loki-mode 11.79.0 → 11.80.0

package/packages/control-plane/dist/server.js

@@ -10896,6 +10896,14 @@ var init_history = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/unit_model.ts
+function clampToMaxTier(model, env = process.env) {
+  const cap = (env["LOKI_MAX_TIER"] ?? "").trim().toLowerCase();
+  return modelRank(cap) < modelRank("opus") && modelRank(model) > modelRank(cap) ? cap : model;
+}
+function unitModel(cascade, runModel) {
+  const floor = clampToMaxTier(runFloor(runModel ?? resolveModel("claude")));
+  return modelRank(cascade) >= modelRank(floor) ? cascade : floor;
+}
 function validHaikuRoute(plan) {
   const units = plan?.["units"], np = plan?.["route_not_proven"];
   if (!Array.isArray(units) || units.length === 0 || Array.isArray(np) && np.length > 0)
@@ -63181,12 +63189,70 @@ var init_run_summary = __esm(() => {
   init_term_width();
 });
 
+// ../../loki-ts/src/util/wall_owned.ts
+import { isAbsolute as isAbsolute13, join as join75, relative as relative13 } from "path";
+function failingLocations(raw2, cwd, repoDir) {
+  const out3 = raw2.replace(ANSI2, "").replace(/\r\n?/g, `
+`), files = new Set;
+  let located = 0, errors2 = 0, header = null;
+  for (const line2 of out3.split(`
+`)) {
+    const m = /^(.+?)\(\d+,\d+\): error TS\d+:/.exec(line2) ?? /^(.+?):\d+:\d+ - error TS\d+:/.exec(line2) ?? /^(.+?):\d+:\d+: .*\berror\b/.exec(line2);
+    if (m) {
+      files.add(m[1]);
+      located++;
+      errors2++;
+      continue;
+    }
+    if (/\berror TS\d+:/.test(line2)) {
+      errors2++;
+      continue;
+    }
+    if (/^\S/.test(line2) && /^[^\s:]+\.[cm]?[jt]sx?$/.test(line2.trim())) {
+      header = line2.trim();
+      continue;
+    }
+    if (/^\s+\d+:\d+\s+error\b/.test(line2)) {
+      errors2++;
+      if (header) {
+        files.add(header);
+        located++;
+      }
+    }
+  }
+  if (errors2 === 0 || located !== errors2)
+    return null;
+  return [...files].map((f) => relative13(repoDir, isAbsolute13(f) ? f : join75(cwd, f)));
+}
+function wallOwnedFailure(raw2, cwd, repoDir, wall) {
+  const locs = failingLocations(raw2, cwd, repoDir);
+  return !!locs && locs.length > 0 && locs.every((l) => wall.has(l));
+}
+function wallAnchor(reason, wall) {
+  for (const m of reason.matchAll(/([\w@./-]+\.[A-Za-z]{1,5}):(\d+)/g)) {
+    const p = m[1].replace(/^\.\//, ""), file = wall.find((w) => w === p || w.endsWith(`/${p}`) || p.endsWith(`/${w}`));
+    if (file)
+      return { file, line: Number(m[2]) };
+  }
+  return null;
+}
+function wallDropped(o) {
+  return [...new Set([o.implement, o.fix].flatMap((s) => {
+    const d = s?.wall_defect;
+    return d?.action === "dropped" ? [`${WALL_DROPPED}: ${d.file}:${d.line}: ${d.reason}`] : [];
+  }))];
+}
+var WALL_COMPILE_REASON = "wall test did not compile under the package config", ANSI2, WALL_DROPPED = "Wall assertion dropped (harness-owned conflict persisted after one re-author)";
+var init_wall_owned = __esm(() => {
+  ANSI2 = /\u001b\[[0-9;?]*[ -/]*[@-~]/g;
+});
+
 // ../../loki-ts/src/util/mutation_proof.ts
 import { existsSync as existsSync53, mkdirSync as mkdirSync38, mkdtempSync as mkdtempSync6, readFileSync as readFileSync68, rmSync as rmSync17, symlinkSync as symlinkSync3, writeFileSync as writeFileSync36 } from "fs";
 import { tmpdir as tmpdir8 } from "os";
-import { basename as basename18, dirname as dirname30, isAbsolute as isAbsolute13, join as join75, relative as relative13 } from "path";
+import { basename as basename18, dirname as dirname30, isAbsolute as isAbsolute14, join as join76, relative as relative14 } from "path";
 function mutationProof(i) {
-  const rels = i.wallFiles.map((f) => isAbsolute13(f.path) ? relative13(i.repoDir, f.path) : f.path);
+  const rels = i.wallFiles.map((f) => isAbsolute14(f.path) ? relative14(i.repoDir, f.path) : f.path);
   if (rels.length === 0)
     return np2("no Wall tests");
   const tests = rels.flatMap((rel) => {
@@ -63202,28 +63268,28 @@ function mutationProof(i) {
   const deadline = Date.now() + budgetS * 1000, remaining = () => deadline - Date.now();
   let parent = null, wt = null, added = false;
   try {
-    parent = mkdtempSync6(join75(tmpdir8(), "loki-mutproof-"));
-    wt = join75(parent, "wt");
+    parent = mkdtempSync6(join76(tmpdir8(), "loki-mutproof-"));
+    wt = join76(parent, "wt");
     const add3 = git5(i.repoDir, ["worktree", "add", "--detach", wt, i.baseSha], Math.max(1000, Math.min(30000, remaining())));
     added = existsSync53(wt) || add3.status === 0;
     if (add3.status !== 0)
       return np2("could not create the base worktree");
     for (const rel of rels) {
-      const sealed = join75(i.runDir, "wall", basename18(rel));
-      if (!existsSync53(sealed) && existsSync53(join75(i.runDir, "wall")))
+      const sealed = join76(i.runDir, "wall", basename18(rel));
+      if (!existsSync53(sealed) && existsSync53(join76(i.runDir, "wall")))
         return np2(`sealed Wall copy missing: ${rel}`);
-      const src = existsSync53(sealed) ? sealed : join75(i.repoDir, rel);
+      const src = existsSync53(sealed) ? sealed : join76(i.repoDir, rel);
       if (!existsSync53(src))
         return np2(`Wall file missing: ${rel}`);
-      mkdirSync38(dirname30(join75(wt, rel)), { recursive: true });
-      writeFileSync36(join75(wt, rel), readFileSync68(src));
+      mkdirSync38(dirname30(join76(wt, rel)), { recursive: true });
+      writeFileSync36(join76(wt, rel), readFileSync68(src));
     }
     for (const rel of rels) {
       const parts = rel.split("/").slice(0, -1);
       for (let n10 = 0;n10 <= parts.length; n10++) {
         const anc = parts.slice(0, n10).join("/");
         for (const d of DEP_DIRS) {
-          const src = join75(i.repoDir, anc, d), dst = join75(wt, anc, d);
+          const src = join76(i.repoDir, anc, d), dst = join76(wt, anc, d);
           if (existsSync53(src) && !existsSync53(dst)) {
             try {
               symlinkSync3(src, dst);
@@ -63289,7 +63355,7 @@ var init_mutation_proof = __esm(() => {
 
 // ../../loki-ts/src/util/python.ts
 import { accessSync, constants as constants4, existsSync as existsSync54, mkdtempSync as mkdtempSync7, readFileSync as readFileSync69, realpathSync as realpathSync25, rmSync as rmSync18, statSync as statSync24 } from "fs";
-import { join as join76 } from "path";
+import { join as join77 } from "path";
 import { spawnSync as spawnSync8 } from "child_process";
 import { tmpdir as tmpdir9 } from "os";
 async function findPython3() {
@@ -63473,9 +63539,9 @@ ${res.stderr ?? ""}`, res.status, timedOut, junitXml);
   };
 }
 function spawnPytest(pythonBin, repoDir, timeoutMs, extra, withJunit) {
-  const pycPrefix = mkdtempSync7(join76(tmpdir9(), "loki-pyc-"));
-  const junitDir = mkdtempSync7(join76(tmpdir9(), "loki-junit-"));
-  const junit = join76(junitDir, "junit.xml");
+  const pycPrefix = mkdtempSync7(join77(tmpdir9(), "loki-pyc-"));
+  const junitDir = mkdtempSync7(join77(tmpdir9(), "loki-junit-"));
+  const junit = join77(junitDir, "junit.xml");
   let junitXml;
   try {
     let root = repoDir;
@@ -63535,7 +63601,7 @@ function makePytestCollector(pythonBin = "python3", timeoutMs = 300000) {
 }
 function pytestConfigFor(root) {
   const has2 = (f, marker) => {
-    const p = join76(root, f);
+    const p = join77(root, f);
     if (!existsSync54(p))
       return false;
     if (!marker)
@@ -63548,13 +63614,13 @@ function pytestConfigFor(root) {
   };
   for (const f of ["pytest.ini", ".pytest.ini", "pytest.toml", ".pytest.toml"])
     if (has2(f))
-      return join76(root, f);
+      return join77(root, f);
   if (has2("pyproject.toml", /^\s*\[tool\.pytest|^\s*(tool\.)?pytest\./m))
-    return join76(root, "pyproject.toml");
+    return join77(root, "pyproject.toml");
   if (has2("tox.ini", /^\s*\[pytest\]/m))
-    return join76(root, "tox.ini");
+    return join77(root, "tox.ini");
   if (has2("setup.cfg", /^\s*\[tool:pytest\]/m))
-    return join76(root, "setup.cfg");
+    return join77(root, "setup.cfg");
   return "/dev/null";
 }
 var _pythonCache, PY_TIMEOUT_MS = 5000, PY_SCRIPT = `
@@ -63955,7 +64021,7 @@ Example: test('name', () => { assert.strictEqual(fn(1), 2); });  Run: node --tes
 import { createHash as createHash25 } from "crypto";
 import { appendFileSync as appendFileSync9, copyFileSync as copyFileSync4, existsSync as existsSync55, mkdirSync as mkdirSync39, readFileSync as readFileSync70, rmSync as rmSync19, writeFileSync as writeFileSync37 } from "fs";
 import { tmpdir as tmpdir10 } from "os";
-import { basename as basename20, join as join77, relative as relative14 } from "path";
+import { basename as basename20, join as join78, relative as relative15 } from "path";
 function wallHoldoutRatio(env = process.env) {
   if (env["LOKI_WALL_HOLDOUT"]?.trim() === "0")
     return 0;
@@ -63986,32 +64052,32 @@ function stashHoldout(o) {
   rmSync19(dir, { recursive: true, force: true });
   mkdirSync39(dir, { recursive: true, mode: 448 });
   const files = held.map((name) => {
-    copyFileSync4(join77(o.srcDir, name), join77(dir, name));
-    rmSync19(join77(o.srcDir, name), { force: true });
-    return { name, runner: o.runnerOf(name), sha256: sha3(readFileSync70(join77(dir, name), "utf8")) };
+    copyFileSync4(join78(o.srcDir, name), join78(dir, name));
+    rmSync19(join78(o.srcDir, name), { force: true });
+    return { name, runner: o.runnerOf(name), sha256: sha3(readFileSync70(join78(dir, name), "utf8")) };
   });
-  writeFileSync37(join77(dir, MANIFEST), JSON.stringify({ targetDir: o.targetDir, files }));
+  writeFileSync37(join78(dir, MANIFEST), JSON.stringify({ targetDir: o.targetDir, files }));
   return { dir, names: new Set(held) };
 }
 function stageHoldout(dir, repoDir) {
   const put = [], tests = [], missing = [];
   let man = null;
   try {
-    man = JSON.parse(readFileSync70(join77(dir, MANIFEST), "utf8"));
+    man = JSON.parse(readFileSync70(join78(dir, MANIFEST), "utf8"));
   } catch {}
   if (!man)
     return { tests, missing: [`holdout store unreadable: ${basename20(dir)}`], cleanup: () => {} };
   mkdirSync39(man.targetDir, { recursive: true });
   man.files.forEach((f, i) => {
-    const src = join77(dir, f.name);
+    const src = join78(dir, f.name);
     if (!existsSync55(src) || sha3(readFileSync70(src, "utf8")) !== f.sha256) {
       missing.push(`holdout ${i + 1} missing or altered`);
       return;
     }
-    const dest = join77(man.targetDir, `loki_wall_holdout_${i + 1}${f.name.slice(f.name.indexOf("."))}`);
+    const dest = join78(man.targetDir, `loki_wall_holdout_${i + 1}${f.name.slice(f.name.indexOf("."))}`);
     copyFileSync4(src, dest);
     put.push(dest);
-    tests.push({ runner: f.runner, path: relative14(repoDir, dest) });
+    tests.push({ runner: f.runner, path: relative15(repoDir, dest) });
   });
   return { tests, missing, cleanup: () => {
     for (const p of put)
@@ -64021,16 +64087,16 @@ function stageHoldout(dir, repoDir) {
 function recordHoldoutTriage(runDir, entry2) {
   try {
     mkdirSync39(runDir, { recursive: true });
-    appendFileSync9(join77(runDir, HOLDOUT_TRIAGE_FILE), JSON.stringify(entry2) + `
+    appendFileSync9(join78(runDir, HOLDOUT_TRIAGE_FILE), JSON.stringify(entry2) + `
 `, { mode: 384 });
   } catch {}
 }
-var sha3 = (s) => createHash25("sha256").update(s).digest("hex"), WALL_HOLDOUT_DEFAULT_RATIO = 0.2, isHoldoutCheck = (name) => name.startsWith("holdout:"), holdoutDirFor = (runId, repoDir) => join77(tmpdir10(), `loki-e10-holdout-${sha3(`${runId}:${repoDir}`).slice(0, 16)}`), MANIFEST = "manifest.json", WALL_HOLDOUT_MIN = 5, HOLDOUT_TRIAGE_FILE = "holdout-triage.jsonl";
+var sha3 = (s) => createHash25("sha256").update(s).digest("hex"), WALL_HOLDOUT_DEFAULT_RATIO = 0.2, isHoldoutCheck = (name) => name.startsWith("holdout:"), holdoutDirFor = (runId, repoDir) => join78(tmpdir10(), `loki-e10-holdout-${sha3(`${runId}:${repoDir}`).slice(0, 16)}`), MANIFEST = "manifest.json", WALL_HOLDOUT_MIN = 5, HOLDOUT_TRIAGE_FILE = "holdout-triage.jsonl";
 var init_holdout = () => {};
 
 // ../../loki-ts/src/features/runner_config.ts
 import { readFileSync as readFileSync71 } from "fs";
-import { dirname as dirname32, join as join78, normalize as normalize4 } from "path";
+import { dirname as dirname32, join as join79, normalize as normalize4 } from "path";
 function tomlKey2(s, i = 0, eq3 = true) {
   const parts = [], ws2 = () => {
     while (/\s/.test(s[i] ?? "x"))
@@ -64307,8 +64373,8 @@ function referenced(cfg, text3) {
     }
   const dir = dirname32(cfg), explicit = ROOT_DIR.exec(text3), roots = [dir];
   if (explicit)
-    roots.push("", ...explicit[1] ? [join78(dir, explicit[1])] : []);
-  return [...raw2.flatMap((r) => r.startsWith("/") ? [normalize4(r.slice(1))] : roots.map((root) => normalize4(join78(root, r.replace(/^<rootDir>\/?/, ""))))), ...patchedTargets(cfg, text3).map((t) => normalize4(join78(dir, t)))];
+    roots.push("", ...explicit[1] ? [join79(dir, explicit[1])] : []);
+  return [...raw2.flatMap((r) => r.startsWith("/") ? [normalize4(r.slice(1))] : roots.map((root) => normalize4(join79(root, r.replace(/^<rootDir>\/?/, ""))))), ...patchedTargets(cfg, text3).map((t) => normalize4(join79(dir, t)))];
 }
 function runnerConfigNotes(repoDir, baseSha, head, changed, signal) {
   const notes = new Set, ch = new Set(changed.map((c) => normalize4(c)));
@@ -64388,7 +64454,7 @@ var PKG_KEYS, RAW_CONFIGS, RUNNER_CONFIGS, DEP_MAPS, RUNNER_DEP, LOCAL_SPEC, dep
   }
 }, headText = (dir, f) => {
   try {
-    return readFileSync71(join78(dir, f), "utf8");
+    return readFileSync71(join79(dir, f), "utf8");
   } catch {
     return "";
   }
@@ -64430,7 +64496,7 @@ var init_runner_config = __esm(() => {
 import { execFileSync as execFileSync6 } from "child_process";
 import { mkdtempSync as mkdtempSync8, readFileSync as readFileSync72, rmSync as rmSync20 } from "fs";
 import { tmpdir as tmpdir11 } from "os";
-import { join as join79 } from "path";
+import { join as join80 } from "path";
 import { basename as basename21 } from "path";
 function classifyAssertDelta(inp) {
   const f = basename21(inp.path);
@@ -64440,7 +64506,7 @@ function classifyAssertDelta(inp) {
     return WEAKENED;
   let cwd = "";
   try {
-    cwd = mkdtempSync8(join79(tmpdir11(), "loki-ad-"));
+    cwd = mkdtempSync8(join80(tmpdir11(), "loki-ad-"));
     const raw2 = execFileSync6("python3", ["-I", "-c", PY2], {
       input: JSON.stringify({ path: inp.path, base: inp.base, head: inp.head, task: inp.task }),
       cwd,
@@ -64471,7 +64537,7 @@ function assertDeltaNotes(repoDir, baseSha, headRef, path, task, baseCounts, hea
     return null;
   try {
     const show = (ref) => safeGit(repoDir, ["show", `${ref}:${path}`]);
-    const head = headRef ? show(headRef) : readFileSync72(join79(repoDir, path), "utf8");
+    const head = headRef ? show(headRef) : readFileSync72(join80(repoDir, path), "utf8");
     const r = classifyTestEdit(path, show(baseSha), head, task, baseCounts, headCounts);
     return r[0]?.kind === "literal-only" ? r.map((e10) => `assertion value changed (not shown to be required by the task): ${e10.file}:${e10.line} ${e10.old} -> ${e10.new}`) : null;
   } catch {
@@ -64762,50 +64828,6 @@ var init_select = __esm(() => {
   RANK_LABELS = ["wallPasses", "deterministicFails", "passesInS", "flakyInS", "lintFails", "diffLines", "index"];
 });
 
-// ../../loki-ts/src/util/wall_owned.ts
-import { isAbsolute as isAbsolute14, join as join80, relative as relative15 } from "path";
-function failingLocations(raw2, cwd, repoDir) {
-  const out3 = raw2.replace(ANSI2, "").replace(/\r\n?/g, `
-`), files = new Set;
-  let located = 0, errors2 = 0, header = null;
-  for (const line2 of out3.split(`
-`)) {
-    const m = /^(.+?)\(\d+,\d+\): error TS\d+:/.exec(line2) ?? /^(.+?):\d+:\d+ - error TS\d+:/.exec(line2) ?? /^(.+?):\d+:\d+: .*\berror\b/.exec(line2);
-    if (m) {
-      files.add(m[1]);
-      located++;
-      errors2++;
-      continue;
-    }
-    if (/\berror TS\d+:/.test(line2)) {
-      errors2++;
-      continue;
-    }
-    if (/^\S/.test(line2) && /^[^\s:]+\.[cm]?[jt]sx?$/.test(line2.trim())) {
-      header = line2.trim();
-      continue;
-    }
-    if (/^\s+\d+:\d+\s+error\b/.test(line2)) {
-      errors2++;
-      if (header) {
-        files.add(header);
-        located++;
-      }
-    }
-  }
-  if (errors2 === 0 || located !== errors2)
-    return null;
-  return [...files].map((f) => relative15(repoDir, isAbsolute14(f) ? f : join80(cwd, f)));
-}
-function wallOwnedFailure(raw2, cwd, repoDir, wall) {
-  const locs = failingLocations(raw2, cwd, repoDir);
-  return !!locs && locs.length > 0 && locs.every((l) => wall.has(l));
-}
-var WALL_COMPILE_REASON = "wall test did not compile under the package config", ANSI2;
-var init_wall_owned = __esm(() => {
-  ANSI2 = /\u001b\[[0-9;?]*[ -/]*[@-~]/g;
-});
-
 // ../../loki-ts/src/util/app_probe.ts
 import { spawnSync as spawnSync9 } from "child_process";
 import { existsSync as existsSync56, mkdirSync as mkdirSync40, readFileSync as readFileSync73, renameSync as renameSync18, writeFileSync as writeFileSync38 } from "fs";
@@ -66417,7 +66439,7 @@ async function planRoute(runDir, provider, env = process.env, repoDir = "") {
     advisor,
     pinOpus,
     pin: pinOpus ? { model: "opus" } : {},
-    pinFor: (onSonnet) => onSonnet ? SONNET_PIN : out3.pin,
+    pinFor: (onSonnet, runModel) => onSonnet ? { model: planFallbackModel(runModel) } : out3.pin,
     planModel: (fastModel) => pinOpus ? "opus" : provider === "claude" ? fastModel : "provider default",
     units: () => {
       if (!routed)
@@ -66436,7 +66458,11 @@ async function planRoute(runDir, provider, env = process.env, repoDir = "") {
   };
   return out3;
 }
-var ROUTER_UNITS_INSTRUCTION = 'In the same JSON file (<scope>) also add "units": [{"id":"<unit id>","kind":"<short kind>","executor":"sonnet"|"haiku","reason":"<=200 chars"}], one entry per work unit of your plan. The default executor is sonnet. Assign haiku to a unit only when you judge it safe for that unit and say why in reason. Give the Wall acceptance-test unit the id "wall".', SONNET_PIN;
+var ROUTER_UNITS_INSTRUCTION = 'In the same JSON file (<scope>) also add "units": [{"id":"<unit id>","kind":"<short kind>","executor":"sonnet"|"haiku","reason":"<=200 chars"}], one entry per work unit of your plan. The default executor is sonnet. Assign haiku to a unit only when you judge it safe for that unit and say why in reason. Give the Wall acceptance-test unit the id "wall".', planFallbackModel = (runModel) => {
+  const floor = runModel ? runFloor(runModel) : "sonnet";
+  const r = modelRank(clampToMaxTier(floor));
+  return r > modelRank("sonnet") && modelRank(floor) < modelRank("unknown-id") ? floor : "sonnet";
+};
 var init_plan_route = __esm(() => {
   init_run_cap();
   init_providers();
@@ -66444,7 +66470,8 @@ var init_plan_route = __esm(() => {
   init_advisor_probe();
   init_route_record();
   init_history();
-  SONNET_PIN = { model: "sonnet" };
+  init_model_rank();
+  init_unit_model();
 });
 
 // ../../loki-ts/src/engine10/stages/plan.ts
@@ -66535,14 +66562,14 @@ var init_plan = __esm(() => {
         limitS: planStage.limitS,
         signal,
         cwd: ctx.repoDir,
-        ...pr2.pinFor(onSonnet)
+        ...pr2.pinFor(onSonnet, ctx.model)
       });
       let session = await runPlan(false);
       let planModel = pr2.planModel(fastTierModel(process.env));
       let planModelNote = null;
       if (pr2.pinOpus && !session.killed && session.exit !== 0) {
-        planModel = "sonnet";
-        planModelNote = `Opus plan session failed (exit ${session.exit}); the plan ran on sonnet`;
+        planModel = planFallbackModel(ctx.model);
+        planModelNote = `Opus plan session failed (exit ${session.exit}); the plan ran on ${planModel}`;
         session = await runPlan(true);
       }
       if (!session.killed && session.exit !== 0) {
@@ -66576,6 +66603,10 @@ var init_plan = __esm(() => {
 });
 
