loki-mode 11.17.19 → 11.17.21

package/packages/control-plane/dist/server.js

@@ -9674,6 +9674,19 @@ var init_test_file_text = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/testmap.ts
+import { existsSync as existsSync22, readdirSync as readdirSync13, readFileSync as readFileSync28, realpathSync as realpathSync16 } from "fs";
+import { basename as basename10, extname, isAbsolute as isAbsolute2, join as join37, relative, sep as sep10 } from "path";
+function projectInterpreter(root) {
+  const ve = process.env["VIRTUAL_ENV"], inRepo = (p) => {
+    try {
+      const r = relative(realpathSync16(root), realpathSync16(p));
+      return r !== "" && !r.startsWith("..") && !isAbsolute2(r);
+    } catch {
+      return false;
+    }
+  };
+  return [join37(root, ".venv", "bin", "python"), join37(root, "venv", "bin", "python"), ...ve && inRepo(ve) ? [join37(ve, "bin", "python")] : []].some(existsSync22) ? "project" : "system";
+}
 var SKIP_DIRS;
 var init_testmap = __esm(() => {
   init_resolve();
@@ -9697,8 +9710,8 @@ var init_testmap = __esm(() => {
 });
 
 // ../../loki-ts/src/util/check_result.ts
-import { mkdirSync as mkdirSync13, readFileSync as readFileSync28, renameSync as renameSync8, writeFileSync as writeFileSync16 } from "fs";
-import { basename as basename10, join as join37 } from "path";
+import { mkdirSync as mkdirSync13, readFileSync as readFileSync29, renameSync as renameSync8, writeFileSync as writeFileSync16 } from "fs";
+import { basename as basename11, join as join38 } from "path";
 function plainTestEnv(base = process.env) {
   const e = {};
   for (const [k, v] of Object.entries(tokenFreeEnv(base)))
@@ -9716,7 +9729,7 @@ function ran(raw2, path, ok) {
   if (blk) {
     const c = n2(blk, /(?:#|\u2139) pass (\d+)/) + n2(blk, /(?:#|\u2139) fail (\d+)/);
     const nm = out2.match(/^(?:ok \d+ - |\u2714 )(\S+\.[cm]?[jt]s)(?: \(|$)/m)?.[1];
-    return c === 1 && nm && (!path || basename10(nm) === basename10(path)) ? 0 : c;
+    return c === 1 && nm && (!path || basename11(nm) === basename11(path)) ? 0 : c;
   }
   const cg = cargoTrailer(out2);
   if (cg.length)
@@ -9807,16 +9820,16 @@ function goRunner(cmd, args) {
     let k = 0;
     for (;k < t.length; k++) {
       const x = t[k];
-      if (/^[A-Za-z_]\w*=/.test(x) || /^(?:env|command|exec|time|nohup)$/.test(basename10(x)))
+      if (/^[A-Za-z_]\w*=/.test(x) || /^(?:env|command|exec|time|nohup)$/.test(basename11(x)))
         continue;
-      if (/^-/.test(x) && k > 0 && basename10(t[k - 1]) === "env") {
+      if (/^-/.test(x) && k > 0 && basename11(t[k - 1]) === "env") {
         if (x === "-u" || x === "-C" || x === "-S")
           k++;
         continue;
       }
       break;
     }
-    if (t[k] !== undefined && basename10(t[k]) === "go")
+    if (t[k] !== undefined && basename11(t[k]) === "go")
       return { runner: "go" };
   }
   return {};
@@ -9993,7 +10006,7 @@ function diffFiles(repoDir, baseSha) {
       return f;
     let n2 = 0;
     try {
-      n2 = readFileSync28(join37(repoDir, path), "utf8").split(`
+      n2 = readFileSync29(join38(repoDir, path), "utf8").split(`
 `).length;
     } catch {}
     return { path, added: n2, deleted: 0, status: "added" };
@@ -10001,7 +10014,7 @@ function diffFiles(repoDir, baseSha) {
 }
 function recordRisk(repoDir, a) {
   try {
-    const dir = join37(repoDir, ".loki", "state"), p = join37(dir, "risk-tier.json");
+    const dir = join38(repoDir, ".loki", "state"), p = join38(dir, "risk-tier.json");
     mkdirSync13(dir, { recursive: true });
     writeFileSync16(`${p}.tmp`, JSON.stringify(a, null, 2) + `
 `);
@@ -10011,12 +10024,54 @@ function recordRisk(repoDir, a) {
     return null;
   }
 }
+function truncateBytes(s, cap) {
+  const buf = Buffer.from(s, "utf8");
+  return buf.length <= cap ? s : buf.subarray(0, Math.max(0, cap)).toString("utf8").replace(/\uFFFD$/, "");
+}
+function failureExcerpt(out2, repoDir = "", cap = EXCERPT_GROUP_CAP) {
+  let t = stripAnsi(out2.slice(-65536)).replace(/\r/g, "");
+  if (repoDir)
+    t = t.split(repoDir.replace(/\/+$/, "") + "/").join("");
+  const lines = t.split(`
+`).map((l) => l.replace(/\s+$/, ""));
+  const pick = new Set;
+  const take = (i, n2 = 1) => {
+    for (let k = 0;k < n2 && i + k < lines.length; k++)
+      if (lines[i + k].trim())
+        pick.add(i + k);
+  };
+  lines.forEach((l, i) => {
+    if (/^E\s/.test(l))
+      take(i);
+    else if (/^\s*(Expected|Received)\b/.test(l) || /^\s*expect\(.*\)\.\w+/.test(l))
+      take(i);
+    else if (/^[\w./@-]+\.py:\d+: /.test(l))
+      take(i);
+    else if (/AssertionError|^\s*(expected|actual)\b.*[:=]|^\s*(not ok|FAILED)\b/.test(l))
+      take(i, 3);
+    else if (/^\s*--- FAIL/.test(l))
+      take(i, 4);
+    else if (/^[\w./@-]+\.\w+(\(\d+,\d+\)|:\d+(:\d+)?)[:\s].*\b(error|TS\d+|[A-Z]{1,3}\d{3,4})\b/.test(l))
+      take(i);
+  });
+  const lastFrame = lines.map((l, i) => /^[\w./@-]+\.py:\d+: /.test(l) ? i : -1).filter((i) => i >= 0).pop();
+  if (lastFrame !== undefined && [...pick].some((i) => /^E\s/.test(lines[i])))
+    take(lastFrame);
+  let body = [...pick].sort((a, b) => a - b).map((i) => lines[i]).join(`
+`);
+  if (!body)
+    body = lines.filter((l) => l.trim()).slice(-6).join(`
+`);
+  body = redactSecrets(body);
+  return truncateBytes(body, cap);
+}
 var NO_TESTS_REASON = "no tests executed", GO_EXIT0_REASON = "test count could not be confirmed: go test output is produced by the code under test and cannot confirm execution (a Go exit 0 is never a pass)", UNCONFIRMED_REASON = "test count could not be confirmed", FAIL_EVIDENCE, GO_FAIL_EVIDENCE, UNMEASURED_REASON = "executed count unmeasured (Loki could not parse the runner summary, harness-owned)", stripAnsi = (s) => s.replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)/g, "").replace(/(?:\u001b\[|\u009b)[0-9;?]*[ -\/]*[@-~]/g, "").replace(/\r\n?/g, `
 `), tailLines = (out2) => out2.split(`
-`).filter((x) => x.trim()).slice(-12), GO_PKG_RE, isExecutedProof = (c) => c.result === "pass" && typeof c.n === "number" && c.n > 0, hasExecutedProof = (checks) => checks.some(isExecutedProof), LLM_JUDGES, NON_RUNNER, SENSITIVE, API, TEST_CFG, RANK2, FILES_MEDIUM = 4, FILES_HIGH = 15, LINES_MEDIUM = 100, LINES_HIGH = 500, RAN_ALWAYS, PLAN, LOW_SKIPPED, deferredOf = (tier, selected, executed) => (tier === "low" ? LOW_SKIPPED : selected).filter((c) => !RAN_ALWAYS.includes(c) && !executed.includes(c));
+`).filter((x) => x.trim()).slice(-12), GO_PKG_RE, isExecutedProof = (c) => c.result === "pass" && typeof c.n === "number" && c.n > 0, hasExecutedProof = (checks) => checks.some(isExecutedProof), LLM_JUDGES, NON_RUNNER, SENSITIVE, API, TEST_CFG, RANK2, FILES_MEDIUM = 4, FILES_HIGH = 15, LINES_MEDIUM = 100, LINES_HIGH = 500, RAN_ALWAYS, PLAN, LOW_SKIPPED, deferredOf = (tier, selected, executed) => (tier === "low" ? LOW_SKIPPED : selected).filter((c) => !RAN_ALWAYS.includes(c) && !executed.includes(c)), EXCERPT_GROUP_CAP = 1500, EXCERPT_TOTAL_CAP = 6144;
 var init_check_result = __esm(() => {
   init_testmap();
   init_safe_git();
+  init_redact();
   FAIL_EVIDENCE = /\[(?:build|setup) failed\]|^--- FAIL|^[\w./-]+\.go:\d+:\d+: \S|\b[1-9]\d* (?:failed|errors?)\b/m;
   GO_FAIL_EVIDENCE = /^FAIL\t\S+\t[\d.]+s$|^panic: /m;
   GO_PKG_RE = /^(?:ok|FAIL|\?)\s+\S+\s+(?:\(cached\)|[\d.]+s\b|\[(?:no test files|build failed|setup failed)\])/;
@@ -10062,11 +10117,11 @@ var init_state = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/repo_profile.ts
-import { existsSync as existsSync22, readFileSync as readFileSync29, mkdirSync as mkdirSync14, readdirSync as readdirSync13, renameSync as renameSync9, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "fs";
-import { basename as basename11, join as join38, resolve as resolve13, isAbsolute as isAbsolute2 } from "path";
+import { existsSync as existsSync23, readFileSync as readFileSync30, mkdirSync as mkdirSync14, readdirSync as readdirSync14, renameSync as renameSync9, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "fs";
+import { basename as basename12, join as join39, resolve as resolve13, isAbsolute as isAbsolute3 } from "path";
 function loadProfile(repoDir) {
   try {
-    const p = JSON.parse(readFileSync29(commandProfilePath(repoDir), "utf8"));
+    const p = JSON.parse(readFileSync30(commandProfilePath(repoDir), "utf8"));
     return p?.version === 1 && Array.isArray(p.commands) && p.baseline ? p : null;
   } catch {
     return null;
@@ -10157,7 +10212,7 @@ async function staticPreExisting(tool, prefix, files, io) {
   }
   return attributeStatic(tool, head.out, baseOut, 1).preExisting;
 }
-var commandProfilePath = (repoDir) => join38(repoDir, ".loki", "state", "repo-profile.json"), STATIC_DIAG, STATIC_NOISE, STATIC_SUMMARY;
+var commandProfilePath = (repoDir) => join39(repoDir, ".loki", "state", "repo-profile.json"), STATIC_DIAG, STATIC_NOISE, STATIC_SUMMARY;
 var init_repo_profile = __esm(() => {
   init_failures();
   init_check_result();
@@ -10199,14 +10254,14 @@ var init_context = __esm(() => {
 });
 
 // ../../loki-ts/src/util/steer.ts
-import { appendFileSync as appendFileSync2, closeSync as closeSync8, constants as constants2, fstatSync as fstatSync6, readdirSync as readdirSync14, lstatSync as lstatSync9, mkdirSync as mkdirSync15, linkSync as linkSync2, openSync as openSync8, readFileSync as readFileSync30, readSync as readSync7, renameSync as renameSync10, statSync as statSync15, lutimesSync, rmSync as rmSync9, unlinkSync as unlinkSync5, writeFileSync as writeFileSync18, existsSync as existsSync23 } from "fs";
+import { appendFileSync as appendFileSync2, closeSync as closeSync8, constants as constants2, fstatSync as fstatSync6, readdirSync as readdirSync15, lstatSync as lstatSync9, mkdirSync as mkdirSync15, linkSync as linkSync2, openSync as openSync8, readFileSync as readFileSync31, readSync as readSync7, renameSync as renameSync10, statSync as statSync15, lutimesSync, rmSync as rmSync9, unlinkSync as unlinkSync5, writeFileSync as writeFileSync18, existsSync as existsSync24 } from "fs";
 import { createHash as createHash9, randomBytes as randomBytes4 } from "crypto";
-import { basename as basename12, join as join39 } from "path";
+import { basename as basename13, join as join40 } from "path";
 function archiveTo(logs, prefix, src, link = linkSync2, onLinked) {
   for (let i = 0;; i++) {
     const name = i === 0 ? `${prefix}.md` : `${prefix}-${i}.md`;
     try {
-      link(src, join39(logs, name));
+      link(src, join40(logs, name));
     } catch (e) {
       const code = e.code;
       if (code === "EEXIST")
@@ -10214,7 +10269,7 @@ function archiveTo(logs, prefix, src, link = linkSync2, onLinked) {
       if (code !== "EPERM" && code !== "ENOTSUP" && code !== "EXDEV" && code !== "EMLINK")
         throw e;
       const name2 = `${prefix}-${randomBytes4(4).toString("hex")}.md`;
-      renameSync10(src, join39(logs, name2));
+      renameSync10(src, join40(logs, name2));
       onLinked?.(name2);
       return name2;
     }
@@ -10229,14 +10284,14 @@ function orphanAlreadyArchived(logs, claim) {
   const c = lstatSync9(claim);
   if (!c.isFile())
     return false;
-  for (const a of readdirSync14(logs)) {
+  for (const a of readdirSync15(logs)) {
     if (!/^human-input-.*\.md$/.test(a))
       continue;
     try {
-      const s = statSync15(join39(logs, a));
+      const s = statSync15(join40(logs, a));
       if (s.ino !== c.ino || s.dev !== c.dev)
         continue;
-      if (/^human-input-(ORPHAN|REJECTED)-/.test(a) || existsSync23(appliedMarker(logs, a)))
+      if (/^human-input-(ORPHAN|REJECTED)-/.test(a) || existsSync24(appliedMarker(logs, a)))
         return true;
     } catch {}
   }
@@ -10245,7 +10300,7 @@ function orphanAlreadyArchived(logs, claim) {
 function sweepOrphans(logs, stamp2, unapplied, link, nowMs = Date.now()) {
   let names;
   try {
-    names = readdirSync14(logs);
+    names = readdirSync15(logs);
   } catch {
     return;
   }
@@ -10253,7 +10308,7 @@ function sweepOrphans(logs, stamp2, unapplied, link, nowMs = Date.now()) {
   for (const n2 of names)
     if (n2.startsWith(".applied-") && !present.has(n2.slice(".applied-".length))) {
       try {
-        unlinkSync5(join39(logs, n2));
+        unlinkSync5(join40(logs, n2));
       } catch {}
     }
   for (const n2 of names) {
@@ -10270,7 +10325,7 @@ function sweepOrphans(logs, stamp2, unapplied, link, nowMs = Date.now()) {
     if (alive) {
       let ageMs = 0;
       try {
-        ageMs = nowMs - statSync15(join39(logs, n2)).mtimeMs;
+        ageMs = nowMs - statSync15(join40(logs, n2)).mtimeMs;
       } catch {
         continue;
       }
@@ -10278,11 +10333,11 @@ function sweepOrphans(logs, stamp2, unapplied, link, nowMs = Date.now()) {
         continue;
     }
     try {
-      if (orphanAlreadyArchived(logs, join39(logs, n2))) {
-        unlinkSync5(join39(logs, n2));
+      if (orphanAlreadyArchived(logs, join40(logs, n2))) {
+        unlinkSync5(join40(logs, n2));
         continue;
       }
-      archiveTo(logs, `human-input-ORPHAN-${stamp2}`, join39(logs, n2), link);
+      archiveTo(logs, `human-input-ORPHAN-${stamp2}`, join40(logs, n2), link);
       unapplied("orphaned claim");
     } catch (e) {
       if (e.code === "ENOENT")
@@ -10294,17 +10349,17 @@ function sweepOrphans(logs, stamp2, unapplied, link, nowMs = Date.now()) {
 function consumeSteer(repoDir, env = process.env, now2 = () => new Date, sink, hooks2) {
   if (/^(0|false)$/i.test(env.LOKI_PROMPT_INJECTION ?? ""))
     return null;
-  const f = join39(repoDir, ".loki", "HUMAN_INPUT.md");
+  const f = join40(repoDir, ".loki", "HUMAN_INPUT.md");
   const unapplied = (reason) => {
     sink?.push({ rev: 0, source: null, actor: null, sha: "", at: now2().getTime(), unapplied: true, reason });
   };
   let fd = -1, claimed = "";
   try {
-    const logs = join39(repoDir, ".loki", "logs");
+    const logs = join40(repoDir, ".loki", "logs");
     mkdirSync15(logs, { recursive: true });
     const stamp2 = now2().toISOString().replace(/[-:]/g, "").replace(/\..*/, "");
     sweepOrphans(logs, stamp2, unapplied, hooks2?.link, now2().getTime());
-    claimed = join39(logs, `.claim-${process.pid}-${randomBytes4(6).toString("hex")}`);
+    claimed = join40(logs, `.claim-${process.pid}-${randomBytes4(6).toString("hex")}`);
     try {
       renameSync10(f, claimed);
     } catch (e) {
@@ -10395,10 +10450,10 @@ function consumeSteer(repoDir, env = process.env, now2 = () => new Date, sink, h
   } catch {
     if (claimed) {
       try {
-        archiveTo(join39(repoDir, ".loki", "logs"), `human-input-${now2().toISOString().replace(/[-:]/g, "").replace(/\..*/, "")}`, claimed, hooks2?.link);
+        archiveTo(join40(repoDir, ".loki", "logs"), `human-input-${now2().toISOString().replace(/[-:]/g, "").replace(/\..*/, "")}`, claimed, hooks2?.link);
         unapplied("logs dir unwritable or file unreadable");
       } catch {
-        unapplied(`steer stranded at .loki/logs/${basename12(claimed)}`);
+        unapplied(`steer stranded at .loki/logs/${basename13(claimed)}`);
       }
     } else
       try {
@@ -10414,10 +10469,10 @@ function consumeSteer(repoDir, env = process.env, now2 = () => new Date, sink, h
   }
 }
 function recordRevisions(repoDir, text2, archived, at) {
-  const file = join39(repoDir, ".loki", "intent-revisions.jsonl");
+  const file = join40(repoDir, ".loki", "intent-revisions.jsonl");
   let last = 0;
   try {
-    for (const l of readFileSync30(file, "utf8").split(`
+    for (const l of readFileSync31(file, "utf8").split(`
 `)) {
       try {
         last = Math.max(last, Number(JSON.parse(l).rev) || 0);
@@ -10471,7 +10526,7 @@ function staleAtSeal(repoDir, ctx) {
   const frozen = ctx.outputs === undefined || ctx.outputs().wall !== undefined || ctx.wallSealed === true;
   return [...new Set([...staleWallRevisions(ctx.intentRevisions, frozen ? ctx.timeline : []), ...late])];
 }
-var STEER_MAX_BYTES, STEER_STAGES, STEER_CLAIM_MAX_AGE_MS, appliedMarker = (logs, archive) => join39(logs, `.applied-${archive}`), REV_HDR, STEER_REMEDY;
+var STEER_MAX_BYTES, STEER_STAGES, STEER_CLAIM_MAX_AGE_MS, appliedMarker = (logs, archive) => join40(logs, `.applied-${archive}`), REV_HDR, STEER_REMEDY;
 var init_steer = __esm(() => {
   init_context();
   STEER_MAX_BYTES = 1024 * 1024;
@@ -10534,18 +10589,18 @@ var init_seal_drift = __esm(() => {
 });
 
