loki-mode 11.17.11 → 11.17.13

package/packages/control-plane/dist/server.js

@@ -7635,10 +7635,43 @@ var init_receipt_signer = () => {};
 // ../../loki-ts/src/engine10/registry.ts
 var init_registry = () => {};
 
+// ../../loki-ts/src/engine10/types.ts
+function pushArgv(a) {
+  switch (a.cmd) {
+    case "push-pr":
+      return ["push-pr", a.repoDir, a.branch, a.title, a.bodyFile, a.draft ? "1" : "0"];
+    case "comment":
+      return ["comment", a.runId, a.prUrl, a.file];
+    case "status":
+      return ["status", a.sha, a.state, a.description];
+    case "issue-comment":
+      return a.update ? ["issue-comment", "--update", a.issueRef, a.bodyFile] : ["issue-comment", a.issueRef, a.bodyFile];
+  }
+}
+function taskBlock(task) {
+  return ["Task (untrusted, quoted verbatim):", "<<<TASK", task, "TASK"];
+}
+var STAGE_BUDGETS;
+var init_types = __esm(() => {
+  STAGE_BUDGETS = {
+    intake: { targetS: 15, limitS: 60 },
+    plan: { targetS: 45, limitS: 90 },
+    wall: { targetS: 45, limitS: 90 },
+    implement: { targetS: 180, limitS: 480 },
+    verify: { targetS: 60, limitS: 120 },
+    fix: { targetS: 90, limitS: 180 },
+    commit: { targetS: 5, limitS: 30 },
+    seal: { targetS: 15, limitS: 60 },
+    pr: { targetS: 15, limitS: 60 },
+    deep: { targetS: null, limitS: 2700 }
+  };
+});
+
 // ../../loki-ts/src/engine10/output.ts
 var init_output = __esm(() => {
   init_registry();
   init_redact();
+  init_types();
 });
 
 // ../../loki-ts/src/util/atomic.ts
@@ -8123,38 +8156,6 @@ var init_budget = __esm(() => {
   PRICING = Object.freeze(_loadPricing());
 });
 
-// ../../loki-ts/src/engine10/types.ts
-function pushArgv(a) {
-  switch (a.cmd) {
-    case "push-pr":
-      return ["push-pr", a.repoDir, a.branch, a.title, a.bodyFile, a.draft ? "1" : "0"];
-    case "comment":
-      return ["comment", a.runId, a.prUrl, a.file];
-    case "status":
-      return ["status", a.sha, a.state, a.description];
-    case "issue-comment":
-      return a.update ? ["issue-comment", "--update", a.issueRef, a.bodyFile] : ["issue-comment", a.issueRef, a.bodyFile];
-  }
-}
-function taskBlock(task) {
-  return ["Task (untrusted, quoted verbatim):", "<<<TASK", task, "TASK"];
-}
-var STAGE_BUDGETS;
-var init_types = __esm(() => {
-  STAGE_BUDGETS = {
-    intake: { targetS: 15, limitS: 60 },
-    plan: { targetS: 45, limitS: 90 },
-    wall: { targetS: 45, limitS: 90 },
-    implement: { targetS: 180, limitS: 480 },
-    verify: { targetS: 60, limitS: 120 },
-    fix: { targetS: 90, limitS: 180 },
-    commit: { targetS: 5, limitS: 30 },
-    seal: { targetS: 15, limitS: 60 },
-    pr: { targetS: 15, limitS: 60 },
-    deep: { targetS: null, limitS: 2700 }
-  };
-});
-
 // ../../loki-ts/src/runner/router/decision.ts
 var init_decision = () => {};
 
@@ -8864,16 +8865,25 @@ var init_scope = __esm(() => {
   dropped = new WeakMap;
 });
 
-// ../../loki-ts/src/engine10/testmap.ts
-import { basename as basename9, extname, join as join37, relative, sep as sep10 } from "path";
+// ../../loki-ts/src/util/test_file_text.ts
+import { basename as basename9 } from "path";
 function isTestFile(rel) {
   const name = basename9(rel);
   return JS_TEST_RE.test(name) || PY_TEST_RE.test(name) || GO_TEST_RE.test(name);
 }
-var SKIP_DIRS, JS_TEST_RE, PY_TEST_RE, GO_TEST_RE;
+var JS_TEST_RE, PY_TEST_RE, GO_TEST_RE;
+var init_test_file_text = __esm(() => {
+  JS_TEST_RE = /\.(test|spec)\.[cm]?[jt]sx?$/;
+  PY_TEST_RE = /^(test_.+|.+_test)\.py$/;
+  GO_TEST_RE = /_test\.go$/;
+});
+
+// ../../loki-ts/src/engine10/testmap.ts
+var SKIP_DIRS;
 var init_testmap = __esm(() => {
   init_resolve();
   init_scope();
+  init_test_file_text();
   SKIP_DIRS = new Set([
     ".git",
     "node_modules",
@@ -8889,14 +8899,11 @@ var init_testmap = __esm(() => {
     ".loki",
     ".next"
   ]);
-  JS_TEST_RE = /\.(test|spec)\.[cm]?[jt]sx?$/;
-  PY_TEST_RE = /^(test_.+|.+_test)\.py$/;
-  GO_TEST_RE = /_test\.go$/;
 });
 
 // ../../loki-ts/src/util/check_result.ts
 import { mkdirSync as mkdirSync13, readFileSync as readFileSync28, renameSync as renameSync8, writeFileSync as writeFileSync16 } from "fs";
-import { basename as basename10, join as join38 } from "path";
+import { basename as basename10, join as join37 } from "path";
 function plainTestEnv(base = process.env) {
   const e = {};
   for (const [k, v] of Object.entries(tokenFreeEnv(base)))
@@ -9191,7 +9198,7 @@ function diffFiles(repoDir, baseSha) {
       return f;
     let n2 = 0;
     try {
-      n2 = readFileSync28(join38(repoDir, path), "utf8").split(`
+      n2 = readFileSync28(join37(repoDir, path), "utf8").split(`
 `).length;
     } catch {}
     return { path, added: n2, deleted: 0, status: "added" };
@@ -9199,7 +9206,7 @@ function diffFiles(repoDir, baseSha) {
 }
 function recordRisk(repoDir, a) {
   try {
-    const dir = join38(repoDir, ".loki", "state"), p = join38(dir, "risk-tier.json");
+    const dir = join37(repoDir, ".loki", "state"), p = join37(dir, "risk-tier.json");
     mkdirSync13(dir, { recursive: true });
     writeFileSync16(`${p}.tmp`, JSON.stringify(a, null, 2) + `
 `);
@@ -9259,7 +9266,7 @@ var init_state = __esm(() => {
 
 // ../../loki-ts/src/runner/repo_profile.ts
 import { existsSync as existsSync22, readFileSync as readFileSync29, mkdirSync as mkdirSync14, readdirSync as readdirSync13, renameSync as renameSync9, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "fs";
-import { basename as basename11, join as join39, resolve as resolve13, isAbsolute as isAbsolute2 } from "path";
+import { basename as basename11, join as join38, resolve as resolve13, isAbsolute as isAbsolute2 } from "path";
 function loadProfile(repoDir) {
   try {
     const p = JSON.parse(readFileSync29(commandProfilePath(repoDir), "utf8"));
@@ -9293,7 +9300,7 @@ function attributeFullSuite(repoDir, baseSha, full, blocked, changed) {
   const block = new Set(blocked);
   return attribute(repoDir, baseSha, bad.map((c) => ({ name: c.name, ...c.ids ? { ids: c.ids } : {}, eligible: (c.ids ?? []).every((i) => !block.has(i) && !changed.some((f) => i.includes(f))) })));
 }
-var commandProfilePath = (repoDir) => join39(repoDir, ".loki", "state", "repo-profile.json");
+var commandProfilePath = (repoDir) => join38(repoDir, ".loki", "state", "repo-profile.json");
 var init_repo_profile = __esm(() => {
   init_failures();
   init_check_result();
@@ -9329,12 +9336,12 @@ var init_context = __esm(() => {
 // ../../loki-ts/src/util/steer.ts
 import { appendFileSync as appendFileSync2, closeSync as closeSync8, constants as constants2, fstatSync as fstatSync6, readdirSync as readdirSync14, lstatSync as lstatSync9, mkdirSync as mkdirSync15, linkSync as linkSync2, openSync as openSync8, readFileSync as readFileSync30, readSync as readSync7, renameSync as renameSync10, statSync as statSync15, lutimesSync, rmSync as rmSync9, unlinkSync as unlinkSync5, writeFileSync as writeFileSync18, existsSync as existsSync23 } from "fs";
 import { createHash as createHash9, randomBytes as randomBytes4 } from "crypto";
-import { basename as basename12, join as join40 } from "path";
+import { basename as basename12, join as join39 } from "path";
 function archiveTo(logs, prefix, src, link = linkSync2, onLinked) {
   for (let i = 0;; i++) {
     const name = i === 0 ? `${prefix}.md` : `${prefix}-${i}.md`;
     try {
-      link(src, join40(logs, name));
+      link(src, join39(logs, name));
     } catch (e) {
       const code = e.code;
       if (code === "EEXIST")
@@ -9342,7 +9349,7 @@ function archiveTo(logs, prefix, src, link = linkSync2, onLinked) {
       if (code !== "EPERM" && code !== "ENOTSUP" && code !== "EXDEV" && code !== "EMLINK")
         throw e;
       const name2 = `${prefix}-${randomBytes4(4).toString("hex")}.md`;
-      renameSync10(src, join40(logs, name2));
+      renameSync10(src, join39(logs, name2));
       onLinked?.(name2);
       return name2;
     }
@@ -9361,7 +9368,7 @@ function orphanAlreadyArchived(logs, claim) {
     if (!/^human-input-.*\.md$/.test(a))
       continue;
     try {
-      const s = statSync15(join40(logs, a));
+      const s = statSync15(join39(logs, a));
       if (s.ino !== c.ino || s.dev !== c.dev)
         continue;
       if (/^human-input-(ORPHAN|REJECTED)-/.test(a) || existsSync23(appliedMarker(logs, a)))
@@ -9381,7 +9388,7 @@ function sweepOrphans(logs, stamp2, unapplied, link, nowMs = Date.now()) {
   for (const n2 of names)
     if (n2.startsWith(".applied-") && !present.has(n2.slice(".applied-".length))) {
       try {
-        unlinkSync5(join40(logs, n2));
+        unlinkSync5(join39(logs, n2));
       } catch {}
     }
   for (const n2 of names) {
@@ -9398,7 +9405,7 @@ function sweepOrphans(logs, stamp2, unapplied, link, nowMs = Date.now()) {
     if (alive) {
       let ageMs = 0;
       try {
-        ageMs = nowMs - statSync15(join40(logs, n2)).mtimeMs;
+        ageMs = nowMs - statSync15(join39(logs, n2)).mtimeMs;
       } catch {
         continue;
       }
@@ -9406,11 +9413,11 @@ function sweepOrphans(logs, stamp2, unapplied, link, nowMs = Date.now()) {
         continue;
     }
     try {
-      if (orphanAlreadyArchived(logs, join40(logs, n2))) {
-        unlinkSync5(join40(logs, n2));
+      if (orphanAlreadyArchived(logs, join39(logs, n2))) {
+        unlinkSync5(join39(logs, n2));
         continue;
       }
-      archiveTo(logs, `human-input-ORPHAN-${stamp2}`, join40(logs, n2), link);
+      archiveTo(logs, `human-input-ORPHAN-${stamp2}`, join39(logs, n2), link);
       unapplied("orphaned claim");
     } catch (e) {
       if (e.code === "ENOENT")
@@ -9422,17 +9429,17 @@ function sweepOrphans(logs, stamp2, unapplied, link, nowMs = Date.now()) {
 function consumeSteer(repoDir, env = process.env, now2 = () => new Date, sink, hooks2) {
   if (/^(0|false)$/i.test(env.LOKI_PROMPT_INJECTION ?? ""))
     return null;
-  const f = join40(repoDir, ".loki", "HUMAN_INPUT.md");
+  const f = join39(repoDir, ".loki", "HUMAN_INPUT.md");
   const unapplied = (reason) => {
     sink?.push({ rev: 0, source: null, actor: null, sha: "", at: now2().getTime(), unapplied: true, reason });
   };
   let fd = -1, claimed = "";
   try {
-    const logs = join40(repoDir, ".loki", "logs");
+    const logs = join39(repoDir, ".loki", "logs");
     mkdirSync15(logs, { recursive: true });
     const stamp2 = now2().toISOString().replace(/[-:]/g, "").replace(/\..*/, "");
     sweepOrphans(logs, stamp2, unapplied, hooks2?.link, now2().getTime());
-    claimed = join40(logs, `.claim-${process.pid}-${randomBytes4(6).toString("hex")}`);
+    claimed = join39(logs, `.claim-${process.pid}-${randomBytes4(6).toString("hex")}`);
     try {
       renameSync10(f, claimed);
     } catch (e) {
@@ -9523,7 +9530,7 @@ function consumeSteer(repoDir, env = process.env, now2 = () => new Date, sink, h
   } catch {
     if (claimed) {
       try {
-        archiveTo(join40(repoDir, ".loki", "logs"), `human-input-${now2().toISOString().replace(/[-:]/g, "").replace(/\..*/, "")}`, claimed, hooks2?.link);
+        archiveTo(join39(repoDir, ".loki", "logs"), `human-input-${now2().toISOString().replace(/[-:]/g, "").replace(/\..*/, "")}`, claimed, hooks2?.link);
         unapplied("logs dir unwritable or file unreadable");
       } catch {
         unapplied(`steer stranded at .loki/logs/${basename12(claimed)}`);
@@ -9542,7 +9549,7 @@ function consumeSteer(repoDir, env = process.env, now2 = () => new Date, sink, h
   }
 }
 function recordRevisions(repoDir, text2, archived, at) {
-  const file = join40(repoDir, ".loki", "intent-revisions.jsonl");
+  const file = join39(repoDir, ".loki", "intent-revisions.jsonl");
   let last = 0;
   try {
     for (const l of readFileSync30(file, "utf8").split(`
@@ -9599,7 +9606,7 @@ function staleAtSeal(repoDir, ctx) {
   const frozen = ctx.outputs === undefined || ctx.outputs().wall !== undefined || ctx.wallSealed === true;
   return [...new Set([...staleWallRevisions(ctx.intentRevisions, frozen ? ctx.timeline : []), ...late])];
 }
-var STEER_MAX_BYTES, STEER_STAGES, STEER_CLAIM_MAX_AGE_MS, appliedMarker = (logs, archive) => join40(logs, `.applied-${archive}`), REV_HDR, STEER_REMEDY;
+var STEER_MAX_BYTES, STEER_STAGES, STEER_CLAIM_MAX_AGE_MS, appliedMarker = (logs, archive) => join39(logs, `.applied-${archive}`), REV_HDR, STEER_REMEDY;
 var init_steer = __esm(() => {
   init_context();
   STEER_MAX_BYTES = 1024 * 1024;
@@ -9662,18 +9669,18 @@ var init_seal_drift = __esm(() => {
 });
 
