loki-mode 11.17.74 → 11.17.76

package/packages/control-plane/dist/server.js

@@ -9894,13 +9894,104 @@ var init_stop_restore = __esm(() => {
 });
 
 // ../../loki-ts/src/util/base_guard.ts
+import { existsSync as existsSync24, readdirSync as readdirSync15, readFileSync as readFileSync30, readlinkSync, realpathSync as realpathSync17, symlinkSync } from "fs";
+import { basename as basename13, join as join39, relative as relative3, resolve as resolve13, sep as sep11 } from "path";
+import { fileURLToPath as fileURLToPath4 } from "url";
+function insideAny(p, roots) {
+  const under = (q) => roots.some((r) => q === r || q.startsWith(r + sep11));
+  if (under(resolve13(p)))
+    return true;
+  try {
+    return under(realpathSync17(p));
+  } catch {
+    return false;
+  }
+}
+function namedPaths(file, text2) {
+  const out2 = text2.split(/\r?\n/).map((l) => l.trim()).filter((l) => l !== "");
+  if (basename13(file) !== "direct_url.json")
+    return out2;
+  const url = JSON.parse(text2).url;
+  return typeof url === "string" && url.startsWith("file:") ? [...out2, fileURLToPath4(url)] : out2;
+}
+function depsSeeHead(pkgDir, repoDir) {
+  let roots;
+  try {
+    roots = [...new Set([resolve13(repoDir), realpathSync17(repoDir)])];
+  } catch {
+    return true;
+  }
+  let seen = 0;
+  const walk = (dir, own) => {
+    for (const e of readdirSync15(dir, { withFileTypes: true })) {
+      if (++seen > WALK_BOUND)
+        return true;
+      const p = join39(dir, e.name);
+      if (e.isSymbolicLink()) {
+        const t = resolve13(dir, readlinkSync(p));
+        let rt = t;
+        try {
+          rt = realpathSync17(t);
+        } catch {}
+        if (insideAny(t, roots) && !own.some((r) => rt === r || rt.startsWith(r + sep11)))
+          return true;
+      } else if (e.isDirectory()) {
+        if (walk(p, own))
+          return true;
+      } else if (REPO_LINK_FILE.test(e.name)) {
+        const text2 = readFileSync30(p, "utf8");
+        if (roots.some((r) => text2.includes(r)) || namedPaths(p, text2).some((n2) => insideAny(n2, roots)))
+          return true;
+      }
+    }
+    return false;
+  };
+  try {
+    return ["node_modules", ".venv"].some((d) => {
+      try {
+        const top = join39(pkgDir, d);
+        return walk(top, [...new Set([resolve13(top), realpathSync17(top)])]);
+      } catch (e) {
+        if (e.code === "ENOENT")
+          return false;
+        throw e;
+      }
+    });
+  } catch {
+    return true;
+  }
+}
+async function zeroOnBase(cands, baseDir, repoDir, run, note) {
+  const zero = [];
+  for (const c of cands) {
+    const src = join39(repoDir, relative3(baseDir, c.cwd));
+    if (depsSeeHead(src, repoDir))
+      continue;
+    for (const d of ["node_modules", ".venv"]) {
+      try {
+        if (existsSync24(join39(src, d)) && !existsSync24(join39(c.cwd, d)))
+          symlinkSync(join39(src, d), join39(c.cwd, d));
+      } catch {}
+    }
+    const b = await run(c), last = c.args[c.args.length - 1] ?? "";
+    const k = classifyCheck({ kind: "test", ok: b.ok, cut: b.cut, missing: b.missing, out: b.out, ...goRunner(c.cmd, c.args), path: /\.[cm]?[jt]s$/.test(last) ? last : undefined });
+    if (k.result === "not_run" && k.n === 0 && !b.cut && !b.missing) {
+      zero.push(c.name);
+      note(c.name);
+    }
+  }
+  return zero;
+}
+var WALK_BOUND = 50000, REPO_LINK_FILE;
 var init_base_guard = __esm(() => {
+  init_check_result();
   init_run_status();
   init_safe_git();
+  REPO_LINK_FILE = /\.pth$|\.egg-link$|^direct_url\.json$|^__editable___.*_finder\.py$/;
 });
 
 // ../../loki-ts/src/features/speed/unit_mode.ts
-import { closeSync as closeSync7, constants, fstatSync as fstatSync5, lstatSync as lstatSync9, openSync as openSync7, readSync as readSync6, realpathSync as realpathSync17 } from "fs";
+import { closeSync as closeSync7, constants, fstatSync as fstatSync5, lstatSync as lstatSync9, openSync as openSync7, readSync as readSync6, realpathSync as realpathSync18 } from "fs";
 function readBounded(path) {
   const l = lstatSync9(path);
   if (l.isSymbolicLink() || !l.isFile() || l.size > MAX_SPEC_BYTES)
@@ -10719,14 +10810,15 @@ function failCount(out2) {
 `).reverse().map((x) => x.trim()).find((x) => /^(?:=+ )?\d+ \w+.* in [\d.]+s|^Tests?:?\s+\d/.test(x)), m = /^(?:#|\u2139) fail (\d+)$/m.exec(out2);
   return l ? n2(l, /(\d+) failed/) + n2(l, /(\d+) errors?/) : m ? +m[1] : null;
 }
-function failIds(output) {
-  const ids = [...new Set(output.split(`
+function failIds(raw2) {
+  const output = stripAnsi(raw2), ids = [...new Set(output.split(`
 `).map((l) => ID_LINE.exec(l.trim())).flatMap((m) => m ? [(m.slice(1).find(Boolean) ?? "").trim()] : []).filter(Boolean))];
   const c = failCount(output);
   return c && ids.length >= c ? ids : [];
 }
 var ID_LINE;
 var init_failures = __esm(() => {
+  init_check_result();
   ID_LINE = /^(?:(?:FAILED|ERROR)\s+(\S+::\S*)(?:\s.*)?|\u25cf\s+(?!Console|Test suite failed)(.+)|not ok \d+ - (.+?)(?:\s+#.*)?|\u2716\s+(?!failing tests:)(.+?)(?:\s+\([\d.]+ms\))?|FAIL\s+(.+)|\u00d7\s+(.+?)(?:\s+\d+(?:\.\d+)?\s*m?s)?)$/;
 });
 
@@ -10749,25 +10841,25 @@ var init_state = __esm(() => {
 
 // ../../loki-ts/src/runner/repo_profile.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync24, lstatSync as lstatSync10, readFileSync as readFileSync30, mkdirSync as mkdirSync14, readdirSync as readdirSync15, renameSync as renameSync9, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "fs";
-import { basename as basename13, join as join39, resolve as resolve13, isAbsolute as isAbsolute4 } from "path";
+import { existsSync as existsSync25, lstatSync as lstatSync10, readFileSync as readFileSync31, mkdirSync as mkdirSync14, readdirSync as readdirSync16, renameSync as renameSync9, rmSync as rmSync8, writeFileSync as writeFileSync17 } from "fs";
+import { basename as basename14, join as join40, resolve as resolve14, isAbsolute as isAbsolute4 } from "path";
 function detectFormatters(repoDir) {
   const out2 = [];
-  const has = (...fs2) => fs2.some((f) => existsSync24(join39(repoDir, f)));
-  const pp = read(join39(repoDir, "pyproject.toml")), pj = read(join39(repoDir, "package.json"));
+  const has = (...fs2) => fs2.some((f) => existsSync25(join40(repoDir, f)));
+  const pp = read(join40(repoDir, "pyproject.toml")), pj = read(join40(repoDir, "package.json"));
   if (/\[tool\.ruff/.test(pp) || has("ruff.toml", ".ruff.toml"))
     out2.push({ tool: "ruff", argv: ["ruff", "format"], exts: /\.pyi?$/ });
   let prettierKey = false;
   try {
     prettierKey = pj !== "" && "prettier" in JSON.parse(pj);
   } catch {}
-  const local = join39(repoDir, "node_modules", ".bin", "prettier");
-  if ((prettierKey || readdirSync15(repoDir).some((f) => /^(\.prettierrc(\.[a-z0-9]+)?|prettier\.config\.[cm]?[jt]s)$/.test(f))) && existsSync24(local))
+  const local = join40(repoDir, "node_modules", ".bin", "prettier");
+  if ((prettierKey || readdirSync16(repoDir).some((f) => /^(\.prettierrc(\.[a-z0-9]+)?|prettier\.config\.[cm]?[jt]s)$/.test(f))) && existsSync25(local))
     out2.push({ tool: "prettier", argv: [local, "--write"], exts: /\.(?:[cm]?[jt]sx?|json|css|scss|md|ya?ml|html)$/ });
   if (has("go.mod"))
     out2.push({ tool: "gofmt", argv: ["gofmt", "-w"], exts: /\.go$/ });
   if (has("rustfmt.toml", ".rustfmt.toml")) {
-    const ed = /^\s*edition\s*=\s*"(\d+)"/m.exec(read(join39(repoDir, "Cargo.toml")))?.[1];
+    const ed = /^\s*edition\s*=\s*"(\d+)"/m.exec(read(join40(repoDir, "Cargo.toml")))?.[1];
     out2.push({ tool: "rustfmt", argv: ["rustfmt", ...ed ? ["--edition", ed] : []], exts: /\.rs$/ });
   }
   return out2;
@@ -10776,7 +10868,7 @@ function runFormatters(repoDir, files, env) {
   const fmts = detectFormatters(repoDir);
   const mine = fmts.length ? files.filter((f) => {
     try {
-      return lstatSync10(join39(repoDir, f)).isFile();
+      return lstatSync10(join40(repoDir, f)).isFile();
     } catch {
       return false;
     }
@@ -10789,7 +10881,7 @@ function runFormatters(repoDir, files, env) {
 }
 function loadProfile(repoDir) {
   try {
-    const p = JSON.parse(readFileSync30(commandProfilePath(repoDir), "utf8"));
+    const p = JSON.parse(readFileSync31(commandProfilePath(repoDir), "utf8"));
     return p?.version === 1 && Array.isArray(p.commands) && p.baseline ? p : null;
   } catch {
     return null;
@@ -10803,10 +10895,11 @@ function attribute(repoDir, baseSha, failing) {
   return split(failing.map((f) => ({ ...f, base })), base.size);
 }
 function split(failing, known) {
+  const unparsed = failing.filter((f) => !f.ids?.length && f.base.size > 0).length;
   const pre = failing.filter((f) => f.eligible && f.ids?.length && f.ids.every((i) => f.base.has(i)));
   const introduced = failing.filter((f) => !pre.includes(f)).map((f) => f.name);
   if (pre.length === 0)
-    return { preExistingChecks: [], preExistingIds: [], introducedChecks: introduced, line: `baseline: ${known} known failure(s) before this run; none of the failing checks match them, ${introduced.length} introduced (blocking)` };
+    return { preExistingChecks: [], preExistingIds: [], introducedChecks: introduced, line: `baseline: ${known} known failure(s) before this run; ${unparsed ? `head failure ids unparseable for ${unparsed} failing check(s), cannot compare` : "none of the failing checks match them"}, ${introduced.length} introduced (blocking)` };
   return {
     preExistingChecks: pre.map((f) => f.name),
     preExistingIds: pre.flatMap((f) => f.ids ?? []),
@@ -10890,9 +10983,9 @@ async function staticPreExisting(tool, prefix, files, io) {
   }
   return attributeStatic(tool, head.out, baseOut, 1).preExisting;
 }
-var commandProfilePath = (repoDir) => join39(repoDir, ".loki", "state", "repo-profile.json"), read = (p) => {
+var commandProfilePath = (repoDir) => join40(repoDir, ".loki", "state", "repo-profile.json"), read = (p) => {
   try {
-    return readFileSync30(p, "utf8");
+    return readFileSync31(p, "utf8");
   } catch {
     return "";
   }
@@ -10938,14 +11031,14 @@ var init_context = __esm(() => {
 });
 
 // ../../loki-ts/src/util/steer.ts
-import { appendFileSync as appendFileSync2, closeSync as closeSync8, constants as constants2, fstatSync as fstatSync6, readdirSync as readdirSync16, lstatSync as lstatSync11, mkdirSync as mkdirSync15, linkSync as linkSync2, openSync as openSync8, readFileSync as readFileSync31, readSync as readSync7, renameSync as renameSync10, statSync as statSync16, lutimesSync, rmSync as rmSync9, unlinkSync as unlinkSync6, writeFileSync as writeFileSync18, existsSync as existsSync25 } from "fs";
+import { appendFileSync as appendFileSync2, closeSync as closeSync8, constants as constants2, fstatSync as fstatSync6, readdirSync as readdirSync17, lstatSync as lstatSync11, mkdirSync as mkdirSync15, linkSync as linkSync2, openSync as openSync8, readFileSync as readFileSync32, readSync as readSync7, renameSync as renameSync10, statSync as statSync16, lutimesSync, rmSync as rmSync9, unlinkSync as unlinkSync6, writeFileSync as writeFileSync18, existsSync as existsSync26 } from "fs";
 import { createHash as createHash9, randomBytes as randomBytes4 } from "crypto";
-import { basename as basename14, join as join40 } from "path";
+import { basename as basename15, join as join41 } from "path";
 function archiveTo(logs, prefix, src, link = linkSync2, onLinked) {
   for (let i = 0;; i++) {
     const name = i === 0 ? `${prefix}.md` : `${prefix}-${i}.md`;
     try {
-      link(src, join40(logs, name));
+      link(src, join41(logs, name));
     } catch (e) {
       const code = e.code;
       if (code === "EEXIST")
@@ -10953,7 +11046,7 @@ function archiveTo(logs, prefix, src, link = linkSync2, onLinked) {
       if (code !== "EPERM" && code !== "ENOTSUP" && code !== "EXDEV" && code !== "EMLINK")
         throw e;
       const name2 = `${prefix}-${randomBytes4(4).toString("hex")}.md`;
-      renameSync10(src, join40(logs, name2));
+      renameSync10(src, join41(logs, name2));
       onLinked?.(name2);
       return name2;
     }
@@ -10968,14 +11061,14 @@ function orphanAlreadyArchived(logs, claim) {
   const c = lstatSync11(claim);
   if (!c.isFile())
     return false;
-  for (const a of readdirSync16(logs)) {
+  for (const a of readdirSync17(logs)) {
     if (!/^human-input-.*\.md$/.test(a))
       continue;
     try {
-      const s = statSync16(join40(logs, a));
+      const s = statSync16(join41(logs, a));
       if (s.ino !== c.ino || s.dev !== c.dev)
         continue;
-      if (/^human-input-(ORPHAN|REJECTED)-/.test(a) || existsSync25(appliedMarker(logs, a)))
+      if (/^human-input-(ORPHAN|REJECTED)-/.test(a) || existsSync26(appliedMarker(logs, a)))
         return true;
     } catch {}
   }
@@ -10984,7 +11077,7 @@ function orphanAlreadyArchived(logs, claim) {
 function sweepOrphans(logs, stamp2, unapplied, link, nowMs = Date.now()) {
   let names;
   try {
-    names = readdirSync16(logs);
+    names = readdirSync17(logs);
   } catch {
     return;
   }
@@ -10992,7 +11085,7 @@ function sweepOrphans(logs, stamp2, unapplied, link, nowMs = Date.now()) {
   for (const n2 of names)
     if (n2.startsWith(".applied-") && !present.has(n2.slice(".applied-".length))) {
       try {
-        unlinkSync6(join40(logs, n2));
+        unlinkSync6(join41(logs, n2));
       } catch {}
     }
   for (const n2 of names) {
@@ -11009,7 +11102,7 @@ function sweepOrphans(logs, stamp2, unapplied, link, nowMs = Date.now()) {
     if (alive) {
       let ageMs = 0;
       try {
-        ageMs = nowMs - statSync16(join40(logs, n2)).mtimeMs;
+        ageMs = nowMs - statSync16(join41(logs, n2)).mtimeMs;
       } catch {
         continue;
       }
@@ -11017,11 +11110,11 @@ function sweepOrphans(logs, stamp2, unapplied, link, nowMs = Date.now()) {
         continue;
     }
     try {
-      if (orphanAlreadyArchived(logs, join40(logs, n2))) {
-        unlinkSync6(join40(logs, n2));
+      if (orphanAlreadyArchived(logs, join41(logs, n2))) {
+        unlinkSync6(join41(logs, n2));
         continue;
       }
-      archiveTo(logs, `human-input-ORPHAN-${stamp2}`, join40(logs, n2), link);
+      archiveTo(logs, `human-input-ORPHAN-${stamp2}`, join41(logs, n2), link);
       unapplied("orphaned claim");
     } catch (e) {
       if (e.code === "ENOENT")
@@ -11033,17 +11126,17 @@ function sweepOrphans(logs, stamp2, unapplied, link, nowMs = Date.now()) {
 function consumeSteer(repoDir, env = process.env, now2 = () => new Date, sink, hooks2) {
   if (/^(0|false)$/i.test(env.LOKI_PROMPT_INJECTION ?? ""))
     return null;
-  const f = join40(repoDir, ".loki", "HUMAN_INPUT.md");
+  const f = join41(repoDir, ".loki", "HUMAN_INPUT.md");
   const unapplied = (reason) => {
     sink?.push({ rev: 0, source: null, actor: null, sha: "", at: now2().getTime(), unapplied: true, reason });
   };
   let fd = -1, claimed = "";
   try {
-    const logs = join40(repoDir, ".loki", "logs");
+    const logs = join41(repoDir, ".loki", "logs");
     mkdirSync15(logs, { recursive: true });
     const stamp2 = now2().toISOString().replace(/[-:]/g, "").replace(/\..*/, "");
     sweepOrphans(logs, stamp2, unapplied, hooks2?.link, now2().getTime());
-    claimed = join40(logs, `.claim-${process.pid}-${randomBytes4(6).toString("hex")}`);
+    claimed = join41(logs, `.claim-${process.pid}-${randomBytes4(6).toString("hex")}`);
     try {
       renameSync10(f, claimed);
     } catch (e) {
@@ -11134,10 +11227,10 @@ function consumeSteer(repoDir, env = process.env, now2 = () => new Date, sink, h
   } catch {
     if (claimed) {
       try {
-        archiveTo(join40(repoDir, ".loki", "logs"), `human-input-${now2().toISOString().replace(/[-:]/g, "").replace(/\..*/, "")}`, claimed, hooks2?.link);
+        archiveTo(join41(repoDir, ".loki", "logs"), `human-input-${now2().toISOString().replace(/[-:]/g, "").replace(/\..*/, "")}`, claimed, hooks2?.link);
         unapplied("logs dir unwritable or file unreadable");
       } catch {
-        unapplied(`steer stranded at .loki/logs/${basename14(claimed)}`);
+        unapplied(`steer stranded at .loki/logs/${basename15(claimed)}`);
       }
     } else
       try {
@@ -11153,10 +11246,10 @@ function consumeSteer(repoDir, env = process.env, now2 = () => new Date, sink, h
   }
 }
 function recordRevisions(repoDir, text2, archived, at) {
-  const file = join40(repoDir, ".loki", "intent-revisions.jsonl");
+  const file = join41(repoDir, ".loki", "intent-revisions.jsonl");
   let last = 0;
   try {
-    for (const l of readFileSync31(file, "utf8").split(`
+    for (const l of readFileSync32(file, "utf8").split(`
 `)) {
       try {
         last = Math.max(last, Number(JSON.parse(l).rev) || 0);
@@ -11210,7 +11303,7 @@ function staleAtSeal(repoDir, ctx) {
   const frozen = ctx.outputs === undefined || ctx.outputs().wall !== undefined || ctx.wallSealed === true;
   return [...new Set([...staleWallRevisions(ctx.intentRevisions, frozen ? ctx.timeline : []), ...late])];
 }
-var STEER_MAX_BYTES, STEER_STAGES, STEER_CLAIM_MAX_AGE_MS, appliedMarker = (logs, archive) => join40(logs, `.applied-${archive}`), REV_HDR, STEER_REMEDY;
+var STEER_MAX_BYTES, STEER_STAGES, STEER_CLAIM_MAX_AGE_MS, appliedMarker = (logs, archive) => join41(logs, `.applied-${archive}`), REV_HDR, STEER_REMEDY;
 var init_steer = __esm(() => {
   init_context();
   STEER_MAX_BYTES = 1024 * 1024;
@@ -11222,20 +11315,20 @@ var init_steer = __esm(() => {
 
