loki-mode 11.67.1 → 11.67.3

package/packages/control-plane/dist/server.js

@@ -7649,33 +7649,10 @@ var init_paths = __esm(() => {
   REPO_ROOT = findRepoRoot();
 });
 
-// ../../loki-ts/src/engine10/cache.ts
+// ../../loki-ts/src/util/producer_fingerprint.ts
 import { createHash as createHash6 } from "crypto";
-import { chmodSync as chmodSync4, existsSync as existsSync15, mkdirSync as mkdirSync5, readdirSync as readdirSync9, readFileSync as readFileSync18, renameSync as renameSync4, statSync as statSync12, unlinkSync as unlinkSync3, writeFileSync as writeFileSync8 } from "fs";
-import { basename as basename8, relative, resolve as resolve8 } from "path";
-function repoKey(originUrl, repoDir) {
-  const basis = originUrl && originUrl.trim() !== "" ? originUrl : resolve8(repoDir);
-  return createHash6("sha256").update(basis).digest("hex");
-}
-function defaultCacheRoot() {
-  return resolve8(homeLokiDir(), "cache", "v10");
-}
-function repoCacheDir(key, cacheRoot = defaultCacheRoot()) {
-  return resolve8(cacheRoot, key);
-}
-function readJson3(path, isValid = (_v) => true) {
-  if (!existsSync15(path))
-    return null;
-  try {
-    const parsed = JSON.parse(readFileSync18(path, "utf8"));
-    return isValid(parsed) ? parsed : null;
-  } catch {
-    return null;
-  }
-}
-function isRepoMap(v) {
-  return typeof v === "object" && v !== null && Array.isArray(v.files) && Array.isArray(v.entries);
-}
+import { readdirSync as readdirSync9, readFileSync as readFileSync18 } from "fs";
+import { relative, resolve as resolve8 } from "path";
 function sourceFingerprint(root) {
   const h = createHash6("sha256");
   const walk = (dir) => {
@@ -7703,9 +7680,40 @@ function computeProducerFingerprint(root = resolve8(import.meta.dir, ".."), inje
 function producerFingerprint() {
   return producerFp ??= computeProducerFingerprint();
 }
-var producerFp = null, cacheFileName = (kind, tree, fp = producerFingerprint()) => `${kind}-${fp.slice(0, 16)}-${tree}.json`, readRepoMapCache = (dir, tree, fp = producerFingerprint()) => readJson3(resolve8(dir, cacheFileName("repomap", tree, fp)), isRepoMap);
+var producerFp = null;
+var init_producer_fingerprint = () => {};
+
+// ../../loki-ts/src/engine10/cache.ts
+import { createHash as createHash7 } from "crypto";
+import { chmodSync as chmodSync4, existsSync as existsSync15, mkdirSync as mkdirSync5, readdirSync as readdirSync10, readFileSync as readFileSync19, renameSync as renameSync4, statSync as statSync12, unlinkSync as unlinkSync3, writeFileSync as writeFileSync8 } from "fs";
+import { basename as basename8, resolve as resolve9 } from "path";
+function repoKey(originUrl, repoDir) {
+  const basis = originUrl && originUrl.trim() !== "" ? originUrl : resolve9(repoDir);
+  return createHash7("sha256").update(basis).digest("hex");
+}
+function defaultCacheRoot() {
+  return resolve9(homeLokiDir(), "cache", "v10");
+}
+function repoCacheDir(key, cacheRoot = defaultCacheRoot()) {
+  return resolve9(cacheRoot, key);
+}
+function readJson3(path, isValid = (_v) => true) {
+  if (!existsSync15(path))
+    return null;
+  try {
+    const parsed = JSON.parse(readFileSync19(path, "utf8"));
+    return isValid(parsed) ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+function isRepoMap(v) {
+  return typeof v === "object" && v !== null && Array.isArray(v.files) && Array.isArray(v.entries);
+}
+var cacheFileName = (kind, tree, fp = producerFingerprint()) => `${kind}-${fp.slice(0, 16)}-${tree}.json`, readRepoMapCache = (dir, tree, fp = producerFingerprint()) => readJson3(resolve9(dir, cacheFileName("repomap", tree, fp)), isRepoMap);
 var init_cache = __esm(() => {
   init_paths();
+  init_producer_fingerprint();
 });
 
 // ../../loki-ts/src/engine10/repomap.ts
@@ -7818,12 +7826,12 @@ var init_lean_select = __esm(() => {
 });
 
 // ../../loki-ts/src/util/claude_model.ts
-import { readFileSync as readFileSync19 } from "fs";
-import { resolve as resolve9 } from "path";
+import { readFileSync as readFileSync20 } from "fs";
+import { resolve as resolve10 } from "path";
 function resolveClaudeModel(want) {
   try {
-    const path = process.env["LOKI_MODEL_CATALOG"] || resolve9(REPO_ROOT, "providers/model_catalog.json");
-    return JSON.parse(readFileSync19(path, "utf8")).providers?.claude?.cli_aliases?.[want] ?? want;
+    const path = process.env["LOKI_MODEL_CATALOG"] || resolve10(REPO_ROOT, "providers/model_catalog.json");
+    return JSON.parse(readFileSync20(path, "utf8")).providers?.claude?.cli_aliases?.[want] ?? want;
   } catch {
     return want;
   }
@@ -7900,18 +7908,18 @@ var init_price_table = __esm(() => {
 });
 
 // ../../loki-ts/src/providers/provider_cost.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync6, readdirSync as readdirSync10, readFileSync as readFileSync20, renameSync as renameSync5, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync16, mkdirSync as mkdirSync6, readdirSync as readdirSync11, readFileSync as readFileSync21, renameSync as renameSync5, writeFileSync as writeFileSync9 } from "fs";
 import { dirname as dirname7, join as join27 } from "path";
 function withArchivedCosts(lokiRoot, ids, keep = () => true) {
   let files = [];
   try {
-    files = readdirSync10(join27(lokiRoot, "metrics"));
+    files = readdirSync11(join27(lokiRoot, "metrics"));
   } catch {}
   return [...new Set([...ids, ...ids.flatMap((id) => files.filter((f) => f.startsWith(`result-cost-${id}-q`) && f.endsWith(".json")).map((f) => f.slice("result-cost-".length, -".json".length)).filter(keep))])];
 }
 function neverRan(path, unmeteredMarker) {
   try {
-    const r = JSON.parse(readFileSync20(path, "utf8")), n2 = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
+    const r = JSON.parse(readFileSync21(path, "utf8")), n2 = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
     return r["total_cost_usd"] === 0 && r["source"] !== unmeteredMarker && ["input_tokens", "output_tokens", "cache_read_tokens", "cache_creation_tokens"].every((k) => n2(r[k]) === 0);
   } catch {
     return false;
@@ -7928,13 +7936,13 @@ var init_provider_cost = __esm(() => {
 });
 
 // ../../loki-ts/src/providers/model_routes.ts
-import { readFileSync as readFileSync21 } from "fs";
-import { dirname as dirname8, resolve as resolve10 } from "path";
+import { readFileSync as readFileSync22 } from "fs";
+import { dirname as dirname8, resolve as resolve11 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 function inferenceGeoTable() {
   try {
-    const p = resolve10(dirname8(fileURLToPath2(import.meta.url)), "..", "..", "data", "model-pricing.json");
-    const t = JSON.parse(readFileSync21(p, "utf8")).inference_geo_multipliers;
+    const p = resolve11(dirname8(fileURLToPath2(import.meta.url)), "..", "..", "data", "model-pricing.json");
+    const t = JSON.parse(readFileSync22(p, "utf8")).inference_geo_multipliers;
     if (t && typeof t === "object")
       return t;
   } catch {}
@@ -7970,7 +7978,7 @@ function advisorOnlyEnabled(env = process.env) {
 var routerEnabled = (env = process.env) => routerMode(env) === "on", sessionPlanEnabled = (env = process.env) => routerEnabled(env) || advisorOnlyEnabled(env);
 
 // ../../loki-ts/src/engine10/cost.ts
-import { readdirSync as readdirSync11, readFileSync as readFileSync22 } from "fs";
+import { readdirSync as readdirSync12, readFileSync as readFileSync23 } from "fs";
 import { join as join28 } from "path";
 function routerTelemetryOn(env = process.env) {
   return sessionPlanEnabled(env);
@@ -8010,7 +8018,7 @@ function sumResultCosts(lokiRoot, iterations, context = []) {
   const parsed = new Map;
   for (const iter of iterations) {
     try {
-      parsed.set(iter, JSON.parse(readFileSync22(resultCostPath(lokiRoot, iter), "utf8")));
+      parsed.set(iter, JSON.parse(readFileSync23(resultCostPath(lokiRoot, iter), "utf8")));
     } catch {}
   }
   const own = new Set(iterations);
@@ -8019,7 +8027,7 @@ function sumResultCosts(lokiRoot, iterations, context = []) {
     if (own.has(iter))
       continue;
     try {
-      lookup.push({ iter, rec: JSON.parse(readFileSync22(resultCostPath(lokiRoot, iter), "utf8")) });
+      lookup.push({ iter, rec: JSON.parse(readFileSync23(resultCostPath(lokiRoot, iter), "utf8")) });
     } catch {}
   }
   const verdicts = hooks.costRecords?.resumeVerdicts(lookup) ?? { ambiguous: [], separate: [] };
@@ -8312,21 +8320,21 @@ var init_atomic = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/budget.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync9, readdirSync as readdirSync12, readFileSync as readFileSync23, writeFileSync as writeFileSync12 } from "fs";
-import { dirname as dirname10, join as join29, resolve as resolve11 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, readdirSync as readdirSync13, readFileSync as readFileSync24, writeFileSync as writeFileSync12 } from "fs";
+import { dirname as dirname10, join as join29, resolve as resolve12 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 function loadDefaultMaxCostUsd(dataDirs = [["..", "..", "data"], ["..", "data"]]) {
   const here = dirname10(fileURLToPath3(import.meta.url));
   for (const rel of dataDirs) {
     try {
-      const j = JSON.parse(readFileSync23(resolve11(here, ...rel, "model-pricing.json"), "utf8"));
+      const j = JSON.parse(readFileSync24(resolve12(here, ...rel, "model-pricing.json"), "utf8"));
       if (typeof j.default_max_cost_usd === "number" && Number.isFinite(j.default_max_cost_usd) && j.default_max_cost_usd > 0)
         return j.default_max_cost_usd;
     } catch {}
   }
   if (!pricingFallbackWarned) {
     pricingFallbackWarned = true;
-    process.stderr.write(`loki: warning: model-pricing.json is missing or unreadable (looked in ${dataDirs.map((r) => resolve11(here, ...r)).join(", ")}); using fallback default max cost $${DEFAULT_FALLBACK_USD}
+    process.stderr.write(`loki: warning: model-pricing.json is missing or unreadable (looked in ${dataDirs.map((r) => resolve12(here, ...r)).join(", ")}); using fallback default max cost $${DEFAULT_FALLBACK_USD}
 `);
   }
   return DEFAULT_FALLBACK_USD;
@@ -8334,10 +8342,10 @@ function loadDefaultMaxCostUsd(dataDirs = [["..", "..", "data"], ["..", "data"]]
 function _loadPricing() {
   try {
     const moduleDir = dirname10(fileURLToPath3(import.meta.url));
-    const jsonPath = resolve11(moduleDir, "..", "..", "data", "model-pricing.json");
+    const jsonPath = resolve12(moduleDir, "..", "..", "data", "model-pricing.json");
     if (!existsSync17(jsonPath))
       return _FALLBACK_PRICING;
-    const raw2 = JSON.parse(readFileSync23(jsonPath, "utf8"));
+    const raw2 = JSON.parse(readFileSync24(jsonPath, "utf8"));
     const pricing2 = raw2["pricing"];
     if (!pricing2 || typeof pricing2 !== "object")
       return _FALLBACK_PRICING;
@@ -8648,8 +8656,8 @@ var init_schema = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/history_store.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync10, readFileSync as readFileSync24, renameSync as renameSync7, rmSync as rmSync6, writeFileSync as writeFileSync13 } from "fs";
-import { resolve as resolve12 } from "path";
+import { existsSync as existsSync19, mkdirSync as mkdirSync10, readFileSync as readFileSync25, renameSync as renameSync7, rmSync as rmSync6, writeFileSync as writeFileSync13 } from "fs";
+import { resolve as resolve13 } from "path";
 function validRun(v) {
   if (typeof v !== "object" || v === null)
     return false;
@@ -8657,14 +8665,14 @@ function validRun(v) {
   return typeof r["shape"] === "string" && typeof r["executor"] === "string" && EXECUTORS.includes(r["executor"]) && typeof r["verdict"] === "string" && VERDICTS.includes(r["verdict"]) && (r["owner"] === null || typeof r["owner"] === "string" && OWNERS.includes(r["owner"])) && typeof r["escalated"] === "boolean" && typeof r["usd"] === "number" && Number.isFinite(r["usd"]) && typeof r["wallS"] === "number" && Number.isFinite(r["wallS"]);
 }
 function historyPath(key, cacheRoot) {
-  return resolve12(repoCacheDir(key, cacheRoot), HISTORY_FILE);
+  return resolve13(repoCacheDir(key, cacheRoot), HISTORY_FILE);
 }
 function readRunHistory(key, cacheRoot) {
   const path = historyPath(key, cacheRoot);
   if (!existsSync19(path))
     return [];
   try {
-    const parsed = JSON.parse(readFileSync24(path, "utf8"));
+    const parsed = JSON.parse(readFileSync25(path, "utf8"));
     const runs2 = parsed?.runs;
     return Array.isArray(runs2) ? runs2.filter(validRun) : [];
   } catch {
@@ -8701,8 +8709,8 @@ var init_history_store = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/gather.ts
-import { createHash as createHash7 } from "crypto";
-import { closeSync as closeSync6, lstatSync as lstatSync7, openSync as openSync6, readFileSync as readFileSync25, readSync as readSync5 } from "fs";
+import { createHash as createHash8 } from "crypto";
+import { closeSync as closeSync6, lstatSync as lstatSync7, openSync as openSync6, readFileSync as readFileSync26, readSync as readSync5 } from "fs";
 import { dirname as dirname11, join as join31 } from "path";
 function listShallow(repoDir) {
   try {
@@ -8716,7 +8724,7 @@ function shallowDirs(repoDir) {
   return [...new Set(listShallow(repoDir).map((p) => dirname11(p)))].sort();
 }
 function computeKey(repoDir, fingerprintFiles, dirs, committedHash = null) {
-  const h = createHash7("sha256");
+  const h = createHash8("sha256");
   h.update(`${MODEL_REV}
 `);
   if (committedHash !== null)
@@ -8731,7 +8739,7 @@ function computeKey(repoDir, fingerprintFiles, dirs, committedHash = null) {
       else {
         const abs = join31(repoDir, f);
         const size = lstatSync7(abs).size;
-        h.update(size <= GATHER_CAPS.maxHashBytes ? readFileSync25(abs) : `too-large:${size}`);
+        h.update(size <= GATHER_CAPS.maxHashBytes ? readFileSync26(abs) : `too-large:${size}`);
       }
     } catch {
       h.update("missing");
@@ -8756,7 +8764,7 @@ function committedModelHash(raw2) {
   if (typeof raw2 !== "object" || raw2 === null || Array.isArray(raw2))
     return null;
   const { key: _key, expiresAt: _exp, ...rest } = raw2;
-  return createHash7("sha256").update(JSON.stringify(rest)).digest("hex");
+  return createHash8("sha256").update(JSON.stringify(rest)).digest("hex");
 }
 var GATHER_CAPS, depthOf = (p) => p.split("/").length, MODEL_REV = "model-rev:2";
 var init_gather = __esm(() => {
@@ -8913,7 +8921,7 @@ var init_engine_origin = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/history.ts
-import { dirname as dirname12, join as join32, resolve as resolve13 } from "path";
+import { dirname as dirname12, join as join32, resolve as resolve14 } from "path";
 import { fileURLToPath as fileURLToPath4 } from "url";
 function shapeKey(model) {
   if (!model || model.status !== "ok")
@@ -8945,7 +8953,7 @@ var init_history = __esm(() => {
   init_cache();
   init_engine_origin();
   init_history_store();
-  SHAPE_DEFAULTS_FILE = resolve13(dirname12(fileURLToPath4(import.meta.url)), "..", "..", "..", "data", "router-shape-defaults.json");
+  SHAPE_DEFAULTS_FILE = resolve14(dirname12(fileURLToPath4(import.meta.url)), "..", "..", "..", "data", "router-shape-defaults.json");
 });
 