 // ../../loki-ts/src/util/spec_file.ts
-import { isAbsolute as isAbsolute3, join as join40, relative } from "path";
+import { isAbsolute as isAbsolute4, join as join41, relative as relative2 } from "path";
 function specReceiptBlock(env) {
   const { LOKI_E10_SPEC_PATH: p, LOKI_E10_SPEC_SHA256: sha2 } = env;
   if (!p || !sha2)
     return {};
-  const rel = isAbsolute3(p) && env.LOKI_E10_REPO_DIR ? relative(env.LOKI_E10_REPO_DIR, p) : p;
+  const rel = isAbsolute4(p) && env.LOKI_E10_REPO_DIR ? relative2(env.LOKI_E10_REPO_DIR, p) : p;
   return { spec: { path: rel, sha256: sha2 } };
 }
 var SPEC_DIR;
 var init_spec_file = __esm(() => {
   init_types();
-  SPEC_DIR = join40(".loki", "specs");
+  SPEC_DIR = join41(".loki", "specs");
 });
 
 // ../../loki-ts/src/engine10/pr_body.ts
@@ -10565,11 +10620,11 @@ var init_run_cap = __esm(() => {
 });
 
 // ../../loki-ts/src/util/mutation_proof.ts
-import { existsSync as existsSync24, mkdirSync as mkdirSync16, mkdtempSync as mkdtempSync3, readFileSync as readFileSync31, rmSync as rmSync10, symlinkSync, writeFileSync as writeFileSync19 } from "fs";
+import { existsSync as existsSync25, mkdirSync as mkdirSync16, mkdtempSync as mkdtempSync3, readFileSync as readFileSync32, rmSync as rmSync10, symlinkSync, writeFileSync as writeFileSync19 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { basename as basename13, dirname as dirname13, isAbsolute as isAbsolute4, join as join41, relative as relative2 } from "path";
+import { basename as basename14, dirname as dirname13, isAbsolute as isAbsolute5, join as join42, relative as relative3 } from "path";
 function mutationProof(i) {
-  const rels = i.wallFiles.map((f) => isAbsolute4(f.path) ? relative2(i.repoDir, f.path) : f.path);
+  const rels = i.wallFiles.map((f) => isAbsolute5(f.path) ? relative3(i.repoDir, f.path) : f.path);
   if (rels.length === 0)
     return np("no Wall tests");
   const tests = rels.flatMap((rel) => {
@@ -10585,26 +10640,26 @@ function mutationProof(i) {
   const deadline = Date.now() + budgetS * 1000, remaining = () => deadline - Date.now();
   let parent = null, wt = null, added = false;
   try {
-    parent = mkdtempSync3(join41(tmpdir4(), "loki-mutproof-"));
-    wt = join41(parent, "wt");
+    parent = mkdtempSync3(join42(tmpdir4(), "loki-mutproof-"));
+    wt = join42(parent, "wt");
     const add3 = git(i.repoDir, ["worktree", "add", "--detach", wt, i.baseSha], Math.max(1000, Math.min(30000, remaining())));
-    added = existsSync24(wt) || add3.status === 0;
+    added = existsSync25(wt) || add3.status === 0;
     if (add3.status !== 0)
       return np("could not create the base worktree");
     for (const rel of rels) {
-      const sealed = join41(i.runDir, "wall", basename13(rel)), src = existsSync24(sealed) ? sealed : join41(i.repoDir, rel);
-      if (!existsSync24(src))
+      const sealed = join42(i.runDir, "wall", basename14(rel)), src = existsSync25(sealed) ? sealed : join42(i.repoDir, rel);
+      if (!existsSync25(src))
         return np(`Wall file missing: ${rel}`);
-      mkdirSync16(dirname13(join41(wt, rel)), { recursive: true });
-      writeFileSync19(join41(wt, rel), readFileSync31(src));
+      mkdirSync16(dirname13(join42(wt, rel)), { recursive: true });
+      writeFileSync19(join42(wt, rel), readFileSync32(src));
     }
     for (const rel of rels) {
       const parts = rel.split("/").slice(0, -1);
       for (let n2 = 0;n2 <= parts.length; n2++) {
         const anc = parts.slice(0, n2).join("/");
         for (const d of DEP_DIRS) {
-          const src = join41(i.repoDir, anc, d), dst = join41(wt, anc, d);
-          if (existsSync24(src) && !existsSync24(dst)) {
+          const src = join42(i.repoDir, anc, d), dst = join42(wt, anc, d);
+          if (existsSync25(src) && !existsSync25(dst)) {
             try {
               symlinkSync(src, dst);
             } catch {}
@@ -10732,7 +10787,7 @@ var init_shell = __esm(() => {
 });
 
 // ../../loki-ts/src/util/python.ts
-import { accessSync, constants as constants3, existsSync as existsSync25, mkdtempSync as mkdtempSync4, readFileSync as readFileSync32, realpathSync as realpathSync16, rmSync as rmSync11, statSync as statSync16 } from "fs";
+import { accessSync, constants as constants3, existsSync as existsSync26, mkdtempSync as mkdtempSync4, readFileSync as readFileSync33, realpathSync as realpathSync17, rmSync as rmSync11, statSync as statSync16 } from "fs";
 import { spawnSync as spawnSync2 } from "child_process";
 import { tmpdir as tmpdir5 } from "os";
 function resolvePython3() {
@@ -11073,7 +11128,7 @@ var init_wall_manifest = __esm(() => {
 
 // ../../loki-ts/src/features/wall_manifest_wire.ts
 import { createHash as createHash11 } from "crypto";
-import { basename as basename14, dirname as dirname14 } from "path";
+import { basename as basename15, dirname as dirname14 } from "path";
 function blobEntries(ls) {
   const out2 = [];
   for (const raw2 of ls.toString("latin1").split("\x00")) {
@@ -11103,12 +11158,12 @@ function wallManifestFor(repoDir, tree, task, env = process.env) {
       return null;
     const low = task.toLowerCase().replace(/\\/g, "/");
     const token = (n2) => new RegExp(`(?<![A-Za-z0-9_])${n2.toLowerCase().replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![A-Za-z0-9_])`).test(low);
-    const dirModule = (e) => /^(index|__init__|mod|main)\.[^.]+$/.test(basename14(e.path)) && e.path.includes("/") && token(dirname14(e.path));
-    const matched = all.filter((e) => SOURCE.test(e.path) && (token(basename14(e.path)) || token(e.path) || token(basename14(e.path).replace(/\.[^.]*$/, "")) || dirModule(e)));
+    const dirModule = (e) => /^(index|__init__|mod|main)\.[^.]+$/.test(basename15(e.path)) && e.path.includes("/") && token(dirname14(e.path));
+    const matched = all.filter((e) => SOURCE.test(e.path) && (token(basename15(e.path)) || token(e.path) || token(basename15(e.path).replace(/\.[^.]*$/, "")) || dirModule(e)));
     const spans = (p) => [...low.matchAll(new RegExp(`(?<![A-Za-z0-9_])${p.toLowerCase().replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![A-Za-z0-9_])`, "g"))].map((m) => [m.index, m.index + m[0].length]);
     const occ = new Map(matched.map((e) => [e, spans(e.path)]));
     const exact = (e) => occ.get(e).some(([s, t]) => !matched.some((o) => o !== e && o.path.length > e.path.length && occ.get(o).some(([s2, t2]) => s2 <= s && t <= t2)));
-    const byPath2 = matched.filter(exact).sort((a, b) => b.path.length - a.path.length), byBase = matched.filter((e) => !byPath2.includes(e) && token(basename14(e.path)));
+    const byPath2 = matched.filter(exact).sort((a, b) => b.path.length - a.path.length), byBase = matched.filter((e) => !byPath2.includes(e) && token(basename15(e.path)));
     const named = [...byPath2, ...byBase, ...matched.filter((e) => !byPath2.includes(e) && !byBase.includes(e))].slice(0, MAX_NAMED);
     const tests = all.filter((e) => TESTISH.test(e.path)).slice(0, MAX_FILES), listed = tests.filter((e) => !SOURCE.test(e.path));
     const want = [...new Set([...all.filter((e) => CONFIG.test(e.path)), ...tests.filter((e) => SOURCE.test(e.path)), ...named])];
@@ -11165,9 +11220,9 @@ Example: test('name', () => { assert.strictEqual(fn(1), 2); });  Run: node --tes
 
 // ../../loki-ts/src/util/holdout.ts
 import { createHash as createHash12 } from "crypto";
-import { appendFileSync as appendFileSync3, copyFileSync as copyFileSync2, existsSync as existsSync26, mkdirSync as mkdirSync17, readFileSync as readFileSync33, rmSync as rmSync12, writeFileSync as writeFileSync20 } from "fs";
+import { appendFileSync as appendFileSync3, copyFileSync as copyFileSync2, existsSync as existsSync27, mkdirSync as mkdirSync17, readFileSync as readFileSync34, rmSync as rmSync12, writeFileSync as writeFileSync20 } from "fs";
 import { tmpdir as tmpdir6 } from "os";
-import { basename as basename15, join as join42, relative as relative3 } from "path";
+import { basename as basename16, join as join43, relative as relative4 } from "path";
 function wallHoldoutRatio(env = process.env) {
   if (env["LOKI_WALL_HOLDOUT"]?.trim() === "0")
     return 0;
@@ -11195,32 +11250,32 @@ function stashHoldout(o) {
   rmSync12(dir, { recursive: true, force: true });
   mkdirSync17(dir, { recursive: true, mode: 448 });
   const files = held.map((name) => {
-    copyFileSync2(join42(o.srcDir, name), join42(dir, name));
-    rmSync12(join42(o.srcDir, name), { force: true });
-    return { name, runner: o.runnerOf(name), sha256: sha2(readFileSync33(join42(dir, name), "utf8")) };
+    copyFileSync2(join43(o.srcDir, name), join43(dir, name));
+    rmSync12(join43(o.srcDir, name), { force: true });
+    return { name, runner: o.runnerOf(name), sha256: sha2(readFileSync34(join43(dir, name), "utf8")) };
   });
-  writeFileSync20(join42(dir, MANIFEST), JSON.stringify({ targetDir: o.targetDir, files }));
+  writeFileSync20(join43(dir, MANIFEST), JSON.stringify({ targetDir: o.targetDir, files }));
   return { dir, names: new Set(held) };
 }
 function stageHoldout(dir, repoDir) {
   const put = [], tests = [], missing = [];
   let man = null;
   try {
-    man = JSON.parse(readFileSync33(join42(dir, MANIFEST), "utf8"));
+    man = JSON.parse(readFileSync34(join43(dir, MANIFEST), "utf8"));
   } catch {}
   if (!man)
-    return { tests, missing: [`holdout store unreadable: ${basename15(dir)}`], cleanup: () => {} };
+    return { tests, missing: [`holdout store unreadable: ${basename16(dir)}`], cleanup: () => {} };
   mkdirSync17(man.targetDir, { recursive: true });
   man.files.forEach((f, i) => {
-    const src = join42(dir, f.name);
-    if (!existsSync26(src) || sha2(readFileSync33(src, "utf8")) !== f.sha256) {
+    const src = join43(dir, f.name);
+    if (!existsSync27(src) || sha2(readFileSync34(src, "utf8")) !== f.sha256) {
       missing.push(`holdout ${i + 1} missing or altered`);
       return;
     }
-    const dest = join42(man.targetDir, `loki_wall_holdout_${i + 1}${f.name.slice(f.name.indexOf("."))}`);
+    const dest = join43(man.targetDir, `loki_wall_holdout_${i + 1}${f.name.slice(f.name.indexOf("."))}`);
     copyFileSync2(src, dest);
     put.push(dest);
-    tests.push({ runner: f.runner, path: relative3(repoDir, dest) });
+    tests.push({ runner: f.runner, path: relative4(repoDir, dest) });
   });
   return { tests, missing, cleanup: () => {
     for (const p of put)
@@ -11230,16 +11285,16 @@ function stageHoldout(dir, repoDir) {
 function recordHoldoutTriage(runDir, entry) {
   try {
     mkdirSync17(runDir, { recursive: true });
-    appendFileSync3(join42(runDir, HOLDOUT_TRIAGE_FILE), JSON.stringify(entry) + `
+    appendFileSync3(join43(runDir, HOLDOUT_TRIAGE_FILE), JSON.stringify(entry) + `
 `, { mode: 384 });
   } catch {}
 }
-var sha2 = (s) => createHash12("sha256").update(s).digest("hex"), WALL_HOLDOUT_DEFAULT_RATIO = 0.2, isHoldoutCheck = (name) => name.startsWith("holdout:"), holdoutDirFor = (runId, repoDir) => join42(tmpdir6(), `loki-e10-holdout-${sha2(`${runId}:${repoDir}`).slice(0, 16)}`), MANIFEST = "manifest.json", WALL_HOLDOUT_MIN = 5, HOLDOUT_TRIAGE_FILE = "holdout-triage.jsonl";
+var sha2 = (s) => createHash12("sha256").update(s).digest("hex"), WALL_HOLDOUT_DEFAULT_RATIO = 0.2, isHoldoutCheck = (name) => name.startsWith("holdout:"), holdoutDirFor = (runId, repoDir) => join43(tmpdir6(), `loki-e10-holdout-${sha2(`${runId}:${repoDir}`).slice(0, 16)}`), MANIFEST = "manifest.json", WALL_HOLDOUT_MIN = 5, HOLDOUT_TRIAGE_FILE = "holdout-triage.jsonl";
 var init_holdout = () => {};
 