 // ../../loki-ts/src/util/run_outputs.ts
 import { createHash as createHash10 } from "crypto";
-import { existsSync as existsSync26, mkdirSync as mkdirSync16, readdirSync as readdirSync17, readFileSync as readFileSync32, statSync as statSync17, writeFileSync as writeFileSync19 } from "fs";
-import { join as join41, resolve as resolve14 } from "path";
+import { existsSync as existsSync27, mkdirSync as mkdirSync16, readdirSync as readdirSync18, readFileSync as readFileSync33, statSync as statSync17, writeFileSync as writeFileSync19 } from "fs";
+import { join as join42, resolve as resolve15 } from "path";
 function intentRevisionsBlock(revs) {
   const r = (revs ?? []).filter((r2) => r2.unapplied !== true).map(({ rev, source, actor, sha: sha2 }) => ({ rev, source, actor, sha: sha2 }));
   return r.length ? { intent_revisions: r } : {};
 }
 function seededCorpusBlock(env = process.env) {
-  const dir = env["LOKI_SEEDED_DEFECTS_DIR"] || join41(REPO_ROOT, "benchmarks", "seeded-defects");
+  const dir = env["LOKI_SEEDED_DEFECTS_DIR"] || join42(REPO_ROOT, "benchmarks", "seeded-defects");
   try {
-    const bytes = readFileSync32(join41(dir, "manifest.json")), version2 = createHash10("sha256").update(bytes).digest("hex");
+    const bytes = readFileSync33(join42(dir, "manifest.json")), version2 = createHash10("sha256").update(bytes).digest("hex");
     const ids = (JSON.parse(bytes.toString("utf8")).defects ?? []).map((d) => d.id);
     let rate = null;
     try {
-      const res = JSON.parse(readFileSync32(join41(dir, "results", "wrong-pass.json"), "utf8"));
+      const res = JSON.parse(readFileSync33(join42(dir, "results", "wrong-pass.json"), "utf8"));
       const runs2 = res.manifest_sha256 === version2 && Array.isArray(res.runs) ? res.runs : [];
       const complete = (o) => !!o && Object.keys(o).length === ids.length && ids.every((id) => typeof id === "string" && (o[id] === "SEALED" || o[id] === "NOT_SEALED"));
       const top = runs2.filter((r) => r.setup === "top"), floor = runs2.filter((r) => r.setup === "floor");
@@ -11519,7 +11612,7 @@ var init_registry2 = __esm(() => {
 
 // ../../loki-ts/src/features/receipt_dsse.ts
 import { createPublicKey as createPublicKey3, sign as sign2, verify as verify3 } from "crypto";
-import { readFileSync as readFileSync33 } from "fs";
+import { readFileSync as readFileSync34 } from "fs";
 function pae(payloadType, body) {
   const t = Buffer.from(payloadType, "utf8");
   return Buffer.concat([Buffer.from(`DSSEv1 ${t.length} `), t, Buffer.from(` ${body.length} `), body]);
@@ -11596,7 +11689,7 @@ function verifyDsseReceipt(env, d) {
 }
 function runIdGuard(receiptPath, runId2) {
   try {
-    return envelopeRunIdProblem(JSON.parse(readFileSync33(receiptPath, "utf8")), runId2);
+    return envelopeRunIdProblem(JSON.parse(readFileSync34(receiptPath, "utf8")), runId2);
   } catch {
     return null;
   }
@@ -11661,18 +11754,18 @@ var init_seal_drift = __esm(() => {
 });
 
 // ../../loki-ts/src/util/spec_file.ts
-import { isAbsolute as isAbsolute5, join as join42, relative as relative3 } from "path";
+import { isAbsolute as isAbsolute5, join as join43, relative as relative4 } from "path";
 function specReceiptBlock(env) {
   const { LOKI_E10_SPEC_PATH: p, LOKI_E10_SPEC_SHA256: sha2 } = env;
   if (!p || !sha2)
     return {};
-  const rel = isAbsolute5(p) && env.LOKI_E10_REPO_DIR ? relative3(env.LOKI_E10_REPO_DIR, p) : p;
+  const rel = isAbsolute5(p) && env.LOKI_E10_REPO_DIR ? relative4(env.LOKI_E10_REPO_DIR, p) : p;
   return { spec: { path: rel, sha256: sha2 } };
 }
 var SPEC_DIR;
 var init_spec_file = __esm(() => {
   init_types();
-  SPEC_DIR = join42(".loki", "specs");
+  SPEC_DIR = join43(".loki", "specs");
 });
 
 // ../../loki-ts/src/util/reviewer_brief.ts
@@ -11702,11 +11795,11 @@ var init_run_cap = __esm(() => {
 });
 
 // ../../loki-ts/src/util/mutation_proof.ts
-import { existsSync as existsSync27, mkdirSync as mkdirSync17, mkdtempSync as mkdtempSync3, readFileSync as readFileSync34, rmSync as rmSync10, symlinkSync, writeFileSync as writeFileSync20 } from "fs";
+import { existsSync as existsSync28, mkdirSync as mkdirSync17, mkdtempSync as mkdtempSync3, readFileSync as readFileSync35, rmSync as rmSync10, symlinkSync as symlinkSync2, writeFileSync as writeFileSync20 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { basename as basename15, dirname as dirname15, isAbsolute as isAbsolute6, join as join43, relative as relative4 } from "path";
+import { basename as basename16, dirname as dirname15, isAbsolute as isAbsolute6, join as join44, relative as relative5 } from "path";
 function mutationProof(i) {
-  const rels = i.wallFiles.map((f) => isAbsolute6(f.path) ? relative4(i.repoDir, f.path) : f.path);
+  const rels = i.wallFiles.map((f) => isAbsolute6(f.path) ? relative5(i.repoDir, f.path) : f.path);
   if (rels.length === 0)
     return np("no Wall tests");
   const tests = rels.flatMap((rel) => {
@@ -11722,28 +11815,28 @@ function mutationProof(i) {
   const deadline = Date.now() + budgetS * 1000, remaining = () => deadline - Date.now();
   let parent = null, wt = null, added = false;
   try {
-    parent = mkdtempSync3(join43(tmpdir4(), "loki-mutproof-"));
-    wt = join43(parent, "wt");
+    parent = mkdtempSync3(join44(tmpdir4(), "loki-mutproof-"));
+    wt = join44(parent, "wt");
     const add3 = git(i.repoDir, ["worktree", "add", "--detach", wt, i.baseSha], Math.max(1000, Math.min(30000, remaining())));
-    added = existsSync27(wt) || add3.status === 0;
+    added = existsSync28(wt) || add3.status === 0;
     if (add3.status !== 0)
       return np("could not create the base worktree");
     for (const rel of rels) {
-      const sealed = join43(i.runDir, "wall", basename15(rel)), src = existsSync27(sealed) ? sealed : join43(i.repoDir, rel);
-      if (!existsSync27(src))
+      const sealed = join44(i.runDir, "wall", basename16(rel)), src = existsSync28(sealed) ? sealed : join44(i.repoDir, rel);
+      if (!existsSync28(src))
         return np(`Wall file missing: ${rel}`);
-      mkdirSync17(dirname15(join43(wt, rel)), { recursive: true });
-      writeFileSync20(join43(wt, rel), readFileSync34(src));
+      mkdirSync17(dirname15(join44(wt, rel)), { recursive: true });
+      writeFileSync20(join44(wt, rel), readFileSync35(src));
     }
     for (const rel of rels) {
       const parts = rel.split("/").slice(0, -1);
       for (let n2 = 0;n2 <= parts.length; n2++) {
         const anc = parts.slice(0, n2).join("/");
         for (const d of DEP_DIRS) {
-          const src = join43(i.repoDir, anc, d), dst = join43(wt, anc, d);
-          if (existsSync27(src) && !existsSync27(dst)) {
+          const src = join44(i.repoDir, anc, d), dst = join44(wt, anc, d);
+          if (existsSync28(src) && !existsSync28(dst)) {
             try {
-              symlinkSync(src, dst);
+              symlinkSync2(src, dst);
             } catch {}
           }
         }
@@ -11887,14 +11980,14 @@ var init_shell = __esm(() => {
 });
 
 // ../../loki-ts/src/util/python.ts
-import { accessSync, constants as constants3, existsSync as existsSync28, mkdtempSync as mkdtempSync4, readFileSync as readFileSync35, realpathSync as realpathSync18, rmSync as rmSync11, statSync as statSync18 } from "fs";
+import { accessSync, constants as constants3, existsSync as existsSync29, mkdtempSync as mkdtempSync4, readFileSync as readFileSync36, realpathSync as realpathSync19, rmSync as rmSync11, statSync as statSync18 } from "fs";
 import { spawnSync as spawnSync4 } from "child_process";
 import { tmpdir as tmpdir5 } from "os";
 async function findPython3() {
   if (_pythonCache !== undefined)
     return _pythonCache;
   const homebrew = "/opt/homebrew/bin/python3.12";
-  if (existsSync28(homebrew)) {
+  if (existsSync29(homebrew)) {
     _pythonCache = homebrew;
     return homebrew;
   }
@@ -12245,7 +12338,7 @@ var init_wall_manifest = __esm(() => {
 
 // ../../loki-ts/src/features/wall_manifest_wire.ts
 import { createHash as createHash12 } from "crypto";
-import { basename as basename16, dirname as dirname16 } from "path";
+import { basename as basename17, dirname as dirname16 } from "path";
 function blobEntries(ls) {
   const out2 = [];
   for (const raw2 of ls.toString("latin1").split("\x00")) {
@@ -12275,12 +12368,12 @@ function wallManifestFor(repoDir, tree, task, env = process.env) {
       return null;
     const low = task.toLowerCase().replace(/\\/g, "/");
     const token = (n2) => new RegExp(`(?<![A-Za-z0-9_])${n2.toLowerCase().replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![A-Za-z0-9_])`).test(low);
-    const dirModule = (e) => /^(index|__init__|mod|main)\.[^.]+$/.test(basename16(e.path)) && e.path.includes("/") && token(dirname16(e.path));
-    const matched = all.filter((e) => SOURCE.test(e.path) && (token(basename16(e.path)) || token(e.path) || token(basename16(e.path).replace(/\.[^.]*$/, "")) || dirModule(e)));
+    const dirModule = (e) => /^(index|__init__|mod|main)\.[^.]+$/.test(basename17(e.path)) && e.path.includes("/") && token(dirname16(e.path));
+    const matched = all.filter((e) => SOURCE.test(e.path) && (token(basename17(e.path)) || token(e.path) || token(basename17(e.path).replace(/\.[^.]*$/, "")) || dirModule(e)));
     const spans = (p) => [...low.matchAll(new RegExp(`(?<![A-Za-z0-9_])${p.toLowerCase().replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![A-Za-z0-9_])`, "g"))].map((m) => [m.index, m.index + m[0].length]);
     const occ = new Map(matched.map((e) => [e, spans(e.path)]));
     const exact = (e) => occ.get(e).some(([s, t]) => !matched.some((o) => o !== e && o.path.length > e.path.length && occ.get(o).some(([s2, t2]) => s2 <= s && t <= t2)));
-    const byPath2 = matched.filter(exact).sort((a, b) => b.path.length - a.path.length), byBase = matched.filter((e) => !byPath2.includes(e) && token(basename16(e.path)));
+    const byPath2 = matched.filter(exact).sort((a, b) => b.path.length - a.path.length), byBase = matched.filter((e) => !byPath2.includes(e) && token(basename17(e.path)));
     const named = [...byPath2, ...byBase, ...matched.filter((e) => !byPath2.includes(e) && !byBase.includes(e))].slice(0, MAX_NAMED);
     const tests = all.filter((e) => TESTISH.test(e.path)).slice(0, MAX_FILES), listed = tests.filter((e) => !SOURCE.test(e.path));
     const want = [...new Set([...all.filter((e) => CONFIG.test(e.path)), ...tests.filter((e) => SOURCE.test(e.path)), ...named])];
@@ -12337,9 +12430,9 @@ Example: test('name', () => { assert.strictEqual(fn(1), 2); });  Run: node --tes
 
 // ../../loki-ts/src/util/holdout.ts
 import { createHash as createHash13 } from "crypto";
-import { appendFileSync as appendFileSync3, copyFileSync as copyFileSync2, existsSync as existsSync29, mkdirSync as mkdirSync18, readFileSync as readFileSync36, rmSync as rmSync12, writeFileSync as writeFileSync21 } from "fs";
+import { appendFileSync as appendFileSync3, copyFileSync as copyFileSync2, existsSync as existsSync30, mkdirSync as mkdirSync18, readFileSync as readFileSync37, rmSync as rmSync12, writeFileSync as writeFileSync21 } from "fs";
 import { tmpdir as tmpdir6 } from "os";
-import { basename as basename17, join as join44, relative as relative5 } from "path";
+import { basename as basename18, join as join45, relative as relative6 } from "path";
 function wallHoldoutRatio(env = process.env) {
   if (env["LOKI_WALL_HOLDOUT"]?.trim() === "0")
     return 0;
@@ -12370,32 +12463,32 @@ function stashHoldout(o) {
   rmSync12(dir, { recursive: true, force: true });
   mkdirSync18(dir, { recursive: true, mode: 448 });
   const files = held.map((name) => {
-    copyFileSync2(join44(o.srcDir, name), join44(dir, name));
-    rmSync12(join44(o.srcDir, name), { force: true });
-    return { name, runner: o.runnerOf(name), sha256: sha2(readFileSync36(join44(dir, name), "utf8")) };
+    copyFileSync2(join45(o.srcDir, name), join45(dir, name));
+    rmSync12(join45(o.srcDir, name), { force: true });
+    return { name, runner: o.runnerOf(name), sha256: sha2(readFileSync37(join45(dir, name), "utf8")) };
   });
-  writeFileSync21(join44(dir, MANIFEST), JSON.stringify({ targetDir: o.targetDir, files }));
+  writeFileSync21(join45(dir, MANIFEST), JSON.stringify({ targetDir: o.targetDir, files }));
   return { dir, names: new Set(held) };
 }
 function stageHoldout(dir, repoDir) {
   const put = [], tests = [], missing = [];
   let man = null;
   try {
-    man = JSON.parse(readFileSync36(join44(dir, MANIFEST), "utf8"));
+    man = JSON.parse(readFileSync37(join45(dir, MANIFEST), "utf8"));
   } catch {}
   if (!man)
-    return { tests, missing: [`holdout store unreadable: ${basename17(dir)}`], cleanup: () => {} };
+    return { tests, missing: [`holdout store unreadable: ${basename18(dir)}`], cleanup: () => {} };
   mkdirSync18(man.targetDir, { recursive: true });
   man.files.forEach((f, i) => {
-    const src = join44(dir, f.name);
-    if (!existsSync29(src) || sha2(readFileSync36(src, "utf8")) !== f.sha256) {
+    const src = join45(dir, f.name);
+    if (!existsSync30(src) || sha2(readFileSync37(src, "utf8")) !== f.sha256) {
       missing.push(`holdout ${i + 1} missing or altered`);
       return;
     }
-    const dest = join44(man.targetDir, `loki_wall_holdout_${i + 1}${f.name.slice(f.name.indexOf("."))}`);
+    const dest = join45(man.targetDir, `loki_wall_holdout_${i + 1}${f.name.slice(f.name.indexOf("."))}`);
     copyFileSync2(src, dest);
     put.push(dest);
-    tests.push({ runner: f.runner, path: relative5(repoDir, dest) });
+    tests.push({ runner: f.runner, path: relative6(repoDir, dest) });
   });
   return { tests, missing, cleanup: () => {
     for (const p of put)
@@ -12405,11 +12498,11 @@ function stageHoldout(dir, repoDir) {
 function recordHoldoutTriage(runDir, entry) {
   try {
     mkdirSync18(runDir, { recursive: true });
-    appendFileSync3(join44(runDir, HOLDOUT_TRIAGE_FILE), JSON.stringify(entry) + `
+    appendFileSync3(join45(runDir, HOLDOUT_TRIAGE_FILE), JSON.stringify(entry) + `
 `, { mode: 384 });
   } catch {}
 }
-var sha2 = (s) => createHash13("sha256").update(s).digest("hex"), WALL_HOLDOUT_DEFAULT_RATIO = 0.2, isHoldoutCheck = (name) => name.startsWith("holdout:"), holdoutDirFor = (runId2, repoDir) => join44(tmpdir6(), `loki-e10-holdout-${sha2(`${runId2}:${repoDir}`).slice(0, 16)}`), MANIFEST = "manifest.json", WALL_HOLDOUT_MIN = 5, HOLDOUT_TRIAGE_FILE = "holdout-triage.jsonl";
+var sha2 = (s) => createHash13("sha256").update(s).digest("hex"), WALL_HOLDOUT_DEFAULT_RATIO = 0.2, isHoldoutCheck = (name) => name.startsWith("holdout:"), holdoutDirFor = (runId2, repoDir) => join45(tmpdir6(), `loki-e10-holdout-${sha2(`${runId2}:${repoDir}`).slice(0, 16)}`), MANIFEST = "manifest.json", WALL_HOLDOUT_MIN = 5, HOLDOUT_TRIAGE_FILE = "holdout-triage.jsonl";
 var init_holdout = () => {};
 