 // ../../loki-ts/src/runner/router/unit_model.ts
@@ -8972,7 +8980,7 @@ var init_mcp_config = __esm(() => {
 });
 
 // ../../loki-ts/src/providers/claude_flags.ts
-import { existsSync as existsSync20, readFileSync as readFileSync26 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync27 } from "fs";
 import { resolve as resolvePath, dirname as dirname13 } from "path";
 import { fileURLToPath as fileURLToPath5 } from "url";
 function claudeFlagSupported(flag, helpText) {
@@ -9027,7 +9035,7 @@ function designArchetypesText() {
     ]) {
       const p = resolvePath(moduleDir, ...rel);
       if (existsSync20(p))
-        return readFileSync26(p, "utf8");
+        return readFileSync27(p, "utf8");
     }
   } catch {}
   return "";
@@ -9208,7 +9216,7 @@ var init_model_rank = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/sizing.ts
-import { existsSync as existsSync21, readFileSync as readFileSync27 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync28 } from "fs";
 import { basename as basename9 } from "path";
 function namedFiles(task, map) {
   return (map?.files ?? []).filter((f) => task.toLowerCase().includes(basename9(f).toLowerCase()));
@@ -9230,7 +9238,7 @@ function sizeTask(task, map, tests) {
 }
 function loadRepoMap(repomapRef) {
   try {
-    return repomapRef && existsSync21(repomapRef) ? JSON.parse(readFileSync27(repomapRef, "utf8")) : null;
+    return repomapRef && existsSync21(repomapRef) ? JSON.parse(readFileSync28(repomapRef, "utf8")) : null;
   } catch {
     return null;
   }
@@ -9292,14 +9300,14 @@ var init_model_downgrades = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/discover.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync11, readFileSync as readFileSync28, rmSync as rmSync7, writeFileSync as writeFileSync14 } from "fs";
+import { existsSync as existsSync22, mkdirSync as mkdirSync11, readFileSync as readFileSync29, rmSync as rmSync7, writeFileSync as writeFileSync14 } from "fs";
 import { join as join34 } from "path";
 function projectModelEnabled(env = process.env) {
   return env["LOKI_E10_PROJECT_MODEL"] !== "0";
 }
 function loadCached(repoDir, now2 = Date.now()) {
   try {
-    return parseCached(repoDir, JSON.parse(readFileSync28(join34(repoDir, PROJECT_FILE), "utf8")), now2);
+    return parseCached(repoDir, JSON.parse(readFileSync29(join34(repoDir, PROJECT_FILE), "utf8")), now2);
   } catch {
     return null;
   }
@@ -9314,7 +9322,7 @@ function loadCommitted(repoDir) {
   };
   let raw2;
   try {
-    raw2 = JSON.parse(readFileSync28(join34(repoDir, PROJECT_FILE), "utf8"));
+    raw2 = JSON.parse(readFileSync29(join34(repoDir, PROJECT_FILE), "utf8"));
   } catch (e) {
     return ignore(`unreadable JSON (${e instanceof Error ? e.message : String(e)})`);
   }
@@ -9455,7 +9463,7 @@ var init_test_file_text = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/testmap.ts
-import { existsSync as existsSync23, readFileSync as readFileSync29, realpathSync as realpathSync15 } from "fs";
+import { existsSync as existsSync23, readFileSync as readFileSync30, realpathSync as realpathSync15 } from "fs";
 import { basename as basename11, dirname as dirname14, extname, isAbsolute as isAbsolute2, join as join36, relative as relative2, sep as sep10 } from "path";
 function guessRunner(fileName, runners, relPath) {
   if (fileName.endsWith(".py"))
@@ -9488,8 +9496,8 @@ var init_testmap = __esm(() => {
 
 // ../../loki-ts/src/util/check_result.ts
 import { spawn as spawn7 } from "child_process";
-import { createHash as createHash8 } from "crypto";
-import { existsSync as existsSync24, mkdirSync as mkdirSync12, readFileSync as readFileSync30, realpathSync as realpathSync16, renameSync as renameSync8, rmSync as rmSync8, writeFileSync as writeFileSync15 } from "fs";
+import { createHash as createHash9 } from "crypto";
+import { existsSync as existsSync24, mkdirSync as mkdirSync12, readFileSync as readFileSync31, realpathSync as realpathSync16, renameSync as renameSync8, rmSync as rmSync8, writeFileSync as writeFileSync15 } from "fs";
 import { basename as basename12, dirname as dirname15, isAbsolute as isAbsolute3, join as join37, relative as relative3 } from "path";
 function plainTestEnv(base = process.env) {
   const e = {};
@@ -9683,7 +9691,7 @@ function exitCodedId(cmd, out2, repoDir = "") {
   const norm2 = (x) => roots.reduce((t, r) => t.split(r).join(""), x).replace(/(?<=\.[A-Za-z0-9]+):\d+(?::\d+)?/g, "").replace(/\s+/g, " ").trim();
   const lines = stripAnsi(out2).split(`
 `).map(norm2).filter(Boolean).sort();
-  return lines.length ? `exit-coded:${cmd.trim()}:${createHash8("sha256").update(lines.join(`
+  return lines.length ? `exit-coded:${cmd.trim()}:${createHash9("sha256").update(lines.join(`
 `)).digest("hex")}` : null;
 }
 function classifyCheck(i) {
@@ -9956,8 +9964,8 @@ function publishableWall(repoDir, runDir, o, env = process.env) {
     if (!hit || rel.startsWith("..") || isAbsolute3(rel) || rel.startsWith(".loki/") || !basename12(rel).startsWith("loki_wall_"))
       continue;
     try {
-      const bytes = readFileSync30(join37(runDir, "wall", basename12(rel)));
-      if (createHash8("sha256").update(bytes).digest("hex") !== w["sha256"])
+      const bytes = readFileSync31(join37(runDir, "wall", basename12(rel)));
+      if (createHash9("sha256").update(bytes).digest("hex") !== w["sha256"])
         throw new Error("hash");
       out2.files.push({ rel, bytes, cmd: String(hit["cmd"]) });
     } catch {
@@ -9995,7 +10003,7 @@ function diffFiles(repoDir, baseSha, skip) {
       return f;
     let n2 = 0;
     try {
-      n2 = readFileSync30(join37(repoDir, path), "utf8").split(`
+      n2 = readFileSync31(join37(repoDir, path), "utf8").split(`
 `).length;
     } catch {}
     return { path, added: n2, deleted: 0, status: "added" };
@@ -10018,7 +10026,7 @@ function diffFiles(repoDir, baseSha, skip) {
     let text2 = added.get(f.path) ?? "";
     if (!text2 && f.status === "added") {
       try {
-        text2 = readFileSync30(join37(repoDir, f.path), "utf8");
+        text2 = readFileSync31(join37(repoDir, f.path), "utf8");
       } catch {}
     }
     const rule = criticalRuleFor(f.path, text2, rules);
@@ -10030,7 +10038,7 @@ function diffFiles(repoDir, baseSha, skip) {
       continue;
     try {
       const oldText = f.status === "added" ? "" : safeGit(repoDir, ["show", `${baseSha}:${f.path}`]);
-      const newText = readFileSync30(join37(repoDir, f.path), "utf8");
+      const newText = readFileSync31(join37(repoDir, f.path), "utf8");
       const patch = f.status === "added" ? newText.split(`
 `).map((l) => `+${l}`).join(`
 `) : safeGit(repoDir, ["diff", "-U0", baseSha, "--", f.path]);
@@ -10195,13 +10203,13 @@ async function mapPool(items, jobs, fn, stop = () => false) {
   return out2;
 }
 function spawnCollect(cmd, args, o) {
-  return new Promise((resolve14) => {
+  return new Promise((resolve15) => {
     let out2 = "", err = "", error = false, done = false;
     const MAX = 1024 * 1024;
     const fin = (status) => {
       if (!done) {
         done = true;
-        resolve14({ status: error ? null : status, output: `${out2}
+        resolve15({ status: error ? null : status, output: `${out2}
 ${err}` });
       }
     };
@@ -10242,7 +10250,7 @@ function resolveTool(repoDir, bin, fallback, lastResort = fallback) {
 }
 function goTestNames(file) {
   try {
-    return [...new Set([...readFileSync30(file, "utf8").matchAll(/^func\s+((?:Test|Fuzz|Example)[\p{L}\p{N}_]*)\s*\(/gmu)].map((m) => m[1]).filter((n2) => n2 !== "TestMain"))];
+    return [...new Set([...readFileSync31(file, "utf8").matchAll(/^func\s+((?:Test|Fuzz|Example)[\p{L}\p{N}_]*)\s*\(/gmu)].map((m) => m[1]).filter((n2) => n2 !== "TestMain"))];
   } catch {
     return [];
   }
@@ -10305,7 +10313,7 @@ async function wallChild(git, runId, repoDir, wallFiles) {
     return false;
   for (const n2 of names) {
     const h = want.get(n2);
-    if (h === undefined || createHash8("sha256").update((await git(["cat-file", "blob", `HEAD:${n2}`])).out).digest("hex") !== h)
+    if (h === undefined || createHash9("sha256").update((await git(["cat-file", "blob", `HEAD:${n2}`])).out).digest("hex") !== h)
       return false;
   }
   return true;
@@ -10363,7 +10371,7 @@ var NO_TESTS_REASON = "no tests executed", NO_RUNNER_REASON = "no runner of this
   return out2.filter((n2) => !NOT_A_NAME.has(n2));
 }, SENSITIVE, API, TEST_CFG, RANK2, FILES_MEDIUM = 4, FILES_HIGH = 15, LINES_MEDIUM = 100, LINES_HIGH = 500, RAN_ALWAYS, REVIEWER_ITEM = "one reviewer", PLAN, LOW_SKIPPED, deferredOf = (tier, selected, executed) => (tier === "low" ? LOW_SKIPPED : selected).filter((c) => !RAN_ALWAYS.includes(c) && !executed.includes(c)), DEEP_ITEMS, NOT_SELECTED = "not selected by risk tier: ", MANIFEST_LOCKS, dirOf = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "", PKG_DEP_KEYS, PYPROJECT_NONDEP, SEM_RULES, DOC_FILE, readOr = (p) => {
   try {
-    return readFileSync30(p, "utf8");
+    return readFileSync31(p, "utf8");
   } catch {
     return null;
   }
@@ -10376,7 +10384,7 @@ var NO_TESTS_REASON = "no tests executed", NO_RUNNER_REASON = "no runner of this
 }, EXCERPT_GROUP_CAP = 1500, EXCERPT_TOTAL_CAP = 6144, verifyJobs = () => {
   const n2 = Number.parseInt(process.env["LOKI_E10_VERIFY_JOBS"] ?? "", 10);
   return Number.isFinite(n2) && n2 >= 1 ? Math.min(n2, 8) : 1;
-}, FULL_SUITE_STATIC, ALREADY_FAILING_ON_BASE = "already failing on base, not caused by this change", SKIPPED_BY_REPO = "skipped by the repo on base and head", checkResultLabel = (result, preRed, repoSkipped = false) => result === "fail" && preRed ? `fail (${ALREADY_FAILING_ON_BASE})` : result === "not_run" && repoSkipped ? `not_run (${SKIPPED_BY_REPO})` : result, blobSha = (b, hex) => createHash8(hex === 64 ? "sha256" : "sha1").update(Buffer.concat([Buffer.from(`blob ${b.length}\x00`), b])).digest("hex");
+}, FULL_SUITE_STATIC, ALREADY_FAILING_ON_BASE = "already failing on base, not caused by this change", SKIPPED_BY_REPO = "skipped by the repo on base and head", checkResultLabel = (result, preRed, repoSkipped = false) => result === "fail" && preRed ? `fail (${ALREADY_FAILING_ON_BASE})` : result === "not_run" && repoSkipped ? `not_run (${SKIPPED_BY_REPO})` : result, blobSha = (b, hex) => createHash9(hex === 64 ? "sha256" : "sha1").update(Buffer.concat([Buffer.from(`blob ${b.length}\x00`), b])).digest("hex");
 var init_check_result = __esm(() => {
   init_resolve();
   init_testmap();
@@ -10444,8 +10452,8 @@ var init_check_result = __esm(() => {
 });
 