 // ../../loki-ts/src/util/spec_file.ts
-import { isAbsolute as isAbsolute3, join as join41, relative as relative2 } from "path";
+import { isAbsolute as isAbsolute3, join as join40, relative } from "path";
 function specReceiptBlock(env) {
   const { LOKI_E10_SPEC_PATH: p, LOKI_E10_SPEC_SHA256: sha2 } = env;
   if (!p || !sha2)
     return {};
-  const rel = isAbsolute3(p) && env.LOKI_E10_REPO_DIR ? relative2(env.LOKI_E10_REPO_DIR, p) : p;
+  const rel = isAbsolute3(p) && env.LOKI_E10_REPO_DIR ? relative(env.LOKI_E10_REPO_DIR, p) : p;
   return { spec: { path: rel, sha256: sha2 } };
 }
 var SPEC_DIR;
 var init_spec_file = __esm(() => {
   init_types();
-  SPEC_DIR = join41(".loki", "specs");
+  SPEC_DIR = join40(".loki", "specs");
 });
 
 // ../../loki-ts/src/engine10/pr_body.ts
@@ -9695,9 +9702,9 @@ var init_run_cap = __esm(() => {
 // ../../loki-ts/src/util/mutation_proof.ts
 import { existsSync as existsSync24, mkdirSync as mkdirSync16, mkdtempSync as mkdtempSync3, readFileSync as readFileSync31, rmSync as rmSync10, symlinkSync, writeFileSync as writeFileSync19 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { basename as basename13, dirname as dirname13, isAbsolute as isAbsolute4, join as join42, relative as relative3 } from "path";
+import { basename as basename13, dirname as dirname13, isAbsolute as isAbsolute4, join as join41, relative as relative2 } from "path";
 function mutationProof(i) {
-  const rels = i.wallFiles.map((f) => isAbsolute4(f.path) ? relative3(i.repoDir, f.path) : f.path);
+  const rels = i.wallFiles.map((f) => isAbsolute4(f.path) ? relative2(i.repoDir, f.path) : f.path);
   if (rels.length === 0)
     return np("no Wall tests");
   const tests = rels.flatMap((rel) => {
@@ -9713,25 +9720,25 @@ function mutationProof(i) {
   const deadline = Date.now() + budgetS * 1000, remaining = () => deadline - Date.now();
   let parent = null, wt = null, added = false;
   try {
-    parent = mkdtempSync3(join42(tmpdir4(), "loki-mutproof-"));
-    wt = join42(parent, "wt");
+    parent = mkdtempSync3(join41(tmpdir4(), "loki-mutproof-"));
+    wt = join41(parent, "wt");
     const add3 = git(i.repoDir, ["worktree", "add", "--detach", wt, i.baseSha], Math.max(1000, Math.min(30000, remaining())));
     added = existsSync24(wt) || add3.status === 0;
     if (add3.status !== 0)
       return np("could not create the base worktree");
     for (const rel of rels) {
-      const sealed = join42(i.runDir, "wall", basename13(rel)), src = existsSync24(sealed) ? sealed : join42(i.repoDir, rel);
+      const sealed = join41(i.runDir, "wall", basename13(rel)), src = existsSync24(sealed) ? sealed : join41(i.repoDir, rel);
       if (!existsSync24(src))
         return np(`Wall file missing: ${rel}`);
-      mkdirSync16(dirname13(join42(wt, rel)), { recursive: true });
-      writeFileSync19(join42(wt, rel), readFileSync31(src));
+      mkdirSync16(dirname13(join41(wt, rel)), { recursive: true });
+      writeFileSync19(join41(wt, rel), readFileSync31(src));
     }
     for (const rel of rels) {
       const parts = rel.split("/").slice(0, -1);
       for (let n2 = 0;n2 <= parts.length; n2++) {
         const anc = parts.slice(0, n2).join("/");
         for (const d of DEP_DIRS) {
-          const src = join42(i.repoDir, anc, d), dst = join42(wt, anc, d);
+          const src = join41(i.repoDir, anc, d), dst = join41(wt, anc, d);
           if (existsSync24(src) && !existsSync24(dst)) {
             try {
               symlinkSync(src, dst);
@@ -11028,7 +11035,7 @@ Example: test('name', () => { assert.strictEqual(fn(1), 2); });  Run: node --tes
 import { createHash as createHash12 } from "crypto";
 import { appendFileSync as appendFileSync3, copyFileSync as copyFileSync2, existsSync as existsSync26, mkdirSync as mkdirSync17, readFileSync as readFileSync33, rmSync as rmSync12, writeFileSync as writeFileSync20 } from "fs";
 import { tmpdir as tmpdir6 } from "os";
-import { basename as basename15, join as join43, relative as relative4 } from "path";
+import { basename as basename15, join as join42, relative as relative3 } from "path";
 function wallHoldoutRatio(env = process.env) {
   if (env["LOKI_WALL_HOLDOUT"]?.trim() === "0")
     return 0;
@@ -11056,32 +11063,32 @@ function stashHoldout(o) {
   rmSync12(dir, { recursive: true, force: true });
   mkdirSync17(dir, { recursive: true, mode: 448 });
   const files = held.map((name) => {
-    copyFileSync2(join43(o.srcDir, name), join43(dir, name));
-    rmSync12(join43(o.srcDir, name), { force: true });
-    return { name, runner: o.runnerOf(name), sha256: sha2(readFileSync33(join43(dir, name), "utf8")) };
+    copyFileSync2(join42(o.srcDir, name), join42(dir, name));
+    rmSync12(join42(o.srcDir, name), { force: true });
+    return { name, runner: o.runnerOf(name), sha256: sha2(readFileSync33(join42(dir, name), "utf8")) };
   });
-  writeFileSync20(join43(dir, MANIFEST), JSON.stringify({ targetDir: o.targetDir, files }));
+  writeFileSync20(join42(dir, MANIFEST), JSON.stringify({ targetDir: o.targetDir, files }));
   return { dir, names: new Set(held) };
 }
 function stageHoldout(dir, repoDir) {
   const put = [], tests = [], missing = [];
   let man = null;
   try {
-    man = JSON.parse(readFileSync33(join43(dir, MANIFEST), "utf8"));
+    man = JSON.parse(readFileSync33(join42(dir, MANIFEST), "utf8"));
   } catch {}
   if (!man)
     return { tests, missing: [`holdout store unreadable: ${basename15(dir)}`], cleanup: () => {} };
   mkdirSync17(man.targetDir, { recursive: true });
   man.files.forEach((f, i) => {
-    const src = join43(dir, f.name);
+    const src = join42(dir, f.name);
     if (!existsSync26(src) || sha2(readFileSync33(src, "utf8")) !== f.sha256) {
       missing.push(`holdout ${i + 1} missing or altered`);
       return;
     }
-    const dest = join43(man.targetDir, `loki_wall_holdout_${i + 1}${f.name.slice(f.name.indexOf("."))}`);
+    const dest = join42(man.targetDir, `loki_wall_holdout_${i + 1}${f.name.slice(f.name.indexOf("."))}`);
     copyFileSync2(src, dest);
     put.push(dest);
-    tests.push({ runner: f.runner, path: relative4(repoDir, dest) });
+    tests.push({ runner: f.runner, path: relative3(repoDir, dest) });
   });
   return { tests, missing, cleanup: () => {
     for (const p of put)
@@ -11091,16 +11098,16 @@ function stageHoldout(dir, repoDir) {
 function recordHoldoutTriage(runDir, entry) {
   try {
     mkdirSync17(runDir, { recursive: true });
-    appendFileSync3(join43(runDir, HOLDOUT_TRIAGE_FILE), JSON.stringify(entry) + `
+    appendFileSync3(join42(runDir, HOLDOUT_TRIAGE_FILE), JSON.stringify(entry) + `
 `, { mode: 384 });
   } catch {}
 }
-var sha2 = (s) => createHash12("sha256").update(s).digest("hex"), WALL_HOLDOUT_DEFAULT_RATIO = 0.2, isHoldoutCheck = (name) => name.startsWith("holdout:"), holdoutDirFor = (runId, repoDir) => join43(tmpdir6(), `loki-e10-holdout-${sha2(`${runId}:${repoDir}`).slice(0, 16)}`), MANIFEST = "manifest.json", WALL_HOLDOUT_MIN = 5, HOLDOUT_TRIAGE_FILE = "holdout-triage.jsonl";
+var sha2 = (s) => createHash12("sha256").update(s).digest("hex"), WALL_HOLDOUT_DEFAULT_RATIO = 0.2, isHoldoutCheck = (name) => name.startsWith("holdout:"), holdoutDirFor = (runId, repoDir) => join42(tmpdir6(), `loki-e10-holdout-${sha2(`${runId}:${repoDir}`).slice(0, 16)}`), MANIFEST = "manifest.json", WALL_HOLDOUT_MIN = 5, HOLDOUT_TRIAGE_FILE = "holdout-triage.jsonl";
 var init_holdout = () => {};
 