 // ../../loki-ts/src/runner/runner_errors.ts
@@ -12455,19 +12548,19 @@ var init_runner_errors = __esm(() => {
 
 // ../../loki-ts/src/runner/load_owner.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { mkdtempSync as mkdtempSync5, realpathSync as realpathSync19, rmSync as rmSync13 } from "fs";
+import { mkdtempSync as mkdtempSync5, realpathSync as realpathSync20, rmSync as rmSync13 } from "fs";
 import { tmpdir as tmpdir7 } from "os";
-import { basename as basename18, extname as extname2, join as join45 } from "path";
+import { basename as basename19, extname as extname2, join as join46 } from "path";
 function changedFilesNamed(out2, repoDir, changed) {
   return changed.filter((f) => {
-    if (out2.includes(f) || out2.includes(join45(repoDir, f)))
+    if (out2.includes(f) || out2.includes(join46(repoDir, f)))
       return true;
     const segs = f.split("/");
     if (suffixes(segs, 2).some((x) => x !== f && bounded(out2, x, "(?![\\w-])")))
       return true;
     if (extname2(f) === ".go" && segs.length > 1 && suffixes(segs.slice(0, -1), 1).some((d) => new RegExp(`(?<=[\\w-])/${esc(d)}(?![\\w./-])`).test(out2)))
       return true;
-    const stem = basename18(f, extname2(f));
+    const stem = basename19(f, extname2(f));
     if (stem.length < 2 || stem === "index" || stem === "__init__")
       return false;
     return new RegExp(`(?<![\\w-])${esc(stem)}(?![\\w-])`).test(out2);
@@ -12477,7 +12570,7 @@ function loadSignature(out2, roots) {
   let o = out2;
   for (const r of roots.flatMap((x) => {
     try {
-      return [x, realpathSync19(x)];
+      return [x, realpathSync20(x)];
     } catch {
       return [x];
     }
@@ -12579,7 +12672,7 @@ async function loadErrorIsHarnessOwned(i) {
     return false;
   if (i.args.some((a) => changed.includes(a.replace(/^\.\//, ""))))
     return false;
-  const dir = mkdtempSync5(join45(tmpdir7(), "e10-loadown-"));
+  const dir = mkdtempSync5(join46(tmpdir7(), "e10-loadown-"));
   const git3 = (args) => {
     safeGit(i.repoDir, args, { stdio: "ignore" });
   };
@@ -12611,7 +12704,7 @@ var init_load_owner = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/package_suite.ts
-import { join as join46 } from "path";
+import { join as join47 } from "path";
 function packageSuiteSpecs(api) {
   if (!isMultiRoot(api))
     return null;
@@ -12621,29 +12714,32 @@ function packageSuiteSpecs(api) {
   });
   return specs.length ? specs : null;
 }
+function suiteEnv(path) {
+  return path ? { ...plainTestEnv(), PATH: path } : plainTestEnv();
+}
 async function runPackageSuites(repoDir, signal, opts, checks, notProven) {
   const api = loadProjectApi(repoDir), specs = packageSuiteSpecs(api);
   if (!api || !specs)
     return false;
   for (const { name, cmd: cmd2, cwd, run: line2 } of specs) {
     const started = Date.now();
-    const r = await run(["bash", "-c", line2], { cwd: join46(repoDir, cwd), timeoutMs: opts.timeoutMs, ...opts.path ? { env: { PATH: opts.path } } : {} });
+    const r = await run(["bash", "-c", line2], { cwd: join47(repoDir, cwd), timeoutMs: opts.timeoutMs, env: suiteEnv(opts.path) });
     const duration_s = (Date.now() - started) / 1000;
     if (signal.aborted) {
       checks.push({ name, cmd: cmd2, result: "not_run", duration_s });
       notProven.add(`not run: ${name} (aborted)`);
       continue;
     }
-    const out2 = `${r.stdout}
-${r.stderr}`;
-    const lr = r.exitCode === 0 || !opts.baseSha ? undefined : await harnessLoadReason({ repoDir, baseSha: opts.baseSha, ...opts.skip ? { skip: opts.skip } : {}, out: out2, cmd: "bash", args: ["-c", line2], signal, cwd: join46(repoDir, cwd), ...opts.path ? { env: { PATH: opts.path } } : {} });
+    const out2 = stripAnsi(`${r.stdout}
+${r.stderr}`);
+    const lr = r.exitCode === 0 || !opts.baseSha ? undefined : await harnessLoadReason({ repoDir, baseSha: opts.baseSha, ...opts.skip ? { skip: opts.skip } : {}, out: out2, cmd: "bash", args: ["-c", line2], signal, cwd: join47(repoDir, cwd), env: suiteEnv(opts.path) });
     if (lr) {
       checks.push({ name, cmd: cmd2, result: "not_run", duration_s });
       notProven.add(`${lr} (${name}; harness-owned)`);
       continue;
     }
     const cls = classifyCheck({ kind: "test", ok: r.exitCode === 0, out: out2, ...goRunner(line2) });
-    checks.push({ name, cmd: cmd2, result: cls.result, duration_s, ...cls.result === "fail" ? { ids: failIds(out2) } : {} });
+    checks.push({ name, cmd: cmd2, result: cls.result, duration_s, ...cls.result === "fail" ? { ids: failIds(out2), excerpt: failureExcerpt(out2, repoDir) } : {} });
     if (cls.result === "not_run")
       notProven.add(`not run: ${name} (${cls.reason ?? NO_TESTS_REASON})`);
   }
@@ -12682,8 +12778,8 @@ var init_install = __esm(() => {
 });
 
 // ../../loki-ts/src/features/runner_config.ts
-import { readFileSync as readFileSync37 } from "fs";
-import { dirname as dirname17, join as join47, normalize as normalize2 } from "path";
+import { readFileSync as readFileSync38 } from "fs";
+import { dirname as dirname17, join as join48, normalize as normalize2 } from "path";
 function tomlKey2(s, i = 0, eq2 = true) {
   const parts = [], ws = () => {
     while (/\s/.test(s[i] ?? "x"))
@@ -12960,8 +13056,8 @@ function referenced(cfg, text2) {
     }
   const dir = dirname17(cfg), explicit = ROOT_DIR.exec(text2), roots = [dir];
   if (explicit)
-    roots.push("", ...explicit[1] ? [join47(dir, explicit[1])] : []);
-  return [...raw2.flatMap((r) => r.startsWith("/") ? [normalize2(r.slice(1))] : roots.map((root) => normalize2(join47(root, r.replace(/^<rootDir>\/?/, ""))))), ...patchedTargets(cfg, text2).map((t) => normalize2(join47(dir, t)))];
+    roots.push("", ...explicit[1] ? [join48(dir, explicit[1])] : []);
+  return [...raw2.flatMap((r) => r.startsWith("/") ? [normalize2(r.slice(1))] : roots.map((root) => normalize2(join48(root, r.replace(/^<rootDir>\/?/, ""))))), ...patchedTargets(cfg, text2).map((t) => normalize2(join48(dir, t)))];
 }
 function runnerConfigNotes(repoDir, baseSha, head, changed, signal) {
   const notes = new Set, ch = new Set(changed.map((c) => normalize2(c)));
@@ -13041,7 +13137,7 @@ var PKG_KEYS, RAW_CONFIGS, RUNNER_CONFIGS, DEP_MAPS, RUNNER_DEP, LOCAL_SPEC, dep
   }
 }, headText = (dir, f) => {
   try {
-    return readFileSync37(join47(dir, f), "utf8");
+    return readFileSync38(join48(dir, f), "utf8");
   } catch {
     return "";
   }
@@ -13081,19 +13177,19 @@ var init_runner_config = __esm(() => {
 
 // ../../loki-ts/src/e10ext/assert_delta.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { mkdtempSync as mkdtempSync6, readFileSync as readFileSync38, rmSync as rmSync14 } from "fs";
+import { mkdtempSync as mkdtempSync6, readFileSync as readFileSync39, rmSync as rmSync14 } from "fs";
 import { tmpdir as tmpdir8 } from "os";
-import { join as join48 } from "path";
-import { basename as basename19 } from "path";
+import { join as join49 } from "path";
+import { basename as basename20 } from "path";
 function classifyAssertDelta(inp) {
-  const f = basename19(inp.path);
+  const f = basename20(inp.path);
   if (!/^(test_.*|.*_test)\.py$/.test(f))
     return WEAKENED;
   if (inp.headCounts.run !== inp.baseCounts.run || inp.headCounts.skipped !== inp.baseCounts.skipped)
     return WEAKENED;
   let cwd = "";
   try {
-    cwd = mkdtempSync6(join48(tmpdir8(), "loki-ad-"));
+    cwd = mkdtempSync6(join49(tmpdir8(), "loki-ad-"));
     const raw2 = execFileSync4("python3", ["-I", "-c", PY], {
       input: JSON.stringify({ path: inp.path, base: inp.base, head: inp.head, task: inp.task }),
       cwd,
@@ -13124,7 +13220,7 @@ function assertDeltaNotes(repoDir, baseSha, headRef, path, task, baseCounts, hea
     return null;
   try {
     const show = (ref) => safeGit(repoDir, ["show", `${ref}:${path}`]);
-    const head = headRef ? show(headRef) : readFileSync38(join48(repoDir, path), "utf8");
+    const head = headRef ? show(headRef) : readFileSync39(join49(repoDir, path), "utf8");
     const r = classifyTestEdit(path, show(baseSha), head, task, baseCounts, headCounts);
     return r[0]?.kind === "literal-only" ? r.map((e) => `assertion value changed (not shown to be required by the task): ${e.file}:${e.line} ${e.old} -> ${e.new}`) : null;
   } catch {
@@ -13307,7 +13403,7 @@ var init_select = __esm(() => {
 });
 
 // ../../loki-ts/src/util/wall_owned.ts
-import { isAbsolute as isAbsolute7, join as join49, relative as relative6 } from "path";
+import { isAbsolute as isAbsolute7, join as join50, relative as relative7 } from "path";
 function failingLocations(raw2, cwd, repoDir) {
   const out2 = raw2.replace(ANSI2, "").replace(/\r\n?/g, `
 `), files = new Set;
@@ -13339,7 +13435,7 @@ function failingLocations(raw2, cwd, repoDir) {
   }
   if (errors2 === 0 || located !== errors2)
     return null;
-  return [...files].map((f) => relative6(repoDir, isAbsolute7(f) ? f : join49(cwd, f)));
+  return [...files].map((f) => relative7(repoDir, isAbsolute7(f) ? f : join50(cwd, f)));
 }
 function wallOwnedFailure(raw2, cwd, repoDir, wall) {
   const locs = failingLocations(raw2, cwd, repoDir);
@@ -13352,25 +13448,25 @@ var init_wall_owned = __esm(() => {
 
 // ../../loki-ts/src/util/app_probe.ts
 import { spawnSync as spawnSync6 } from "child_process";
-import { existsSync as existsSync30, mkdirSync as mkdirSync19, readFileSync as readFileSync39, renameSync as renameSync11, writeFileSync as writeFileSync22 } from "fs";
-import { join as join50 } from "path";
+import { existsSync as existsSync31, mkdirSync as mkdirSync19, readFileSync as readFileSync40, renameSync as renameSync11, writeFileSync as writeFileSync22 } from "fs";
+import { join as join51 } from "path";
 function readJson4(p) {
   try {
-    const v = JSON.parse(readFileSync39(p, "utf8"));
+    const v = JSON.parse(readFileSync40(p, "utf8"));
     return v && typeof v === "object" ? v : null;
   } catch {
     return null;
   }
 }
 function stopApp(repoDir, opts = {}) {
-  const runner = opts.runnerPath ?? join50(REPO_ROOT, "autonomy", "app-runner.sh");
-  if (!existsSync30(runner) || !existsSync30(join50(repoDir, ".loki", "app-runner", "app.pid")))
+  const runner = opts.runnerPath ?? join51(REPO_ROOT, "autonomy", "app-runner.sh");
+  if (!existsSync31(runner) || !existsSync31(join51(repoDir, ".loki", "app-runner", "app.pid")))
     return;
   spawnSync6("bash", ["-c", STOP, "app-probe", repoDir, runner], { cwd: repoDir, env: plainTestEnv(), timeout: opts.timeoutMs ?? 60000, killSignal: "SIGKILL", stdio: "ignore" });
 }
 async function appProbe(repoDir, lokiDir2, opts = {}) {
-  const timeoutMs = opts.timeoutMs ?? 60000, runner = opts.runnerPath ?? join50(REPO_ROOT, "autonomy", "app-runner.sh");
-  const dir = join50(repoDir, ".loki", "app-runner"), checks = [];
+  const timeoutMs = opts.timeoutMs ?? 60000, runner = opts.runnerPath ?? join51(REPO_ROOT, "autonomy", "app-runner.sh");
+  const dir = join51(repoDir, ".loki", "app-runner"), checks = [];
   const t0 = Date.now();
   const mk2 = (name, result, reason) => ({ name, cmd: "autonomy/app-runner.sh", result, duration_s: (Date.now() - t0) / 1000, reason });
   const sh = (script) => {
@@ -13378,7 +13474,7 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
     return { out: r.stdout ?? "", status: r.error ? null : r.status };
   };
   let pid = null, url = null;
-  if (!existsSync30(runner))
+  if (!existsSync31(runner))
     return { checks: [mk2("app boot", "not_run", "app-runner.sh not found"), mk2("http probe", "not_run", "app not booted")], pid, url };
   try {
     const b = sh(BOOT);
@@ -13388,9 +13484,9 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
       return { checks, pid, url };
     }
     const ir = Number(m[1]), sr = Number(m[2]), hr = Number(m[3]);
-    const pidTxt = existsSync30(join50(dir, "app.pid")) ? readFileSync39(join50(dir, "app.pid"), "utf8").trim() : "";
+    const pidTxt = existsSync31(join51(dir, "app.pid")) ? readFileSync40(join51(dir, "app.pid"), "utf8").trim() : "";
     pid = /^\d+$/.test(pidTxt) && sr >= 0 ? Number(pidTxt) : null;
-    const st = readJson4(join50(dir, "state.json"));
+    const st = readJson4(join51(dir, "state.json"));
     url = typeof st?.["url"] === "string" ? st["url"] : null;
     if (sr < 0) {
       checks.push(mk2("app boot", "not_run", ir === 0 ? "app-runner detected no app" : "no runnable app detected or runtime missing"), mk2("http probe", "not_run", "app not booted"));
@@ -13401,7 +13497,7 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
       return { checks, pid, url };
     }
     checks.push(mk2("app boot", "pass", "app process started"));
-    const health = readJson4(join50(dir, "health.json"));
+    const health = readJson4(join51(dir, "health.json"));
     checks.push(hr === 0 && health?.["ok"] === true ? mk2("http probe", "pass", "health.json ok") : mk2("http probe", "fail", "app-runner health check failed"));
     if (opts.specText !== undefined && checks[1]?.result === "pass" && url)
       checks.push(await functionalVerify(opts, url, dir, lokiDir2, timeoutMs));
@@ -13414,10 +13510,10 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
 async function functionalVerify(opts, url, dir, lokiDir2, timeoutMs) {
   const t0 = Date.now();
   const res = (result, reason) => ({ name: "functional verify", cmd: "autonomy/lib/functional-verify.py", result, duration_s: (Date.now() - t0) / 1000, reason });
-  const py = await findPython3(), script = opts.verifyPath ?? join50(REPO_ROOT, "autonomy", "lib", "functional-verify.py");
-  if (!py || !existsSync30(script))
+  const py = await findPython3(), script = opts.verifyPath ?? join51(REPO_ROOT, "autonomy", "lib", "functional-verify.py");
+  if (!py || !existsSync31(script))
     return res("not_run", "python3 or functional-verify.py unavailable");
-  const specFile = join50(dir, "spec.txt");
+  const specFile = join51(dir, "spec.txt");
   writeFileSync22(specFile, opts.specText ?? "");
   const r = spawnSync6(py, ["-I", script, specFile, url], { env: plainTestEnv(), encoding: "utf8", timeout: timeoutMs, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "ignore"] });
   let out2 = null;
@@ -13429,11 +13525,11 @@ async function functionalVerify(opts, url, dir, lokiDir2, timeoutMs) {
   }
   if (!out2 || r.status !== 0)
     return res("not_run", "functional harness produced no result");
-  const q = join50(lokiDir2, "quality");
+  const q = join51(lokiDir2, "quality");
   mkdirSync19(q, { recursive: true });
-  const tmp = join50(q, `functional-results.json.tmp.${process.pid}`);
+  const tmp = join51(q, `functional-results.json.tmp.${process.pid}`);
   writeFileSync22(tmp, JSON.stringify(out2, null, 2));
-  renameSync11(tmp, join50(q, "functional-results.json"));
+  renameSync11(tmp, join51(q, "functional-results.json"));
   const s = String(out2["functional_status"] ?? "inconclusive");
   return res(s === "verified" ? "pass" : s === "failed" ? "fail" : "not_run", `functional_status ${s}`);
 }
@@ -13463,16 +13559,16 @@ app_runner_stop >/dev/null 2>&1
 });
 
