice(0, 300);
-    if (typeof error === "object") {
-        const message = error.message;
-        if (typeof message === "string" && message)
-            return message.slice(0, 300);
-        // OpenRouter wraps a submit refusal as `{ error: { message } }`.
-        const nested = error.error;
-        if (nested && typeof nested === "object") {
-            const inner = nested.message;
-            if (typeof inner === "string" && inner)
-                return inner.slice(0, 300);
-        }
-        if (typeof nested === "string" && nested)
-            return nested.slice(0, 300);
-        try {
-            return JSON.stringify(error).slice(0, 300);
-        }
-        catch {
-            return String(error);
-        }
-    }
-    return String(error);
-}
-/**
- * A provider refusal plus what to do about it, for the two refusals a batch
- * run meets in practice and cannot fix by itself (#141):
- *
- * - `Model '<id>' does not have a :batch endpoint.` — the catalog advertises a
- *   `:batch` id that OpenRouter runs no batch endpoint for. Nothing in the
- *   catalog distinguishes these; the `models` action marks ids this
- *   repository has seen refused.
- * - `job-submission-count … in use: 16, quota: 16` — the per-account limit
- *   on concurrent batch jobs. Broad-Side submits one job per lens, so a few
- *   runs in flight on the same key fill it; the refusal costs nothing.
- */
-export function explainBatchError(error) {
-    const message = describeBatchError(error);
-    if (!message)
-        return null;
-    if (NO_BATCH_ENDPOINT_RE.test(message)) {
-        return `${message} — the catalog lists this id, but OpenRouter runs no batch endpoint for it. Nothing was charged; pick another model (the models action marks ids this repository has seen refused).`;
-    }
-    if (BATCH_QUOTA_RE.test(message)) {
-        return `${message} — OpenRouter's per-account limit on concurrent batch jobs is full. Broad-Side submits one job per lens, so a few runs in flight on this key (in any repository) fill it. Nothing was charged; collect or wait out the runs in flight, then re-submit.`;
-    }
-    return message;
-}
-export function collectResultText(result) {
-    const lines = [
-        `Broad-Side run ${result.runId}: ${result.status}`,
-        `  Results: ${result.resultCount} | Total cost: $${result.totalCost.toFixed(6)}`,
-    ];
-    for (const lensId of BROADSIDE_LENS_IDS) {
-        const outcome = result.lensOutcomes[lensId];
-        if (!outcome)
-            continue;
-        const truncation = outcome.truncated ? `, ${outcome.truncated} truncated` : "";
-        lines.push(`  ${lensId}: ${outcome.status}` +
-            (outcome.cost !== undefined ? `, $${outcome.cost.toFixed(6)}` : "") +
-            (outcome.resultCount !== undefined ? `, ${outcome.resultCount} result(s)` : "") +
-            truncation +
-            // The reason a lens did not complete, when the poll recorded one:
-            // an auth failure or a dead network used to read as a slow batch.
-            (outcome.error ? ` — ${outcome.error}` : ""));
-    }
-    if (result.retriedCount > 0) {
-        lines.push(`  ↻ ${result.retriedCount} truncated result(s) recovered by re-submission with a doubled output cap.`);
-    }
-    if (result.retryElsewhere) {
-        lines.push("  ↻ The truncation retry is in flight in another collect on this run; collect again for its result.");
-    }
-    if (result.truncatedCount > 0) {
-        lines.push(`  ⚠ ${result.truncatedCount} result(s) still truncated after retry — their modules are unscouted, not clean.`);
-    }
-    // A pass still in flight or retired must appear: a run reported
-    // "completed" with no synthesis line read as "no synthesis was run",
-    // when the batch was running and a later collect would have claimed it
-    // (0.22.1 live run — the collect's wait ran out during the pass).
-    const passInFlight = (kind, entry) => {
-        if (entry.status === "submitted") {
-            lines.push(`  ${kind}: ${entry.batchId ? "still running" : "in flight in another collect"} — collect again for its result.`);
-        }
-        else if (entry.status === "failed") {
-            lines.push(`  ${kind}: failed${entry.error ? ` — ${explainBatchError(entry.error)}` : ""}`);
-        }
-    };
-    // Whether a pass was built from a verify pass's verdicts is part of what
-    // it is: a work order that ranked on batch severities alone is the one
-    // that put two dismissed casts above the confirmed finding (#338).