 // ../../loki-ts/src/util/receipt_signer.ts
-import { createHash as createHash9, randomBytes as randomBytes3, createPrivateKey, createPublicKey as createPublicKey2, generateKeyPairSync, sign, verify as verify2 } from "crypto";
-import { chmodSync as chmodSync5, linkSync, mkdirSync as mkdirSync13, readdirSync as readdirSync14, readFileSync as readFileSync31, renameSync as renameSync9, statSync as statSync15, unlinkSync as unlinkSync5, writeFileSync as writeFileSync16 } from "fs";
+import { createHash as createHash10, randomBytes as randomBytes3, createPrivateKey, createPublicKey as createPublicKey2, generateKeyPairSync, sign, verify as verify2 } from "crypto";
+import { chmodSync as chmodSync5, linkSync, mkdirSync as mkdirSync13, readdirSync as readdirSync15, readFileSync as readFileSync32, renameSync as renameSync9, statSync as statSync15, unlinkSync as unlinkSync5, writeFileSync as writeFileSync16 } from "fs";
 import { homedir as homedir8 } from "os";
 import { spawnSync as spawnSync2 } from "child_process";
 import { dirname as dirname16, join as join38 } from "path";
@@ -10471,7 +10479,7 @@ function loadSigningKey(generate = true) {
       const given = process.env["LOKI_RECEIPT_SIGNING_KEY_FILE"]?.trim();
       const file = given || join38(process.env["HOME"] || homedir8(), ".loki", "keys", RECEIPT_SIGNER_BASENAME);
       try {
-        pem = readFileSync31(file);
+        pem = readFileSync32(file);
         if (!given) {
           for (const [f, m] of [[file, 384], [dirname16(file), 448]])
             if (statSync15(f).mode & 63)
@@ -10494,7 +10502,7 @@ function loadSigningKey(generate = true) {
         } finally {
           unlinkSync5(tmp);
         }
-        pem = readFileSync31(file);
+        pem = readFileSync32(file);
       }
     }
     stage = "parse";
@@ -10552,7 +10560,7 @@ function collectToolchain(probe) {
   }
   return { ...memo };
 }
-var RECEIPT_SIGNER_BASENAME = "receipt-ed25519.pem", b64u = (b) => Buffer.from(b).toString("base64url"), kidOf2 = (pub) => b64u(createHash9("sha256").update(`{"crv":"Ed25519","kty":"OKP","x":"${pub.export({ format: "jwk" }).x}"}`).digest()), lastProblem = null, TOOLCHAIN_KEYS, probeRuns = 0, memo = null;
+var RECEIPT_SIGNER_BASENAME = "receipt-ed25519.pem", b64u = (b) => Buffer.from(b).toString("base64url"), kidOf2 = (pub) => b64u(createHash10("sha256").update(`{"crv":"Ed25519","kty":"OKP","x":"${pub.export({ format: "jwk" }).x}"}`).digest()), lastProblem = null, TOOLCHAIN_KEYS, probeRuns = 0, memo = null;
 var init_receipt_signer = __esm(() => {
   init_check_result();
   TOOLCHAIN_KEYS = ["bun", "node", "python3", "git"];
@@ -10627,12 +10635,12 @@ var init_stop_restore = __esm(() => {
 });
 
 // ../../loki-ts/src/util/base_guard.ts
-import { existsSync as existsSync25, readdirSync as readdirSync15, readFileSync as readFileSync32, readlinkSync, realpathSync as realpathSync17, symlinkSync } from "fs";
-import { basename as basename13, join as join39, relative as relative4, resolve as resolve14, sep as sep11 } from "path";
+import { existsSync as existsSync25, readdirSync as readdirSync16, readFileSync as readFileSync33, readlinkSync, realpathSync as realpathSync17, symlinkSync } from "fs";
+import { basename as basename13, join as join39, relative as relative4, resolve as resolve15, sep as sep11 } from "path";
 import { fileURLToPath as fileURLToPath6 } from "url";
 function insideAny(p, roots) {
   const under = (q) => roots.some((r) => q === r || q.startsWith(r + sep11));
-  if (under(resolve14(p)))
+  if (under(resolve15(p)))
     return true;
   try {
     return under(realpathSync17(p));
@@ -10650,18 +10658,18 @@ function namedPaths(file, text2) {
 function depsSeeHead(pkgDir, repoDir) {
   let roots;
   try {
-    roots = [...new Set([resolve14(repoDir), realpathSync17(repoDir)])];
+    roots = [...new Set([resolve15(repoDir), realpathSync17(repoDir)])];
   } catch {
     return true;
   }
   let seen = 0;
   const walk = (dir, own) => {
-    for (const e of readdirSync15(dir, { withFileTypes: true })) {
+    for (const e of readdirSync16(dir, { withFileTypes: true })) {
       if (++seen > WALK_BOUND)
         return true;
       const p = join39(dir, e.name);
       if (e.isSymbolicLink()) {
-        const t = resolve14(dir, readlinkSync(p));
+        const t = resolve15(dir, readlinkSync(p));
         let rt = t;
         try {
           rt = realpathSync17(t);
@@ -10672,7 +10680,7 @@ function depsSeeHead(pkgDir, repoDir) {
         if (walk(p, own))
           return true;
       } else if (REPO_LINK_FILE.test(e.name)) {
-        const text2 = readFileSync32(p, "utf8");
+        const text2 = readFileSync33(p, "utf8");
         if (roots.some((r) => text2.includes(r)) || namedPaths(p, text2).some((n2) => insideAny(n2, roots)))
           return true;
       }
@@ -10683,7 +10691,7 @@ function depsSeeHead(pkgDir, repoDir) {
     return ["node_modules", ".venv"].some((d) => {
       try {
         const top = join39(pkgDir, d);
-        return walk(top, [...new Set([resolve14(top), realpathSync17(top)])]);
+        return walk(top, [...new Set([resolve15(top), realpathSync17(top)])]);
       } catch (e) {
         if (e.code === "ENOENT")
           return false;
@@ -10740,7 +10748,7 @@ var init_base_guard = __esm(() => {
 });
 
 // ../../loki-ts/src/features/speed/unit_mode.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 import { closeSync as closeSync7, constants, fstatSync as fstatSync5, lstatSync as lstatSync9, openSync as openSync7, readSync as readSync6, realpathSync as realpathSync18 } from "fs";
 function readBounded(path) {
   const l = lstatSync9(path);
@@ -10798,7 +10806,7 @@ function unitSpec(env = process.env) {
   return memo2.get(path) ?? null;
 }
 function unitSpecSha256(s) {
-  return createHash10("sha256").update(JSON.stringify({ id: typeof s.id === "string" ? s.id : "", items: arr2(s.items), acceptance: arr2(s.acceptance), writeSet: arr2(s.writeSet), base: typeof s.base === "string" ? s.base : "" })).digest("hex");
+  return createHash11("sha256").update(JSON.stringify({ id: typeof s.id === "string" ? s.id : "", items: arr2(s.items), acceptance: arr2(s.acceptance), writeSet: arr2(s.writeSet), base: typeof s.base === "string" ? s.base : "" })).digest("hex");
 }
 function unitSpecReceiptBlock(env = process.env) {
   const path = env["LOKI_UNIT_SPEC"], frozen = env["LOKI_UNIT_SPEC_FROZEN"];
@@ -11663,8 +11671,8 @@ var init_state = __esm(() => {
 
 // ../../loki-ts/src/runner/repo_profile.ts
 import { spawnSync as spawnSync3 } from "child_process";
-import { existsSync as existsSync26, lstatSync as lstatSync10, readFileSync as readFileSync33, mkdirSync as mkdirSync14, readdirSync as readdirSync16, renameSync as renameSync10, rmSync as rmSync9, writeFileSync as writeFileSync17 } from "fs";
-import { basename as basename14, join as join40, resolve as resolve15, isAbsolute as isAbsolute4 } from "path";
+import { existsSync as existsSync26, lstatSync as lstatSync10, readFileSync as readFileSync34, mkdirSync as mkdirSync14, readdirSync as readdirSync17, renameSync as renameSync10, rmSync as rmSync9, writeFileSync as writeFileSync17 } from "fs";
+import { basename as basename14, join as join40, resolve as resolve16, isAbsolute as isAbsolute4 } from "path";
 function detectFormatters(repoDir) {
   const out2 = [];
   const has = (...fs2) => fs2.some((f) => existsSync26(join40(repoDir, f)));
@@ -11676,7 +11684,7 @@ function detectFormatters(repoDir) {
     prettierKey = pj !== "" && "prettier" in JSON.parse(pj);
   } catch {}
   const local = join40(repoDir, "node_modules", ".bin", "prettier");
-  if ((prettierKey || readdirSync16(repoDir).some((f) => /^(\.prettierrc(\.[a-z0-9]+)?|prettier\.config\.[cm]?[jt]s)$/.test(f))) && existsSync26(local))
+  if ((prettierKey || readdirSync17(repoDir).some((f) => /^(\.prettierrc(\.[a-z0-9]+)?|prettier\.config\.[cm]?[jt]s)$/.test(f))) && existsSync26(local))
     out2.push({ tool: "prettier", argv: [local, "--write"], exts: /\.(?:[cm]?[jt]sx?|json|css|scss|md|ya?ml|html)$/ });
   if (has("go.mod"))
     out2.push({ tool: "gofmt", argv: ["gofmt", "-w"], exts: /\.go$/ });
@@ -11703,7 +11711,7 @@ function runFormatters(repoDir, files, env) {
 }
 function loadProfile(repoDir) {
   try {
-    const p = JSON.parse(readFileSync33(commandProfilePath(repoDir), "utf8"));
+    const p = JSON.parse(readFileSync34(commandProfilePath(repoDir), "utf8"));
     return p?.version === 1 && Array.isArray(p.commands) && p.baseline ? p : null;
   } catch {
     return null;
@@ -11733,7 +11741,7 @@ function goIdTouched(repoDir, id, changed) {
   const pkg = id.split("::")[0] ?? "";
   const modOf = (dir) => {
     try {
-      return /^module\s+(\S+)/m.exec(readFileSync33(join40(repoDir, dir, "go.mod"), "utf8"))?.[1] ?? null;
+      return /^module\s+(\S+)/m.exec(readFileSync34(join40(repoDir, dir, "go.mod"), "utf8"))?.[1] ?? null;
     } catch {
       return null;
     }
@@ -11845,7 +11853,7 @@ async function staticPreExisting(tool, prefix, files, io) {
 }
 var commandProfilePath = (repoDir) => join40(repoDir, ".loki", "state", "repo-profile.json"), read = (p) => {
   try {
-    return readFileSync33(p, "utf8");
+    return readFileSync34(p, "utf8");
   } catch {
     return "";
   }
@@ -11879,7 +11887,7 @@ var init_context = __esm(() => {
     "Rules:",
     "- The Wall tests are read-only: do not edit or delete them. Existing test files are append-only: you may add new test functions, but never edit or delete an existing one.",
     "- Exception: when the task text itself states the new expected value of an existing assertion, change only that literal in that assertion; never remove, skip or loosen an assertion, and never edit one the task text does not name.",
-    "- Run any tests you need, including the package's full suite (the Project Model commands below say how). The impacted tests named below are a starting hint, not a limit. The harness re-runs those checks after you stop; a pass that exists only in your reply does not count. Run Python tests as `python -m pytest <file>`, never plain `pytest` (it leaves the repo root off sys.path); never create files or symlinks in a test directory to make an import work.",
+    "- Run any tests you need, including the package's full suite (the Project Model commands below say how). The impacted tests named below are a starting hint, not a limit. The harness re-runs those checks after you stop; a pass that exists only in your reply does not count. Run tests with the exact command the Project Model lists, never a shortened variant that changes how imports resolve; never create files or symlinks in a test directory to make an import work.",
     "- Never leave a long-lived server running.",
     "- Never kill processes.",
     "- Write no documentation unless the task explicitly asks for it. Never write documentation, changelog or README text that announces a behavior the code does not have, even to make a test pass: if the task needs code that is not in this repository, finish with LOKI_SPEC_CONFLICT.",
@@ -11891,8 +11899,8 @@ var init_context = __esm(() => {
 });
 