 // ../../loki-ts/src/util/secure_scan.ts
-import { existsSync as existsSync31, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync7, readFileSync as readFileSync40, realpathSync as realpathSync20, rmSync as rmSync15, statSync as statSync19, writeFileSync as writeFileSync23 } from "fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync7, readFileSync as readFileSync41, realpathSync as realpathSync21, rmSync as rmSync15, statSync as statSync19, writeFileSync as writeFileSync23 } from "fs";
 import { randomBytes as randomBytes5 } from "crypto";
 import { tmpdir as tmpdir9 } from "os";
-import { basename as basename20, dirname as dirname18, join as join51, resolve as resolve15, sep as sep11 } from "path";
+import { basename as basename21, dirname as dirname18, join as join52, resolve as resolve16, sep as sep12 } from "path";
 function fail(error) {
   return { ok: false, findings: [], error };
 }
 async function runSecureScan(targetDir, opts = {}) {
-  const script = opts.scriptPath ?? join51(REPO_ROOT, "autonomy", "lib", "secure-scan.py");
-  if (!existsSync31(script))
+  const script = opts.scriptPath ?? join52(REPO_ROOT, "autonomy", "lib", "secure-scan.py");
+  if (!existsSync32(script))
     return fail(`secure-scan script not found: ${script}`);
   const py = await findPython3();
   if (!py)
@@ -13523,7 +13619,7 @@ function isWorkTreeRoot(dir) {
   if (top === null)
     return false;
   try {
-    return realpathSync20(top.trim()) === realpathSync20(dir);
+    return realpathSync21(top.trim()) === realpathSync21(dir);
   } catch {
     return false;
   }
@@ -13641,7 +13737,7 @@ async function scanAddedLines(repoDir, opts = {}) {
   const skipped2 = [];
   for (const p of untracked.split("\x00").filter(Boolean)) {
     try {
-      const st = statSync19(join51(repoDir, p));
+      const st = statSync19(join52(repoDir, p));
       if (!st.isFile())
         continue;
       if (st.size > MAX_ADDED_FILE_BYTES) {
@@ -13656,23 +13752,23 @@ async function scanAddedLines(repoDir, opts = {}) {
         continue;
       }
       const lines2 = new Map;
-      readFileSync40(join51(repoDir, p), "utf8").split(`
+      readFileSync41(join52(repoDir, p), "utf8").split(`
 `).forEach((t, i) => lines2.set(i + 1, t));
       added.set(p, lines2);
     } catch {}
   }
   if (added.size === 0)
     return { ok: true, findings: skipped2 };
-  const mirror = mkdtempSync7(join51(tmpdir9(), "loki-secure-added-"));
+  const mirror = mkdtempSync7(join52(tmpdir9(), "loki-secure-added-"));
   try {
-    const root = resolve15(mirror) + sep11;
+    const root = resolve16(mirror) + sep12;
     const chunkMap = new Map;
     const chunkRoot = `.loki-chunks-${randomBytes5(6).toString("hex")}`;
     let chunkSeq = 0;
     for (const [p, lines2] of added) {
       if (lines2.size === 0)
         continue;
-      const dest = resolve15(mirror, p);
+      const dest = resolve16(mirror, p);
       if (!dest.startsWith(root))
         continue;
       let max = 0;
@@ -13709,8 +13805,8 @@ async function scanAddedLines(repoDir, opts = {}) {
         chunks.push(cur);
       const whole = chunks.length === 1;
       for (const c of chunks) {
-        const rel = whole ? p : join51(chunkRoot, String(chunkSeq++), basename20(p));
-        const out2 = whole ? dest : resolve15(mirror, rel);
+        const rel = whole ? p : join52(chunkRoot, String(chunkSeq++), basename21(p));
+        const out2 = whole ? dest : resolve16(mirror, rel);
         if (!out2.startsWith(root))
           break;
         chunkMap.set(rel, { file: p, lines: c.orig });
@@ -13727,7 +13823,7 @@ async function scanAddedLines(repoDir, opts = {}) {
     for (let f of r.findings) {
       if (f.rule !== "secret-in-client-file")
         continue;
-      const c = chunkMap.get(f.file.split(sep11).join("/"));
+      const c = chunkMap.get(f.file.split(sep12).join("/"));
       if (c)
         f = { ...f, file: c.file, line: c.lines[f.line - 1] ?? f.line };
       const kind = /A live (\S+)/.exec(f.message)?.[1] ?? "provider key";
@@ -13859,9 +13955,9 @@ var init_route_block = __esm(() => {
 // ../../loki-ts/src/features/visual_evidence.ts
 import { spawn as spawn8 } from "child_process";
 import { createHash as createHash14, randomBytes as randomBytes6 } from "crypto";
-import { existsSync as existsSync32, lstatSync as lstatSync12, mkdirSync as mkdirSync21, readdirSync as readdirSync18, readFileSync as readFileSync41, writeFileSync as writeFileSync24 } from "fs";
+import { existsSync as existsSync33, lstatSync as lstatSync12, mkdirSync as mkdirSync21, readdirSync as readdirSync19, readFileSync as readFileSync42, writeFileSync as writeFileSync24 } from "fs";
 import { createServer } from "net";
-import { dirname as dirname19, isAbsolute as isAbsolute8, join as join52, normalize as normalize3, relative as relative7, sep as sep12 } from "path";
+import { dirname as dirname19, isAbsolute as isAbsolute8, join as join53, normalize as normalize3, relative as relative8, sep as sep13 } from "path";
 function routeFor(file) {
   let r = file.replace(/^(?:.*?\/)?(?:app|pages|src|public)\//, "").replace(/^(?:routes|pages)\//, "");
   r = r.replace(/\.(?:html|jsx|tsx|vue|svelte)$/, "").replace(/\/?(?:page|index|\+page)$/, "");
@@ -13871,7 +13967,7 @@ function hashScreens(runDir, rels) {
   const out2 = [];
   for (const rel of rels) {
     try {
-      out2.push({ path: rel, sha256: sha256File(join52(runDir, rel)) });
+      out2.push({ path: rel, sha256: sha256File(join53(runDir, rel)) });
     } catch {}
   }
   return out2;
@@ -13884,14 +13980,14 @@ function checkScreens(runDir, screens) {
       return "evidence_screens entry is malformed";
     if (isAbsolute8(s.path) || normalize3(s.path).startsWith(".."))
       return `evidence screenshot path escapes the evidence dir: ${s.path}`;
-    const file = join52(runDir, s.path);
+    const file = join53(runDir, s.path);
     let cur = runDir;
-    for (const seg of normalize3(s.path).split(sep12)) {
-      cur = join52(cur, seg);
+    for (const seg of normalize3(s.path).split(sep13)) {
+      cur = join53(cur, seg);
       if (isSymlink(cur))
         return `evidence screenshot path is a symlink: ${s.path}`;
     }
-    if (!existsSync32(file))
+    if (!existsSync33(file))
       return `evidence screenshot is missing: ${s.path}`;
     if (!isRegularFile(file))
       return `evidence screenshot is not a regular file: ${s.path}`;
@@ -13934,11 +14030,11 @@ async function waitUp(url, ms, signal) {
 }
 function openapiPaths(repoDir) {
   for (const f of ["openapi.json", "openapi.yaml", "openapi.yml", "swagger.json"]) {
-    const p = join52(repoDir, f);
-    if (!existsSync32(p))
+    const p = join53(repoDir, f);
+    if (!existsSync33(p))
       continue;
     try {
-      const txt = readFileSync41(p, "utf8");
+      const txt = readFileSync42(p, "utf8");
       const paths = f.endsWith(".json") ? Object.keys(JSON.parse(txt).paths ?? {}) : [...txt.matchAll(/^ {2}(\/[^\s:]*):\s*$/gm)].map((m) => m[1]);
       return paths.filter((x) => !x.includes("{")).slice(0, 10);
     } catch {
@@ -13952,24 +14048,24 @@ async function recordE2eMedia(repoDir, runDir, relDir, base, routes, ms, signal)
   if (!pw || !pkg)
     return { rels: [], skipped: "playwright e2e video and trace skipped: @playwright/test is not installed in the repo" };
   try {
-    const dir = join52(runDir, relDir, "e2e");
+    const dir = join53(runDir, relDir, "e2e");
     mkdirSync21(dir, { recursive: true });
-    writeFileSync24(join52(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
-    writeFileSync24(join52(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
+    writeFileSync24(join53(dir, "walk.spec.cjs"), e2eSpecSource(pkg, base, routes));
+    writeFileSync24(join53(dir, "playwright.config.cjs"), `module.exports = { testDir: ".", testMatch: "walk.spec.cjs", outputDir: "./out", reporter: "null", use: { video: "on", trace: "on" } };
 `);
-    if (!await shoot(pw, ["test", "--config", join52(dir, "playwright.config.cjs")], repoDir, ms, signal))
+    if (!await shoot(pw, ["test", "--config", join53(dir, "playwright.config.cjs")], repoDir, ms, signal))
       return { rels: [], skipped: "playwright e2e video and trace skipped: the run failed or timed out" };
     const rels = [];
     const walk = (d) => {
-      for (const e of readdirSync18(d, { withFileTypes: true })) {
-        const full = join52(d, e.name);
+      for (const e of readdirSync19(d, { withFileTypes: true })) {
+        const full = join53(d, e.name);
         if (e.isDirectory())
           walk(full);
         else if (e.isFile() && /\.(webm|zip)$/.test(e.name))
-          rels.push(join52(relDir, "e2e", relative7(dir, full)));
+          rels.push(join53(relDir, "e2e", relative8(dir, full)));
       }
     };
-    walk(join52(dir, "out"));
+    walk(join53(dir, "out"));
     return rels.length > 0 ? { rels, skipped: null } : { rels, skipped: "playwright e2e video and trace skipped: no video or trace was produced" };
   } catch (e) {
     return { rels: [], skipped: `playwright e2e video and trace skipped: ${String(e?.message ?? e).slice(0, 120)}` };
@@ -14048,22 +14144,22 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     if (!visualEvidenceEnabled(opts.env))
       return skip("LOKI_VISUAL_EVIDENCE is 0");
     const api = loadProjectApi(repoDir), boot = isMultiRoot(api) ? api.uiBoot() : null;
-    const appDir = boot ? join52(repoDir, boot.boot.cwd) : repoDir;
-    const pkgPath = join52(appDir, "package.json");
+    const appDir = boot ? join53(repoDir, boot.boot.cwd) : repoDir;
+    const pkgPath = join53(appDir, "package.json");
     let script = null;
     if (!boot) {
-      if (!existsSync32(pkgPath)) {
-        const subs = ["backend", "frontend"].filter((d) => existsSync32(join52(repoDir, d, "package.json")));
+      if (!existsSync33(pkgPath)) {
+        const subs = ["backend", "frontend"].filter((d) => existsSync33(join53(repoDir, d, "package.json")));
         const has = (d) => {
           try {
-            return pickScript(JSON.parse(readFileSync41(join52(repoDir, d, "package.json"), "utf8"))) !== null;
+            return pickScript(JSON.parse(readFileSync42(join53(repoDir, d, "package.json"), "utf8"))) !== null;
           } catch {
             return false;
           }
         };
         return skip(noRootReason(subs, subs.filter((d) => !has(d))));
       }
-      script = pickScript(JSON.parse(readFileSync41(pkgPath, "utf8")));
+      script = pickScript(JSON.parse(readFileSync42(pkgPath, "utf8")));
       if (!script)
         return skip("no dev, preview or start script");
     }
@@ -14090,20 +14186,20 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     }
     if (!await waitUp(base, left(), signal))
       return skip(aborted() ? "aborted" : `${script} server did not answer within ${Math.round(budget / 1000)}s`);
-    const evRoot = join52(runDir, "evidence");
+    const evRoot = join53(runDir, "evidence");
     if (isSymlink(evRoot))
       return skip("evidence dir is a symlink");
     mkdirSync21(evRoot, { recursive: true });
     if (pages.length > 0) {
-      const rel0 = join52("evidence", randomBytes6(6).toString("hex"));
-      mkdirSync21(join52(runDir, rel0));
+      const rel0 = join53("evidence", randomBytes6(6).toString("hex"));
+      mkdirSync21(join53(runDir, rel0));
       const rels = [];
       for (const route of [...new Set(pages.map(routeFor))].slice(0, opts.maxRoutes ?? MAX_ROUTES)) {
         if (aborted() || left() <= 0)
           break;
-        const rel = join52(rel0, `${screenName(route)}.png`);
-        const ok = await shoot(pw, ["screenshot", `${base}${route}`, join52(runDir, rel)], appDir, left(), signal);
-        if (ok && !aborted() && !isSymlink(join52(runDir, rel)) && existsSync32(join52(runDir, rel)))
+        const rel = join53(rel0, `${screenName(route)}.png`);
+        const ok = await shoot(pw, ["screenshot", `${base}${route}`, join53(runDir, rel)], appDir, left(), signal);
+        if (ok && !aborted() && !isSymlink(join53(runDir, rel)) && existsSync33(join53(runDir, rel)))
           rels.push(rel);
       }
       if (aborted())
@@ -14128,9 +14224,9 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
     }
     if (aborted())
       return skip("aborted");
-    const hdir = join52(evRoot, randomBytes6(6).toString("hex"));
+    const hdir = join53(evRoot, randomBytes6(6).toString("hex"));
     mkdirSync21(hdir);
-    writeFileSync24(join52(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
+    writeFileSync24(join53(hdir, "http.json"), JSON.stringify(rows, null, 2) + `
 `);
     return { screens: [], http: true, skipped: null };
   } catch (e) {
@@ -14159,12 +14255,12 @@ function receiptScreensProblem(receiptPath, receipt) {
     return `visual evidence failed (LOKI_VISUAL_GATE=1): ${receipt["evidence_failed"]}`;
   return receipt["evidence_screens"] === undefined ? null : checkScreens(dirname19(receiptPath), receipt["evidence_screens"]);
 }
-var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash14("sha256").update(readFileSync41(p)).digest("hex"), playwrightBin = (repoDir) => {
-  const bin = join52(repoDir, "node_modules", ".bin", "playwright");
-  return existsSync32(bin) ? bin : null;
+var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash14("sha256").update(readFileSync42(p)).digest("hex"), playwrightBin = (repoDir) => {
+  const bin = join53(repoDir, "node_modules", ".bin", "playwright");
+  return existsSync33(bin) ? bin : null;
 }, playwrightTestPkg = (repoDir) => {
-  const d = join52(repoDir, "node_modules", "@playwright", "test");
-  return existsSync32(join52(d, "package.json")) ? d : null;
+  const d = join53(repoDir, "node_modules", "@playwright", "test");
+  return existsSync33(join53(d, "package.json")) ? d : null;
 }, e2eSpecSource = (pkgDir, base, routes) => `const { test } = require(${JSON.stringify(pkgDir)});
 test("loki e2e walkthrough", async ({ page }) => {
   for (const r of ${JSON.stringify(routes)}) { await page.goto(${JSON.stringify(base)} + r); await page.waitForLoadState("load"); }
@@ -14210,7 +14306,7 @@ var init_outbox = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/pr.ts
-import { join as join53 } from "path";
+import { join as join54 } from "path";
 var DEFAULT_PUSH_SH, DEFAULT_PUSH_GITLAB_SH;
 var init_pr = __esm(() => {
   init_types();
@@ -14229,20 +14325,20 @@ var init_pr = __esm(() => {
   init_receipt_surface();
   init_yaml_key();
   init_outbox();
-  DEFAULT_PUSH_SH = join53(REPO_ROOT, "autonomy/lib/engine10-push.sh");
-  DEFAULT_PUSH_GITLAB_SH = join53(REPO_ROOT, "autonomy/lib/engine10-push-gitlab.sh");
+  DEFAULT_PUSH_SH = join54(REPO_ROOT, "autonomy/lib/engine10-push.sh");
+  DEFAULT_PUSH_GITLAB_SH = join54(REPO_ROOT, "autonomy/lib/engine10-push-gitlab.sh");
 });
 
 // ../../loki-ts/src/util/pr_lessons.ts
-import { existsSync as existsSync33, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync8, readFileSync as readFileSync42, rmSync as rmSync16, writeFileSync as writeFileSync25 } from "fs";
-import { dirname as dirname20, join as join54 } from "path";
+import { existsSync as existsSync34, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync8, readFileSync as readFileSync43, rmSync as rmSync16, writeFileSync as writeFileSync25 } from "fs";
+import { dirname as dirname20, join as join55 } from "path";
 import { createHash as createHash15 } from "crypto";
 function loadLessons(repoDir) {
   const p = lessonsPath(repoDir);
-  if (!existsSync33(p))
+  if (!existsSync34(p))
     return [];
   try {
-    const j = JSON.parse(readFileSync42(p, "utf-8"));
+    const j = JSON.parse(readFileSync43(p, "utf-8"));
     return Array.isArray(j.lessons) ? j.lessons : [];
   } catch {
     return [];
@@ -14284,7 +14380,7 @@ function recordRunVerdict(repoDir, runId2, verdict) {
   if (dirty)
     save(repoDir, lessons);
 }
-var lessonsPath = (repoDir) => join54(repoDir, ".loki", "memory", "semantic", "pr-lessons.json"), KINDS;
+var lessonsPath = (repoDir) => join55(repoDir, ".loki", "memory", "semantic", "pr-lessons.json"), KINDS;
 var init_pr_lessons = __esm(() => {
   init_atomic();
   init_safe_git();
@@ -14310,9 +14406,9 @@ var init_attempts = __esm(() => {
 var init_mcp_config = () => {};
 