 // ../../loki-ts/src/features/runner_config.ts
-import { readFileSync as readFileSync34 } from "fs";
-import { dirname as dirname15, join as join43, normalize as normalize2 } from "path";
+import { readFileSync as readFileSync35 } from "fs";
+import { dirname as dirname15, join as join44, normalize as normalize2 } from "path";
 function tomlKey2(s, i = 0, eq2 = true) {
   const parts = [], ws = () => {
     while (/\s/.test(s[i] ?? "x"))
@@ -11516,8 +11571,8 @@ function referenced(cfg, text2) {
     }
   const dir = dirname15(cfg), explicit = ROOT_DIR.exec(text2), roots = [dir];
   if (explicit)
-    roots.push("", ...explicit[1] ? [join43(dir, explicit[1])] : []);
-  return [...raw2.flatMap((r) => r.startsWith("/") ? [normalize2(r.slice(1))] : roots.map((root) => normalize2(join43(root, r.replace(/^<rootDir>\/?/, ""))))), ...patchedTargets(cfg, text2).map((t) => normalize2(join43(dir, t)))];
+    roots.push("", ...explicit[1] ? [join44(dir, explicit[1])] : []);
+  return [...raw2.flatMap((r) => r.startsWith("/") ? [normalize2(r.slice(1))] : roots.map((root) => normalize2(join44(root, r.replace(/^<rootDir>\/?/, ""))))), ...patchedTargets(cfg, text2).map((t) => normalize2(join44(dir, t)))];
 }
 function runnerConfigNotes(repoDir, baseSha, head, changed, signal) {
   const notes = new Set, ch = new Set(changed.map((c) => normalize2(c)));
@@ -11597,7 +11652,7 @@ var PKG_KEYS, RAW_CONFIGS, RUNNER_CONFIGS, DEP_MAPS, RUNNER_DEP, LOCAL_SPEC, dep
   }
 }, headText = (dir, f) => {
   try {
-    return readFileSync34(join43(dir, f), "utf8");
+    return readFileSync35(join44(dir, f), "utf8");
   } catch {
     return "";
   }
@@ -11637,19 +11692,19 @@ var init_runner_config = __esm(() => {
 
 // ../../loki-ts/src/e10ext/assert_delta.ts
 import { execFileSync as execFileSync3 } from "child_process";
-import { mkdtempSync as mkdtempSync5, readFileSync as readFileSync35, rmSync as rmSync13 } from "fs";
+import { mkdtempSync as mkdtempSync5, readFileSync as readFileSync36, rmSync as rmSync13 } from "fs";
 import { tmpdir as tmpdir7 } from "os";
-import { join as join44 } from "path";
-import { basename as basename16 } from "path";
+import { join as join45 } from "path";
+import { basename as basename17 } from "path";
 function classifyAssertDelta(inp) {
-  const f = basename16(inp.path);
+  const f = basename17(inp.path);
   if (!/^(test_.*|.*_test)\.py$/.test(f))
     return WEAKENED;
   if (inp.headCounts.run !== inp.baseCounts.run || inp.headCounts.skipped !== inp.baseCounts.skipped)
     return WEAKENED;
   let cwd = "";
   try {
-    cwd = mkdtempSync5(join44(tmpdir7(), "loki-ad-"));
+    cwd = mkdtempSync5(join45(tmpdir7(), "loki-ad-"));
     const raw2 = execFileSync3("python3", ["-I", "-c", PY], {
       input: JSON.stringify({ path: inp.path, base: inp.base, head: inp.head, task: inp.task }),
       cwd,
@@ -11680,7 +11735,7 @@ function assertDeltaNotes(repoDir, baseSha, headRef, path, task, baseCounts, hea
     return null;
   try {
     const show = (ref) => safeGit(repoDir, ["show", `${ref}:${path}`]);
-    const head = headRef ? show(headRef) : readFileSync35(join44(repoDir, path), "utf8");
+    const head = headRef ? show(headRef) : readFileSync36(join45(repoDir, path), "utf8");
     const r = classifyTestEdit(path, show(baseSha), head, task, baseCounts, headCounts);
     return r[0]?.kind === "literal-only" ? r.map((e) => `assertion value changed (not shown to be required by the task): ${e.file}:${e.line} ${e.old} -> ${e.new}`) : null;
   } catch {
@@ -11887,19 +11942,19 @@ var init_runner_errors = __esm(() => {
 
 // ../../loki-ts/src/runner/load_owner.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { mkdtempSync as mkdtempSync6, realpathSync as realpathSync17, rmSync as rmSync14 } from "fs";
+import { mkdtempSync as mkdtempSync6, realpathSync as realpathSync18, rmSync as rmSync14 } from "fs";
 import { tmpdir as tmpdir8 } from "os";
-import { basename as basename17, extname, join as join45 } from "path";
+import { basename as basename18, extname as extname2, join as join46 } from "path";
 function changedFilesNamed(out2, repoDir, changed) {
   return changed.filter((f) => {
-    if (out2.includes(f) || out2.includes(join45(repoDir, f)))
+    if (out2.includes(f) || out2.includes(join46(repoDir, f)))
       return true;
     const segs = f.split("/");
     if (suffixes(segs, 2).some((x) => x !== f && bounded(out2, x, "(?![\\w-])")))
       return true;
-    if (extname(f) === ".go" && segs.length > 1 && suffixes(segs.slice(0, -1), 1).some((d) => new RegExp(`(?<=[\\w-])/${esc(d)}(?![\\w./-])`).test(out2)))
+    if (extname2(f) === ".go" && segs.length > 1 && suffixes(segs.slice(0, -1), 1).some((d) => new RegExp(`(?<=[\\w-])/${esc(d)}(?![\\w./-])`).test(out2)))
       return true;
-    const stem = basename17(f, extname(f));
+    const stem = basename18(f, extname2(f));
     if (stem.length < 2 || stem === "index" || stem === "__init__")
       return false;
     return new RegExp(`(?<![\\w-])${esc(stem)}(?![\\w-])`).test(out2);
@@ -11909,7 +11964,7 @@ function loadSignature(out2, roots) {
   let o = out2;
   for (const r of roots.flatMap((x) => {
     try {
-      return [x, realpathSync17(x)];
+      return [x, realpathSync18(x)];
     } catch {
       return [x];
     }
@@ -12003,7 +12058,7 @@ async function loadErrorIsHarnessOwned(i) {
     return false;
   if (i.args.some((a) => changed.includes(a.replace(/^\.\//, ""))))
     return false;
-  const dir = mkdtempSync6(join45(tmpdir8(), "e10-loadown-"));
+  const dir = mkdtempSync6(join46(tmpdir8(), "e10-loadown-"));
   const git3 = (args) => {
     safeGit(i.repoDir, args, { stdio: "ignore" });
   };
@@ -12035,7 +12090,7 @@ var init_load_owner = __esm(() => {
 });
 
 // ../../loki-ts/src/util/wall_owned.ts
-import { isAbsolute as isAbsolute5, join as join46, relative as relative4 } from "path";
+import { isAbsolute as isAbsolute6, join as join47, relative as relative5 } from "path";
 function failingLocations(raw2, cwd, repoDir) {
   const out2 = raw2.replace(ANSI2, "").replace(/\r\n?/g, `
 `), files = new Set;
@@ -12067,7 +12122,7 @@ function failingLocations(raw2, cwd, repoDir) {
   }
   if (errors2 === 0 || located !== errors2)
     return null;
-  return [...files].map((f) => relative4(repoDir, isAbsolute5(f) ? f : join46(cwd, f)));
+  return [...files].map((f) => relative5(repoDir, isAbsolute6(f) ? f : join47(cwd, f)));
 }
 function wallOwnedFailure(raw2, cwd, repoDir, wall) {
   const locs = failingLocations(raw2, cwd, repoDir);
@@ -12081,21 +12136,21 @@ var init_wall_owned = __esm(() => {
 // ../../loki-ts/src/project_graph.ts
 import { createHash as createHash13 } from "crypto";
 import {
-  existsSync as existsSync27,
-  readdirSync as readdirSync15,
-  readFileSync as readFileSync36,
+  existsSync as existsSync28,
+  readdirSync as readdirSync16,
+  readFileSync as readFileSync37,
   statSync as statSync17,
   writeFileSync as writeFileSync21,
   mkdirSync as mkdirSync18
 } from "fs";
-import { basename as basename18, dirname as dirname16, join as join47, resolve as resolve14 } from "path";
+import { basename as basename19, dirname as dirname16, join as join48, resolve as resolve14 } from "path";
 function readManifest(path) {
-  if (!existsSync27(path)) {
+  if (!existsSync28(path)) {
     return null;
   }
   let raw2;
   try {
-    raw2 = readFileSync36(path, "utf8");
+    raw2 = readFileSync37(path, "utf8");
   } catch {
     return null;
   }
@@ -12132,7 +12187,7 @@ function resolveMembers(rootDir, declared, selfBasename) {
   const seen = new Set;
   let children;
   try {
-    children = readdirSync15(rootDir);
+    children = readdirSync16(rootDir);
   } catch {
     children = [];
   }
@@ -12147,7 +12202,7 @@ function resolveMembers(rootDir, declared, selfBasename) {
     for (const child of children) {
       if (!matchPattern(name, child))
         continue;
-      const full = join47(rootDir, child);
+      const full = join48(rootDir, child);
       if (seen.has(full))
         continue;
       let st;
@@ -12164,7 +12219,7 @@ function resolveMembers(rootDir, declared, selfBasename) {
   }
   if (declared.length === 0) {
     for (const child of children) {
-      const full = join47(rootDir, child);
+      const full = join48(rootDir, child);
       if (seen.has(full))
         continue;
       let st;
@@ -12175,7 +12230,7 @@ function resolveMembers(rootDir, declared, selfBasename) {
       }
       if (!st.isDirectory())
         continue;
-      if (!existsSync27(join47(full, ".loki", "app.json")))
+      if (!existsSync28(join48(full, ".loki", "app.json")))
         continue;
       seen.add(full);
       out2.push(full);
@@ -12196,26 +12251,26 @@ function cacheKey(manifestPaths) {
 }
 function writeCache(targetDir, key, result) {
   try {
-    const cacheDir = join47(targetDir, ".loki", "state");
+    const cacheDir = join48(targetDir, ".loki", "state");
     mkdirSync18(cacheDir, { recursive: true });
-    const cachePath = join47(cacheDir, "project-graph.json");
+    const cachePath = join48(cacheDir, "project-graph.json");
     writeFileSync21(cachePath, JSON.stringify({ key, result }, null, 2), "utf8");
   } catch {}
 }
 function discoverProjectGraph(targetDir) {
   const absTarget = resolve14(targetDir);
-  const targetManifest = join47(absTarget, ".loki", "app.json");
+  const targetManifest = join48(absTarget, ".loki", "app.json");
   const parentDir = dirname16(absTarget);
-  const parentManifest = join47(parentDir, ".loki", "app.json");
+  const parentManifest = join48(parentDir, ".loki", "app.json");
   const examined = [];
   let chosenManifest = null;
   let chosenRoot = "";
-  if (existsSync27(parentManifest) && parentDir !== absTarget) {
+  if (existsSync28(parentManifest) && parentDir !== absTarget) {
     examined.push(parentManifest);
     chosenManifest = readManifest(parentManifest);
     chosenRoot = parentDir;
   }
-  if (!chosenManifest && existsSync27(targetManifest)) {
+  if (!chosenManifest && existsSync28(targetManifest)) {
     examined.push(targetManifest);
     chosenManifest = readManifest(targetManifest);
     chosenRoot = absTarget;
@@ -12223,11 +12278,11 @@ function discoverProjectGraph(targetDir) {
   if (!chosenManifest)
     return null;
   const declared = chosenManifest.members ?? [];
-  const members = resolveMembers(chosenRoot, declared, basename18(absTarget));
+  const members = resolveMembers(chosenRoot, declared, basename19(absTarget));
   const filtered = [];
   for (const m of members) {
-    const sibManifestPath = join47(m, ".loki", "app.json");
-    if (existsSync27(sibManifestPath)) {
+    const sibManifestPath = join48(m, ".loki", "app.json");
+    if (existsSync28(sibManifestPath)) {
       examined.push(sibManifestPath);
       const sibManifest = readManifest(sibManifestPath);
       if (sibManifest && sibManifest.app_id !== chosenManifest.app_id) {
@@ -12355,9 +12410,9 @@ var init_route_block = __esm(() => {
 // ../../loki-ts/src/features/visual_evidence.ts
 import { spawn as spawn7 } from "child_process";
 import { createHash as createHash14, randomBytes as randomBytes5 } from "crypto";
-import { existsSync as existsSync28, lstatSync as lstatSync10, mkdirSync as mkdirSync19, readdirSync as readdirSync16, readFileSync as readFileSync37, writeFileSync as writeFileSync22 } from "fs";
+import { existsSync as existsSync29, lstatSync as lstatSync10, mkdirSync as mkdirSync19, readdirSync as readdirSync17, readFileSync as readFileSync38, writeFileSync as writeFileSync22 } from "fs";
 import { createServer } from "net";
-import { dirname as dirname17, isAbsolute as isAbsolute6, join as join48, normalize as normalize3, relative as relative5, sep as sep10 } from "path";
+import { dirname as dirname17, isAbsolute as isAbsolute7, join as join49, normalize as normalize3, relative as relative6, sep as sep11 } from "path";
 function routeFor(file) {
   let r = file.replace(/^(?:.*?\/)?(?:app|pages|src|public)\//, "").replace(/^(?:routes|pages)\//, "");
   r = r.replace(/\.(?:html|jsx|tsx|vue|svelte)$/, "").replace(/\/?(?:page|index|\+page)$/, "");
@@ -12367,7 +12422,7 @@ function hashScreens(runDir, rels) {
   const out2 = [];
   for (const rel of rels) {
     try {
-      out2.push({ path: rel, sha256: sha256File(join48(runDir, rel)) });
+      out2.push({ path: rel, sha256: sha256File(join49(runDir, rel)) });
     } catch {}
   }
   return out2;
@@ -12378,16 +12433,16 @@ function checkScreens(runDir, screens) {
   for (const s of screens) {
     if (typeof s?.path !== "string" || typeof s.sha256 !== "string")
       return "evidence_screens entry is malformed";
-    if (isAbsolute6(s.path) || normalize3(s.path).startsWith(".."))
+    if (isAbsolute7(s.path) || normalize3(s.path).startsWith(".."))
       return `evidence screenshot path escapes the evidence dir: ${s.path}`;
-    const file = join48(runDir, s.path);
+    const file = join49(runDir, s.path);
     let cur = runDir;
-    for (const seg of normalize3(s.path).split(sep10)) {
-      cur = join48(cur, seg);
+    for (const seg of normalize3(s.path).split(sep11)) {
+      cur = join49(cur, seg);
       if (isSymlink(cur))
         return `evidence screenshot path is a symlink: ${s.path}`;
     }
-    if (!existsSync28(file))
+    if (!existsSync29(file))
       return `evidence screenshot is missing: ${s.path}`;
     if (!isRegularFile(file))
       return `evidence screenshot is not a regular file: ${s.path}`;
@@ -12430,11 +12485,11 @@ async function waitUp(url, ms, signal) {
 }
 function openapiPaths(repoDir) {
   for (const f of ["openapi.json", "openapi.yaml", "openapi.yml", "swagger.json"]) {
-    const p = join48(repoDir, f);
-    if (!existsSync28(p))
+    const p = join49(repoDir, f);
+    if (!existsSync29(p))
       continue;
     try {
-      const txt = readFileSync37(p, "utf8");
+      const txt = readFileSync38(p, "utf8");
       const paths = f.endsWith(".json") ? Object.keys(JSON.parse(txt).paths ?? {}) : [...txt.matchAll(/^ {2}(\/[^\s:]*):\s*$/gm)].map((m) => m[1]);
       return paths.filter((x) => !x.includes("{")).slice(0, 10);
     } catch {
@@ -12448,24 +12503,24 @@ async function recordE2eMedia(repoDir, runDir, relDir, base, routes, ms, signal)
   if (!pw || !pkg)
     return { rels: [], skipped: "playwright e2e video and trace skipped: @playwright/test is not installed in the repo" };
   try {
-    const dir = join48(runDir, relDir, "e2e");
+    const dir = join49(runDir, relDir, "e2e");
     mkdirSync19(dir, { recursive: true });
-    writeFileSync22(join48(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
-    writeFileSync22(join48(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
+    writeFileSync22(join49(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
+    writeFileSync22(join49(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
 `);
-    if (!await shoot(pw, ["test", "--config", join48(dir, "playwright.config.cjs")], repoDir, ms, signal))
+    if (!await shoot(pw, ["test", "--config", join49(dir, "playwright.config.cjs")], repoDir, ms, signal))
       return { rels: [], skipped: "playwright e2e video and trace skipped: the run failed or timed out" };
     const rels = [];
     const walk = (d) => {
-      for (const e of readdirSync16(d, { withFileTypes: true })) {
-        const full = join48(d, e.name);
+      for (const e of readdirSync17(d, { withFileTypes: true })) {
+        const full = join49(d, e.name);
         if (e.isDirectory())
           walk(full);
         else if (e.isFile() && /\.(webm|zip)$/.test(e.name))
-          rels.push(join48(relDir, "e2e", relative5(dir, full)));
+          rels.push(join49(relDir, "e2e", relative6(dir, full)));
       }
     };
-    walk(join48(dir, "out"));
+    walk(join49(dir, "out"));
     return rels.length > 0 ? { rels, skipped: null } : { rels, skipped: "playwright e2e video and trace skipped: no video or trace was produced" };
   } catch (e) {
     return { rels: [], skipped: `playwright e2e video and trace skipped: ${String(e?.message ?? e).slice(0, 120)}` };
@@ -12544,22 +12599,22 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     if (!visualEvidenceEnabled(opts.env))
       return skip("LOKI_VISUAL_EVIDENCE is 0");
     const api = loadProjectApi(repoDir), boot = isMultiRoot(api) ? api.uiBoot() : null;
-    const appDir = boot ? join48(repoDir, boot.boot.cwd) : repoDir;
-    const pkgPath = join48(appDir, "package.json");
+    const appDir = boot ? join49(repoDir, boot.boot.cwd) : repoDir;
+    const pkgPath = join49(appDir, "package.json");
     let script = null;
     if (!boot) {
-      if (!existsSync28(pkgPath)) {
-        const subs = ["backend", "frontend"].filter((d) => existsSync28(join48(repoDir, d, "package.json")));
+      if (!existsSync29(pkgPath)) {
+        const subs = ["backend", "frontend"].filter((d) => existsSync29(join49(repoDir, d, "package.json")));
         const has = (d) => {
           try {
-            return pickScript(JSON.parse(readFileSync37(join48(repoDir, d, "package.json"), "utf8"))) !== null;
+            return pickScript(JSON.parse(readFileSync38(join49(repoDir, d, "package.json"), "utf8"))) !== null;
           } catch {
             return false;
           }
         };
         return skip(noRootReason(subs, subs.filter((d) => !has(d))));
       }
-      script = pickScript(JSON.parse(readFileSync37(pkgPath, "utf8")));
+      script = pickScript(JSON.parse(readFileSync38(pkgPath, "utf8")));
       if (!script)
         return skip("no dev, preview or start script");
     }
@@ -12586,20 +12641,20 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     }
     if (!await waitUp(base, left(), signal))
       return skip(aborted() ? "aborted" : `${script} server did not answer within ${Math.round(budget / 1000)}s`);
-    const evRoot = join48(runDir, "evidence");
+    const evRoot = join49(runDir, "evidence");
     if (isSymlink(evRoot))
       return skip("evidence dir is a symlink");
     mkdirSync19(evRoot, { recursive: true });
     if (pages.length > 0) {
-      const rel0 = join48("evidence", randomBytes5(6).toString("hex"));
-      mkdirSync19(join48(runDir, rel0));
+      const rel0 = join49("evidence", randomBytes5(6).toString("hex"));
+      mkdirSync19(join49(runDir, rel0));
       const rels = [];
       for (const route of [...new Set(pages.map(routeFor))].slice(0, opts.maxRoutes ?? MAX_ROUTES)) {
         if (aborted() || left() <= 0)
           break;
-        const rel = join48(rel0, `${screenName(route)}.png`);
-        const ok = await shoot(pw, ["screenshot", `${base}${route}`, join48(runDir, rel)], appDir, left(), signal);
-        if (ok && !aborted() && !isSymlink(join48(runDir, rel)) && existsSync28(join48(runDir, rel)))
+        const rel = join49(rel0, `${screenName(route)}.png`);
+        const ok = await shoot(pw, ["screenshot", `${base}${route}`, join49(runDir, rel)], appDir, left(), signal);
+        if (ok && !aborted() && !isSymlink(join49(runDir, rel)) && existsSync29(join49(runDir, rel)))
           rels.push(rel);
       }
       if (aborted())
@@ -12624,9 +12679,9 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     }
     if (aborted())
       return skip("aborted");
-    const hdir = join48(evRoot, randomBytes5(6).toString("hex"));
+    const hdir = join49(evRoot, randomBytes5(6).toString("hex"));
     mkdirSync19(hdir);
-    writeFileSync22(join48(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
+    writeFileSync22(join49(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
 `);
     return { screens: [], http: true, skipped: null };
   } catch (e) {
@@ -12655,12 +12710,12 @@ function receiptScreensProblem(receiptPath, receipt) {
     return `visual evidence failed (LOKI_VISUAL_GATE=1): ${receipt["evidence_failed"]}`;
   return receipt["evidence_screens"] === undefined ? null : checkScreens(dirname17(receiptPath), receipt["evidence_screens"]);
 }
-var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash14("sha256").update(readFileSync37(p)).digest("hex"), playwrightBin = (repoDir) => {
-  const bin = join48(repoDir, "node_modules", ".bin", "playwright");
-  return existsSync28(bin) ? bin : null;
+var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash14("sha256").update(readFileSync38(p)).digest("hex"), playwrightBin = (repoDir) => {
+  const bin = join49(repoDir, "node_modules", ".bin", "playwright");
+  return existsSync29(bin) ? bin : null;
 }, playwrightTestPkg = (repoDir) => {
-  const d = join48(repoDir, "node_modules", "@playwright", "test");
-  return existsSync28(join48(d, "package.json")) ? d : null;
+  const d = join49(repoDir, "node_modules", "@playwright", "test");
+  return existsSync29(join49(d, "package.json")) ? d : null;
 }, e2eSpecSource = (pkgDir, base, routes) => `const { test } = require(${JSON.stringify(pkgDir)});
 test("loki e2e walkthrough", async ({ page }) => {
   for (const r of ${JSON.stringify(routes)}) { await page.goto(${JSON.stringify(base)} + r); await page.waitForLoadState("load"); }
@@ -12703,7 +12758,7 @@ var init_outbox = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/pr.ts
-import { join as join49 } from "path";
+import { join as join50 } from "path";
 var DEFAULT_PUSH_SH;
 var init_pr = __esm(() => {
   init_types();
@@ -12720,19 +12775,19 @@ var init_pr = __esm(() => {
   init_run_outputs();
   init_yaml_key();
   init_outbox();
-  DEFAULT_PUSH_SH = join49(REPO_ROOT, "autonomy/lib/engine10-push.sh");
+  DEFAULT_PUSH_SH = join50(REPO_ROOT, "autonomy/lib/engine10-push.sh");
 });
 