 // ../../loki-ts/src/util/steer.ts
-import { appendFileSync as appendFileSync2, closeSync as closeSync8, constants as constants2, fstatSync as fstatSync6, readdirSync as readdirSync17, lstatSync as lstatSync11, mkdirSync as mkdirSync15, linkSync as linkSync2, openSync as openSync8, readFileSync as readFileSync34, readSync as readSync7, renameSync as renameSync11, statSync as statSync16, lutimesSync, rmSync as rmSync10, unlinkSync as unlinkSync6, writeFileSync as writeFileSync18, existsSync as existsSync27 } from "fs";
-import { createHash as createHash11, randomBytes as randomBytes4 } from "crypto";
+import { appendFileSync as appendFileSync2, closeSync as closeSync8, constants as constants2, fstatSync as fstatSync6, readdirSync as readdirSync18, lstatSync as lstatSync11, mkdirSync as mkdirSync15, linkSync as linkSync2, openSync as openSync8, readFileSync as readFileSync35, readSync as readSync7, renameSync as renameSync11, statSync as statSync16, lutimesSync, rmSync as rmSync10, unlinkSync as unlinkSync6, writeFileSync as writeFileSync18, existsSync as existsSync27 } from "fs";
+import { createHash as createHash12, randomBytes as randomBytes4 } from "crypto";
 import { basename as basename15, join as join41 } from "path";
 function archiveTo(logs, prefix, src, link = linkSync2, onLinked) {
   for (let i = 0;; i++) {
@@ -11921,7 +11929,7 @@ function orphanAlreadyArchived(logs, claim) {
   const c = lstatSync11(claim);
   if (!c.isFile())
     return false;
-  for (const a of readdirSync17(logs)) {
+  for (const a of readdirSync18(logs)) {
     if (!/^human-input-.*\.md$/.test(a))
       continue;
     try {
@@ -11937,7 +11945,7 @@ function orphanAlreadyArchived(logs, claim) {
 function sweepOrphans(logs, stamp2, unapplied, link, nowMs = Date.now()) {
   let names;
   try {
-    names = readdirSync17(logs);
+    names = readdirSync18(logs);
   } catch {
     return;
   }
@@ -12109,7 +12117,7 @@ function recordRevisions(repoDir, text2, archived, at) {
   const file = join41(repoDir, ".loki", "intent-revisions.jsonl");
   let last = 0;
   try {
-    for (const l of readFileSync34(file, "utf8").split(`
+    for (const l of readFileSync35(file, "utf8").split(`
 `)) {
       try {
         last = Math.max(last, Number(JSON.parse(l).rev) || 0);
@@ -12131,7 +12139,7 @@ function recordRevisions(repoDir, text2, archived, at) {
 `).trim();
     if (p.rev === null && body === "")
       continue;
-    const rev = p.rev !== null && p.rev > last ? p.rev : last + 1, sha2 = createHash11("sha256").update(body).digest("hex");
+    const rev = p.rev !== null && p.rev > last ? p.rev : last + 1, sha2 = createHash12("sha256").update(body).digest("hex");
     last = rev;
     recs.push({ rev, source: p.source, actor: p.actor, sha: sha2, at: at.getTime() });
     out2.push(JSON.stringify({ rev, ts: p.ts, actor: p.actor, source: p.source, chars: body.length, sha256: sha2, consumed_at: at.toISOString(), archived }));
@@ -12174,9 +12182,9 @@ var init_steer = __esm(() => {
 });
 
 // ../../loki-ts/src/util/run_outputs.ts
-import { createHash as createHash12 } from "crypto";
-import { existsSync as existsSync28, mkdirSync as mkdirSync16, readdirSync as readdirSync18, readFileSync as readFileSync35, statSync as statSync17, writeFileSync as writeFileSync19 } from "fs";
-import { join as join42, resolve as resolve16 } from "path";
+import { createHash as createHash13 } from "crypto";
+import { existsSync as existsSync28, mkdirSync as mkdirSync16, readdirSync as readdirSync19, readFileSync as readFileSync36, statSync as statSync17, writeFileSync as writeFileSync19 } from "fs";
+import { join as join42, resolve as resolve17 } from "path";
 function intentRevisionsBlock(revs) {
   const r = (revs ?? []).filter((r2) => r2.unapplied !== true).map(({ rev, source, actor, sha: sha2 }) => ({ rev, source, actor, sha: sha2 }));
   return r.length ? { intent_revisions: r } : {};
@@ -12184,11 +12192,11 @@ function intentRevisionsBlock(revs) {
 function seededCorpusBlock(env = process.env) {
   const dir = env["LOKI_SEEDED_DEFECTS_DIR"] || join42(REPO_ROOT, "benchmarks", "seeded-defects");
   try {
-    const bytes = readFileSync35(join42(dir, "manifest.json")), version2 = createHash12("sha256").update(bytes).digest("hex");
+    const bytes = readFileSync36(join42(dir, "manifest.json")), version2 = createHash13("sha256").update(bytes).digest("hex");
     const ids = (JSON.parse(bytes.toString("utf8")).defects ?? []).map((d) => d.id);
     let rate = null;
     try {
-      const res = JSON.parse(readFileSync35(join42(dir, "results", "wrong-pass.json"), "utf8"));
+      const res = JSON.parse(readFileSync36(join42(dir, "results", "wrong-pass.json"), "utf8"));
       const runs2 = res.manifest_sha256 === version2 && Array.isArray(res.runs) ? res.runs : [];
       const complete = (o) => !!o && Object.keys(o).length === ids.length && ids.every((id) => typeof id === "string" && (o[id] === "SEALED" || o[id] === "NOT_SEALED"));
       const top = runs2.filter((r) => r.setup === "top"), floor = runs2.filter((r) => r.setup === "floor");
@@ -12473,7 +12481,7 @@ var init_registry2 = __esm(() => {
 
 // ../../loki-ts/src/features/receipt_dsse.ts
 import { createPublicKey as createPublicKey3, sign as sign2, verify as verify3 } from "crypto";
-import { readFileSync as readFileSync36 } from "fs";
+import { readFileSync as readFileSync37 } from "fs";
 function pae(payloadType, body) {
   const t = Buffer.from(payloadType, "utf8");
   return Buffer.concat([Buffer.from(`DSSEv1 ${t.length} `), t, Buffer.from(` ${body.length} `), body]);
@@ -12550,7 +12558,7 @@ function verifyDsseReceipt(env, d) {
 }
 function runIdGuard(receiptPath, runId2) {
   try {
-    return envelopeRunIdProblem(JSON.parse(readFileSync36(receiptPath, "utf8")), runId2);
+    return envelopeRunIdProblem(JSON.parse(readFileSync37(receiptPath, "utf8")), runId2);
   } catch {
     return null;
   }
@@ -12609,11 +12617,11 @@ var init_run_status = __esm(() => {
 });
 
 // ../../loki-ts/src/util/seal_drift.ts
-import { createHash as createHash13 } from "crypto";
+import { createHash as createHash14 } from "crypto";
 var EMPTY_SHA;
 var init_seal_drift = __esm(() => {
   init_safe_git();
-  EMPTY_SHA = createHash13("sha256").digest("hex");
+  EMPTY_SHA = createHash14("sha256").digest("hex");
 });
 
 // ../../loki-ts/src/util/spec_file.ts
@@ -12679,7 +12687,7 @@ var init_run_cap = __esm(() => {
 });
 
 // ../../loki-ts/src/util/mutation_proof.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync17, mkdtempSync as mkdtempSync3, readFileSync as readFileSync37, rmSync as rmSync11, symlinkSync as symlinkSync2, writeFileSync as writeFileSync20 } from "fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync17, mkdtempSync as mkdtempSync3, readFileSync as readFileSync38, rmSync as rmSync11, symlinkSync as symlinkSync2, writeFileSync as writeFileSync20 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
 import { basename as basename16, dirname as dirname17, isAbsolute as isAbsolute6, join as join44, relative as relative6 } from "path";
 function mutationProof(i) {
@@ -12710,7 +12718,7 @@ function mutationProof(i) {
       if (!existsSync29(src))
         return np(`Wall file missing: ${rel}`);
       mkdirSync17(dirname17(join44(wt, rel)), { recursive: true });
-      writeFileSync20(join44(wt, rel), readFileSync37(src));
+      writeFileSync20(join44(wt, rel), readFileSync38(src));
     }
     for (const rel of rels) {
       const parts = rel.split("/").slice(0, -1);
@@ -12769,7 +12777,7 @@ var init_mutation_proof = __esm(() => {
 });
 
 // ../../loki-ts/src/util/python.ts
-import { accessSync, constants as constants3, existsSync as existsSync30, mkdtempSync as mkdtempSync4, readFileSync as readFileSync38, realpathSync as realpathSync19, rmSync as rmSync12, statSync as statSync18 } from "fs";
+import { accessSync, constants as constants3, existsSync as existsSync30, mkdtempSync as mkdtempSync4, readFileSync as readFileSync39, realpathSync as realpathSync19, rmSync as rmSync12, statSync as statSync18 } from "fs";
 import { spawnSync as spawnSync4 } from "child_process";
 import { tmpdir as tmpdir5 } from "os";
 async function findPython3() {
@@ -13126,7 +13134,7 @@ var init_wall_manifest = __esm(() => {
 });
 
 // ../../loki-ts/src/features/wall_manifest_wire.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash15 } from "crypto";
 import { basename as basename17, dirname as dirname18 } from "path";
 function blobEntries(ls) {
   const out2 = [];
@@ -13186,7 +13194,7 @@ function wallManifestFor(repoDir, tree, task, env = process.env) {
     if (at !== cat.length)
       return null;
     const text2 = buildWallManifest([...files, ...listed.map((e) => ({ path: e.path, content: "" }))], named.map((e) => e.path), matched.map((e) => e.path));
-    return { text: text2, sha256: createHash14("sha256").update(text2).digest("hex") };
+    return { text: text2, sha256: createHash15("sha256").update(text2).digest("hex") };
   } catch {
     return null;
   }
@@ -13218,8 +13226,8 @@ Example: test('name', () => { assert.strictEqual(fn(1), 2); });  Run: node --tes
 });
 