 // ../../loki-ts/src/providers/claude_flags.ts
-import { existsSync as existsSync34, readFileSync as readFileSync43 } from "fs";
+import { existsSync as existsSync35, readFileSync as readFileSync44 } from "fs";
 import { resolve as resolvePath, dirname as dirname21 } from "path";
-import { fileURLToPath as fileURLToPath4 } from "url";
+import { fileURLToPath as fileURLToPath5 } from "url";
 function claudeFlagSupported(flag, helpText) {
   const txt = helpText ?? _claudeHelpCache;
   if (txt === null || txt === undefined) {
@@ -14358,14 +14454,14 @@ function leanReviewerFlags(opts = {}) {
 }
 function designArchetypesText() {
   try {
-    const moduleDir = dirname21(fileURLToPath4(import.meta.url));
+    const moduleDir = dirname21(fileURLToPath5(import.meta.url));
     for (const rel of [
       ["..", "..", "..", "references", "design-archetypes.md"],
       ["..", "..", "references", "design-archetypes.md"]
     ]) {
       const p = resolvePath(moduleDir, ...rel);
-      if (existsSync34(p))
-        return readFileSync43(p, "utf8");
+      if (existsSync35(p))
+        return readFileSync44(p, "utf8");
     }
   } catch {}
   return "";
@@ -14450,14 +14546,14 @@ var init_providers = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/route_record.ts
-import { existsSync as existsSync35, lstatSync as lstatSync13, mkdirSync as mkdirSync23, readFileSync as readFileSync44, writeFileSync as writeFileSync26 } from "fs";
-import { join as join55 } from "path";
+import { existsSync as existsSync36, lstatSync as lstatSync13, mkdirSync as mkdirSync23, readFileSync as readFileSync45, writeFileSync as writeFileSync26 } from "fs";
+import { join as join56 } from "path";
 function loadRouteRecord(runDir) {
   try {
-    const p = join55(runDir, ROUTE_RECORD_FILE);
-    if (!existsSync35(p) || !lstatSync13(p).isFile())
+    const p = join56(runDir, ROUTE_RECORD_FILE);
+    if (!existsSync36(p) || !lstatSync13(p).isFile())
       return;
-    const v = JSON.parse(readFileSync44(p, "utf8"));
+    const v = JSON.parse(readFileSync45(p, "utf8"));
     return typeof v === "object" && v !== null && !Array.isArray(v) ? v : undefined;
   } catch {
     return;
@@ -14605,14 +14701,14 @@ __export(exports_deep, {
   DEFAULT_SECRET_SCAN_SH: () => DEFAULT_SECRET_SCAN_SH,
   DEFAULT_PUSH_SH: () => DEFAULT_PUSH_SH2
 });
-import { copyFileSync as copyFileSync3, existsSync as existsSync36, lstatSync as lstatSync14, mkdirSync as mkdirSync24, mkdtempSync as mkdtempSync9, rmSync as rmSync17, writeFileSync as writeFileSync27 } from "fs";
+import { copyFileSync as copyFileSync3, existsSync as existsSync37, lstatSync as lstatSync14, mkdirSync as mkdirSync24, mkdtempSync as mkdtempSync9, rmSync as rmSync17, writeFileSync as writeFileSync27 } from "fs";
 import { tmpdir as tmpdir10 } from "os";
-import { dirname as dirname22, join as join56 } from "path";
+import { dirname as dirname22, join as join57 } from "path";
 function sessionCouncil(sessions) {
   return { async run(input, signal) {
-    const cwd = mkdtempSync9(join56(tmpdir10(), "loki-deep-council-"));
+    const cwd = mkdtempSync9(join57(tmpdir10(), "loki-deep-council-"));
     try {
-      writeFileSync27(join56(cwd, "diff.patch"), input.diff, "utf8");
+      writeFileSync27(join57(cwd, "diff.patch"), input.diff, "utf8");
       const r = await sessions.run({
         stage: "deep",
         tier: "development",
@@ -14658,7 +14754,7 @@ async function runFullSuite(ctx, signal, opts, checks, notProven) {
     const r = await run([spec.cmd, ...spec.args], {
       cwd: ctx.repoDir,
       timeoutMs: opts.fullSuiteTimeoutMs ?? FULL_SUITE_TIMEOUT_MS,
-      ...opts.path ? { env: { PATH: opts.path } } : {}
+      env: suiteEnv(opts.path)
     });
     const durationS = (Date.now() - started) / 1000;
     if (signal.aborted) {
@@ -14666,15 +14762,15 @@ async function runFullSuite(ctx, signal, opts, checks, notProven) {
       notProven.add(`not run: ${name} (aborted)`);
       continue;
     }
-    const out2 = `${r.stdout}
-${r.stderr}`, lr = r.exitCode === 0 ? undefined : await harnessLoadReason({ repoDir: ctx.repoDir, baseSha: ctx.baseSha, skip: installOwned(ctx.repoDir, ctx.outputs().intake?.install_created), out: out2, cmd: spec.cmd, args: spec.args, signal, ...opts.path ? { env: { PATH: opts.path } } : {} });
+    const out2 = stripAnsi(`${r.stdout}
+${r.stderr}`), lr = r.exitCode === 0 ? undefined : await harnessLoadReason({ repoDir: ctx.repoDir, baseSha: ctx.baseSha, skip: installOwned(ctx.repoDir, ctx.outputs().intake?.install_created), out: out2, cmd: spec.cmd, args: spec.args, signal, ...opts.path ? { env: { PATH: opts.path } } : {} });
     if (lr) {
       checks.push({ name, cmd: [spec.cmd, ...spec.args].join(" "), result: "not_run", duration_s: durationS });
       notProven.add(`${lr} (${name}; harness-owned)`);
       continue;
     }
     const cls = classifyCheck({ kind: "test", ok: r.exitCode === 0, out: out2, ...goRunner(spec.cmd, spec.args) });
-    checks.push({ name, cmd: [spec.cmd, ...spec.args].join(" "), result: cls.result, duration_s: durationS, ...cls.result === "fail" ? { ids: failIds(out2) } : {} });
+    checks.push({ name, cmd: [spec.cmd, ...spec.args].join(" "), result: cls.result, duration_s: durationS, ...cls.result === "fail" ? { ids: failIds(out2), excerpt: failureExcerpt(out2, ctx.repoDir) } : {} });
     if (cls.result === "not_run")
       notProven.add(`not run: ${name} (${cls.reason ?? NO_TESTS_REASON})`);
   }
@@ -14682,7 +14778,7 @@ ${r.stderr}`, lr = r.exitCode === 0 ? undefined : await harnessLoadReason({ repo
 async function runAppBoot(ctx, opts, checks, notProven) {
   let r;
   try {
-    r = await (opts.appProbe ?? appProbe)(ctx.repoDir, join56(ctx.repoDir, ".loki"));
+    r = await (opts.appProbe ?? appProbe)(ctx.repoDir, join57(ctx.repoDir, ".loki"));
   } catch (err) {
     r = { checks: [{ name: "app boot", cmd: "autonomy/app-runner.sh", result: "not_run", duration_s: 0, reason: `app probe threw: ${err.message}` }], pid: null, url: null };
   }
@@ -14724,12 +14820,12 @@ async function runCouncilCheck(ctx, changed, baseSha, signal, opts, checks, notP
   }
 }
 async function secureScanChanged(repoDir, changed, opts) {
-  const dir = mkdtempSync9(join56(tmpdir10(), "loki-deep-secure-"));
+  const dir = mkdtempSync9(join57(tmpdir10(), "loki-deep-secure-"));
   try {
     for (const f of changed)
-      if (existsSync36(join56(repoDir, f)) && lstatSync14(join56(repoDir, f)).isFile()) {
-        mkdirSync24(dirname22(join56(dir, f)), { recursive: true });
-        copyFileSync3(join56(repoDir, f), join56(dir, f));
+      if (existsSync37(join57(repoDir, f)) && lstatSync14(join57(repoDir, f)).isFile()) {
+        mkdirSync24(dirname22(join57(dir, f)), { recursive: true });
+        copyFileSync3(join57(repoDir, f), join57(dir, f));
       }
     return await runSecureScan(dir, { ...opts.secureScanPath ? { scriptPath: opts.secureScanPath } : {}, timeoutMs: 60000 });
   } finally {
@@ -14738,7 +14834,7 @@ async function secureScanChanged(repoDir, changed, opts) {
 }
 async function runSecretScan(ctx, changed, opts, checks, notProven) {
   const scriptPath = opts.secretScanShPath ?? DEFAULT_SECRET_SCAN_SH, name = "security scan", cmd2 = "secret-scan.sh + secure-scan.py";
-  if (!existsSync36(scriptPath)) {
+  if (!existsSync37(scriptPath)) {
     checks.push({ name, cmd: cmd2, result: "not_run", duration_s: 0 });
     notProven.add(`not run: ${name} (secret-scan.sh not found)`);
     return;
@@ -14749,7 +14845,7 @@ async function runSecretScan(ctx, changed, opts, checks, notProven) {
   }
   const inline = 'script="$1"; shift; . "$script" || exit 3; hit=0; for f in "$@"; do if _commit_scan_secret_file "$f" || _commit_path_looks_secret "$f"; then printf "%s\\n" "$f"; hit=1; fi; done; exit "$hit"';
   const started = Date.now();
-  const r = await run(["bash", "-c", inline, "_", scriptPath, ...changed.map((f) => join56(ctx.repoDir, f))], { cwd: ctx.repoDir, timeoutMs: 30000 });
+  const r = await run(["bash", "-c", inline, "_", scriptPath, ...changed.map((f) => join57(ctx.repoDir, f))], { cwd: ctx.repoDir, timeoutMs: 30000 });
   const sec = await secureScanChanged(ctx.repoDir, changed, opts), gaps = [], reasons = [];
   const hits = r.exitCode === 3 ? [] : r.stdout.split(`
 `).map((l) => l.trim()).filter(Boolean), high = sec.findings.filter((f) => String(f.severity).toUpperCase() === "HIGH");
@@ -14790,7 +14886,7 @@ async function postResults(ctx, opts, checks, notProven, statusState) {
   const prNumber = prUrl ? PR_NUMBER_RE.exec(prUrl)?.[1] : undefined;
   if (prNumber) {
     mkdirSync24(ctx.runDir, { recursive: true });
-    const bodyFile = join56(ctx.runDir, "deep-comment.md");
+    const bodyFile = join57(ctx.runDir, "deep-comment.md");
     writeFileSync27(bodyFile, buildCommentBody(checks, notProven, statusState), "utf8");
     const commentResult = await run(["bash", scriptPath, ...commentArgv(prNumber, bodyFile)], { cwd: ctx.repoDir, env, timeoutMs: 30000 });
     if (commentResult.exitCode !== 0)
@@ -14844,7 +14940,7 @@ async function runDeep(ctx, signal, opts = {}) {
   const sig = signReceipt(`${ctx.runId}-deep`, addendumSha256);
   const addendum = { ...addendumBody, addendum_sha256: addendumSha256, verification: { jwt: sig.jwt, kid: sig.kid } };
   mkdirSync24(ctx.runDir, { recursive: true });
-  writeFileSync27(join56(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
+  writeFileSync27(join57(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
 `);
   const pushNotProven = await postResults(ctx, opts, checks, notProvenList, statusState);
   const allNotProven = [...notProvenList, ...pushNotProven];
@@ -14880,9 +14976,9 @@ var init_deep = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/verify.ts
-import { existsSync as existsSync37, mkdtempSync as mkdtempSync10, rmSync as rmSync18 } from "fs";
+import { existsSync as existsSync38, mkdtempSync as mkdtempSync10, rmSync as rmSync18 } from "fs";
 import { tmpdir as tmpdir11 } from "os";
-import { isAbsolute as isAbsolute9, join as join57, relative as relative8 } from "path";
+import { isAbsolute as isAbsolute9, join as join58, relative as relative9 } from "path";
 async function runOnce2(cmd2, args, cwd, signal, opts) {
   if (!Bun.which(cmd2, { PATH: opts.path ?? process.env["PATH"] ?? "" }))
     return { ok: false, missing: true, cut: false, out: "" };
@@ -14945,17 +15041,18 @@ async function runCheck(ctx, name, cmd2, args, signal, checks, opts = {}) {
   ctx.emit("test.result", "verify", opts.opaque ? { ...pubHold(check) } : { ...check });
   return check;
 }
-async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal) {
-  const out2 = { ids: [], names: [], weak: [], cnt: {} };
+async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal, zeroOk = true) {
+  const out2 = { ids: [], names: [], weak: [], zero: [], cnt: {} };
   const pairs = checks.flatMap((c) => {
     const t = tests.find((x) => testCheckName(x) === c.name);
     return t ? [{ c, t }] : [];
   });
   const un = pairs.filter(({ t }) => !changed.includes(t.path));
   const sus = pairs.filter(({ c }) => rel.has(c.name) && c.result === "pass");
-  if (!(un.some(({ c }) => c.result === "fail" && c.ids?.length) || sus.length) || signal.aborted)
+  const zc = zeroOk ? un.filter(({ c, t }) => c.result === "not_run" && !c.owner && (c.reason ?? "").startsWith(NO_TESTS_REASON) && !wall.has(c.name) && !rel.has(c.name) && !isHoldoutCheck(c.name) && !changed.includes(t.path)) : [];
+  if (!(un.some(({ c }) => c.result === "fail" && c.ids?.length) || sus.length || zc.length) || signal.aborted)
     return out2;
-  const dir = mkdtempSync10(join57(tmpdir11(), "e10-base-"));
+  const dir = mkdtempSync10(join58(tmpdir11(), "e10-base-"));
   const git4 = (args) => {
     safeGit(ctx.repoDir, args, { stdio: "ignore", repoDrivers: true });
   };
@@ -14968,6 +15065,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal)
       const red = !b.ok && !b.cut ? failIds(b.out) : [];
       base.set(c, { red, n: ran(b.out) ?? summaryPassFailCount(b.out), sk: skipped(b.out) });
     }
+    out2.zero = await zeroOnBase(zc.map(({ c, t }) => ({ name: c.name, ...commandFor(t, dir, api) })), dir, ctx.repoDir, (r) => runOnce2(r.cmd, r.args, r.cwd, signal, {}), (n2) => ctx.emit("test.skipped_on_base", "verify", { note: `skipped on base: ${n2}`, check: n2 }));
     out2.weak = sus.filter(({ c }) => (c.sk ?? 0) > base.get(c).sk || (c.n ?? 0) < base.get(c).n).map(({ c }) => c.name);
     for (const { c } of sus) {
       out2.cnt[c.name] = { b: { run: base.get(c).n, skipped: base.get(c).sk }, h: { run: c.n ?? 0, skipped: c.sk ?? 0 } };
@@ -14993,7 +15091,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal)
   return out2;
 }
 function isLokiModeRepo(repoDir) {
-  return existsSync37(join57(repoDir, "scripts", "select-tests.sh"));
+  return existsSync38(join58(repoDir, "scripts", "select-tests.sh"));
 }
 async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   const { api, ...runOpts } = opts;
@@ -15015,9 +15113,9 @@ async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   }
   for (const g of groupByPackage(api, ctx.repoDir, changed.filter((f) => /\.(ts|tsx|js|jsx)$/.test(f)))) {
     const sfx = g.root === "." ? "" : `:${g.root}`, co = g.root === "." ? opts : { ...opts, cwd: g.cwd };
-    if (existsSync37(join57(g.cwd, "tsconfig.json")))
+    if (existsSync38(join58(g.cwd, "tsconfig.json")))
       await runCheck(ctx, `lint:tsc${sfx}`, "npx", ["--no-install", "tsc", "--noEmit", "-p", "."], signal, checks, { ...co, kind: "static" });
-    if (ESLINT_CONFIGS.some((f) => existsSync37(join57(g.cwd, f)))) {
+    if (ESLINT_CONFIGS.some((f) => existsSync38(join58(g.cwd, f)))) {
       const c = await runCheck(ctx, `lint:eslint${sfx}`, "npx", ["--no-install", "eslint", ...g.rel], signal, checks, { ...co, kind: "static" });
       if (await excuseLint(ctx, signal, c, "eslint", "npx", ["--no-install", "eslint"], g.cwd, g.rel, co))
         pre.push(c.name);
@@ -15032,7 +15130,7 @@ var CHECK_TIMEOUT_MS = 60000, excerpts, isHold = (c) => isHoldoutCheck(c.name),
   return r.missing || r.cut ? null : r;
 }, base: (f) => {
   try {
-    return safeGit(ctx.repoDir, ["show", `${ctx.baseSha}:${relative8(ctx.repoDir, join57(cwd, f))}`], { stdio: ["ignore", "pipe", "ignore"] });
+    return safeGit(ctx.repoDir, ["show", `${ctx.baseSha}:${relative9(ctx.repoDir, join58(cwd, f))}`], { stdio: ["ignore", "pipe", "ignore"] });
   } catch {
     return null;
   }
@@ -15053,6 +15151,7 @@ var init_verify = __esm(() => {
   init_types();
   init_resolve();
   init_safe_git();
+  init_base_guard();
   init_repo_profile();
   init_check_result();
   init_check_result();
@@ -15095,7 +15194,7 @@ var init_verify = __esm(() => {
       const impacted = ctx.tests.impacted(map, changed);
       const changedTestFiles = map.tests.filter((t) => changed.includes(t.path));
       const wall = ctx.outputs().wall ?? {};
-      const wallPaths = new Set((wall.files ?? []).map((f) => isAbsolute9(f.path) ? relative8(ctx.repoDir, f.path) : f.path));
+      const wallPaths = new Set((wall.files ?? []).map((f) => isAbsolute9(f.path) ? relative9(ctx.repoDir, f.path) : f.path));
       const intake = ctx.outputs().intake, repoMap = loadRepoMap(intake?.repomap_ref), relevant2 = ctx.tests.impacted(map, namedFiles(intake?.task ?? "", repoMap));
       const harness = map.runners.length === 0 ? harnessRunners(map.runners, repoMap?.files ?? [])[0] : undefined, wallTests = [...map.tests.filter((t) => wallPaths.has(t.path)), ...harness ? [...wallPaths].filter((p) => /[._](?:test|spec)\.[cm]?[jt]sx?$/.test(p) && !map.tests.some((t) => t.path === p)).map((path) => ({ runner: harness, path })) : []];
       const tests = failedFirst(dedupeTests([...impacted, ...changedTestFiles, ...wallTests, ...relevant2]), ctx.outputs().verify?.checks);
@@ -15126,7 +15225,8 @@ var init_verify = __esm(() => {
         ctx.emit("test.result", "verify", { ...pubHold(k) });
       }
       const targetNames = new Set([...[...wallTests, ...relevant2].map(testCheckName), ...checks.filter(isHold).map((c) => c.name)]);
-      const preRed = await subtractBase(ctx, api, checks, tests, changed, new Set(wallTests.map(testCheckName)), new Set(relevant2.map(testCheckName)), signal);
+      const cfgChanged = testConfigChanged(ctx.repoDir, ctx.baseSha, changed);
+      const preRed = await subtractBase(ctx, api, checks, tests, changed, new Set(wallTests.map(testCheckName)), new Set(relevant2.map(testCheckName)), signal, cfgChanged.length === 0 && changed.every(isTestFile));
       const attr = attribute(ctx.repoDir, ctx.baseSha, checks.filter((c) => c.result === "fail" && !preRed.names.includes(c.name)).map((c) => ({ name: c.name, ids: c.ids, eligible: !targetNames.has(c.name) && !changed.includes(c.name.slice(c.name.indexOf(":") + 1)) })));
       attr.introducedChecks = [...new Set(attr.introducedChecks.map((n2) => isHoldoutCheck(n2) ? "holdout" : n2))];
       preRed.names.push(...attr.preExistingChecks);
@@ -15154,6 +15254,8 @@ var init_verify = __esm(() => {
           const k = { name: c.name, cmd: c.cmd, result: c.result, duration_s: c.duration_s, ...c.reason ? { reason: c.reason } : {} };
           checks.push(k);
           ctx.emit("test.result", "verify", { ...k });
+          if (c.excerpt)
+            excerpts.set(k, c.excerpt);
         }
         const fa = attributeFullSuite(ctx.repoDir, ctx.baseSha, full, checks.filter((c) => c.result === "fail" && !preRed.names.includes(c.name)).flatMap((c) => c.ids ?? []), changed);
         preRed.names.push(...fa.preExistingChecks);
@@ -15165,7 +15267,6 @@ var init_verify = __esm(() => {
           recordRisk(ctx.repoDir, risk);
         }
       }
-      const cfgChanged = testConfigChanged(ctx.repoDir, ctx.baseSha, changed);
       const covered = (f) => ctx.tests.impacted(map, [f]).some((t) => checks.some((c) => c.name === testCheckName(t) && hasExecutedProof([c])));
       const uncoveredChanged = changed.filter((f) => CODE_EXT.test(f) && !isTestFile(f) && !wallPaths.has(f) && !cfgChanged.includes(f) && !covered(f));
       const flaky = checks.filter((c) => c.result === "flaky").map((c) => isHold(c) ? "holdout" : c.name);
@@ -15195,14 +15296,14 @@ ${x}` : c.cmd };
       const weakened = [...modifiedRel, ...cfgChanged.map((f) => `test configuration changed: ${f}`), ...preRed.weak.map((n2) => `skipped or fewer tests than base: ${n2}`)];
       const notProven = [...weakened, ...intake?.deps_not_proven ?? [], ...pub.filter((c) => c.name === "holdout" && c.result !== "pass").map((c) => c.result === "not_run" ? "holdout not executed" : "holdout check failed"), ...[...fullNotProven].filter((n2) => !n2.startsWith("full suite (no test runner")), ...pub.filter((c) => c.owner === "harness" && c.name !== "holdout").map((c) => `${c.reason} (${c.name}; harness-owned, no fix rounds)`), ...new Set(checks.filter((c) => c.interpreter === "system" && c.result !== "not_run").map((c) => c.name.startsWith("lint:") ? "lint ran on the system ruff" : "tests ran on the system interpreter"))];
       const wallNames = new Set(wallTests.map(testCheckName)), wallRun = checks.filter((c) => wallNames.has(c.name) || isHold(c)), wallPassed = wallRun.some((c) => c.result === "fail") ? false : wallRun.length > 0 && wallRun.every((c) => c.result === "pass") ? true : undefined;
-      return { status: "completed", data: { checks: pub, flaky, ...wallPassed === undefined ? {} : { wall_passed: wallPassed }, failures_grouped: failuresGrouped, holdout_failed: holdoutFailed, changed_files: changed, not_proven: notProven, pre_red: preRed.ids, pre_red_checks: preRed.names, ...attr.line ? { baseline_line: attr.line, introduced_checks: attr.introducedChecks } : {}, test_counts: testCounts, uncovered_changed: uncoveredChanged, target_checks: checks.filter((c) => c.result === "pass" && targetNames.has(c.name)).map((c) => isHold(c) ? "holdout" : c.name), risk } };
+      return { status: "completed", data: { checks: pub, flaky, ...wallPassed === undefined ? {} : { wall_passed: wallPassed }, failures_grouped: failuresGrouped, holdout_failed: holdoutFailed, changed_files: changed, not_proven: notProven, pre_red: preRed.ids, pre_red_checks: preRed.names, skipped_on_base: preRed.zero, ...attr.line ? { baseline_line: attr.line, introduced_checks: attr.introducedChecks } : {}, test_counts: testCounts, uncovered_changed: uncoveredChanged, target_checks: checks.filter((c) => c.result === "pass" && targetNames.has(c.name)).map((c) => isHold(c) ? "holdout" : c.name), risk } };
     }
   };
 });
 