 // ../../loki-ts/src/util/pr_lessons.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync7, readFileSync as readFileSync38, rmSync as rmSync15, writeFileSync as writeFileSync23 } from "fs";
-import { dirname as dirname18, join as join50 } from "path";
+import { existsSync as existsSync30, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync7, readFileSync as readFileSync39, rmSync as rmSync15, writeFileSync as writeFileSync23 } from "fs";
+import { dirname as dirname18, join as join51 } from "path";
 import { createHash as createHash15 } from "crypto";
 function loadLessons(repoDir) {
   const p = lessonsPath(repoDir);
-  if (!existsSync29(p))
+  if (!existsSync30(p))
     return [];
   try {
-    const j = JSON.parse(readFileSync38(p, "utf-8"));
+    const j = JSON.parse(readFileSync39(p, "utf-8"));
     return Array.isArray(j.lessons) ? j.lessons : [];
   } catch {
     return [];
@@ -12774,7 +12829,7 @@ function recordRunVerdict(repoDir, runId, verdict) {
   if (dirty)
     save(repoDir, lessons);
 }
-var lessonsPath = (repoDir) => join50(repoDir, ".loki", "memory", "semantic", "pr-lessons.json"), KINDS;
+var lessonsPath = (repoDir) => join51(repoDir, ".loki", "memory", "semantic", "pr-lessons.json"), KINDS;
 var init_pr_lessons = __esm(() => {
   init_atomic();
   init_safe_git();
@@ -12806,7 +12861,7 @@ var init_attempts = __esm(() => {
 var init_mcp_config = () => {};
 