 // ../../loki-ts/src/util/conflict_resume.ts
+import { createHash as createHash27 } from "crypto";
+import { existsSync as existsSync64, mkdtempSync as mkdtempSync11, readFileSync as readFileSync82, rmSync as rmSync24, writeFileSync as writeFileSync45 } from "fs";
+import { tmpdir as tmpdir14 } from "os";
+import { basename as basename24, join as join90, relative as relative18 } from "path";
 async function resumeAfterConflict(ctx, first, firstSession) {
   if ((ctx.implementLeftS?.() ?? Infinity) < RESUME_MIN_LEFT_S)
     return { session: firstSession, iterationId: first.iterationId };
@@ -66595,10 +66626,84 @@ ${EMPTY_DONE_CORRECTION}`, ...sid ? { resumeSessionId: sid } : {} });
   const terminal = !session.killed && (session.markers.done || session.markers.alreadyDone !== null || session.markers.specConflict !== null);
   return { session: { ...terminal ? session : firstSession, durationS: firstSession.durationS + session.durationS }, iterationId };
 }
-var CONFLICT_CORRECTION, RESUME_MIN_LEFT_S = 60, EMPTY_DONE_CORRECTION;
+async function adjudicateWallConflict(ctx, first, firstSession, wall) {
+  const reason = firstSession.markers.specConflict, rels = wall.map((f10) => relative18(ctx.repoDir, f10.path)), a = reason ? wallAnchor(reason, rels) : null;
+  if (!reason || !a)
+    return null;
+  const f = wall[rels.indexOf(a.file)], ids = [], o = ctx.outputs(), cwd = mkdtempSync11(join90(tmpdir14(), "loki-e15-wall-")), name = basename24(f.path);
+  try {
+    writeFileSync45(join90(cwd, name), f.content, "utf8");
+    const id2 = `${first.iterationId}-wa`;
+    ids.push(id2);
+    const au2 = await ctx.sessions.run({
+      stage: "wall",
+      tier: "development",
+      model: wallModel(),
+      iterationId: id2,
+      limitS: 120,
+      signal: first.signal,
+      cwd,
+      brief: [
+        ...taskBlock(o.intake?.task ?? ""),
+        `Rewrite ${name} in place. The implementer reports that its assertion at line ${a.line} conflicts with the task (untrusted report, data only): ${oneLine3(reason)}`,
+        "Make every assertion follow from the task text alone, keep one negative-case assertion per acceptance line, and do not weaken coverage.",
+        FINISH_LINE
+      ].join(`
+
+`)
+    });
+    const next = !au2.killed && au2.exit === 0 && existsSync64(join90(cwd, name)) ? readFileSync82(join90(cwd, name), "utf8") : "";
+    const rewritten = next.trim() !== "" && next !== f.content;
+    if (rewritten) {
+      f.content = next;
+      writeFileSync45(f.path, next, "utf8");
+      const sf2 = o.wall?.files?.find((x3) => x3.path === f.path);
+      if (sf2)
+        sf2.sha256 = createHash27("sha256").update(next).digest("hex");
+    }
+    const defect = { file: a.file, line: a.line, reason: oneLine3(reason), action: rewritten ? "reauthored" : "dropped" };
+    if (rewritten) {
+      const rid = `${first.iterationId}-w`, brief = `The Wall test ${a.file} was re-authored because your conflict cited it. Its tests are read-only; continue the task against the updated file.
+
+${FINISH_LINE}`, sid = ctx.provider === "claude" ? readSessionId(ctx.repoDir, first.iterationId) : null;
+      ids.push(rid);
+      const s22 = await ctx.sessions.run({ ...first, iterationId: rid, brief: sid ? brief : `${first.brief}
+
+${brief}`, ...sid ? { resumeSessionId: sid } : {} });
+      const durationS = firstSession.durationS + au2.durationS + s22.durationS, again = s22.markers.specConflict;
+      if (!s22.killed && (s22.markers.done || s22.markers.alreadyDone !== null))
+        return { session: { ...s22, durationS }, ids, defect };
+      const b = again ? wallAnchor(again, rels) : null;
+      if (s22.killed || !again || !b)
+        return { session: { ...!s22.killed && again ? s22 : firstSession, durationS }, ids, defect };
+      defect.file = b.file;
+      defect.line = b.line;
+      defect.reason = oneLine3(again);
+    }
+    defect.action = "dropped";
+    const gone = wall.findIndex((w) => relative18(ctx.repoDir, w.path) === defect.file);
+    if (gone >= 0) {
+      rmSync24(wall[gone].path, { force: true });
+      wall.splice(gone, 1);
+    }
+    const files = o.wall?.files;
+    if (files) {
+      const k3 = files.findIndex((x3) => relative18(ctx.repoDir, x3.path) === defect.file);
+      if (k3 >= 0)
+        files.splice(k3, 1);
+    }
+    return { session: { ...firstSession, markers: { done: true, alreadyDone: null, specConflict: null }, exit: 0 }, ids, defect };
+  } finally {
+    rmSync24(cwd, { recursive: true, force: true });
+  }
+}
+var CONFLICT_CORRECTION, RESUME_MIN_LEFT_S = 60, EMPTY_DONE_CORRECTION, oneLine3 = (s) => s.replace(/[\u0000-\u001f\u007f]+/g, " ").trim().slice(0, 200);
 var init_conflict_resume = __esm(() => {
   init_session_resume();
   init_context();
+  init_sizing();
+  init_wall_owned();
+  init_types();
   CONFLICT_CORRECTION = "Loki imposes no file or test limits on you. If your conflict is only about Loki's own rules, finish the task. If the task itself conflicts, restate the conflict. " + FINISH_LINE;
   EMPTY_DONE_CORRECTION = "Your session finished with LOKI_DONE but the working tree has no change against the base. Make the change the task asks for, or if the task is already satisfied finish with LOKI_ALREADY_DONE: <file:line evidence>, or if the task itself conflicts finish with LOKI_SPEC_CONFLICT: <reason>. " + FINISH_LINE;
 });
@@ -66642,8 +66747,8 @@ __export(exports_implement, {
   briefCtx: () => briefCtx,
   applyExternalPatch: () => applyExternalPatch
 });
-import { existsSync as existsSync64, mkdirSync as mkdirSync47, readFileSync as readFileSync82, rmSync as rmSync24, writeFileSync as writeFileSync45 } from "fs";
-import { join as join90, relative as relative18 } from "path";
+import { existsSync as existsSync65, mkdirSync as mkdirSync47, readFileSync as readFileSync83, rmSync as rmSync25, writeFileSync as writeFileSync46 } from "fs";
+import { join as join91, relative as relative19 } from "path";
 function impactedTests(ctx) {
   const o = ctx.outputs();
   const map = o.intake?.testmap;
@@ -66651,7 +66756,7 @@ function impactedTests(ctx) {
   const relevantFiles = o.plan?.relevant_files;
   const relevant2 = relevantFiles?.length ? relevantFiles : namedFiles(task, loadRepoMap(o.intake?.repomap_ref));
   const fromMap = map ? ctx.tests.impacted(map, relevant2).map((t) => t.path) : [];
-  const wall = (o.wall?.readOnlyFiles ?? []).map((f) => relative18(ctx.repoDir, f.path));
+  const wall = (o.wall?.readOnlyFiles ?? []).map((f) => relative19(ctx.repoDir, f.path));
   return [...new Set([...fromMap, ...wall])];
 }
 function buildImplementBrief(task, plan, impactedTests2, repoMap = "", spec = null) {
@@ -66671,9 +66776,9 @@ ${plan}` : "No separate plan was made: plan the change yourself in this session,
 function restoreReadOnly(files) {
   const reverted = [];
   for (const f of files) {
-    const current = existsSync64(f.path) ? readFileSync82(f.path, "utf8") : null;
+    const current = existsSync65(f.path) ? readFileSync83(f.path, "utf8") : null;
     if (current !== f.content) {
-      writeFileSync45(f.path, f.content, "utf8");
+      writeFileSync46(f.path, f.content, "utf8");
       reverted.push(f.path);
     }
   }
@@ -66690,7 +66795,7 @@ function specFor(ctx) {
   if (!process.env.LOKI_E10_SPEC_SHA256)
     return null;
   try {
-    return loadSpecFile(join90(ctx.runDir, "spec.snapshot.md"));
+    return loadSpecFile(join91(ctx.runDir, "spec.snapshot.md"));
   } catch {
     return null;
   }
@@ -66703,7 +66808,7 @@ function applyExternalPatch(ctx, patchPath) {
 `)[0]}` };
   }
   const testsReverted = restoreReadOnly(ctx.outputs().wall?.readOnlyFiles ?? []);
-  return { status: "completed", data: { exit: "external", external: true, patch_sha256: sha2562(readFileSync82(patchPath, "utf8")), tests_reverted: testsReverted, impacted_tests: impactedTests(ctx), iteration_ids: [] } };
+  return { status: "completed", data: { exit: "external", external: true, patch_sha256: sha2562(readFileSync83(patchPath, "utf8")), tests_reverted: testsReverted, impacted_tests: impactedTests(ctx), iteration_ids: [] } };
 }
 var briefCtx = (ctx) => briefContext(ctx, { select: selectRelevantFiles, cmd: (t, repoDir) => {
   const c = commandFor(t, repoDir, loadProjectApi(repoDir));
@@ -66735,7 +66840,7 @@ var init_implement = __esm(() => {
     targetS: 180,
     limitS: 480,
     async run(ctx, signal) {
-      rmSync24(join90(ctx.repoDir, ".loki", "supply-declared.json"), { force: true });
+      rmSync25(join91(ctx.repoDir, ".loki", "supply-declared.json"), { force: true });
       if (ctx.externalPatch)
         return applyExternalPatch(ctx, ctx.externalPatch);
       const prior = ctx.outputs();
@@ -66778,7 +66883,7 @@ var init_implement = __esm(() => {
       };
       const rt2 = routed ? routeStart(ctx, first, prior.plan) : null;
       const size = sizeTask(task, loadRepoMap(prior.intake?.repomap_ref), prior.intake?.testmap ?? null).size;
-      const two = attemptsGate({ size, predictedS: impacted.length }) ? await runAttemptsOnCtx(ctx, first, signal, impacted, { wallPaths: readOnly.map((f) => relative18(ctx.repoDir, f.path)), wallContent: Object.fromEntries(readOnly.map((f) => [relative18(ctx.repoDir, f.path), f.content])), check: (c, t, sg2, out3) => {
+      const two = attemptsGate({ size, predictedS: impacted.length }) ? await runAttemptsOnCtx(ctx, first, signal, impacted, { wallPaths: readOnly.map((f) => relative19(ctx.repoDir, f.path)), wallContent: Object.fromEntries(readOnly.map((f) => [relative19(ctx.repoDir, f.path), f.content])), check: (c, t, sg2, out3) => {
         const tc2 = commandFor(t, c.repoDir, loadProjectApi(c.repoDir));
         return runCheck(c, `${t.runner}:${t.path}`, tc2.cmd, tc2.args, sg2, out3, { ...tc2.interpreter ? { interpreter: tc2.interpreter } : {}, ...tc2.pkgRoot !== "." ? { cwd: tc2.cwd } : {} });
       } }) : null;
@@ -66803,6 +66908,15 @@ var init_implement = __esm(() => {
         if (r.iterationId !== ids[ids.length - 1])
           ids.push(r.iterationId);
       }
+      let wallDefect = null;
+      if (session.markers.specConflict && !session.killed && !signal.aborted) {
+        const w = await adjudicateWallConflict(ctx, { ...unchained(), iterationId: ids[ids.length - 1] }, session, readOnly);
+        if (w) {
+          session = w.session;
+          ids.push(...w.ids);
+          wallDefect = w.defect;
+        }
+      }
       if (!signal.aborted && !session.killed && session.exit === 0 && !session.markers.specConflict && !session.markers.alreadyDone && treeIsEmpty(ctx)) {
         const r = await resumeAfterEmptyDone(ctx, { ...unchained(), iterationId: ids[ids.length - 1] }, session);
         session = r.session;
@@ -66838,6 +66952,7 @@ var init_implement = __esm(() => {
         already_done_evidence: session.markers.alreadyDone,
         spec_conflict_reason: session.markers.specConflict,
         tests_reverted: testsReverted,
+        ...wallDefect ? { wall_defect: wallDefect } : {},
         impacted_tests: impacted,
         cascade,
         ...downgrade ? { model_downgrade: downgrade.note } : {},
@@ -66854,8 +66969,8 @@ var init_implement = __esm(() => {
         return { status: "completed", data };
       const stderrTail = session.stderrTail ?? "";
       mkdirSync47(ctx.runDir, { recursive: true });
-      const stderrPath = join90(ctx.runDir, `${iterationId}.stderr.log`);
-      writeFileSync45(stderrPath, stderrTail, "utf8");
+      const stderrPath = join91(ctx.runDir, `${iterationId}.stderr.log`);
+      writeFileSync46(stderrPath, stderrTail, "utf8");
       data.stderr_path = stderrPath;
       return { status: "failed", reason: classifyExitCause(session.exit, false), data };
     }
@@ -66864,18 +66979,18 @@ var init_implement = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/machine.ts
-import { existsSync as existsSync65, mkdirSync as mkdirSync48, rmSync as rmSync25, writeFileSync as writeFileSync46 } from "fs";
-import { isAbsolute as isAbsolute17, join as join91, relative as relative19 } from "path";
+import { existsSync as existsSync66, mkdirSync as mkdirSync48, rmSync as rmSync26, writeFileSync as writeFileSync47 } from "fs";
+import { isAbsolute as isAbsolute17, join as join92, relative as relative20 } from "path";
 async function optional(path) {
-  const abs = isAbsolute17(path) ? path : join91(import.meta.dir, path);
-  if (!existsSync65(abs))
+  const abs = isAbsolute17(path) ? path : join92(import.meta.dir, path);
+  if (!existsSync66(abs))
     return null;
   return await import(abs);
 }
 function defaultLoader(dir) {
   return async (name) => {
-    const reg = dir === join91(import.meta.dir, "stages") ? REGISTRY[`./stages/${name}.ts`] : undefined;
-    const mod = reg ? await reg() : await optional(join91(dir, `${name}.ts`));
+    const reg = dir === join92(import.meta.dir, "stages") ? REGISTRY[`./stages/${name}.ts`] : undefined;
+    const mod = reg ? await reg() : await optional(join92(dir, `${name}.ts`));
     return mod ? mod.stage ?? mod.default ?? null : null;
   };
 }
@@ -66884,7 +66999,7 @@ function softCapS(capS) {
   return Math.max(0, Math.min(plain2, budget));
 }
 async function runMachine(ctx, opts = {}) {
-  const load = opts.load ?? defaultLoader(opts.stagesDir ?? join91(import.meta.dir, "stages"));
+  const load = opts.load ?? defaultLoader(opts.stagesDir ?? join92(import.meta.dir, "stages"));
   const outputs = {};
   let capHit = false, fatal = null;
   if (opts.restored)
@@ -66999,7 +67114,7 @@ ${timeBudgetNote(limitS)}`;
       }
       r = { status: "failed", data: {}, reason: why, killed: true };
       if (name === "implement" && why === "limit") {
-        const ro = outputs.wall?.readOnlyFiles ?? [], reverted = restoreReadOnly(ro).map((f) => relative19(ctx.repoDir, f));
+        const ro = outputs.wall?.readOnlyFiles ?? [], reverted = restoreReadOnly(ro).map((f) => relative20(ctx.repoDir, f));
         outputs.implement = { exit: "killed", limit_s: limitS, elapsed_s: dur(), ...reverted.length ? { tests_reverted: reverted } : {} };
       }
     }
@@ -67037,7 +67152,7 @@ ${timeBudgetNote(limitS)}`;
   const dropSnap = (j10) => {
     j10.snap.then((d) => {
       if (d)
-        rmSync25(d, { recursive: true, force: true });
+        rmSync26(d, { recursive: true, force: true });
     }, () => {});
   };
   const abortWall = () => {
@@ -67100,20 +67215,20 @@ ${timeBudgetNote(limitS)}`;
         else
           try {
             const w = a;
-            mkdirSync48(join91(base, relative19(ctx.repoDir, w.targetDir)), { recursive: true });
+            mkdirSync48(join92(base, relative20(ctx.repoDir, w.targetDir)), { recursive: true });
             for (const [n10, c] of w.contents)
-              writeFileSync46(join91(base, relative19(ctx.repoDir, w.targetDir), n10), c, "utf8");
+              writeFileSync47(join92(base, relative20(ctx.repoDir, w.targetDir), n10), c, "utf8");
             r = j10.split.install(sctx, a, base);
             const changed = hooks.wall.changedSinceBase(ctx.repoDir, ctx.baseSha);
             if (r.status === "completed") {
-              const touched = (changed ?? []).filter((f) => !f.startsWith(".loki/") && !f.startsWith(`${relative19(ctx.repoDir, w.targetDir)}/loki_wall_`));
+              const touched = (changed ?? []).filter((f) => !f.startsWith(".loki/") && !f.startsWith(`${relative20(ctx.repoDir, w.targetDir)}/loki_wall_`));
               const unsure = changed === null || touched.length > 0, d = r.data, b02 = d.base_run;
               const green = typeof b02.pass === "number" && b02.pass > 0 && b02.fail === 0 && (b02.not_run ?? 0) === 0;
               const d12 = unsure && green ? distrustGreenBase(d) : d;
               r = { ...r, data: { ...d12, base_run: { ...d12.base_run, ...changed === null || changed.some((f) => hooks.wall.manifests.test(f)) ? { deps: "head" } : {} } } };
             }
           } finally {
-            rmSync25(base, { recursive: true, force: true });
+            rmSync26(base, { recursive: true, force: true });
           }
       }
     } catch (err) {
@@ -67409,8 +67524,8 @@ __export(exports_worker, {
   main: () => main2,
   assertWorkerEnv: () => assertWorkerEnv
 });
-import { readFileSync as readFileSync83 } from "fs";
-import { join as join92 } from "path";
+import { readFileSync as readFileSync84 } from "fs";
+import { join as join93 } from "path";
 function assertWorkerEnv(env = process.env) {
   if (env.LOKI_ALLOW_AGENT_GITHUB_TOKEN === "1")
     return;
@@ -67440,7 +67555,7 @@ async function main2(args) {
     return 2;
   }
   const repoDir = process.cwd();
-  const lokiRoot = join92(repoDir, ".loki");
+  const lokiRoot = join93(repoDir, ".loki");
   const deep = mode === "deep";
   globalThis[Symbol.for("loki.ownsStopSignals")] = true;
   for (const sig of ["SIGTERM", "SIGINT"])
@@ -67468,7 +67583,7 @@ async function main2(args) {
       externalPatch,
       runId,
       repoDir,
-      runDir: join92(lokiRoot, "runs", runId),
+      runDir: join93(lokiRoot, "runs", runId),
       branch: `loki/${runId}`,
       provider,
       model,
@@ -67482,7 +67597,7 @@ async function main2(args) {
       tests: new RealTestMapProvider,
       cost: {
         read(dir, ids) {
-          const c = sumResultCosts(join92(dir, ".loki"), liveArchivedCosts(join92(dir, ".loki"), ids, UNMETERED));
+          const c = sumResultCosts(join93(dir, ".loki"), liveArchivedCosts(join93(dir, ".loki"), ids, UNMETERED));
           return costTotalsOf(c);
         }
       },
@@ -67492,7 +67607,7 @@ async function main2(args) {
     const resize = deep ? undefined : () => resizeCap(ctx.runDir, loadProjectApi(repoDir), !(Number(parseCapUsd(process.env.LOKI_E10_MAX_COST_USD)) > 0), Number(process.env.LOKI_E10_CAP_FIXED_S) || undefined);
     let flow = FLOW.filter((s) => s !== "pr"), restored;
     if (process.env.LOKI_E10_RESUME === "1") {
-      const p = join92(repoDir, eventsRelPath(runId)), r = (await Promise.resolve().then(() => (init_run_outputs(), exports_run_outputs))).resumeMachineOpts(ctx, readEvents(p), readFileSync83(p, "utf8"), flow);
+      const p = join93(repoDir, eventsRelPath(runId)), r = (await Promise.resolve().then(() => (init_run_outputs(), exports_run_outputs))).resumeMachineOpts(ctx, readEvents(p), readFileSync84(p, "utf8"), flow);
       if (!r.ok) {
         emit("escalated", null, { stop: `resume refused: ${r.reason}` });
         return;
@@ -67538,14 +67653,14 @@ __export(exports_deep, {
   deepStage: () => deepStage,
   DEFAULT_SECRET_SCAN_SH: () => DEFAULT_SECRET_SCAN_SH
 });
-import { existsSync as existsSync66, mkdirSync as mkdirSync49, mkdtempSync as mkdtempSync11, rmSync as rmSync26, writeFileSync as writeFileSync47 } from "fs";
-import { tmpdir as tmpdir14 } from "os";
-import { join as join93 } from "path";
+import { existsSync as existsSync67, mkdirSync as mkdirSync49, mkdtempSync as mkdtempSync12, rmSync as rmSync27, writeFileSync as writeFileSync48 } from "fs";
+import { tmpdir as tmpdir15 } from "os";
+import { join as join94 } from "path";
 function sessionCouncil(sessions) {
   return { async run(input, signal) {
-    const cwd = mkdtempSync11(join93(tmpdir14(), "loki-deep-council-"));
+    const cwd = mkdtempSync12(join94(tmpdir15(), "loki-deep-council-"));
     try {
-      writeFileSync47(join93(cwd, "diff.patch"), input.diff, "utf8");
+      writeFileSync48(join94(cwd, "diff.patch"), input.diff, "utf8");
       const r = await sessions.run({
         stage: "deep",
         tier: "development",
@@ -67567,7 +67682,7 @@ function sessionCouncil(sessions) {
         throw new Error("reviewer reply has no LGTM or FINDING: line");
       return { findings };
     } finally {
-      rmSync26(cwd, { recursive: true, force: true });
+      rmSync27(cwd, { recursive: true, force: true });
     }
   } };
 }
@@ -67615,7 +67730,7 @@ ${r.stderr}`), lr2 = r.exitCode === 0 ? undefined : await harnessLoadReason({ re
 async function runAppBoot(ctx, opts, checks, notProven) {
   let r;
   try {
-    r = await (opts.appProbe ?? appProbe)(ctx.repoDir, join93(ctx.repoDir, ".loki"));
+    r = await (opts.appProbe ?? appProbe)(ctx.repoDir, join94(ctx.repoDir, ".loki"));
   } catch (err) {
     r = { checks: [{ name: "app boot", cmd: "autonomy/app-runner.sh", result: "not_run", duration_s: 0, reason: `app probe threw: ${err.message}` }], pid: null, url: null };
   }
@@ -67662,7 +67777,7 @@ async function runCouncilCheck(ctx, changed, baseSha, signal, opts, checks, notP
 }
 async function runSecretScan(ctx, changed, opts, checks, notProven) {
   const scriptPath = opts.secretScanShPath ?? DEFAULT_SECRET_SCAN_SH, name = "security scan", cmd = "secret-scan.sh + secure-scan.py";
-  if (!existsSync66(scriptPath)) {
+  if (!existsSync67(scriptPath)) {
     checks.push({ name, cmd, result: "not_run", duration_s: 0 });
     notProven.add(`not run: ${name} (secret-scan.sh not found)`);
     return;
@@ -67673,7 +67788,7 @@ async function runSecretScan(ctx, changed, opts, checks, notProven) {
   }
   const inline = 'script="$1"; shift; . "$script" || exit 3; hit=0; for f in "$@"; do if _commit_scan_secret_file "$f" || _commit_path_looks_secret "$f"; then printf "%s\\n" "$f"; hit=1; fi; done; exit "$hit"';
   const started = Date.now();
-  const r = await run(["bash", "-c", inline, "_", scriptPath, ...changed.map((f) => join93(ctx.repoDir, f))], { cwd: ctx.repoDir, timeoutMs: 30000 });
+  const r = await run(["bash", "-c", inline, "_", scriptPath, ...changed.map((f) => join94(ctx.repoDir, f))], { cwd: ctx.repoDir, timeoutMs: 30000 });
   const sec = await secureScanChanged(ctx.repoDir, changed, opts.secureScanPath), gaps = [], reasons = [];
   const hits = r.exitCode === 3 ? [] : r.stdout.split(`
 `).map((l) => l.trim()).filter(Boolean), high = sec.findings.filter((f) => String(f.severity).toUpperCase() === "HIGH");
@@ -67726,7 +67841,7 @@ async function runDeep(ctx, signal, opts = {}) {
   const sig = signReceipt(`${ctx.runId}-deep`, addendumSha256);
   const addendum = { ...addendumBody, addendum_sha256: addendumSha256, verification: { jwt: sig.jwt, kid: sig.kid } };
   mkdirSync49(ctx.runDir, { recursive: true });
-  writeFileSync47(join93(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
+  writeFileSync48(join94(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
 `);
   const headSha = (await safeGitRun(ctx.repoDir, ["rev-parse", "HEAD"], { timeoutMs: 1e4 })).stdout.trim();
   const pushNotProven = await postDeepResults({
@@ -67752,11 +67867,11 @@ async function deepWorker(args, deps = {}) {
 `);
     return 2;
   }
-  const repoDir = process.cwd(), lokiRoot = join93(repoDir, ".loki"), runDir = join93(lokiRoot, "runs", runId);
+  const repoDir = process.cwd(), lokiRoot = join94(repoDir, ".loki"), runDir = join94(lokiRoot, "runs", runId);
   const { readEvents: readEvents2 } = await Promise.resolve().then(() => (init_events(), exports_events)), { eventsRelPath: eventsRelPath2 } = await Promise.resolve().then(() => (init_engine_origin(), exports_engine_origin)), { outputsFromEvents: outputsFromEvents2 } = await Promise.resolve().then(() => (init_run_outputs(), exports_run_outputs));
   let outputs;
   try {
-    outputs = outputsFromEvents2(readEvents2(join93(repoDir, eventsRelPath2(runId))));
+    outputs = outputsFromEvents2(readEvents2(join94(repoDir, eventsRelPath2(runId))));
   } catch (err) {
     process.stderr.write(`engine10 deep-worker: cannot read run events: ${err.message}
 `);
@@ -67846,9 +67961,9 @@ __export(exports_verify, {
   commandFor: () => commandFor,
   changedFiles: () => changedFiles
 });
-import { existsSync as existsSync67, mkdtempSync as mkdtempSync12, readFileSync as readFileSync84, rmSync as rmSync27 } from "fs";
-import { tmpdir as tmpdir15 } from "os";
-import { basename as basename24, isAbsolute as isAbsolute18, join as join94, relative as relative20 } from "path";
+import { existsSync as existsSync68, mkdtempSync as mkdtempSync13, readFileSync as readFileSync85, rmSync as rmSync28 } from "fs";
+import { tmpdir as tmpdir16 } from "os";
+import { basename as basename25, isAbsolute as isAbsolute18, join as join95, relative as relative21 } from "path";
 async function runOnce3(cmd, args, cwd, signal, opts) {
   if (!Bun.which(cmd, { PATH: opts.path ?? process.env["PATH"] ?? "" }))
     return { ok: false, missing: true, cut: false, out: "" };
@@ -67941,7 +68056,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal,
   const zc2 = zeroOk ? un2.filter(({ c, t }) => c.result === "not_run" && !c.owner && (c.reason ?? "").startsWith(NO_TESTS_REASON) && !wall.has(c.name) && !isHoldoutCheck(c.name) && !changed.includes(t.path) && zeroIntake.has(c.name)) : [];
   if (!(un2.some(({ c }) => c.result === "fail" && c.ids?.length) || sus.length || zc2.length) || signal.aborted)
     return out3;
-  const dir = mkdtempSync12(join94(tmpdir15(), "e10-base-"));
+  const dir = mkdtempSync13(join95(tmpdir16(), "e10-base-"));
   const git9 = (args) => {
     safeGit(ctx.repoDir, args, { stdio: "ignore", repoDrivers: true });
   };
@@ -67972,7 +68087,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal,
     try {
       git9(["worktree", "remove", "--force", dir]);
     } catch {}
-    rmSync27(dir, { recursive: true, force: true });
+    rmSync28(dir, { recursive: true, force: true });
     try {
       git9(["worktree", "prune"]);
     } catch {}
@@ -67980,15 +68095,15 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal,
   return out3;
 }
 function isLokiModeRepo(repoDir) {
-  return existsSync67(join94(repoDir, "scripts", "select-tests.sh"));
+  return existsSync68(join95(repoDir, "scripts", "select-tests.sh"));
 }
 function projectDeclaresRuff(repoDir) {
-  if (["ruff.toml", ".ruff.toml"].some((f) => existsSync67(join94(repoDir, f))))
+  if (["ruff.toml", ".ruff.toml"].some((f) => existsSync68(join95(repoDir, f))))
     return true;
   const files = ["pyproject.toml", "setup.cfg", "tox.ini", ".pre-commit-config.yaml", "Pipfile", "requirements.txt", "requirements-dev.txt", "dev-requirements.txt"];
   return files.some((f) => {
     try {
-      return /\bruff\b/i.test(readFileSync84(join94(repoDir, f), "utf8"));
+      return /\bruff\b/i.test(readFileSync85(join95(repoDir, f), "utf8"));
     } catch {
       return false;
     }
@@ -68014,9 +68129,9 @@ async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   }
   for (const g of groupByPackage(api, ctx.repoDir, changed.filter((f) => /\.(ts|tsx|js|jsx)$/.test(f)))) {
     const sfx = g.root === "." ? "" : `:${g.root}`, co = g.root === "." ? opts : { ...opts, cwd: g.cwd };
-    if (existsSync67(join94(g.cwd, "tsconfig.json")))
+    if (existsSync68(join95(g.cwd, "tsconfig.json")))
       await runCheck(ctx, `lint:tsc${sfx}`, "npx", ["--no-install", "tsc", "--noEmit", "-p", "."], signal, checks, { ...co, kind: "static" });
-    if (ESLINT_CONFIGS.some((f) => existsSync67(join94(g.cwd, f)))) {
+    if (ESLINT_CONFIGS.some((f) => existsSync68(join95(g.cwd, f)))) {
       const c = await runCheck(ctx, `lint:eslint${sfx}`, "npx", ["--no-install", "eslint", ...g.rel], signal, checks, { ...co, kind: "static" });
       if (await excuseLint(ctx, signal, c, "eslint", "npx", ["--no-install", "eslint"], g.cwd, g.rel, co))
         pre2.push(c.name);
@@ -68031,7 +68146,7 @@ var CHECK_TIMEOUT_MS = 60000, excerpts, isHold = (c) => isHoldoutCheck(c.name),
   return r.missing || r.cut ? null : r;
 }, base: (f) => {
   try {
-    return safeGit(ctx.repoDir, ["show", `${ctx.baseSha}:${relative20(ctx.repoDir, join94(cwd, f))}`], { stdio: ["ignore", "pipe", "ignore"] });
+    return safeGit(ctx.repoDir, ["show", `${ctx.baseSha}:${relative21(ctx.repoDir, join95(cwd, f))}`], { stdio: ["ignore", "pipe", "ignore"] });
   } catch {
     return null;
   }
@@ -68096,14 +68211,14 @@ var init_verify = __esm(() => {
       const impacted = ctx.tests.impacted(map, changed);
       const changedTestFiles = map.tests.filter((t) => changed.includes(t.path));
       const wall = ctx.outputs().wall ?? {};
-      const wallPaths = new Set((wall.files ?? []).map((f) => isAbsolute18(f.path) ? relative20(ctx.repoDir, f.path) : f.path));
+      const wallPaths = new Set((wall.files ?? []).map((f) => isAbsolute18(f.path) ? relative21(ctx.repoDir, f.path) : f.path));
       const intake = ctx.outputs().intake, repoMap = loadRepoMap(intake?.repomap_ref), relevant2 = ctx.tests.impacted(map, namedFiles(intake?.task ?? "", repoMap));
       const harness = map.runners.length === 0 ? harnessRunners(map.runners, repoMap?.files ?? [], process.env, [...changed, ...wallPaths])[0] : undefined, wallRunners = harness ? [harness] : map.runners;
       const wallTests = [...wallPaths].flatMap((p) => {
         const found = map.tests.find((t) => t.path === p);
         if (found)
           return [found];
-        const runner = guessRunner(basename24(p), wallRunners, p);
+        const runner = guessRunner(basename25(p), wallRunners, p);
         return runner && (runner !== harness || /[._](?:test|spec)\.[cm]?[jt]sx?$/.test(p)) ? [{ runner, path: p }] : [];
       });
       const tests = failedFirst(dedupeTests([...impacted, ...changedTestFiles, ...wallTests, ...relevant2]), ctx.outputs().verify?.checks);
@@ -68204,9 +68319,9 @@ ${x3}` : c.cmd };
       });
       const weakened = [...modifiedRel, ...cfgChanged.map((f) => `test configuration changed: ${f}`), ...preRed.weak.map((n10) => `skipped or fewer tests than base: ${n10}`)];
       const notProven = [...weakened, ...intake?.deps_not_proven ?? [], ...pub.filter((c) => c.name === "holdout" && c.result !== "pass").map((c) => c.result === "not_run" ? "holdout not executed" : "holdout check failed"), ...[...fullNotProven].filter((n10) => !naNote(n10)), ...pub.filter((c) => c.owner === "harness" && c.name !== "holdout").map((c) => `${c.reason} (${c.name}; harness-owned, no fix rounds)`), ...new Set(checks.filter((c) => c.interpreter === "system" && c.result !== "not_run").map((c) => c.name.startsWith("lint:") ? "lint ran on the system ruff" : "tests ran on the system interpreter"))];
-      const wallDropped = [...wallPaths].filter((p) => !wallTests.some((t) => t.path === p));
-      notProven.push(...wallDropped.map((p) => `Wall test not executed: ${p}: ${NO_RUNNER_REASON}`));
-      const wallNames = new Set(wallTests.map(testCheckName)), wallRun = checks.filter((c) => wallNames.has(c.name) || isHold(c)), wallPassed = wallRun.some((c) => c.result === "fail") ? false : wallRun.length > 0 && wallDropped.length === 0 && wallRun.every((c) => c.result === "pass") ? true : undefined;
+      const wallDropped2 = [...wallPaths].filter((p) => !wallTests.some((t) => t.path === p));
+      notProven.push(...wallDropped2.map((p) => `Wall test not executed: ${p}: ${NO_RUNNER_REASON}`));
+      const wallNames = new Set(wallTests.map(testCheckName)), wallRun = checks.filter((c) => wallNames.has(c.name) || isHold(c)), wallPassed = wallRun.some((c) => c.result === "fail") ? false : wallRun.length > 0 && wallDropped2.length === 0 && wallRun.every((c) => c.result === "pass") ? true : undefined;
       return { status: "completed", data: { checks: pub, flaky, ...wallPassed === undefined ? {} : { wall_passed: wallPassed }, failures_grouped: failuresGrouped, holdout_failed: holdoutFailed, changed_files: changed, not_proven: notProven, ...fullNotProven.size ? { not_applicable: [...fullNotProven].filter(naNote).map(naText) } : {}, pre_red: preRed.ids, pre_red_checks: preRed.names, skipped_on_base: preRed.zero, ...attr.line ? { baseline_line: attr.line, introduced_checks: attr.introducedChecks } : {}, test_counts: testCounts, uncovered_changed: uncoveredChanged, target_checks: checks.filter((c) => c.result === "pass" && targetNames.has(c.name)).map((c) => isHold(c) ? "holdout" : c.name), risk } };
     }
   };
@@ -68238,9 +68353,9 @@ __export(exports_wall, {
   BASE_RUN_TIMEOUT_MS: () => BASE_RUN_TIMEOUT_MS
 });
 import { spawnSync as spawnSync10 } from "child_process";
-import { existsSync as existsSync68, mkdirSync as mkdirSync50, mkdtempSync as mkdtempSync13, readFileSync as readFileSync85, readdirSync as readdirSync28, rmSync as rmSync28, writeFileSync as writeFileSync48 } from "fs";
-import { tmpdir as tmpdir16 } from "os";
-import { dirname as dirname38, join as join95, relative as relative21 } from "path";
+import { existsSync as existsSync69, mkdirSync as mkdirSync50, mkdtempSync as mkdtempSync14, readFileSync as readFileSync86, readdirSync as readdirSync28, rmSync as rmSync29, writeFileSync as writeFileSync49 } from "fs";
+import { tmpdir as tmpdir17 } from "os";
+import { dirname as dirname38, join as join96, relative as relative22 } from "path";
 
 class RealBaseTestRunner {
   api;
@@ -68306,10 +68421,10 @@ ${acceptance2.map((a) => `Acceptance: ${a}`).join(`
 function loadTaskText(ctx, fromPrior) {
   if (fromPrior)
     return fromPrior;
-  const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join95(ctx.runDir, "issue.json");
-  if (existsSync68(issueJsonPath)) {
+  const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join96(ctx.runDir, "issue.json");
+  if (existsSync69(issueJsonPath)) {
     try {
-      const issue = JSON.parse(readFileSync85(issueJsonPath, "utf8"));
+      const issue = JSON.parse(readFileSync86(issueJsonPath, "utf8"));
       const text3 = [issue.title, issue.body].filter((s) => typeof s === "string" && s.length > 0).join(`
 