 // ../../loki-ts/src/util/holdout.ts
-import { createHash as createHash15 } from "crypto";
-import { appendFileSync as appendFileSync3, copyFileSync as copyFileSync2, existsSync as existsSync31, mkdirSync as mkdirSync18, readFileSync as readFileSync39, rmSync as rmSync13, writeFileSync as writeFileSync21 } from "fs";
+import { createHash as createHash16 } from "crypto";
+import { appendFileSync as appendFileSync3, copyFileSync as copyFileSync2, existsSync as existsSync31, mkdirSync as mkdirSync18, readFileSync as readFileSync40, rmSync as rmSync13, writeFileSync as writeFileSync21 } from "fs";
 import { tmpdir as tmpdir6 } from "os";
 import { basename as basename18, join as join45, relative as relative7 } from "path";
 function wallHoldoutRatio(env = process.env) {
@@ -13254,7 +13262,7 @@ function stashHoldout(o) {
   const files = held.map((name) => {
     copyFileSync2(join45(o.srcDir, name), join45(dir, name));
     rmSync13(join45(o.srcDir, name), { force: true });
-    return { name, runner: o.runnerOf(name), sha256: sha2(readFileSync39(join45(dir, name), "utf8")) };
+    return { name, runner: o.runnerOf(name), sha256: sha2(readFileSync40(join45(dir, name), "utf8")) };
   });
   writeFileSync21(join45(dir, MANIFEST), JSON.stringify({ targetDir: o.targetDir, files }));
   return { dir, names: new Set(held) };
@@ -13263,14 +13271,14 @@ function stageHoldout(dir, repoDir) {
   const put = [], tests = [], missing = [];
   let man = null;
   try {
-    man = JSON.parse(readFileSync39(join45(dir, MANIFEST), "utf8"));
+    man = JSON.parse(readFileSync40(join45(dir, MANIFEST), "utf8"));
   } catch {}
   if (!man)
     return { tests, missing: [`holdout store unreadable: ${basename18(dir)}`], cleanup: () => {} };
   mkdirSync18(man.targetDir, { recursive: true });
   man.files.forEach((f, i) => {
     const src = join45(dir, f.name);
-    if (!existsSync31(src) || sha2(readFileSync39(src, "utf8")) !== f.sha256) {
+    if (!existsSync31(src) || sha2(readFileSync40(src, "utf8")) !== f.sha256) {
       missing.push(`holdout ${i + 1} missing or altered`);
       return;
     }
@@ -13291,7 +13299,7 @@ function recordHoldoutTriage(runDir, entry) {
 `, { mode: 384 });
   } catch {}
 }
-var sha2 = (s) => createHash15("sha256").update(s).digest("hex"), WALL_HOLDOUT_DEFAULT_RATIO = 0.2, isHoldoutCheck = (name) => name.startsWith("holdout:"), holdoutDirFor = (runId2, repoDir) => join45(tmpdir6(), `loki-e10-holdout-${sha2(`${runId2}:${repoDir}`).slice(0, 16)}`), MANIFEST = "manifest.json", WALL_HOLDOUT_MIN = 5, HOLDOUT_TRIAGE_FILE = "holdout-triage.jsonl";
+var sha2 = (s) => createHash16("sha256").update(s).digest("hex"), WALL_HOLDOUT_DEFAULT_RATIO = 0.2, isHoldoutCheck = (name) => name.startsWith("holdout:"), holdoutDirFor = (runId2, repoDir) => join45(tmpdir6(), `loki-e10-holdout-${sha2(`${runId2}:${repoDir}`).slice(0, 16)}`), MANIFEST = "manifest.json", WALL_HOLDOUT_MIN = 5, HOLDOUT_TRIAGE_FILE = "holdout-triage.jsonl";
 var init_holdout = () => {};
 
 // ../../loki-ts/src/util/lock_ecosystems.ts
@@ -13598,7 +13606,7 @@ var init_install = __esm(() => {
 });
 
 // ../../loki-ts/src/features/runner_config.ts
-import { readFileSync as readFileSync40 } from "fs";
+import { readFileSync as readFileSync41 } from "fs";
 import { dirname as dirname19, join as join48, normalize as normalize2 } from "path";
 function tomlKey2(s, i = 0, eq2 = true) {
   const parts = [], ws = () => {
@@ -13957,7 +13965,7 @@ var PKG_KEYS, RAW_CONFIGS, RUNNER_CONFIGS, DEP_MAPS, RUNNER_DEP, LOCAL_SPEC, dep
   }
 }, headText = (dir, f) => {
   try {
-    return readFileSync40(join48(dir, f), "utf8");
+    return readFileSync41(join48(dir, f), "utf8");
   } catch {
     return "";
   }
@@ -13997,7 +14005,7 @@ var init_runner_config = __esm(() => {
 
 // ../../loki-ts/src/e10ext/assert_delta.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { mkdtempSync as mkdtempSync6, readFileSync as readFileSync41, rmSync as rmSync15 } from "fs";
+import { mkdtempSync as mkdtempSync6, readFileSync as readFileSync42, rmSync as rmSync15 } from "fs";
 import { tmpdir as tmpdir8 } from "os";
 import { join as join49 } from "path";
 import { basename as basename20 } from "path";
@@ -14040,7 +14048,7 @@ function assertDeltaNotes(repoDir, baseSha, headRef, path, task, baseCounts, hea
     return null;
   try {
     const show = (ref) => safeGit(repoDir, ["show", `${ref}:${path}`]);
-    const head = headRef ? show(headRef) : readFileSync41(join49(repoDir, path), "utf8");
+    const head = headRef ? show(headRef) : readFileSync42(join49(repoDir, path), "utf8");
     const r = classifyTestEdit(path, show(baseSha), head, task, baseCounts, headCounts);
     return r[0]?.kind === "literal-only" ? r.map((e) => `assertion value changed (not shown to be required by the task): ${e.file}:${e.line} ${e.old} -> ${e.new}`) : null;
   } catch {
@@ -14269,11 +14277,11 @@ var init_wall_owned = __esm(() => {
 
 // ../../loki-ts/src/util/app_probe.ts
 import { spawnSync as spawnSync6 } from "child_process";
-import { existsSync as existsSync32, mkdirSync as mkdirSync19, readFileSync as readFileSync42, renameSync as renameSync12, writeFileSync as writeFileSync22 } from "fs";
+import { existsSync as existsSync32, mkdirSync as mkdirSync19, readFileSync as readFileSync43, renameSync as renameSync12, writeFileSync as writeFileSync22 } from "fs";
 import { join as join51 } from "path";
 function readJson4(p) {
   try {
-    const v = JSON.parse(readFileSync42(p, "utf8"));
+    const v = JSON.parse(readFileSync43(p, "utf8"));
     return v && typeof v === "object" ? v : null;
   } catch {
     return null;
@@ -14305,7 +14313,7 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
       return { checks, pid, url };
     }
     const ir = Number(m[1]), sr = Number(m[2]), hr = Number(m[3]), noApp = m[4] === "1";
-    const pidTxt = existsSync32(join51(dir, "app.pid")) ? readFileSync42(join51(dir, "app.pid"), "utf8").trim() : "";
+    const pidTxt = existsSync32(join51(dir, "app.pid")) ? readFileSync43(join51(dir, "app.pid"), "utf8").trim() : "";
     pid = /^\d+$/.test(pidTxt) && sr >= 0 ? Number(pidTxt) : null;
     const st = readJson4(join51(dir, "state.json"));
     url = typeof st?.["url"] === "string" ? st["url"] : null;
@@ -14382,10 +14390,10 @@ app_runner_stop >/dev/null 2>&1
 });
 
 // ../../loki-ts/src/util/secure_scan.ts
-import { existsSync as existsSync33, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync7, readFileSync as readFileSync43, realpathSync as realpathSync21, rmSync as rmSync16, statSync as statSync19, writeFileSync as writeFileSync23 } from "fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync20, mkdtempSync as mkdtempSync7, readFileSync as readFileSync44, realpathSync as realpathSync21, rmSync as rmSync16, statSync as statSync19, writeFileSync as writeFileSync23 } from "fs";
 import { randomBytes as randomBytes5 } from "crypto";
 import { tmpdir as tmpdir9 } from "os";
-import { basename as basename21, dirname as dirname20, join as join52, resolve as resolve17, sep as sep12 } from "path";
+import { basename as basename21, dirname as dirname20, join as join52, resolve as resolve18, sep as sep12 } from "path";
 function fail(error) {
   return { ok: false, findings: [], error };
 }
@@ -14575,7 +14583,7 @@ async function scanAddedLines(repoDir, opts = {}) {
         continue;
       }
       const lines2 = new Map;
-      readFileSync43(join52(repoDir, p), "utf8").split(`
+      readFileSync44(join52(repoDir, p), "utf8").split(`
 `).forEach((t, i) => lines2.set(i + 1, t));
       added.set(p, lines2);
     } catch {}
@@ -14584,14 +14592,14 @@ async function scanAddedLines(repoDir, opts = {}) {
     return { ok: true, findings: skipped2 };
   const mirror = mkdtempSync7(join52(tmpdir9(), "loki-secure-added-"));
   try {
-    const root = resolve17(mirror) + sep12;
+    const root = resolve18(mirror) + sep12;
     const chunkMap = new Map;
     const chunkRoot = `.loki-chunks-${randomBytes5(6).toString("hex")}`;
     let chunkSeq = 0;
     for (const [p, lines2] of added) {
       if (lines2.size === 0)
         continue;
-      const dest = resolve17(mirror, p);
+      const dest = resolve18(mirror, p);
       if (!dest.startsWith(root))
         continue;
       let max = 0;
@@ -14629,7 +14637,7 @@ async function scanAddedLines(repoDir, opts = {}) {
       const whole = chunks.length === 1;
       for (const c of chunks) {
         const rel = whole ? p : join52(chunkRoot, String(chunkSeq++), basename21(p));
-        const out2 = whole ? dest : resolve17(mirror, rel);
+        const out2 = whole ? dest : resolve18(mirror, rel);
         if (!out2.startsWith(root))
           break;
         chunkMap.set(rel, { file: p, lines: c.orig });
@@ -14680,8 +14688,8 @@ var init_secure_scan = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/conventions.ts
-import { existsSync as existsSync34, readdirSync as readdirSync19, readFileSync as readFileSync44 } from "fs";
-import { basename as basename22, dirname as dirname21, isAbsolute as isAbsolute9, join as join53, relative as relative10, resolve as resolve18 } from "path";
+import { existsSync as existsSync34, readdirSync as readdirSync20, readFileSync as readFileSync45 } from "fs";
+import { basename as basename22, dirname as dirname21, isAbsolute as isAbsolute9, join as join53, relative as relative10, resolve as resolve19 } from "path";
 function parseJsonc(text2) {
   let out2 = "", i = 0;
   while (i < text2.length) {
@@ -14722,7 +14730,7 @@ function moduleOf(file, depth = 0) {
 function readPackageConventions(pkgDir, runner = null) {
   let names = [];
   try {
-    names = readdirSync19(pkgDir).filter((f) => f.endsWith(".json")).sort((x, y) => x.length - y.length || x.localeCompare(y));
+    names = readdirSync20(pkgDir).filter((f) => f.endsWith(".json")).sort((x, y) => x.length - y.length || x.localeCompare(y));
   } catch {
     return null;
   }
@@ -14776,7 +14784,7 @@ function nearestPackageRoot(testDir, repoDir, fileName) {
     return siteFor(api, repoDir, relative10(repoDir, join53(testDir, fileName)))?.cwd ?? repoDir;
   const shaped = (d) => {
     try {
-      return readdirSync19(d).some((f) => {
+      return readdirSync20(d).some((f) => {
         if (!f.endsWith(".json"))
           return false;
         const j = readJson5(join53(d, f));
@@ -14858,7 +14866,7 @@ function phantomRepoPaths(content, fileName, testDir, repoDir, planText) {
         return join53(testDir, "__self__");
       const url = /^fileURLToPath\(new URL\((["'])([^"']*)\1\s*,\s*import\.meta\.url\)\)$/.exec(e);
       if (url)
-        return resolve18(testDir, url[2]);
+        return resolve19(testDir, url[2]);
       const lit = /^(["'`])((?:\\.|(?!\1)[^\\])*)\1$/.exec(e);
       if (lit)
         return lit[2].includes("${") ? null : lit[2];
@@ -14872,7 +14880,7 @@ function phantomRepoPaths(content, fileName, testDir, repoDir, planText) {
         return null;
       if (call[1] === "dirname")
         return dirname21(args[0]);
-      const out2 = resolve18(...args);
+      const out2 = resolve19(...args);
       const first = parts.slice(1).map((a) => /^\s*["'`]([^"'`]*)["'`]\s*$/.exec(a)?.[1]).find((x) => x), viaWalk = !!first && walk.has(parts[0].trim()) && [pkg, repoDir].some((d) => existsSync34(join53(d, first.split("/").filter(Boolean)[0] ?? "\x00")));
       if (report && (viaWalk || !parts.some((a) => walk.has(a.trim()) || taint.has(a.trim())) && (relative10(testDir, out2).startsWith("..") || strayInTestDir(out2))) && parts.some((a) => /^\s*["'`]/.test(a)))
         reports.set(`${ln}|${e}`, { out: out2, rel: relative10(repoDir, out2), tail: viaWalk ? join53(...args.slice(1)) : undefined });
@@ -14975,7 +14983,7 @@ function phantomReason(miss, repoFiles, testDir = "", pkgRoot = "") {
 }
 var readJson5 = (p) => {
   try {
-    const v = parseJsonc(readFileSync44(p, "utf8"));
+    const v = parseJsonc(readFileSync45(p, "utf8"));
     return v && typeof v === "object" && !Array.isArray(v) ? v : null;
   } catch {
     return null;
@@ -14997,6 +15005,23 @@ var init_version = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/preexisting_dirty.ts
+function untouchedSinceIntake(repoDir, recorded, env = process.env) {
+  if (!recorded || typeof recorded !== "object")
+    return [];
+  return Object.entries(recorded).filter(([p, h]) => {
+    try {
+      return blob2(repoDir, p, env) === h;
+    } catch {
+      return false;
+    }
+  }).map(([p]) => p);
+}
+var blob2 = (repoDir, path, env = process.env) => safeGit(repoDir, ["hash-object", "-w", "--no-filters", "--", path], { env }).trim();
+var init_preexisting_dirty = __esm(() => {
+  init_safe_git();
+});
+
+// ../../loki-ts/src/features/untouched_untracked.ts
 import { lstatSync as lstatSync12 } from "fs";
 import { join as join54 } from "path";
 function untouchedUntracked(repoDir, recorded, env = process.env) {
@@ -15016,20 +15041,8 @@ function untouchedUntracked(repoDir, recorded, env = process.env) {
     }
   }).map(([p]) => p);
 }
-function untouchedSinceIntake(repoDir, recorded, env = process.env) {
-  if (!recorded || typeof recorded !== "object")
-    return [];
-  return Object.entries(recorded).filter(([p, h]) => {
-    try {
-      return blob2(repoDir, p, env) === h;
-    } catch {
-      return false;
-    }
-  }).map(([p]) => p);
-}
-var blob2 = (repoDir, path, env = process.env) => safeGit(repoDir, ["hash-object", "-w", "--no-filters", "--", path], { env }).trim();
-var init_preexisting_dirty = __esm(() => {
-  init_safe_git();
+var init_untouched_untracked = __esm(() => {
+  init_preexisting_dirty();
 });
 