 // ../../loki-ts/src/providers/claude_flags.ts
-import { existsSync as existsSync30, readFileSync as readFileSync39 } from "fs";
+import { existsSync as existsSync31, readFileSync as readFileSync40 } from "fs";
 import { resolve as resolvePath, dirname as dirname19 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function claudeFlagSupported(flag, helpText) {
@@ -12860,8 +12915,8 @@ function designArchetypesText() {
       ["..", "..", "references", "design-archetypes.md"]
     ]) {
       const p = resolvePath(moduleDir, ...rel);
-      if (existsSync30(p))
-        return readFileSync39(p, "utf8");
+      if (existsSync31(p))
+        return readFileSync40(p, "utf8");
     }
   } catch {}
   return "";
@@ -12945,14 +13000,14 @@ var init_providers = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/route_record.ts
-import { existsSync as existsSync31, lstatSync as lstatSync11, mkdirSync as mkdirSync21, readFileSync as readFileSync40, writeFileSync as writeFileSync24 } from "fs";
-import { join as join51 } from "path";
+import { existsSync as existsSync32, lstatSync as lstatSync11, mkdirSync as mkdirSync21, readFileSync as readFileSync41, writeFileSync as writeFileSync24 } from "fs";
+import { join as join52 } from "path";
 function loadRouteRecord(runDir) {
   try {
-    const p = join51(runDir, ROUTE_RECORD_FILE);
-    if (!existsSync31(p) || !lstatSync11(p).isFile())
+    const p = join52(runDir, ROUTE_RECORD_FILE);
+    if (!existsSync32(p) || !lstatSync11(p).isFile())
       return;
-    const v = JSON.parse(readFileSync40(p, "utf8"));
+    const v = JSON.parse(readFileSync41(p, "utf8"));
     return typeof v === "object" && v !== null && !Array.isArray(v) ? v : undefined;
   } catch {
     return;
@@ -13079,7 +13134,7 @@ var init_worker = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/package_suite.ts
-import { join as join52 } from "path";
+import { join as join53 } from "path";
 async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
   const api = loadProjectApi(repoDir);
   if (!isMultiRoot(api))
@@ -13090,7 +13145,7 @@ async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
   for (const pkg of withTests) {
     const tc = pkg.commands.test, name = `full suite: ${pkg.name}`, cmd = `(cd ${tc.cwd} && ${tc.cmd})`;
     const started = Date.now();
-    const r = await run(["bash", "-c", tc.cmd], { cwd: join52(repoDir, tc.cwd), timeoutMs: opts.timeoutMs, ...opts.path ? { env: { PATH: opts.path } } : {} });
+    const r = await run(["bash", "-c", tc.cmd], { cwd: join53(repoDir, tc.cwd), timeoutMs: opts.timeoutMs, ...opts.path ? { env: { PATH: opts.path } } : {} });
     const duration_s = (Date.now() - started) / 1000;
     if (signal.aborted) {
       checks.push({ name, cmd, result: "not_run", duration_s });
@@ -13099,7 +13154,7 @@ async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
     }
     const out2 = `${r.stdout}
 ${r.stderr}`;
-    const lr = r.exitCode === 0 || !opts.baseSha ? undefined : await harnessLoadReason({ repoDir, baseSha: opts.baseSha, out: out2, cmd: "bash", args: ["-c", tc.cmd], signal, cwd: join52(repoDir, tc.cwd), ...opts.path ? { env: { PATH: opts.path } } : {} });
+    const lr = r.exitCode === 0 || !opts.baseSha ? undefined : await harnessLoadReason({ repoDir, baseSha: opts.baseSha, out: out2, cmd: "bash", args: ["-c", tc.cmd], signal, cwd: join53(repoDir, tc.cwd), ...opts.path ? { env: { PATH: opts.path } } : {} });
     if (lr) {
       checks.push({ name, cmd, result: "not_run", duration_s });
       notProven.add(`${lr} (${name}; harness-owned)`);
@@ -13133,14 +13188,14 @@ __export(exports_deep, {
   DEFAULT_SECRET_SCAN_SH: () => DEFAULT_SECRET_SCAN_SH,
   DEFAULT_PUSH_SH: () => DEFAULT_PUSH_SH2
 });
-import { existsSync as existsSync32, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync8, rmSync as rmSync16, writeFileSync as writeFileSync25 } from "fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync8, rmSync as rmSync16, writeFileSync as writeFileSync25 } from "fs";
 import { tmpdir as tmpdir9 } from "os";
-import { join as join53 } from "path";
+import { join as join54 } from "path";
 function sessionCouncil(sessions) {
   return { async run(input, signal) {
-    const cwd = mkdtempSync8(join53(tmpdir9(), "loki-deep-council-"));
+    const cwd = mkdtempSync8(join54(tmpdir9(), "loki-deep-council-"));
     try {
-      writeFileSync25(join53(cwd, "diff.patch"), input.diff, "utf8");
+      writeFileSync25(join54(cwd, "diff.patch"), input.diff, "utf8");
       const r = await sessions.run({
         stage: "deep",
         tier: "development",
@@ -13250,7 +13305,7 @@ async function runCouncilCheck(ctx, changed, baseSha, signal, opts, checks, notP
 async function runSecretScan(ctx, changed, opts, checks, notProven) {
   const scriptPath = opts.secretScanShPath ?? DEFAULT_SECRET_SCAN_SH;
   const name = "security scan";
-  if (!existsSync32(scriptPath)) {
+  if (!existsSync33(scriptPath)) {
     checks.push({ name, cmd: "secret-scan.sh", result: "not_run", duration_s: 0 });
     notProven.add(`not run: ${name} (secret-scan.sh not found)`);
     return;
@@ -13261,7 +13316,7 @@ async function runSecretScan(ctx, changed, opts, checks, notProven) {
   }
   const inline = 'script="$1"; shift; . "$script" || exit 3; hit=0; for f in "$@"; do if _commit_scan_secret_file "$f" || _commit_path_looks_secret "$f"; then printf "%s\\n" "$f"; hit=1; fi; done; exit "$hit"';
   const started = Date.now();
-  const r = await run(["bash", "-c", inline, "_", scriptPath, ...changed.map((f) => join53(ctx.repoDir, f))], { cwd: ctx.repoDir, timeoutMs: 30000 });
+  const r = await run(["bash", "-c", inline, "_", scriptPath, ...changed.map((f) => join54(ctx.repoDir, f))], { cwd: ctx.repoDir, timeoutMs: 30000 });
   const durationS = (Date.now() - started) / 1000;
   if (r.exitCode === 3) {
     checks.push({ name, cmd: "secret-scan.sh", result: "not_run", duration_s: durationS });
@@ -13296,7 +13351,7 @@ async function postResults(ctx, opts, checks, notProven, statusState) {
   const prNumber = prUrl ? PR_NUMBER_RE.exec(prUrl)?.[1] : undefined;
   if (prNumber) {
     mkdirSync22(ctx.runDir, { recursive: true });
-    const bodyFile = join53(ctx.runDir, "deep-comment.md");
+    const bodyFile = join54(ctx.runDir, "deep-comment.md");
     writeFileSync25(bodyFile, buildCommentBody(checks, notProven, statusState), "utf8");
     const commentResult = await run(["bash", scriptPath, ...commentArgv(prNumber, bodyFile)], { cwd: ctx.repoDir, env, timeoutMs: 30000 });
     if (commentResult.exitCode !== 0)
@@ -13350,7 +13405,7 @@ async function runDeep(ctx, signal, opts = {}) {
   const sig = signReceipt(`${ctx.runId}-deep`, addendumSha256);
   const addendum = { ...addendumBody, addendum_sha256: addendumSha256, verification: { jwt: sig.jwt, kid: sig.kid } };
   mkdirSync22(ctx.runDir, { recursive: true });
-  writeFileSync25(join53(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
+  writeFileSync25(join54(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
 `);
   const pushNotProven = await postResults(ctx, opts, checks, notProvenList, statusState);
   const allNotProven = [...notProvenList, ...pushNotProven];
@@ -13394,20 +13449,20 @@ var init_deep = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/verify.ts
-import { existsSync as existsSync33, mkdtempSync as mkdtempSync9, realpathSync as realpathSync18, rmSync as rmSync17 } from "fs";
+import { existsSync as existsSync34, mkdtempSync as mkdtempSync9, realpathSync as realpathSync19, rmSync as rmSync17 } from "fs";
 import { tmpdir as tmpdir10 } from "os";
-import { dirname as dirname20, isAbsolute as isAbsolute7, join as join54, relative as relative6 } from "path";
+import { dirname as dirname20, isAbsolute as isAbsolute8, join as join55, relative as relative7 } from "path";
 function resolveTool(repoDir, bin, fallback, lastResort = fallback) {
   const inRepo = (p) => {
     try {
-      const r = relative6(realpathSync18(repoDir), realpathSync18(p));
-      return r !== "" && !r.startsWith("..") && !isAbsolute7(r);
+      const r = relative7(realpathSync19(repoDir), realpathSync19(p));
+      return r !== "" && !r.startsWith("..") && !isAbsolute8(r);
     } catch {
       return false;
     }
   };
   const venvEnv = process.env["VIRTUAL_ENV"];
-  const project = [join54(repoDir, ".venv", "bin", bin), join54(repoDir, "venv", "bin", bin), ...venvEnv && inRepo(venvEnv) ? [join54(venvEnv, "bin", bin)] : []].find(existsSync33);
+  const project = [join55(repoDir, ".venv", "bin", bin), join55(repoDir, "venv", "bin", bin), ...venvEnv && inRepo(venvEnv) ? [join55(venvEnv, "bin", bin)] : []].find(existsSync34);
   return project ? [project, "project"] : [Bun.which(fallback) ? fallback : lastResort, "system"];
 }
 function runnerCmd(t, repoDir) {
@@ -13504,6 +13559,8 @@ async function runCheck(ctx, name, cmd, args, signal, checks, opts = {}) {
   }
   const reason = c.reason;
   const check = { name, cmd: cmdStr, result, duration_s: (Date.now() - started) / 1000, ...result === "fail" ? { first_error: firstError(attempt.out), ids: failIds(attempt.out) } : result === "pass" && kind === "test" ? { n: c.n ?? 0, sk: skipped(attempt.out) } : {}, ...reason ? { reason } : {}, ...c.owner ? { owner: "harness" } : {}, ...opts.interpreter ? { interpreter: opts.interpreter } : {} };
+  if (result === "fail" && !opts.opaque && !isHold(check))
+    excerpts.set(check, failureExcerpt(attempt.out, ctx.repoDir));
   checks.push(check);
   if (opts.opaque && check.result !== "pass" && check.reason)
     recordHoldoutTriage(ctx.runDir, { check: name, result: check.result, reason: check.reason });
@@ -13520,7 +13577,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal)
   const sus = pairs.filter(({ c }) => rel.has(c.name) && c.result === "pass");
   if (!(un.some(({ c }) => c.result === "fail" && c.ids?.length) || sus.length) || signal.aborted)
     return out2;
-  const dir = mkdtempSync9(join54(tmpdir10(), "e10-base-"));
+  const dir = mkdtempSync9(join55(tmpdir10(), "e10-base-"));
   const git3 = (args) => {
     safeGit(ctx.repoDir, args, { stdio: "ignore", repoDrivers: true });
   };
@@ -13558,7 +13615,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal)
   return out2;
 }
 function isLokiModeRepo(repoDir) {
-  return existsSync33(join54(repoDir, "scripts", "select-tests.sh"));
+  return existsSync34(join55(repoDir, "scripts", "select-tests.sh"));
 }
 async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   const { api, ...runOpts } = opts;
@@ -13580,9 +13637,9 @@ async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   }
   for (const g of groupByPackage(api, ctx.repoDir, changed.filter((f) => /\.(ts|tsx|js|jsx)$/.test(f)))) {
     const sfx = g.root === "." ? "" : `:${g.root}`, co = g.root === "." ? opts : { ...opts, cwd: g.cwd };
-    if (existsSync33(join54(g.cwd, "tsconfig.json")))
+    if (existsSync34(join55(g.cwd, "tsconfig.json")))
       await runCheck(ctx, `lint:tsc${sfx}`, "npx", ["tsc", "--noEmit", "-p", "."], signal, checks, { ...co, kind: "static" });
-    if (ESLINT_CONFIGS.some((f) => existsSync33(join54(g.cwd, f)))) {
+    if (ESLINT_CONFIGS.some((f) => existsSync34(join55(g.cwd, f)))) {
       const c = await runCheck(ctx, `lint:eslint${sfx}`, "npx", ["eslint", ...g.rel], signal, checks, { ...co, kind: "static" });
       if (await excuseLint(ctx, signal, c, "eslint", "npx", ["eslint"], g.cwd, g.rel, co))
         pre.push(c.name);
@@ -13590,14 +13647,14 @@ async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   }
   return pre;
 }
-var CHECK_TIMEOUT_MS = 60000, isHold = (c) => isHoldoutCheck(c.name), pubHold = (c) => ({ name: "holdout", cmd: "holdout", result: c.result, duration_s: c.duration_s, ...c.n !== undefined ? { n: c.n } : {}, ...c.sk !== undefined ? { sk: c.sk } : {}, ...c.owner ? { owner: c.owner, reason: "holdout infrastructure failure" } : {} }), testCheckName = (t) => `${t.runner}:${t.path}`, dedupeTests = (tests) => [...new Map(tests.map((t) => [`${t.runner}:${t.path}`, t])).values()], CODE_EXT, ESLINT_CONFIGS, excuseLint = (ctx, signal, c, tool, cmd, prefix, cwd, rel, opts) => c.result !== "fail" || signal.aborted ? Promise.resolve(false) : staticPreExisting(tool, prefix, rel, { run: async (a, stdin) => {
+var CHECK_TIMEOUT_MS = 60000, excerpts, isHold = (c) => isHoldoutCheck(c.name), pubHold = (c) => ({ name: "holdout", cmd: "holdout", result: c.result, duration_s: c.duration_s, ...c.n !== undefined ? { n: c.n } : {}, ...c.sk !== undefined ? { sk: c.sk } : {}, ...c.owner ? { owner: c.owner, reason: "holdout infrastructure failure" } : {} }), testCheckName = (t) => `${t.runner}:${t.path}`, dedupeTests = (tests) => [...new Map(tests.map((t) => [`${t.runner}:${t.path}`, t])).values()], CODE_EXT, ESLINT_CONFIGS, excuseLint = (ctx, signal, c, tool, cmd, prefix, cwd, rel, opts) => c.result !== "fail" || signal.aborted ? Promise.resolve(false) : staticPreExisting(tool, prefix, rel, { run: async (a, stdin) => {
   if (signal.aborted)
     return null;
   const r = await runOnce2(cmd, a, cwd, AbortSignal.any([signal, AbortSignal.timeout(opts.timeoutMs ?? CHECK_TIMEOUT_MS)]), { ...opts, ...stdin !== undefined ? { stdin } : {} });
   return r.missing || r.cut ? null : r;
 }, base: (f) => {
   try {
-    return safeGit(ctx.repoDir, ["show", `${ctx.baseSha}:${relative6(ctx.repoDir, join54(cwd, f))}`], { stdio: ["ignore", "pipe", "ignore"] });
+    return safeGit(ctx.repoDir, ["show", `${ctx.baseSha}:${relative7(ctx.repoDir, join55(cwd, f))}`], { stdio: ["ignore", "pipe", "ignore"] });
   } catch {
     return null;
   }
@@ -13620,6 +13677,7 @@ var init_verify = __esm(() => {
   init_check_result();
   init_check_result();
   init_runner_config();
+  excerpts = new WeakMap;
   CODE_EXT = /\.(?:[cm]?[jt]sx?|py|go)$/;
   ESLINT_CONFIGS = [".eslintrc", ".eslintrc.json", ".eslintrc.js", ".eslintrc.cjs", "eslint.config.js", "eslint.config.mjs", "eslint.config.cjs"];
   verifyStage = {
@@ -13655,7 +13713,7 @@ var init_verify = __esm(() => {
       const impacted = ctx.tests.impacted(map, changed);
       const changedTestFiles = map.tests.filter((t) => changed.includes(t.path));
       const wall = ctx.outputs().wall ?? {};
-      const wallPaths = new Set((wall.files ?? []).map((f) => isAbsolute7(f.path) ? relative6(ctx.repoDir, f.path) : f.path));
+      const wallPaths = new Set((wall.files ?? []).map((f) => isAbsolute8(f.path) ? relative7(ctx.repoDir, f.path) : f.path));
       const wallTests = map.tests.filter((t) => wallPaths.has(t.path));
       const intake = ctx.outputs().intake, relevant2 = ctx.tests.impacted(map, namedFiles(intake?.task ?? "", loadRepoMap(intake?.repomap_ref)));
       const tests = dedupeTests([...impacted, ...changedTestFiles, ...wallTests, ...relevant2]);
@@ -13730,7 +13788,13 @@ var init_verify = __esm(() => {
       const covered = (f) => ctx.tests.impacted(map, [f]).some((t) => checks.some((c) => c.name === testCheckName(t) && hasExecutedProof([c])));
       const uncoveredChanged = changed.filter((f) => CODE_EXT.test(f) && !isTestFile(f) && !wallPaths.has(f) && !cfgChanged.includes(f) && !covered(f));
       const flaky = checks.filter((c) => c.result === "flaky").map((c) => isHold(c) ? "holdout" : c.name);
-      const failuresGrouped = checks.filter((c) => c.result === "fail" && !preRed.names.includes(c.name) && !isHold(c)).map((c) => ({ signature: c.first_error ? `${c.name} ${c.first_error}` : c.name, count: 1, sample: c.cmd }));
+      let excerptLeft = EXCERPT_TOTAL_CAP;
+      const failuresGrouped = checks.filter((c) => c.result === "fail" && !preRed.names.includes(c.name) && !isHold(c)).map((c) => {
+        const x = isHold(c) ? "" : truncateBytes(excerpts.get(c) ?? "", Math.max(0, excerptLeft));
+        excerptLeft -= Buffer.byteLength(x);
+        return { signature: c.first_error ? `${c.name} ${c.first_error}` : c.name, count: 1, sample: x ? `${c.cmd}
+${x}` : c.cmd };
+      });
       const pub = checks.map((c) => isHold(c) ? pubHold(c) : c), holdoutFailed = checks.filter((c) => c.result === "fail" && isHold(c) && !preRed.names.includes(c.name)).length;
       const inBase = (f) => {
         try {
@@ -13755,8 +13819,8 @@ var init_verify = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/conventions.ts
-import { existsSync as existsSync34, readdirSync as readdirSync17, readFileSync as readFileSync41 } from "fs";
-import { dirname as dirname21, join as join55 } from "path";
+import { existsSync as existsSync35, readdirSync as readdirSync18, readFileSync as readFileSync42 } from "fs";
+import { dirname as dirname21, join as join56 } from "path";
 function parseJsonc(text2) {
   let out2 = "", i = 0;
   while (i < text2.length) {
@@ -13791,25 +13855,25 @@ function moduleOf(file, depth = 0) {
   const ext = typeof j.extends === "string" ? j.extends : null;
   if (!ext || !ext.startsWith("."))
     return null;
-  const next = join55(dirname21(file), ext.endsWith(".json") ? ext : `${ext}.json`);
-  return existsSync34(next) ? moduleOf(next, depth + 1) : null;
+  const next = join56(dirname21(file), ext.endsWith(".json") ? ext : `${ext}.json`);
+  return existsSync35(next) ? moduleOf(next, depth + 1) : null;
 }
 function readPackageConventions(pkgDir, runner = null) {
   let names = [];
   try {
-    names = readdirSync17(pkgDir).filter((f) => f.endsWith(".json")).sort((x, y) => x.length - y.length || x.localeCompare(y));
+    names = readdirSync18(pkgDir).filter((f) => f.endsWith(".json")).sort((x, y) => x.length - y.length || x.localeCompare(y));
   } catch {
     return null;
   }
   let packageType = null, tsModule = null;
   for (const n2 of names) {
-    const j = readJson4(join55(pkgDir, n2));
+    const j = readJson4(join56(pkgDir, n2));
     if (!j)
       continue;
     if (packageType === null && typeof j.type === "string" && typeof j.name === "string")
       packageType = j.type;
     if (tsModule === null && j.compilerOptions !== undefined)
-      tsModule = moduleOf(join55(pkgDir, n2));
+      tsModule = moduleOf(join56(pkgDir, n2));
   }
   if (packageType === null && tsModule === null)
     return null;
@@ -13831,7 +13895,7 @@ function conventionViolation(c, fileName, content) {
 }
 var readJson4 = (p) => {
   try {
-    const v = parseJsonc(readFileSync41(p, "utf8"));
+    const v = parseJsonc(readFileSync42(p, "utf8"));
     return v && typeof v === "object" && !Array.isArray(v) ? v : null;
   } catch {
     return null;
@@ -13841,15 +13905,15 @@ var init_conventions = () => {};
 
 // ../../loki-ts/src/engine10/stages/wall.ts
 import { spawnSync as spawnSync4 } from "child_process";
-import { existsSync as existsSync35, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync10, readFileSync as readFileSync42, readdirSync as readdirSync18, realpathSync as realpathSync19, rmSync as rmSync18, writeFileSync as writeFileSync26 } from "fs";
+import { existsSync as existsSync36, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync10, readFileSync as readFileSync43, readdirSync as readdirSync19, realpathSync as realpathSync20, rmSync as rmSync18, writeFileSync as writeFileSync26 } from "fs";
 import { tmpdir as tmpdir11 } from "os";
-import { dirname as dirname22, isAbsolute as isAbsolute8, join as join56, relative as relative7 } from "path";
+import { dirname as dirname22, isAbsolute as isAbsolute9, join as join57, relative as relative8 } from "path";
 function pytestCollectionIsRed(output, repoDir) {
   if (/ModuleNotFoundError/.test(output))
     return false;
   const real2 = (p) => {
     try {
-      return realpathSync19(isAbsolute8(p) ? p : join56(repoDir, p));
+      return realpathSync20(isAbsolute9(p) ? p : join57(repoDir, p));
     } catch {
       return null;
     }
@@ -13886,7 +13950,7 @@ function pytestCollectionIsRed(output, repoDir) {
 }
 function moduleUnderRepo(repoDir, name) {
   const rel = name.replace(/\./g, "/");
-  return existsSync35(join56(repoDir, `${rel}.py`)) || existsSync35(join56(repoDir, rel, "__init__.py"));
+  return existsSync36(join57(repoDir, `${rel}.py`)) || existsSync36(join57(repoDir, rel, "__init__.py"));
 }
 function pytestExit1IsRed(output) {
   if (/^!+ _pytest\.outcomes\.Exit\b/m.test(output))
@@ -13985,10 +14049,10 @@ ${acceptance.map((a) => `Acceptance: ${a}`).join(`
 function loadTaskText(ctx, fromPrior) {
   if (fromPrior)
     return fromPrior;
-  const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join56(ctx.runDir, "issue.json");
-  if (existsSync35(issueJsonPath)) {
+  const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join57(ctx.runDir, "issue.json");
+  if (existsSync36(issueJsonPath)) {
     try {
-      const issue = JSON.parse(readFileSync42(issueJsonPath, "utf8"));
+      const issue = JSON.parse(readFileSync43(issueJsonPath, "utf8"));
       const text2 = [issue.title, issue.body].filter((s) => typeof s === "string" && s.length > 0).join(`
 