 `);
@@ -68321,7 +68436,7 @@ function loadTaskText(ctx, fromPrior) {
 }
 function wallTargetDir(repoDir, existingTests) {
   const first = existingTests[0];
-  return first ? join95(repoDir, dirname38(first.path)) : join95(repoDir, "tests");
+  return first ? join96(repoDir, dirname38(first.path)) : join96(repoDir, "tests");
 }
 async function wallAuthor(ctx, signal, retry) {
   const done = (result) => ({ kind: "done", result });
@@ -68346,17 +68461,17 @@ async function wallAuthor(ctx, signal, retry) {
     return done({ status: "skipped", data: { size: sz2.size, files: [], no_interpreter: true, not_proven: ["Wall skipped: no project test interpreter"] }, reason: "Wall skipped: no project test interpreter" });
   const tree = prior.intake?.tree;
   const repomapText = repoMapText(ctx.repoDir, tree, repomapRef, WALL_MAP_MAX_LINES);
-  const targetDir = wallTargetDir(ctx.repoDir, existingTests), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative21(ctx.repoDir, targetDir)}/x`);
-  const conv2 = readPackageConventions(join95(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
-  const cwd = mkdtempSync13(join95(tmpdir16(), "loki-e15-wall-"));
+  const targetDir = wallTargetDir(ctx.repoDir, existingTests), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative22(ctx.repoDir, targetDir)}/x`);
+  const conv2 = readPackageConventions(join96(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
+  const cwd = mkdtempSync14(join96(tmpdir17(), "loki-e15-wall-"));
   const wm2 = wallManifestFor(ctx.repoDir, tree, task);
   for (const [n10, c] of [["task.md", task], ["repomap.txt", repomapText], ...wm2 ? [["wall_manifest.txt", wm2.text]] : []])
-    writeFileSync48(join95(cwd, n10), c, "utf8");
+    writeFileSync49(join96(cwd, n10), c, "utf8");
   const clauseSet = extractClauses(task);
   const model = retry?.model ?? wallFirstModel(sz2.size), iterationId = `${ctx.runId}-wall${retry?.suffix ?? ""}`;
   const session = await ctx.sessions.run({
     stage: "wall",
-    brief: buildWallBrief(task, repomapText, runners, !!wm2, conventionsBrief(conv2), unitSpec()?.acceptance ?? [], relative21(ctx.repoDir, targetDir), clauseSet),
+    brief: buildWallBrief(task, repomapText, runners, !!wm2, conventionsBrief(conv2), unitSpec()?.acceptance ?? [], relative22(ctx.repoDir, targetDir), clauseSet),
     tier: "development",
     model,
     iterationId,
@@ -68365,26 +68480,26 @@ async function wallAuthor(ctx, signal, retry) {
     cwd
   });
   if (session.killed || session.exit === null) {
-    rmSync28(cwd, { recursive: true, force: true });
+    rmSync29(cwd, { recursive: true, force: true });
     return done({ status: "failed", data: { iteration_ids: [iterationId], model }, reason: "wall session aborted, killed, or timed out", killed: true });
   }
   const planText = typeof prior.plan?.plan === "string" ? prior.plan.plan : null, repoFiles = repoMap?.files ?? [];
   const oor = () => readdirSync28(cwd).filter((f) => f.startsWith(WALL_PREFIX)).flatMap((name) => {
-    const text3 = readFileSync85(join95(cwd, name), "utf8"), why = outOfRepoTarget(text3) ?? vacuousCheck(name, text3) ?? phantomReason(phantomRepoPaths(text3, name, targetDir, ctx.repoDir, planText), repoFiles, relative21(ctx.repoDir, targetDir), pkg?.root ?? "");
+    const text3 = readFileSync86(join96(cwd, name), "utf8"), why = outOfRepoTarget(text3) ?? vacuousCheck(name, text3) ?? phantomReason(phantomRepoPaths(text3, name, targetDir, ctx.repoDir, planText), repoFiles, relative22(ctx.repoDir, targetDir), pkg?.root ?? "");
     return why ? [{ name, why }] : [];
   });
   const bad1 = oor();
   if (bad1.length > 0 && !signal.aborted && !ctx.overCap?.())
     await ctx.sessions.run({ stage: "wall", brief: withStagePrefix(outOfRepoReask("Rewrite these Wall files in place, keeping the same names and acceptance coverage.", bad1)), tier: "development", model, iterationId: `${iterationId}-oor`, limitS: wallLimitS(sz2.size), signal, cwd });
-  const oorBad = new Map(oor().map((b) => [b.name, b.why])), all = readdirSync28(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n10) => !oorBad.has(n10) && !conventionViolation(conv2, n10, readFileSync85(join95(cwd, n10), "utf8"))), runnerOf: (n10) => guessRunner(n10, runners) }), generated = all.filter((n10) => !held?.names.has(n10));
-  const sealedDir = join95(ctx.runDir, "wall");
+  const oorBad = new Map(oor().map((b) => [b.name, b.why])), all = readdirSync28(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n10) => !oorBad.has(n10) && !conventionViolation(conv2, n10, readFileSync86(join96(cwd, n10), "utf8"))), runnerOf: (n10) => guessRunner(n10, runners) }), generated = all.filter((n10) => !held?.names.has(n10));
+  const sealedDir = join96(ctx.runDir, "wall");
   if (generated.length > 0)
     mkdirSync50(sealedDir, { recursive: true });
   const contents = new Map;
   const discarded = [];
   for (const name of generated) {
-    const content = readFileSync85(join95(cwd, name), "utf8"), oorWhy = oorBad.get(name), bad = oorWhy ?? conventionViolation(conv2, name, content);
-    writeFileSync48(join95(sealedDir, name), content, "utf8");
+    const content = readFileSync86(join96(cwd, name), "utf8"), oorWhy = oorBad.get(name), bad = oorWhy ?? conventionViolation(conv2, name, content);
+    writeFileSync49(join96(sealedDir, name), content, "utf8");
     if (oorWhy)
       discarded.push({ file: name, reason: `${oorWhy}; wall test discarded after one rewrite request` });
     else if (bad)
@@ -68392,7 +68507,7 @@ async function wallAuthor(ctx, signal, retry) {
     else
       contents.set(name, content);
   }
-  rmSync28(cwd, { recursive: true, force: true });
+  rmSync29(cwd, { recursive: true, force: true });
   return { kind: "authored", model, iterationId, task, sizeName: sz2.size, runners, targetDir, generated, contents, discarded, ...clauseSet.clauses.length ? { clauses: clauseSet } : {}, ...wm2 ? { manifestSha256: wm2.sha256 } : {}, ...held ? { holdoutDir: held.dir } : {} };
 }
 function installWall(ctx, a, baseDir, opts = {}) {
@@ -68413,30 +68528,30 @@ function* installCore(ctx, a, baseDir, opts) {
     const content = contents.get(name);
     if (content === undefined)
       continue;
-    const dest = join95(targetDir, name), runner = guessRunner(name, runners, relative21(ctx.repoDir, dest));
-    writeFileSync48(dest, content, "utf8");
+    const dest = join96(targetDir, name), runner = guessRunner(name, runners, relative22(ctx.repoDir, dest));
+    writeFileSync49(dest, content, "utf8");
     sealedFiles.push({ path: dest, sha256: sha2562(content) });
     readOnlyFiles.push({ path: dest, content });
     if (runner)
-      wallTests.push({ runner, path: relative21(ctx.repoDir, dest) });
+      wallTests.push({ runner, path: relative22(ctx.repoDir, dest) });
   }
   ctx.wallSealed = true;
   ctx.emit("wall.sealed", "wall", { files: sealedFiles, ...a.manifestSha256 ? { manifest_sha256: a.manifestSha256 } : {} });
   const baseRunner = opts.baseRunner ?? new RealBaseTestRunner, baseRun = { pass: 0, fail: 0, not_run: discarded.length }, notRunFiles = [];
   for (const f of sealedFiles) {
-    const rel = relative21(ctx.repoDir, f.path);
+    const rel = relative22(ctx.repoDir, f.path);
     if (!wallTests.some((t) => t.path === rel))
       notRunFiles.push({ file: rel, reason: NO_RUNNER_REASON });
   }
   const each = yield { runner: baseRunner, tests: wallTests };
   for (const [i, t] of wallTests.entries()) {
-    const e10 = each?.[i], r = e10 ?? baseRunner.run(baseDir, [t]), abs = join95(ctx.repoDir, t.path);
+    const e10 = each?.[i], r = e10 ?? baseRunner.run(baseDir, [t]), abs = join96(ctx.repoDir, t.path);
     baseRun.pass += r.pass;
     baseRun.fail += r.fail;
     baseRun.not_run += r.not_run ?? 0;
     notRunFiles.push(...e10 ? e10.notRunFiles : baseRunner.lastNotRunFiles ?? []);
     if (r.pass + r.fail === 0) {
-      rmSync28(abs, { force: true });
+      rmSync29(abs, { force: true });
       for (const l of [sealedFiles, readOnlyFiles])
         l.splice(0, l.length, ...l.filter((f) => f.path !== abs));
     }
@@ -68472,8 +68587,8 @@ async function runWall(ctx, signal, opts = {}) {
     return green ? { ...first, data: distrustGreenBase(first.data) } : first;
   if (a.kind === "authored") {
     for (const f of first.data.files ?? [])
-      rmSync28(f.path, { force: true });
-    rmSync28(join95(ctx.runDir, "wall"), { recursive: true, force: true });
+      rmSync29(f.path, { force: true });
+    rmSync29(join96(ctx.runDir, "wall"), { recursive: true, force: true });
     ctx.wallSealed = false;
   }
   removeHoldout(ctx.runId, ctx.repoDir);
@@ -68513,15 +68628,15 @@ var init_wall = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/discard.ts
-import { chmodSync as chmodSync6, closeSync as closeSync13, lstatSync as lstatSync24, mkdirSync as mkdirSync51, openSync as openSync13, readFileSync as readFileSync86, realpathSync as realpathSync29, rmdirSync, unlinkSync as unlinkSync9, writeFileSync as writeFileSync49 } from "fs";
-import { dirname as dirname39, join as join96, relative as relative22, sep as sep19 } from "path";
+import { chmodSync as chmodSync6, closeSync as closeSync13, lstatSync as lstatSync24, mkdirSync as mkdirSync51, openSync as openSync13, readFileSync as readFileSync87, realpathSync as realpathSync29, rmdirSync, unlinkSync as unlinkSync9, writeFileSync as writeFileSync50 } from "fs";
+import { dirname as dirname39, join as join97, relative as relative23, sep as sep19 } from "path";
 function safeRestore(repoDir, f, want, mode) {
-  const root = realpathSync29(repoDir), fp2 = join96(root, f), rel = relative22(root, dirname39(fp2));
+  const root = realpathSync29(repoDir), fp2 = join97(root, f), rel = relative23(root, dirname39(fp2));
   if (rel.startsWith(".."))
     throw new Error("outside repo");
   let cur = root;
   for (const part of rel === "" ? [] : rel.split(sep19)) {
-    cur = join96(cur, part);
+    cur = join97(cur, part);
     let st3;
     try {
       st3 = lstatSync24(cur);
@@ -68538,7 +68653,7 @@ function safeRestore(repoDir, f, want, mode) {
   } catch {
     st2 = null;
   }
-  if (st2?.isFile() && readFileSync86(fp2).equals(want)) {
+  if (st2?.isFile() && readFileSync87(fp2).equals(want)) {
     chmodSync6(fp2, mode);
     return;
   }
@@ -68550,7 +68665,7 @@ function safeRestore(repoDir, f, want, mode) {
   }
   const fd2 = openSync13(fp2, "wx", mode);
   try {
-    writeFileSync49(fd2, want);
+    writeFileSync50(fd2, want);
   } finally {
     closeSync13(fd2);
   }
@@ -68575,7 +68690,7 @@ async function discardIfSatisfied(git9, base, o, staged, keep, repoDir) {
     return { status: "failed", data: {}, reason: "already-satisfied discard failed" };
   const notProven = [];
   for (const [f, v3] of Object.entries(o.intake?.preexisting_untracked_blobs ?? {})) {
-    const fp2 = join96(repoDir, f);
+    const fp2 = join97(repoDir, f);
     try {
       if (v3.startsWith("!")) {
         const st2 = lstatSync24(fp2);
@@ -68594,7 +68709,7 @@ async function discardIfSatisfied(git9, base, o, staged, keep, repoDir) {
       try {
         let m = 420;
         try {
-          const l = lstatSync24(join96(repoDir, f));
+          const l = lstatSync24(join97(repoDir, f));
           if (l.isFile())
             m = l.mode & 511;
         } catch {}
@@ -68610,7 +68725,7 @@ var init_discard = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/scope.ts
-import { basename as basename25, dirname as dirname40 } from "path";
+import { basename as basename26, dirname as dirname40 } from "path";
 function contractText(o) {
   const c = o.intake?.contract_snapshot?.contract;
   return Array.isArray(c?.criteria) ? c.criteria.map((x3) => typeof x3?.text === "string" ? x3.text : "").join(`
@@ -68625,7 +68740,7 @@ function outsideScope(o, staged) {
 ${typeof o.intake?.task === "string" ? o.intake.task : ""}
 ${contractText(o)}`, pre2 = o.intake?.preexisting_dirty ?? {};
   const toks = surfaceTokens(text3), plannedDirs = new Set(rel.map((r) => dirname40(r)).filter((d) => d !== "."));
-  return staged.filter(({ st: st2, f }) => st2 !== "A" && !isTestFile(f) && !Object.hasOwn(pre2, f) && !rel.includes(f) && !mentions(text3, f) && !mentions(text3, basename25(f)) && !plannedDirs.has(dirname40(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
+  return staged.filter(({ st: st2, f }) => st2 !== "A" && !isTestFile(f) && !Object.hasOwn(pre2, f) && !rel.includes(f) && !mentions(text3, f) && !mentions(text3, basename26(f)) && !plannedDirs.has(dirname40(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
 }
 function flagOutsideScope(o, staged) {
   const unit = unitFlags(staged, process.env, o.intake?.preexisting_dirty ?? {});
@@ -68640,14 +68755,14 @@ var init_scope2 = __esm(() => {
 });
 
 // ../../loki-ts/src/council/role_agents.ts
-import { existsSync as existsSync69, readdirSync as readdirSync29, readFileSync as readFileSync87 } from "fs";
+import { existsSync as existsSync70, readdirSync as readdirSync29, readFileSync as readFileSync88 } from "fs";
 import { homedir as homedir11 } from "os";
-import { join as join97 } from "path";
+import { join as join98 } from "path";
 function agentDirs(repoDir, env = process.env) {
-  return [env["LOKI_AGENTS_PROJECT_DIR"] || join97(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join97(env["XDG_CONFIG_HOME"] || join97(homedir11(), ".config"), "loki", "agents")];
+  return [env["LOKI_AGENTS_PROJECT_DIR"] || join98(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join98(env["XDG_CONFIG_HOME"] || join98(homedir11(), ".config"), "loki", "agents")];
 }
 function parseAgent(file, stem2) {
-  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync87(file, "utf8"));
+  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync88(file, "utf8"));
   if (!m)
     return null;
   const body = m[2].trim();
@@ -68661,7 +68776,7 @@ function parseAgent(file, stem2) {
 }
 function loadRoleAgent(repoDir, role, env = process.env) {
   for (const d of agentDirs(repoDir, env)) {
-    if (!existsSync69(d))
+    if (!existsSync70(d))
       continue;
     let names;
     try {
@@ -68672,7 +68787,7 @@ function loadRoleAgent(repoDir, role, env = process.env) {
     const ordered = [...names.filter((n10) => n10 === `${role}.md`), ...names.filter((n10) => n10 !== `${role}.md`)];
     for (const n10 of ordered) {
       try {
-        const a = parseAgent(join97(d, n10), n10.slice(0, -3));
+        const a = parseAgent(join98(d, n10), n10.slice(0, -3));
         if (a && a.role === role)
           return a;
       } catch {}
@@ -68691,11 +68806,11 @@ function explicitReview(repoDir, env) {
   if (flag && isOff(ev2))
     return "off";
   for (const f of ["loki.yaml", "loki.yml"]) {
-    const p = join97(repoDir, f);
-    if (!existsSync69(p))
+    const p = join98(repoDir, f);
+    if (!existsSync70(p))
       continue;
     try {
-      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync87(p, "utf8"));
+      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync88(p, "utf8"));
       const v3 = asProvider(m?.[1]);
       if (v3)
         return v3;
@@ -68728,7 +68843,7 @@ var init_role_agents = __esm(() => {
 
 // ../../loki-ts/src/util/child_ledger.ts
 import { appendFileSync as appendFileSync10, mkdirSync as mkdirSync52 } from "fs";
-import { join as join98 } from "path";
+import { join as join99 } from "path";
 function unmeasuredRecord(phase, model, source) {
   return { phase, model, input_tokens: 0, output_tokens: 0, cache_creation_tokens: 0, cache_read_tokens: 0, source, cost_status: "unmeasured" };
 }
@@ -68753,9 +68868,9 @@ function recordFromClaudeResult(phase, payload, source = "claude-json") {
 }
 function appendChildLedger(lokiDir2, rec2) {
   try {
-    const dir = join98(lokiDir2, "metrics");
+    const dir = join99(lokiDir2, "metrics");
     mkdirSync52(dir, { recursive: true });
-    appendFileSync10(join98(dir, "child-sessions.jsonl"), `${JSON.stringify(rec2)}
+    appendFileSync10(join99(dir, "child-sessions.jsonl"), `${JSON.stringify(rec2)}
 `);
     return true;
   } catch {
@@ -68785,7 +68900,7 @@ var init_child_ledger = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/xreview.ts
-import { join as join99 } from "path";
+import { join as join100 } from "path";
 function minVerdict(verdict, review) {
   const ceiling = review?.level === "block" ? "PARTIAL" : verdict;
   return RANK4[ceiling] < RANK4[verdict] ? ceiling : verdict;
@@ -68883,9 +68998,9 @@ Review ONLY the diff below. Do not modify files.` : "You are an independent code
   try {
     if (p === "claude")
       await ensureClaudeHelpCache();
-    const r = await withChildLedger(run, join99(ctx.repoDir, ".loki"), "xreview")(reviewArgv(p, prompt, process.env, p === "claude" ? agent?.model || pin : undefined), { cwd: ctx.repoDir, timeoutMs: boxFor(ctx) * 1000, group: true, signal });
+    const r = await withChildLedger(run, join100(ctx.repoDir, ".loki"), "xreview")(reviewArgv(p, prompt, process.env, p === "claude" ? agent?.model || pin : undefined), { cwd: ctx.repoDir, timeoutMs: boxFor(ctx) * 1000, group: true, signal });
     const costId = `${ctx.runId}-xreview-${p}`;
-    writeReviewerCost(join99(ctx.repoDir, ".loki"), costId, { reviewer: `xreview-${p}`, provider: p, model: p === "claude" ? agent?.model || pin : undefined, stdout: r.stdout, stderr: r.stderr });
+    writeReviewerCost(join100(ctx.repoDir, ".loki"), costId, { reviewer: `xreview-${p}`, provider: p, model: p === "claude" ? agent?.model || pin : undefined, stdout: r.stdout, stderr: r.stderr });
     if (r.exitCode !== 0)
       return { ...tag({ provider: p, level: "not_run", notes: [`cross-review not run: ${p} exited ${r.exitCode}`] }), cost_iteration: costId };
     return { ...tag(parseReview(p, r.stdout)), cost_iteration: costId };
@@ -69066,10 +69181,10 @@ __export(exports_contract, {
   MAX_CONTRACT_BYTES: () => MAX_CONTRACT_BYTES,
   CONSTRAINT_KINDS: () => CONSTRAINT_KINDS
 });
-import { existsSync as existsSync70, lstatSync as lstatSync25, mkdirSync as mkdirSync53, readFileSync as readFileSync88, rmSync as rmSync29, writeFileSync as writeFileSync50 } from "fs";
+import { existsSync as existsSync71, lstatSync as lstatSync25, mkdirSync as mkdirSync53, readFileSync as readFileSync89, rmSync as rmSync30, writeFileSync as writeFileSync51 } from "fs";
 import { spawnSync as spawnSync11 } from "child_process";
-import { dirname as dirname41, join as join100 } from "path";
-import { createHash as createHash27 } from "crypto";
+import { dirname as dirname41, join as join101 } from "path";
+import { createHash as createHash28 } from "crypto";
 function contractEnabled(env = process.env) {
   return env["LOKI_CONTRACT"] !== "0";
 }
@@ -69135,7 +69250,7 @@ function assignCriteria(units, criteria2) {
   return { units: out3, orphans: criteria2.filter((c) => !owned.has(c.id)) };
 }
 function groupContractPath(repoDir, groupId) {
-  return join100(repoDir, ".loki", "groups", groupId.replace(/[^A-Za-z0-9._-]/g, "_"), "contract.json");
+  return join101(repoDir, ".loki", "groups", groupId.replace(/[^A-Za-z0-9._-]/g, "_"), "contract.json");
 }
 function freezeGroupContract(repoDir, groupId, units, contract) {
   const a = assignCriteria(units, contract.criteria);
@@ -69200,7 +69315,7 @@ function untracedLines(trace) {
   return trace.criteria.filter((c) => c.status === "no_match").map((c) => `contract ${sanitizeCriterion(c.id)} untraced (no keyword match in changed files): ${sanitizeCriterion(c.text)}`);
 }
 function contractPath(repoDir) {
-  return join100(repoDir, ".loki", "contract.json");
+  return join101(repoDir, ".loki", "contract.json");
 }
 function readContract(repoDir) {
   const p = contractPath(repoDir);
@@ -69216,11 +69331,11 @@ function readContract(repoDir) {
     return { contract: null, notes: ["contract unreadable: too large"], sha256: null };
   let raw2;
   try {
-    raw2 = readFileSync88(p);
+    raw2 = readFileSync89(p);
   } catch {
     return { contract: null, notes: ["contract unreadable: read failed"], sha256: null };
   }
-  const sha2563 = createHash27("sha256").update(raw2).digest("hex");
+  const sha2563 = createHash28("sha256").update(raw2).digest("hex");
   let j10;
   try {
     j10 = JSON.parse(raw2.toString("utf8"));
@@ -69283,15 +69398,15 @@ function main3(args) {
 `);
     return file ? 0 : 2;
   }
-  if (!existsSync70(file)) {
+  if (!existsSync71(file)) {
     process.stderr.write(`contract: no such file: ${file}
 `);
     return 2;
   }
-  const contract = parseContract(readFileSync88(file, "utf8"), file);
+  const contract = parseContract(readFileSync89(file, "utf8"), file);
   const out3 = contractPath(repoRoot(process.cwd()));
   mkdirSync53(dirname41(out3), { recursive: true });
-  writeFileSync50(out3, JSON.stringify(contract, null, 2) + `
+  writeFileSync51(out3, JSON.stringify(contract, null, 2) + `
 `);
   process.stdout.write(renderContract(contract));
   return 0;
@@ -69347,8 +69462,8 @@ function fromSpecText(raw2) {
   }
 }
 function fromPrdText(text3, python = "python3") {
-  const script = join100(REPO_ROOT, "autonomy", "lib", "requirements_contract.py");
-  if (!existsSync70(script))
+  const script = join101(REPO_ROOT, "autonomy", "lib", "requirements_contract.py");
+  if (!existsSync71(script))
     return null;
   const code = `import sys,json,importlib.util as u
 s=u.spec_from_file_location('rc',sys.argv[1]);m=u.module_from_spec(s);sys.modules['rc']=m;s.loader.exec_module(m)
@@ -69390,12 +69505,12 @@ function mapRequirements(reqs, ran2, revision) {
   return { version: 1, revision, requirements: out3 };
 }
 function fromChecklist(lokiDir2) {
-  const p = join100(lokiDir2, "checklist", "checklist.json");
-  if (!existsSync70(p))
+  const p = join101(lokiDir2, "checklist", "checklist.json");
+  if (!existsSync71(p))
     return null;
   let doc;
   try {
-    doc = JSON.parse(readFileSync88(p, "utf8"));
+    doc = JSON.parse(readFileSync89(p, "utf8"));
   } catch {
     return null;
   }
@@ -69427,7 +69542,7 @@ function writeRequirementsMap(repoDir, lokiDir2, reqs, ran2) {
     if (!reqs || reqs.length === 0)
       return null;
     const m = mapRequirements(reqs, ran2, currentRevision(repoDir));
-    atomicWriteJson(join100(lokiDir2, "state", "requirements-map.json"), m);
+    atomicWriteJson(join101(lokiDir2, "state", "requirements-map.json"), m);
     return m;
   } catch {
     return null;
@@ -69439,20 +69554,20 @@ function writeFromChecklist(repoDir, lokiDir2) {
 }
 function writeFromEngine10(repoDir, lokiDir2, runDir, task, events2) {
   let reqs = null;
-  const snap = join100(runDir, "spec.snapshot.md");
-  if (existsSync70(snap)) {
+  const snap = join101(runDir, "spec.snapshot.md");
+  if (existsSync71(snap)) {
     try {
-      reqs = fromSpecText(readFileSync88(snap, "utf8"));
+      reqs = fromSpecText(readFileSync89(snap, "utf8"));
     } catch {
       reqs = null;
     }
   }
   if (!reqs && task)
     reqs = fromPrdText(task);
-  const mapPath = join100(lokiDir2, "state", "requirements-map.json");
+  const mapPath = join101(lokiDir2, "state", "requirements-map.json");
   if (!reqs || reqs.length === 0) {
     try {
-      rmSync29(mapPath, { force: true });
+      rmSync30(mapPath, { force: true });
     } catch {}
     return null;
   }
@@ -69465,7 +69580,7 @@ function writeFromEngine10(repoDir, lokiDir2, runDir, task, events2) {
   const m = writeRequirementsMap(repoDir, lokiDir2, reqs, [...last.values()]);
   if (!m) {
     try {
-      rmSync29(mapPath, { force: true });
+      rmSync30(mapPath, { force: true });
     } catch {}
   }
   return m;
@@ -69475,7 +69590,7 @@ function uncoveredCount(m) {
 }
 function readRequirementsMap(lokiDir2) {
   try {
-    const m = JSON.parse(readFileSync88(join100(lokiDir2, "state", "requirements-map.json"), "utf8"));
+    const m = JSON.parse(readFileSync89(join101(lokiDir2, "state", "requirements-map.json"), "utf8"));
     return m.version === 1 && Array.isArray(m.requirements) ? m : null;
   } catch {
     return null;
@@ -69503,18 +69618,18 @@ var init_contract = __esm(() => {
   BULLET = /^\s*(?:[-*+]|\d+[.)])\s+(.+)$/;
   STOP3 = new Set(["the", "and", "for", "with", "that", "this", "must", "should", "shall", "when", "then", "are", "was", "all", "any", "can", "not", "has", "have", "from", "into", "each", "user", "users"]);
   MAX_CONTRACT_BYTES = 1024 * 1024;
-  REQ_MAP_REL = join100(".loki", "state", "requirements-map.json");
+  REQ_MAP_REL = join101(".loki", "state", "requirements-map.json");
   REQ_STOP = new Set(["with", "that", "this", "from", "have", "will", "should", "must", "when", "then", "into", "each", "every", "user", "users", "page", "able", "allow", "support", "ensure", "using", "their", "there", "which", "shall"]);
   LINK_RE = /\s*\[checks?:\s*([^\]]+)\]\s*$/i;
 });
 
 // ../../loki-ts/src/features/speed/seal_group.ts
-import { createHash as createHash28 } from "crypto";
-import { existsSync as existsSync71, mkdirSync as mkdirSync54, readdirSync as readdirSync30, readFileSync as readFileSync89, renameSync as renameSync20, statSync as statSync26, writeFileSync as writeFileSync51 } from "fs";
-import { dirname as dirname42, join as join101 } from "path";
+import { createHash as createHash29 } from "crypto";
+import { existsSync as existsSync72, mkdirSync as mkdirSync54, readdirSync as readdirSync30, readFileSync as readFileSync90, renameSync as renameSync20, statSync as statSync26, writeFileSync as writeFileSync52 } from "fs";
+import { dirname as dirname42, join as join102 } from "path";
 function sealGroup(runDir, rh) {
-  const manifestPath = join101(runDir, "group", "manifest.json");
-  if (!existsSync71(manifestPath))
+  const manifestPath = join102(runDir, "group", "manifest.json");
+  if (!existsSync72(manifestPath))
     return { section: undefined, notProven: [], problems: 0, allUnitsPass: true };
   const notProven = [];
   let problems = 0;
@@ -69538,10 +69653,10 @@ function sealGroup(runDir, rh) {
       return fail2(`unit ${index2} has an invalid, duplicate or case-colliding id`);
     seen.add(id2);
     seenLower.add(id2.toLowerCase());
-    const dir = join101(unitsDir(runDir), id2), rp = join101(dir, "receipt.json"), ep2 = join101(dir, "events.jsonl");
+    const dir = join102(unitsDir(runDir), id2), rp = join102(dir, "receipt.json"), ep2 = join102(dir, "events.jsonl");
     let bytes;
     try {
-      bytes = readFileSync89(rp);
+      bytes = readFileSync90(rp);
     } catch {
       return fail2(`unit ${id2} sub-receipt missing`);
     }
@@ -69560,7 +69675,7 @@ function sealGroup(runDir, rh) {
       unit_id: id2,
       sub_receipt_sha256: sha4(bytes),
       receipt_sha256: sub["receipt_sha256"],
-      events_file_sha256: existsSync71(ep2) ? sha4(readFileSync89(ep2)) : null,
+      events_file_sha256: existsSync72(ep2) ? sha4(readFileSync90(ep2)) : null,
       verdict,
       goal: text3(u10["goal"], 200),
       files: (Array.isArray(u10["files"]) ? u10["files"] : []).map((f) => text3(f, 200)).filter(Boolean).slice(0, 50),
@@ -69585,7 +69700,7 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
   const bad = (reason) => ({ verdict: "TAMPERED", reason: `group: ${reason}` });
   const g = receipt["group"];
   if (g === undefined)
-    return existsSync71(join101(runDir, "group", "manifest.json")) ? bad("group directory present but the receipt has no group section") : null;
+    return existsSync72(join102(runDir, "group", "manifest.json")) ? bad("group directory present but the receipt has no group section") : null;
   if (!isObj10(g) || !ID_RE.test(String(g["group_id"] ?? "")) || !Array.isArray(g["units"]) || g["units"].length === 0)
     return bad("group section malformed");
   const entries = g["units"];
@@ -69597,20 +69712,20 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
     return bad("unit directories do not match the receipt (missing or extra unit)");
   let unchecked = null;
   for (let i = 0;i < entries.length; i++) {
-    const e10 = entries[i], id2 = ids[i], dir = join101(unitsDir(runDir), id2), rp = join101(dir, "receipt.json"), ep2 = join101(dir, "events.jsonl");
+    const e10 = entries[i], id2 = ids[i], dir = join102(unitsDir(runDir), id2), rp = join102(dir, "receipt.json"), ep2 = join102(dir, "events.jsonl");
     if (e10["index"] !== i)
       return bad(`unit ${id2} is out of order (index ${String(e10["index"])} at position ${i})`);
     let bytes;
     try {
       if (!statSync26(dir).isDirectory())
         return bad(`unit ${id2} is not a directory`);
-      bytes = readFileSync89(rp);
+      bytes = readFileSync90(rp);
     } catch {
       return bad(`unit ${id2} sub-receipt missing`);
     }
     if (sha4(bytes) !== e10["sub_receipt_sha256"])
       return bad(`unit ${id2} sub-receipt does not match its recorded hash`);
-    const evSha = existsSync71(ep2) ? sha4(readFileSync89(ep2)) : null;
+    const evSha = existsSync72(ep2) ? sha4(readFileSync90(ep2)) : null;
     if (evSha !== (e10["events_file_sha256"] ?? null))
       return bad(`unit ${id2} events.jsonl does not match its recorded hash`);
     const sub = readJson7(rp);
@@ -69639,9 +69754,9 @@ function composeGroupReceipt(groupDir, rh, o) {
   const body = { schema: GROUP_SCHEMA, run_id: gid, verdict, base_sha: o.baseRef, head_sha: o.head, not_proven: seal.notProven, group: seal.section };
   const hash = rh(body), sig = signReceipt(gid, hash);
   const receipt = { ...body, receipt_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } };
-  const path = join101(groupDir, "receipt.json"), tmp = `${path}.${process.pid}.tmp`;
+  const path = join102(groupDir, "receipt.json"), tmp = `${path}.${process.pid}.tmp`;
   mkdirSync54(groupDir, { recursive: true });
-  writeFileSync51(tmp, JSON.stringify(receipt, null, 2) + `
+  writeFileSync52(tmp, JSON.stringify(receipt, null, 2) + `
 `);
   renameSync20(tmp, path);
   return { path, receipt };
@@ -69651,9 +69766,9 @@ function compositeVerdict(childVerdicts) {
   const failed2 = childVerdicts.filter((v3) => v3 === "FAILED" || !["VERIFIED", "ALREADY_SATISFIED", "PARTIAL", "SPEC_CONFLICT"].includes(v3)).length;
   return capGroupVerdict(base, { section: undefined, notProven: [], problems: failed2, allUnitsPass: childVerdicts.every((v3) => PASSING.has(v3)) });
 }
-var ID_RE, PASSING, sha4 = (b) => createHash28("sha256").update(b).digest("hex"), isObj10 = (v3) => v3 !== null && typeof v3 === "object" && !Array.isArray(v3), text3 = (v3, cap) => typeof v3 === "string" ? v3.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v3) => typeof v3 === "number" && Number.isFinite(v3) && v3 >= 0 ? v3 : 0, unitsDir = (runDir) => join101(runDir, "group", "units"), readJson7 = (p) => {
+var ID_RE, PASSING, sha4 = (b) => createHash29("sha256").update(b).digest("hex"), isObj10 = (v3) => v3 !== null && typeof v3 === "object" && !Array.isArray(v3), text3 = (v3, cap) => typeof v3 === "string" ? v3.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v3) => typeof v3 === "number" && Number.isFinite(v3) && v3 >= 0 ? v3 : 0, unitsDir = (runDir) => join102(runDir, "group", "units"), readJson7 = (p) => {
   try {
-    return JSON.parse(readFileSync89(p, "utf8"));
+    return JSON.parse(readFileSync90(p, "utf8"));
   } catch {
     return;
   }
@@ -69671,8 +69786,8 @@ var init_seal_group = __esm(() => {
 });
 