 // ../../loki-ts/src/e10ext/commit_filter.ts
@@ -15041,6 +15054,7 @@ function dropSet(repoDir, staged, preexistingDirty, env = process.env, installCr
 var WALL_FILE, parseStaged = (out2) => out2.split("\x00").reduce((a, t, i, all) => i % 2 === 0 && t ? [...a, { st: t, f: all[i + 1] }] : a, []), formatChanged = (repoDir, staged, dropped2, env = process.env) => runFormatters(repoDir, staged.filter(({ st, f }) => (st === "A" || st === "M") && !dropped2.has(f) && !f.startsWith(".loki/")).map(({ f }) => f), tokenFreeEnv(env));
 var init_commit_filter = __esm(() => {
   init_preexisting_dirty();
+  init_untouched_untracked();
   init_install();
   init_repo_profile();
   init_safe_git();
@@ -15142,8 +15156,8 @@ var init_route_block = __esm(() => {
 
 // ../../loki-ts/src/features/visual_evidence.ts
 import { spawn as spawn8 } from "child_process";
-import { createHash as createHash16, randomBytes as randomBytes6 } from "crypto";
-import { existsSync as existsSync35, lstatSync as lstatSync13, mkdirSync as mkdirSync21, readdirSync as readdirSync20, readFileSync as readFileSync45, writeFileSync as writeFileSync24 } from "fs";
+import { createHash as createHash17, randomBytes as randomBytes6 } from "crypto";
+import { existsSync as existsSync35, lstatSync as lstatSync13, mkdirSync as mkdirSync21, readdirSync as readdirSync21, readFileSync as readFileSync46, writeFileSync as writeFileSync24 } from "fs";
 import { createServer } from "net";
 import { dirname as dirname23, isAbsolute as isAbsolute10, join as join55, normalize as normalize3, relative as relative11, sep as sep13 } from "path";
 function routeFor(file) {
@@ -15222,7 +15236,7 @@ function openapiPaths(repoDir) {
     if (!existsSync35(p))
       continue;
     try {
-      const txt = readFileSync45(p, "utf8");
+      const txt = readFileSync46(p, "utf8");
       const paths = f.endsWith(".json") ? Object.keys(JSON.parse(txt).paths ?? {}) : [...txt.matchAll(/^ {2}(\/[^\s:]*):\s*$/gm)].map((m) => m[1]);
       return paths.filter((x) => !x.includes("{")).slice(0, 10);
     } catch {
@@ -15245,7 +15259,7 @@ async function recordE2eMedia(repoDir, runDir, relDir, base, routes, ms, signal)
       return { rels: [], skipped: "playwright e2e video and trace skipped: the run failed or timed out" };
     const rels = [];
     const walk = (d) => {
-      for (const e of readdirSync20(d, { withFileTypes: true })) {
+      for (const e of readdirSync21(d, { withFileTypes: true })) {
         const full = join55(d, e.name);
         if (e.isDirectory())
           walk(full);
@@ -15340,14 +15354,14 @@ async function captureVisualEvidence(repoDir, runDir, changed, opts = {}) {
         const subs = ["backend", "frontend"].filter((d) => existsSync35(join55(repoDir, d, "package.json")));
         const has2 = (d) => {
           try {
-            return pickScript(JSON.parse(readFileSync45(join55(repoDir, d, "package.json"), "utf8"))) !== null;
+            return pickScript(JSON.parse(readFileSync46(join55(repoDir, d, "package.json"), "utf8"))) !== null;
           } catch {
             return false;
           }
         };
         return skip(noRootReason(subs, subs.filter((d) => !has2(d))));
       }
-      script = pickScript(JSON.parse(readFileSync45(pkgPath, "utf8")));
+      script = pickScript(JSON.parse(readFileSync46(pkgPath, "utf8")));
       if (!script)
         return skip("no dev, preview or start script");
     }
@@ -15444,7 +15458,7 @@ function receiptScreensProblem(receiptPath, receipt) {
     return `visual evidence failed (LOKI_VISUAL_GATE=1): ${receipt["evidence_failed"]}`;
   return receipt["evidence_screens"] === undefined ? null : checkScreens(dirname23(receiptPath), receipt["evidence_screens"]);
 }
-var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash16("sha256").update(readFileSync45(p)).digest("hex"), playwrightBin = (repoDir) => {
+var visualEvidenceEnabled = (env = process.env) => env["LOKI_VISUAL_EVIDENCE"] !== "0", visualGateEnabled = (env = process.env) => env["LOKI_VISUAL_GATE"] === "1", PAGE_RE, isPageFile = (p) => PAGE_RE.test(p), screenName = (route) => (route === "/" ? "index" : route.slice(1).replace(/[^A-Za-z0-9._-]+/g, "_")) || "index", sha256File = (p) => createHash17("sha256").update(readFileSync46(p)).digest("hex"), playwrightBin = (repoDir) => {
   const bin = join55(repoDir, "node_modules", ".bin", "playwright");
   return existsSync35(bin) ? bin : null;
 }, playwrightTestPkg = (repoDir) => {
@@ -15522,15 +15536,15 @@ var init_pr = __esm(() => {
 });
 
 // ../../loki-ts/src/util/pr_lessons.ts
-import { existsSync as existsSync36, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync8, readFileSync as readFileSync46, rmSync as rmSync17, writeFileSync as writeFileSync25 } from "fs";
+import { existsSync as existsSync36, mkdirSync as mkdirSync22, mkdtempSync as mkdtempSync8, readFileSync as readFileSync47, rmSync as rmSync17, writeFileSync as writeFileSync25 } from "fs";
 import { dirname as dirname24, join as join57 } from "path";
-import { createHash as createHash17 } from "crypto";
+import { createHash as createHash18 } from "crypto";
 function loadLessons(repoDir) {
   const p = lessonsPath(repoDir);
   if (!existsSync36(p))
     return [];
   try {
-    const j = JSON.parse(readFileSync46(p, "utf-8"));
+    const j = JSON.parse(readFileSync47(p, "utf-8"));
     return Array.isArray(j.lessons) ? j.lessons : [];
   } catch {
     return [];
@@ -15542,7 +15556,7 @@ function save(repoDir, lessons) {
   atomicWriteJson(p, { version: 2, lessons });
 }
 function appendReceiptFact(repoDir, f, now2 = () => new Date) {
-  const id = `rcp-${createHash17("sha256").update(f.runId).digest("hex").slice(0, 12)}`;
+  const id = `rcp-${createHash18("sha256").update(f.runId).digest("hex").slice(0, 12)}`;
   const lessons = loadLessons(repoDir);
   if (lessons.some((l) => l.id === id))
     return false;
@@ -15596,14 +15610,14 @@ var init_attempts = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/route_record.ts
-import { existsSync as existsSync37, lstatSync as lstatSync14, mkdirSync as mkdirSync23, readFileSync as readFileSync47, writeFileSync as writeFileSync26 } from "fs";
+import { existsSync as existsSync37, lstatSync as lstatSync14, mkdirSync as mkdirSync23, readFileSync as readFileSync48, writeFileSync as writeFileSync26 } from "fs";
 import { join as join58 } from "path";
 function loadRouteRecord(runDir) {
   try {
     const p = join58(runDir, ROUTE_RECORD_FILE);
     if (!existsSync37(p) || !lstatSync14(p).isFile())
       return;
-    const v = JSON.parse(readFileSync47(p, "utf8"));
+    const v = JSON.parse(readFileSync48(p, "utf8"));
     return typeof v === "object" && v !== null && !Array.isArray(v) ? v : undefined;
   } catch {
     return;
@@ -16026,7 +16040,7 @@ var init_deep = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/verify.ts
-import { existsSync as existsSync39, mkdtempSync as mkdtempSync10, readFileSync as readFileSync48, rmSync as rmSync19 } from "fs";
+import { existsSync as existsSync39, mkdtempSync as mkdtempSync10, readFileSync as readFileSync49, rmSync as rmSync19 } from "fs";
 import { tmpdir as tmpdir11 } from "os";
 import { basename as basename23, isAbsolute as isAbsolute11, join as join60, relative as relative12 } from "path";
 async function runOnce2(cmd2, args, cwd, signal, opts) {
@@ -16149,7 +16163,7 @@ function projectDeclaresRuff(repoDir) {
   const files = ["pyproject.toml", "setup.cfg", "tox.ini", ".pre-commit-config.yaml", "Pipfile", "requirements.txt", "requirements-dev.txt", "dev-requirements.txt"];
   return files.some((f) => {
     try {
-      return /\bruff\b/i.test(readFileSync48(join60(repoDir, f), "utf8"));
+      return /\bruff\b/i.test(readFileSync49(join60(repoDir, f), "utf8"));
     } catch {
       return false;
     }
@@ -16375,7 +16389,7 @@ ${x}` : c.cmd };
 
 // ../../loki-ts/src/engine10/stages/wall.ts
 import { spawnSync as spawnSync7 } from "child_process";
-import { existsSync as existsSync40, mkdirSync as mkdirSync25, mkdtempSync as mkdtempSync11, readFileSync as readFileSync49, readdirSync as readdirSync21, rmSync as rmSync20, writeFileSync as writeFileSync28 } from "fs";
+import { existsSync as existsSync40, mkdirSync as mkdirSync25, mkdtempSync as mkdtempSync11, readFileSync as readFileSync50, readdirSync as readdirSync22, rmSync as rmSync20, writeFileSync as writeFileSync28 } from "fs";
 import { tmpdir as tmpdir12 } from "os";
 import { dirname as dirname26, join as join61, relative as relative13 } from "path";
 
@@ -16445,7 +16459,7 @@ function loadTaskText(ctx, fromPrior) {
   const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join61(ctx.runDir, "issue.json");
   if (existsSync40(issueJsonPath)) {
     try {
-      const issue = JSON.parse(readFileSync49(issueJsonPath, "utf8"));
+      const issue = JSON.parse(readFileSync50(issueJsonPath, "utf8"));
       const text2 = [issue.title, issue.body].filter((s) => typeof s === "string" && s.length > 0).join(`
 
 `);
@@ -16504,21 +16518,21 @@ async function wallAuthor(ctx, signal, retry) {
     return done({ status: "failed", data: { iteration_ids: [iterationId], model }, reason: "wall session aborted, killed, or timed out", killed: true });
   }
   const planText = typeof prior.plan?.plan === "string" ? prior.plan.plan : null, repoFiles = repoMap?.files ?? [];
-  const oor = () => readdirSync21(cwd).filter((f) => f.startsWith(WALL_PREFIX)).flatMap((name) => {
-    const text2 = readFileSync49(join61(cwd, name), "utf8"), why = outOfRepoTarget(text2) ?? phantomReason(phantomRepoPaths(text2, name, targetDir, ctx.repoDir, planText), repoFiles, relative13(ctx.repoDir, targetDir), pkg?.root ?? "");
+  const oor = () => readdirSync22(cwd).filter((f) => f.startsWith(WALL_PREFIX)).flatMap((name) => {
+    const text2 = readFileSync50(join61(cwd, name), "utf8"), why = outOfRepoTarget(text2) ?? phantomReason(phantomRepoPaths(text2, name, targetDir, ctx.repoDir, planText), repoFiles, relative13(ctx.repoDir, targetDir), pkg?.root ?? "");
     return why ? [{ name, why }] : [];
   });
   const bad1 = oor();
   if (bad1.length > 0 && !signal.aborted && !ctx.overCap?.())
     await ctx.sessions.run({ stage: "wall", brief: withStagePrefix(outOfRepoReask("Rewrite these Wall files in place, keeping the same names and acceptance coverage.", bad1)), tier: "development", model, iterationId: `${iterationId}-oor`, limitS: wallLimitS(sz.size), signal, cwd });
-  const oorBad = new Map(oor().map((b) => [b.name, b.why])), all = readdirSync21(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !oorBad.has(n2) && !conventionViolation(conv2, n2, readFileSync49(join61(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
+  const oorBad = new Map(oor().map((b) => [b.name, b.why])), all = readdirSync22(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n2) => !oorBad.has(n2) && !conventionViolation(conv2, n2, readFileSync50(join61(cwd, n2), "utf8"))), runnerOf: (n2) => guessRunner(n2, runners) }), generated = all.filter((n2) => !held?.names.has(n2));
   const sealedDir = join61(ctx.runDir, "wall");
   if (generated.length > 0)
     mkdirSync25(sealedDir, { recursive: true });
   const contents = new Map;
   const discarded = [];
   for (const name of generated) {
-    const content = readFileSync49(join61(cwd, name), "utf8"), oorWhy = oorBad.get(name), bad = oorWhy ?? conventionViolation(conv2, name, content);
+    const content = readFileSync50(join61(cwd, name), "utf8"), oorWhy = oorBad.get(name), bad = oorWhy ?? conventionViolation(conv2, name, content);
     writeFileSync28(join61(sealedDir, name), content, "utf8");
     if (oorWhy)
       discarded.push({ file: name, reason: `${oorWhy}; wall test discarded after one rewrite request` });
@@ -16642,7 +16656,7 @@ var init_wall = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/discard.ts
-import { chmodSync as chmodSync6, closeSync as closeSync9, lstatSync as lstatSync16, mkdirSync as mkdirSync26, openSync as openSync9, readFileSync as readFileSync50, realpathSync as realpathSync23, rmdirSync, unlinkSync as unlinkSync7, writeFileSync as writeFileSync29 } from "fs";
+import { chmodSync as chmodSync6, closeSync as closeSync9, lstatSync as lstatSync16, mkdirSync as mkdirSync26, openSync as openSync9, readFileSync as readFileSync51, realpathSync as realpathSync23, rmdirSync, unlinkSync as unlinkSync7, writeFileSync as writeFileSync29 } from "fs";
 import { dirname as dirname27, join as join62, relative as relative14, sep as sep14 } from "path";
 function safeRestore(repoDir, f, want, mode) {
   const root = realpathSync23(repoDir), fp = join62(root, f), rel = relative14(root, dirname27(fp));
@@ -16667,7 +16681,7 @@ function safeRestore(repoDir, f, want, mode) {
   } catch {
     st = null;
   }
-  if (st?.isFile() && readFileSync50(fp).equals(want)) {
+  if (st?.isFile() && readFileSync51(fp).equals(want)) {
     chmodSync6(fp, mode);
     return;
   }
@@ -16769,14 +16783,14 @@ var init_scope2 = __esm(() => {
 });
 