 // ../../loki-ts/src/features/runner_config.ts
 import { readFileSync as readFileSync34 } from "fs";
-import { dirname as dirname15, join as join44, normalize as normalize2 } from "path";
+import { dirname as dirname15, join as join43, normalize as normalize2 } from "path";
 function tomlKey2(s, i = 0, eq2 = true) {
   const parts = [], ws = () => {
     while (/\s/.test(s[i] ?? "x"))
@@ -11377,8 +11384,8 @@ function referenced(cfg, text2) {
     }
   const dir = dirname15(cfg), explicit = ROOT_DIR.exec(text2), roots = [dir];
   if (explicit)
-    roots.push("", ...explicit[1] ? [join44(dir, explicit[1])] : []);
-  return [...raw2.flatMap((r) => r.startsWith("/") ? [normalize2(r.slice(1))] : roots.map((root) => normalize2(join44(root, r.replace(/^<rootDir>\/?/, ""))))), ...patchedTargets(cfg, text2).map((t) => normalize2(join44(dir, t)))];
+    roots.push("", ...explicit[1] ? [join43(dir, explicit[1])] : []);
+  return [...raw2.flatMap((r) => r.startsWith("/") ? [normalize2(r.slice(1))] : roots.map((root) => normalize2(join43(root, r.replace(/^<rootDir>\/?/, ""))))), ...patchedTargets(cfg, text2).map((t) => normalize2(join43(dir, t)))];
 }
 function runnerConfigNotes(repoDir, baseSha, head, changed, signal) {
   const notes = new Set, ch = new Set(changed.map((c) => normalize2(c)));
@@ -11458,7 +11465,7 @@ var PKG_KEYS, RAW_CONFIGS, RUNNER_CONFIGS, DEP_MAPS, RUNNER_DEP, LOCAL_SPEC, dep
   }
 }, headText = (dir, f) => {
   try {
-    return readFileSync34(join44(dir, f), "utf8");
+    return readFileSync34(join43(dir, f), "utf8");
   } catch {
     return "";
   }
@@ -11500,7 +11507,7 @@ var init_runner_config = __esm(() => {
 import { execFileSync as execFileSync3 } from "child_process";
 import { mkdtempSync as mkdtempSync5, readFileSync as readFileSync35, rmSync as rmSync13 } from "fs";
 import { tmpdir as tmpdir7 } from "os";
-import { join as join45 } from "path";
+import { join as join44 } from "path";
 import { basename as basename16 } from "path";
 function classifyAssertDelta(inp) {
   const f = basename16(inp.path);
@@ -11510,7 +11517,7 @@ function classifyAssertDelta(inp) {
     return WEAKENED;
   let cwd = "";
   try {
-    cwd = mkdtempSync5(join45(tmpdir7(), "loki-ad-"));
+    cwd = mkdtempSync5(join44(tmpdir7(), "loki-ad-"));
     const raw2 = execFileSync3("python3", ["-I", "-c", PY], {
       input: JSON.stringify({ path: inp.path, base: inp.base, head: inp.head, task: inp.task }),
       cwd,
@@ -11541,7 +11548,7 @@ function assertDeltaNotes(repoDir, baseSha, headRef, path, task, baseCounts, hea
     return null;
   try {
     const show = (ref) => safeGit(repoDir, ["show", `${ref}:${path}`]);
-    const head = headRef ? show(headRef) : readFileSync35(join45(repoDir, path), "utf8");
+    const head = headRef ? show(headRef) : readFileSync35(join44(repoDir, path), "utf8");
     const r = classifyTestEdit(path, show(baseSha), head, task, baseCounts, headCounts);
     return r[0]?.kind === "literal-only" ? r.map((e) => `assertion value changed (not shown to be required by the task): ${e.file}:${e.line} ${e.old} -> ${e.new}`) : null;
   } catch {
@@ -11750,17 +11757,17 @@ var init_runner_errors = __esm(() => {
 import { spawnSync as spawnSync3 } from "child_process";
 import { mkdtempSync as mkdtempSync6, realpathSync as realpathSync17, rmSync as rmSync14 } from "fs";
 import { tmpdir as tmpdir8 } from "os";
-import { basename as basename17, extname as extname2, join as join46 } from "path";
+import { basename as basename17, extname, join as join45 } from "path";
 function changedFilesNamed(out2, repoDir, changed) {
   return changed.filter((f) => {
-    if (out2.includes(f) || out2.includes(join46(repoDir, f)))
+    if (out2.includes(f) || out2.includes(join45(repoDir, f)))
       return true;
     const segs = f.split("/");
     if (suffixes(segs, 2).some((x) => x !== f && bounded(out2, x, "(?![\\w-])")))
       return true;
-    if (extname2(f) === ".go" && segs.length > 1 && suffixes(segs.slice(0, -1), 1).some((d) => new RegExp(`(?<=[\\w-])/${esc(d)}(?![\\w./-])`).test(out2)))
+    if (extname(f) === ".go" && segs.length > 1 && suffixes(segs.slice(0, -1), 1).some((d) => new RegExp(`(?<=[\\w-])/${esc(d)}(?![\\w./-])`).test(out2)))
       return true;
-    const stem = basename17(f, extname2(f));
+    const stem = basename17(f, extname(f));
     if (stem.length < 2 || stem === "index" || stem === "__init__")
       return false;
     return new RegExp(`(?<![\\w-])${esc(stem)}(?![\\w-])`).test(out2);
@@ -11864,7 +11871,7 @@ async function loadErrorIsHarnessOwned(i) {
     return false;
   if (i.args.some((a) => changed.includes(a.replace(/^\.\//, ""))))
     return false;
-  const dir = mkdtempSync6(join46(tmpdir8(), "e10-loadown-"));
+  const dir = mkdtempSync6(join45(tmpdir8(), "e10-loadown-"));
   const git3 = (args) => {
     safeGit(i.repoDir, args, { stdio: "ignore" });
   };
@@ -11896,7 +11903,7 @@ var init_load_owner = __esm(() => {
 });
 