 // ../../loki-ts/src/supply/supply_guard.ts
-import { existsSync as existsSync72, readFileSync as readFileSync90, statSync as statSync27 } from "fs";
-import { basename as basename26, join as join102 } from "path";
+import { existsSync as existsSync73, readFileSync as readFileSync91, statSync as statSync27 } from "fs";
+import { basename as basename27, join as join103 } from "path";
 function supplyEnabled(env) {
   return env["LOKI_SUPPLY_GUARD"] !== "0";
 }
@@ -69684,16 +69799,16 @@ function supplyVerdict(verdict, r) {
   return r.blocked && verdict === "VERIFIED" ? "FAILED" : verdict;
 }
 function isManifestPath(path) {
-  return MANIFESTS2.test(basename26(path));
+  return MANIFESTS2.test(basename27(path));
 }
 function readDeclared(repoDir) {
-  const p = join102(repoDir, ".loki", DECLARED_FILE);
-  if (!existsSync72(p))
+  const p = join103(repoDir, ".loki", DECLARED_FILE);
+  if (!existsSync73(p))
     return { deps: [], problem: null };
   try {
     if (statSync27(p).size > MAX_FILE_BYTES)
       return { deps: [], problem: "declaration file too large" };
-    const j10 = JSON.parse(readFileSync90(p, "utf8"));
+    const j10 = JSON.parse(readFileSync91(p, "utf8"));
     if (!Array.isArray(j10))
       return { deps: [], problem: "declaration is not a JSON array" };
     const deps = [];
@@ -69713,11 +69828,11 @@ function readDeclared(repoDir) {
   }
 }
 function readAllowlist(repoDir) {
-  const p = join102(repoDir, ".loki", "supply-allowlist");
-  if (!existsSync72(p))
+  const p = join103(repoDir, ".loki", "supply-allowlist");
+  if (!existsSync73(p))
     return new Set;
   try {
-    return new Set(readFileSync90(p, "utf8").split(`
+    return new Set(readFileSync91(p, "utf8").split(`
 `).map((l) => l.replace(/#.*$/, "").trim()).filter(Boolean));
   } catch {
     return new Set;
@@ -69758,7 +69873,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "npm") {
     if (privateUrlList([env["npm_config_registry"] ?? "", env["NPM_CONFIG_REGISTRY"] ?? ""]))
       return true;
-    return files(join102(repoDir, ".npmrc"), home ? join102(home, ".npmrc") : "").some((t) => t.split(`
+    return files(join103(repoDir, ".npmrc"), home ? join103(home, ".npmrc") : "").some((t) => t.split(`
 `).some((l) => {
       const m = /^\s*(?:(@[^:\s]+):)?registry\s*=\s*(\S+)/.exec(l);
       return !!m && privateUrl(m[2]) && (m[1] === undefined || name.startsWith(`${m[1]}/`));
@@ -69767,7 +69882,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "pypi") {
     if (privateUrlList([env["PIP_INDEX_URL"] ?? "", env["PIP_EXTRA_INDEX_URL"] ?? ""]))
       return true;
-    const cfg = [env["PIP_CONFIG_FILE"] ?? "", home ? join102(home, ".config", "pip", "pip.conf") : "", home ? join102(home, ".pip", "pip.conf") : "", join102(repoDir, "pip.conf")];
+    const cfg = [env["PIP_CONFIG_FILE"] ?? "", home ? join103(home, ".config", "pip", "pip.conf") : "", home ? join103(home, ".pip", "pip.conf") : "", join103(repoDir, "pip.conf")];
     return files(...cfg).some((t) => t.split(`
 `).some((l) => {
       const m = /^\s*(?:extra-)?index-url\s*[=:]\s*(.+)$/.exec(l);
@@ -69777,7 +69892,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "cargo") {
     if (Object.keys(env).some((k3) => /^CARGO_REGISTRIES_.+_INDEX$/.test(k3) || /^CARGO_SOURCE_/.test(k3)))
       return true;
-    return files(join102(repoDir, ".cargo", "config.toml"), join102(repoDir, ".cargo", "config"), home ? join102(home, ".cargo", "config.toml") : "", home ? join102(home, ".cargo", "config") : "").some((t) => /^\s*\[(registries\.|source\.)/m.test(t) || /replace-with\s*=/.test(t));
+    return files(join103(repoDir, ".cargo", "config.toml"), join103(repoDir, ".cargo", "config"), home ? join103(home, ".cargo", "config.toml") : "", home ? join103(home, ".cargo", "config") : "").some((t) => /^\s*\[(registries\.|source\.)/m.test(t) || /replace-with\s*=/.test(t));
   }
   if (eco === "go") {
     const gp2 = goEnv["GOPROXY"] ?? env["GOPROXY"] ?? "";
@@ -69900,7 +70015,7 @@ var MIN_AGE_DAYS = 7, DECLARED_FILE = "supply-declared.json", MAX_CHECKED = 50,
   }
 }, PUBLIC_HOSTS, hostOf = (u10) => u10.trim().toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^www\./, "").split(/[/?#\s]/)[0].replace(/^[^@]*@/, "").replace(/:\d+$/, ""), privateUrl = (u10) => /[a-z0-9]/i.test(u10) && !PUBLIC_HOSTS.has(hostOf(u10)), readSmall = (p) => {
   try {
-    return statSync27(p).size <= MAX_FILE_BYTES ? readFileSync90(p, "utf8") : "";
+    return statSync27(p).size <= MAX_FILE_BYTES ? readFileSync91(p, "utf8") : "";
   } catch {
     return "";
   }
@@ -69938,9 +70053,9 @@ __export(exports_seal, {
   EXTERNAL_DIFF_NOT_ISOLATED: () => EXTERNAL_DIFF_NOT_ISOLATED,
   AGENT_ONLY_REASON: () => AGENT_ONLY_REASON
 });
-import { createHash as createHash29 } from "crypto";
-import { existsSync as existsSync73, readdirSync as readdirSync31, mkdirSync as mkdirSync55, readFileSync as readFileSync91 } from "fs";
-import { basename as basename27, isAbsolute as isAbsolute20, join as join103, relative as relative23 } from "path";
+import { createHash as createHash30 } from "crypto";
+import { existsSync as existsSync74, readdirSync as readdirSync31, mkdirSync as mkdirSync55, readFileSync as readFileSync92 } from "fs";
+import { basename as basename28, isAbsolute as isAbsolute20, join as join104, relative as relative24 } from "path";
 async function leanSymbolGap(ctx, o, rawDiff, head, vraw) {
   if (externalRun(o) || Array.isArray(o.wall?.files) && o.wall.files.length > 0 || o.intake?.already_satisfied === true || o.implement?.exit === "already_done")
     return [];
@@ -69961,7 +70076,7 @@ async function leanSymbolGap(ctx, o, rawDiff, head, vraw) {
       const n11 = String(c.name ?? ""), p = n11.slice(n11.indexOf(":") + 1);
       if (n11.includes(":") && isTestFile(p))
         try {
-          sources2.push(readFileSync91(join103(ctx.repoDir, p), "utf8"));
+          sources2.push(readFileSync92(join104(ctx.repoDir, p), "utf8"));
         } catch {}
     }
   return symbolGap(changedSymbols(d.stdout), sources2);
@@ -69975,7 +70090,7 @@ async function git9(ctx, args, keep = {}) {
   return { out: r.stdout, code: r.exitCode };
 }
 function verdictOf2(o, checks, emptyDiff, verifyNotProven, wallGreenOnBase, proof, targetProof = false, uncovered = [], leanGap = []) {
-  const exit = o.implement?.exit;
+  const exit = o.implement?.exit, wd2 = wallDropped(o).length > 0;
   if (o.commit?.failed !== true && strs2(o.commit?.not_proven).length === 0 && (o.intake?.already_satisfied === true || exit === "already_done"))
     return proof || wallGreenOnBase ? "ALREADY_SATISFIED" : "PARTIAL";
   if (exit === "spec_conflict")
@@ -69985,7 +70100,7 @@ function verdictOf2(o, checks, emptyDiff, verifyNotProven, wallGreenOnBase, proo
   if (emptyDiff)
     return "FAILED";
   if (exit === "killed")
-    return typeof o.implement?.limit_s === "number" && targetProof && uncovered.length === 0 && proof && !wallGreenOnBase && !verifyNotProven && checks.length > 0 && checks.every((c) => c.result === "pass") ? "VERIFIED" : "PARTIAL";
+    return typeof o.implement?.limit_s === "number" && targetProof && uncovered.length === 0 && proof && !wallGreenOnBase && !verifyNotProven && !wd2 && checks.length > 0 && checks.every((c) => c.result === "pass") ? "VERIFIED" : "PARTIAL";
   if (typeof o.implement?.limit_s === "number")
     return "PARTIAL";
   if (checks.some((c) => c.result === "fail"))
@@ -69994,7 +70109,7 @@ function verdictOf2(o, checks, emptyDiff, verifyNotProven, wallGreenOnBase, proo
     return "PARTIAL";
   if (leanGap.length > 0)
     return "PARTIAL";
-  if (exit === "killed" || checks.length === 0 || checks.some((c) => c.result !== "pass") || verifyNotProven || !proof || wallGreenOnBase)
+  if (wd2 || exit === "killed" || checks.length === 0 || checks.some((c) => c.result !== "pass") || verifyNotProven || !proof || wallGreenOnBase)
     return "PARTIAL";
   return "VERIFIED";
 }
@@ -70043,14 +70158,15 @@ function renderReceiptMd(r) {
   ].join(`
 `);
 }
-var SIGNING_UNAVAILABLE = "receipt signing unavailable (no usable signing key: invalid key or unwritable ~/.loki/keys)", AGENT_ONLY_REASON = "only agent-authored tests executed (no agent-independent proof)", WALL_GREEN_ON_BASE_REASON = "Wall green on base: no Wall test discriminates the change", EXCLUDE_LOKI = ":(exclude).loki", sha2562 = (s) => createHash29("sha256").update(s).digest("hex"), str3 = (v3) => typeof v3 === "string" && v3 !== "" ? v3 : null, EXTERNAL_MODEL_LABEL = "external (no Loki implement session)", EXTERNAL_DIFF_NOT_ISOLATED = "Wall author not filesystem-isolated from the external diff", EXTERNAL_NO_WALL = "external diff sealed with no Wall file that ran; the only checks are the repo's existing tests", externalRun = (o) => o.implement?.exit === "external", LEAN_NO_SYMBOL = "no passing check references a changed symbol and no Wall file ran", strs2 = (v3) => Array.isArray(v3) ? v3.filter((x3) => typeof x3 === "string" && x3 !== "") : [], g = (ctx) => (a) => git9(ctx, a), receiptRel = (ctx) => {
-  const r = relative23(ctx.repoDir, join103(ctx.runDir, "receipt.json"));
+var SIGNING_UNAVAILABLE = "receipt signing unavailable (no usable signing key: invalid key or unwritable ~/.loki/keys)", AGENT_ONLY_REASON = "only agent-authored tests executed (no agent-independent proof)", WALL_GREEN_ON_BASE_REASON = "Wall green on base: no Wall test discriminates the change", EXCLUDE_LOKI = ":(exclude).loki", sha2562 = (s) => createHash30("sha256").update(s).digest("hex"), str3 = (v3) => typeof v3 === "string" && v3 !== "" ? v3 : null, EXTERNAL_MODEL_LABEL = "external (no Loki implement session)", EXTERNAL_DIFF_NOT_ISOLATED = "Wall author not filesystem-isolated from the external diff", EXTERNAL_NO_WALL = "external diff sealed with no Wall file that ran; the only checks are the repo's existing tests", externalRun = (o) => o.implement?.exit === "external", LEAN_NO_SYMBOL = "no passing check references a changed symbol and no Wall file ran", strs2 = (v3) => Array.isArray(v3) ? v3.filter((x3) => typeof x3 === "string" && x3 !== "") : [], g = (ctx) => (a) => git9(ctx, a), receiptRel = (ctx) => {
+  const r = relative24(ctx.repoDir, join104(ctx.runDir, "receipt.json"));
   return r.startsWith("..") || isAbsolute20(r) ? `.loki/runs/${ctx.runId}/receipt.json` : r;
 }, commitStage, wallGreenOnBaseOf = (o) => {
   const b = o.wall?.base_run ?? {};
   return typeof b.pass === "number" && b.pass > 0 && b.fail === 0 && (typeof b.not_run === "number" ? b.not_run : 0) === 0;
 }, sealStage, stage7;
 var init_seal = __esm(() => {
+  init_wall_owned();
   init_redact();
   init_spec_file();
   init_steer();
@@ -70174,7 +70290,7 @@ var init_seal = __esm(() => {
       }
       if (wallNotRun > 0)
         notProven.add(`wall base run not_run: ${wallNotRun}`);
-      for (const n11 of strs2(o.wall?.not_proven))
+      for (const n11 of [...strs2(o.wall?.not_proven), ...wallDropped(o)])
         notProven.add(n11);
       for (const d of Array.isArray(o.wall?.discarded) ? o.wall.discarded : [])
         notProven.add(`wall test discarded: ${String(d.file)} (${String(d.reason)})`);
@@ -70184,8 +70300,8 @@ var init_seal = __esm(() => {
         notProven.add(`Wall test not executed: ${wallNotRun} file(s), no reason recorded`);
       if (wallNotRun > 0) {
         try {
-          const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename27(String(f.path))));
-          for (const n11 of readdirSync31(join103(ctx.runDir, "wall")).sort())
+          const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename28(String(f.path))));
+          for (const n11 of readdirSync31(join104(ctx.runDir, "wall")).sort())
             if (!kept.has(n11))
               notProven.add(`wall test discarded: ${n11} (not_run)`);
         } catch {}
@@ -70256,19 +70372,19 @@ var init_seal = __esm(() => {
       for (const [s, d] of Object.entries(o))
         if (typeof d?.duration_s === "number")
           stages[s] = d.duration_s;
-      const T = hooks.time, time = T ? T.build(ctx, stages, T.firstEventMs(join103(ctx.runDir, "events.jsonl"))) : { wall_s: Object.values(stages).reduce((a, b) => a + (b ?? 0), 0), stages }, totalS = T?.reconciled(time) ?? null;
+      const T = hooks.time, time = T ? T.build(ctx, stages, T.firstEventMs(join104(ctx.runDir, "events.jsonl"))) : { wall_s: Object.values(stages).reduce((a, b) => a + (b ?? 0), 0), stages }, totalS = T?.reconciled(time) ?? null;
       const iterIds = [...new Set([...Object.values(o).flatMap((d) => [...strs2(d?.iteration_ids), ...strs2([d?.iteration_id])]), ...ctx.sessionIds?.() ?? [], ...xr2?.cost_iteration ? [xr2.cost_iteration] : []])];
       if (iterIds.length === 0)
         notProven.add("cost not measured (no iteration ids recorded)");
       const cost = ctx.cost.read(ctx.repoDir, iterIds);
       if (cost.unmetered)
         notProven.add("cost unmetered (CLI invoker; recorded as 0)");
-      const eventsPath = join103(ctx.runDir, "events.jsonl");
+      const eventsPath = join104(ctx.runDir, "events.jsonl");
       const wallFiles = Array.isArray(o.wall?.files) ? o.wall.files : [];
       const wallPassed = typeof o.verify?.wall_passed === "boolean" ? o.verify.wall_passed : null;
       if (wallFiles.length > 0 && wallPassed === null)
         notProven.add("wall result not recorded by verify");
-      const routeBlock = buildRouteBlock(process.env, ctx.provider, o.implement?.route ?? o.plan?.route_record ?? (routerEnabled(process.env) ? loadRouteRecord(ctx.runDir) : undefined), cost.router ?? (routerEnabled(process.env) ? sumResultCosts(join103(ctx.repoDir, ".loki"), liveArchivedCosts(join103(ctx.repoDir, ".loki"), iterIds, UNMETERED)).router : undefined), ctx.model);
+      const routeBlock = buildRouteBlock(process.env, ctx.provider, o.implement?.route ?? o.plan?.route_record ?? (routerEnabled(process.env) ? loadRouteRecord(ctx.runDir) : undefined), cost.router ?? (routerEnabled(process.env) ? sumResultCosts(join104(ctx.repoDir, ".loki"), liveArchivedCosts(join104(ctx.repoDir, ".loki"), iterIds, UNMETERED)).router : undefined), ctx.model);
       if (routeBlock)
         for (const l of routeNotProven(routeBlock))
           notProven.add(l);
@@ -70311,7 +70427,7 @@ var init_seal = __esm(() => {
         model: externalRun(o) ? EXTERNAL_MODEL_LABEL : ctx.model,
         ...externalRun(o) ? { implement: { exit: "external", patch_sha256: str3(o.implement?.patch_sha256) ?? "" } } : {},
         resumed: o.intake?.resumed === true,
-        events_sha256: sha2562(existsSync73(eventsPath) ? readFileSync91(eventsPath) : ""),
+        events_sha256: sha2562(existsSync74(eventsPath) ? readFileSync92(eventsPath) : ""),
         ...await sealEvidence(ctx.repoDir, ctx.runDir, o, notProven, signal, ctx.emit),
         log_seal: true,
         toolchain: collectToolchain(),
@@ -70339,10 +70455,10 @@ var init_seal = __esm(() => {
       }
       const receipt = { ...body, receipt_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } };
       mkdirSync55(ctx.runDir, { recursive: true });
-      const path = join103(ctx.runDir, "receipt.json");
+      const path = join104(ctx.runDir, "receipt.json");
       atomicWriteText(path, JSON.stringify(receipt, null, 2) + `
 `);
-      atomicWriteText(join103(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
+      atomicWriteText(join104(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
       recordRun(process.env, ctx.repoDir, ranModel(o.implement, ctx.model, o.fix), verdict, cost.usd, cost.unmetered === true, totalS);
       try {
         hooks.sealed?.(ctx.runDir, JSON.parse(JSON.stringify(receipt), (_k2, v3) => v3 && typeof v3 === "object" ? Object.freeze(v3) : v3));
@@ -70415,8 +70531,8 @@ var init_github_token = __esm(() => {
 
 // ../../loki-ts/src/engine10/fetch_issue.ts
 import { execFileSync as execFileSync7 } from "child_process";
-import { writeFileSync as writeFileSync53 } from "fs";
-import { join as join104 } from "path";
+import { writeFileSync as writeFileSync54 } from "fs";
+import { join as join105 } from "path";
 function defaultExec(cmd, args) {
   const ms = Number(process.env.LOKI_FETCH_ISSUE_TIMEOUT_MS) || 60000;
   return execFileSync7(cmd, args, { encoding: "utf8", env: process.env, timeout: ms, killSignal: "SIGKILL" });
@@ -70437,18 +70553,18 @@ function fetchIssue(ref, execer = defaultExec) {
 }
 function fetchIssueToFile(ref, outFile, exec = defaultExec) {
   const issue = fetchIssue(ref, exec);
-  writeFileSync53(outFile, JSON.stringify(issue));
+  writeFileSync54(outFile, JSON.stringify(issue));
   return issue;
 }
 var ISSUE_PROVIDERS_SH;
 var init_fetch_issue = __esm(() => {
   init_paths();
-  ISSUE_PROVIDERS_SH = join104(REPO_ROOT, "autonomy/issue-providers.sh");
+  ISSUE_PROVIDERS_SH = join105(REPO_ROOT, "autonomy/issue-providers.sh");
   if (false) {}
 });
 
 // ../../loki-ts/src/features/tracker_intake.ts
-import { writeFileSync as writeFileSync54 } from "fs";
+import { writeFileSync as writeFileSync55 } from "fs";
 function selfHostedSite(s, env) {
   const base = env.JIRA_BASE_URL;
   const m = SELF_URL.exec(s);
@@ -70595,7 +70711,7 @@ async function fetchTrackerIssue(ref, f = fetch, env = process.env) {
 }
 async function fetchTrackerIssueToFile(ref, outFile, f = fetch, env = process.env) {
   const issue = await fetchTrackerIssue(ref, f, env);
-  writeFileSync54(outFile, JSON.stringify(issue));
+  writeFileSync55(outFile, JSON.stringify(issue));
   return issue;
 }
 var JIRA_KEY = "[A-Z][A-Z0-9_]*-\\d+", JIRA_REF, JIRA_URL, LINEAR_REF, LINEAR_URL, SELF_URL;
@@ -70990,14 +71106,14 @@ var init_capability = __esm(() => {
 var init_raster = () => {};
 
 // ../../loki-ts/src/commands/doctor.ts
-import { appendFileSync as appendFileSync11, writeFileSync as writeFileSync55, mkdirSync as mkdirSync56, accessSync as accessSync2, constants as fsConstants2, existsSync as existsSync74, lstatSync as lstatSync26, readdirSync as readdirSync32, readFileSync as readFileSync92, readlinkSync as readlinkSync6, realpathSync as realpathSync31, statSync as statSync29, statfsSync } from "fs";
+import { appendFileSync as appendFileSync11, writeFileSync as writeFileSync56, mkdirSync as mkdirSync56, accessSync as accessSync2, constants as fsConstants2, existsSync as existsSync75, lstatSync as lstatSync26, readdirSync as readdirSync32, readFileSync as readFileSync93, readlinkSync as readlinkSync6, realpathSync as realpathSync31, statSync as statSync29, statfsSync } from "fs";
 import { spawnSync as spawnSync12 } from "child_process";
-import { homedir as homedir12, tmpdir as tmpdir17 } from "os";
-import { join as join105, resolve as resolve31 } from "path";
+import { homedir as homedir12, tmpdir as tmpdir18 } from "os";
+import { join as join106, resolve as resolve31 } from "path";
 function loadRequirements(file = REQUIREMENTS_FILE) {
   if (file === REQUIREMENTS_FILE && cached)
     return cached;
-  const t = JSON.parse(readFileSync92(file, "utf8"));
+  const t = JSON.parse(readFileSync93(file, "utf8"));
   if (file === REQUIREMENTS_FILE)
     cached = t;
   return t;
@@ -71022,13 +71138,13 @@ function providerLoginIssue(provider, cli, env) {
   if (provider === "codex") {
     if (key("OPENAI_API_KEY") || key("CODEX_API_KEY"))
       return null;
-    const r = spawnSync12(cli, ["login", "status"], { env: providerProbeEnv(env), encoding: "utf8", timeout: 5000, cwd: tmpdir17() });
+    const r = spawnSync12(cli, ["login", "status"], { env: providerProbeEnv(env), encoding: "utf8", timeout: 5000, cwd: tmpdir18() });
     if (r.status === 0)
       return null;
     const said = `${r.stdout}${r.stderr}`;
     return /not logged in/i.test(said) || classifyFailure(said).reason === "auth" ? { fatal: "codex is not logged in; run: codex login (or set OPENAI_API_KEY)" } : { warn: "could not confirm the Codex login (codex login status gave no answer); continuing" };
   }
-  if (PROVIDER_API_KEY_VARS.some(key) || provider === "opencode" && existsSync74(join105(env.XDG_DATA_HOME || join105(home, ".local", "share"), "opencode", "auth.json")) || provider === "cline" && existsSync74(join105(home, ".cline")))
+  if (PROVIDER_API_KEY_VARS.some(key) || provider === "opencode" && existsSync75(join106(env.XDG_DATA_HOME || join106(home, ".local", "share"), "opencode", "auth.json")) || provider === "cline" && existsSync75(join106(home, ".cline")))
     return null;
   return provider === "aider" || provider === "opencode" || provider === "cline" ? { warn: `no ${provider} login or API key found (set a provider API key such as ANTHROPIC_API_KEY or OPENAI_API_KEY${provider === "opencode" ? ", or run: opencode auth login" : ""}); continuing` } : null;
 }
@@ -71039,9 +71155,9 @@ function providerAuthPath(provider, env) {
   const v3 = own.find(set);
   if (v3)
     return `${v3 === "CLAUDE_CODE_OAUTH_TOKEN" ? "oauth_token" : "api_key"}:${v3}`;
-  if (provider === "opencode" && existsSync74(join105(env.XDG_DATA_HOME || join105(home, ".local", "share"), "opencode", "auth.json")))
+  if (provider === "opencode" && existsSync75(join106(env.XDG_DATA_HOME || join106(home, ".local", "share"), "opencode", "auth.json")))
     return "cli_login:opencode";
-  if (provider === "cline" && existsSync74(join105(home, ".cline")))
+  if (provider === "cline" && existsSync75(join106(home, ".cline")))
     return "cli_login:cline";
   return provider === "claude" || provider === "codex" ? `cli_login:${provider}` : "none";
 }
@@ -71066,9 +71182,9 @@ function claudeAuthStatusLoggedIn(cli = "claude", env = process.env) {
   }
 }
 function claudeLoginProbeCached(cli, env = process.env, now2 = Date.now()) {
-  const file = join105(env.HOME || homedir12(), ".loki", "claude-login-ok.json");
+  const file = join106(env.HOME || homedir12(), ".loki", "claude-login-ok.json");
   try {
-    const c = JSON.parse(readFileSync92(file, "utf8"));
+    const c = JSON.parse(readFileSync93(file, "utf8"));
     if (c?.cli === cli && typeof c.at === "number" && now2 - c.at >= 0 && now2 - c.at < CLAUDE_LOGIN_TTL_MS)
       return "yes";
   } catch {}
@@ -71077,8 +71193,8 @@ function claudeLoginProbeCached(cli, env = process.env, now2 = Date.now()) {
     li2 = claudeAuthStatusLoggedIn(cli, env);
   if (li2 === "yes") {
     try {
-      mkdirSync56(join105(file, ".."), { recursive: true });
-      writeFileSync55(file, JSON.stringify({ cli, at: now2 }));
+      mkdirSync56(join106(file, ".."), { recursive: true });
+      writeFileSync56(file, JSON.stringify({ cli, at: now2 }));
     } catch {}
   }
   return li2;
@@ -71086,17 +71202,17 @@ function claudeLoginProbeCached(cli, env = process.env, now2 = Date.now()) {
 async function ghAuthProbeCached(env, probe, now2 = Date.now()) {
   const bin = "gh";
   const gh = Bun.which(bin, { PATH: env.PATH ?? process.env.PATH ?? "" }) ?? bin;
-  const file = join105(env.HOME || homedir12(), ".loki", "gh-auth-ok.json");
+  const file = join106(env.HOME || homedir12(), ".loki", "gh-auth-ok.json");
   try {
-    const c = JSON.parse(readFileSync92(file, "utf8"));
+    const c = JSON.parse(readFileSync93(file, "utf8"));
     if (c?.gh === gh && typeof c.at === "number" && now2 - c.at >= 0 && now2 - c.at < CLAUDE_LOGIN_TTL_MS)
       return true;
   } catch {}
   const ok3 = await probe();
   if (ok3) {
     try {
-      mkdirSync56(join105(file, ".."), { recursive: true });
-      writeFileSync55(file, JSON.stringify({ gh, at: now2 }));
+      mkdirSync56(join106(file, ".."), { recursive: true });
+      writeFileSync56(file, JSON.stringify({ gh, at: now2 }));
     } catch {}
   }
   return ok3;
@@ -71169,8 +71285,8 @@ var init_first_run_repo = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/preflight.ts
-import { accessSync as accessSync3, constants as fsc2, mkdirSync as mkdirSync57, statfsSync as statfsSync2, writeFileSync as writeFileSync56 } from "fs";
-import { join as join106 } from "path";
+import { accessSync as accessSync3, constants as fsc2, mkdirSync as mkdirSync57, statfsSync as statfsSync2, writeFileSync as writeFileSync57 } from "fs";
+import { join as join107 } from "path";
 async function sh3(argv, opts) {
   try {
     return await run(argv, opts);
@@ -71254,7 +71370,7 @@ async function checkPreflight(o) {
   if (o.runDir) {
     try {
       mkdirSync57(o.runDir, { recursive: true });
-      writeFileSync56(join106(o.runDir, "preflight.json"), JSON.stringify({ provider: o.provider, auth_path, probe }) + `
+      writeFileSync57(join107(o.runDir, "preflight.json"), JSON.stringify({ provider: o.provider, auth_path, probe }) + `
 `);
     } catch {}
   }
@@ -71919,10 +72035,10 @@ __export(exports_run_group, {
   groupCostLine: () => groupCostLine,
   NOT_PROVEN: () => NOT_PROVEN
 });
-import { cpSync as cpSync2, existsSync as existsSync75, mkdirSync as mkdirSync58, readdirSync as readdirSync34, readFileSync as readFileSync93, rmSync as rmSync31, statSync as statSync30 } from "fs";
-import { createHash as createHash30 } from "crypto";
+import { cpSync as cpSync2, existsSync as existsSync76, mkdirSync as mkdirSync58, readdirSync as readdirSync34, readFileSync as readFileSync94, rmSync as rmSync32, statSync as statSync30 } from "fs";
+import { createHash as createHash31 } from "crypto";
 import { spawn as spawn12 } from "child_process";
-import { join as join107, resolve as resolve32 } from "path";
+import { join as join108, resolve as resolve32 } from "path";
 function scopedEnv(env) {
   const out3 = {};
   for (const [k3, v3] of Object.entries(env))
@@ -71959,7 +72075,7 @@ function groupCostLine(costs, provider = "claude") {
 `;
 }
 function writeGroupCostRecord(repoDir, name, costs, provider) {
-  const dir = join107(repoDir, ".loki", "metrics", "efficiency");
+  const dir = join108(repoDir, ".loki", "metrics", "efficiency");
   const timestamp = new Date().toISOString();
   try {
     const base = { phase: "implement", provider, status: "group", kind: "group_cost", timestamp };
@@ -71973,7 +72089,7 @@ function writeGroupCostRecord(repoDir, name, costs, provider) {
     if (recs.length === 0)
       return;
     mkdirSync58(dir, { recursive: true });
-    recs.forEach((r, k3) => atomicWriteJson(join107(dir, `iteration-group-${name}-${String(k3).padStart(3, "0")}.json`), r));
+    recs.forEach((r, k3) => atomicWriteJson(join108(dir, `iteration-group-${name}-${String(k3).padStart(3, "0")}.json`), r));
   } catch {}
 }
 function testCommand(repoDir, env) {
@@ -71986,7 +72102,7 @@ function testCommand(repoDir, env) {
   return [];
 }
 function findResumable(repoDir, specSha, unitIds) {
-  const root = join107(repoDir, ".loki", "groups");
+  const root = join108(repoDir, ".loki", "groups");
   let names = [];
   try {
     names = readdirSync34(root);
@@ -71997,7 +72113,7 @@ function findResumable(repoDir, specSha, unitIds) {
   for (const gid of names) {
     if (!GID_RE.test(gid))
       continue;
-    const p = join107(root, gid, "dag.json"), d = readJson8(p);
+    const p = join108(root, gid, "dag.json"), d = readJson8(p);
     if (!d || (unitIds ? JSON.stringify((Array.isArray(d["units"]) ? d["units"] : []).filter((u10) => !u10.fixKind).map((u10) => u10.id)) !== JSON.stringify(unitIds) : d["spec_sha256"] !== specSha) || typeof d["base_ref"] !== "string" || !Array.isArray(d["units"]))
       continue;
     let at2 = 0;
@@ -72014,7 +72130,7 @@ function findResumable(repoDir, specSha, unitIds) {
 async function unitDone(verifyReceipt, repoDir, gid, n11, id2) {
   if (!UNIT_ID_RE.test(id2))
     return false;
-  const rp = join107(repoDir, ".loki", "groups", gid, "group", "units", id2, "receipt.json");
+  const rp = join108(repoDir, ".loki", "groups", gid, "group", "units", id2, "receipt.json");
   const rec2 = readJson8(rp);
   if (!rec2 || rec2["verdict"] !== "VERIFIED")
     return false;
@@ -72029,7 +72145,7 @@ async function adoptJournaled(verifyReceipt, repoDir, dir, key, gid, n11, id2, t
     return false;
   if (!await unitDone(verifyReceipt, repoDir, e10.gid, e10.n, id2))
     return false;
-  const signed = readJson8(join107(repoDir, ".loki", "groups", e10.gid, "group", "units", id2, "receipt.json"));
+  const signed = readJson8(join108(repoDir, ".loki", "groups", e10.gid, "group", "units", id2, "receipt.json"));
   const signedTask = (signed?.["task"] ?? {}).sha256;
   const signedSpec = (signed?.["unit_spec"] ?? {}).sha256;
   if (typeof signedSpec !== "string" || signedSpec === "" || signedSpec !== specSha)
@@ -72039,9 +72155,9 @@ async function adoptJournaled(verifyReceipt, repoDir, dir, key, gid, n11, id2, t
   const tip = git11(repoDir, ["rev-parse", "--verify", "--quiet", `refs/heads/loki/unit-${e10.gid}-${e10.n}`]);
   if (tip === "" || tip !== e10.head)
     return false;
-  const dst = join107(repoDir, ".loki", "groups", gid, "group", "units", id2);
-  rmSync31(dst, { recursive: true, force: true });
-  cpSync2(join107(repoDir, ".loki", "groups", e10.gid, "group", "units", id2), dst, { recursive: true });
+  const dst = join108(repoDir, ".loki", "groups", gid, "group", "units", id2);
+  rmSync32(dst, { recursive: true, force: true });
+  cpSync2(join108(repoDir, ".loki", "groups", e10.gid, "group", "units", id2), dst, { recursive: true });
   if (safeGitSpawn(repoDir, ["update-ref", `refs/heads/loki/unit-${gid}-${n11}`, tip], { encoding: "utf8" }).status !== 0)
     return false;
   if (!await unitDone(verifyReceipt, repoDir, gid, n11, id2))
@@ -72076,8 +72192,8 @@ async function runGroup(launcher, dag, ctx) {
   const revised = resumable !== null && exact === null;
   const changed = new Set;
   const groupId = resumable?.gid ?? `g${Date.now().toString(36)}`;
-  const groupDir = join107(repoDir, ".loki", "groups", groupId);
-  const receiptPath = join107(groupDir, "receipt.json");
+  const groupDir = join108(repoDir, ".loki", "groups", groupId);
+  const receiptPath = join108(groupDir, "receipt.json");
   const slugOf = () => originSlug(repoDir);
   let baseRef;
   let startBranch = "";
@@ -72122,7 +72238,7 @@ async function runGroup(launcher, dag, ctx) {
             u10.writeSet = nd2.writeSet;
           }
         }
-    } else if (!existsSync75(groupContractPath(repoDir, groupId))) {
+    } else if (!existsSync76(groupContractPath(repoDir, groupId))) {
       const f = freezeGroupContract(repoDir, groupId, units, parseContract(ctx.spec, ctx.specPath ?? ""));
       if (!f.ok) {
         say(`loki: ${f.reason}
@@ -72169,10 +72285,10 @@ async function runGroup(launcher, dag, ctx) {
   const accOf = new Map;
   for (const cu2 of Array.isArray(gc2?.["units"]) ? gc2["units"] : [])
     accOf.set(cu2.id, cu2.criteria.map((c) => c.text));
-  const specDir = join107(groupDir, "unit_specs");
+  const specDir = join108(groupDir, "unit_specs");
   mkdirSync58(specDir, { recursive: true });
   for (const u10 of units) {
-    const spec = join107(specDir, `${u10.id}.json`);
+    const spec = join108(specDir, `${u10.id}.json`);
     const isFix = !!u10.fixKind;
     if (!isFix)
       u10.base = baseRef;
@@ -72198,19 +72314,19 @@ async function runGroup(launcher, dag, ctx) {
         say(`loki: unit ${u10.id} skipped-unchanged
 `);
     } else if (resumable && UNIT_ID_RE.test(u10.id))
-      rmSync31(join107(groupDir, "group", "units", u10.id), { recursive: true, force: true });
+      rmSync32(join108(groupDir, "group", "units", u10.id), { recursive: true, force: true });
   }
   const cut2 = units.findIndex((u10) => u10.fixKind && !u10.done);
   if (cut2 >= 0)
     for (const u10 of units.splice(cut2)) {
       if (u10.done)
         doneCount--;
-      rmSync31(join107(groupDir, "group", "units", u10.id), { recursive: true, force: true });
+      rmSync32(join108(groupDir, "group", "units", u10.id), { recursive: true, force: true });
     }
   if (resumable)
     say(`loki: resuming group ${groupId}: ${doneCount} of ${units.length} units already VERIFIED
 `);
-  const dagPath = join107(groupDir, "dag.json");
+  const dagPath = join108(groupDir, "dag.json");
   atomicWriteJson(dagPath, { group: groupId, spec_sha256: specSha, base_ref: baseRef, start_branch: startBranch, ...full, units });
   try {
     const chk = await checkDecomposable(full, { map: (() => {
@@ -72240,7 +72356,7 @@ async function runGroup(launcher, dag, ctx) {
     const n11 = Math.min(slots, pending);
     say(`loki: group ${groupId}: ${units.length} units, ${n11} parallel slot(s) (provider ${provider})
 `);
-    const backlog = join107(REPO_ROOT, "autonomy", "lib", "backlog.py");
+    const backlog = join108(REPO_ROOT, "autonomy", "lib", "backlog.py");
     const feed = createGroupFeed(groupId, units, createGroupRenderer({ write: say, isTTY: false }));
     const res = await run2([backlog, slug, "--dag", dagPath, "--group", groupId, "--slots", String(n11), "--provider", provider], scopedEnv({ ...env, LOKI_PROVIDER: provider }), repoDir, (c) => feed.feed(c));
     launchCode = res.code;
@@ -72280,7 +72396,7 @@ async function runGroup(launcher, dag, ctx) {
   const testCmd = testCommand(repoDir, env), fixes = units.filter((u10) => u10.fixKind);
   const putDag = (us2) => atomicWriteJson(dagPath, { group: groupId, spec_sha256: specSha, base_ref: baseRef, start_branch: startBranch, ...full, units: us2 });
   const launchFix = async (fix) => {
-    const key = `unit-${groupId}-${units.length + 1}`, spec = join107(specDir, `${fix.id}.json`), slug = slugOf();
+    const key = `unit-${groupId}-${units.length + 1}`, spec = join108(specDir, `${fix.id}.json`), slug = slugOf();
     if (!slug)
       return null;
     atomicWriteJson(spec, { id: fix.id, writeSet: fix.writeSet, pack: fix.writeSet, tokenBudget: 1e9, acceptance: fix.acceptance });
@@ -72289,7 +72405,7 @@ async function runGroup(launcher, dag, ctx) {
     fix.base = git11(repoDir, ["rev-parse", "HEAD"]);
     units.push(fix);
     putDag(units.map((u10) => u10 === fix ? u10 : { ...u10, done: true }));
-    const res = await run2([join107(REPO_ROOT, "autonomy", "lib", "backlog.py"), slug, "--dag", dagPath, "--group", groupId, "--slots", "1", "--provider", provider], scopedEnv({ ...env, LOKI_PROVIDER: provider }), repoDir);
+    const res = await run2([join108(REPO_ROOT, "autonomy", "lib", "backlog.py"), slug, "--dag", dagPath, "--group", groupId, "--slots", "1", "--provider", provider], scopedEnv({ ...env, LOKI_PROVIDER: provider }), repoDir);
     costs.push(parseGroupCost(res.stdout));
     if (res.code !== 0 || !new RegExp(`^backlog: ${key} (VERIFIED|PR \\S+)$`, "m").test(res.stdout)) {
       units.pop();
@@ -72323,7 +72439,7 @@ async function runGroup(launcher, dag, ctx) {
     return 1;
   }
   const order2 = units.map((u10) => ({ unit_id: u10.id, goal: u10.items.join("; "), files: u10.writeSet }));
-  atomicWriteJson(join107(groupDir, "group", "manifest.json"), { group_id: groupId, units: order2 });
+  atomicWriteJson(join108(groupDir, "group", "manifest.json"), { group_id: groupId, units: order2 });
   const head = git11(repoDir, ["rev-parse", "--verify", `refs/heads/${r.branch}`]);
   let verdict = "", unitVerdicts = [], why = "";
   try {
@@ -72367,9 +72483,9 @@ var NOT_PROVEN = 4, ENV_KEEP, defaultLauncher = (argv, env, cwd, onOut) => new P
 }), git11 = (dir, args) => {
   const r = safeGitSpawn(dir, args, { encoding: "utf8" });
   return r.status === 0 ? String(r.stdout).trim() : "";
-}, SLUG_RE, originSlug = (repoDir) => SLUG_RE.exec(git11(repoDir, ["remote", "get-url", "origin"]))?.[1], sha2563 = (s) => createHash30("sha256").update(s).digest("hex"), UNIT_ID_RE, GID_RE, readJson8 = (p) => {
+}, SLUG_RE, originSlug = (repoDir) => SLUG_RE.exec(git11(repoDir, ["remote", "get-url", "origin"]))?.[1], sha2563 = (s) => createHash31("sha256").update(s).digest("hex"), UNIT_ID_RE, GID_RE, readJson8 = (p) => {
   try {
-    const v3 = JSON.parse(readFileSync93(p, "utf8"));
+    const v3 = JSON.parse(readFileSync94(p, "utf8"));
     return v3 !== null && typeof v3 === "object" && !Array.isArray(v3) ? v3 : null;
   } catch {
     return null;
@@ -72404,8 +72520,8 @@ __export(exports_route, {
   MAX_SPEC_BYTES: () => MAX_SPEC_BYTES2,
   MAX_SEQ_TASK_BYTES: () => MAX_SEQ_TASK_BYTES
 });
-import { closeSync as closeSync14, constants as constants5, fstatSync as fstatSync8, openSync as openSync14, readFileSync as readFileSync94, realpathSync as realpathSync32 } from "fs";
-import { isAbsolute as isAbsolute21, relative as relative24, resolve as resolve33 } from "path";
+import { closeSync as closeSync14, constants as constants5, fstatSync as fstatSync8, openSync as openSync14, readFileSync as readFileSync95, realpathSync as realpathSync32 } from "fs";
+import { isAbsolute as isAbsolute21, relative as relative25, resolve as resolve33 } from "path";
 function providerSlots(env, provider) {
   provider = (provider || env.LOKI_PROVIDER || "claude").toLowerCase();
   return { provider, slots: PROVIDER_SLOTS[provider] ?? 1 };
@@ -72420,7 +72536,7 @@ function readSpec(task, repoDir, cwd) {
   } catch {
     return { kind: "missing", path: p };
   }
-  const rel = relative24(realpathSync32(repoDir), real3);
+  const rel = relative25(realpathSync32(repoDir), real3);
   if (rel === ".." || rel.startsWith("../") || isAbsolute21(rel))
     return { kind: "reject", reason: `spec path escapes the repo: ${task}` };
   let fd2 = -1;
@@ -72431,7 +72547,7 @@ function readSpec(task, repoDir, cwd) {
       return { kind: "text" };
     if (st2.size > MAX_SPEC_BYTES2)
       return { kind: "reject", reason: `spec file over ${MAX_SPEC_BYTES2} bytes` };
-    const buf = readFileSync94(fd2);
+    const buf = readFileSync95(fd2);
     if (buf.length > MAX_SPEC_BYTES2)
       return { kind: "reject", reason: `spec file over ${MAX_SPEC_BYTES2} bytes` };
     if (buf.includes(0))
@@ -72550,15 +72666,15 @@ var init_route = __esm(() => {
 });
 