 // ../../loki-ts/src/council/role_agents.ts
-import { existsSync as existsSync41, readdirSync as readdirSync22, readFileSync as readFileSync51 } from "fs";
+import { existsSync as existsSync41, readdirSync as readdirSync23, readFileSync as readFileSync52 } from "fs";
 import { homedir as homedir9 } from "os";
 import { join as join63 } from "path";
 function agentDirs(repoDir, env = process.env) {
   return [env["LOKI_AGENTS_PROJECT_DIR"] || join63(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join63(env["XDG_CONFIG_HOME"] || join63(homedir9(), ".config"), "loki", "agents")];
 }
 function parseAgent(file, stem2) {
-  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync51(file, "utf8"));
+  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync52(file, "utf8"));
   if (!m)
     return null;
   const body = m[2].trim();
@@ -16794,7 +16808,7 @@ function loadRoleAgent(repoDir, role, env = process.env) {
       continue;
     let names;
     try {
-      names = readdirSync22(d).filter((n2) => n2.endsWith(".md") && !n2.startsWith(".")).sort();
+      names = readdirSync23(d).filter((n2) => n2.endsWith(".md") && !n2.startsWith(".")).sort();
     } catch {
       continue;
     }
@@ -16896,14 +16910,14 @@ var init_colors = __esm(() => {
 });
 
 // ../../loki-ts/src/util/run_summary.ts
-import { existsSync as existsSync42, mkdirSync as mkdirSync28, readFileSync as readFileSync52, renameSync as renameSync13, statSync as statSync20, writeFileSync as writeFileSync30 } from "fs";
+import { existsSync as existsSync42, mkdirSync as mkdirSync28, readFileSync as readFileSync53, renameSync as renameSync13, statSync as statSync20, writeFileSync as writeFileSync30 } from "fs";
 import { join as join65 } from "path";
 function readRiskRecord(repoDir, sinceMs = 0) {
   try {
     const p = join65(repoDir, ".loki", "state", "risk-tier.json");
     if (statSync20(p).mtimeMs < sinceMs)
       return null;
-    const r = JSON.parse(readFileSync52(p, "utf8"));
+    const r = JSON.parse(readFileSync53(p, "utf8"));
     return r && typeof r === "object" ? r : null;
   } catch {
     return null;
@@ -16919,7 +16933,7 @@ var init_run_summary = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/xreview.ts
-import { existsSync as existsSync43, readFileSync as readFileSync53 } from "fs";
+import { existsSync as existsSync43, readFileSync as readFileSync54 } from "fs";
 import { join as join66 } from "path";
 function minVerdict(verdict, review) {
   const ceiling = review?.level === "block" ? "PARTIAL" : verdict;
@@ -16937,7 +16951,7 @@ function explicitReview(repoDir, env) {
     if (!existsSync43(p))
       continue;
     try {
-      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync53(p, "utf8"));
+      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync54(p, "utf8"));
       const v = asProvider(m?.[1]);
       if (v)
         return v;
@@ -17132,9 +17146,9 @@ See also: loki cost --detail (what a run ALREADY spent)
 });
 
 // ../../loki-ts/src/features/contract.ts
-import { existsSync as existsSync44, lstatSync as lstatSync17, mkdirSync as mkdirSync29, readFileSync as readFileSync54, rmSync as rmSync21, writeFileSync as writeFileSync31 } from "fs";
+import { existsSync as existsSync44, lstatSync as lstatSync17, mkdirSync as mkdirSync29, readFileSync as readFileSync55, rmSync as rmSync21, writeFileSync as writeFileSync31 } from "fs";
 import { dirname as dirname29, join as join67 } from "path";
-import { createHash as createHash18 } from "crypto";
+import { createHash as createHash19 } from "crypto";
 function contractEnabled(env = process.env) {
   return env["LOKI_CONTRACT"] !== "0";
 }
@@ -17181,11 +17195,11 @@ function readContract(repoDir) {
     return { contract: null, notes: ["contract unreadable: too large"], sha256: null };
   let raw2;
   try {
-    raw2 = readFileSync54(p);
+    raw2 = readFileSync55(p);
   } catch {
     return { contract: null, notes: ["contract unreadable: read failed"], sha256: null };
   }
-  const sha2563 = createHash18("sha256").update(raw2).digest("hex");
+  const sha2563 = createHash19("sha256").update(raw2).digest("hex");
   let j;
   try {
     j = JSON.parse(raw2.toString("utf8"));
@@ -17255,8 +17269,8 @@ var init_contract = __esm(() => {
 });
 
 // ../../loki-ts/src/features/speed/seal_group.ts
-import { createHash as createHash19 } from "crypto";
-import { existsSync as existsSync45, mkdirSync as mkdirSync30, readdirSync as readdirSync23, readFileSync as readFileSync55, renameSync as renameSync14, statSync as statSync21, writeFileSync as writeFileSync32 } from "fs";
+import { createHash as createHash20 } from "crypto";
+import { existsSync as existsSync45, mkdirSync as mkdirSync30, readdirSync as readdirSync24, readFileSync as readFileSync56, renameSync as renameSync14, statSync as statSync21, writeFileSync as writeFileSync32 } from "fs";
 import { dirname as dirname30, join as join68 } from "path";
 function sealGroup(runDir, rh) {
   const manifestPath = join68(runDir, "group", "manifest.json");
@@ -17287,7 +17301,7 @@ function sealGroup(runDir, rh) {
     const dir = join68(unitsDir(runDir), id), rp = join68(dir, "receipt.json"), ep = join68(dir, "events.jsonl");
     let bytes;
     try {
-      bytes = readFileSync55(rp);
+      bytes = readFileSync56(rp);
     } catch {
       return fail2(`unit ${id} sub-receipt missing`);
     }
@@ -17304,7 +17318,7 @@ function sealGroup(runDir, rh) {
       unit_id: id,
       sub_receipt_sha256: sha3(bytes),
       receipt_sha256: sub2["receipt_sha256"],
-      events_file_sha256: existsSync45(ep) ? sha3(readFileSync55(ep)) : null,
+      events_file_sha256: existsSync45(ep) ? sha3(readFileSync56(ep)) : null,
       verdict,
       goal: text2(u["goal"], 200),
       files: (Array.isArray(u["files"]) ? u["files"] : []).map((f) => text2(f, 200)).filter(Boolean).slice(0, 50),
@@ -17348,13 +17362,13 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
     try {
       if (!statSync21(dir).isDirectory())
         return bad(`unit ${id} is not a directory`);
-      bytes = readFileSync55(rp);
+      bytes = readFileSync56(rp);
     } catch {
       return bad(`unit ${id} sub-receipt missing`);
     }
     if (sha3(bytes) !== e["sub_receipt_sha256"])
       return bad(`unit ${id} sub-receipt does not match its recorded hash`);
-    const evSha = existsSync45(ep) ? sha3(readFileSync55(ep)) : null;
+    const evSha = existsSync45(ep) ? sha3(readFileSync56(ep)) : null;
     if (evSha !== (e["events_file_sha256"] ?? null))
       return bad(`unit ${id} events.jsonl does not match its recorded hash`);
     const sub2 = readJson6(rp);
@@ -17377,15 +17391,15 @@ function compositeVerdict(childVerdicts) {
   const failed2 = childVerdicts.filter((v) => v === "FAILED" || !["VERIFIED", "ALREADY_SATISFIED", "PARTIAL", "SPEC_CONFLICT"].includes(v)).length;
   return capGroupVerdict(base, { section: undefined, notProven: [], problems: failed2, allUnitsPass: childVerdicts.every((v) => PASSING.has(v)) });
 }
-var ID_RE, PASSING, sha3 = (b) => createHash19("sha256").update(b).digest("hex"), isObj10 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), text2 = (v, cap) => typeof v === "string" ? v.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0, unitsDir = (runDir) => join68(runDir, "group", "units"), readJson6 = (p) => {
+var ID_RE, PASSING, sha3 = (b) => createHash20("sha256").update(b).digest("hex"), isObj10 = (v) => v !== null && typeof v === "object" && !Array.isArray(v), text2 = (v, cap) => typeof v === "string" ? v.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v) => typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : 0, unitsDir = (runDir) => join68(runDir, "group", "units"), readJson6 = (p) => {
   try {
-    return JSON.parse(readFileSync55(p, "utf8"));
+    return JSON.parse(readFileSync56(p, "utf8"));
   } catch {
     return;
   }
 }, dirNames = (d) => {
   try {
-    return readdirSync23(d).filter((n3) => !n3.startsWith(".")).sort();
+    return readdirSync24(d).filter((n3) => !n3.startsWith(".")).sort();
   } catch {
     return null;
   }
@@ -17397,7 +17411,7 @@ var init_seal_group = __esm(() => {
 });
 