 // ../../loki-ts/src/project_model/conventions.ts
-import { existsSync as existsSync38, readdirSync as readdirSync19, readFileSync as readFileSync45 } from "fs";
-import { dirname as dirname23, join as join58 } from "path";
+import { existsSync as existsSync39, readdirSync as readdirSync20, readFileSync as readFileSync46 } from "fs";
+import { dirname as dirname23, join as join59 } from "path";
 function parseJsonc(text2) {
   let out2 = "", i = 0;
   while (i < text2.length) {
@@ -15237,25 +15338,25 @@ function moduleOf(file, depth = 0) {
   const ext = typeof j.extends === "string" ? j.extends : null;
   if (!ext || !ext.startsWith("."))
     return null;
-  const next = join58(dirname23(file), ext.endsWith(".json") ? ext : `${ext}.json`);
-  return existsSync38(next) ? moduleOf(next, depth + 1) : null;
+  const next = join59(dirname23(file), ext.endsWith(".json") ? ext : `${ext}.json`);
+  return existsSync39(next) ? moduleOf(next, depth + 1) : null;
 }
 function readPackageConventions(pkgDir, runner = null) {
   let names = [];
   try {
-    names = readdirSync19(pkgDir).filter((f) => f.endsWith(".json")).sort((x, y) => x.length - y.length || x.localeCompare(y));
+    names = readdirSync20(pkgDir).filter((f) => f.endsWith(".json")).sort((x, y) => x.length - y.length || x.localeCompare(y));
   } catch {
     return null;
   }
   let packageType = null, tsModule = null;
   for (const n2 of names) {
-    const j = readJson5(join58(pkgDir, n2));
+    const j = readJson5(join59(pkgDir, n2));
     if (!j)
       continue;
     if (packageType === null && typeof j.type === "string" && typeof j.name === "string")
       packageType = j.type;
     if (tsModule === null && j.compilerOptions !== undefined)
-      tsModule = moduleOf(join58(pkgDir, n2));
+      tsModule = moduleOf(join59(pkgDir, n2));
   }
   if (packageType === null && tsModule === null)
     return null;
@@ -15277,7 +15378,7 @@ function conventionViolation(c, fileName, content) {
 }
 var readJson5 = (p) => {
   try {
-    const v = parseJsonc(readFileSync45(p, "utf8"));
+    const v = parseJsonc(readFileSync46(p, "utf8"));
     return v && typeof v === "object" && !Array.isArray(v) ? v : null;
   } catch {
     return null;
@@ -15287,9 +15388,9 @@ var init_conventions = () => {};
 
 // ../../loki-ts/src/engine10/stages/wall.ts
 import { spawnSync as spawnSync7 } from "child_process";
-import { existsSync as existsSync39, mkdirSync as mkdirSync25, mkdtempSync as mkdtempSync11, readFileSync as readFileSync46, readdirSync as readdirSync20, rmSync as rmSync19, writeFileSync as writeFileSync28 } from "fs";
+import { existsSync as existsSync40, mkdirSync as mkdirSync25, mkdtempSync as mkdtempSync11, readFileSync as readFileSync47, readdirSync as readdirSync21, rmSync as rmSync19, writeFileSync as writeFileSync28 } from "fs";
 import { tmpdir as tmpdir12 } from "os";
-import { dirname as dirname24, join as join59, relative as relative9 } from "path";
+import { dirname as dirname24, join as join60, relative as relative10 } from "path";
 
 class RealBaseTestRunner {
   api;
@@ -15352,10 +15453,10 @@ ${acceptance.map((a) => `Acceptance: ${a}`).join(`
 function loadTaskText(ctx, fromPrior) {
   if (fromPrior)
     return fromPrior;
-  const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join59(ctx.runDir, "issue.json");
-  if (existsSync39(issueJsonPath)) {
+  const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join60(ctx.runDir, "issue.json");
+  if (existsSync40(issueJsonPath)) {
     try {
-      const issue = JSON.parse(readFileSync46(issueJsonPath, "utf8"));
+      const issue = JSON.parse(readFileSync47(issueJsonPath, "utf8"));
       const text2 = [issue.title, issue.body].filter((s) => typeof s === "string" && s.length > 0).join(`
 
 `);
@@ -15367,7 +15468,7 @@ function loadTaskText(ctx, fromPrior) {
 }
 function wallTargetDir(repoDir, existingTests) {
   const first = existingTests[0];
-  return first ? join59(repoDir, dirname24(first.path)) : join59(repoDir, "tests");
+  return first ? join60(repoDir, dirname24(first.path)) : join60(repoDir, "tests");
 }
 function guessRunner(fileName, runners) {
   if (fileName.endsWith(".py"))
@@ -15399,12 +15500,12 @@ async function wallAuthor(ctx, signal, retry) {
     return done({ status: "skipped", data: { size: sz.size, files: [], no_interpreter: true, not_proven: ["Wall skipped: no project test interpreter"] }, reason: "Wall skipped: no project test interpreter" });
   const tree = prior.intake?.tree;
   const repomapText = repoMapText(ctx.repoDir, tree, repomapRef, WALL_MAP_MAX_LINES);
-  const targetDir = wallTargetDir(ctx.repoDir, existingTests), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative9(ctx.repoDir, targetDir)}/x`);
-  const conv2 = readPackageConventions(join59(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
-  const cwd = mkdtempSync11(join59(tmpdir12(), "loki-e15-wall-"));
+  const targetDir = wallTargetDir(ctx.repoDir, existingTests), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative10(ctx.repoDir, targetDir)}/x`);
+  const conv2 = readPackageConventions(join60(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
+  const cwd = mkdtempSync11(join60(tmpdir12(), "loki-e15-wall-"));
   const wm = wallManifestFor(ctx.repoDir, tree, task);
   for (const [n2, c] of [["task.md", task], ["repomap.txt", repomapText], ...wm ? [["wall_manifest.txt", wm.text]] : []])
-    writeFileSync28(join59(cwd, n2), c, "utf8");
+    writeFileSync28(join60(cwd, n2), c, "utf8");
   const model = retry?.model ?? wallFirstModel(sz.size), iterationId = `${ctx.runId}-wall${retry?.suffix ?? ""}`;
   const session = await ctx.sessions.run({
     stage: "wall",
@@ -15420,15 +15521,15 @@ async function wallAuthor(ctx, signal, retry) {
     rmSync19(cwd, { recursive: true, force: true });
     return done({ status: "failed", data: { iteration_ids: [iterationId], model }, reason: "wall session aborted, killed, or timed out", killed: true });
   }
-  const all = readdirSync20(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !conventionViolation(conv2, n2, readFileSync46(join59(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
-  const sealedDir = join59(ctx.runDir, "wall");
+  const all = readdirSync21(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !conventionViolation(conv2, n2, readFileSync47(join60(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
+  const sealedDir = join60(ctx.runDir, "wall");
   if (generated.length > 0)
     mkdirSync25(sealedDir, { recursive: true });
   const contents = new Map;
   const discarded = [];
   for (const name of generated) {
-    const content = readFileSync46(join59(cwd, name), "utf8"), bad = conventionViolation(conv2, name, content);
-    writeFileSync28(join59(sealedDir, name), content, "utf8");
+    const content = readFileSync47(join60(cwd, name), "utf8"), bad = conventionViolation(conv2, name, content);
+    writeFileSync28(join60(sealedDir, name), content, "utf8");
     if (bad)
       discarded.push({ file: name, reason: `${bad}; wall test did not compile under the package config` });
     else
@@ -15455,19 +15556,19 @@ function* installCore(ctx, a, baseDir, opts) {
     const content = contents.get(name);
     if (content === undefined)
       continue;
-    const dest = join59(targetDir, name), runner = guessRunner(name, runners);
+    const dest = join60(targetDir, name), runner = guessRunner(name, runners);
     writeFileSync28(dest, content, "utf8");
     sealedFiles.push({ path: dest, sha256: sha2562(content) });
     readOnlyFiles.push({ path: dest, content });
     if (runner)
-      wallTests.push({ runner, path: relative9(ctx.repoDir, dest) });
+      wallTests.push({ runner, path: relative10(ctx.repoDir, dest) });
   }
   ctx.wallSealed = true;
   ctx.emit("wall.sealed", "wall", { files: sealedFiles, ...a.manifestSha256 ? { manifest_sha256: a.manifestSha256 } : {} });
   const baseRunner = opts.baseRunner ?? new RealBaseTestRunner, baseRun = { pass: 0, fail: 0, not_run: discarded.length }, notRunFiles = [];
   const each = yield { runner: baseRunner, tests: wallTests };
   for (const [i, t] of wallTests.entries()) {
-    const e = each?.[i], r = e ?? baseRunner.run(baseDir, [t]), abs = join59(ctx.repoDir, t.path);
+    const e = each?.[i], r = e ?? baseRunner.run(baseDir, [t]), abs = join60(ctx.repoDir, t.path);
     baseRun.pass += r.pass;
     baseRun.fail += r.fail;
     baseRun.not_run += r.not_run ?? 0;
@@ -15508,7 +15609,7 @@ async function runWall(ctx, signal, opts = {}) {
   if (a.kind === "authored") {
     for (const f of first.data.files ?? [])
       rmSync19(f.path, { force: true });
-    rmSync19(join59(ctx.runDir, "wall"), { recursive: true, force: true });
+    rmSync19(join60(ctx.runDir, "wall"), { recursive: true, force: true });
     ctx.wallSealed = false;
   }
   removeHoldout(ctx.runId, ctx.repoDir);
@@ -15544,15 +15645,15 @@ var init_wall = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/discard.ts
-import { chmodSync as chmodSync5, closeSync as closeSync9, lstatSync as lstatSync15, mkdirSync as mkdirSync26, openSync as openSync9, readFileSync as readFileSync47, realpathSync as realpathSync22, rmdirSync, unlinkSync as unlinkSync7, writeFileSync as writeFileSync29 } from "fs";
-import { dirname as dirname25, join as join60, relative as relative10, sep as sep13 } from "path";
+import { chmodSync as chmodSync5, closeSync as closeSync9, lstatSync as lstatSync15, mkdirSync as mkdirSync26, openSync as openSync9, readFileSync as readFileSync48, realpathSync as realpathSync23, rmdirSync, unlinkSync as unlinkSync7, writeFileSync as writeFileSync29 } from "fs";
+import { dirname as dirname25, join as join61, relative as relative11, sep as sep14 } from "path";
 function safeRestore(repoDir, f, want, mode) {
-  const root = realpathSync22(repoDir), fp = join60(root, f), rel = relative10(root, dirname25(fp));
+  const root = realpathSync23(repoDir), fp = join61(root, f), rel = relative11(root, dirname25(fp));
   if (rel.startsWith(".."))
     throw new Error("outside repo");
   let cur = root;
-  for (const part of rel === "" ? [] : rel.split(sep13)) {
-    cur = join60(cur, part);
+  for (const part of rel === "" ? [] : rel.split(sep14)) {
+    cur = join61(cur, part);
     let st2;
     try {
       st2 = lstatSync15(cur);
@@ -15569,7 +15670,7 @@ function safeRestore(repoDir, f, want, mode) {
   } catch {
     st = null;
   }
-  if (st?.isFile() && readFileSync47(fp).equals(want)) {
+  if (st?.isFile() && readFileSync48(fp).equals(want)) {
     chmodSync5(fp, mode);
     return;
   }
@@ -15606,7 +15707,7 @@ async function discardIfSatisfied(git4, base, o, staged, keep, repoDir) {
     return { status: "failed", data: {}, reason: "already-satisfied discard failed" };
   const notProven = [];
   for (const [f, v] of Object.entries(o.intake?.preexisting_untracked_blobs ?? {})) {
-    const fp = join60(repoDir, f);
+    const fp = join61(repoDir, f);
     try {
       if (v.startsWith("!")) {
         const st = lstatSync15(fp);
@@ -15625,7 +15726,7 @@ async function discardIfSatisfied(git4, base, o, staged, keep, repoDir) {
       try {
         let m = 420;
         try {
-          const l = lstatSync15(join60(repoDir, f));
+          const l = lstatSync15(join61(repoDir, f));
           if (l.isFile())
             m = l.mode & 511;
         } catch {}
@@ -15672,7 +15773,7 @@ var init_commit_filter = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/scope.ts
-import { basename as basename22, dirname as dirname27 } from "path";
+import { basename as basename23, dirname as dirname27 } from "path";
 function contractText(o) {
   const c = o.intake?.contract_snapshot?.contract;
   return Array.isArray(c?.criteria) ? c.criteria.map((x) => typeof x?.text === "string" ? x.text : "").join(`
@@ -15687,7 +15788,7 @@ function outsideScope(o, staged) {
 ${typeof o.intake?.task === "string" ? o.intake.task : ""}
 ${contractText(o)}`, pre = o.intake?.preexisting_dirty ?? {};
   const toks = surfaceTokens(text2), plannedDirs = new Set(rel.map((r) => dirname27(r)).filter((d) => d !== "."));
-  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename22(f)) && !plannedDirs.has(dirname27(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
+  return staged.filter(({ st, f }) => st !== "A" && !isTestFile(f) && !Object.hasOwn(pre, f) && !rel.includes(f) && !mentions(text2, f) && !mentions(text2, basename23(f)) && !plannedDirs.has(dirname27(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
 }
 function flagOutsideScope(o, staged) {
   const unit = unitFlags(staged, process.env, o.intake?.preexisting_dirty ?? {});
@@ -15702,14 +15803,14 @@ var init_scope2 = __esm(() => {
 });
 
 // ../../loki-ts/src/council/role_agents.ts
-import { existsSync as existsSync40, readdirSync as readdirSync21, readFileSync as readFileSync48 } from "fs";
+import { existsSync as existsSync41, readdirSync as readdirSync22, readFileSync as readFileSync49 } from "fs";
 import { homedir as homedir9 } from "os";
-import { join as join61 } from "path";
+import { join as join62 } from "path";
 function agentDirs(repoDir, env = process.env) {
-  return [env["LOKI_AGENTS_PROJECT_DIR"] || join61(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join61(env["XDG_CONFIG_HOME"] || join61(homedir9(), ".config"), "loki", "agents")];
+  return [env["LOKI_AGENTS_PROJECT_DIR"] || join62(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join62(env["XDG_CONFIG_HOME"] || join62(homedir9(), ".config"), "loki", "agents")];
 }
 function parseAgent(file, stem2) {
-  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync48(file, "utf8"));
+  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync49(file, "utf8"));
   if (!m)
     return null;
   const body = m[2].trim();
@@ -15723,18 +15824,18 @@ function parseAgent(file, stem2) {
 }
 function loadRoleAgent(repoDir, role, env = process.env) {
   for (const d of agentDirs(repoDir, env)) {
-    if (!existsSync40(d))
+    if (!existsSync41(d))
       continue;
     let names;
     try {
-      names = readdirSync21(d).filter((n2) => n2.endsWith(".md") && !n2.startsWith(".")).sort();
+      names = readdirSync22(d).filter((n2) => n2.endsWith(".md") && !n2.startsWith(".")).sort();
     } catch {
       continue;
     }
     const ordered = [...names.filter((n2) => n2 === `${role}.md`), ...names.filter((n2) => n2 !== `${role}.md`)];
     for (const n2 of ordered) {
       try {
-        const a = parseAgent(join61(d, n2), n2.slice(0, -3));
+        const a = parseAgent(join62(d, n2), n2.slice(0, -3));
         if (a && a.role === role)
           return a;
       } catch {}
@@ -15752,7 +15853,7 @@ var init_role_agents = __esm(() => {
 