 // ../../loki-ts/src/contrib/forecast.ts
-import { appendFileSync as appendFileSync12, existsSync as existsSync76, mkdirSync as mkdirSync59, readFileSync as readFileSync95 } from "fs";
-import { join as join108 } from "path";
+import { appendFileSync as appendFileSync12, existsSync as existsSync77, mkdirSync as mkdirSync59, readFileSync as readFileSync96 } from "fs";
+import { join as join109 } from "path";
 function readWindowDeltas(lokiDir2) {
   const p = historyPath2(lokiDir2);
-  if (!existsSync76(p))
+  if (!existsSync77(p))
     return [];
   const out3 = [];
   try {
-    for (const line2 of readFileSync95(p, "utf8").split(`
+    for (const line2 of readFileSync96(p, "utf8").split(`
 `)) {
       if (!line2.trim())
         continue;
@@ -72619,7 +72735,7 @@ async function printForecast(lokiDir2, read2, write, env = process.env) {
 `);
   } catch {}
 }
-var MIN_FORECAST_RUNS = 3, KEEP_RUNS = 20, forecastOn = (env = process.env) => env["LOKI_FORECAST"] !== "0", finite = (v3) => typeof v3 === "number" && Number.isFinite(v3), historyPath2 = (lokiDir2) => join108(lokiDir2, "quota-runs.jsonl"), range = (xs2) => {
+var MIN_FORECAST_RUNS = 3, KEEP_RUNS = 20, forecastOn = (env = process.env) => env["LOKI_FORECAST"] !== "0", finite = (v3) => typeof v3 === "number" && Number.isFinite(v3), historyPath2 = (lokiDir2) => join109(lokiDir2, "quota-runs.jsonl"), range = (xs2) => {
   const lo = Math.floor(Math.min(...xs2)), hi2 = Math.ceil(Math.max(...xs2));
   return lo === hi2 ? `${hi2}` : `${lo}-${hi2}`;
 };
@@ -72628,8 +72744,8 @@ var init_forecast = __esm(() => {
 });
 
 // ../../loki-ts/src/commands/queue.ts
-import { existsSync as existsSync77, mkdirSync as mkdirSync60, readFileSync as readFileSync96, readdirSync as readdirSync35, renameSync as renameSync21, statSync as statSync31, writeFileSync as writeFileSync57 } from "fs";
-import { join as join109, resolve as resolve34 } from "path";
+import { existsSync as existsSync78, mkdirSync as mkdirSync60, readFileSync as readFileSync97, readdirSync as readdirSync35, renameSync as renameSync21, statSync as statSync31, writeFileSync as writeFileSync58 } from "fs";
+import { join as join110, resolve as resolve34 } from "path";
 function normalizeRef(raw2) {
   const m = URL_RE2.exec(raw2);
   if (m)
@@ -72639,11 +72755,11 @@ function normalizeRef(raw2) {
   return /^0+$/.test(raw2.replace(/^.*#/, "")) ? null : raw2;
 }
 function queuePath(lokiDir2) {
-  return join109(lokiDir2, "issue-queue.json");
+  return join110(lokiDir2, "issue-queue.json");
 }
 function readQueue(lokiDir2) {
   try {
-    const d = JSON.parse(readFileSync96(queuePath(lokiDir2), "utf8"));
+    const d = JSON.parse(readFileSync97(queuePath(lokiDir2), "utf8"));
     return Array.isArray(d.items) ? d.items.filter((i) => typeof i?.ref === "string") : [];
   } catch {
     return [];
@@ -72651,10 +72767,10 @@ function readQueue(lokiDir2) {
 }
 function quarantineCorruptQueue(lokiDir2, now2, warn) {
   const p = queuePath(lokiDir2);
-  if (!existsSync77(p))
+  if (!existsSync78(p))
     return;
   try {
-    const d = JSON.parse(readFileSync96(p, "utf8"));
+    const d = JSON.parse(readFileSync97(p, "utf8"));
     if (d !== null && typeof d === "object" && Array.isArray(d.items))
       return;
   } catch {}
@@ -72856,8 +72972,8 @@ ${QUEUE_USAGE}`);
   try {
     mkdirSync60(d.lokiDir, { recursive: true });
     const stamp2 = finished.toISOString().replace(/[:.]/g, "-");
-    writeFileSync57(join109(d.lokiDir, `queue-digest-${stamp2}.txt`), text4);
-    writeFileSync57(join109(d.lokiDir, "queue-digest-latest.txt"), text4);
+    writeFileSync58(join110(d.lokiDir, `queue-digest-${stamp2}.txt`), text4);
+    writeFileSync58(join110(d.lokiDir, "queue-digest-latest.txt"), text4);
   } catch (e10) {
     d.err(`loki queue: could not write digest: ${e10 instanceof Error ? e10.message : String(e10)}
 `);
@@ -72867,12 +72983,12 @@ ${QUEUE_USAGE}`);
 }
 function newestRecord(lokiDir2, since) {
   for (const [sub2, file] of [["runs", "receipt.json"], ["proofs", "proof.json"]]) {
-    const dir = join109(lokiDir2, sub2);
+    const dir = join110(lokiDir2, sub2);
     let best = null;
     try {
       for (const name of readdirSync35(dir)) {
-        const p = join109(dir, name, file);
-        if (!existsSync77(p))
+        const p = join110(dir, name, file);
+        if (!existsSync78(p))
           continue;
         const t = statSync31(p).mtimeMs;
         if (t >= since && (!best || t > best.t))
@@ -72880,7 +72996,7 @@ function newestRecord(lokiDir2, since) {
       }
       if (!best)
         continue;
-      const d = JSON.parse(readFileSync96(best.p, "utf8"));
+      const d = JSON.parse(readFileSync97(best.p, "utf8"));
       const usd = d.cost?.usd;
       const unmetered = d.cost?.source === "cli-invoker-unmetered";
       return {
@@ -72914,7 +73030,7 @@ function makeDefaultRunner(lokiDir2) {
   return async (ref, opts) => {
     const since = Date.now();
     const argv = [resolve34(REPO_ROOT, "bin", "loki"), ...queueStartArgs(ref, !!opts.pr)];
-    const runLoki = opts.cwd ? join109(opts.cwd, ".loki") : lokiDir2;
+    const runLoki = opts.cwd ? join110(opts.cwd, ".loki") : lokiDir2;
     const env = runnerEnv(opts, runLoki);
     const proc = Bun.spawn(argv, { stdout: "pipe", stderr: "pipe", stdin: "ignore", env, ...opts.cwd ? { cwd: opts.cwd } : {} });
     const mins2 = itemTimeoutMin(process.env["LOKI_QUEUE_ITEM_TIMEOUT_MIN"]);
@@ -72924,9 +73040,9 @@ function makeDefaultRunner(lokiDir2) {
     clearTimeout(timer);
     const output = so + se2;
     try {
-      const logDir = join109(lokiDir2, "queue-logs");
+      const logDir = join110(lokiDir2, "queue-logs");
       mkdirSync60(logDir, { recursive: true });
-      writeFileSync57(join109(logDir, `${(opts.logName ?? ref).replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 120)}.log`), output);
+      writeFileSync58(join110(logDir, `${(opts.logName ?? ref).replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 120)}.log`), output);
     } catch {}
     const proof = newestRecord(runLoki, since);
     return { rc: rc2, output, verdict: proof.verdict, costUsd: proof.costUsd, runId: proof.runId ?? null };
@@ -72995,7 +73111,7 @@ function parseDecomposition(text4) {
     const files = o.files === undefined ? [] : strList(o.files, 50);
     if (!files)
       return { ok: false, reason: `${o.id}: files must be a list of paths` };
-    slices.push({ id: o.id, title: oneLine3(o.title), acceptance: acceptance2, depends_on: [...new Set(deps)], files });
+    slices.push({ id: o.id, title: oneLine4(o.title), acceptance: acceptance2, depends_on: [...new Set(deps)], files });
   }
   for (const s of slices)
     for (const d of s.depends_on)
@@ -73038,7 +73154,7 @@ function parseDecomposition(text4) {
 function decomposeBrief(slug, i, triageReason, outPath) {
   return [
     "You are planning how an autonomous coding agent should deliver one GitHub issue that is too large for a single pull request.",
-    `A triage pass judged it too large: ${oneLine3(triageReason)}`,
+    `A triage pass judged it too large: ${oneLine4(triageReason)}`,
     "Split it into an ordered list of independently verifiable, PR-sized slices. Each slice becomes one pull request, opened as a stack:",
     "a slice that depends on another is built on top of that slice's branch. Prefer a short chain; give a slice several dependencies only when they are already on one chain.",
     "Do not edit, create or delete any repository file. You may read the repository to judge scope.",
@@ -73059,14 +73175,14 @@ function sliceTask(slug, epic, s, index2, total, parent) {
     `This is slice ${index2 + 1} of a larger issue that was split into ${total} pull requests. Implement only this slice.` + (parent ? ` The branch already contains slice ${parent} and everything it depends on.` : ""),
     `Acceptance criteria: ${s.acceptance.map((a, k3) => `(${k3 + 1}) ${a}`).join("; ")}`,
     s.files.length ? `Likely files: ${s.files.join(", ")}` : "",
-    `Parent issue: ${oneLine3(epic.title)}`
+    `Parent issue: ${oneLine4(epic.title)}`
   ].filter(Boolean).join(`
 
 `);
 }
 function planComment(triageReason, slices) {
   return [
-    `Loki triage: too-large (${oneLine3(triageReason)}). Loki split it into ${slices.length} stacked pull requests, run in this order:`,
+    `Loki triage: too-large (${oneLine4(triageReason)}). Loki split it into ${slices.length} stacked pull requests, run in this order:`,
     "",
     ...slices.map((s, k3) => `${k3 + 1}. ${s.id}: ${s.title}${s.depends_on.length ? ` (after ${s.depends_on.join(", ")})` : ""}`)
   ].join(`
@@ -73089,7 +73205,7 @@ async function runEpicSlices(d, runSlice, onSkip) {
   return d.slices.map((s) => results.get(s.id));
 }
 function renderEpicTree(n11, title, rows) {
-  const L = [`### #${n11} ${oneLine3(title)}`, ""];
+  const L = [`### #${n11} ${oneLine4(title)}`, ""];
   const kids = new Map;
   for (const r of rows)
     kids.set(r.parent, [...kids.get(r.parent) ?? [], r]);
@@ -73106,13 +73222,13 @@ function renderEpicTree(n11, title, rows) {
 }
 function makeSessionDecompose(repoDir, lokiDir2, provider) {
   return async (slug, issue, triageReason) => {
-    const { mkdirSync: mkdirSync61, readFileSync: readFileSync97, existsSync: existsSync78 } = await import("fs");
-    const { join: join110 } = await import("path");
+    const { mkdirSync: mkdirSync61, readFileSync: readFileSync98, existsSync: existsSync79 } = await import("fs");
+    const { join: join111 } = await import("path");
     const { createSessionRunner: createSessionRunner2 } = await Promise.resolve().then(() => (init_session(), exports_session));
     const { envOverride: envOverride2 } = await Promise.resolve().then(() => (init_decision(), exports_decision));
-    const dir = join110(lokiDir2, "issues-run", "decompose");
+    const dir = join111(lokiDir2, "issues-run", "decompose");
     mkdirSync61(dir, { recursive: true });
-    const outPath = join110(dir, `issue-${issue.number}-${Date.now()}.json`);
+    const outPath = join111(dir, `issue-${issue.number}-${Date.now()}.json`);
     const runner = createSessionRunner2({ provider, lokiRoot: lokiDir2 });
     const r = await runner.run({
       stage: "plan",
@@ -73124,12 +73240,12 @@ function makeSessionDecompose(repoDir, lokiDir2, provider) {
       cwd: repoDir,
       ...provider === "claude" && envOverride2(process.env) === null ? { model: "opus" } : {}
     });
-    if (existsSync78(outPath))
-      return readFileSync97(outPath, "utf8");
+    if (existsSync79(outPath))
+      return readFileSync98(outPath, "utf8");
     return r.summary ?? "";
   };
 }
-var ID_RE2, MIN_SLICES = 2, MAX_SLICES = 15, oneLine3 = (s) => s.replace(/[\x00-\x1f\x7f]+/g, " ").replace(/\s+/g, " ").trim(), strList = (v3, max) => Array.isArray(v3) && v3.length <= max && v3.every((x3) => typeof x3 === "string" && x3.trim() !== "" && x3.length <= 500) ? v3.map(oneLine3) : null, stacksOn = (r) => !!r && !!r.pr && !!r.branch && !/^(FAILED|BLOCKED|SKIPPED)/.test(r.outcome);
+var ID_RE2, MIN_SLICES = 2, MAX_SLICES = 15, oneLine4 = (s) => s.replace(/[\x00-\x1f\x7f]+/g, " ").replace(/\s+/g, " ").trim(), strList = (v3, max) => Array.isArray(v3) && v3.length <= max && v3.every((x3) => typeof x3 === "string" && x3.trim() !== "" && x3.length <= 500) ? v3.map(oneLine4) : null, stacksOn = (r) => !!r && !!r.pr && !!r.branch && !/^(FAILED|BLOCKED|SKIPPED)/.test(r.outcome);
 var init_issues_epic = __esm(() => {
   ID_RE2 = /^[A-Za-z0-9_-]{1,32}$/;
 });
@@ -73150,9 +73266,9 @@ __export(exports_issues_run, {
   TRIAGE_RE: () => TRIAGE_RE
 });
 import { spawnSync as spawnSync15 } from "child_process";
-import { cpSync as cpSync3, existsSync as existsSync78, mkdirSync as mkdirSync61, mkdtempSync as mkdtempSync14, rmSync as rmSync32, writeFileSync as writeFileSync58 } from "fs";
-import { tmpdir as tmpdir18 } from "os";
-import { join as join110, resolve as resolve35 } from "path";
+import { cpSync as cpSync3, existsSync as existsSync79, mkdirSync as mkdirSync61, mkdtempSync as mkdtempSync15, rmSync as rmSync33, writeFileSync as writeFileSync59 } from "fs";
+import { tmpdir as tmpdir19 } from "os";
+import { join as join111, resolve as resolve35 } from "path";
 import { createInterface as createInterface3 } from "readline";
 function parseIssuesArgs(args) {
   const a = { slug: null, label: null, milestone: null, limit: DEFAULT_LIMIT, parallel: 1, draft: false, dryRun: false, yes: false, comment: false, split: true, json: false };
@@ -73408,7 +73524,7 @@ ${USAGE}`);
     }
   }
   const stamp2 = started.toISOString().replace(/[:.]/g, "-");
-  const runDir = join110(d.lokiDir, "issues-run", stamp2);
+  const runDir = join111(d.lokiDir, "issues-run", stamp2);
   mkdirSync61(runDir, { recursive: true });
   const byRef = new Map(actionable.map((i) => [`${slug}#${i.number}`, i]));
   const sink = () => {};
@@ -73498,14 +73614,14 @@ ${USAGE}`);
 ${trees.join(`
 `)}` : "");
   try {
-    writeFileSync58(join110(runDir, "digest.md"), text4);
+    writeFileSync59(join111(runDir, "digest.md"), text4);
   } catch (e10) {
     d.err(`loki issues run: could not write digest: ${e10 instanceof Error ? e10.message : String(e10)}
 `);
   }
   d.out(`
 ${text4}
-digest: ${join110(runDir, "digest.md")}
+digest: ${join111(runDir, "digest.md")}
 `);
   return 0;
 }
@@ -73515,11 +73631,11 @@ function perRun(est) {
   return est.prior ? { usd: est.prior.usd, tilde: "~", label: " (rough prior)" } : null;
 }
 function keepReceipt(wt, runId2, runDir, err) {
-  const src = join110(wt, ".loki", "runs", runId2);
-  if (!/^[A-Za-z0-9_.-]+$/.test(runId2) || !existsSync78(src))
+  const src = join111(wt, ".loki", "runs", runId2);
+  if (!/^[A-Za-z0-9_.-]+$/.test(runId2) || !existsSync79(src))
     return;
   try {
-    cpSync3(src, join110(runDir, "receipts", runId2), { recursive: true });
+    cpSync3(src, join111(runDir, "receipts", runId2), { recursive: true });
   } catch (e10) {
     err(`loki issues run: could not keep the receipt of ${runId2}: ${e10 instanceof Error ? e10.message : String(e10)}
 `);
@@ -73566,8 +73682,8 @@ function makeWorktrees(repoDir) {
   let root = null;
   return {
     create: (name, base) => {
-      root ??= mkdtempSync14(join110(tmpdir18(), "loki-issues-"));
-      const p = join110(root, name);
+      root ??= mkdtempSync15(join111(tmpdir19(), "loki-issues-"));
+      const p = join111(root, name);
       safeGit(repoDir, ["worktree", "add", "-B", `loki/${name}`, p, base]);
       return p;
     },
@@ -73576,7 +73692,7 @@ function makeWorktrees(repoDir) {
         safeGit(repoDir, ["worktree", "remove", "--force", p]);
         safeGit(repoDir, ["branch", "-D", `loki/${name}`]);
       } catch {
-        rmSync32(p, { recursive: true, force: true });
+        rmSync33(p, { recursive: true, force: true });
       }
     }
   };
@@ -73660,7 +73776,7 @@ __export(exports_satisfaction, {
 });
 import { appendFileSync as appendFileSync13, mkdirSync as mkdirSync62 } from "fs";
 import { homedir as homedir13 } from "os";
-import { join as join111 } from "path";
+import { join as join112 } from "path";
 import { createInterface as createInterface4 } from "readline";
 function satisfactionEnabled(env, tty) {
   if (!tty)
@@ -73680,9 +73796,9 @@ function parseScore(line2) {
   return { score: Number(m[1]), again: m[2] ? m[2].toLowerCase() === "y" : null };
 }
 function recordSatisfaction(home, row) {
-  const dir = join111(home, ".loki");
+  const dir = join112(home, ".loki");
   mkdirSync62(dir, { recursive: true, mode: 448 });
-  appendFileSync13(join111(dir, "satisfaction.jsonl"), `${JSON.stringify(row)}
+  appendFileSync13(join112(dir, "satisfaction.jsonl"), `${JSON.stringify(row)}
 `, { mode: 384 });
 }
 async function maybeAsk(o) {
@@ -73752,9 +73868,9 @@ __export(exports_supervisor, {
   BACKSTOP_GRACE_S: () => BACKSTOP_GRACE_S
 });
 import { spawn as spawn13, spawnSync as spawnSync16 } from "child_process";
-import { createHash as createHash31, createPublicKey as createPublicKey3, sign as sign2 } from "crypto";
-import { existsSync as existsSync79, mkdirSync as mkdirSync63, readFileSync as readFileSync97, writeFileSync as writeFileSync59 } from "fs";
-import { join as join112, relative as relative25, resolve as resolve36 } from "path";
+import { createHash as createHash32, createPublicKey as createPublicKey3, sign as sign2 } from "crypto";
+import { existsSync as existsSync80, mkdirSync as mkdirSync63, readFileSync as readFileSync98, writeFileSync as writeFileSync60 } from "fs";
+import { join as join113, relative as relative26, resolve as resolve36 } from "path";
 async function slackEvent(...a) {
   try {
     await (await Promise.resolve().then(() => (init_slack_events(), exports_slack_events))).notifyEvent(...a);
@@ -73781,9 +73897,9 @@ class SupervisorLog {
   constructor(path, runId2) {
     this.path = path;
     this.log = new EventLog(path, runId2);
-    this.hash = createHash31("sha256");
+    this.hash = createHash32("sha256");
     try {
-      this.hash.update(readFileSync97(path));
+      this.hash.update(readFileSync98(path));
     } catch {}
   }
   implementOpen = false;
@@ -73838,7 +73954,7 @@ class SupervisorLog {
     const expected = this.hash.copy().digest("hex");
     let actual = "";
     try {
-      actual = createHash31("sha256").update(readFileSync97(this.path)).digest("hex");
+      actual = createHash32("sha256").update(readFileSync98(this.path)).digest("hex");
     } catch {}
     if (actual === expected)
       return true;
@@ -73860,15 +73976,15 @@ async function runSupervisor(opts) {
   const t02 = Date.now();
   const startedProvider = opts.started?.["provider"];
   const env = opts.env ?? process.env;
-  await assertPreflight({ repoDir: opts.repoDir, provider: typeof startedProvider === "string" ? startedProvider : "claude", pr: opts.pr !== undefined, env, runDir: join112(opts.repoDir, ".loki", "runs", opts.runId) });
+  await assertPreflight({ repoDir: opts.repoDir, provider: typeof startedProvider === "string" ? startedProvider : "claude", pr: opts.pr !== undefined, env, runDir: join113(opts.repoDir, ".loki", "runs", opts.runId) });
   writeEngineMarker(opts.repoDir, opts.runId);
   const origin = readOriginUrl(opts.repoDir);
-  const rmRunPid = writeRunPid(join112(opts.repoDir, ".loki", "runs", opts.runId), opts.runId);
+  const rmRunPid = writeRunPid(join113(opts.repoDir, ".loki", "runs", opts.runId), opts.runId);
   process.once("exit", rmRunPid);
-  const log = new SupervisorLog(join112(opts.repoDir, eventsRelPath(opts.runId)), opts.runId);
+  const log = new SupervisorLog(join113(opts.repoDir, eventsRelPath(opts.runId)), opts.runId);
   if ((env.LOKI_CONTROL ?? process.env.LOKI_CONTROL) !== "0")
     Promise.resolve().then(() => (init_ship_hook(), exports_ship_hook)).then((m) => m.startShip(opts.repoDir, log.path, env)).catch(() => {});
-  const aliveDir = join112(opts.repoDir, ".loki", "runs", opts.runId), lastAlive = opts.resume ? readAliveBeat(aliveDir) : null;
+  const aliveDir = join113(opts.repoDir, ".loki", "runs", opts.runId), lastAlive = opts.resume ? readAliveBeat(aliveDir) : null;
   log.append(opts.resume ? "run.resumed" : "run.started", null, { ...opts.started, ...opts.resume ? { phase: "stage", ...lastAlive ? { last_alive_ts: new Date(lastAlive).toISOString() } : {} } : {}, origin_repo: githubRepoFromUrl(origin) });
   if (!opts.resume)
     Promise.resolve().then(() => (init_writeback(), exports_writeback)).then((m) => m.writeBack({ phase: "started", verdict: "", prUrl: null, receiptSha256: null, task: "" }, env));
@@ -73903,7 +74019,7 @@ async function runSupervisor(opts) {
     if (e10?.type === "receipt.sealed")
       sealed = e10.data;
     if (e10?.type === "variant" && e10.data.intent_confirm === true && workerEnv.LOKI_INTENT_TTY === "1") {
-      askIntent(String(e10.data.card ?? ""), join112(opts.repoDir, ".loki", "runs", opts.runId));
+      askIntent(String(e10.data.card ?? ""), join113(opts.repoDir, ".loki", "runs", opts.runId));
     }
   }, (stopped) => {
     for (const g10 of sessionGroups)
@@ -74002,8 +74118,8 @@ async function runSupervisor(opts) {
   }
   log.append("run.completed", null, { verdict, ...cancelled2 ? { cancelled: true, signal: cancelled2, outcome: "CANCELLED" } : {}, pr_url: prUrl, not_proven: notProven, cost_usd: costUsd, wall_s: wallS, pre_model: preModelTiming(allEvents, t02) });
   log.sealLog();
-  recordFingerprints(join112(opts.repoDir, ".loki", "state"), opts.runId, "failed", failedCheckNames(folded.stages["verify"]?.data.checks, folded.stages["verify"]?.data.pre_red_checks), cleanTreeId(opts.repoDir));
-  const stages = allEvents.filter((e10) => e10.type === "stage.completed" && typeof e10.data.duration_s === "number").map((e10) => ({ label: String(e10.stage), seconds: e10.data.duration_s })), pc2 = partialCost(allEvents, log.tampered), summary = { pr: prUrl ? { url: prUrl, draft: verdict !== "VERIFIED" } : null, verdict, outcome, notProven, flaky: recordFingerprints(join112(opts.repoDir, ".loki", "state"), opts.runId, "flaky", folded.stages["verify"]?.data.flaky, cleanTreeId(opts.repoDir)), wallS, stages, cost: { usd: costUsd, provider: String(opts.started?.provider ?? ""), tokens: summaryTokens(folded, allEvents.some((e10) => e10.type === "cost")), ...summaryCache(allEvents, log.tampered), partialUsd: pc2.usd, measuredSessions: pc2.measured, totalSessions: pc2.total, stageShares: log.tampered ? null : stageShareText(allEvents), capUsd: Number(opts.started?.["max_cost_usd"]) > 0 ? Number(opts.started?.["max_cost_usd"]) : undefined } };
+  recordFingerprints(join113(opts.repoDir, ".loki", "state"), opts.runId, "failed", failedCheckNames(folded.stages["verify"]?.data.checks, folded.stages["verify"]?.data.pre_red_checks), cleanTreeId(opts.repoDir));
+  const stages = allEvents.filter((e10) => e10.type === "stage.completed" && typeof e10.data.duration_s === "number").map((e10) => ({ label: String(e10.stage), seconds: e10.data.duration_s })), pc2 = partialCost(allEvents, log.tampered), summary = { pr: prUrl ? { url: prUrl, draft: verdict !== "VERIFIED" } : null, verdict, outcome, notProven, flaky: recordFingerprints(join113(opts.repoDir, ".loki", "state"), opts.runId, "flaky", folded.stages["verify"]?.data.flaky, cleanTreeId(opts.repoDir)), wallS, stages, cost: { usd: costUsd, provider: String(opts.started?.provider ?? ""), tokens: summaryTokens(folded, allEvents.some((e10) => e10.type === "cost")), ...summaryCache(allEvents, log.tampered), partialUsd: pc2.usd, measuredSessions: pc2.measured, totalSessions: pc2.total, stageShares: log.tampered ? null : stageShareText(allEvents), capUsd: Number(opts.started?.["max_cost_usd"]) > 0 ? Number(opts.started?.["max_cost_usd"]) : undefined } };
   await slackEvent(env, "finished", { summary: formatSummary(summary), outcome: String(outcome), cost: summary.cost.usd != null ? `$${summary.cost.usd.toFixed(2)}` : "not measured", time: `${Math.round(wallS)}s`, receipt: log.tampered ? "TAMPERED" : receiptVerdict ? verdict : undefined });
   rmRunPid();
   process.off("exit", rmRunPid);
@@ -74123,7 +74239,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
       return rec2;
   }
   const runId2 = `e10-${new Date().toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z")}-${Math.random().toString(16).slice(2, 6)}`;
-  const runDir = join112(repoDir, ".loki", "runs", runId2);
+  const runDir = join113(repoDir, ".loki", "runs", runId2);
   const cap = resolveCap(maxCost, repoDir);
   if ("error" in cap) {
     process.stderr.write(`engine10: ${cap.error}
@@ -74161,9 +74277,9 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
   }
   if (spec) {
     mkdirSync63(runDir, { recursive: true });
-    writeFileSync59(join112(runDir, "spec.snapshot.md"), spec.raw);
+    writeFileSync60(join113(runDir, "spec.snapshot.md"), spec.raw);
     for (const e10 of [env, process.env]) {
-      e10.LOKI_E10_SPEC_PATH = relative25(repoDir, spec.path);
+      e10.LOKI_E10_SPEC_PATH = relative26(repoDir, spec.path);
       e10.LOKI_E10_SPEC_SHA256 = spec.sha256;
       e10.LOKI_E10_REPO_DIR = repoDir;
     }
@@ -74173,7 +74289,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
   if (seed > 0)
     env.LOKI_E10_SPENT_USD = String(seed);
   if (sealPatch !== null) {
-    if (!existsSync79(sealPatch)) {
+    if (!existsSync80(sealPatch)) {
       process.stderr.write(`engine10: --seal-existing patch not found: ${sealPatch}
 `);
       return 2;
@@ -74186,9 +74302,9 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
     mkdirSync63(runDir, { recursive: true });
     try {
       if (trackerRef)
-        await fetchTrackerIssueToFile(trackerRef, join112(runDir, "issue.json"));
+        await fetchTrackerIssueToFile(trackerRef, join113(runDir, "issue.json"));
       else
-        fetchIssueToFile(task, join112(runDir, "issue.json"));
+        fetchIssueToFile(task, join113(runDir, "issue.json"));
     } catch (err) {
       process.stderr.write(`engine10: issue fetch failed: ${err.message.split(`
 `)[0]}
@@ -74218,7 +74334,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
     process.stdout.write(`${capLine}
 `);
   const t02 = Date.now();
-  const eventsPath = join112(repoDir, eventsRelPath(runId2));
+  const eventsPath = join113(repoDir, eventsRelPath(runId2));
   const live2 = (e10) => {
     const clockS = (Date.parse(e10.ts) - t02) / 1000;
     const d = e10.data;
@@ -74234,7 +74350,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
   };
   let stopTail = () => {};
   const tailTimer = setInterval(() => {
-    if (verbose && !json2 && existsSync79(eventsPath)) {
+    if (verbose && !json2 && existsSync80(eventsPath)) {
       clearInterval(tailTimer);
       stopTail = tail(eventsPath, live2, { intervalMs: 250 });
     }
@@ -74249,7 +74365,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
     let stopLiveTail = () => {};
     const tick2 = setInterval(() => liveLine.tick(), 1000);
     const wait2 = setInterval(() => {
-      if (existsSync79(eventsPath)) {
+      if (existsSync80(eventsPath)) {
         clearInterval(wait2);
         stopLiveTail = tail(eventsPath, (e10) => liveLine.onEvent(e10), { intervalMs: 250 });
       }
@@ -74265,7 +74381,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
   const reqOnce = async (evs) => {
     if (reqMap === undefined) {
       const rq2 = await Promise.resolve().then(() => (init_contract(), exports_contract));
-      reqMap = rq2.writeFromEngine10(repoDir, join112(repoDir, ".loki"), runDir, isIssue ? null : task, evs);
+      reqMap = rq2.writeFromEngine10(repoDir, join113(repoDir, ".loki"), runDir, isIssue ? null : task, evs);
     }
     return reqMap;
   };
@@ -74328,8 +74444,8 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
     comment: noPr ? undefined : async ({ issueRef, reason, prUrl }) => {
       const { DEFAULT_PUSH_SH: DEFAULT_PUSH_SH2 } = await Promise.resolve().then(() => (init_pr(), exports_pr));
       mkdirSync63(runDir, { recursive: true });
-      const bodyFile = join112(runDir, "backstop-comment.md");
-      writeFileSync59(bodyFile, `<!-- loki-backstop -->
+      const bodyFile = join113(runDir, "backstop-comment.md");
+      writeFileSync60(bodyFile, `<!-- loki-backstop -->
 Loki 10 run ${runId2} ${prUrl ? `opened draft PR ${prUrl}` : "ended without a PR"}.
 