 // ../../loki-ts/src/supply/supply_guard.ts
-import { existsSync as existsSync46, readFileSync as readFileSync56, statSync as statSync22 } from "fs";
+import { existsSync as existsSync46, readFileSync as readFileSync57, statSync as statSync22 } from "fs";
 import { basename as basename25, join as join69 } from "path";
 function supplyEnabled(env) {
   return env["LOKI_SUPPLY_GUARD"] !== "0";
@@ -17419,7 +17433,7 @@ function readDeclared(repoDir) {
   try {
     if (statSync22(p).size > MAX_FILE_BYTES)
       return { deps: [], problem: "declaration file too large" };
-    const j = JSON.parse(readFileSync56(p, "utf8"));
+    const j = JSON.parse(readFileSync57(p, "utf8"));
     if (!Array.isArray(j))
       return { deps: [], problem: "declaration is not a JSON array" };
     const deps = [];
@@ -17443,7 +17457,7 @@ function readAllowlist(repoDir) {
   if (!existsSync46(p))
     return new Set;
   try {
-    return new Set(readFileSync56(p, "utf8").split(`
+    return new Set(readFileSync57(p, "utf8").split(`
 `).map((l) => l.replace(/#.*$/, "").trim()).filter(Boolean));
   } catch {
     return new Set;
@@ -17626,7 +17640,7 @@ var MIN_AGE_DAYS = 7, DECLARED_FILE = "supply-declared.json", MAX_CHECKED = 50,
   }
 }, PUBLIC_HOSTS, hostOf = (u) => u.trim().toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^www\./, "").split(/[/?#\s]/)[0].replace(/^[^@]*@/, "").replace(/:\d+$/, ""), privateUrl = (u) => /[a-z0-9]/i.test(u) && !PUBLIC_HOSTS.has(hostOf(u)), readSmall = (p) => {
   try {
-    return statSync22(p).size <= MAX_FILE_BYTES ? readFileSync56(p, "utf8") : "";
+    return statSync22(p).size <= MAX_FILE_BYTES ? readFileSync57(p, "utf8") : "";
   } catch {
     return "";
   }
@@ -17641,8 +17655,8 @@ var init_supply_guard = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/seal.ts
-import { createHash as createHash20 } from "crypto";
-import { existsSync as existsSync47, readdirSync as readdirSync24, mkdirSync as mkdirSync31, readFileSync as readFileSync57 } from "fs";
+import { createHash as createHash21 } from "crypto";
+import { existsSync as existsSync47, readdirSync as readdirSync25, mkdirSync as mkdirSync31, readFileSync as readFileSync58 } from "fs";
 import { basename as basename26, isAbsolute as isAbsolute13, join as join70, relative as relative15 } from "path";
 async function leanSymbolGap(ctx, o, rawDiff, head, vraw) {
   if (externalRun(o) || Array.isArray(o.wall?.files) && o.wall.files.length > 0 || o.intake?.already_satisfied === true || o.implement?.exit === "already_done")
@@ -17664,7 +17678,7 @@ async function leanSymbolGap(ctx, o, rawDiff, head, vraw) {
       const n3 = String(c.name ?? ""), p = n3.slice(n3.indexOf(":") + 1);
       if (n3.includes(":") && isTestFile(p))
         try {
-          sources2.push(readFileSync57(join70(ctx.repoDir, p), "utf8"));
+          sources2.push(readFileSync58(join70(ctx.repoDir, p), "utf8"));
         } catch {}
     }
   return symbolGap(changedSymbols(d.stdout), sources2);
@@ -17746,7 +17760,7 @@ function renderReceiptMd(r) {
   ].join(`
 `);
 }
-var SIGNING_UNAVAILABLE = "receipt signing unavailable (no usable signing key: invalid key or unwritable ~/.loki/keys)", AGENT_ONLY_REASON = "only agent-authored tests executed (no agent-independent proof)", WALL_GREEN_ON_BASE_REASON = "Wall green on base: no Wall test discriminates the change", EXCLUDE_LOKI = ":(exclude).loki", sha2562 = (s) => createHash20("sha256").update(s).digest("hex"), str4 = (v) => typeof v === "string" && v !== "" ? v : null, EXTERNAL_MODEL_LABEL = "external (no Loki implement session)", EXTERNAL_DIFF_NOT_ISOLATED = "Wall author not filesystem-isolated from the external diff", EXTERNAL_NO_WALL = "external diff sealed with no Wall file that ran; the only checks are the repo's existing tests", externalRun = (o) => o.implement?.exit === "external", LEAN_NO_SYMBOL = "no passing check references a changed symbol and no Wall file ran", strs2 = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x !== "") : [], g = (ctx) => (a) => git4(ctx, a), receiptRel = (ctx) => {
+var SIGNING_UNAVAILABLE = "receipt signing unavailable (no usable signing key: invalid key or unwritable ~/.loki/keys)", AGENT_ONLY_REASON = "only agent-authored tests executed (no agent-independent proof)", WALL_GREEN_ON_BASE_REASON = "Wall green on base: no Wall test discriminates the change", EXCLUDE_LOKI = ":(exclude).loki", sha2562 = (s) => createHash21("sha256").update(s).digest("hex"), str4 = (v) => typeof v === "string" && v !== "" ? v : null, EXTERNAL_MODEL_LABEL = "external (no Loki implement session)", EXTERNAL_DIFF_NOT_ISOLATED = "Wall author not filesystem-isolated from the external diff", EXTERNAL_NO_WALL = "external diff sealed with no Wall file that ran; the only checks are the repo's existing tests", externalRun = (o) => o.implement?.exit === "external", LEAN_NO_SYMBOL = "no passing check references a changed symbol and no Wall file ran", strs2 = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x !== "") : [], g = (ctx) => (a) => git4(ctx, a), receiptRel = (ctx) => {
   const r = relative15(ctx.repoDir, join70(ctx.runDir, "receipt.json"));
   return r.startsWith("..") || isAbsolute13(r) ? `.loki/runs/${ctx.runId}/receipt.json` : r;
 }, commitStage, wallGreenOnBaseOf = (o) => {
@@ -17880,7 +17894,7 @@ var init_seal = __esm(() => {
       if (wallNotRun > 0) {
         try {
           const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename26(String(f.path))));
-          for (const n3 of readdirSync24(join70(ctx.runDir, "wall")).sort())
+          for (const n3 of readdirSync25(join70(ctx.runDir, "wall")).sort())
             if (!kept.has(n3))
               notProven.add(`wall test discarded: ${n3} (not_run)`);
         } catch {}
@@ -18006,7 +18020,7 @@ var init_seal = __esm(() => {
         model: externalRun(o) ? EXTERNAL_MODEL_LABEL : ctx.model,
         ...externalRun(o) ? { implement: { exit: "external", patch_sha256: str4(o.implement?.patch_sha256) ?? "" } } : {},
         resumed: o.intake?.resumed === true,
-        events_sha256: sha2562(existsSync47(eventsPath) ? readFileSync57(eventsPath) : ""),
+        events_sha256: sha2562(existsSync47(eventsPath) ? readFileSync58(eventsPath) : ""),
         ...await sealEvidence(ctx.repoDir, ctx.runDir, o, notProven, signal, ctx.emit),
         log_seal: true,
         toolchain: collectToolchain(),
@@ -18062,14 +18076,14 @@ var init_seal = __esm(() => {
 });
 
 // ../../loki-ts/src/util/composite_seal.ts
-import { existsSync as existsSync48, readFileSync as readFileSync58 } from "fs";
+import { existsSync as existsSync48, readFileSync as readFileSync59 } from "fs";
 import { basename as basename27, dirname as dirname32, join as join71 } from "path";
 function logProblem(runDir, integ) {
   if (typeof integ["log_sha256"] !== "string")
     return null;
   let b;
   try {
-    b = readFileSync58(join71(runDir, "integration.log"));
+    b = readFileSync59(join71(runDir, "integration.log"));
   } catch {
     return "integration.log is missing but integration.json records its hash";
   }
@@ -18092,7 +18106,7 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
     return bad("body malformed");
   let ibytes;
   try {
-    ibytes = readFileSync58(join71(runDir, "integration.json"));
+    ibytes = readFileSync59(join71(runDir, "integration.json"));
   } catch {
     return bad("integration.json missing");
   }
@@ -18136,7 +18150,7 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
     const rp = join71(runDir, rel);
     let bytes;
     try {
-      bytes = readFileSync58(rp);
+      bytes = readFileSync59(rp);
     } catch {
       return bad(`child ${repo} receipt missing`);
     }
@@ -18185,16 +18199,16 @@ var init_keys_cmd = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/verify_cmd.ts
-import { existsSync as existsSync49, readFileSync as readFileSync59, renameSync as renameSync15, statSync as statSync24, writeFileSync as writeFileSync34 } from "fs";
+import { existsSync as existsSync49, readFileSync as readFileSync60, renameSync as renameSync15, statSync as statSync24, writeFileSync as writeFileSync34 } from "fs";
 import { basename as basename28, dirname as dirname33, join as join72 } from "path";
-import { createHash as createHash21, createPublicKey as createPublicKey4, verify as verify4 } from "crypto";
+import { createHash as createHash22, createPublicKey as createPublicKey4, verify as verify4 } from "crypto";
 function pubFor(kid, given) {
   if (given)
     return kidOf2(given) === kid ? given : undefined;
   const active = loadSigningKey(false);
   const pubs = (process.env["LOKI_RECEIPT_RETIRED_PUBKEYS"] ?? "").split(":").map((f) => f.trim()).filter(Boolean).flatMap((f) => {
     try {
-      return [createPublicKey4(readFileSync59(f))];
+      return [createPublicKey4(readFileSync60(f))];
     } catch {
       return [];
     }
@@ -18233,7 +18247,7 @@ function checkEventLog(receiptPath, receipt) {
   }
   if (typeof bound !== "string")
     return null;
-  if (bound === createHash21("sha256").digest("hex")) {
+  if (bound === createHash22("sha256").digest("hex")) {
     const st = receipt["time"]?.stages;
     const claims = st !== null && typeof st === "object" && Object.keys(st).length > 0;
     return claims ? "the receipt records stages but binds the empty-log hash, so no events.jsonl can back it (missing, empty or non-empty); the receipt is forged or was sealed without a log. Re-run the task to produce a fresh receipt" : null;
@@ -18241,13 +18255,13 @@ function checkEventLog(receiptPath, receipt) {
   const path = join72(dirname33(receiptPath), "events.jsonl");
   if (!existsSync49(path))
     return "events.jsonl is missing";
-  const raw2 = readFileSync59(path, "utf8"), events2 = readEvents(path), lines2 = raw2.split(`
+  const raw2 = readFileSync60(path, "utf8"), events2 = readEvents(path), lines2 = raw2.split(`
 `).filter((l) => l.trim() !== "");
   if (events2.length !== lines2.length || events2.some((e, i) => e.seq !== i))
     return "events.jsonl has a forged, edited or missing line";
   if (events2.some((e) => e.type === "tamper.detected"))
     return "the supervisor detected events.jsonl being modified during the run";
-  const h = createHash21("sha256");
+  const h = createHash22("sha256");
   for (const l of lines2) {
     if (h.copy().digest("hex") === bound)
       return null;
@@ -18265,8 +18279,8 @@ function checkLogSeal(receiptPath, hash, kid, given) {
   const seal = events2[done + 1], d = seal?.type === "log.sealed" ? seal.data : null;
   if (!d)
     return { verdict: "TAMPERED", reason: "events.jsonl has no signed log.sealed line after run.completed" };
-  const lines2 = readFileSync59(path, "utf8").split(`
-`).filter((l) => l.trim() !== ""), sha4 = createHash21("sha256").update(lines2.slice(0, done + 1).join(`
+  const lines2 = readFileSync60(path, "utf8").split(`
+`).filter((l) => l.trim() !== ""), sha4 = createHash22("sha256").update(lines2.slice(0, done + 1).join(`
 `) + `
 `).digest("hex");
   const pub = d["kid"] === kid ? pubFor(kid, given) : undefined;
@@ -18279,7 +18293,7 @@ async function verifyReceipt(receiptPath, deps = {}) {
     return { verdict: "UNCHECKED", reasons: [`receipt not found: ${receiptPath}`] };
   let receipt;
   try {
-    receipt = JSON.parse((deps.read ?? ((p) => readFileSync59(p, "utf8")))(receiptPath));
+    receipt = JSON.parse((deps.read ?? ((p) => readFileSync60(p, "utf8")))(receiptPath));
   } catch {
     return { verdict: "UNCHECKED", reasons: ["receipt.json is not valid JSON"] };
   }
@@ -18368,8 +18382,8 @@ var init_verify_cmd = __esm(() => {
 });
 
 // src/server/app.ts
-import { existsSync as existsSync51, readFileSync as readFileSync62, statSync as statSync25 } from "fs";
-import { join as join75, resolve as resolve19, sep as sep16 } from "path";
+import { existsSync as existsSync51, readFileSync as readFileSync63, statSync as statSync25 } from "fs";
+import { join as join75, resolve as resolve20, sep as sep16 } from "path";
 
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = Symbol();
@@ -28680,7 +28694,7 @@ function mount20(ctx) {
 }
 
 // src/server/routes/verify.ts
-import { readFileSync as readFileSync60, realpathSync as realpathSync25 } from "fs";
+import { readFileSync as readFileSync61, realpathSync as realpathSync25 } from "fs";
 import { createPublicKey as createPublicKey5 } from "crypto";
 import { join as join73, sep as sep15 } from "path";
 init_verify_cmd();
@@ -28732,7 +28746,7 @@ function mount21(ctx) {
         sha4 = r.receiptSha256 ?? null;
       }
       try {
-        outcome = outcomeOf(JSON.parse(readFileSync60(file, "utf8")));
+        outcome = outcomeOf(JSON.parse(readFileSync61(file, "utf8")));
       } catch {
         outcome = "UNREADABLE";
       }
@@ -28794,7 +28808,7 @@ function ttlCache(ttlMs = PROBE_CACHE_MS, now2 = Date.now) {
 }
 
 // src/server/legacy/shim.ts
-import { existsSync as existsSync50, readFileSync as readFileSync61 } from "fs";
+import { existsSync as existsSync50, readFileSync as readFileSync62 } from "fs";
 import { join as join74 } from "path";
 
 // src/server/legacy/routes.ts
@@ -29176,7 +29190,7 @@ var repoVersion = () => {
   for (const f of [join74(import.meta.dir, "../../../../../VERSION")]) {
     try {
       if (existsSync50(f))
-        return readFileSync61(f, "utf8").trim();
+        return readFileSync62(f, "utf8").trim();
     } catch {}
   }
   return "unknown";
@@ -29390,7 +29404,7 @@ function createApp(opts) {
     for (const f of [process.env.LOKI_VERSION_FILE, join75(import.meta.dir, "../../../../VERSION")]) {
       try {
         if (f)
-          return readFileSync62(f, "utf8").trim() || "unknown";
+          return readFileSync63(f, "utf8").trim() || "unknown";
       } catch {}
     }
     return "unknown";
@@ -29499,8 +29513,8 @@ function createApp(opts) {
     }
     if (!uiDir || p.startsWith("/v1/"))
       return c.json({ error: "not found" }, 404);
-    const root = resolve19(uiDir);
-    const f = resolve19(root, `.${p}`);
+    const root = resolve20(uiDir);
+    const f = resolve20(root, `.${p}`);
     if (f.startsWith(root + sep16) && existsSync51(f) && statSync25(f).isFile())
       return new Response(Bun.file(f));
     if (/\.[a-z0-9]+$/i.test(p))