 // ../../loki-ts/src/util/child_ledger.ts
 import { appendFileSync as appendFileSync4, mkdirSync as mkdirSync27 } from "fs";
-import { join as join62 } from "path";
+import { join as join63 } from "path";
 function unmeasuredRecord(phase, model, source) {
   return { phase, model, input_tokens: 0, output_tokens: 0, cache_creation_tokens: 0, cache_read_tokens: 0, source, cost_status: "unmeasured" };
 }
@@ -15777,9 +15878,9 @@ function recordFromClaudeResult(phase, payload, source = "claude-json") {
 }
 function appendChildLedger(lokiDir2, rec2) {
   try {
-    const dir = join62(lokiDir2, "metrics");
+    const dir = join63(lokiDir2, "metrics");
     mkdirSync27(dir, { recursive: true });
-    appendFileSync4(join62(dir, "child-sessions.jsonl"), `${JSON.stringify(rec2)}
+    appendFileSync4(join63(dir, "child-sessions.jsonl"), `${JSON.stringify(rec2)}
 `);
     return true;
   } catch {
@@ -15829,14 +15930,14 @@ var init_colors = __esm(() => {
 });
 
 // ../../loki-ts/src/util/run_summary.ts
-import { existsSync as existsSync41, mkdirSync as mkdirSync28, readFileSync as readFileSync49, renameSync as renameSync12, statSync as statSync20, writeFileSync as writeFileSync30 } from "fs";
-import { join as join63 } from "path";
+import { existsSync as existsSync42, mkdirSync as mkdirSync28, readFileSync as readFileSync50, renameSync as renameSync12, statSync as statSync20, writeFileSync as writeFileSync30 } from "fs";
+import { join as join64 } from "path";
 function readRiskRecord(repoDir, sinceMs = 0) {
   try {
-    const p = join63(repoDir, ".loki", "state", "risk-tier.json");
+    const p = join64(repoDir, ".loki", "state", "risk-tier.json");
     if (statSync20(p).mtimeMs < sinceMs)
       return null;
-    const r = JSON.parse(readFileSync49(p, "utf8"));
+    const r = JSON.parse(readFileSync50(p, "utf8"));
     return r && typeof r === "object" ? r : null;
   } catch {
     return null;
@@ -15851,8 +15952,8 @@ var init_run_summary = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/xreview.ts
-import { existsSync as existsSync42, readFileSync as readFileSync50 } from "fs";
-import { join as join64 } from "path";
+import { existsSync as existsSync43, readFileSync as readFileSync51 } from "fs";
+import { join as join65 } from "path";
 function minVerdict(verdict, review) {
   const ceiling = review?.level === "block" ? "PARTIAL" : verdict;
   return RANK3[ceiling] < RANK3[verdict] ? ceiling : verdict;
@@ -15865,11 +15966,11 @@ function explicitReview(repoDir, env) {
   if (flag && isOff(ev))
     return "off";
   for (const f of ["loki.yaml", "loki.yml"]) {
-    const p = join64(repoDir, f);
-    if (!existsSync42(p))
+    const p = join65(repoDir, f);
+    if (!existsSync43(p))
       continue;
     try {
-      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync50(p, "utf8"));
+      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync51(p, "utf8"));
       const v = asProvider(m?.[1]);
       if (v)
         return v;
@@ -15952,7 +16053,7 @@ Review ONLY the diff below. Do not modify files.` : "You are an independent code
   try {
     if (p === "claude")
       await ensureClaudeHelpCache();
-    const r = await withChildLedger(run, join64(ctx.repoDir, ".loki"), "xreview")(reviewArgv(p, prompt, process.env, p === "claude" ? agent?.model : undefined), { cwd: ctx.repoDir, timeoutMs: TIMEOUT_MS });
+    const r = await withChildLedger(run, join65(ctx.repoDir, ".loki"), "xreview")(reviewArgv(p, prompt, process.env, p === "claude" ? agent?.model : undefined), { cwd: ctx.repoDir, timeoutMs: TIMEOUT_MS });
     if (r.exitCode !== 0)
       return { provider: p, level: "not_run", notes: [`cross-review not run: ${p} exited ${r.exitCode}`] };
     return parseReview(p, r.stdout);
@@ -16048,8 +16149,8 @@ See also: loki cost --detail (what a run ALREADY spent)
 });
 
 // ../../loki-ts/src/features/contract.ts
-import { existsSync as existsSync43, lstatSync as lstatSync16, mkdirSync as mkdirSync29, readFileSync as readFileSync51, rmSync as rmSync20, writeFileSync as writeFileSync31 } from "fs";
-import { dirname as dirname28, join as join65 } from "path";
+import { existsSync as existsSync44, lstatSync as lstatSync16, mkdirSync as mkdirSync29, readFileSync as readFileSync52, rmSync as rmSync20, writeFileSync as writeFileSync31 } from "fs";
+import { dirname as dirname28, join as join66 } from "path";
 import { createHash as createHash16 } from "crypto";
 function contractEnabled(env = process.env) {
   return env["LOKI_CONTRACT"] !== "0";
@@ -16081,7 +16182,7 @@ function untracedLines(trace) {
   return trace.criteria.filter((c) => c.status === "no_match").map((c) => `contract ${sanitizeCriterion(c.id)} untraced (no keyword match in changed files): ${sanitizeCriterion(c.text)}`);
 }
 function contractPath(repoDir) {
-  return join65(repoDir, ".loki", "contract.json");
+  return join66(repoDir, ".loki", "contract.json");
 }
 function readContract(repoDir) {
   const p = contractPath(repoDir);
@@ -16097,7 +16198,7 @@ function readContract(repoDir) {
     return { contract: null, notes: ["contract unreadable: too large"], sha256: null };
   let raw2;
   try {
-    raw2 = readFileSync51(p);
+    raw2 = readFileSync52(p);
   } catch {
     return { contract: null, notes: ["contract unreadable: read failed"], sha256: null };
   }
@@ -16166,17 +16267,17 @@ var init_contract = __esm(() => {
   init_safe_git();
   STOP3 = new Set(["the", "and", "for", "with", "that", "this", "must", "should", "shall", "when", "then", "are", "was", "all", "any", "can", "not", "has", "have", "from", "into", "each", "user", "users"]);
   MAX_CONTRACT_BYTES = 1024 * 1024;
-  REQ_MAP_REL = join65(".loki", "state", "requirements-map.json");
+  REQ_MAP_REL = join66(".loki", "state", "requirements-map.json");
   REQ_STOP = new Set(["with", "that", "this", "from", "have", "will", "should", "must", "when", "then", "into", "each", "every", "user", "users", "page", "able", "allow", "support", "ensure", "using", "their", "there", "which", "shall"]);
 });
 
 // ../../loki-ts/src/features/speed/seal_group.ts
 import { createHash as createHash17 } from "crypto";
-import { existsSync as existsSync44, mkdirSync as mkdirSync30, readdirSync as readdirSync22, readFileSync as readFileSync52, renameSync as renameSync13, statSync as statSync21, writeFileSync as writeFileSync32 } from "fs";
-import { dirname as dirname29, join as join66 } from "path";
+import { existsSync as existsSync45, mkdirSync as mkdirSync30, readdirSync as readdirSync23, readFileSync as readFileSync53, renameSync as renameSync13, statSync as statSync21, writeFileSync as writeFileSync32 } from "fs";
+import { dirname as dirname29, join as join67 } from "path";
 function sealGroup(runDir, rh) {
-  const manifestPath = join66(runDir, "group", "manifest.json");
-  if (!existsSync44(manifestPath))
+  const manifestPath = join67(runDir, "group", "manifest.json");
+  if (!existsSync45(manifestPath))
     return { section: undefined, notProven: [], problems: 0, allUnitsPass: true };
   const notProven = [];
   let problems = 0;
@@ -16200,10 +16301,10 @@ function sealGroup(runDir, rh) {
       return fail2(`unit ${index2} has an invalid, duplicate or case-colliding id`);
     seen.add(id);
     seenLower.add(id.toLowerCase());
-    const dir = join66(unitsDir(runDir), id), rp = join66(dir, "receipt.json"), ep = join66(dir, "events.jsonl");
+    const dir = join67(unitsDir(runDir), id), rp = join67(dir, "receipt.json"), ep = join67(dir, "events.jsonl");
     let bytes;
     try {
-      bytes = readFileSync52(rp);
+      bytes = readFileSync53(rp);
     } catch {
       return fail2(`unit ${id} sub-receipt missing`);
     }
@@ -16220,7 +16321,7 @@ function sealGroup(runDir, rh) {
       unit_id: id,
       sub_receipt_sha256: sha3(bytes),
       receipt_sha256: sub2["receipt_sha256"],
-      events_file_sha256: existsSync44(ep) ? sha3(readFileSync52(ep)) : null,
+      events_file_sha256: existsSync45(ep) ? sha3(readFileSync53(ep)) : null,
       verdict,
       goal: text2(u["goal"], 200),
       files: (Array.isArray(u["files"]) ? u["files"] : []).map((f) => text2(f, 200)).filter(Boolean).slice(0, 50),
@@ -16245,7 +16346,7 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
   const bad = (reason) => ({ verdict: "TAMPERED", reason: `group: ${reason}` });
   const g = receipt["group"];
   if (g === undefined)
-    return existsSync44(join66(runDir, "group", "manifest.json")) ? bad("group directory present but the receipt has no group section") : null;
+    return existsSync45(join67(runDir, "group", "manifest.json")) ? bad("group directory present but the receipt has no group section") : null;
   if (!isObj10(g) || !ID_RE.test(String(g["group_id"] ?? "")) || !Array.isArray(g["units"]) || g["units"].length === 0)
     return bad("group section malformed");
   const entries = g["units"];
@@ -16257,20 +16358,20 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
     return bad("unit directories do not match the receipt (missing or extra unit)");
   let unchecked = null;
   for (let i = 0;i < entries.length; i++) {
-    const e = entries[i], id = ids[i], dir = join66(unitsDir(runDir), id), rp = join66(dir, "receipt.json"), ep = join66(dir, "events.jsonl");
+    const e = entries[i], id = ids[i], dir = join67(unitsDir(runDir), id), rp = join67(dir, "receipt.json"), ep = join67(dir, "events.jsonl");
     if (e["index"] !== i)
       return bad(`unit ${id} is out of order (index ${String(e["index"])} at position ${i})`);
     let bytes;
     try {
       if (!statSync21(dir).isDirectory())
         return bad(`unit ${id} is not a directory`);
-      bytes = readFileSync52(rp);
+      bytes = readFileSync53(rp);
     } catch {
       return bad(`unit ${id} sub-receipt missing`);
     }
     if (sha3(bytes) !== e["sub_receipt_sha256"])
       return bad(`unit ${id} sub-receipt does not match its recorded hash`);
-    const evSha = existsSync44(ep) ? sha3(readFileSync52(ep)) : null;
+    const evSha = existsSync45(ep) ? sha3(readFileSync53(ep)) : null;
     if (evSha !== (e["events_file_sha256"] ?? null))
       return bad(`unit ${id} events.jsonl does not match its recorded hash`);
     const sub2 = readJson6(rp);
@@ -16293,15 +16394,15 @@ function compositeVerdict(childVerdicts) {
   const failed2 = childVerdicts.filter((v) => v === "FAILED" || !["VERIFIED", "ALREADY_SATISFIED", "PARTIAL", "SPEC_CONFLICT"].includes(v)).length;
   return capGroupVerdict(base, { section: undefined, notProven: [], problems: failed2, allUnitsPass: childVerdicts.every((v) => PASSING.has(v)) });
 }
-var ID_RE, PASSING, sha3 = (b) => createHash17("sha256").update(b).digest("hex"), isObj10 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), text2 = (v, cap) => typeof v === "string" ? v.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0, unitsDir = (runDir) => join66(runDir, "group", "units"), readJson6 = (p) => {
+var ID_RE, PASSING, sha3 = (b) => createHash17("sha256").update(b).digest("hex"), isObj10 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), text2 = (v, cap) => typeof v === "string" ? v.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0, unitsDir = (runDir) => join67(runDir, "group", "units"), readJson6 = (p) => {
   try {
-    return JSON.parse(readFileSync52(p, "utf8"));
+    return JSON.parse(readFileSync53(p, "utf8"));
   } catch {
     return;
   }
 }, dirNames = (d) => {
   try {
-    return readdirSync22(d).filter((n3) => !n3.startsWith(".")).sort();
+    return readdirSync23(d).filter((n3) => !n3.startsWith(".")).sort();
   } catch {
     return null;
   }
@@ -16313,8 +16414,8 @@ var init_seal_group = __esm(() => {
 });
 
 // ../../loki-ts/src/supply/supply_guard.ts
-import { existsSync as existsSync45, readFileSync as readFileSync53, statSync as statSync22 } from "fs";
-import { basename as basename23, join as join67 } from "path";
+import { existsSync as existsSync46, readFileSync as readFileSync54, statSync as statSync22 } from "fs";
+import { basename as basename24, join as join68 } from "path";
 function supplyEnabled(env) {
   return env["LOKI_SUPPLY_GUARD"] !== "0";
 }
@@ -16326,16 +16427,16 @@ function supplyVerdict(verdict, r) {
   return r.blocked && verdict === "VERIFIED" ? "FAILED" : verdict;
 }
 function isManifestPath(path) {
-  return MANIFESTS.test(basename23(path));
+  return MANIFESTS.test(basename24(path));
 }
 function readDeclared(repoDir) {
-  const p = join67(repoDir, ".loki", DECLARED_FILE);
-  if (!existsSync45(p))
+  const p = join68(repoDir, ".loki", DECLARED_FILE);
+  if (!existsSync46(p))
     return { deps: [], problem: null };
   try {
     if (statSync22(p).size > MAX_FILE_BYTES)
       return { deps: [], problem: "declaration file too large" };
-    const j = JSON.parse(readFileSync53(p, "utf8"));
+    const j = JSON.parse(readFileSync54(p, "utf8"));
     if (!Array.isArray(j))
       return { deps: [], problem: "declaration is not a JSON array" };
     const deps = [];
@@ -16355,11 +16456,11 @@ function readDeclared(repoDir) {
   }
 }
 function readAllowlist(repoDir) {
-  const p = join67(repoDir, ".loki", "supply-allowlist");
-  if (!existsSync45(p))
+  const p = join68(repoDir, ".loki", "supply-allowlist");
+  if (!existsSync46(p))
     return new Set;
   try {
-    return new Set(readFileSync53(p, "utf8").split(`
+    return new Set(readFileSync54(p, "utf8").split(`
 `).map((l) => l.replace(/#.*$/, "").trim()).filter(Boolean));
   } catch {
     return new Set;
@@ -16400,7 +16501,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "npm") {
     if (privateUrlList([env["npm_config_registry"] ?? "", env["NPM_CONFIG_REGISTRY"] ?? ""]))
       return true;
-    return files(join67(repoDir, ".npmrc"), home ? join67(home, ".npmrc") : "").some((t) => t.split(`
+    return files(join68(repoDir, ".npmrc"), home ? join68(home, ".npmrc") : "").some((t) => t.split(`
 `).some((l) => {
       const m = /^\s*(?:(@[^:\s]+):)?registry\s*=\s*(\S+)/.exec(l);
       return !!m && privateUrl(m[2]) && (m[1] === undefined || name.startsWith(`${m[1]}/`));
@@ -16409,7 +16510,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "pypi") {
     if (privateUrlList([env["PIP_INDEX_URL"] ?? "", env["PIP_EXTRA_INDEX_URL"] ?? ""]))
       return true;
-    const cfg = [env["PIP_CONFIG_FILE"] ?? "", home ? join67(home, ".config", "pip", "pip.conf") : "", home ? join67(home, ".pip", "pip.conf") : "", join67(repoDir, "pip.conf")];
+    const cfg = [env["PIP_CONFIG_FILE"] ?? "", home ? join68(home, ".config", "pip", "pip.conf") : "", home ? join68(home, ".pip", "pip.conf") : "", join68(repoDir, "pip.conf")];
     return files(...cfg).some((t) => t.split(`
 `).some((l) => {
       const m = /^\s*(?:extra-)?index-url\s*[=:]\s*(.+)$/.exec(l);
@@ -16419,7 +16520,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "cargo") {
     if (Object.keys(env).some((k) => /^CARGO_REGISTRIES_.+_INDEX$/.test(k) || /^CARGO_SOURCE_/.test(k)))
       return true;
-    return files(join67(repoDir, ".cargo", "config.toml"), join67(repoDir, ".cargo", "config"), home ? join67(home, ".cargo", "config.toml") : "", home ? join67(home, ".cargo", "config") : "").some((t) => /^\s*\[(registries\.|source\.)/m.test(t) || /replace-with\s*=/.test(t));
+    return files(join68(repoDir, ".cargo", "config.toml"), join68(repoDir, ".cargo", "config"), home ? join68(home, ".cargo", "config.toml") : "", home ? join68(home, ".cargo", "config") : "").some((t) => /^\s*\[(registries\.|source\.)/m.test(t) || /replace-with\s*=/.test(t));
   }
   if (eco === "go") {
     const gp = goEnv["GOPROXY"] ?? env["GOPROXY"] ?? "";
@@ -16542,7 +16643,7 @@ var MIN_AGE_DAYS = 7, DECLARED_FILE = "supply-declared.json", MAX_CHECKED = 50,
   }
 }, PUBLIC_HOSTS, hostOf = (u) => u.trim().toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^www\./, "").split(/[/?#\s]/)[0].replace(/^[^@]*@/, "").replace(/:\d+$/, ""), privateUrl = (u) => /[a-z0-9]/i.test(u) && !PUBLIC_HOSTS.has(hostOf(u)), readSmall = (p) => {
   try {
-    return statSync22(p).size <= MAX_FILE_BYTES ? readFileSync53(p, "utf8") : "";
+    return statSync22(p).size <= MAX_FILE_BYTES ? readFileSync54(p, "utf8") : "";
   } catch {
     return "";
   }
@@ -16558,8 +16659,8 @@ var init_supply_guard = __esm(() => {
 