 // ../../loki-ts/src/util/wall_owned.ts
-import { isAbsolute as isAbsolute5, join as join47, relative as relative5 } from "path";
+import { isAbsolute as isAbsolute5, join as join46, relative as relative4 } from "path";
 function failingLocations(raw2, cwd, repoDir) {
   const out2 = raw2.replace(ANSI2, "").replace(/\r\n?/g, `
 `), files = new Set;
@@ -11928,7 +11935,7 @@ function failingLocations(raw2, cwd, repoDir) {
   }
   if (errors2 === 0 || located !== errors2)
     return null;
-  return [...files].map((f) => relative5(repoDir, isAbsolute5(f) ? f : join47(cwd, f)));
+  return [...files].map((f) => relative4(repoDir, isAbsolute5(f) ? f : join46(cwd, f)));
 }
 function wallOwnedFailure(raw2, cwd, repoDir, wall) {
   const locs = failingLocations(raw2, cwd, repoDir);
@@ -11949,7 +11956,7 @@ import {
   writeFileSync as writeFileSync21,
   mkdirSync as mkdirSync18
 } from "fs";
-import { basename as basename18, dirname as dirname16, join as join48, resolve as resolve14 } from "path";
+import { basename as basename18, dirname as dirname16, join as join47, resolve as resolve14 } from "path";
 function readManifest(path) {
   if (!existsSync27(path)) {
     return null;
@@ -12008,7 +12015,7 @@ function resolveMembers(rootDir, declared, selfBasename) {
     for (const child of children) {
       if (!matchPattern(name, child))
         continue;
-      const full = join48(rootDir, child);
+      const full = join47(rootDir, child);
       if (seen.has(full))
         continue;
       let st;
@@ -12025,7 +12032,7 @@ function resolveMembers(rootDir, declared, selfBasename) {
   }
   if (declared.length === 0) {
     for (const child of children) {
-      const full = join48(rootDir, child);
+      const full = join47(rootDir, child);
       if (seen.has(full))
         continue;
       let st;
@@ -12036,7 +12043,7 @@ function resolveMembers(rootDir, declared, selfBasename) {
       }
       if (!st.isDirectory())
         continue;
-      if (!existsSync27(join48(full, ".loki", "app.json")))
+      if (!existsSync27(join47(full, ".loki", "app.json")))
         continue;
       seen.add(full);
       out2.push(full);
@@ -12057,17 +12064,17 @@ function cacheKey(manifestPaths) {
 }
 function writeCache(targetDir, key, result) {
   try {
-    const cacheDir = join48(targetDir, ".loki", "state");
+    const cacheDir = join47(targetDir, ".loki", "state");
     mkdirSync18(cacheDir, { recursive: true });
-    const cachePath = join48(cacheDir, "project-graph.json");
+    const cachePath = join47(cacheDir, "project-graph.json");
     writeFileSync21(cachePath, JSON.stringify({ key, result }, null, 2), "utf8");
   } catch {}
 }
 function discoverProjectGraph(targetDir) {
   const absTarget = resolve14(targetDir);
-  const targetManifest = join48(absTarget, ".loki", "app.json");
+  const targetManifest = join47(absTarget, ".loki", "app.json");
   const parentDir = dirname16(absTarget);
-  const parentManifest = join48(parentDir, ".loki", "app.json");
+  const parentManifest = join47(parentDir, ".loki", "app.json");
   const examined = [];
   let chosenManifest = null;
   let chosenRoot = "";
@@ -12087,7 +12094,7 @@ function discoverProjectGraph(targetDir) {
   const members = resolveMembers(chosenRoot, declared, basename18(absTarget));
   const filtered = [];
   for (const m of members) {
-    const sibManifestPath = join48(m, ".loki", "app.json");
+    const sibManifestPath = join47(m, ".loki", "app.json");
     if (existsSync27(sibManifestPath)) {
       examined.push(sibManifestPath);
       const sibManifest = readManifest(sibManifestPath);
@@ -12218,7 +12225,7 @@ import { spawn as spawn7 } from "child_process";
 import { createHash as createHash14, randomBytes as randomBytes5 } from "crypto";
 import { existsSync as existsSync28, lstatSync as lstatSync10, mkdirSync as mkdirSync19, readdirSync as readdirSync16, readFileSync as readFileSync37, writeFileSync as writeFileSync22 } from "fs";
 import { createServer } from "net";
-import { dirname as dirname17, isAbsolute as isAbsolute6, join as join49, normalize as normalize3, relative as relative6, sep as sep11 } from "path";
+import { dirname as dirname17, isAbsolute as isAbsolute6, join as join48, normalize as normalize3, relative as relative5, sep as sep10 } from "path";
 function routeFor(file) {
   let r = file.replace(/^(?:.*?\/)?(?:app|pages|src|public)\//, "").replace(/^(?:routes|pages)\//, "");
   r = r.replace(/\.(?:html|jsx|tsx|vue|svelte)$/, "").replace(/\/?(?:page|index|\+page)$/, "");
@@ -12228,7 +12235,7 @@ function hashScreens(runDir, rels) {
   const out2 = [];
   for (const rel of rels) {
     try {
-      out2.push({ path: rel, sha256: sha256File(join49(runDir, rel)) });
+      out2.push({ path: rel, sha256: sha256File(join48(runDir, rel)) });
     } catch {}
   }
   return out2;
@@ -12241,10 +12248,10 @@ function checkScreens(runDir, screens) {
       return "evidence_screens entry is malformed";
     if (isAbsolute6(s.path) || normalize3(s.path).startsWith(".."))
       return `evidence screenshot path escapes the evidence dir: ${s.path}`;
-    const file = join49(runDir, s.path);
+    const file = join48(runDir, s.path);
     let cur = runDir;
-    for (const seg of normalize3(s.path).split(sep11)) {
-      cur = join49(cur, seg);
+    for (const seg of normalize3(s.path).split(sep10)) {
+      cur = join48(cur, seg);
       if (isSymlink(cur))
         return `evidence screenshot path is a symlink: ${s.path}`;
     }
@@ -12291,7 +12298,7 @@ async function waitUp(url, ms, signal) {
 }
 function openapiPaths(repoDir) {
   for (const f of ["openapi.json", "openapi.yaml", "openapi.yml", "swagger.json"]) {
-    const p = join49(repoDir, f);
+    const p = join48(repoDir, f);
     if (!existsSync28(p))
       continue;
     try {
@@ -12309,24 +12316,24 @@ async function recordE2eMedia(repoDir, runDir, relDir, base, routes, ms, signal)
   if (!pw || !pkg)
     return { rels: [], skipped: "playwright e2e video and trace skipped: @playwright/test is not installed in the repo" };
   try {
-    const dir = join49(runDir, relDir, "e2e");
+    const dir = join48(runDir, relDir, "e2e");
     mkdirSync19(dir, { recursive: true });
-    writeFileSync22(join49(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
-    writeFileSync22(join49(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
+    writeFileSync22(join48(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
+    writeFileSync22(join48(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
 `);
-    if (!await shoot(pw, ["test", "--config", join49(dir, "playwright.config.cjs")], repoDir, ms, signal))
+    if (!await shoot(pw, ["test", "--config", join48(dir, "playwright.config.cjs")], repoDir, ms, signal))
       return { rels: [], skipped: "playwright e2e video and trace skipped: the run failed or timed out" };
     const rels = [];
     const walk = (d) => {
       for (const e of readdirSync16(d, { withFileTypes: true })) {
-        const full = join49(d, e.name);
+        const full = join48(d, e.name);
         if (e.isDirectory())
           walk(full);
         else if (e.isFile() && /\.(webm|zip)$/.test(e.name))
-          rels.push(join49(relDir, "e2e", relative6(dir, full)));
+          rels.push(join48(relDir, "e2e", relative5(dir, full)));
       }
     };
-    walk(join49(dir, "out"));
+    walk(join48(dir, "out"));
     return rels.length > 0 ? { rels, skipped: null } : { rels, skipped: "playwright e2e video and trace skipped: no video or trace was produced" };
   } catch (e) {
     return { rels: [], skipped: `playwright e2e video and trace skipped: ${String(e?.message ?? e).slice(0, 120)}` };
@@ -12405,15 +12412,15 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     if (!visualEvidenceEnabled(opts.env))
       return skip("LOKI_VISUAL_EVIDENCE is 0");
     const api = loadProjectApi(repoDir), boot = isMultiRoot(api) ? api.uiBoot() : null;
-    const appDir = boot ? join49(repoDir, boot.boot.cwd) : repoDir;
-    const pkgPath = join49(appDir, "package.json");
+    const appDir = boot ? join48(repoDir, boot.boot.cwd) : repoDir;
+    const pkgPath = join48(appDir, "package.json");
     let script = null;
     if (!boot) {
       if (!existsSync28(pkgPath)) {
-        const subs = ["backend", "frontend"].filter((d) => existsSync28(join49(repoDir, d, "package.json")));
+        const subs = ["backend", "frontend"].filter((d) => existsSync28(join48(repoDir, d, "package.json")));
         const has = (d) => {
           try {
-            return pickScript(JSON.parse(readFileSync37(join49(repoDir, d, "package.json"), "utf8"))) !== null;
+            return pickScript(JSON.parse(readFileSync37(join48(repoDir, d, "package.json"), "utf8"))) !== null;
           } catch {
             return false;
           }
@@ -12447,20 +12454,20 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     }
     if (!await waitUp(base, left(), signal))
       return skip(aborted() ? "aborted" : `${script} server did not answer within ${Math.round(budget / 1000)}s`);
-    const evRoot = join49(runDir, "evidence");
+    const evRoot = join48(runDir, "evidence");
     if (isSymlink(evRoot))
       return skip("evidence dir is a symlink");
     mkdirSync19(evRoot, { recursive: true });
     if (pages.length > 0) {
-      const rel0 = join49("evidence", randomBytes5(6).toString("hex"));
-      mkdirSync19(join49(runDir, rel0));
+      const rel0 = join48("evidence", randomBytes5(6).toString("hex"));
+      mkdirSync19(join48(runDir, rel0));
       const rels = [];
       for (const route of [...new Set(pages.map(routeFor))].slice(0, opts.maxRoutes ?? MAX_ROUTES)) {
         if (aborted() || left() <= 0)
           break;
-        const rel = join49(rel0, `${screenName(route)}.png`);
-        const ok = await shoot(pw, ["screenshot", `${base}${route}`, join49(runDir, rel)], appDir, left(), signal);
-        if (ok && !aborted() && !isSymlink(join49(runDir, rel)) && existsSync28(join49(runDir, rel)))
+        const rel = join48(rel0, `${screenName(route)}.png`);
+        const ok = await shoot(pw, ["screenshot", `${base}${route}`, join48(runDir, rel)], appDir, left(), signal);
+        if (ok && !aborted() && !isSymlink(join48(runDir, rel)) && existsSync28(join48(runDir, rel)))
           rels.push(rel);
       }
       if (aborted())
@@ -12485,9 +12492,9 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     }
     if (aborted())
       return skip("aborted");
-    const hdir = join49(evRoot, randomBytes5(6).toString("hex"));
+    const hdir = join48(evRoot, randomBytes5(6).toString("hex"));
     mkdirSync19(hdir);
-    writeFileSync22(join49(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
+    writeFileSync22(join48(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
 `);
     return { screens: [], http: true, skipped: null };
   } catch (e) {
@@ -12517,11 +12524,11 @@ function receiptScreensProblem(receiptPath, receipt) {
   return receipt["evidence_screens"] === undefined ? null : checkScreens(dirname17(receiptPath), receipt["evidence_screens"]);
 }
 var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash14("sha256").update(readFileSync37(p)).digest("hex"), playwrightBin = (repoDir) => {
-  const bin = join49(repoDir, "node_modules", ".bin", "playwright");
+  const bin = join48(repoDir, "node_modules", ".bin", "playwright");
   return existsSync28(bin) ? bin : null;
 }, playwrightTestPkg = (repoDir) => {
-  const d = join49(repoDir, "node_modules", "@playwright", "test");
-  return existsSync28(join49(d, "package.json")) ? d : null;
+  const d = join48(repoDir, "node_modules", "@playwright", "test");
+  return existsSync28(join48(d, "package.json")) ? d : null;
 }, e2eSpecSource = (pkgDir, base, routes) => `const { test } = require(${JSON.stringify(pkgDir)});
 test("loki e2e walkthrough", async ({ page }) => {
   for (const r of ${JSON.stringify(routes)}) { await page.goto(${JSON.stringify(base)} + r); await page.waitForLoadState("load"); }
@@ -12564,7 +12571,7 @@ var init_outbox = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/pr.ts
-import { join as join50 } from "path";
+import { join as join49 } from "path";
 var DEFAULT_PUSH_SH;
 var init_pr = __esm(() => {
   init_types();
@@ -12581,12 +12588,12 @@ var init_pr = __esm(() => {
   init_run_outputs();
   init_yaml_key();
   init_outbox();
-  DEFAULT_PUSH_SH = join50(REPO_ROOT, "autonomy/lib/engine10-push.sh");
+  DEFAULT_PUSH_SH = join49(REPO_ROOT, "autonomy/lib/engine10-push.sh");
 });
 
 // ../../loki-ts/src/util/pr_lessons.ts
 import { existsSync as existsSync29, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync7, readFileSync as readFileSync38, rmSync as rmSync15, writeFileSync as writeFileSync23 } from "fs";
-import { dirname as dirname18, join as join51 } from "path";
+import { dirname as dirname18, join as join50 } from "path";
 import { createHash as createHash15 } from "crypto";
 function loadLessons(repoDir) {
   const p = lessonsPath(repoDir);
@@ -12635,7 +12642,7 @@ function recordRunVerdict(repoDir, runId, verdict) {
   if (dirty)
     save(repoDir, lessons);
 }
-var lessonsPath = (repoDir) => join51(repoDir, ".loki", "memory", "semantic", "pr-lessons.json"), KINDS;
+var lessonsPath = (repoDir) => join50(repoDir, ".loki", "memory", "semantic", "pr-lessons.json"), KINDS;
 var init_pr_lessons = __esm(() => {
   init_atomic();
   init_safe_git();
@@ -12770,10 +12777,10 @@ var init_providers = __esm(() => {
 