 `);
@@ -14000,7 +14064,7 @@ function loadTaskText(ctx, fromPrior) {
 }
 function wallTargetDir(repoDir, existingTests) {
   const first = existingTests[0];
-  return first ? join56(repoDir, dirname22(first.path)) : join56(repoDir, "tests");
+  return first ? join57(repoDir, dirname22(first.path)) : join57(repoDir, "tests");
 }
 function guessRunner(fileName, runners) {
   if (fileName.endsWith(".py"))
@@ -14028,14 +14092,16 @@ async function wallAuthor(ctx, signal) {
   }
   if (testMap && runners.length === 0 && !(repoMap?.files ?? []).some((p) => /\.(py|go)$/.test(p)))
     return done({ status: "skipped", data: { size: sz.size, files: [], no_runner: true }, reason: "no runnable test command detected: the Wall cannot write a runnable check" });
+  if (testMap && (runners.length === 0 ? (repoMap?.files ?? []).some((p) => p.endsWith(".py")) && !(repoMap?.files ?? []).some((p) => p.endsWith(".go")) : runners.every((r) => r === "pytest")) && projectInterpreter(ctx.repoDir) === "system" && wallHoldoutRatio() === 0)
+    return done({ status: "skipped", data: { size: sz.size, files: [], no_interpreter: true, not_proven: ["Wall skipped: no project test interpreter"] }, reason: "Wall skipped: no project test interpreter" });
   const tree = prior.intake?.tree;
   const repomapText = repoMapText(ctx.repoDir, tree, repomapRef, WALL_MAP_MAX_LINES);
-  const targetDir = wallTargetDir(ctx.repoDir, existingTests), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative7(ctx.repoDir, targetDir)}/x`);
-  const conv2 = readPackageConventions(join56(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
-  const cwd = mkdtempSync10(join56(tmpdir11(), "loki-e15-wall-"));
+  const targetDir = wallTargetDir(ctx.repoDir, existingTests), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative8(ctx.repoDir, targetDir)}/x`);
+  const conv2 = readPackageConventions(join57(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
+  const cwd = mkdtempSync10(join57(tmpdir11(), "loki-e15-wall-"));
   const wm = wallManifestFor(ctx.repoDir, tree, task);
   for (const [n2, c] of [["task.md", task], ["repomap.txt", repomapText], ...wm ? [["wall_manifest.txt", wm.text]] : []])
-    writeFileSync26(join56(cwd, n2), c, "utf8");
+    writeFileSync26(join57(cwd, n2), c, "utf8");
   const session = await ctx.sessions.run({
     stage: "wall",
     brief: buildWallBrief(task, repomapText, runners, !!wm, conventionsBrief(conv2), unitSpec()?.acceptance ?? []),
@@ -14050,15 +14116,15 @@ async function wallAuthor(ctx, signal) {
     rmSync18(cwd, { recursive: true, force: true });
     return done({ status: "failed", data: {}, reason: "wall session aborted, killed, or timed out", killed: true });
   }
-  const all = readdirSync18(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !conventionViolation(conv2, n2, readFileSync42(join56(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
-  const sealedDir = join56(ctx.runDir, "wall");
+  const all = readdirSync19(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !conventionViolation(conv2, n2, readFileSync43(join57(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
+  const sealedDir = join57(ctx.runDir, "wall");
   if (generated.length > 0)
     mkdirSync23(sealedDir, { recursive: true });
   const contents = new Map;
   const discarded = [];
   for (const name of generated) {
-    const content = readFileSync42(join56(cwd, name), "utf8"), bad = conventionViolation(conv2, name, content);
-    writeFileSync26(join56(sealedDir, name), content, "utf8");
+    const content = readFileSync43(join57(cwd, name), "utf8"), bad = conventionViolation(conv2, name, content);
+    writeFileSync26(join57(sealedDir, name), content, "utf8");
     if (bad)
       discarded.push({ file: name, reason: `${bad}; wall test did not compile under the package config` });
     else
@@ -14078,18 +14144,18 @@ function installWall(ctx, a, baseDir, opts = {}) {
     const content = contents.get(name);
     if (content === undefined)
       continue;
-    const dest = join56(targetDir, name), runner = guessRunner(name, runners);
+    const dest = join57(targetDir, name), runner = guessRunner(name, runners);
     writeFileSync26(dest, content, "utf8");
     sealedFiles.push({ path: dest, sha256: sha2562(content) });
     readOnlyFiles.push({ path: dest, content });
     if (runner)
-      wallTests.push({ runner, path: relative7(ctx.repoDir, dest) });
+      wallTests.push({ runner, path: relative8(ctx.repoDir, dest) });
   }
   ctx.wallSealed = true;
   ctx.emit("wall.sealed", "wall", { files: sealedFiles, ...a.manifestSha256 ? { manifest_sha256: a.manifestSha256 } : {} });
   const baseRunner = opts.baseRunner ?? new RealBaseTestRunner, baseRun = { pass: 0, fail: 0, not_run: discarded.length }, notRunFiles = [];
   for (const t of wallTests) {
-    const r = baseRunner.run(baseDir, [t]), abs = join56(ctx.repoDir, t.path);
+    const r = baseRunner.run(baseDir, [t]), abs = join57(ctx.repoDir, t.path);
     baseRun.pass += r.pass;
     baseRun.fail += r.fail;
     baseRun.not_run += r.not_run ?? 0;
@@ -14130,6 +14196,7 @@ var init_wall = __esm(() => {
   init_seal();
   init_holdout();
   init_verify();
+  init_testmap();
   init_resolve();
   init_check_result();
   init_conventions();
@@ -14143,15 +14210,15 @@ var init_wall = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/discard.ts
-import { chmodSync as chmodSync5, closeSync as closeSync9, lstatSync as lstatSync12, mkdirSync as mkdirSync24, openSync as openSync9, readFileSync as readFileSync43, realpathSync as realpathSync20, rmdirSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync27 } from "fs";
-import { dirname as dirname23, join as join57, relative as relative8, sep as sep11 } from "path";
+import { chmodSync as chmodSync5, closeSync as closeSync9, lstatSync as lstatSync12, mkdirSync as mkdirSync24, openSync as openSync9, readFileSync as readFileSync44, realpathSync as realpathSync21, rmdirSync, unlinkSync as unlinkSync6, writeFileSync as writeFileSync27 } from "fs";
+import { dirname as dirname23, join as join58, relative as relative9, sep as sep12 } from "path";
 function safeRestore(repoDir, f, want, mode) {
-  const root = realpathSync20(repoDir), fp = join57(root, f), rel = relative8(root, dirname23(fp));
+  const root = realpathSync21(repoDir), fp = join58(root, f), rel = relative9(root, dirname23(fp));
   if (rel.startsWith(".."))
     throw new Error("outside repo");
   let cur = root;
-  for (const part of rel === "" ? [] : rel.split(sep11)) {
-    cur = join57(cur, part);
+  for (const part of rel === "" ? [] : rel.split(sep12)) {
+    cur = join58(cur, part);
     let st2;
     try {
       st2 = lstatSync12(cur);
@@ -14168,7 +14235,7 @@ function safeRestore(repoDir, f, want, mode) {
   } catch {
     st = null;
   }
-  if (st?.isFile() && readFileSync43(fp).equals(want)) {
+  if (st?.isFile() && readFileSync44(fp).equals(want)) {
     chmodSync5(fp, mode);
     return;
   }
@@ -14206,7 +14273,7 @@ async function discardIfSatisfied(git3, base, o, staged, keep, repoDir) {
     return { status: "failed", data: {}, reason: "already-satisfied discard failed" };
   const notProven = [];
   for (const [f, v] of Object.entries(o.intake?.preexisting_untracked_blobs ?? {})) {
-    const fp = join57(repoDir, f);
+    const fp = join58(repoDir, f);
     try {
       if (v.startsWith("!")) {
         const st = lstatSync12(fp);
@@ -14225,7 +14292,7 @@ async function discardIfSatisfied(git3, base, o, staged, keep, repoDir) {
       try {
         let m = 420;
         try {
-          const l = lstatSync12(join57(repoDir, f));
+          const l = lstatSync12(join58(repoDir, f));
           if (l.isFile())
             m = l.mode & 511;
         } catch {}
@@ -14269,7 +14336,7 @@ var init_commit_filter = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/scope.ts
-import { basename as basename20, dirname as dirname25 } from "path";
+import { basename as basename21, dirname as dirname25 } from "path";
 function contractText(o) {
   const c = o.intake?.contract_snapshot?.contract;
   return Array.isArray(c?.criteria) ? c.criteria.map((x) => typeof x?.text === "string" ? x.text : "").join(`
@@ -14284,7 +14351,7 @@ function outsideScope(o, staged) {
 ${typeof o.intake?.task === "string" ? o.intake.task : ""}
 ${contractText(o)}`, pre = o.intake?.preexisting_dirty ?? {};
   const toks = surfaceTokens(text2), plannedDirs = new Set(rel.map((r) => dirname25(r)).filter((d) => d !== "."));
-  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename20(f)) && !plannedDirs.has(dirname25(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
+  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename21(f)) && !plannedDirs.has(dirname25(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
 }
 function flagOutsideScope(o, staged) {
   const unit = unitFlags(staged, process.env, o.intake?.preexisting_dirty ?? {});
@@ -14299,14 +14366,14 @@ var init_scope2 = __esm(() => {
 });
 
 // ../../loki-ts/src/council/role_agents.ts
-import { existsSync as existsSync36, readdirSync as readdirSync19, readFileSync as readFileSync44 } from "fs";
+import { existsSync as existsSync37, readdirSync as readdirSync20, readFileSync as readFileSync45 } from "fs";
 import { homedir as homedir9 } from "os";
-import { join as join58 } from "path";
+import { join as join59 } from "path";
 function agentDirs(repoDir, env = process.env) {
-  return [env["LOKI_AGENTS_PROJECT_DIR"] || join58(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join58(env["XDG_CONFIG_HOME"] || join58(homedir9(), ".config"), "loki", "agents")];
+  return [env["LOKI_AGENTS_PROJECT_DIR"] || join59(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join59(env["XDG_CONFIG_HOME"] || join59(homedir9(), ".config"), "loki", "agents")];
 }
 function parseAgent(file, stem2) {
-  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync44(file, "utf8"));
+  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync45(file, "utf8"));
   if (!m)
     return null;
   const body = m[2].trim();
@@ -14320,18 +14387,18 @@ function parseAgent(file, stem2) {
 }
 function loadRoleAgent(repoDir, role, env = process.env) {
   for (const d of agentDirs(repoDir, env)) {
-    if (!existsSync36(d))
+    if (!existsSync37(d))
       continue;
     let names;
     try {
-      names = readdirSync19(d).filter((n2) => n2.endsWith(".md") && !n2.startsWith(".")).sort();
+      names = readdirSync20(d).filter((n2) => n2.endsWith(".md") && !n2.startsWith(".")).sort();
     } catch {
       continue;
     }
     const ordered = [...names.filter((n2) => n2 === `${role}.md`), ...names.filter((n2) => n2 !== `${role}.md`)];
     for (const n2 of ordered) {
       try {
-        const a = parseAgent(join58(d, n2), n2.slice(0, -3));
+        const a = parseAgent(join59(d, n2), n2.slice(0, -3));
         if (a && a.role === role)
           return a;
       } catch {}
@@ -14349,7 +14416,7 @@ var init_role_agents = __esm(() => {
 
 // ../../loki-ts/src/util/child_ledger.ts
 import { appendFileSync as appendFileSync4, mkdirSync as mkdirSync25 } from "fs";
-import { join as join59 } from "path";
+import { join as join60 } from "path";
 function unmeasuredRecord(phase, model, source) {
   return { phase, model, input_tokens: 0, output_tokens: 0, cache_creation_tokens: 0, cache_read_tokens: 0, source, cost_status: "unmeasured" };
 }
@@ -14374,9 +14441,9 @@ function recordFromClaudeResult(phase, payload, source = "claude-json") {
 }
 function appendChildLedger(lokiDir2, rec2) {
   try {
-    const dir = join59(lokiDir2, "metrics");
+    const dir = join60(lokiDir2, "metrics");
     mkdirSync25(dir, { recursive: true });
-    appendFileSync4(join59(dir, "child-sessions.jsonl"), `${JSON.stringify(rec2)}
+    appendFileSync4(join60(dir, "child-sessions.jsonl"), `${JSON.stringify(rec2)}
 `);
     return true;
   } catch {
@@ -14406,14 +14473,14 @@ var init_child_ledger = __esm(() => {
 });
 
 // ../../loki-ts/src/util/run_summary.ts
-import { existsSync as existsSync37, mkdirSync as mkdirSync26, readFileSync as readFileSync45, renameSync as renameSync11, statSync as statSync18, writeFileSync as writeFileSync28 } from "fs";
-import { join as join60 } from "path";
+import { existsSync as existsSync38, mkdirSync as mkdirSync26, readFileSync as readFileSync46, renameSync as renameSync11, statSync as statSync18, writeFileSync as writeFileSync28 } from "fs";
+import { join as join61 } from "path";
 function readRiskRecord(repoDir, sinceMs = 0) {
   try {
-    const p = join60(repoDir, ".loki", "state", "risk-tier.json");
+    const p = join61(repoDir, ".loki", "state", "risk-tier.json");
     if (statSync18(p).mtimeMs < sinceMs)
       return null;
-    const r = JSON.parse(readFileSync45(p, "utf8"));
+    const r = JSON.parse(readFileSync46(p, "utf8"));
     return r && typeof r === "object" ? r : null;
   } catch {
     return null;
@@ -14427,8 +14494,8 @@ var init_run_summary = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/xreview.ts
-import { existsSync as existsSync38, readFileSync as readFileSync46 } from "fs";
-import { join as join61 } from "path";
+import { existsSync as existsSync39, readFileSync as readFileSync47 } from "fs";
+import { join as join62 } from "path";
 function minVerdict(verdict, review) {
   const ceiling = review?.level === "block" ? "PARTIAL" : verdict;
   return RANK3[ceiling] < RANK3[verdict] ? ceiling : verdict;
@@ -14441,11 +14508,11 @@ function explicitReview(repoDir, env) {
   if (flag && isOff(ev))
     return "off";
   for (const f of ["loki.yaml", "loki.yml"]) {
-    const p = join61(repoDir, f);
-    if (!existsSync38(p))
+    const p = join62(repoDir, f);
+    if (!existsSync39(p))
       continue;
     try {
-      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync46(p, "utf8"));
+      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync47(p, "utf8"));
       const v = asProvider(m?.[1]);
       if (v)
         return v;
@@ -14527,7 +14594,7 @@ Review ONLY the diff below. Do not modify files.` : "You are an independent code
   try {
     if (p === "claude")
       await ensureClaudeHelpCache();
-    const r = await withChildLedger(run, join61(ctx.repoDir, ".loki"), "xreview")(reviewArgv(p, prompt, process.env, p === "claude" ? agent?.model : undefined), { cwd: ctx.repoDir, timeoutMs: TIMEOUT_MS });
+    const r = await withChildLedger(run, join62(ctx.repoDir, ".loki"), "xreview")(reviewArgv(p, prompt, process.env, p === "claude" ? agent?.model : undefined), { cwd: ctx.repoDir, timeoutMs: TIMEOUT_MS });
     if (r.exitCode !== 0)
       return { provider: p, level: "not_run", notes: [`cross-review not run: ${p} exited ${r.exitCode}`] };
     return parseReview(p, r.stdout);
@@ -14621,8 +14688,8 @@ See also: loki cost --detail (what a run ALREADY spent)
 });
 