 // ../../loki-ts/src/engine10/stages/seal.ts
 import { createHash as createHash18 } from "crypto";
-import { existsSync as existsSync46, readdirSync as readdirSync23, mkdirSync as mkdirSync31, readFileSync as readFileSync54 } from "fs";
-import { basename as basename24, isAbsolute as isAbsolute11, join as join68, relative as relative11 } from "path";
+import { existsSync as existsSync47, readdirSync as readdirSync24, mkdirSync as mkdirSync31, readFileSync as readFileSync55 } from "fs";
+import { basename as basename25, isAbsolute as isAbsolute11, join as join69, relative as relative12 } from "path";
 function receiptSha256(r) {
   const { verification: _v, receipt_sha256: _h, ...body } = r;
   return sha2562(canonicalJson(body));
@@ -16630,7 +16731,7 @@ function renderReceiptMd(r) {
 `);
 }
 var DEEP_NOT_PROVEN, SIGNING_UNAVAILABLE = "receipt signing unavailable (no usable signing key: invalid key or unwritable ~/.loki/keys)", AGENT_ONLY_REASON = "only agent-authored tests executed (no agent-independent proof)", WALL_GREEN_ON_BASE_REASON = "Wall green on base: no Wall test discriminates the change", EXCLUDE_LOKI = ":(exclude).loki", sha2562 = (s) => createHash18("sha256").update(s).digest("hex"), str4 = (v) => typeof v === "string" && v !== "" ? v : null, strs2 = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x !== "") : [], receiptRel = (ctx) => {
-  const r = relative11(ctx.repoDir, join68(ctx.runDir, "receipt.json"));
+  const r = relative12(ctx.repoDir, join69(ctx.runDir, "receipt.json"));
   return r.startsWith("..") || isAbsolute11(r) ? `.loki/runs/${ctx.runId}/receipt.json` : r;
 }, commitStage, wallGreenOnBaseOf = (o) => {
   const b = o.wall?.base_run ?? {};
@@ -16750,8 +16851,8 @@ var init_seal = __esm(() => {
         notProven.add(`Wall test not executed: ${wallNotRun} file(s), no reason recorded`);
       if (wallNotRun > 0) {
         try {
-          const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename24(String(f.path))));
-          for (const n3 of readdirSync23(join68(ctx.runDir, "wall")).sort())
+          const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename25(String(f.path))));
+          for (const n3 of readdirSync24(join69(ctx.runDir, "wall")).sort())
             if (!kept.has(n3))
               notProven.add(`wall test discarded: ${n3} (not_run)`);
         } catch {}
@@ -16779,8 +16880,10 @@ var init_seal = __esm(() => {
         for (const f of uncoveredAfterLimit)
           notProven.add(`changed, untested after limit: ${f}`);
       for (const c of checks)
-        if (c.result === "not_run")
+        if (c.result === "not_run" && !strs2(o.verify?.skipped_on_base).includes(c.name))
           notProven.add(`not run: ${c.name}`);
+      for (const n3 of strs2(o.verify?.skipped_on_base))
+        notProven.add(`skipped on base (excused): ${n3}`);
       for (const f of strs2(o.verify?.flaky))
         notProven.add(`flaky test: ${f}`);
       for (const n3 of verifyNotProven)
@@ -16814,19 +16917,19 @@ var init_seal = __esm(() => {
       for (const [s, d] of Object.entries(o))
         if (typeof d?.duration_s === "number")
           stages[s] = d.duration_s;
-      const T = hooks.time, time = T ? T.build(ctx, stages, T.firstEventMs(join68(ctx.runDir, "events.jsonl"))) : { wall_s: Object.values(stages).reduce((a, b) => a + (b ?? 0), 0), stages }, totalS = T?.reconciled(time) ?? null;
+      const T = hooks.time, time = T ? T.build(ctx, stages, T.firstEventMs(join69(ctx.runDir, "events.jsonl"))) : { wall_s: Object.values(stages).reduce((a, b) => a + (b ?? 0), 0), stages }, totalS = T?.reconciled(time) ?? null;
       const iterIds = [...new Set([...Object.values(o).flatMap((d) => [...strs2(d?.iteration_ids), ...strs2([d?.iteration_id])]), ...ctx.sessionIds?.() ?? []])];
       if (iterIds.length === 0)
         notProven.add("cost not measured (no iteration ids recorded)");
       const cost = ctx.cost.read(ctx.repoDir, iterIds);
       if (cost.unmetered)
         notProven.add("cost unmetered (CLI invoker; recorded as 0)");
-      const eventsPath = join68(ctx.runDir, "events.jsonl");
+      const eventsPath = join69(ctx.runDir, "events.jsonl");
       const wallFiles = Array.isArray(o.wall?.files) ? o.wall.files : [];
       const wallPassed = typeof o.verify?.wall_passed === "boolean" ? o.verify.wall_passed : null;
       if (wallFiles.length > 0 && wallPassed === null)
         notProven.add("wall result not recorded by verify");
-      const routeBlock = buildRouteBlock(process.env, ctx.provider, o.implement?.route ?? o.plan?.route_record ?? (routerEnabled(process.env) ? loadRouteRecord(ctx.runDir) : undefined), cost.router ?? (routerEnabled(process.env) ? sumResultCosts(join68(ctx.repoDir, ".loki"), liveArchivedCosts(join68(ctx.repoDir, ".loki"), iterIds, UNMETERED)).router : undefined), ctx.model);
+      const routeBlock = buildRouteBlock(process.env, ctx.provider, o.implement?.route ?? o.plan?.route_record ?? (routerEnabled(process.env) ? loadRouteRecord(ctx.runDir) : undefined), cost.router ?? (routerEnabled(process.env) ? sumResultCosts(join69(ctx.repoDir, ".loki"), liveArchivedCosts(join69(ctx.repoDir, ".loki"), iterIds, UNMETERED)).router : undefined), ctx.model);
       if (routeBlock)
         for (const l of routeNotProven(routeBlock))
           notProven.add(l);
@@ -16868,7 +16971,7 @@ var init_seal = __esm(() => {
         provider: ctx.provider,
         model: ctx.model,
         resumed: o.intake?.resumed === true,
-        events_sha256: sha2562(existsSync46(eventsPath) ? readFileSync54(eventsPath) : ""),
+        events_sha256: sha2562(existsSync47(eventsPath) ? readFileSync55(eventsPath) : ""),
         ...await sealEvidence(ctx.repoDir, ctx.runDir, o, notProven, signal, ctx.emit),
         log_seal: true,
         toolchain: collectToolchain(),
@@ -16892,10 +16995,10 @@ var init_seal = __esm(() => {
       }
       const receipt = { ...body, receipt_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } };
       mkdirSync31(ctx.runDir, { recursive: true });
-      const path = join68(ctx.runDir, "receipt.json");
+      const path = join69(ctx.runDir, "receipt.json");
       atomicWriteText(path, JSON.stringify(receipt, null, 2) + `
 `);
-      atomicWriteText(join68(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
+      atomicWriteText(join69(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
       recordRun(process.env, ctx.repoDir, ranModel(o.implement, ctx.model, o.fix), verdict, cost.usd, cost.unmetered === true, totalS);
       try {
         hooks.sealed?.(ctx.runDir, JSON.parse(JSON.stringify(receipt), (_k, v) => v && typeof v === "object" ? Object.freeze(v) : v));
@@ -16920,14 +17023,14 @@ var init_seal = __esm(() => {
 });
 
 // ../../loki-ts/src/util/composite_seal.ts
-import { existsSync as existsSync47, readFileSync as readFileSync55 } from "fs";
-import { basename as basename25, dirname as dirname31, join as join69 } from "path";
+import { existsSync as existsSync48, readFileSync as readFileSync56 } from "fs";
+import { basename as basename26, dirname as dirname31, join as join70 } from "path";
 function logProblem(runDir, integ) {
   if (typeof integ["log_sha256"] !== "string")
     return null;
   let b;
   try {
-    b = readFileSync55(join69(runDir, "integration.log"));
+    b = readFileSync56(join70(runDir, "integration.log"));
   } catch {
     return "integration.log is missing but integration.json records its hash";
   }
@@ -16950,13 +17053,13 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
     return bad("body malformed");
   let ibytes;
   try {
-    ibytes = readFileSync55(join69(runDir, "integration.json"));
+    ibytes = readFileSync56(join70(runDir, "integration.json"));
   } catch {
     return bad("integration.json missing");
   }
   if (sha3(ibytes) !== receipt["integration_sha256"])
     return bad("integration.json does not match its recorded hash");
-  const integ = readJson6(join69(runDir, "integration.json"));
+  const integ = readJson6(join70(runDir, "integration.json"));
   if (!isObj10(integ) || !isObj10(integ["outcomes"]))
     return bad("integration.json has no outcomes");
   const iprob = integrationProblem(integ);
@@ -16991,10 +17094,10 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
       return bad(`child ${text2(repo, 80) || "?"} has an invalid receipt path`);
     if (outcomes[repo] !== "ok")
       return bad(`child ${text2(repo, 80)} did not finish ok in integration.json`);
-    const rp = join69(runDir, rel);
+    const rp = join70(runDir, rel);
     let bytes;
     try {
-      bytes = readFileSync55(rp);
+      bytes = readFileSync56(rp);
     } catch {
       return bad(`child ${repo} receipt missing`);
     }
@@ -17043,8 +17146,8 @@ var init_keys_cmd = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/verify_cmd.ts
-import { existsSync as existsSync48, readFileSync as readFileSync56, renameSync as renameSync14, statSync as statSync24, writeFileSync as writeFileSync33 } from "fs";
-import { basename as basename26, dirname as dirname32, join as join70 } from "path";
+import { existsSync as existsSync49, readFileSync as readFileSync57, renameSync as renameSync14, statSync as statSync24, writeFileSync as writeFileSync33 } from "fs";
+import { basename as basename27, dirname as dirname32, join as join71 } from "path";
 import { createHash as createHash19, createPublicKey as createPublicKey4, verify as verify4 } from "crypto";
 function pubFor(kid, given) {
   if (given)
@@ -17052,7 +17155,7 @@ function pubFor(kid, given) {
   const active = loadSigningKey(false);
   const pubs = (process.env["LOKI_RECEIPT_RETIRED_PUBKEYS"] ?? "").split(":").map((f) => f.trim()).filter(Boolean).flatMap((f) => {
     try {
-      return [createPublicKey4(readFileSync56(f))];
+      return [createPublicKey4(readFileSync57(f))];
     } catch {
       return [];
     }
@@ -17096,10 +17199,10 @@ function checkEventLog(receiptPath, receipt) {
     const claims = st !== null && typeof st === "object" && Object.keys(st).length > 0;
     return claims ? "the receipt records stages but binds the empty-log hash, so no events.jsonl can back it (missing, empty or non-empty); the receipt is forged or was sealed without a log. Re-run the task to produce a fresh receipt" : null;
   }
-  const path = join70(dirname32(receiptPath), "events.jsonl");
-  if (!existsSync48(path))
+  const path = join71(dirname32(receiptPath), "events.jsonl");
+  if (!existsSync49(path))
     return "events.jsonl is missing";
-  const raw2 = readFileSync56(path, "utf8"), events2 = readEvents(path), lines2 = raw2.split(`
+  const raw2 = readFileSync57(path, "utf8"), events2 = readEvents(path), lines2 = raw2.split(`
 `).filter((l) => l.trim() !== "");
   if (events2.length !== lines2.length || events2.some((e, i) => e.seq !== i))
     return "events.jsonl has a forged, edited or missing line";
@@ -17115,7 +17218,7 @@ function checkEventLog(receiptPath, receipt) {
   return h.digest("hex") === bound ? null : "events.jsonl does not match the hash recorded at seal";
 }
 function checkLogSeal(receiptPath, hash, kid, given) {
-  const path = join70(dirname32(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
+  const path = join71(dirname32(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e) => e.type === "run.completed");
   if (!events2.some((e) => e.type === "receipt.sealed" && e.data["receipt_sha256"] === hash))
     return { verdict: "TAMPERED", reason: "events.jsonl has no receipt.sealed event for this receipt" };
   if (done < 0)
@@ -17123,7 +17226,7 @@ function checkLogSeal(receiptPath, hash, kid, given) {
   const seal = events2[done + 1], d = seal?.type === "log.sealed" ? seal.data : null;
   if (!d)
     return { verdict: "TAMPERED", reason: "events.jsonl has no signed log.sealed line after run.completed" };
-  const lines2 = readFileSync56(path, "utf8").split(`
+  const lines2 = readFileSync57(path, "utf8").split(`
 `).filter((l) => l.trim() !== ""), sha4 = createHash19("sha256").update(lines2.slice(0, done + 1).join(`
 `) + `
 `).digest("hex");
@@ -17133,11 +17236,11 @@ function checkLogSeal(receiptPath, hash, kid, given) {
   return null;
 }
 async function verifyReceipt(receiptPath, deps = {}) {
-  if (!existsSync48(receiptPath))
+  if (!existsSync49(receiptPath))
     return { verdict: "UNCHECKED", reasons: [`receipt not found: ${receiptPath}`] };
   let receipt;
   try {
-    receipt = JSON.parse((deps.read ?? ((p) => readFileSync56(p, "utf8")))(receiptPath));
+    receipt = JSON.parse((deps.read ?? ((p) => readFileSync57(p, "utf8")))(receiptPath));
   } catch {
     return { verdict: "UNCHECKED", reasons: ["receipt.json is not valid JSON"] };
   }
@@ -17226,8 +17329,8 @@ var init_verify_cmd = __esm(() => {
 });
 
 // src/server/app.ts
-import { existsSync as existsSync50, readFileSync as readFileSync59, statSync as statSync25 } from "fs";
-import { join as join73, resolve as resolve16, sep as sep15 } from "path";
+import { existsSync as existsSync51, readFileSync as readFileSync60, statSync as statSync25 } from "fs";
+import { join as join74, resolve as resolve17, sep as sep16 } from "path";
 
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = Symbol();
@@ -27499,9 +27602,9 @@ function mount20(ctx) {
 }
 
 // src/server/routes/verify.ts
-import { readFileSync as readFileSync57, realpathSync as realpathSync23 } from "fs";
+import { readFileSync as readFileSync58, realpathSync as realpathSync24 } from "fs";
 import { createPublicKey as createPublicKey5 } from "crypto";
-import { join as join71, sep as sep14 } from "path";
+import { join as join72, sep as sep15 } from "path";
 init_verify_cmd();
 init_seal();
 init_receipt_dsse();
@@ -27528,15 +27631,15 @@ function mount21(ctx) {
       return done(404, "receipt not available", "not_found");
     let runDir, file;
     try {
-      const root = realpathSync23(join71(repo.p, ".loki", "runs"));
-      runDir = realpathSync23(join71(root, run2));
-      if (runDir !== join71(root, run2))
+      const root = realpathSync24(join72(repo.p, ".loki", "runs"));
+      runDir = realpathSync24(join72(root, run2));
+      if (runDir !== join72(root, run2))
         return done(404, "receipt not found", "not_found");
-      file = realpathSync23(join71(runDir, "receipt.json"));
+      file = realpathSync24(join72(runDir, "receipt.json"));
     } catch {
       return done(404, "receipt not found", "not_found");
     }
-    if (!file.startsWith(runDir + sep14))
+    if (!file.startsWith(runDir + sep15))
       return done(404, "receipt not found", "not_found");
     let integrity, reasons, sha4 = null, outcome = "UNREADABLE";
     try {
@@ -27551,7 +27654,7 @@ function mount21(ctx) {
         sha4 = r.receiptSha256 ?? null;
       }
       try {
-        outcome = outcomeOf(JSON.parse(readFileSync57(file, "utf8")));
+        outcome = outcomeOf(JSON.parse(readFileSync58(file, "utf8")));
       } catch {
         outcome = "UNREADABLE";
       }
@@ -27613,8 +27716,8 @@ function ttlCache(ttlMs = PROBE_CACHE_MS, now2 = Date.now) {
 }
 
 // src/server/legacy/shim.ts
-import { existsSync as existsSync49, readFileSync as readFileSync58 } from "fs";
-import { join as join72 } from "path";
+import { existsSync as existsSync50, readFileSync as readFileSync59 } from "fs";
+import { join as join73 } from "path";
 
 // src/server/legacy/routes.ts
 var LEGACY_ROUTES = [
@@ -27992,10 +28095,10 @@ var logged = new Set;
 var toHono = (p) => p.replace(/\{([A-Za-z_]+):path\}/g, ":$1{.+}").replace(/\{([A-Za-z_]+)\}/g, ":$1");
 var NOT_SUPPORTED = "not yet supported by the Control Plane";
 var repoVersion = () => {
-  for (const f of [join72(import.meta.dir, "../../../../../VERSION")]) {
+  for (const f of [join73(import.meta.dir, "../../../../../VERSION")]) {
     try {
-      if (existsSync49(f))
-        return readFileSync58(f, "utf8").trim();
+      if (existsSync50(f))
+        return readFileSync59(f, "utf8").trim();
     } catch {}
   }
   return "unknown";
@@ -28177,7 +28280,7 @@ function legacyShim(opts) {
 
 // src/server/app.ts
 var MAX_BODY2 = 1e6;
-var defaultUiDir = () => [join73(import.meta.dir, "../../ui/dist"), join73(import.meta.dir, "../ui/dist")].find((d) => existsSync50(join73(d, "index.html")));
+var defaultUiDir = () => [join74(import.meta.dir, "../../ui/dist"), join74(import.meta.dir, "../ui/dist")].find((d) => existsSync51(join74(d, "index.html")));
 function createApp(opts) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db, sqlite } = openDb(opts.dbPath);
@@ -28206,10 +28309,10 @@ function createApp(opts) {
     await next();
   });
   const readInstalled = () => {
-    for (const f of [process.env.LOKI_VERSION_FILE, join73(import.meta.dir, "../../../../VERSION")]) {
+    for (const f of [process.env.LOKI_VERSION_FILE, join74(import.meta.dir, "../../../../VERSION")]) {
       try {
         if (f)
-          return readFileSync59(f, "utf8").trim() || "unknown";
+          return readFileSync60(f, "utf8").trim() || "unknown";
       } catch {}
     }
     return "unknown";
@@ -28318,13 +28421,13 @@ function createApp(opts) {
     }
     if (!uiDir || p.startsWith("/v1/"))
       return c.json({ error: "not found" }, 404);
-    const root = resolve16(uiDir);
-    const f = resolve16(root, `.${p}`);
-    if (f.startsWith(root + sep15) && existsSync50(f) && statSync25(f).isFile())
+    const root = resolve17(uiDir);
+    const f = resolve17(root, `.${p}`);
+    if (f.startsWith(root + sep16) && existsSync51(f) && statSync25(f).isFile())
       return new Response(Bun.file(f));
     if (/\.[a-z0-9]+$/i.test(p))
       return c.json({ error: "not found" }, 404);
-    return new Response(Bun.file(join73(root, "index.html")));
+    return new Response(Bun.file(join74(root, "index.html")));
   });
   return { app, db, close: () => {
     clearInterval(reconciler);