 ${prUrl ? "One question" : "Reason"}: ${reason}
@@ -74390,7 +74506,7 @@ ${prUrl ? "One question" : "Reason"}: ${reason}
   const rr2 = resultOf(res.outcome);
   if (res.outcome === "BUDGET_STOP" && cap.usd > 0)
     writeBudgetStop(repoDir, runId2, { task: task.trim(), cap_usd: cap.usd, spent_usd: seed + (usd ?? 0), source: cap.source });
-  const ui2 = { result: rr2, filesChanged: ds2?.files ?? null, insertions: ds2?.ins, deletions: ds2?.del, costUsd: usd, elapsedS: Number(f.run.completed?.data.wall_s ?? (Date.now() - t02) / 1000), receiptPath: res.receiptSha ? join112(runDir, "receipt.json") : null, next: res.outcome === "BUDGET_STOP" && cap.usd > 0 ? budgetNext(seed + (usd ?? 0), cap.usd) : nextOf(rr2, ds2?.files ?? null, reasonOf(events2, res.tampered, res.stop, res.outcome), provider, runId2), uncovered };
+  const ui2 = { result: rr2, filesChanged: ds2?.files ?? null, insertions: ds2?.ins, deletions: ds2?.del, costUsd: usd, elapsedS: Number(f.run.completed?.data.wall_s ?? (Date.now() - t02) / 1000), receiptPath: res.receiptSha ? join113(runDir, "receipt.json") : null, next: res.outcome === "BUDGET_STOP" && cap.usd > 0 ? budgetNext(seed + (usd ?? 0), cap.usd) : nextOf(rr2, ds2?.files ?? null, reasonOf(events2, res.tampered, res.stop, res.outcome), provider, runId2), uncovered };
   const rdy = events2.find((e10) => e10.type === "stage.completed" && e10.stage === "intake")?.data.readiness, foldTail = [handoffRef, typeof rdy === "string" ? rdy : ""].filter(Boolean).join("; ");
   const riskLine = readRiskSummary(repoDir, t02);
   process.stdout.write(json2 ? `${JSON.stringify({ ...JSON.parse(out3), summary: { ...summaryObject(ui2), ...riskLine ? { risk: riskLine } : {} } })}
@@ -74445,8 +74561,8 @@ var init_supervisor = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/compound_match.ts
-import { readFileSync as readFileSync98 } from "fs";
-import { basename as basename28, join as join113 } from "path";
+import { readFileSync as readFileSync99 } from "fs";
+import { basename as basename29, join as join114 } from "path";
 function parts(s) {
   return s.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().match(/[a-z0-9]+/g) ?? [];
 }
@@ -74467,13 +74583,13 @@ function fuzzyHit(word, ps2) {
 }
 function linkedHits(word, repoMap, testMap, repoDir) {
   const out3 = [];
-  const srcs = repoMap.entries.filter((e10) => !vendored(e10.path) && e10.symbols.some((s) => fuzzyHit(word, parts(s))) && fuzzyHit(word, parts(basename28(e10.path))));
+  const srcs = repoMap.entries.filter((e10) => !vendored(e10.path) && e10.symbols.some((s) => fuzzyHit(word, parts(s))) && fuzzyHit(word, parts(basename29(e10.path))));
   for (const t of testMap.tests) {
-    if (vendored(t.path) || !fuzzyHit(word, parts(basename28(t.path))))
+    if (vendored(t.path) || !fuzzyHit(word, parts(basename29(t.path))))
       continue;
     let body;
     try {
-      body = importLines(readFileSync98(join113(repoDir, t.path), "utf8"));
+      body = importLines(readFileSync99(join114(repoDir, t.path), "utf8"));
     } catch {
       continue;
     }
@@ -74487,15 +74603,15 @@ function linkedHits(word, repoMap, testMap, repoDir) {
   }
   return out3;
 }
-var MIN_PREFIX = 5, SUFFIX, VENDORED, vendored = (p) => p.split("/").some((s) => VENDORED.has(s)), stemOf2 = (p) => parts(basename28(p)).slice(0, -1).filter((x3) => x3 !== "test" && x3 !== "spec").join("-");
+var MIN_PREFIX = 5, SUFFIX, VENDORED, vendored = (p) => p.split("/").some((s) => VENDORED.has(s)), stemOf2 = (p) => parts(basename29(p)).slice(0, -1).filter((x3) => x3 !== "test" && x3 !== "spec").join("-");
 var init_compound_match = __esm(() => {
   SUFFIX = /^(ation|ization|isation|ity|ivity|ments?|ives?|als?|ures?|ness|ism|ist|ize|ise|able|ible|ous|ics?|ings?|ed|ers?|ions?|ly|less|es|s|(ful|hood|ship|dom|ance|ence|ancy|ency|ator|ant|ent|ary|ery|ory|ward|wise|like|ish)s?)$/;
   VENDORED = new Set(["vendor", "third_party", "build", ".venv", "__generated__", "coverage", "node_modules", "dist"]);
 });
 
 // ../../loki-ts/src/util/already_done_evidence.ts
-import { existsSync as existsSync80, readFileSync as readFileSync99 } from "fs";
-import { basename as basename29, join as join114 } from "path";
+import { existsSync as existsSync81, readFileSync as readFileSync100 } from "fs";
+import { basename as basename30, join as join115 } from "path";
 function keywords2(task) {
   const words3 = task.toLowerCase().match(/[a-z0-9_]+/g) ?? [];
   return Array.from(new Set(words3.filter((w) => w.length > 2 && !STOP_WORDS.has(w))));
@@ -74516,7 +74632,7 @@ function codeEvidence(words3, repoMap) {
 function testEvidence(words3, testMap) {
   const hits = [];
   for (const t of testMap.tests) {
-    const toks = tokenSet(basename29(t.path));
+    const toks = tokenSet(basename30(t.path));
     if (words3.some((w) => toks.has(w)))
       hits.push({ source: "test", path: t.path, line: t.path });
   }
@@ -74527,7 +74643,7 @@ function docEvidence(words3, repoDir) {
   for (const name of DOC_FILES) {
     let text4;
     try {
-      text4 = readFileSync99(join114(repoDir, name), "utf8");
+      text4 = readFileSync100(join115(repoDir, name), "utf8");
     } catch {
       continue;
     }
@@ -74589,7 +74705,7 @@ function citesToken(text4, token) {
 function citesRealHit(text4, hit, repoDir) {
   if (hit.source === "changelog")
     return false;
-  return (citesToken(text4, hit.path) || citesToken(text4, basename29(hit.path))) && existsSync80(join114(repoDir, hit.path));
+  return (citesToken(text4, hit.path) || citesToken(text4, basename30(hit.path))) && existsSync81(join115(repoDir, hit.path));
 }
 function renderAlreadyDoneComment(evidence) {
   return ["Loki 10: no change needed. This already appears to be implemented.", "", "Evidence:", ...evidence.map((e10) => `- ${e10}`), ""].join(`
@@ -74790,8 +74906,8 @@ __export(exports_warm, {
   dirtyHash: () => dirtyHash,
   WarmEngine: () => WarmEngine
 });
-import { createHash as createHash32 } from "crypto";
-import { existsSync as existsSync81, mkdirSync as mkdirSync64, readFileSync as readFileSync100, statSync as statSync32, unlinkSync as unlinkSync11 } from "fs";
+import { createHash as createHash33 } from "crypto";
+import { existsSync as existsSync82, mkdirSync as mkdirSync64, readFileSync as readFileSync101, statSync as statSync32, unlinkSync as unlinkSync11 } from "fs";
 import { createServer as createServer2 } from "net";
 import { dirname as dirname45, resolve as resolve37 } from "path";
 function speedEnabled() {
@@ -74812,7 +74928,7 @@ function dirtyHash(repoDir) {
   const out3 = git12(repoDir, ["status", "--porcelain", "-uall"]);
   if (out3 === null || out3.trim() === "")
     return "";
-  const h10 = createHash32("sha256");
+  const h10 = createHash33("sha256");
   for (const line2 of out3.split(`
 `).filter(Boolean).sort()) {
     h10.update(line2 + `
@@ -74820,8 +74936,8 @@ function dirtyHash(repoDir) {
     const rel = line2.slice(3).split(" -> ").pop().replace(/^"|"$/g, "");
     try {
       const p = resolve37(repoDir, rel);
-      if (existsSync81(p) && statSync32(p).isFile() && statSync32(p).size <= MAX_HASHED_BYTES)
-        h10.update(readFileSync100(p));
+      if (existsSync82(p) && statSync32(p).isFile() && statSync32(p).size <= MAX_HASHED_BYTES)
+        h10.update(readFileSync101(p));
     } catch {}
   }
   return h10.digest("hex");
@@ -74931,9 +75047,9 @@ var init_warm = __esm(() => {
 
 // ../../loki-ts/src/features/speed/already_done_async.ts
 import { execFile as execFile3 } from "child_process";
-import { mkdirSync as mkdirSync65, mkdtempSync as mkdtempSync15, rmSync as rmSync33 } from "fs";
-import { tmpdir as tmpdir19 } from "os";
-import { join as join115 } from "path";
+import { mkdirSync as mkdirSync65, mkdtempSync as mkdtempSync16, rmSync as rmSync34 } from "fs";
+import { tmpdir as tmpdir20 } from "os";
+import { join as join116 } from "path";
 function hitsUnchangedFromBase(repoDir, baseSha, paths) {
   if (paths.length === 0 || !baseSha)
     return false;
@@ -74957,7 +75073,7 @@ function trackRoot(root) {
   process.on("exit", () => {
     for (const r of liveRoots) {
       try {
-        rmSync33(r, { recursive: true, force: true });
+        rmSync34(r, { recursive: true, force: true });
       } catch {}
     }
   });
@@ -74965,29 +75081,29 @@ function trackRoot(root) {
 function dropRoot(root) {
   liveRoots.delete(root);
   try {
-    rmSync33(root, { recursive: true, force: true });
+    rmSync34(root, { recursive: true, force: true });
   } catch {}
 }
 function pinBaseTree(ctx, signal) {
   let root;
   try {
-    root = mkdtempSync15(join115(tmpdir19(), "loki-already-done-"));
+    root = mkdtempSync16(join116(tmpdir20(), "loki-already-done-"));
   } catch {
     return Promise.resolve(null);
   }
   trackRoot(root);
   try {
-    mkdirSync65(join115(root, "tree"));
+    mkdirSync65(join116(root, "tree"));
   } catch {
     dropRoot(root);
     return Promise.resolve(null);
   }
-  const tarball = join115(root, "base.tar");
+  const tarball = join116(root, "base.tar");
   const step = (cmd2, args, cwd) => new Promise((res) => {
     execFile3(cmd2, args, { env: process.env, signal, cwd }, (err) => res(!err));
   });
   return (async () => {
-    if (!ctx.baseSha || (await safeGitRun(ctx.repoDir, ["archive", "-o", tarball, ctx.baseSha], { signal })).exitCode !== 0 || !await step("tar", ["-x", "-f", tarball, "-C", join115(root, "tree")], root)) {
+    if (!ctx.baseSha || (await safeGitRun(ctx.repoDir, ["archive", "-o", tarball, ctx.baseSha], { signal })).exitCode !== 0 || !await step("tar", ["-x", "-f", tarball, "-C", join116(root, "tree")], root)) {
       dropRoot(root);
       return null;
     }
@@ -75045,7 +75161,7 @@ function deferAlreadyDone(ctx, signal, task, repoMap, testMap, apply) {
     if (!root)
       return;
     try {
-      const r = await checkAlreadyDone({ ...ctx, repoDir: join115(root, "tree"), sessions: inner }, check.signal, task, repoMap, testMap);
+      const r = await checkAlreadyDone({ ...ctx, repoDir: join116(root, "tree"), sessions: inner }, check.signal, task, repoMap, testMap);
       const ph = phase;
       if (r && ph !== "done" && !check.signal.aborted) {
         hit = r;
@@ -75071,8 +75187,8 @@ __export(exports_intake, {
   stage: () => stage8,
   runIntake: () => runIntake
 });
-import { appendFileSync as appendFileSync14, existsSync as existsSync82, mkdirSync as mkdirSync66, readFileSync as readFileSync101, writeFileSync as writeFileSync60 } from "fs";
-import { dirname as dirname46, join as join116, resolve as resolve38 } from "path";
+import { appendFileSync as appendFileSync14, existsSync as existsSync83, mkdirSync as mkdirSync66, readFileSync as readFileSync102, writeFileSync as writeFileSync61 } from "fs";
+import { dirname as dirname46, join as join117, resolve as resolve38 } from "path";
 function issueRefOf(raw2) {
   return typeof raw2.repo === "string" && raw2.repo && typeof raw2.number === "number" ? `${raw2.repo}#${raw2.number}` : null;
 }
@@ -75092,11 +75208,11 @@ function ensureBranch(repoDir, branch, from) {
   }
 }
 function excludeLokiDir(repoDir) {
-  let path = join116(repoDir, ".git", "info", "exclude");
+  let path = join117(repoDir, ".git", "info", "exclude");
   try {
     path = resolve38(repoDir, git13(repoDir, ["rev-parse", "--git-path", "info/exclude"]));
   } catch {}
-  const existing = existsSync82(path) ? readFileSync101(path, "utf8") : "";
+  const existing = existsSync83(path) ? readFileSync102(path, "utf8") : "";
   if (existing.split(`
 `).some((l) => l.trim() === ".loki/"))
     return;
@@ -75108,7 +75224,7 @@ function excludeLokiDir(repoDir) {
 `);
 }
 function loadIssue(path) {
-  const raw2 = JSON.parse(readFileSync101(path, "utf8"));
+  const raw2 = JSON.parse(readFileSync102(path, "utf8"));
   return { state: typeof raw2.state === "string" ? raw2.state.toLowerCase() : null, closed_by_merged_pr: raw2.closed_by_merged_pr === true };
 }
 function isAlreadyDone(issue) {
@@ -75158,16 +75274,16 @@ async function runIntakeBody(ctx, signal, opts, held) {
     ensureBranch(ctx.repoDir, ctx.branch);
   const tree = git13(ctx.repoDir, ["rev-parse", "HEAD^{tree}"]);
   excludeLokiDir(ctx.repoDir);
-  const issueJsonPath = opts.issueJsonPath ?? process.env.LOKI_E10_ISSUE_JSON ?? join116(ctx.runDir, "issue.json");
+  const issueJsonPath = opts.issueJsonPath ?? process.env.LOKI_E10_ISSUE_JSON ?? join117(ctx.runDir, "issue.json");
   const taskText = opts.taskText ?? process.env.LOKI_E10_TASK_TEXT;
   let source;
   let taskSha256;
   let task = taskText ?? "";
   let alreadySatisfied2 = false;
   let issueRef = null;
-  if (existsSync82(issueJsonPath)) {
+  if (existsSync83(issueJsonPath)) {
     source = "issue";
-    const raw2 = readFileSync101(issueJsonPath, "utf8");
+    const raw2 = readFileSync102(issueJsonPath, "utf8");
     taskSha256 = sha2562(raw2);
     const i = JSON.parse(raw2);
     task = [i.title, i.body].filter((x3) => typeof x3 === "string" && x3 !== "").join(`
@@ -75188,10 +75304,10 @@ async function runIntakeBody(ctx, signal, opts, held) {
     return { status: "completed", data: { ...common, task_sha256: taskSha256, source, base_sha: baseSha, tree, branch: ctx.branch, already_satisfied: true } };
   }
   mkdirSync66(ctx.runDir, { recursive: true });
-  const repomapRef = join116(ctx.runDir, "repomap.json");
+  const repomapRef = join117(ctx.runDir, "repomap.json");
   const cacheDir = repoCacheDir(repoKey(null, ctx.repoDir));
   const repoMap = cachedRepoMap(cacheDir, tree, () => buildRepoMap(ctx.repoDir));
-  writeFileSync60(repomapRef, JSON.stringify(repoMap));
+  writeFileSync61(repomapRef, JSON.stringify(repoMap));
   let testmap = readTestMapCache(cacheDir, tree);
   if (!testmap) {
     testmap = await ctx.tests.detect(ctx.repoDir);
@@ -75209,8 +75325,8 @@ async function runIntakeBody(ctx, signal, opts, held) {
   const already = speedEnabled() ? null : await checkAlreadyDone(ctx, signal, task, repoMap, testmap);
   const alreadyData = (already2) => {
     const comment = renderAlreadyDoneComment(already2.evidence);
-    const bodyFile = join116(ctx.runDir, "already-done-comment.md");
-    writeFileSync60(bodyFile, comment, "utf8");
+    const bodyFile = join117(ctx.runDir, "already-done-comment.md");
+    writeFileSync61(bodyFile, comment, "utf8");
     const commentArgv = source === "issue" && issueRef ? buildAlreadyDoneCommentArgv(ctx.runId, issueRef, bodyFile) : undefined;
     return { already_satisfied: true, evidence: already2.evidence, iteration_ids: [`${ctx.runId}-already-done`], comment, ...commentArgv ? { comment_argv: commentArgv } : {} };
   };
@@ -75306,6 +75422,7 @@ var init_fix = __esm(() => {
   init_anti_loop();
   init_session_resume();
   init_conflict_resume();
+  init_implement();
   init_install();
   fixStage = {
     name: "fix",
@@ -75349,6 +75466,10 @@ var init_fix = __esm(() => {
         const last = r.ids[r.ids.length - 1], rc2 = await resumeAfterConflict(ctx, { ...sessionBase, iterationId: last, brief: fullBrief }, r.session);
         r = { ...r, session: rc2.session, ids: rc2.iterationId === last ? r.ids : [...r.ids, rc2.iterationId] };
       }
+      const ro = prior.wall?.readOnlyFiles ?? [], wd2 = r.session.markers.specConflict && !r.session.killed ? await adjudicateWallConflict(ctx, { ...sessionBase, iterationId: r.ids[r.ids.length - 1], brief: fullBrief }, r.session, ro) : null;
+      if (wd2)
+        r = { ...r, session: wd2.session, ids: [...r.ids, ...wd2.ids] };
+      const testsReverted = restoreReadOnly(ro), wallDefect = wd2?.defect ?? prior.fix?.wall_defect;
       const treeAfter = treeFingerprint(ctx.repoDir, ctx.baseSha), conflict = r.session.markers.specConflict && !r.session.killed && treeBefore !== null && treeBefore === treeAfter ? r.session.markers.specConflict : null;
       ctx.emit("fix.round", "fix", {
         round: round2,
@@ -75372,6 +75493,8 @@ var init_fix = __esm(() => {
           tree_after: treeAfter,
           ...conflict ? { exit: "spec_conflict", spec_conflict_reason: conflict } : {},
           killed: r.session.killed,
+          tests_reverted: testsReverted,
+          ...wallDefect ? { wall_defect: wallDefect } : {},
           cascade: repeated,
           model: actualModel,
           ...stallEsc ? { stall_escalated: true } : {},
@@ -75394,7 +75517,7 @@ __export(exports_keys_cmd, {
   takePubkey: () => takePubkey,
   main: () => main5
 });
-import { readFileSync as readFileSync102 } from "fs";
+import { readFileSync as readFileSync103 } from "fs";
 import { parseArgs } from "util";
 import { createPublicKey as createPublicKey4 } from "crypto";
 function takePubkey(args) {
@@ -75407,7 +75530,7 @@ function takePubkey(args) {
       return { args: rest };
     if (!(file = pubkey[0]))
       throw new Error("--pubkey requires a file argument");
-    const t = readFileSync102(file, "utf8"), key = createPublicKey4(t.trim().startsWith("{") ? { key: JSON.parse(t), format: "jwk" } : t);
+    const t = readFileSync103(file, "utf8"), key = createPublicKey4(t.trim().startsWith("{") ? { key: JSON.parse(t), format: "jwk" } : t);
     return key.asymmetricKeyType === "ed25519" ? { args: rest, pubkey: key } : { args: rest, error: `cannot read an Ed25519 public key from ${file}` };
   } catch (e10) {
     return { args: [], error: file ? `cannot read an Ed25519 public key from ${file}` : e10.message.replace(/^./, (c) => c.toLowerCase()) };
@@ -75665,7 +75788,7 @@ var groupRoute = async (repoDir, rawGroup) => {
 };
 
 // ../../loki-ts/src/engine10/modernize/types.ts
-import { join as join117 } from "path";
+import { join as join118 } from "path";
 function makeModernizeId(now2 = new Date) {
   const utc = now2.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
   const short = Math.floor(Math.random() * 16777215).toString(16).padStart(6, "0");
@@ -75675,13 +75798,13 @@ function isModernizeId(mid) {
   return MID_RE.test(mid);
 }
 function modernizeRoot(repoDir, mid) {
-  return join117(repoDir, ".loki", "modernize", mid);
+  return join118(repoDir, ".loki", "modernize", mid);
 }
 function modernizeEventsPath(repoDir, mid) {
-  return join117(modernizeRoot(repoDir, mid), "events.jsonl");
+  return join118(modernizeRoot(repoDir, mid), "events.jsonl");
 }
 function planPath(repoDir, mid) {
-  return join117(modernizeRoot(repoDir, mid), "plan.json");
+  return join118(modernizeRoot(repoDir, mid), "plan.json");
 }
 function isSafeUnitId(unit) {
   return typeof unit === "string" && unit.length <= MAX_UNIT_ID && UNIT_ID_RE2.test(unit) && !unit.includes("..");
@@ -75692,13 +75815,13 @@ function encodeUnitId(unit) {
   return unit.replace(/\//g, "%2F");
 }
 function oracleDir(repoDir, mid, unit) {
-  return join117(modernizeRoot(repoDir, mid), "oracle", encodeUnitId(unit));
+  return join118(modernizeRoot(repoDir, mid), "oracle", encodeUnitId(unit));
 }
 function reportJsonPath(repoDir, mid) {
-  return join117(modernizeRoot(repoDir, mid), "report.json");
+  return join118(modernizeRoot(repoDir, mid), "report.json");
 }
 function reportMdPath(repoDir, mid) {
-  return join117(modernizeRoot(repoDir, mid), "report.md");
+  return join118(modernizeRoot(repoDir, mid), "report.md");
 }
 var MID_RE, UNIT_ID_SEGMENT = "[A-Za-z0-9][A-Za-z0-9_.-]*", UNIT_ID_RE2, MAX_UNIT_ID = 128;
 var init_types2 = __esm(() => {
@@ -75737,14 +75860,14 @@ __export(exports_dashboard, {
   modernizeRoute: () => modernizeRoute,
   listModernizeIds: () => listModernizeIds
 });
-import { existsSync as existsSync83, readdirSync as readdirSync36 } from "fs";
-import { join as join118 } from "path";
+import { existsSync as existsSync84, readdirSync as readdirSync36 } from "fs";
+import { join as join119 } from "path";
 function modernizeDir(repoDir) {
-  return join118(repoDir, ".loki", "modernize");
+  return join119(repoDir, ".loki", "modernize");
 }
 function listModernizeIds(repoDir) {
   const dir = modernizeDir(repoDir);
-  if (!existsSync83(dir))
+  if (!existsSync84(dir))
     return [];
   return readdirSync36(dir, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
 }
@@ -76075,11 +76198,11 @@ var init_engine10_dashboard = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/modernize/inventory.ts
-import { readFileSync as readFileSync103 } from "fs";
-import { extname as extname3, join as join119 } from "path";
+import { readFileSync as readFileSync104 } from "fs";
+import { extname as extname3, join as join120 } from "path";
 function readCapped2(absPath) {
   try {
-    return readFileSync103(absPath, "utf8").slice(0, MAX_SCAN_BYTES2);
+    return readFileSync104(absPath, "utf8").slice(0, MAX_SCAN_BYTES2);
   } catch {
     return "";
   }
@@ -76096,9 +76219,9 @@ function detectEntryPoints(repoDir, files) {
   const out3 = [];
   for (const rel of files) {
     const ext = extname3(rel);
-    if (ext === ".py" && PY_MAIN_RE.test(readCapped2(join119(repoDir, rel))))
+    if (ext === ".py" && PY_MAIN_RE.test(readCapped2(join120(repoDir, rel))))
       out3.push(rel);
-    else if (ext === ".java" && JAVA_MAIN_RE.test(readCapped2(join119(repoDir, rel))))
+    else if (ext === ".java" && JAVA_MAIN_RE.test(readCapped2(join120(repoDir, rel))))
       out3.push(rel);
   }
   return out3;
@@ -76148,7 +76271,7 @@ var init_inventory = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/modernize/lang/python.ts
-import { join as join120 } from "path";
+import { join as join121 } from "path";
 async function buildPythonGraph(repoDir, files, opts = {}) {
   if (files.length === 0)
     return { graph: { nodes: [], edges: [] }, unresolved: [] };
@@ -76187,7 +76310,7 @@ var init_python2 = __esm(() => {
   init_paths();
   init_python();
   init_shell();
-  SCRIPT = join120(REPO_ROOT, "autonomy", "lib", "modernize", "py_imports.py");
+  SCRIPT = join121(REPO_ROOT, "autonomy", "lib", "modernize", "py_imports.py");
 });
 