 // ../../loki-ts/src/runner/router/route_record.ts
 import { existsSync as existsSync31, lstatSync as lstatSync11, mkdirSync as mkdirSync21, readFileSync as readFileSync40, writeFileSync as writeFileSync24 } from "fs";
-import { join as join52 } from "path";
+import { join as join51 } from "path";
 function loadRouteRecord(runDir) {
   try {
-    const p = join52(runDir, ROUTE_RECORD_FILE);
+    const p = join51(runDir, ROUTE_RECORD_FILE);
     if (!existsSync31(p) || !lstatSync11(p).isFile())
       return;
     const v = JSON.parse(readFileSync40(p, "utf8"));
@@ -12902,7 +12909,7 @@ var init_worker = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/package_suite.ts
-import { join as join53 } from "path";
+import { join as join52 } from "path";
 async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
   const api = loadProjectApi(repoDir);
   if (!isMultiRoot(api))
@@ -12913,7 +12920,7 @@ async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
   for (const pkg of withTests) {
     const tc = pkg.commands.test, name = `full suite: ${pkg.name}`, cmd = `(cd ${tc.cwd} && ${tc.cmd})`;
     const started = Date.now();
-    const r = await run(["bash", "-c", tc.cmd], { cwd: join53(repoDir, tc.cwd), timeoutMs: opts.timeoutMs, ...opts.path ? { env: { PATH: opts.path } } : {} });
+    const r = await run(["bash", "-c", tc.cmd], { cwd: join52(repoDir, tc.cwd), timeoutMs: opts.timeoutMs, ...opts.path ? { env: { PATH: opts.path } } : {} });
     const duration_s = (Date.now() - started) / 1000;
     if (signal.aborted) {
       checks.push({ name, cmd, result: "not_run", duration_s });
@@ -12922,7 +12929,7 @@ async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
     }
     const out2 = `${r.stdout}
 ${r.stderr}`;
-    const lr = r.exitCode === 0 || !opts.baseSha ? undefined : await harnessLoadReason({ repoDir, baseSha: opts.baseSha, out: out2, cmd: "bash", args: ["-c", tc.cmd], signal, cwd: join53(repoDir, tc.cwd), ...opts.path ? { env: { PATH: opts.path } } : {} });
+    const lr = r.exitCode === 0 || !opts.baseSha ? undefined : await harnessLoadReason({ repoDir, baseSha: opts.baseSha, out: out2, cmd: "bash", args: ["-c", tc.cmd], signal, cwd: join52(repoDir, tc.cwd), ...opts.path ? { env: { PATH: opts.path } } : {} });
     if (lr) {
       checks.push({ name, cmd, result: "not_run", duration_s });
       notProven.add(`${lr} (${name}; harness-owned)`);
@@ -12956,7 +12963,7 @@ __export(exports_deep, {
   DEFAULT_PUSH_SH: () => DEFAULT_PUSH_SH2
 });
 import { existsSync as existsSync32, mkdirSync as mkdirSync22, writeFileSync as writeFileSync25 } from "fs";
-import { join as join54 } from "path";
+import { join as join53 } from "path";
 async function runFullSuite(ctx, signal, opts, checks, notProven) {
   if (await runPackageSuites(ctx.repoDir, signal, { path: opts.path, timeoutMs: opts.fullSuiteTimeoutMs ?? FULL_SUITE_TIMEOUT_MS, baseSha: ctx.baseSha }, checks, notProven))
     return;
@@ -13053,7 +13060,7 @@ async function runSecretScan(ctx, changed, opts, checks, notProven) {
   }
   const inline = 'script="$1"; shift; . "$script" || exit 3; hit=0; for f in "$@"; do if _commit_scan_secret_file "$f" || _commit_path_looks_secret "$f"; then printf "%s\\n" "$f"; hit=1; fi; done; exit "$hit"';
   const started = Date.now();
-  const r = await run(["bash", "-c", inline, "_", scriptPath, ...changed.map((f) => join54(ctx.repoDir, f))], { cwd: ctx.repoDir, timeoutMs: 30000 });
+  const r = await run(["bash", "-c", inline, "_", scriptPath, ...changed.map((f) => join53(ctx.repoDir, f))], { cwd: ctx.repoDir, timeoutMs: 30000 });
   const durationS = (Date.now() - started) / 1000;
   if (r.exitCode === 3) {
     checks.push({ name, cmd: "secret-scan.sh", result: "not_run", duration_s: durationS });
@@ -13094,7 +13101,7 @@ async function postResults(ctx, opts, checks, notProven, statusState) {
   const prNumber = prUrl ? PR_NUMBER_RE.exec(prUrl)?.[1] : undefined;
   if (prNumber) {
     mkdirSync22(ctx.runDir, { recursive: true });
-    const bodyFile = join54(ctx.runDir, "deep-comment.md");
+    const bodyFile = join53(ctx.runDir, "deep-comment.md");
     writeFileSync25(bodyFile, buildCommentBody(checks, notProven, statusState), "utf8");
     const commentResult = await run(["bash", scriptPath, ...commentArgv(prNumber, bodyFile)], { cwd: ctx.repoDir, env, timeoutMs: 30000 });
     if (commentResult.exitCode !== 0)
@@ -13148,7 +13155,7 @@ async function runDeep(ctx, signal, opts = {}) {
   const sig = signReceipt(`${ctx.runId}-deep`, addendumSha256);
   const addendum = { ...addendumBody, addendum_sha256: addendumSha256, verification: { jwt: sig.jwt, kid: sig.kid } };
   mkdirSync22(ctx.runDir, { recursive: true });
-  writeFileSync25(join54(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
+  writeFileSync25(join53(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
 `);
   const pushNotProven = await postResults(ctx, opts, checks, notProvenList, statusState);
   const allNotProven = [...notProvenList, ...pushNotProven];
@@ -13193,18 +13200,18 @@ var init_deep = __esm(() => {
 // ../../loki-ts/src/engine10/stages/verify.ts
 import { existsSync as existsSync33, mkdtempSync as mkdtempSync8, realpathSync as realpathSync18, rmSync as rmSync16 } from "fs";
 import { tmpdir as tmpdir9 } from "os";
-import { dirname as dirname20, isAbsolute as isAbsolute7, join as join55, relative as relative7 } from "path";
+import { dirname as dirname20, isAbsolute as isAbsolute7, join as join54, relative as relative6 } from "path";
 function resolveTool(repoDir, bin, fallback, lastResort = fallback) {
   const inRepo = (p) => {
     try {
-      const r = relative7(realpathSync18(repoDir), realpathSync18(p));
+      const r = relative6(realpathSync18(repoDir), realpathSync18(p));
       return r !== "" && !r.startsWith("..") && !isAbsolute7(r);
     } catch {
       return false;
     }
   };
   const venvEnv = process.env["VIRTUAL_ENV"];
-  const project = [join55(repoDir, ".venv", "bin", bin), join55(repoDir, "venv", "bin", bin), ...venvEnv && inRepo(venvEnv) ? [join55(venvEnv, "bin", bin)] : []].find(existsSync33);
+  const project = [join54(repoDir, ".venv", "bin", bin), join54(repoDir, "venv", "bin", bin), ...venvEnv && inRepo(venvEnv) ? [join54(venvEnv, "bin", bin)] : []].find(existsSync33);
   return project ? [project, "project"] : [Bun.which(fallback) ? fallback : lastResort, "system"];
 }
 function runnerCmd(t, repoDir) {
@@ -13317,7 +13324,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal)
   const sus = pairs.filter(({ c }) => rel.has(c.name) && c.result === "pass");
   if (!(un.some(({ c }) => c.result === "fail" && c.ids?.length) || sus.length) || signal.aborted)
     return out2;
-  const dir = mkdtempSync8(join55(tmpdir9(), "e10-base-"));
+  const dir = mkdtempSync8(join54(tmpdir9(), "e10-base-"));
   const git3 = (args) => {
     safeGit(ctx.repoDir, args, { stdio: "ignore", repoDrivers: true });
   };
@@ -13355,7 +13362,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal)
   return out2;
 }
 function isLokiModeRepo(repoDir) {
-  return existsSync33(join55(repoDir, "scripts", "select-tests.sh"));
+  return existsSync33(join54(repoDir, "scripts", "select-tests.sh"));
 }
 async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   const { api, ...runOpts } = opts;
@@ -13372,9 +13379,9 @@ async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   }
   for (const g of groupByPackage(api, ctx.repoDir, changed.filter((f) => /\.(ts|tsx|js|jsx)$/.test(f)))) {
     const sfx = g.root === "." ? "" : `:${g.root}`, co = g.root === "." ? opts : { ...opts, cwd: g.cwd };
-    if (existsSync33(join55(g.cwd, "tsconfig.json")))
+    if (existsSync33(join54(g.cwd, "tsconfig.json")))
       await runCheck(ctx, `lint:tsc${sfx}`, "npx", ["tsc", "--noEmit", "-p", "."], signal, checks, { ...co, kind: "static" });
-    if (ESLINT_CONFIGS.some((f) => existsSync33(join55(g.cwd, f))))
+    if (ESLINT_CONFIGS.some((f) => existsSync33(join54(g.cwd, f))))
       await runCheck(ctx, `lint:eslint${sfx}`, "npx", ["eslint", ...g.rel], signal, checks, { ...co, kind: "static" });
   }
 }
@@ -13432,7 +13439,7 @@ var init_verify = __esm(() => {
       const impacted = ctx.tests.impacted(map, changed);
       const changedTestFiles = map.tests.filter((t) => changed.includes(t.path));
       const wall = ctx.outputs().wall ?? {};
-      const wallPaths = new Set((wall.files ?? []).map((f) => isAbsolute7(f.path) ? relative7(ctx.repoDir, f.path) : f.path));
+      const wallPaths = new Set((wall.files ?? []).map((f) => isAbsolute7(f.path) ? relative6(ctx.repoDir, f.path) : f.path));
       const wallTests = map.tests.filter((t) => wallPaths.has(t.path));
       const intake = ctx.outputs().intake, relevant2 = ctx.tests.impacted(map, namedFiles(intake?.task ?? "", loadRepoMap(intake?.repomap_ref)));
       const tests = dedupeTests([...impacted, ...changedTestFiles, ...wallTests, ...relevant2]);
@@ -13530,7 +13537,7 @@ var init_verify = __esm(() => {
 