 // ../../loki-ts/src/features/contract.ts
-import { existsSync as existsSync39, lstatSync as lstatSync13, mkdirSync as mkdirSync27, readFileSync as readFileSync47, rmSync as rmSync19, writeFileSync as writeFileSync29 } from "fs";
-import { dirname as dirname26, join as join62 } from "path";
+import { existsSync as existsSync40, lstatSync as lstatSync13, mkdirSync as mkdirSync27, readFileSync as readFileSync48, rmSync as rmSync19, writeFileSync as writeFileSync29 } from "fs";
+import { dirname as dirname26, join as join63 } from "path";
 import { createHash as createHash16 } from "crypto";
 function contractEnabled(env = process.env) {
   return env["LOKI_CONTRACT"] !== "0";
@@ -14654,7 +14721,7 @@ function untracedLines(trace) {
   return trace.criteria.filter((c) => c.status === "no_match").map((c) => `contract ${sanitizeCriterion(c.id)} untraced (no keyword match in changed files): ${sanitizeCriterion(c.text)}`);
 }
 function contractPath(repoDir) {
-  return join62(repoDir, ".loki", "contract.json");
+  return join63(repoDir, ".loki", "contract.json");
 }
 function readContract(repoDir) {
   const p = contractPath(repoDir);
@@ -14670,7 +14737,7 @@ function readContract(repoDir) {
     return { contract: null, notes: ["contract unreadable: too large"], sha256: null };
   let raw2;
   try {
-    raw2 = readFileSync47(p);
+    raw2 = readFileSync48(p);
   } catch {
     return { contract: null, notes: ["contract unreadable: read failed"], sha256: null };
   }
@@ -14739,17 +14806,17 @@ var init_contract = __esm(() => {
   init_safe_git();
   STOP2 = new Set(["the", "and", "for", "with", "that", "this", "must", "should", "shall", "when", "then", "are", "was", "all", "any", "can", "not", "has", "have", "from", "into", "each", "user", "users"]);
   MAX_CONTRACT_BYTES = 1024 * 1024;
-  REQ_MAP_REL = join62(".loki", "state", "requirements-map.json");
+  REQ_MAP_REL = join63(".loki", "state", "requirements-map.json");
   REQ_STOP = new Set(["with", "that", "this", "from", "have", "will", "should", "must", "when", "then", "into", "each", "every", "user", "users", "page", "able", "allow", "support", "ensure", "using", "their", "there", "which", "shall"]);
 });
 
 // ../../loki-ts/src/features/speed/seal_group.ts
 import { createHash as createHash17 } from "crypto";
-import { existsSync as existsSync40, mkdirSync as mkdirSync28, readdirSync as readdirSync20, readFileSync as readFileSync48, renameSync as renameSync12, statSync as statSync19, writeFileSync as writeFileSync30 } from "fs";
-import { dirname as dirname27, join as join63 } from "path";
+import { existsSync as existsSync41, mkdirSync as mkdirSync28, readdirSync as readdirSync21, readFileSync as readFileSync49, renameSync as renameSync12, statSync as statSync19, writeFileSync as writeFileSync30 } from "fs";
+import { dirname as dirname27, join as join64 } from "path";
 function sealGroup(runDir, rh) {
-  const manifestPath = join63(runDir, "group", "manifest.json");
-  if (!existsSync40(manifestPath))
+  const manifestPath = join64(runDir, "group", "manifest.json");
+  if (!existsSync41(manifestPath))
     return { section: undefined, notProven: [], problems: 0, allUnitsPass: true };
   const notProven = [];
   let problems = 0;
@@ -14773,10 +14840,10 @@ function sealGroup(runDir, rh) {
       return fail(`unit ${index2} has an invalid, duplicate or case-colliding id`);
     seen.add(id);
     seenLower.add(id.toLowerCase());
-    const dir = join63(unitsDir(runDir), id), rp = join63(dir, "receipt.json"), ep = join63(dir, "events.jsonl");
+    const dir = join64(unitsDir(runDir), id), rp = join64(dir, "receipt.json"), ep = join64(dir, "events.jsonl");
     let bytes;
     try {
-      bytes = readFileSync48(rp);
+      bytes = readFileSync49(rp);
     } catch {
       return fail(`unit ${id} sub-receipt missing`);
     }
@@ -14793,7 +14860,7 @@ function sealGroup(runDir, rh) {
       unit_id: id,
       sub_receipt_sha256: sha3(bytes),
       receipt_sha256: sub["receipt_sha256"],
-      events_file_sha256: existsSync40(ep) ? sha3(readFileSync48(ep)) : null,
+      events_file_sha256: existsSync41(ep) ? sha3(readFileSync49(ep)) : null,
       verdict,
       goal: text2(u["goal"], 200),
       files: (Array.isArray(u["files"]) ? u["files"] : []).map((f) => text2(f, 200)).filter(Boolean).slice(0, 50),
@@ -14818,7 +14885,7 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
   const bad = (reason) => ({ verdict: "TAMPERED", reason: `group: ${reason}` });
   const g = receipt["group"];
   if (g === undefined)
-    return existsSync40(join63(runDir, "group", "manifest.json")) ? bad("group directory present but the receipt has no group section") : null;
+    return existsSync41(join64(runDir, "group", "manifest.json")) ? bad("group directory present but the receipt has no group section") : null;
   if (!isObj10(g) || !ID_RE.test(String(g["group_id"] ?? "")) || !Array.isArray(g["units"]) || g["units"].length === 0)
     return bad("group section malformed");
   const entries = g["units"];
@@ -14830,20 +14897,20 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
     return bad("unit directories do not match the receipt (missing or extra unit)");
   let unchecked = null;
   for (let i = 0;i < entries.length; i++) {
-    const e = entries[i], id = ids[i], dir = join63(unitsDir(runDir), id), rp = join63(dir, "receipt.json"), ep = join63(dir, "events.jsonl");
+    const e = entries[i], id = ids[i], dir = join64(unitsDir(runDir), id), rp = join64(dir, "receipt.json"), ep = join64(dir, "events.jsonl");
     if (e["index"] !== i)
       return bad(`unit ${id} is out of order (index ${String(e["index"])} at position ${i})`);
     let bytes;
     try {
       if (!statSync19(dir).isDirectory())
         return bad(`unit ${id} is not a directory`);
-      bytes = readFileSync48(rp);
+      bytes = readFileSync49(rp);
     } catch {
       return bad(`unit ${id} sub-receipt missing`);
     }
     if (sha3(bytes) !== e["sub_receipt_sha256"])
       return bad(`unit ${id} sub-receipt does not match its recorded hash`);
-    const evSha = existsSync40(ep) ? sha3(readFileSync48(ep)) : null;
+    const evSha = existsSync41(ep) ? sha3(readFileSync49(ep)) : null;
     if (evSha !== (e["events_file_sha256"] ?? null))
       return bad(`unit ${id} events.jsonl does not match its recorded hash`);
     const sub = readJson5(rp);
@@ -14866,15 +14933,15 @@ function compositeVerdict(childVerdicts) {
   const failed2 = childVerdicts.filter((v) => v === "FAILED" || !["VERIFIED", "ALREADY_SATISFIED", "PARTIAL", "SPEC_CONFLICT"].includes(v)).length;
   return capGroupVerdict(base, { section: undefined, notProven: [], problems: failed2, allUnitsPass: childVerdicts.every((v) => PASSING.has(v)) });
 }
-var ID_RE, PASSING, sha3 = (b) => createHash17("sha256").update(b).digest("hex"), isObj10 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), text2 = (v, cap) => typeof v === "string" ? v.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0, unitsDir = (runDir) => join63(runDir, "group", "units"), readJson5 = (p) => {
+var ID_RE, PASSING, sha3 = (b) => createHash17("sha256").update(b).digest("hex"), isObj10 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), text2 = (v, cap) => typeof v === "string" ? v.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0, unitsDir = (runDir) => join64(runDir, "group", "units"), readJson5 = (p) => {
   try {
-    return JSON.parse(readFileSync48(p, "utf8"));
+    return JSON.parse(readFileSync49(p, "utf8"));
   } catch {
     return;
   }
 }, dirNames = (d) => {
   try {
-    return readdirSync20(d).filter((n3) => !n3.startsWith(".")).sort();
+    return readdirSync21(d).filter((n3) => !n3.startsWith(".")).sort();
   } catch {
     return null;
   }
@@ -14886,8 +14953,8 @@ var init_seal_group = __esm(() => {
 });
 
 // ../../loki-ts/src/supply/supply_guard.ts
-import { existsSync as existsSync41, readFileSync as readFileSync49, statSync as statSync20 } from "fs";
-import { basename as basename21, join as join64 } from "path";
+import { existsSync as existsSync42, readFileSync as readFileSync50, statSync as statSync20 } from "fs";
+import { basename as basename22, join as join65 } from "path";
 function supplyEnabled(env) {
   return env["LOKI_SUPPLY_GUARD"] !== "0";
 }
@@ -14899,16 +14966,16 @@ function supplyVerdict(verdict, r) {
   return r.blocked && verdict === "VERIFIED" ? "FAILED" : verdict;
 }
 function isManifestPath(path) {
-  return MANIFESTS.test(basename21(path));
+  return MANIFESTS.test(basename22(path));
 }
 function readDeclared(repoDir) {
-  const p = join64(repoDir, ".loki", DECLARED_FILE);
-  if (!existsSync41(p))
+  const p = join65(repoDir, ".loki", DECLARED_FILE);
+  if (!existsSync42(p))
     return { deps: [], problem: null };
   try {
     if (statSync20(p).size > MAX_FILE_BYTES)
       return { deps: [], problem: "declaration file too large" };
-    const j = JSON.parse(readFileSync49(p, "utf8"));
+    const j = JSON.parse(readFileSync50(p, "utf8"));
     if (!Array.isArray(j))
       return { deps: [], problem: "declaration is not a JSON array" };
     const deps = [];
@@ -14928,11 +14995,11 @@ function readDeclared(repoDir) {
   }
 }
 function readAllowlist(repoDir) {
-  const p = join64(repoDir, ".loki", "supply-allowlist");
-  if (!existsSync41(p))
+  const p = join65(repoDir, ".loki", "supply-allowlist");
+  if (!existsSync42(p))
     return new Set;
   try {
-    return new Set(readFileSync49(p, "utf8").split(`
+    return new Set(readFileSync50(p, "utf8").split(`
 `).map((l) => l.replace(/#.*$/, "").trim()).filter(Boolean));
   } catch {
     return new Set;
@@ -14973,7 +15040,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "npm") {
     if (privateUrlList([env["npm_config_registry"] ?? "", env["NPM_CONFIG_REGISTRY"] ?? ""]))
       return true;
-    return files(join64(repoDir, ".npmrc"), home ? join64(home, ".npmrc") : "").some((t) => t.split(`
+    return files(join65(repoDir, ".npmrc"), home ? join65(home, ".npmrc") : "").some((t) => t.split(`
 `).some((l) => {
       const m = /^\s*(?:(@[^:\s]+):)?registry\s*=\s*(\S+)/.exec(l);
       return !!m && privateUrl(m[2]) && (m[1] === undefined || name.startsWith(`${m[1]}/`));
@@ -14982,7 +15049,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "pypi") {
     if (privateUrlList([env["PIP_INDEX_URL"] ?? "", env["PIP_EXTRA_INDEX_URL"] ?? ""]))
       return true;
-    const cfg = [env["PIP_CONFIG_FILE"] ?? "", home ? join64(home, ".config", "pip", "pip.conf") : "", home ? join64(home, ".pip", "pip.conf") : "", join64(repoDir, "pip.conf")];
+    const cfg = [env["PIP_CONFIG_FILE"] ?? "", home ? join65(home, ".config", "pip", "pip.conf") : "", home ? join65(home, ".pip", "pip.conf") : "", join65(repoDir, "pip.conf")];
     return files(...cfg).some((t) => t.split(`
 `).some((l) => {
       const m = /^\s*(?:extra-)?index-url\s*[=:]\s*(.+)$/.exec(l);
@@ -14992,7 +15059,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "cargo") {
     if (Object.keys(env).some((k) => /^CARGO_REGISTRIES_.+_INDEX$/.test(k) || /^CARGO_SOURCE_/.test(k)))
       return true;
-    return files(join64(repoDir, ".cargo", "config.toml"), join64(repoDir, ".cargo", "config"), home ? join64(home, ".cargo", "config.toml") : "", home ? join64(home, ".cargo", "config") : "").some((t) => /^\s*\[(registries\.|source\.)/m.test(t) || /replace-with\s*=/.test(t));
+    return files(join65(repoDir, ".cargo", "config.toml"), join65(repoDir, ".cargo", "config"), home ? join65(home, ".cargo", "config.toml") : "", home ? join65(home, ".cargo", "config") : "").some((t) => /^\s*\[(registries\.|source\.)/m.test(t) || /replace-with\s*=/.test(t));
   }
   if (eco === "go") {
     const gp = goEnv["GOPROXY"] ?? env["GOPROXY"] ?? "";
@@ -15115,7 +15182,7 @@ var MIN_AGE_DAYS = 7, DECLARED_FILE = "supply-declared.json", MAX_CHECKED = 50,
   }
 }, PUBLIC_HOSTS, hostOf = (u) => u.trim().toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^www\./, "").split(/[/?#\s]/)[0].replace(/^[^@]*@/, "").replace(/:\d+$/, ""), privateUrl = (u) => /[a-z0-9]/i.test(u) && !PUBLIC_HOSTS.has(hostOf(u)), readSmall = (p) => {
   try {
-    return statSync20(p).size <= MAX_FILE_BYTES ? readFileSync49(p, "utf8") : "";
+    return statSync20(p).size <= MAX_FILE_BYTES ? readFileSync50(p, "utf8") : "";
   } catch {
     return "";
   }
@@ -15131,8 +15198,8 @@ var init_supply_guard = __esm(() => {
 