-    const builtFrom = (entry) => entry.verdicts ? ` (built from ${entry.verdicts} verdict${entry.verdicts === 1 ? "" : "s"})` : " (no verdicts)";
-    if (result.regenerated && result.regenerated.length > 0) {
-        lines.push(`  regenerated: ${result.regenerated.join(", ")}`);
-    }
-    if (result.synthesis.status === "completed") {
-        lines.push(`  synthesis: completed, $${(result.synthesis.cost ?? 0).toFixed(6)}${builtFrom(result.synthesis)}`);
-        if (result.topFindings.length > 0) {
-            lines.push("", result.synthesis.verdicts ? "Top findings (verdicts applied; unread ones are unverified leads):" : "Top findings (unverified leads):");
-            for (const f of result.topFindings.slice(0, 10)) {
-                lines.push(`  [${f.severity}] ${f.title}`);
-            }
-        }
-    }
-    else {
-        passInFlight("synthesis", result.synthesis);
-    }
-    if (result.triage.status === "completed") {
-        lines.push(`  triage: completed, $${(result.triage.cost ?? 0).toFixed(6)}${builtFrom(result.triage)}`);
-        if (result.topTriageItems.length > 0) {
-            lines.push("", result.triage.verdicts
-                ? "Triage — prioritized work order (confirmed findings first; re-verify the unread ones before acting):"
-                : "Triage — prioritized work order (re-verify before acting):");
-            for (const item of result.topTriageItems.slice(0, 10)) {
-                lines.push(`  ${item.priority} [${item.severity}/${item.module}] ${item.title}` +
-                    (item.effort_estimate ? ` (${item.effort_estimate})` : ""));
-            }
-        }
-    }
-    else {
-        passInFlight("triage", result.triage);
-    }
-    if (result.status === "completed" && !result.synthesis.verdicts && !result.triage.verdicts
-        && (result.synthesis.status === "completed" || result.triage.status === "completed")) {
-        lines.push("", "Run verify, then collect --regenerate, to rebuild the report and the work order from verdicts.");
-    }
-    lines.push("", "Disclaimer: Broad-Side findings are unverified scouting signals from a batch model, not validated claims.");
-    return lines.join("\n");
-}
-/**
- * An `onStatus` callback that appends one line to `lines` per *change* of a
- * lens's polled status. Every poll used to append a line, so a four-minute
- * wait returned twenty-six identical "in_progress (0/1)" lines per lens
- * before the result (0.22.0 live run).
- */
-export function statusLineWriter(lines) {
-    const last = new Map();
-    return (lensId, status, counts) => {
-        const line = `  ${lensId}: ${status} (${counts.completed ?? 0}/${counts.total ?? "?"})`;
-        if (last.get(lensId) === line)
-            return;
-        last.set(lensId, line);
-        lines.push(line);
-    };
-}
-export function statusText(state) {
-    if (state.runs.length === 0) {
-        return "No Broad-Side runs recorded. Call codecarto_broadside with action 'submit' first.";
-    }
-    const lines = [];
-    for (const run of [...state.runs].reverse().slice(0, 3)) {
-        lines.push(`Run ${run.id} — ${run.status}`);
-        // Recorded since #248; a run from an older version has neither field.
-        if (run.language || run.snapshot) {
-            const head = run.sourceHead ? ` at ${run.sourceHead.slice(0, 8)}${run.sourceDirty ? " (dirty)" : ""}` : "";
-            const source = run.snapshot === "walk" ? "directory walk" : run.snapshot ? `working tree${head}` : "unknown source";
-            lines.push(`  scanned as ${run.language ?? "unknown"} from the ${source}`);
-        }
-        for (const lensId of BROADSIDE_LENS_IDS) {
-            const entry = run.batches[lensId];
-            if (!entry)
-                continue;
-            lines.push(`  ${lensId}: ${entry.status}${entry.batchId ? ` (${entry.batchId})` : ""}${entry.cost !== undefined ? `, $${entry.cost.toFixed(6)}` : ""}` +
-                (entry.status === "skipped" && entry.reason ? ` — ${entry.reason}` : entry.fallback ? ` — ${entry.fallback}` : ""));
-        }
-        const builtFrom = (entry) => entry?.status === "completed" ? (entry.verdicts ? ` (built from ${entry.verdicts} verdict${entry.verdicts === 1 ? "" : "s"})` : " (no verdicts)") : "";
-        lines.push(`  synthesis: ${run.synthesis.status}${builtFrom(run.synthesis)}`);
-        lines.push(`  triage: ${run.triage?.status ?? "pending"}${builtFrom(run.triage)}`);
-        if (run.verify) {
-            lines.push(`  verify: ${run.verify.status} — ${run.verify.confirmed} confirmed of ${run.verify.verified} read on ${run.verify.model}, $${run.verify.cost.toFixed(4)}`);
-        }
-        if (run.totalCost !== undefined)
-            lines.push(`  total cost: $${run.totalCost.toFixed(6)}`);
-    }
-    return lines.join("\n");
-}
+//
+// The implementation lives in core/broadside/ (#339), one module per concern,
+// with an acyclic import graph at runtime that points one way through these
+// layers (tests/module-graph.test.mjs pins it, #371):
+//   constants, types, schemas, repo
+//   → lenses, requests, results, state, client
+//   → models, verify
+//   → submit, render
+//   → collect
+// This file is the barrel; `core/index.ts` re-exports it, so both surfaces
+// and the tests import one module.
+export * from "./broadside/constants.js";
+export * from "./broadside/types.js";
+export * from "./broadside/schemas.js";
+export * from "./broadside/lenses.js";
+export * from "./broadside/repo.js";
+export * from "./broadside/requests.js";
+export * from "./broadside/state.js";
+export * from "./broadside/models.js";
+export * from "./broadside/client.js";
+export * from "./broadside/submit.js";
+export * from "./broadside/results.js";
+export * from "./broadside/verify.js";
+export * from "./broadside/collect.js";
+export * from "./broadside/render.js";