 // ../../loki-ts/src/engine10/modernize/cluster.ts
@@ -76365,9 +76488,9 @@ var init_codemod = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/modernize/oracle/seal.ts
-import { createHash as createHash33 } from "crypto";
-import { existsSync as existsSync84, mkdirSync as mkdirSync67, readFileSync as readFileSync104, writeFileSync as writeFileSync61 } from "fs";
-import { join as join121 } from "path";
+import { createHash as createHash34 } from "crypto";
+import { existsSync as existsSync85, mkdirSync as mkdirSync67, readFileSync as readFileSync105, writeFileSync as writeFileSync62 } from "fs";
+import { join as join122 } from "path";
 function normalizersSha(n11) {
   return sha2564(JSON.stringify({
     float_tolerance: n11.float_tolerance,
@@ -76429,25 +76552,25 @@ function alreadySealedInLog(repoDir, mid, unit) {
 }
 function sealOracle(repoDir, mid, unit, log, normalizers = DEFAULT_NORMALIZERS) {
   const dir = oracleDir(repoDir, mid, unit);
-  const casesPath = join121(dir, "cases.jsonl");
-  const coveragePath = join121(dir, "coverage.json");
-  const sealedPath = join121(dir, "sealed.json");
+  const casesPath = join122(dir, "cases.jsonl");
+  const coveragePath = join122(dir, "coverage.json");
+  const sealedPath = join122(dir, "sealed.json");
   if (alreadySealedInLog(repoDir, mid, unit)) {
     throw new Error(`oracle seal: ${unit} already has a sealing event in the modernize log; re-seal refused (seal is write-once)`);
   }
-  if (existsSync84(sealedPath)) {
+  if (existsSync85(sealedPath)) {
     throw new Error(`oracle seal: ${unit} is already sealed; re-seal refused (seal is write-once)`);
   }
-  if (!existsSync84(casesPath))
+  if (!existsSync85(casesPath))
     throw new Error(`oracle seal: missing ${casesPath}`);
-  if (!existsSync84(coveragePath))
+  if (!existsSync85(coveragePath))
     throw new Error(`oracle seal: missing ${coveragePath}`);
-  const casesRaw = readFileSync104(casesPath, "utf8");
-  const coverageRaw = readFileSync104(coveragePath, "utf8");
+  const casesRaw = readFileSync105(casesPath, "utf8");
+  const coverageRaw = readFileSync105(coveragePath, "utf8");
   const normalizersHash = normalizersSha(normalizers);
   const sealed = buildSealedOracle(unit, casesRaw, coverageRaw, normalizersHash);
   mkdirSync67(dir, { recursive: true });
-  writeFileSync61(sealedPath, JSON.stringify(sealed, null, 2));
+  writeFileSync62(sealedPath, JSON.stringify(sealed, null, 2));
   log.append(sealed.verdict === "PROVEN_ORACLE" ? "oracle.captured" : "oracle.flagged", {
     unit,
     cases: sealed.case_count,
@@ -76462,24 +76585,24 @@ function sealOracle(repoDir, mid, unit, log, normalizers = DEFAULT_NORMALIZERS)
 }
 function verifySeal(repoDir, mid, unit) {
   const dir = oracleDir(repoDir, mid, unit);
-  const sealedPath = join121(dir, "sealed.json");
-  const casesPath = join121(dir, "cases.jsonl");
-  const coveragePath = join121(dir, "coverage.json");
-  if (!existsSync84(sealedPath))
+  const sealedPath = join122(dir, "sealed.json");
+  const casesPath = join122(dir, "cases.jsonl");
+  const coveragePath = join122(dir, "coverage.json");
+  if (!existsSync85(sealedPath))
     return { ok: false, reason: "no sealed.json" };
-  if (!existsSync84(casesPath))
+  if (!existsSync85(casesPath))
     return { ok: false, reason: "missing cases.jsonl" };
-  if (!existsSync84(coveragePath))
+  if (!existsSync85(coveragePath))
     return { ok: false, reason: "missing coverage.json" };
   const sealEvent = readModernizeEvents(repoDir, mid).find((e10) => (e10.type === "oracle.captured" || e10.type === "oracle.flagged") && e10.data.unit === unit);
   if (!sealEvent) {
     return { ok: false, reason: "no sealing event for this unit in the modernize log; sealed.json is not anchored" };
   }
-  const casesRaw = readFileSync104(casesPath, "utf8");
+  const casesRaw = readFileSync105(casesPath, "utf8");
   if (sha2564(casesRaw) !== sealEvent.data.cases_sha256) {
     return { ok: false, reason: "cases.jsonl does not match the sealing event's hash (tampered or re-captured)" };
   }
-  const coverageRaw = readFileSync104(coveragePath, "utf8");
+  const coverageRaw = readFileSync105(coveragePath, "utf8");
   if (sha2564(coverageRaw) !== sealEvent.data.coverage_sha256) {
     return { ok: false, reason: "coverage.json does not match the sealing event's hash (tampered or re-captured)" };
   }
@@ -76495,13 +76618,13 @@ function verifySeal(repoDir, mid, unit) {
       reason: `verdict does not match the sealing event (event type ${sealEvent.type}, recomputed verdict ${recomputed.verdict})`
     };
   }
-  const sealed = JSON.parse(readFileSync104(sealedPath, "utf8"));
+  const sealed = JSON.parse(readFileSync105(sealedPath, "utf8"));
   if (JSON.stringify(sealed) !== JSON.stringify(recomputed)) {
     return { ok: false, reason: "sealed.json does not match the record recomputed from cases.jsonl and coverage.json (hand-edited)" };
   }
   return { ok: true };
 }
-var sha2564 = (s) => createHash33("sha256").update(s).digest("hex"), DEFAULT_NORMALIZERS, HELD_OUT_FRACTION = 0.2, COVERAGE_FLOOR_PCT = 80, MIN_CASES_FOR_HELD_OUT = 2;
+var sha2564 = (s) => createHash34("sha256").update(s).digest("hex"), DEFAULT_NORMALIZERS, HELD_OUT_FRACTION = 0.2, COVERAGE_FLOOR_PCT = 80, MIN_CASES_FOR_HELD_OUT = 2;
 var init_seal2 = __esm(() => {
   init_holdout();
   init_log();
@@ -76511,9 +76634,9 @@ var init_seal2 = __esm(() => {
 
 // ../../loki-ts/src/engine10/modernize/oracle/search.ts
 import { spawnSync as spawnSync18 } from "child_process";
-import { copyFileSync as copyFileSync6, existsSync as existsSync85, linkSync as linkSync4, mkdirSync as mkdirSync68, mkdtempSync as mkdtempSync16, readFileSync as readFileSync105, renameSync as renameSync22, rmSync as rmSync34, rmdirSync as rmdirSync2, writeFileSync as writeFileSync62 } from "fs";
-import { tmpdir as tmpdir20 } from "os";
-import { basename as basename30, dirname as dirname47, join as join122 } from "path";
+import { copyFileSync as copyFileSync6, existsSync as existsSync86, linkSync as linkSync4, mkdirSync as mkdirSync68, mkdtempSync as mkdtempSync17, readFileSync as readFileSync106, renameSync as renameSync22, rmSync as rmSync35, rmdirSync as rmdirSync2, writeFileSync as writeFileSync63 } from "fs";
+import { tmpdir as tmpdir21 } from "os";
+import { basename as basename31, dirname as dirname47, join as join123 } from "path";
 function search(unitSource, seedCases, propose, runCapture, opts = {}) {
   const maxRounds = opts.maxRounds ?? 10;
   const plateauLimit = opts.plateauRounds ?? 2;
@@ -76570,12 +76693,12 @@ function realCaptureRunner(unitPath, cases, outPath) {
     return captureFailed("old runtime unavailable");
   let dir = "";
   try {
-    dir = mkdtempSync16(join122(tmpdir20(), "m10-search-"));
-    const casesFile = join122(dir, "cases.jsonl");
-    const outFile = join122(dir, "out.jsonl");
-    const covFile = join122(dir, "coverage.json");
+    dir = mkdtempSync17(join123(tmpdir21(), "m10-search-"));
+    const casesFile = join123(dir, "cases.jsonl");
+    const outFile = join123(dir, "out.jsonl");
+    const covFile = join123(dir, "coverage.json");
     const lines2 = cases.map((c) => JSON.stringify({ entry: c.entry, args: c.args, kwargs: c.kwargs }));
-    writeFileSync62(casesFile, lines2.length ? lines2.join(`
+    writeFileSync63(casesFile, lines2.length ? lines2.join(`
 `) + `
 ` : "");
     const r = spawnSync18(py2, [
@@ -76594,7 +76717,7 @@ function realCaptureRunner(unitPath, cases, outPath) {
 `).find((l) => l.trim().length > 0) ?? "(no stderr)";
       return captureFailed(`py_capture.py exit ${r.status}: ${firstErrLine}`);
     }
-    const raw2 = JSON.parse(readFileSync105(covFile, "utf8"));
+    const raw2 = JSON.parse(readFileSync106(covFile, "utf8"));
     if (outPath)
       copyFileSync6(outFile, outPath);
     return {
@@ -76607,7 +76730,7 @@ function realCaptureRunner(unitPath, cases, outPath) {
     return captureFailed(`capture error: ${e10 instanceof Error ? e10.message : String(e10)}`);
   } finally {
     if (dir)
-      rmSync34(dir, { recursive: true, force: true });
+      rmSync35(dir, { recursive: true, force: true });
   }
 }
 function resolveOldRuntimeSync() {
@@ -76621,13 +76744,13 @@ function resolveOldRuntimeSync() {
 }
 function makeProposeInputs(session, cap = 20) {
   return (unitPath, missing, round2) => {
-    const cwd = mkdtempSync16(join122(tmpdir20(), "m27-propose-"));
+    const cwd = mkdtempSync17(join123(tmpdir21(), "m27-propose-"));
     try {
-      const unitFile = join122(cwd, basename30(unitPath));
+      const unitFile = join123(cwd, basename31(unitPath));
       copyFileSync6(unitPath, unitFile);
       session({ cwd, env: tokenFreeEnv(), unitFile, missing, round: round2 });
       const out3 = [];
-      for (const line2 of readFileSync105(join122(cwd, "proposals.jsonl"), "utf8").split(`
+      for (const line2 of readFileSync106(join123(cwd, "proposals.jsonl"), "utf8").split(`
 `)) {
         try {
           const c = JSON.parse(line2);
@@ -76639,13 +76762,13 @@ function makeProposeInputs(session, cap = 20) {
     } catch {
       return [];
     } finally {
-      rmSync34(cwd, { recursive: true, force: true });
+      rmSync35(cwd, { recursive: true, force: true });
     }
   };
 }
 function captureUnitOracle(a) {
   const dir = oracleDir(a.repoDir, a.mid, a.unit);
-  if (existsSync85(join122(dir, "cases.jsonl")) || alreadySealedInLog(a.repoDir, a.mid, a.unit)) {
+  if (existsSync86(join123(dir, "cases.jsonl")) || alreadySealedInLog(a.repoDir, a.mid, a.unit)) {
     return { ok: false, reason: "oracle already captured (write-once)" };
   }
   const run2 = a.runCapture ?? realCaptureRunner;
@@ -76665,15 +76788,15 @@ function captureUnitOracle(a) {
   }
   if (r.cases.length === 0)
     return { ok: false, reason: "no cases captured" };
-  const scratch = mkdtempSync16(join122(tmpdir20(), "m27-replay-"));
-  const t12 = join122(scratch, "cases"), t22 = join122(scratch, "replay");
+  const scratch = mkdtempSync17(join123(tmpdir21(), "m27-replay-"));
+  const t12 = join123(scratch, "cases"), t22 = join123(scratch, "replay");
   const created = [];
-  for (let p = dir;!existsSync85(p) && !created.includes(p); p = dirname47(p))
+  for (let p = dir;!existsSync86(p) && !created.includes(p); p = dirname47(p))
     created.push(p);
-  const read2 = (p) => readFileSync105(p, "utf8").split(`
+  const read2 = (p) => readFileSync106(p, "utf8").split(`
 `).filter(Boolean).map((l) => JSON.parse(l));
-  const tmpCases = join122(dir, `.cases.${process.pid}.tmp`);
-  const tmpCov = join122(dir, `.coverage.${process.pid}.tmp`);
+  const tmpCases = join123(dir, `.cases.${process.pid}.tmp`);
+  const tmpCov = join123(dir, `.coverage.${process.pid}.tmp`);
   try {
     const cov = run2(a.unitPath, r.cases, t12);
     const cov2 = run2(a.unitPath, r.cases, t22);
@@ -76689,10 +76812,10 @@ function captureUnitOracle(a) {
       }
     });
     mkdirSync68(dir, { recursive: true });
-    writeFileSync62(tmpCases, recs.map((x3) => JSON.stringify(x3)).join(`
+    writeFileSync63(tmpCases, recs.map((x3) => JSON.stringify(x3)).join(`
 `) + `
 `);
-    writeFileSync62(tmpCov, JSON.stringify({
+    writeFileSync63(tmpCov, JSON.stringify({
       unit: a.unit,
       entries: [...new Set(r.cases.map((c) => c.entry))],
       cases: r.cases.length,
@@ -76701,19 +76824,19 @@ function captureUnitOracle(a) {
       branch_pct: cov.branchPct,
       missing: cov.missing
     }));
-    if (existsSync85(join122(dir, "cases.jsonl")))
+    if (existsSync86(join123(dir, "cases.jsonl")))
       return { ok: false, reason: "oracle already captured (write-once)" };
-    renameSync22(tmpCov, join122(dir, "coverage.json"));
-    (a.link ?? linkSync4)(tmpCases, join122(dir, "cases.jsonl"));
+    renameSync22(tmpCov, join123(dir, "coverage.json"));
+    (a.link ?? linkSync4)(tmpCases, join123(dir, "cases.jsonl"));
     return { ok: true, cases: r.cases.length, branchPct: cov.branchPct, stoppedReason: r.stoppedReason };
   } catch (e10) {
     return { ok: false, reason: `capture error: ${e10 instanceof Error ? e10.message : String(e10)}` };
   } finally {
-    rmSync34(scratch, { recursive: true, force: true });
+    rmSync35(scratch, { recursive: true, force: true });
     for (const t of [tmpCases, tmpCov])
-      rmSync34(t, { force: true });
-    if (created[0] === dir && !existsSync85(join122(dir, "cases.jsonl")))
-      rmSync34(join122(dir, "coverage.json"), { force: true });
+      rmSync35(t, { force: true });
+    if (created[0] === dir && !existsSync86(join123(dir, "cases.jsonl")))
+      rmSync35(join123(dir, "coverage.json"), { force: true });
     for (const p of created) {
       try {
         rmdirSync2(p);
@@ -76729,12 +76852,12 @@ var init_search = __esm(() => {
   init_safe_git();
   init_types2();
   init_seal2();
-  PY_CAPTURE_SCRIPT = join122(REPO_ROOT, "autonomy", "lib", "modernize", "py_capture.py");
+  PY_CAPTURE_SCRIPT = join123(REPO_ROOT, "autonomy", "lib", "modernize", "py_capture.py");
 });
 
 // ../../loki-ts/src/engine10/modernize/equiv.ts
-import { readFileSync as readFileSync106 } from "fs";
-import { join as join123 } from "path";
+import { readFileSync as readFileSync107 } from "fs";
+import { join as join124 } from "path";
 function parseCases(raw2) {
   const out3 = [];
   for (const line2 of raw2.split(`
@@ -76929,11 +77052,11 @@ function checkEquivalence(repoDir, mid, unit, newTreeDir, normalizers, runNew, l
     return notProvenResult(unit, "normalizers invalid: skip_fields covers every field, nothing would be compared", log);
   }
   const dir = oracleDir(repoDir, mid, unit);
-  const sealed = JSON.parse(readFileSync106(join123(dir, "sealed.json"), "utf8"));
+  const sealed = JSON.parse(readFileSync107(join124(dir, "sealed.json"), "utf8"));
   const normCheck = verifyNormalizersAgainstSeal(sealed, normalizers);
   if (!normCheck.ok)
     return notProvenResult(unit, `normalizers: ${normCheck.reason ?? "check failed"}`, log);
-  const records = parseCases(readFileSync106(join123(dir, "cases.jsonl"), "utf8"));
+  const records = parseCases(readFileSync107(join124(dir, "cases.jsonl"), "utf8"));
   const heldOutSet = new Set(sealed.held_out);
   let pass = 0;
   let fail2 = 0;
@@ -77124,7 +77247,7 @@ var init_reslice = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/modernize/scheduler.ts
-import { join as join124 } from "path";
+import { join as join125 } from "path";
 function mergeOnce(unit, ops, log, completed, worktree) {
   if (completed.has(unit))
     return "already_completed";
@@ -77198,8 +77321,8 @@ function gitMergeOps(repoDir, mid, seam = {}) {
 function clampWorkers(n11) {
   return Number.isFinite(n11) ? Math.min(MAX_LOCAL_WORKERS, Math.max(1, Math.floor(n11))) : DEFAULT_WORKERS;
 }
-function firstModel(unit) {
-  return unit.highRisk ? "opus" : "sonnet";
+function firstModel(unit, runModel) {
+  return unitModel(unit.highRisk ? "opus" : "sonnet", runModel);
 }
 async function schedule(plan, opts) {
   const wt = opts.worktrees ?? gitWorktrees;
@@ -77239,13 +77362,13 @@ async function schedule(plan, opts) {
     let attempts = 0;
     let last = null;
     let reason;
-    const steps = [[0, firstModel(unit)], [1, "opus"], [2, "opus"]];
+    const steps = [[0, firstModel(unit, opts.runModel)], [1, unitModel("opus", opts.runModel)], [2, unitModel("opus", opts.runModel)]];
     for (const [variant, model] of steps) {
       if (attempts > 0 && (stopped(0) || cap != null && unitCost >= cap)) {
         reason = hit ? "budget stop" : "per-unit cost cap reached";
         break;
       }
-      const path = join124(modernizeRoot(opts.repoDir, opts.mid), "wt", variant === 0 ? encodeUnitId(unit.id) : `${encodeUnitId(unit.id)}${VARIANT_SEP}${variant}`);
+      const path = join125(modernizeRoot(opts.repoDir, opts.mid), "wt", variant === 0 ? encodeUnitId(unit.id) : `${encodeUnitId(unit.id)}${VARIANT_SEP}${variant}`);
       let outcome;
       attempts++;
       let resumeRunId;
@@ -77332,6 +77455,7 @@ async function schedule(plan, opts) {
 var MAX_LOCAL_WORKERS = 32, DEFAULT_WORKERS = 4, UNIT_COST_CAP_FACTOR = 3, VARIANT_SEP = "~v", gitWorktrees;
 var init_scheduler = __esm(() => {
   init_safe_git();
+  init_unit_model();
   init_types2();
   gitWorktrees = {
     create(repoDir, path, baseSha) {
@@ -77353,21 +77477,21 @@ var init_scheduler = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/modernize/resume.ts
-import { existsSync as existsSync86, readFileSync as readFileSync107 } from "fs";
+import { existsSync as existsSync87, readFileSync as readFileSync108 } from "fs";
 function loadResumeState(repoDir, mid) {
   const path = modernizeEventsPath(repoDir, mid);
-  if (!existsSync86(path))
+  if (!existsSync87(path))
     return { ok: false, reason: `no modernize log at ${path}` };
   let text4;
   try {
-    text4 = readFileSync107(path, "utf8");
+    text4 = readFileSync108(path, "utf8");
   } catch (e10) {
     return { ok: false, reason: `modernize log unreadable: ${e10 instanceof Error ? e10.message : String(e10)}` };
   }
   const pj2 = planPath(repoDir, mid);
-  if (existsSync86(pj2)) {
+  if (existsSync87(pj2)) {
     try {
-      JSON.parse(readFileSync107(pj2, "utf8"));
+      JSON.parse(readFileSync108(pj2, "utf8"));
     } catch {
       return { ok: false, reason: `plan.json is corrupt or partial: ${pj2}` };
     }
@@ -77480,7 +77604,7 @@ var init_resume = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/modernize/report.ts
-import { mkdirSync as mkdirSync69, readFileSync as readFileSync108, writeFileSync as writeFileSync63 } from "fs";
+import { mkdirSync as mkdirSync69, readFileSync as readFileSync109, writeFileSync as writeFileSync64 } from "fs";
 import { dirname as dirname48 } from "path";
 function buildReport(o) {
   const units = o.units.map((x3) => ({ unit: x3.unit, verdict: x3.verdict, not_proven: [...x3.not_proven], rate: x3.rate, branchPct: x3.branchPct, receiptPath: x3.receiptPath, receiptSha256: x3.receiptSha256 }));
@@ -77525,9 +77649,9 @@ function writeReport(o) {
   const sealed = sealReport(buildReport(o), o.sign);
   const jp2 = reportJsonPath(o.repoDir, o.mid);
   mkdirSync69(dirname48(jp2), { recursive: true });
-  writeFileSync63(jp2, JSON.stringify(sealed, null, 2) + `
+  writeFileSync64(jp2, JSON.stringify(sealed, null, 2) + `
 `, "utf8");
-  writeFileSync63(reportMdPath(o.repoDir, o.mid), renderReportMd(sealed), "utf8");
+  writeFileSync64(reportMdPath(o.repoDir, o.mid), renderReportMd(sealed), "utf8");
   o.log?.append("modernize.completed", { verdict: sealed.verdict, blocking_units: sealed.blocking_units, blocking_waves: sealed.blocking_waves, report_sha256: sealed.report_sha256 });
   return sealed;
 }
@@ -77540,8 +77664,8 @@ var init_report = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/modernize/ship.ts
-import { mkdirSync as mkdirSync70, writeFileSync as writeFileSync64 } from "fs";
-import { join as join125 } from "path";
+import { mkdirSync as mkdirSync70, writeFileSync as writeFileSync65 } from "fs";
+import { join as join126 } from "path";
 function waveIsDraft(verdict, units) {
   return verdict === null || verdict.verified !== true || units.length === 0 || units.some((x3) => x3.verdict !== "PROVEN");
 }
@@ -77562,10 +77686,10 @@ function shipWave(o) {
     return fail2("no pinned origin: refusing to push (Rule of Two)");
   if (draft)
     return fail2("wave not verified: branch stays local, not pushed");
-  const dir = join125(o.repoDir, ".loki", "modernize", o.mid);
+  const dir = join126(o.repoDir, ".loki", "modernize", o.mid);
   mkdirSync70(dir, { recursive: true });
-  const bodyFile = join125(dir, `wave-${o.wave}-pr-body.md`);
-  writeFileSync64(bodyFile, renderWaveBody(o.wave, o.verdict, o.units), "utf8");
+  const bodyFile = join126(dir, `wave-${o.wave}-pr-body.md`);
+  writeFileSync65(bodyFile, renderWaveBody(o.wave, o.verdict, o.units), "utf8");
   const r = (o.push ?? runPushPr)({ repoDir: o.repoDir, branch: o.branch, title: `Loki modernize: wave ${o.wave}`, bodyFile, draft, pinnedOrigin });
   if (!r.ok)
     return fail2(r.reason);
@@ -77584,8 +77708,8 @@ var init_ship2 = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/modernize/presealed_wall.ts
-import { existsSync as existsSync87, mkdirSync as mkdirSync71, readFileSync as readFileSync109, writeFileSync as writeFileSync65 } from "fs";
-import { join as join126 } from "path";
+import { existsSync as existsSync88, mkdirSync as mkdirSync71, readFileSync as readFileSync110, writeFileSync as writeFileSync66 } from "fs";
+import { join as join127 } from "path";
 function isRealFailCount(n11) {
   return typeof n11 === "number" && Number.isInteger(n11) && n11 >= 1;
 }
@@ -77608,7 +77732,7 @@ function classifyBaseRun(o, repoDir) {
   return "not_run";
 }
 function preSealedPath(repoDir, mid, unit) {
-  return join126(oracleDir(repoDir, mid, unit), "presealed_wall.json");
+  return join127(oracleDir(repoDir, mid, unit), "presealed_wall.json");
 }
 function alreadySealed(repoDir, mid, unit) {
   return readModernizeEvents(repoDir, mid).some((e10) => e10.type === SEALED_EVENT && e10.data.unit === unit);
@@ -77622,7 +77746,7 @@ function sealPreSealedWall(repoDir, mid, unit, target, runConformance, log, base
   if (!oracleCheck.ok)
     return refuse(`oracle seal invalid: ${oracleCheck.reason ?? "unknown"}; presealed wall refused`);
   const dir = oracleDir(repoDir, mid, unit);
-  const oracleSealed = JSON.parse(readFileSync109(join126(dir, "sealed.json"), "utf8"));
+  const oracleSealed = JSON.parse(readFileSync110(join127(dir, "sealed.json"), "utf8"));
   if (oracleSealed.verdict !== "PROVEN_ORACLE") {
     return refuse(`oracle seal invalid: oracle is ${oracleSealed.verdict} (${oracleSealed.not_proven ?? "no reason recorded"}); presealed wall refused`);
   }
@@ -77651,7 +77775,7 @@ function sealPreSealedWall(repoDir, mid, unit, target, runConformance, log, base
   }
   mkdirSync71(dir, { recursive: true });
   const sealedPath = preSealedPath(repoDir, mid, unit);
-  if (existsSync87(sealedPath)) {
+  if (existsSync88(sealedPath)) {
     throw new Error(`presealed wall: ${unit} already has a sealed presealed_wall.json; re-seal refused (seal is write-once)`);
   }
   const sealed = {
@@ -77665,7 +77789,7 @@ function sealPreSealedWall(repoDir, mid, unit, target, runConformance, log, base
     ...baseSha !== null ? { base_sha: baseSha } : {}
   };
   const json2 = JSON.stringify(sealed, null, 2);
-  writeFileSync65(sealedPath, json2);
+  writeFileSync66(sealedPath, json2);
   const sealedSha256 = sha2564(json2);
   log.append(SEALED_EVENT, {
     unit,
@@ -77683,7 +77807,7 @@ function sealPreSealedWall(repoDir, mid, unit, target, runConformance, log, base
 }
 function verifyPreSealedWall(repoDir, mid, unit) {
   const sealedPath = preSealedPath(repoDir, mid, unit);
-  if (!existsSync87(sealedPath))
+  if (!existsSync88(sealedPath))
     return { ok: false, reason: "no presealed_wall.json" };
   const event = readModernizeEvents(repoDir, mid).find((e10) => e10.type === SEALED_EVENT && e10.data.unit === unit);
   if (!event)
@@ -77691,7 +77815,7 @@ function verifyPreSealedWall(repoDir, mid, unit) {
   const expectedSha = event.data.sealed_sha256;
   if (typeof expectedSha !== "string")
     return { ok: false, reason: "sealing event has no sealed_sha256" };
-  const sealedRaw = readFileSync109(sealedPath, "utf8");
+  const sealedRaw = readFileSync110(sealedPath, "utf8");
   const actualSha = sha2564(sealedRaw);
   if (actualSha !== expectedSha) {
     return { ok: false, reason: "presealed_wall.json does not match the sealing event's hash (tampered or rewritten)" };
@@ -77700,7 +77824,7 @@ function verifyPreSealedWall(repoDir, mid, unit) {
   if (!oracleCheck.ok) {
     return { ok: false, reason: `bound oracle seal is no longer valid: ${oracleCheck.reason ?? "unknown"}` };
   }
-  const oracleSealed = JSON.parse(readFileSync109(join126(oracleDir(repoDir, mid, unit), "sealed.json"), "utf8"));
+  const oracleSealed = JSON.parse(readFileSync110(join127(oracleDir(repoDir, mid, unit), "sealed.json"), "utf8"));
   const carried = JSON.parse(sealedRaw);
   if (carried.oracle_cases_sha256 !== oracleSealed.cases_sha256 || carried.oracle_coverage_sha256 !== oracleSealed.coverage_sha256 || typeof carried.oracle_normalizers_sha256 !== "string" || typeof oracleSealed.normalizers_sha256 !== "string" || carried.oracle_normalizers_sha256 !== oracleSealed.normalizers_sha256) {
     return { ok: false, reason: "carried oracle hashes do not match the current oracle seal" };
@@ -77725,10 +77849,10 @@ var init_presealed_wall = __esm(() => {
 
 // ../../loki-ts/src/engine10/modernize/unit.ts
 import { spawnSync as spawnSync19 } from "child_process";
-import { createHash as createHash34 } from "crypto";
-import { lstatSync as lstatSync27, readFileSync as readFileSync110, readdirSync as readdirSync37, readlinkSync as readlinkSync7, realpathSync as realpathSync33, rmSync as rmSync35 } from "fs";
-import { tmpdir as tmpdir21 } from "os";
-import { join as join127, sep as sep20 } from "path";
+import { createHash as createHash35 } from "crypto";
+import { lstatSync as lstatSync27, readFileSync as readFileSync111, readdirSync as readdirSync37, readlinkSync as readlinkSync7, realpathSync as realpathSync33, rmSync as rmSync36 } from "fs";
+import { tmpdir as tmpdir22 } from "os";
+import { join as join128, sep as sep20 } from "path";
 function isSealedName(rel) {
   return TEST_FILE2.test(rel) || PYTEST_CFG.test(rel);
 }
@@ -77743,9 +77867,9 @@ function purgePycache(dir) {
     for (const e10 of ents) {
       if (!e10.isDirectory())
         continue;
-      const full = join127(d, e10.name);
+      const full = join128(d, e10.name);
       if (e10.name === "__pycache__")
-        rmSync35(full, { recursive: true, force: true });
+        rmSync36(full, { recursive: true, force: true });
       else if (!skipName(e10.name))
         walk(full);
     }
@@ -77767,7 +77891,7 @@ function outsideTargetDigest(dir, full) {
   }
   if (real3 === root || real3.startsWith(root + sep20))
     return "inside";
-  const h10 = createHash34("sha256");
+  const h10 = createHash35("sha256");
   let budget = 20000;
   const walk = (p) => {
     if (budget-- <= 0) {
@@ -77798,13 +77922,13 @@ function outsideTargetDigest(dir, full) {
       }
       for (const n11 of names) {
         h10.update("D" + n11);
-        walk(join127(p, n11));
+        walk(join128(p, n11));
       }
       return;
     }
     if (st2.isFile()) {
       try {
-        h10.update(readFileSync110(p));
+        h10.update(readFileSync111(p));
       } catch {
         h10.update("unreadable");
       }
@@ -77819,7 +77943,7 @@ function conformanceHashes(dir) {
   const walk = (sub2, inSkip) => {
     let ents;
     try {
-      ents = readdirSync37(join127(dir, sub2), { withFileTypes: true });
+      ents = readdirSync37(join128(dir, sub2), { withFileTypes: true });
     } catch {
       return;
     }
@@ -77850,18 +77974,18 @@ function conformanceHashes(dir) {
   for (const rel of rels) {
     let data;
     try {
-      const st2 = lstatSync27(join127(dir, rel));
+      const st2 = lstatSync27(join128(dir, rel));
       if (st2.isSymbolicLink()) {
-        out3[rel] = `${LINK}${readlinkSync7(join127(dir, rel))}|${outsideTargetDigest(dir, join127(dir, rel))}`;
+        out3[rel] = `${LINK}${readlinkSync7(join128(dir, rel))}|${outsideTargetDigest(dir, join128(dir, rel))}`;
         continue;
       }
       if (!st2.isFile())
         continue;
-      data = readFileSync110(join127(dir, rel));
+      data = readFileSync111(join128(dir, rel));
     } catch {
       continue;
     }
-    out3[rel] = createHash34("sha256").update(data).digest("hex");
+    out3[rel] = createHash35("sha256").update(data).digest("hex");
   }
   return out3;
 }
@@ -77874,7 +77998,7 @@ for n in sys.argv[1:]:
         if n in sys.stdlib_module_names or u.find_spec(n): print(n)
     except Exception: print(n)
 `;
-  const r = spawnSync19(target, ["-I", "-c", code, ...names], { cwd: tmpdir21(), encoding: "utf8", timeout: 30000, env: tokenFreeEnv() });
+  const r = spawnSync19(target, ["-I", "-c", code, ...names], { cwd: tmpdir22(), encoding: "utf8", timeout: 30000, env: tokenFreeEnv() });
   return r.status === 0 ? new Set(r.stdout.split(`
 `).filter(Boolean)) : new Set(names);
 }
@@ -77916,7 +78040,7 @@ function notProvenUnitResult(unit, reason, oracle, wall) {
   return { unit, verdict: "NOT_PROVEN", oracle, wall, equiv: null, not_proven: [reason], conformance: null };
 }
 function readOracleSealed(repoDir, mid, unit) {
-  return JSON.parse(readFileSync110(join127(oracleDir(repoDir, mid, unit), "sealed.json"), "utf8"));
+  return JSON.parse(readFileSync111(join128(oracleDir(repoDir, mid, unit), "sealed.json"), "utf8"));
 }
 function runUnit(card, log, runConformance, implement, runNew, runStub, collect) {
   const { repoDir, mid, unit } = card;
@@ -78027,8 +78151,8 @@ var init_unit = __esm(() => {
 