 // ../../loki-ts/src/project_model/conventions.ts
 import { existsSync as existsSync34, readdirSync as readdirSync17, readFileSync as readFileSync41 } from "fs";
-import { dirname as dirname21, join as join56 } from "path";
+import { dirname as dirname21, join as join55 } from "path";
 function parseJsonc(text2) {
   let out2 = "", i = 0;
   while (i < text2.length) {
@@ -13565,7 +13572,7 @@ function moduleOf(file, depth = 0) {
   const ext = typeof j.extends === "string" ? j.extends : null;
   if (!ext || !ext.startsWith("."))
     return null;
-  const next = join56(dirname21(file), ext.endsWith(".json") ? ext : `${ext}.json`);
+  const next = join55(dirname21(file), ext.endsWith(".json") ? ext : `${ext}.json`);
   return existsSync34(next) ? moduleOf(next, depth + 1) : null;
 }
 function readPackageConventions(pkgDir, runner = null) {
@@ -13577,13 +13584,13 @@ function readPackageConventions(pkgDir, runner = null) {
   }
   let packageType = null, tsModule = null;
   for (const n2 of names) {
-    const j = readJson4(join56(pkgDir, n2));
+    const j = readJson4(join55(pkgDir, n2));
     if (!j)
       continue;
     if (packageType === null && typeof j.type === "string" && typeof j.name === "string")
       packageType = j.type;
     if (tsModule === null && j.compilerOptions !== undefined)
-      tsModule = moduleOf(join56(pkgDir, n2));
+      tsModule = moduleOf(join55(pkgDir, n2));
   }
   if (packageType === null && tsModule === null)
     return null;
@@ -13617,13 +13624,13 @@ var init_conventions = () => {};
 import { spawnSync as spawnSync4 } from "child_process";
 import { existsSync as existsSync35, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync9, readFileSync as readFileSync42, readdirSync as readdirSync18, realpathSync as realpathSync19, rmSync as rmSync17, writeFileSync as writeFileSync26 } from "fs";
 import { tmpdir as tmpdir10 } from "os";
-import { dirname as dirname22, isAbsolute as isAbsolute8, join as join57, relative as relative8 } from "path";
+import { dirname as dirname22, isAbsolute as isAbsolute8, join as join56, relative as relative7 } from "path";
 function pytestCollectionIsRed(output, repoDir) {
   if (/ModuleNotFoundError/.test(output))
     return false;
   const real2 = (p) => {
     try {
-      return realpathSync19(isAbsolute8(p) ? p : join57(repoDir, p));
+      return realpathSync19(isAbsolute8(p) ? p : join56(repoDir, p));
     } catch {
       return null;
     }
@@ -13660,7 +13667,7 @@ function pytestCollectionIsRed(output, repoDir) {
 }
 function moduleUnderRepo(repoDir, name) {
   const rel = name.replace(/\./g, "/");
-  return existsSync35(join57(repoDir, `${rel}.py`)) || existsSync35(join57(repoDir, rel, "__init__.py"));
+  return existsSync35(join56(repoDir, `${rel}.py`)) || existsSync35(join56(repoDir, rel, "__init__.py"));
 }
 function pytestExit1IsRed(output) {
   if (/^!+ _pytest\.outcomes\.Exit\b/m.test(output))
@@ -13758,7 +13765,7 @@ ${acceptance.map((a) => `Acceptance: ${a}`).join(`
 function loadTaskText(ctx, fromPrior) {
   if (fromPrior)
     return fromPrior;
-  const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join57(ctx.runDir, "issue.json");
+  const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join56(ctx.runDir, "issue.json");
   if (existsSync35(issueJsonPath)) {
     try {
       const issue = JSON.parse(readFileSync42(issueJsonPath, "utf8"));
@@ -13773,7 +13780,7 @@ function loadTaskText(ctx, fromPrior) {
 }
 function wallTargetDir(repoDir, existingTests) {
   const first = existingTests[0];
-  return first ? join57(repoDir, dirname22(first.path)) : join57(repoDir, "tests");
+  return first ? join56(repoDir, dirname22(first.path)) : join56(repoDir, "tests");
 }
 function guessRunner(fileName, runners) {
   if (fileName.endsWith(".py"))
@@ -13803,12 +13810,12 @@ async function wallAuthor(ctx, signal) {
     return done({ status: "skipped", data: { size: sz.size, files: [], no_runner: true }, reason: "no runnable test command detected: the Wall cannot write a runnable check" });
   const tree = prior.intake?.tree;
   const repomapText = repoMapText(ctx.repoDir, tree, repomapRef, WALL_MAP_MAX_LINES);
-  const targetDir = wallTargetDir(ctx.repoDir, existingTests), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative8(ctx.repoDir, targetDir)}/x`);
-  const conv2 = readPackageConventions(join57(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
-  const cwd = mkdtempSync9(join57(tmpdir10(), "loki-e15-wall-"));
+  const targetDir = wallTargetDir(ctx.repoDir, existingTests), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative7(ctx.repoDir, targetDir)}/x`);
+  const conv2 = readPackageConventions(join56(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
+  const cwd = mkdtempSync9(join56(tmpdir10(), "loki-e15-wall-"));
   const wm = wallManifestFor(ctx.repoDir, tree, task);
   for (const [n2, c] of [["task.md", task], ["repomap.txt", repomapText], ...wm ? [["wall_manifest.txt", wm.text]] : []])
-    writeFileSync26(join57(cwd, n2), c, "utf8");
+    writeFileSync26(join56(cwd, n2), c, "utf8");
   const session = await ctx.sessions.run({
     stage: "wall",
     brief: buildWallBrief(task, repomapText, runners, !!wm, conventionsBrief(conv2), unitSpec()?.acceptance ?? []),
@@ -13823,15 +13830,15 @@ async function wallAuthor(ctx, signal) {
     rmSync17(cwd, { recursive: true, force: true });
     return done({ status: "failed", data: {}, reason: "wall session aborted, killed, or timed out", killed: true });
   }
-  const all = readdirSync18(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !conventionViolation(conv2, n2, readFileSync42(join57(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
-  const sealedDir = join57(ctx.runDir, "wall");
+  const all = readdirSync18(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !conventionViolation(conv2, n2, readFileSync42(join56(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
+  const sealedDir = join56(ctx.runDir, "wall");
   if (generated.length > 0)
     mkdirSync23(sealedDir, { recursive: true });
   const contents = new Map;
   const discarded = [];
   for (const name of generated) {
-    const content = readFileSync42(join57(cwd, name), "utf8"), bad = conventionViolation(conv2, name, content);
-    writeFileSync26(join57(sealedDir, name), content, "utf8");
+    const content = readFileSync42(join56(cwd, name), "utf8"), bad = conventionViolation(conv2, name, content);
+    writeFileSync26(join56(sealedDir, name), content, "utf8");
     if (bad)
       discarded.push({ file: name, reason: `${bad}; wall test did not compile under the package config` });
     else
@@ -13851,18 +13858,18 @@ function installWall(ctx, a, baseDir, opts = {}) {
     const content = contents.get(name);
     if (content === undefined)
       continue;
-    const dest = join57(targetDir, name), runner = guessRunner(name, runners);
+    const dest = join56(targetDir, name), runner = guessRunner(name, runners);
     writeFileSync26(dest, content, "utf8");
     sealedFiles.push({ path: dest, sha256: sha2562(content) });
     readOnlyFiles.push({ path: dest, content });
     if (runner)
-      wallTests.push({ runner, path: relative8(ctx.repoDir, dest) });
+      wallTests.push({ runner, path: relative7(ctx.repoDir, dest) });
   }
   ctx.wallSealed = true;
   ctx.emit("wall.sealed", "wall", { files: sealedFiles, ...a.manifestSha256 ? { manifest_sha256: a.manifestSha256 } : {} });
   const baseRunner = opts.baseRunner ?? new RealBaseTestRunner, baseRun = { pass: 0, fail: 0, not_run: discarded.length }, notRunFiles = [];
   for (const t of wallTests) {
-    const r = baseRunner.run(baseDir, [t]), abs = join57(ctx.repoDir, t.path);
+    const r = baseRunner.run(baseDir, [t]), abs = join56(ctx.repoDir, t.path);
     baseRun.pass += r.pass;
     baseRun.fail += r.fail;
     baseRun.not_run += r.not_run ?? 0;
@@ -13917,14 +13924,14 @@ var init_wall = __esm(() => {
 
 // ../../loki-ts/src/e10ext/discard.ts
 import { chmodSync as chmodSync5, closeSync as closeSync9, lstatSync as lstatSync12, mkdirSync as mkdirSync24, openSync as openSync9, readFileSync as readFileSync43, realpathSync as realpathSync20, rmdirSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync27 } from "fs";
-import { dirname as dirname23, join as join58, relative as relative9, sep as sep12 } from "path";
+import { dirname as dirname23, join as join57, relative as relative8, sep as sep11 } from "path";
 function safeRestore(repoDir, f, want, mode) {
-  const root = realpathSync20(repoDir), fp = join58(root, f), rel = relative9(root, dirname23(fp));
+  const root = realpathSync20(repoDir), fp = join57(root, f), rel = relative8(root, dirname23(fp));
   if (rel.startsWith(".."))
     throw new Error("outside repo");
   let cur = root;
-  for (const part of rel === "" ? [] : rel.split(sep12)) {
-    cur = join58(cur, part);
+  for (const part of rel === "" ? [] : rel.split(sep11)) {
+    cur = join57(cur, part);
     let st2;
     try {
       st2 = lstatSync12(cur);
@@ -13979,7 +13986,7 @@ async function discardIfSatisfied(git3, base, o, staged, keep, repoDir) {
     return { status: "failed", data: {}, reason: "already-satisfied discard failed" };
   const notProven = [];
   for (const [f, v] of Object.entries(o.intake?.preexisting_untracked_blobs ?? {})) {
-    const fp = join58(repoDir, f);
+    const fp = join57(repoDir, f);
     try {
       if (v.startsWith("!")) {
         const st = lstatSync12(fp);
@@ -13998,7 +14005,7 @@ async function discardIfSatisfied(git3, base, o, staged, keep, repoDir) {
       try {
         let m = 420;
         try {
-          const l = lstatSync12(join58(repoDir, f));
+          const l = lstatSync12(join57(repoDir, f));
           if (l.isFile())
             m = l.mode & 511;
         } catch {}
@@ -14074,9 +14081,9 @@ var init_scope2 = __esm(() => {
 // ../../loki-ts/src/council/role_agents.ts
 import { existsSync as existsSync36, readdirSync as readdirSync19, readFileSync as readFileSync44 } from "fs";
 import { homedir as homedir9 } from "os";
-import { join as join59 } from "path";
+import { join as join58 } from "path";
 function agentDirs(repoDir, env = process.env) {
-  return [env["LOKI_AGENTS_PROJECT_DIR"] || join59(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join59(env["XDG_CONFIG_HOME"] || join59(homedir9(), ".config"), "loki", "agents")];
+  return [env["LOKI_AGENTS_PROJECT_DIR"] || join58(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join58(env["XDG_CONFIG_HOME"] || join58(homedir9(), ".config"), "loki", "agents")];
 }
 function parseAgent(file, stem2) {
   const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync44(file, "utf8"));
@@ -14104,7 +14111,7 @@ function loadRoleAgent(repoDir, role, env = process.env) {
     const ordered = [...names.filter((n2) => n2 === `${role}.md`), ...names.filter((n2) => n2 !== `${role}.md`)];
     for (const n2 of ordered) {
       try {
-        const a = parseAgent(join59(d, n2), n2.slice(0, -3));
+        const a = parseAgent(join58(d, n2), n2.slice(0, -3));
         if (a && a.role === role)
           return a;
       } catch {}
@@ -14122,10 +14129,10 @@ var init_role_agents = __esm(() => {
 
 // ../../loki-ts/src/util/run_summary.ts
 import { existsSync as existsSync37, mkdirSync as mkdirSync25, readFileSync as readFileSync45, renameSync as renameSync11, statSync as statSync18, writeFileSync as writeFileSync28 } from "fs";
-import { join as join60 } from "path";
+import { join as join59 } from "path";
 function readRiskRecord(repoDir, sinceMs = 0) {
   try {
-    const p = join60(repoDir, ".loki", "state", "risk-tier.json");
+    const p = join59(repoDir, ".loki", "state", "risk-tier.json");
     if (statSync18(p).mtimeMs < sinceMs)
       return null;
     const r = JSON.parse(readFileSync45(p, "utf8"));
@@ -14143,7 +14150,7 @@ var init_run_summary = __esm(() => {
 
 // ../../loki-ts/src/engine10/stages/xreview.ts
 import { existsSync as existsSync38, readFileSync as readFileSync46 } from "fs";
-import { join as join61 } from "path";
+import { join as join60 } from "path";
 function minVerdict(verdict, review) {
   const ceiling = review?.level === "block" ? "PARTIAL" : verdict;
   return RANK3[ceiling] < RANK3[verdict] ? ceiling : verdict;
@@ -14156,7 +14163,7 @@ function explicitReview(repoDir, env) {
   if (flag && isOff(ev))
     return "off";
   for (const f of ["loki.yaml", "loki.yml"]) {
-    const p = join61(repoDir, f);
+    const p = join60(repoDir, f);
     if (!existsSync38(p))
       continue;
     try {
@@ -14325,7 +14332,7 @@ See also: loki cost --detail (what a run ALREADY spent)
 