 // ../../loki-ts/src/engine10/stages/seal.ts
 import { createHash as createHash18 } from "crypto";
-import { existsSync as existsSync42, readdirSync as readdirSync21, mkdirSync as mkdirSync29, readFileSync as readFileSync50, writeFileSync as writeFileSync31 } from "fs";
-import { basename as basename22, isAbsolute as isAbsolute9, join as join65, relative as relative9 } from "path";
+import { existsSync as existsSync43, readdirSync as readdirSync22, mkdirSync as mkdirSync29, readFileSync as readFileSync51, writeFileSync as writeFileSync31 } from "fs";
+import { basename as basename23, isAbsolute as isAbsolute10, join as join66, relative as relative10 } from "path";
 function sanitizeReason(s) {
   const collapsed = s.replace(/[\x00-\x1f\x7f]+/g, " ").trim();
   const capped = collapsed.length > 500 ? `${collapsed.slice(0, 500)}...` : collapsed;
@@ -15207,8 +15274,8 @@ function renderReceiptMd(r) {
 `);
 }
 var DEEP_NOT_PROVEN, SIGNING_UNAVAILABLE = "receipt signing unavailable (no usable signing key: invalid key or unwritable ~/.loki/keys)", EXCLUDE_LOKI = ":(exclude).loki", sha2562 = (s) => createHash18("sha256").update(s).digest("hex"), str3 = (v) => typeof v === "string" && v !== "" ? v : null, strs2 = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x !== "") : [], receiptRel = (ctx) => {
-  const r = relative9(ctx.repoDir, join65(ctx.runDir, "receipt.json"));
-  return r.startsWith("..") || isAbsolute9(r) ? `.loki/runs/${ctx.runId}/receipt.json` : r;
+  const r = relative10(ctx.repoDir, join66(ctx.runDir, "receipt.json"));
+  return r.startsWith("..") || isAbsolute10(r) ? `.loki/runs/${ctx.runId}/receipt.json` : r;
 }, commitStage, sealStage;
 var init_seal = __esm(() => {
   init_spec_file();
@@ -15307,6 +15374,8 @@ var init_seal = __esm(() => {
       }
       if (wallNotRun > 0)
         notProven.add(`wall base run not_run: ${wallNotRun}`);
+      for (const n3 of strs2(o.wall?.not_proven))
+        notProven.add(n3);
       for (const d of Array.isArray(o.wall?.discarded) ? o.wall.discarded : [])
         notProven.add(`wall test discarded: ${String(d.file)} (${String(d.reason)})`);
       for (const d of Array.isArray(o.wall?.not_run_files) ? o.wall.not_run_files : [])
@@ -15315,8 +15384,8 @@ var init_seal = __esm(() => {
         notProven.add(`Wall test not executed: ${wallNotRun} file(s), no reason recorded`);
       if (wallNotRun > 0) {
         try {
-          const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename22(String(f.path))));
-          for (const n3 of readdirSync21(join65(ctx.runDir, "wall")).sort())
+          const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename23(String(f.path))));
+          for (const n3 of readdirSync22(join66(ctx.runDir, "wall")).sort())
             if (!kept.has(n3))
               notProven.add(`wall test discarded: ${n3} (not_run)`);
         } catch {}
@@ -15379,19 +15448,19 @@ var init_seal = __esm(() => {
       for (const [s, d] of Object.entries(o))
         if (typeof d?.duration_s === "number")
           stages[s] = d.duration_s;
-      const T = hooks.time, time = T ? T.build(ctx, stages, T.firstEventMs(join65(ctx.runDir, "events.jsonl"))) : { wall_s: Object.values(stages).reduce((a, b) => a + (b ?? 0), 0), stages }, totalS = T?.reconciled(time) ?? null;
+      const T = hooks.time, time = T ? T.build(ctx, stages, T.firstEventMs(join66(ctx.runDir, "events.jsonl"))) : { wall_s: Object.values(stages).reduce((a, b) => a + (b ?? 0), 0), stages }, totalS = T?.reconciled(time) ?? null;
       const iterIds = Object.values(o).flatMap((d) => [...strs2(d?.iteration_ids), ...strs2([d?.iteration_id])]);
       if (iterIds.length === 0)
         notProven.add("cost not measured (no iteration ids recorded)");
       const cost = ctx.cost.read(ctx.repoDir, iterIds);
       if (cost.unmetered)
         notProven.add("cost unmetered (CLI invoker; recorded as 0)");
-      const eventsPath = join65(ctx.runDir, "events.jsonl");
+      const eventsPath = join66(ctx.runDir, "events.jsonl");
       const wallFiles = Array.isArray(o.wall?.files) ? o.wall.files : [];
       const wallPassed = typeof o.verify?.wall_passed === "boolean" ? o.verify.wall_passed : null;
       if (wallFiles.length > 0 && wallPassed === null)
         notProven.add("wall result not recorded by verify");
-      const routeBlock = buildRouteBlock(process.env, ctx.provider, o.implement?.route ?? o.plan?.route_record ?? (routerEnabled(process.env) ? loadRouteRecord(ctx.runDir) : undefined), cost.router ?? (routerEnabled(process.env) ? sumResultCosts(join65(ctx.repoDir, ".loki"), liveArchivedCosts(join65(ctx.repoDir, ".loki"), iterIds, UNMETERED)).router : undefined), ctx.model);
+      const routeBlock = buildRouteBlock(process.env, ctx.provider, o.implement?.route ?? o.plan?.route_record ?? (routerEnabled(process.env) ? loadRouteRecord(ctx.runDir) : undefined), cost.router ?? (routerEnabled(process.env) ? sumResultCosts(join66(ctx.repoDir, ".loki"), liveArchivedCosts(join66(ctx.repoDir, ".loki"), iterIds, UNMETERED)).router : undefined), ctx.model);
       if (routeBlock)
         for (const l of routeNotProven(routeBlock))
           notProven.add(l);
@@ -15433,7 +15502,7 @@ var init_seal = __esm(() => {
         provider: ctx.provider,
         model: ctx.model,
         resumed: o.intake?.resumed === true,
-        events_sha256: sha2562(existsSync42(eventsPath) ? readFileSync50(eventsPath) : ""),
+        events_sha256: sha2562(existsSync43(eventsPath) ? readFileSync51(eventsPath) : ""),
         ...await sealEvidence(ctx.repoDir, ctx.runDir, o, notProven, signal, ctx.emit),
         log_seal: true,
         ...receiptBlock(process.env, cost.usd, cost.unmetered === true, totalS),
@@ -15455,10 +15524,10 @@ var init_seal = __esm(() => {
       }
       const receipt = { ...body, receipt_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } };
       mkdirSync29(ctx.runDir, { recursive: true });
-      const path = join65(ctx.runDir, "receipt.json");
+      const path = join66(ctx.runDir, "receipt.json");
       writeFileSync31(path, JSON.stringify(receipt, null, 2) + `
 `);
-      writeFileSync31(join65(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
+      writeFileSync31(join66(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
       recordRun(process.env, ctx.repoDir, ranModel(o.implement, ctx.model, o.fix), verdict, cost.usd, cost.unmetered === true, totalS);
       try {
         hooks.sealed?.(ctx.runDir, JSON.parse(JSON.stringify(receipt), (_k, v) => v && typeof v === "object" ? Object.freeze(v) : v));
@@ -15484,7 +15553,7 @@ var init_seal = __esm(() => {
 
 // ../../loki-ts/src/features/receipt_dsse.ts
 import { createPublicKey as createPublicKey3, sign as sign2, verify as verify3 } from "crypto";
-import { readFileSync as readFileSync51 } from "fs";
+import { readFileSync as readFileSync52 } from "fs";
 function pae(payloadType, body) {
   const t = Buffer.from(payloadType, "utf8");
   return Buffer.concat([Buffer.from(`DSSEv1 ${t.length} `), t, Buffer.from(` ${body.length} `), body]);
@@ -15561,7 +15630,7 @@ function verifyDsseReceipt(env, d) {
 }
 function runIdGuard(receiptPath, runId) {
   try {
-    return envelopeRunIdProblem(JSON.parse(readFileSync51(receiptPath, "utf8")), runId);
+    return envelopeRunIdProblem(JSON.parse(readFileSync52(receiptPath, "utf8")), runId);
   } catch {
     return null;
   }
@@ -15570,14 +15639,14 @@ var DSSE_PAYLOAD_TYPE = "application/vnd.in-toto+json", STATEMENT_TYPE = "https:
 var init_receipt_dsse = () => {};
 
 // ../../loki-ts/src/util/composite_seal.ts
-import { existsSync as existsSync43, readFileSync as readFileSync52 } from "fs";
-import { basename as basename23, dirname as dirname29, join as join66 } from "path";
+import { existsSync as existsSync44, readFileSync as readFileSync53 } from "fs";
+import { basename as basename24, dirname as dirname29, join as join67 } from "path";
 function logProblem(runDir, integ) {
   if (typeof integ["log_sha256"] !== "string")
     return null;
   let b;
   try {
-    b = readFileSync52(join66(runDir, "integration.log"));
+    b = readFileSync53(join67(runDir, "integration.log"));
   } catch {
     return "integration.log is missing but integration.json records its hash";
   }
@@ -15600,13 +15669,13 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
     return bad("body malformed");
   let ibytes;
   try {
-    ibytes = readFileSync52(join66(runDir, "integration.json"));
+    ibytes = readFileSync53(join67(runDir, "integration.json"));
   } catch {
     return bad("integration.json missing");
   }
   if (sha3(ibytes) !== receipt["integration_sha256"])
     return bad("integration.json does not match its recorded hash");
-  const integ = readJson5(join66(runDir, "integration.json"));
+  const integ = readJson5(join67(runDir, "integration.json"));
   if (!isObj10(integ) || !isObj10(integ["outcomes"]))
     return bad("integration.json has no outcomes");
   const iprob = integrationProblem(integ);
@@ -15636,10 +15705,10 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
       return bad(`child ${text2(repo, 80) || "?"} has an invalid receipt path`);
     if (outcomes[repo] !== "ok")
       return bad(`child ${text2(repo, 80)} did not finish ok in integration.json`);
-    const rp = join66(runDir, rel);
+    const rp = join67(runDir, rel);
     let bytes;
     try {
-      bytes = readFileSync52(rp);
+      bytes = readFileSync53(rp);
     } catch {
       return bad(`child ${repo} receipt missing`);
     }
@@ -15688,8 +15757,8 @@ var init_keys_cmd = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/verify_cmd.ts
-import { existsSync as existsSync44, readFileSync as readFileSync53, renameSync as renameSync13, statSync as statSync22, writeFileSync as writeFileSync32 } from "fs";
-import { basename as basename24, dirname as dirname30, join as join67 } from "path";
+import { existsSync as existsSync45, readFileSync as readFileSync54, renameSync as renameSync13, statSync as statSync22, writeFileSync as writeFileSync32 } from "fs";
+import { basename as basename25, dirname as dirname30, join as join68 } from "path";
 import { createHash as createHash19, createPublicKey as createPublicKey4, verify as verify4 } from "crypto";
 function pubFor(kid, given) {
   if (given)
@@ -15697,7 +15766,7 @@ function pubFor(kid, given) {
   const active = loadSigningKey(false);
   const pubs = (process.env["LOKI_RECEIPT_RETIRED_PUBKEYS"] ?? "").split(":").map((f) => f.trim()).filter(Boolean).flatMap((f) => {
     try {
-      return [createPublicKey4(readFileSync53(f))];
+      return [createPublicKey4(readFileSync54(f))];
     } catch {
       return [];
     }
@@ -15741,10 +15810,10 @@ function checkEventLog(receiptPath, receipt) {
     const claims = st !== null && typeof st === "object" && Object.keys(st).length > 0;
     return claims ? "the receipt records stages but binds the empty-log hash, so no events.jsonl can back it (missing, empty or non-empty); the receipt is forged or was sealed without a log. Re-run the task to produce a fresh receipt" : null;
   }
-  const path = join67(dirname30(receiptPath), "events.jsonl");
-  if (!existsSync44(path))
+  const path = join68(dirname30(receiptPath), "events.jsonl");
+  if (!existsSync45(path))
     return "events.jsonl is missing";
-  const raw2 = readFileSync53(path, "utf8"), events2 = readEvents(path), lines2 = raw2.split(`
+  const raw2 = readFileSync54(path, "utf8"), events2 = readEvents(path), lines2 = raw2.split(`
 `).filter((l) => l.trim() !== "");
   if (events2.length !== lines2.length || events2.some((e, i) => e.seq !== i))
     return "events.jsonl has a forged, edited or missing line";
@@ -15760,7 +15829,7 @@ function checkEventLog(receiptPath, receipt) {
   return h.digest("hex") === bound ? null : "events.jsonl does not match the hash recorded at seal";
 }
 function checkLogSeal(receiptPath, hash, kid, given) {
-  const path = join67(dirname30(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
+  const path = join68(dirname30(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
   if (!events2.some((e) => e.type === "receipt.sealed" && e.data["receipt_sha256"] === hash))
     return { verdict: "TAMPERED", reason: "events.jsonl has no receipt.sealed event for this receipt" };
   if (done < 0)
@@ -15768,7 +15837,7 @@ function checkLogSeal(receiptPath, hash, kid, given) {
   const seal = events2[done + 1], d = seal?.type === "log.sealed" ? seal.data : null;
   if (!d)
     return { verdict: "TAMPERED", reason: "events.jsonl has no signed log.sealed line after run.completed" };
-  const lines2 = readFileSync53(path, "utf8").split(`
+  const lines2 = readFileSync54(path, "utf8").split(`
 `).filter((l) => l.trim() !== ""), sha4 = createHash19("sha256").update(lines2.slice(0, done + 1).join(`
 `) + `
 `).digest("hex");
@@ -15778,11 +15847,11 @@ function checkLogSeal(receiptPath, hash, kid, given) {
   return null;
 }
 async function verifyReceipt(receiptPath, deps = {}) {
-  if (!existsSync44(receiptPath))
+  if (!existsSync45(receiptPath))
     return { verdict: "UNCHECKED", reasons: [`receipt not found: ${receiptPath}`] };
   let receipt;
   try {
-    receipt = JSON.parse((deps.read ?? ((p) => readFileSync53(p, "utf8")))(receiptPath));
+    receipt = JSON.parse((deps.read ?? ((p) => readFileSync54(p, "utf8")))(receiptPath));
   } catch {
     return { verdict: "UNCHECKED", reasons: ["receipt.json is not valid JSON"] };
   }
@@ -15870,8 +15939,8 @@ var init_verify_cmd = __esm(() => {
 });
 
 // src/server/app.ts
-import { existsSync as existsSync46, readFileSync as readFileSync56, statSync as statSync23 } from "fs";
-import { join as join70, resolve as resolve15, sep as sep13 } from "path";
+import { existsSync as existsSync47, readFileSync as readFileSync57, statSync as statSync23 } from "fs";
+import { join as join71, resolve as resolve15, sep as sep14 } from "path";
 
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = Symbol();
@@ -26153,9 +26222,9 @@ function mount20(ctx) {
 }
 
 // src/server/routes/verify.ts
-import { readFileSync as readFileSync54, realpathSync as realpathSync21 } from "fs";
+import { readFileSync as readFileSync55, realpathSync as realpathSync22 } from "fs";
 import { createPublicKey as createPublicKey5 } from "crypto";
-import { join as join68, sep as sep12 } from "path";
+import { join as join69, sep as sep13 } from "path";
 init_verify_cmd();
 init_seal();
 init_receipt_dsse();
@@ -26182,15 +26251,15 @@ function mount21(ctx) {
       return done(404, "receipt not available", "not_found");
     let runDir, file;
     try {
-      const root = realpathSync21(join68(repo.p, ".loki", "runs"));
-      runDir = realpathSync21(join68(root, run2));
-      if (runDir !== join68(root, run2))
+      const root = realpathSync22(join69(repo.p, ".loki", "runs"));
+      runDir = realpathSync22(join69(root, run2));
+      if (runDir !== join69(root, run2))
         return done(404, "receipt not found", "not_found");
-      file = realpathSync21(join68(runDir, "receipt.json"));
+      file = realpathSync22(join69(runDir, "receipt.json"));
     } catch {
       return done(404, "receipt not found", "not_found");
     }
-    if (!file.startsWith(runDir + sep12))
+    if (!file.startsWith(runDir + sep13))
       return done(404, "receipt not found", "not_found");
     let integrity, reasons, sha4 = null, outcome = "UNREADABLE";
     try {
@@ -26205,7 +26274,7 @@ function mount21(ctx) {
         sha4 = r.receiptSha256 ?? null;
       }
       try {
-        outcome = outcomeOf(JSON.parse(readFileSync54(file, "utf8")));
+        outcome = outcomeOf(JSON.parse(readFileSync55(file, "utf8")));
       } catch {
         outcome = "UNREADABLE";
       }
@@ -26267,8 +26336,8 @@ function ttlCache(ttlMs = PROBE_CACHE_MS, now2 = Date.now) {
 }
 
 // src/server/legacy/shim.ts
-import { existsSync as existsSync45, readFileSync as readFileSync55 } from "fs";
-import { join as join69 } from "path";
+import { existsSync as existsSync46, readFileSync as readFileSync56 } from "fs";
+import { join as join70 } from "path";
 
 // src/server/legacy/routes.ts
 var LEGACY_ROUTES = [
@@ -26646,10 +26715,10 @@ var logged = new Set;
 var toHono = (p) => p.replace(/\{([A-Za-z_]+):path\}/g, ":$1{.+}").replace(/\{([A-Za-z_]+)\}/g, ":$1");
 var NOT_SUPPORTED = "not yet supported by the Control Plane";
 var repoVersion = () => {
-  for (const f of [join69(import.meta.dir, "../../../../../VERSION")]) {
+  for (const f of [join70(import.meta.dir, "../../../../../VERSION")]) {
     try {
-      if (existsSync45(f))
-        return readFileSync55(f, "utf8").trim();
+      if (existsSync46(f))
+        return readFileSync56(f, "utf8").trim();
     } catch {}
   }
   return "unknown";
@@ -26831,7 +26900,7 @@ function legacyShim(opts) {
 
 // src/server/app.ts
 var MAX_BODY2 = 1e6;
-var defaultUiDir = () => [join70(import.meta.dir, "../../ui/dist"), join70(import.meta.dir, "../ui/dist")].find((d) => existsSync46(join70(d, "index.html")));
+var defaultUiDir = () => [join71(import.meta.dir, "../../ui/dist"), join71(import.meta.dir, "../ui/dist")].find((d) => existsSync47(join71(d, "index.html")));
 function createApp(opts) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db, sqlite } = openDb(opts.dbPath);
@@ -26860,10 +26929,10 @@ function createApp(opts) {
     await next();
   });
   const readInstalled = () => {
-    for (const f of [process.env.LOKI_VERSION_FILE, join70(import.meta.dir, "../../../../VERSION")]) {
+    for (const f of [process.env.LOKI_VERSION_FILE, join71(import.meta.dir, "../../../../VERSION")]) {
       try {
         if (f)
-          return readFileSync56(f, "utf8").trim() || "unknown";
+          return readFileSync57(f, "utf8").trim() || "unknown";
       } catch {}
     }
     return "unknown";
@@ -26974,11 +27043,11 @@ function createApp(opts) {
       return c.json({ error: "not found" }, 404);
     const root = resolve15(uiDir);
     const f = resolve15(root, `.${p}`);
-    if (f.startsWith(root + sep13) && existsSync46(f) && statSync23(f).isFile())
+    if (f.startsWith(root + sep14) && existsSync47(f) && statSync23(f).isFile())
       return new Response(Bun.file(f));
     if (/\.[a-z0-9]+$/i.test(p))
       return c.json({ error: "not found" }, 404);
-    return new Response(Bun.file(join70(root, "index.html")));
+    return new Response(Bun.file(join71(root, "index.html")));
   });
   return { app, db, close: () => {
     clearInterval(reconciler);