 // ../../loki-ts/src/features/contract.ts
 import { existsSync as existsSync39, lstatSync as lstatSync13, mkdirSync as mkdirSync26, readFileSync as readFileSync47, rmSync as rmSync18, writeFileSync as writeFileSync29 } from "fs";
-import { dirname as dirname26, join as join62 } from "path";
+import { dirname as dirname26, join as join61 } from "path";
 import { createHash as createHash16 } from "crypto";
 function contractEnabled(env = process.env) {
   return env["LOKI_CONTRACT"] !== "0";
@@ -14357,7 +14364,7 @@ function untracedLines(trace) {
   return trace.criteria.filter((c) => c.status === "no_match").map((c) => `contract ${sanitizeCriterion(c.id)} untraced (no keyword match in changed files): ${sanitizeCriterion(c.text)}`);
 }
 function contractPath(repoDir) {
-  return join62(repoDir, ".loki", "contract.json");
+  return join61(repoDir, ".loki", "contract.json");
 }
 function readContract(repoDir) {
   const p = contractPath(repoDir);
@@ -14442,16 +14449,16 @@ var init_contract = __esm(() => {
   init_safe_git();
   STOP2 = new Set(["the", "and", "for", "with", "that", "this", "must", "should", "shall", "when", "then", "are", "was", "all", "any", "can", "not", "has", "have", "from", "into", "each", "user", "users"]);
   MAX_CONTRACT_BYTES = 1024 * 1024;
-  REQ_MAP_REL = join62(".loki", "state", "requirements-map.json");
+  REQ_MAP_REL = join61(".loki", "state", "requirements-map.json");
   REQ_STOP = new Set(["with", "that", "this", "from", "have", "will", "should", "must", "when", "then", "into", "each", "every", "user", "users", "page", "able", "allow", "support", "ensure", "using", "their", "there", "which", "shall"]);
 });
 
 // ../../loki-ts/src/features/speed/seal_group.ts
 import { createHash as createHash17 } from "crypto";
 import { existsSync as existsSync40, mkdirSync as mkdirSync27, readdirSync as readdirSync20, readFileSync as readFileSync48, renameSync as renameSync12, statSync as statSync19, writeFileSync as writeFileSync30 } from "fs";
-import { dirname as dirname27, join as join63 } from "path";
+import { dirname as dirname27, join as join62 } from "path";
 function sealGroup(runDir, rh) {
-  const manifestPath = join63(runDir, "group", "manifest.json");
+  const manifestPath = join62(runDir, "group", "manifest.json");
   if (!existsSync40(manifestPath))
     return { section: undefined, notProven: [], problems: 0, allUnitsPass: true };
   const notProven = [];
@@ -14476,7 +14483,7 @@ function sealGroup(runDir, rh) {
       return fail(`unit ${index2} has an invalid, duplicate or case-colliding id`);
     seen.add(id);
     seenLower.add(id.toLowerCase());
-    const dir = join63(unitsDir(runDir), id), rp = join63(dir, "receipt.json"), ep = join63(dir, "events.jsonl");
+    const dir = join62(unitsDir(runDir), id), rp = join62(dir, "receipt.json"), ep = join62(dir, "events.jsonl");
     let bytes;
     try {
       bytes = readFileSync48(rp);
@@ -14521,7 +14528,7 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
   const bad = (reason) => ({ verdict: "TAMPERED", reason: `group: ${reason}` });
   const g = receipt["group"];
   if (g === undefined)
-    return existsSync40(join63(runDir, "group", "manifest.json")) ? bad("group directory present but the receipt has no group section") : null;
+    return existsSync40(join62(runDir, "group", "manifest.json")) ? bad("group directory present but the receipt has no group section") : null;
   if (!isObj10(g) || !ID_RE.test(String(g["group_id"] ?? "")) || !Array.isArray(g["units"]) || g["units"].length === 0)
     return bad("group section malformed");
   const entries = g["units"];
@@ -14533,7 +14540,7 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
     return bad("unit directories do not match the receipt (missing or extra unit)");
   let unchecked = null;
   for (let i = 0;i < entries.length; i++) {
-    const e = entries[i], id = ids[i], dir = join63(unitsDir(runDir), id), rp = join63(dir, "receipt.json"), ep = join63(dir, "events.jsonl");
+    const e = entries[i], id = ids[i], dir = join62(unitsDir(runDir), id), rp = join62(dir, "receipt.json"), ep = join62(dir, "events.jsonl");
     if (e["index"] !== i)
       return bad(`unit ${id} is out of order (index ${String(e["index"])} at position ${i})`);
     let bytes;
@@ -14569,7 +14576,7 @@ function compositeVerdict(childVerdicts) {
   const failed2 = childVerdicts.filter((v) => v === "FAILED" || !["VERIFIED", "ALREADY_SATISFIED", "PARTIAL", "SPEC_CONFLICT"].includes(v)).length;
   return capGroupVerdict(base, { section: undefined, notProven: [], problems: failed2, allUnitsPass: childVerdicts.every((v) => PASSING.has(v)) });
 }
-var ID_RE, PASSING, sha3 = (b) => createHash17("sha256").update(b).digest("hex"), isObj10 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), text2 = (v, cap) => typeof v === "string" ? v.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0, unitsDir = (runDir) => join63(runDir, "group", "units"), readJson5 = (p) => {
+var ID_RE, PASSING, sha3 = (b) => createHash17("sha256").update(b).digest("hex"), isObj10 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), text2 = (v, cap) => typeof v === "string" ? v.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0, unitsDir = (runDir) => join62(runDir, "group", "units"), readJson5 = (p) => {
   try {
     return JSON.parse(readFileSync48(p, "utf8"));
   } catch {
@@ -14590,7 +14597,7 @@ var init_seal_group = __esm(() => {
 
 // ../../loki-ts/src/supply/supply_guard.ts
 import { existsSync as existsSync41, readFileSync as readFileSync49, statSync as statSync20 } from "fs";
-import { basename as basename21, join as join64 } from "path";
+import { basename as basename21, join as join63 } from "path";
 function supplyEnabled(env) {
   return env["LOKI_SUPPLY_GUARD"] !== "0";
 }
@@ -14605,7 +14612,7 @@ function isManifestPath(path) {
   return MANIFESTS.test(basename21(path));
 }
 function readDeclared(repoDir) {
-  const p = join64(repoDir, ".loki", DECLARED_FILE);
+  const p = join63(repoDir, ".loki", DECLARED_FILE);
   if (!existsSync41(p))
     return { deps: [], problem: null };
   try {
@@ -14631,7 +14638,7 @@ function readDeclared(repoDir) {
   }
 }
 function readAllowlist(repoDir) {
-  const p = join64(repoDir, ".loki", "supply-allowlist");
+  const p = join63(repoDir, ".loki", "supply-allowlist");
   if (!existsSync41(p))
     return new Set;
   try {
@@ -14676,7 +14683,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "npm") {
     if (privateUrlList([env["npm_config_registry"] ?? "", env["NPM_CONFIG_REGISTRY"] ?? ""]))
       return true;
-    return files(join64(repoDir, ".npmrc"), home ? join64(home, ".npmrc") : "").some((t) => t.split(`
+    return files(join63(repoDir, ".npmrc"), home ? join63(home, ".npmrc") : "").some((t) => t.split(`
 `).some((l) => {
       const m = /^\s*(?:(@[^:\s]+):)?registry\s*=\s*(\S+)/.exec(l);
       return !!m && privateUrl(m[2]) && (m[1] === undefined || name.startsWith(`${m[1]}/`));
@@ -14685,7 +14692,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "pypi") {
     if (privateUrlList([env["PIP_INDEX_URL"] ?? "", env["PIP_EXTRA_INDEX_URL"] ?? ""]))
       return true;
-    const cfg = [env["PIP_CONFIG_FILE"] ?? "", home ? join64(home, ".config", "pip", "pip.conf") : "", home ? join64(home, ".pip", "pip.conf") : "", join64(repoDir, "pip.conf")];
+    const cfg = [env["PIP_CONFIG_FILE"] ?? "", home ? join63(home, ".config", "pip", "pip.conf") : "", home ? join63(home, ".pip", "pip.conf") : "", join63(repoDir, "pip.conf")];
     return files(...cfg).some((t) => t.split(`
 `).some((l) => {
       const m = /^\s*(?:extra-)?index-url\s*[=:]\s*(.+)$/.exec(l);
@@ -14695,7 +14702,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "cargo") {
     if (Object.keys(env).some((k) => /^CARGO_REGISTRIES_.+_INDEX$/.test(k) || /^CARGO_SOURCE_/.test(k)))
       return true;
-    return files(join64(repoDir, ".cargo", "config.toml"), join64(repoDir, ".cargo", "config"), home ? join64(home, ".cargo", "config.toml") : "", home ? join64(home, ".cargo", "config") : "").some((t) => /^\s*\[(registries\.|source\.)/m.test(t) || /replace-with\s*=/.test(t));
+    return files(join63(repoDir, ".cargo", "config.toml"), join63(repoDir, ".cargo", "config"), home ? join63(home, ".cargo", "config.toml") : "", home ? join63(home, ".cargo", "config") : "").some((t) => /^\s*\[(registries\.|source\.)/m.test(t) || /replace-with\s*=/.test(t));
   }
   if (eco === "go") {
     const gp = goEnv["GOPROXY"] ?? env["GOPROXY"] ?? "";
@@ -14835,7 +14842,7 @@ var init_supply_guard = __esm(() => {
 // ../../loki-ts/src/engine10/stages/seal.ts
 import { createHash as createHash18 } from "crypto";
 import { existsSync as existsSync42, readdirSync as readdirSync21, mkdirSync as mkdirSync28, readFileSync as readFileSync50, writeFileSync as writeFileSync31 } from "fs";
-import { basename as basename22, isAbsolute as isAbsolute9, join as join65, relative as relative10 } from "path";
+import { basename as basename22, isAbsolute as isAbsolute9, join as join64, relative as relative9 } from "path";
 function sanitizeReason(s) {
   const collapsed = s.replace(/[\x00-\x1f\x7f]+/g, " ").trim();
   const capped = collapsed.length > 500 ? `${collapsed.slice(0, 500)}...` : collapsed;
@@ -14910,7 +14917,7 @@ function renderReceiptMd(r) {
 `);
 }
 var DEEP_NOT_PROVEN, SIGNING_UNAVAILABLE = "receipt signing unavailable (no usable signing key: invalid key or unwritable ~/.loki/keys)", EXCLUDE_LOKI = ":(exclude).loki", sha2562 = (s) => createHash18("sha256").update(s).digest("hex"), str3 = (v) => typeof v === "string" && v !== "" ? v : null, strs2 = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x !== "") : [], receiptRel = (ctx) => {
-  const r = relative10(ctx.repoDir, join65(ctx.runDir, "receipt.json"));
+  const r = relative9(ctx.repoDir, join64(ctx.runDir, "receipt.json"));
   return r.startsWith("..") || isAbsolute9(r) ? `.loki/runs/${ctx.runId}/receipt.json` : r;
 }, commitStage, sealStage;
 var init_seal = __esm(() => {
@@ -15019,7 +15026,7 @@ var init_seal = __esm(() => {
       if (wallNotRun > 0) {
         try {
           const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename22(String(f.path))));
-          for (const n2 of readdirSync21(join65(ctx.runDir, "wall")).sort())
+          for (const n2 of readdirSync21(join64(ctx.runDir, "wall")).sort())
             if (!kept.has(n2))
               notProven.add(`wall test discarded: ${n2} (not_run)`);
         } catch {}
@@ -15082,19 +15089,19 @@ var init_seal = __esm(() => {
       for (const [s, d] of Object.entries(o))
         if (typeof d?.duration_s === "number")
           stages[s] = d.duration_s;
-      const T = hooks.time, time = T ? T.build(ctx, stages, T.firstEventMs(join65(ctx.runDir, "events.jsonl"))) : { wall_s: Object.values(stages).reduce((a, b) => a + (b ?? 0), 0), stages }, totalS = T?.reconciled(time) ?? null;
+      const T = hooks.time, time = T ? T.build(ctx, stages, T.firstEventMs(join64(ctx.runDir, "events.jsonl"))) : { wall_s: Object.values(stages).reduce((a, b) => a + (b ?? 0), 0), stages }, totalS = T?.reconciled(time) ?? null;
       const iterIds = Object.values(o).flatMap((d) => [...strs2(d?.iteration_ids), ...strs2([d?.iteration_id])]);
       if (iterIds.length === 0)
         notProven.add("cost not measured (no iteration ids recorded)");
       const cost = ctx.cost.read(ctx.repoDir, iterIds);
       if (cost.unmetered)
         notProven.add("cost unmetered (CLI invoker; recorded as 0)");
-      const eventsPath = join65(ctx.runDir, "events.jsonl");
+      const eventsPath = join64(ctx.runDir, "events.jsonl");
       const wallFiles = Array.isArray(o.wall?.files) ? o.wall.files : [];
       const wallPassed = typeof o.verify?.wall_passed === "boolean" ? o.verify.wall_passed : null;
       if (wallFiles.length > 0 && wallPassed === null)
         notProven.add("wall result not recorded by verify");
-      const routeBlock = buildRouteBlock(process.env, ctx.provider, o.implement?.route ?? o.plan?.route_record ?? (routerEnabled(process.env) ? loadRouteRecord(ctx.runDir) : undefined), cost.router ?? (routerEnabled(process.env) ? sumResultCosts(join65(ctx.repoDir, ".loki"), liveArchivedCosts(join65(ctx.repoDir, ".loki"), iterIds, UNMETERED)).router : undefined), ctx.model);
+      const routeBlock = buildRouteBlock(process.env, ctx.provider, o.implement?.route ?? o.plan?.route_record ?? (routerEnabled(process.env) ? loadRouteRecord(ctx.runDir) : undefined), cost.router ?? (routerEnabled(process.env) ? sumResultCosts(join64(ctx.repoDir, ".loki"), liveArchivedCosts(join64(ctx.repoDir, ".loki"), iterIds, UNMETERED)).router : undefined), ctx.model);
       if (routeBlock)
         for (const l of routeNotProven(routeBlock))
           notProven.add(l);
@@ -15158,13 +15165,13 @@ var init_seal = __esm(() => {
       }
       const receipt = { ...body, receipt_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } };
       mkdirSync28(ctx.runDir, { recursive: true });
-      const path = join65(ctx.runDir, "receipt.json");
+      const path = join64(ctx.runDir, "receipt.json");
       writeFileSync31(path, JSON.stringify(receipt, null, 2) + `
 `);
-      writeFileSync31(join65(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
+      writeFileSync31(join64(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
       recordRun(process.env, ctx.repoDir, ranModel(o.implement, ctx.model, o.fix), verdict, cost.usd, cost.unmetered === true, totalS);
       try {
-        hooks.sealed?.(ctx.runDir, receipt);
+        hooks.sealed?.(ctx.runDir, JSON.parse(JSON.stringify(receipt), (_k, v) => v && typeof v === "object" ? Object.freeze(v) : v));
       } catch (e) {
         process.stderr.write(`ai-bom skipped: ${e.message}
 `);
@@ -15274,13 +15281,13 @@ var init_receipt_dsse = () => {};
 
 // ../../loki-ts/src/util/composite_seal.ts
 import { existsSync as existsSync43, readFileSync as readFileSync52 } from "fs";
-import { basename as basename23, dirname as dirname29, join as join66 } from "path";
+import { basename as basename23, dirname as dirname29, join as join65 } from "path";
 function logProblem(runDir, integ) {
   if (typeof integ["log_sha256"] !== "string")
     return null;
   let b;
   try {
-    b = readFileSync52(join66(runDir, "integration.log"));
+    b = readFileSync52(join65(runDir, "integration.log"));
   } catch {
     return "integration.log is missing but integration.json records its hash";
   }
@@ -15303,13 +15310,13 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
     return bad("body malformed");
   let ibytes;
   try {
-    ibytes = readFileSync52(join66(runDir, "integration.json"));
+    ibytes = readFileSync52(join65(runDir, "integration.json"));
   } catch {
     return bad("integration.json missing");
   }
   if (sha3(ibytes) !== receipt["integration_sha256"])
     return bad("integration.json does not match its recorded hash");
-  const integ = readJson5(join66(runDir, "integration.json"));
+  const integ = readJson5(join65(runDir, "integration.json"));
   if (!isObj10(integ) || !isObj10(integ["outcomes"]))
     return bad("integration.json has no outcomes");
   const iprob = integrationProblem(integ);
@@ -15339,7 +15346,7 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
       return bad(`child ${text2(repo, 80) || "?"} has an invalid receipt path`);
     if (outcomes[repo] !== "ok")
       return bad(`child ${text2(repo, 80)} did not finish ok in integration.json`);
-    const rp = join66(runDir, rel);
+    const rp = join65(runDir, rel);
     let bytes;
     try {
       bytes = readFileSync52(rp);
@@ -15392,7 +15399,7 @@ var init_keys_cmd = __esm(() => {
 
 // ../../loki-ts/src/engine10/verify_cmd.ts
 import { existsSync as existsSync44, readFileSync as readFileSync53, renameSync as renameSync13, statSync as statSync22, writeFileSync as writeFileSync32 } from "fs";
-import { basename as basename24, dirname as dirname30, join as join67 } from "path";
+import { basename as basename24, dirname as dirname30, join as join66 } from "path";
 import { createHash as createHash19, createPublicKey as createPublicKey4, verify as verify4 } from "crypto";
 function pubFor(kid, given) {
   if (given)
@@ -15444,7 +15451,7 @@ function checkEventLog(receiptPath, receipt) {
     const claims = st !== null && typeof st === "object" && Object.keys(st).length > 0;
     return claims ? "the receipt records stages but binds the empty-log hash, so no events.jsonl can back it (missing, empty or non-empty); the receipt is forged or was sealed without a log. Re-run the task to produce a fresh receipt" : null;
   }
-  const path = join67(dirname30(receiptPath), "events.jsonl");
+  const path = join66(dirname30(receiptPath), "events.jsonl");
   if (!existsSync44(path))
     return "events.jsonl is missing";
   const raw2 = readFileSync53(path, "utf8"), events2 = readEvents(path), lines2 = raw2.split(`
@@ -15463,7 +15470,7 @@ function checkEventLog(receiptPath, receipt) {
   return h.digest("hex") === bound ? null : "events.jsonl does not match the hash recorded at seal";
 }
 function checkLogSeal(receiptPath, hash, kid, given) {
-  const path = join67(dirname30(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
+  const path = join66(dirname30(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
   if (!events2.some((e) => e.type === "receipt.sealed" && e.data["receipt_sha256"] === hash))
     return { verdict: "TAMPERED", reason: "events.jsonl has no receipt.sealed event for this receipt" };
   if (done < 0)
@@ -15574,7 +15581,7 @@ var init_verify_cmd = __esm(() => {
 
 // src/server/app.ts
 import { existsSync as existsSync46, readFileSync as readFileSync56, statSync as statSync23 } from "fs";
-import { join as join70, resolve as resolve15, sep as sep14 } from "path";
+import { join as join69, resolve as resolve15, sep as sep13 } from "path";
 
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = Symbol();
@@ -25858,7 +25865,7 @@ function mount20(ctx) {
 // src/server/routes/verify.ts
 import { readFileSync as readFileSync54, realpathSync as realpathSync21 } from "fs";
 import { createPublicKey as createPublicKey5 } from "crypto";
-import { join as join68, sep as sep13 } from "path";
+import { join as join67, sep as sep12 } from "path";
 init_verify_cmd();
 init_seal();
 init_receipt_dsse();
@@ -25885,15 +25892,15 @@ function mount21(ctx) {
       return done(404, "receipt not available", "not_found");
     let runDir, file;
     try {
-      const root = realpathSync21(join68(repo.p, ".loki", "runs"));
-      runDir = realpathSync21(join68(root, run2));
-      if (runDir !== join68(root, run2))
+      const root = realpathSync21(join67(repo.p, ".loki", "runs"));
+      runDir = realpathSync21(join67(root, run2));
+      if (runDir !== join67(root, run2))
         return done(404, "receipt not found", "not_found");
-      file = realpathSync21(join68(runDir, "receipt.json"));
+      file = realpathSync21(join67(runDir, "receipt.json"));
     } catch {
       return done(404, "receipt not found", "not_found");
     }
-    if (!file.startsWith(runDir + sep13))
+    if (!file.startsWith(runDir + sep12))
       return done(404, "receipt not found", "not_found");
     let integrity, reasons, sha4 = null, outcome = "UNREADABLE";
     try {
@@ -25971,7 +25978,7 @@ function ttlCache(ttlMs = PROBE_CACHE_MS, now2 = Date.now) {
 
 // src/server/legacy/shim.ts
 import { existsSync as existsSync45, readFileSync as readFileSync55 } from "fs";
-import { join as join69 } from "path";
+import { join as join68 } from "path";
 
 // src/server/legacy/routes.ts
 var LEGACY_ROUTES = [
@@ -26349,7 +26356,7 @@ var logged = new Set;
 var toHono = (p) => p.replace(/\{([A-Za-z_]+):path\}/g, ":$1{.+}").replace(/\{([A-Za-z_]+)\}/g, ":$1");
 var NOT_SUPPORTED = "not yet supported by the Control Plane";
 var repoVersion = () => {
-  for (const f of [join69(import.meta.dir, "../../../../../VERSION")]) {
+  for (const f of [join68(import.meta.dir, "../../../../../VERSION")]) {
     try {
       if (existsSync45(f))
         return readFileSync55(f, "utf8").trim();
@@ -26534,7 +26541,7 @@ function legacyShim(opts) {
 
 // src/server/app.ts
 var MAX_BODY2 = 1e6;
-var defaultUiDir = () => [join70(import.meta.dir, "../../ui/dist"), join70(import.meta.dir, "../ui/dist")].find((d) => existsSync46(join70(d, "index.html")));
+var defaultUiDir = () => [join69(import.meta.dir, "../../ui/dist"), join69(import.meta.dir, "../ui/dist")].find((d) => existsSync46(join69(d, "index.html")));
 function createApp(opts) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db, sqlite } = openDb(opts.dbPath);
@@ -26563,7 +26570,7 @@ function createApp(opts) {
     await next();
   });
   const readInstalled = () => {
-    for (const f of [process.env.LOKI_VERSION_FILE, join70(import.meta.dir, "../../../../VERSION")]) {
+    for (const f of [process.env.LOKI_VERSION_FILE, join69(import.meta.dir, "../../../../VERSION")]) {
       try {
         if (f)
           return readFileSync56(f, "utf8").trim() || "unknown";
@@ -26677,11 +26684,11 @@ function createApp(opts) {
       return c.json({ error: "not found" }, 404);
     const root = resolve15(uiDir);
     const f = resolve15(root, `.${p}`);
-    if (f.startsWith(root + sep14) && existsSync46(f) && statSync23(f).isFile())
+    if (f.startsWith(root + sep13) && existsSync46(f) && statSync23(f).isFile())
       return new Response(Bun.file(f));
     if (/\.[a-z0-9]+$/i.test(p))
       return c.json({ error: "not found" }, 404);
-    return new Response(Bun.file(join70(root, "index.html")));
+    return new Response(Bun.file(join69(root, "index.html")));
   });
   return { app, db, close: () => {
     clearInterval(reconciler);