 // ../../loki-ts/src/engine10/modernize/wave.ts
 import { spawnSync as spawnSync20 } from "child_process";
-import { readFileSync as readFileSync111, statSync as statSync33 } from "fs";
-import { join as join128 } from "path";
+import { readFileSync as readFileSync112, statSync as statSync33 } from "fs";
+import { join as join129 } from "path";
 function clampTimeout(ms) {
   if (ms === undefined || !Number.isFinite(ms) || ms <= 0)
     return DEFAULT_STEP_TIMEOUT_MS;
@@ -78097,7 +78221,7 @@ function detectWaveCommands(inv, target) {
   const none = { build: null, integration: null, original_suite: null };
   const text4 = () => {
     try {
-      return readFileSync111(join128(target, marker ?? ""), "utf8");
+      return readFileSync112(join129(target, marker ?? ""), "utf8");
     } catch {
       return "";
     }
@@ -78109,7 +78233,7 @@ function detectWaveCommands(inv, target) {
   if (system === "gradle") {
     let gw2 = "gradle";
     try {
-      if (inv.files.includes("gradlew") && (statSync33(join128(target, "gradlew")).mode & 73) !== 0)
+      if (inv.files.includes("gradlew") && (statSync33(join129(target, "gradlew")).mode & 73) !== 0)
         gw2 = "./gradlew";
     } catch {}
     return { build: { argv: [gw2, "assemble"] }, integration: text4().includes("integrationTest") ? { argv: [gw2, "integrationTest"] } : null, original_suite: { argv: [gw2, "test"] } };
@@ -78121,7 +78245,7 @@ function detectWaveCommands(inv, target) {
   let toxIni = "";
   if (inv.files.includes("tox.ini")) {
     try {
-      toxIni = readFileSync111(join128(target, "tox.ini"), "utf8");
+      toxIni = readFileSync112(join129(target, "tox.ini"), "utf8");
     } catch {}
   }
   const integration = toxIni.includes("[testenv:integration") ? { argv: ["tox", "-e", "integration"] } : itDir && pytest ? { argv: ["python3", "-m", "pytest", "-q", itDir] } : null;
@@ -78153,9 +78277,9 @@ var init_wave = __esm(() => {
 
 // ../../loki-ts/src/util/modernize_unit.ts
 import { spawnSync as spawnSync21 } from "child_process";
-import { existsSync as existsSync88, lstatSync as lstatSync28, mkdtempSync as mkdtempSync17, readFileSync as readFileSync112, realpathSync as realpathSync34, rmSync as rmSync36, statSync as statSync34, writeFileSync as writeFileSync66 } from "fs";
-import { tmpdir as tmpdir22 } from "os";
-import { join as join129, sep as sep21 } from "path";
+import { existsSync as existsSync89, lstatSync as lstatSync28, mkdtempSync as mkdtempSync18, readFileSync as readFileSync113, realpathSync as realpathSync34, rmSync as rmSync37, statSync as statSync34, writeFileSync as writeFileSync67 } from "fs";
+import { tmpdir as tmpdir23 } from "os";
+import { join as join130, sep as sep21 } from "path";
 function parseUnitArgs(args) {
   const f = {};
   for (let i = 0;i < args.length; i++) {
@@ -78227,7 +78351,7 @@ function makeUnitRunners(o) {
 }
 function makeSessionRunner(o) {
   const limitS = o.sessionLimitS ?? SESSION_LIMIT_S2;
-  const cli = import.meta.path.endsWith("modernize_unit.ts") ? join129(import.meta.dir, "..", "cli.ts") : import.meta.path;
+  const cli = import.meta.path.endsWith("modernize_unit.ts") ? join130(import.meta.dir, "..", "cli.ts") : import.meta.path;
   return o.session ?? ((_brief, cwd, env) => spawnSync21(process.execPath, [...SAFE_BUN_FLAGS, cli, "engine10", "session"], { cwd, env, stdio: ["ignore", "ignore", "pipe"], timeout: limitS * 1000 }));
 }
 function defaultUnitFile(unitId, newTreeDir) {
@@ -78235,7 +78359,7 @@ function defaultUnitFile(unitId, newTreeDir) {
     return null;
   try {
     const root = realpathSync34(newTreeDir);
-    const real3 = realpathSync34(join129(root, unitId));
+    const real3 = realpathSync34(join130(root, unitId));
     return real3.startsWith(root + sep21) ? real3 : null;
   } catch {
     return null;
@@ -78270,25 +78394,25 @@ function boundariesFromCase(rec2) {
 }
 function runPythonCase(o, unitId, newTreeDir, rec2, stub) {
   const src = o.unitFile ? o.unitFile(unitId, newTreeDir) : defaultUnitFile(unitId, newTreeDir);
-  if (!src || !src.endsWith(".py") || !existsSync88(src))
+  if (!src || !src.endsWith(".py") || !existsSync89(src))
     throw new Error(`cannot locate the source of unit ${unitId} in the new tree`);
-  const dir = mkdtempSync17(join129(tmpdir22(), "loki-newcase-"));
+  const dir = mkdtempSync18(join130(tmpdir23(), "loki-newcase-"));
   try {
-    const cases = join129(dir, "in.jsonl"), out3 = join129(dir, "out.jsonl");
-    writeFileSync66(cases, JSON.stringify({ entry: rec2.entry, args: rec2.args, kwargs: rec2.kwargs, boundaries: boundariesFromCase(rec2) }) + `
+    const cases = join130(dir, "in.jsonl"), out3 = join130(dir, "out.jsonl");
+    writeFileSync67(cases, JSON.stringify({ entry: rec2.entry, args: rec2.args, kwargs: rec2.kwargs, boundaries: boundariesFromCase(rec2) }) + `
 `, "utf8");
-    const r = spawnSync21(o.pythonBin ?? "python3", [join129(REPO_ROOT, "autonomy", "lib", "modernize", "py_capture.py"), "--unit", src, "--cases", cases, "--out", out3, ...stub ? ["--stub"] : []], { cwd: newTreeDir, encoding: "utf8", timeout: CASE_TIMEOUT_MS, env: { ...tokenFreeEnv(), PYTHONDONTWRITEBYTECODE: "1" } });
-    if (r.status !== 0 || !existsSync88(out3))
+    const r = spawnSync21(o.pythonBin ?? "python3", [join130(REPO_ROOT, "autonomy", "lib", "modernize", "py_capture.py"), "--unit", src, "--cases", cases, "--out", out3, ...stub ? ["--stub"] : []], { cwd: newTreeDir, encoding: "utf8", timeout: CASE_TIMEOUT_MS, env: { ...tokenFreeEnv(), PYTHONDONTWRITEBYTECODE: "1" } });
+    if (r.status !== 0 || !existsSync89(out3))
       throw new Error(`new-tree case runner failed (${r.status ?? r.signal ?? "no status"}): ${String(r.stderr ?? "").trim().split(`
 `).pop() ?? ""}`);
-    const line2 = readFileSync112(out3, "utf8").split(`
+    const line2 = readFileSync113(out3, "utf8").split(`
 `).find((l) => l.trim() !== "");
     if (!line2)
       throw new Error("new-tree case runner produced no record");
     const got = JSON.parse(line2);
     return { return: got.return, exc: got.exc, stdout: got.stdout, files: got.files, ...got.not_proven.length > 0 ? { not_proven: got.not_proven } : {} };
   } finally {
-    rmSync36(dir, { recursive: true, force: true });
+    rmSync37(dir, { recursive: true, force: true });
   }
 }
 async function unitMain(args, deps = {}) {
@@ -78304,10 +78428,10 @@ Usage: ${UNIT_USAGE}
   const runners = u10.implement && u10.runNew && u10.runStub ? null : makeUnitRunners({ target: o.target });
   const implement = u10.implement ?? runners.implement, runNew = u10.runNew ?? runners.runNew, runStub = u10.runStub ?? runners.runStub;
   const runTmp = process.env["LOKI_RUN_TMP"] ?? "";
-  const root = u10.tmpRoot ?? (runTmp !== "" && isRealDir(runTmp) ? runTmp : tmpdir22());
+  const root = u10.tmpRoot ?? (runTmp !== "" && isRealDir(runTmp) ? runTmp : tmpdir23());
   let repoDir;
   try {
-    repoDir = mkdtempSync17(join129(root, "loki-unit-"));
+    repoDir = mkdtempSync18(join130(root, "loki-unit-"));
   } catch (e10) {
     process.stderr.write(`modernize unit: cannot create a temp checkout directory: ${e10.message}
 `);
@@ -78342,8 +78466,8 @@ Usage: ${UNIT_USAGE}
 `);
     return 1;
   } finally {
-    if (existsSync88(repoDir))
-      rmSync36(repoDir, { recursive: true, force: true });
+    if (existsSync89(repoDir))
+      rmSync37(repoDir, { recursive: true, force: true });
   }
 }
 function buildUnitJob(spec) {
@@ -78402,12 +78526,12 @@ var init_modernize_unit = __esm(() => {
 });
 
 // ../../loki-ts/src/util/modernize_coordinator.ts
-import { createHash as createHash35 } from "crypto";
-import { existsSync as existsSync89, mkdtempSync as mkdtempSync18, readFileSync as readFileSync113, rmSync as rmSync37 } from "fs";
-import { tmpdir as tmpdir23 } from "os";
-import { join as join130 } from "path";
+import { createHash as createHash36 } from "crypto";
+import { existsSync as existsSync90, mkdtempSync as mkdtempSync19, readFileSync as readFileSync114, rmSync as rmSync38 } from "fs";
+import { tmpdir as tmpdir24 } from "os";
+import { join as join131 } from "path";
 function shipUnitOf(d, unit, o) {
-  const sealed = join130(oracleDir(d.repoDir, d.mid, unit), "sealed.json");
+  const sealed = join131(oracleDir(d.repoDir, d.mid, unit), "sealed.json");
   const eq3 = o?.result?.equiv;
   return {
     unit,
@@ -78424,7 +78548,7 @@ function scopeBuildToWave(cmd2, repoDir, units) {
   const x3 = cmd2?.argv.indexOf("-x") ?? -1;
   if (!cmd2 || !cmd2.argv.includes("compileall") || x3 < 0)
     return cmd2;
-  const files = [...new Set(units.flatMap((u10) => u10.nodes))].filter((n11) => n11.endsWith(".py") && isSafeUnitId(n11) && existsSync89(join130(repoDir, n11)));
+  const files = [...new Set(units.flatMap((u10) => u10.nodes))].filter((n11) => n11.endsWith(".py") && isSafeUnitId(n11) && existsSync90(join131(repoDir, n11)));
   return files.length ? { ...cmd2, argv: [...cmd2.argv.slice(0, x3 + 2), ...files] } : cmd2;
 }
 async function runWaves(plan, d) {
@@ -78583,16 +78707,16 @@ function makeAttemptRunner(o) {
 }
 function makeUnitPrep(o) {
   const runtimeOk = o.runtimeOk ?? (() => {
-    const dir = mkdtempSync18(join130(tmpdir23(), "loki-probe-"));
+    const dir = mkdtempSync19(join131(tmpdir24(), "loki-probe-"));
     try {
-      return realCaptureRunner(join130(dir, "probe.py"), []).error !== "old runtime unavailable";
+      return realCaptureRunner(join131(dir, "probe.py"), []).error !== "old runtime unavailable";
     } finally {
-      rmSync37(dir, { recursive: true, force: true });
+      rmSync38(dir, { recursive: true, force: true });
     }
   });
   let runtime = null;
   return (unit) => {
-    if (existsSync89(join130(oracleDir(o.repoDir, o.mid, unit.id), "cases.jsonl")) || alreadySealedInLog(o.repoDir, o.mid, unit.id))
+    if (existsSync90(join131(oracleDir(o.repoDir, o.mid, unit.id), "cases.jsonl")) || alreadySealedInLog(o.repoDir, o.mid, unit.id))
       return null;
     runtime ??= runtimeOk();
     if (!runtime)
@@ -78600,7 +78724,7 @@ function makeUnitPrep(o) {
     const node = unit.nodes.length === 1 ? unit.nodes[0] : "";
     if (!node.endsWith(".py") || !isSafeUnitId(node))
       return MULTI_FILE_REASON;
-    const r = (o.capture ?? captureUnitOracle)({ repoDir: o.repoDir, mid: o.mid, unit: unit.id, unitPath: join130(o.repoDir, node), propose: o.propose });
+    const r = (o.capture ?? captureUnitOracle)({ repoDir: o.repoDir, mid: o.mid, unit: unit.id, unitPath: join131(o.repoDir, node), propose: o.propose });
     return r.ok ? null : r.reason;
   };
 }
@@ -78659,7 +78783,7 @@ function productionWaveDeps(o) {
     }
   };
 }
-var productionReslice, sha2565 = (p) => existsSync89(p) ? createHash35("sha256").update(readFileSync113(p)).digest("hex") : "n/a", MULTI_FILE_REASON = "multi-file unit: capture not supported (founder default)";
+var productionReslice, sha2565 = (p) => existsSync90(p) ? createHash36("sha256").update(readFileSync114(p)).digest("hex") : "n/a", MULTI_FILE_REASON = "multi-file unit: capture not supported (founder default)";
 var init_modernize_coordinator = __esm(() => {
   init_codemod();
   init_search();
@@ -78692,7 +78816,7 @@ __export(exports_cli, {
   main: () => main7,
   USAGE: () => USAGE2
 });
-import { existsSync as existsSync90, statSync as statSync35 } from "fs";
+import { existsSync as existsSync91, statSync as statSync35 } from "fs";
 function parseArgs2(args) {
   let repoDir = null;
   let target = null;
@@ -78829,7 +78953,7 @@ ${USAGE2}`);
     return 2;
   }
   const opts = parsed.opts;
-  if (!existsSync90(opts.repoDir) || !statSync35(opts.repoDir).isDirectory()) {
+  if (!existsSync91(opts.repoDir) || !statSync35(opts.repoDir).isDirectory()) {
     process.stderr.write(`modernize: not a directory: ${opts.repoDir}
 `);
     return 2;
@@ -78912,7 +79036,7 @@ Targets: ${TARGETS2.join(", ")}
 });
 
 // ../../loki-ts/src/contrib/sarif.ts
-import { createHash as createHash36 } from "crypto";
+import { createHash as createHash37 } from "crypto";
 function sarifUri(file, repoRoot2) {
   let p = file.replace(/\\/g, "/");
   if (repoRoot2) {
@@ -78973,7 +79097,7 @@ function toSarif(findings, toolVersion2 = "0.0.0", repoRoot2) {
     ]
   };
 }
-var RULES2, SCHEMA = "https://json.schemastore.org/sarif-2.1.0.json", sha5 = (s) => createHash36("sha256").update(s).digest("hex");
+var RULES2, SCHEMA = "https://json.schemastore.org/sarif-2.1.0.json", sha5 = (s) => createHash37("sha256").update(s).digest("hex");
 var init_sarif = __esm(() => {
   init_redact();
   RULES2 = {
@@ -78992,8 +79116,8 @@ __export(exports_export_sarif, {
   preRedFromEvents: () => preRedFromEvents,
   main: () => main8
 });
-import { existsSync as existsSync91, readFileSync as readFileSync114, writeFileSync as writeFileSync67 } from "fs";
-import { join as join131 } from "path";
+import { existsSync as existsSync92, readFileSync as readFileSync115, writeFileSync as writeFileSync68 } from "fs";
+import { join as join132 } from "path";
 function scanDiff(diff) {
   const out3 = [];
   let file = "";
@@ -79024,7 +79148,7 @@ function scanDiff(diff) {
 function preRedFromEvents(runDir) {
   try {
     let pre2 = [];
-    for (const l of readFileSync114(join131(runDir, "events.jsonl"), "utf8").split(`
+    for (const l of readFileSync115(join132(runDir, "events.jsonl"), "utf8").split(`
 `)) {
       if (!l.includes('"stage.completed"'))
         continue;
@@ -79053,19 +79177,19 @@ async function main8(args, deps = {}) {
   if (bad || rest.length > 1)
     return process.stderr.write(`loki export --sarif: ${bad ? `unknown flag ${bad}` : "more than one run-id"}
 `), 2;
-  const runsRoot2 = deps.runsRoot ?? join131(lokiDir(), "runs");
+  const runsRoot2 = deps.runsRoot ?? join132(lokiDir(), "runs");
   const runId2 = rest[0] ?? latestRunId(runsRoot2);
   if (!runId2)
     return process.stderr.write(`loki export --sarif: no runs found
 `), 66;
-  const runDir = join131(runsRoot2, runId2);
-  const receiptPath = join131(runDir, "receipt.json");
-  if (runId2.includes("/") || runId2.includes("..") || !existsSync91(receiptPath))
+  const runDir = join132(runsRoot2, runId2);
+  const receiptPath = join132(runDir, "receipt.json");
+  if (runId2.includes("/") || runId2.includes("..") || !existsSync92(receiptPath))
     return process.stderr.write(`loki export --sarif: unknown run ${runId2}
 `), 66;
   let receipt;
   try {
-    receipt = JSON.parse(readFileSync114(receiptPath, "utf8"));
+    receipt = JSON.parse(readFileSync115(receiptPath, "utf8"));
   } catch {
     return process.stderr.write(`loki export --sarif: unreadable receipt for ${runId2}
 `), 66;
@@ -79082,10 +79206,10 @@ async function main8(args, deps = {}) {
   findings.push(...receiptFindings(receipt, preRedFromEvents(runDir)));
   let version2 = "0.0.0";
   try {
-    version2 = readFileSync114(join131(REPO_ROOT, "VERSION"), "utf8").trim() || version2;
+    version2 = readFileSync115(join132(REPO_ROOT, "VERSION"), "utf8").trim() || version2;
   } catch {}
-  const out3 = join131(runDir, "findings.sarif");
-  writeFileSync67(out3, JSON.stringify(toSarif(findings, version2, deps.repoDir ?? process.cwd()), null, 2) + `
+  const out3 = join132(runDir, "findings.sarif");
+  writeFileSync68(out3, JSON.stringify(toSarif(findings, version2, deps.repoDir ?? process.cwd()), null, 2) + `
 `);
   process.stdout.write(`run: ${runId2}
 findings: ${findings.length}
@@ -79303,7 +79427,7 @@ var init_output = __esm(() => {
 
 // ../../loki-ts/src/features/receipt_dsse.ts
 import { createPublicKey as createPublicKey5, sign as sign3, verify as verify3 } from "crypto";
-import { readFileSync as readFileSync115 } from "fs";
+import { readFileSync as readFileSync116 } from "fs";
 function pae2(payloadType, body) {
   const t = Buffer.from(payloadType, "utf8");
   return Buffer.concat([Buffer.from(`DSSEv1 ${t.length} `), t, Buffer.from(` ${body.length} `), body]);
@@ -79399,7 +79523,7 @@ function verifyDsseReceipt(env, d) {
 }
 function runIdGuard(receiptPath, runId2) {
   try {
-    return envelopeRunIdProblem(JSON.parse(readFileSync115(receiptPath, "utf8")), runId2);
+    return envelopeRunIdProblem(JSON.parse(readFileSync116(receiptPath, "utf8")), runId2);
   } catch {
     return null;
   }
@@ -79407,7 +79531,7 @@ function runIdGuard(receiptPath, runId2) {
 async function exportDsseReceipt(a) {
   const fail2 = (rc2, m) => (process.stderr.write(`loki verify --export-dsse: ${m}
 `), rc2);
-  const rd2 = a.deps.read ?? ((p) => readFileSync115(p, "utf8"));
+  const rd2 = a.deps.read ?? ((p) => readFileSync116(p, "utf8"));
   let text4;
   try {
     text4 = rd2(a.receiptPath);
@@ -79464,13 +79588,13 @@ var init_undo = __esm(() => {
 });
 
 // ../../loki-ts/src/commands/run_status.ts
-import { existsSync as existsSync92, readdirSync as readdirSync38, readFileSync as readFileSync116, statSync as statSync36 } from "fs";
-import { basename as basename31, dirname as dirname49, join as join132, resolve as resolve39 } from "path";
+import { existsSync as existsSync93, readdirSync as readdirSync38, readFileSync as readFileSync117, statSync as statSync36 } from "fs";
+import { basename as basename32, dirname as dirname49, join as join133, resolve as resolve39 } from "path";
 function runsRoot(env, repoDir) {
-  return env.LOKI_DIR ? join132(resolve39(repoDir, env.LOKI_DIR), "runs") : join132(repoDir, ".loki", "runs");
+  return env.LOKI_DIR ? join133(resolve39(repoDir, env.LOKI_DIR), "runs") : join133(repoDir, ".loki", "runs");
 }
 function listRunIds(root) {
-  if (!existsSync92(root))
+  if (!existsSync93(root))
     return [];
   return readdirSync38(root, { withFileTypes: true }).filter((d) => d.isDirectory()).map((d) => d.name).sort();
 }
@@ -79479,7 +79603,7 @@ function latestRunId(root) {
   return ids.length ? ids[ids.length - 1] : null;
 }
 function eventsPath(root, runId2) {
-  return join132(root, runId2, "events.jsonl");
+  return join133(root, runId2, "events.jsonl");
 }
 var TERMINAL2;
 var init_run_status = __esm(() => {
@@ -79495,9 +79619,9 @@ var init_run_status = __esm(() => {
 });
 
 // ../../loki-ts/src/util/seal_drift.ts
-import { createHash as createHash37 } from "crypto";
-import { existsSync as existsSync93, readFileSync as readFileSync117, realpathSync as realpathSync35 } from "fs";
-import { basename as basename32, dirname as dirname50, join as join133, relative as relative26 } from "path";
+import { createHash as createHash38 } from "crypto";
+import { existsSync as existsSync94, readFileSync as readFileSync118, realpathSync as realpathSync35 } from "fs";
+import { basename as basename33, dirname as dirname50, join as join134, relative as relative27 } from "path";
 function tornTail(raw2) {
   if (raw2 === "" || raw2.endsWith(`
 `))
@@ -79514,10 +79638,10 @@ function tornTail(raw2) {
   }
 }
 function boundEvents(log, bound) {
-  if (!existsSync93(log))
+  if (!existsSync94(log))
     return null;
-  const lines2 = readFileSync117(log, "utf8").split(`
-`).filter((l) => l.trim() !== ""), h10 = createHash37("sha256");
+  const lines2 = readFileSync118(log, "utf8").split(`
+`).filter((l) => l.trim() !== ""), h10 = createHash38("sha256");
   let n11 = -1;
   for (let i = 0;i <= lines2.length; i++) {
     if (h10.copy().digest("hex") === bound) {
@@ -79544,7 +79668,7 @@ function fabricatedPass(receiptPath, r) {
   const bound = r["events_sha256"];
   if (typeof bound !== "string" || bound === EMPTY_SHA || !Array.isArray(r["checks"]))
     return null;
-  const events2 = boundEvents(join133(dirname50(receiptPath), "events.jsonl"), bound);
+  const events2 = boundEvents(join134(dirname50(receiptPath), "events.jsonl"), bound);
   if (!events2 || !events2.some((e10) => e10.stage === "verify"))
     return null;
   const passed = new Set(events2.filter((e10) => e10.type === "test.result" && e10.stage === "verify" && e10.data["result"] === "pass").map((e10) => String(e10.data["name"])));
@@ -79552,12 +79676,12 @@ function fabricatedPass(receiptPath, r) {
   return missing.length ? `receipt claims pass with no test.result pass in events.jsonl: ${missing.join(", ")}` : null;
 }
 function currentTaskSha(runDir, source, env) {
-  const f = source === "issue" ? join133(runDir, "issue.json") : env["LOKI_VERIFY_TASK_FILE"];
-  return f && existsSync93(f) ? sha6(readFileSync117(f)) : null;
+  const f = source === "issue" ? join134(runDir, "issue.json") : env["LOKI_VERIFY_TASK_FILE"];
+  return f && existsSync94(f) ? sha6(readFileSync118(f)) : null;
 }
 function repoOf(receiptPath) {
   const runs2 = dirname50(dirname50(receiptPath));
-  return basename32(runs2) === "runs" && basename32(dirname50(runs2)) === ".loki" ? dirname50(dirname50(runs2)) : null;
+  return basename33(runs2) === "runs" && basename33(dirname50(runs2)) === ".loki" ? dirname50(dirname50(runs2)) : null;
 }
 function overlap(repo, base, sealedHead, head) {
   if (typeof base !== "string" || !/^[0-9a-f]{40,64}$/.test(base) || !/^[0-9a-f]{40,64}$/.test(sealedHead))
@@ -79583,7 +79707,7 @@ function onlyWallPublish(repo, r, sealedHead, head) {
       } catch {
         return x3;
       }
-    }, rr2 = real3(repo), want = new Map(wall.map((w) => [relative26(rr2, join133(real3(dirname50(String(w.path))), basename32(String(w.path)))), String(w.sha256)]));
+    }, rr2 = real3(repo), want = new Map(wall.map((w) => [relative27(rr2, join134(real3(dirname50(String(w.path))), basename33(String(w.path)))), String(w.sha256)]));
     const commits = safeGit(repo, ["rev-list", "--reverse", "--topo-order", `${sealedHead}..${head}`]).split(`
 `).filter(Boolean);
     if (commits.length === 0 || safeGit(repo, ["rev-list", "--merges", "--count", `${sealedHead}..${head}`]).trim() !== "0")
@@ -79621,14 +79745,14 @@ function claimsWallPublish(repo, r, sealedHead, head) {
 function sealDrift(given, r, env = process.env) {
   let receiptPath = given;
   try {
-    receiptPath = join133(realpathSync35(dirname50(given)), basename32(given));
+    receiptPath = join134(realpathSync35(dirname50(given)), basename33(given));
   } catch {}
   const fab = fabricatedPass(receiptPath, r);
   if (fab)
     return { verdict: "TAMPERED", reason: fab };
   try {
-    const log = join133(dirname50(receiptPath), "events.jsonl");
-    if (existsSync93(log) && tornTail(readFileSync117(log, "utf8")))
+    const log = join134(dirname50(receiptPath), "events.jsonl");
+    if (existsSync94(log) && tornTail(readFileSync118(log, "utf8")))
       return { verdict: "UNCHECKED", reason: "events.jsonl ends in a torn, unterminated line (an append cut mid-write); every complete line is intact but the log is not whole" };
   } catch {}
   const task = r["task"] ?? {};
@@ -79655,21 +79779,21 @@ function sealDrift(given, r, env = process.env) {
   }
   return null;
 }
-var EMPTY_SHA, sha6 = (s) => createHash37("sha256").update(s).digest("hex");
+var EMPTY_SHA, sha6 = (s) => createHash38("sha256").update(s).digest("hex");
 var init_seal_drift = __esm(() => {
   init_safe_git();
-  EMPTY_SHA = createHash37("sha256").digest("hex");
+  EMPTY_SHA = createHash38("sha256").digest("hex");
 });
 
 // ../../loki-ts/src/util/composite_seal.ts
-import { existsSync as existsSync94, readFileSync as readFileSync118 } from "fs";
-import { basename as basename33, dirname as dirname51, join as join134 } from "path";
+import { existsSync as existsSync95, readFileSync as readFileSync119 } from "fs";
+import { basename as basename34, dirname as dirname51, join as join135 } from "path";
 function logProblem(runDir, integ) {
   if (typeof integ["log_sha256"] !== "string")
     return null;
   let b;
   try {
-    b = readFileSync118(join134(runDir, "integration.log"));
+    b = readFileSync119(join135(runDir, "integration.log"));
   } catch {
     return "integration.log is missing but integration.json records its hash";
   }
@@ -79684,10 +79808,10 @@ function integrationProblem(integ) {
   return null;
 }
 function composeComposite(runDir, rh, toolchain = collectToolchain()) {
-  const ip = join134(runDir, "integration.json");
+  const ip = join135(runDir, "integration.json");
   let ibytes;
   try {
-    ibytes = readFileSync118(ip);
+    ibytes = readFileSync119(ip);
   } catch {
     throw new Error("integration.json missing; the workspace run did not finish");
   }
@@ -79711,12 +79835,12 @@ function composeComposite(runDir, rh, toolchain = collectToolchain()) {
     const outcome = String(integ["outcomes"][repo] ?? "");
     if (outcome !== "ok")
       throw new Error(`repo ${text3(repo, 80)} did not finish (${text3(outcome, 80) || "no outcome"}); no composite`);
-    const runsDir = join134(runDir, "worktrees", slugOf(repo), ".loki", "runs");
-    const ids = (dirNames(runsDir) ?? []).filter((n11) => existsSync94(join134(runsDir, n11, "receipt.json")));
+    const runsDir = join135(runDir, "worktrees", slugOf(repo), ".loki", "runs");
+    const ids = (dirNames(runsDir) ?? []).filter((n11) => existsSync95(join135(runsDir, n11, "receipt.json")));
     const id2 = ids[ids.length - 1];
     if (!id2)
       throw new Error(`repo ${text3(repo, 80)} has no receipt.json under worktrees/${slugOf(repo)}/.loki/runs`);
-    const rp = join134(runsDir, id2, "receipt.json"), bytes = readFileSync118(rp), r = readJson7(rp);
+    const rp = join135(runsDir, id2, "receipt.json"), bytes = readFileSync119(rp), r = readJson7(rp);
     if (jsonTooDeep(r))
       throw new Error(`repo ${text3(repo, 80)} receipt cannot be hashed (nested too deeply); no composite`);
     if (!isObj10(r) || typeof r["receipt_sha256"] !== "string" || rh(r) !== r["receipt_sha256"])
@@ -79734,8 +79858,8 @@ function composeComposite(runDir, rh, toolchain = collectToolchain()) {
     throw new Error("workspace has no repos");
   return {
     schema: COMPOSITE_SCHEMA,
-    workspace: basename33(dirname51(runDir)),
-    run_id: basename33(runDir),
+    workspace: basename34(dirname51(runDir)),
+    run_id: basename34(runDir),
     integration_sha256: sha4(ibytes),
     integration: { status: String(integ["status"]), exit_code: typeof integ["exit_code"] === "number" ? integ["exit_code"] : null, log_sha256: typeof integ["log_sha256"] === "string" ? integ["log_sha256"] : null, heads },
     children,
@@ -79753,13 +79877,13 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
     return bad("body malformed");
   let ibytes;
   try {
-    ibytes = readFileSync118(join134(runDir, "integration.json"));
+    ibytes = readFileSync119(join135(runDir, "integration.json"));
   } catch {
     return bad("integration.json missing");
   }
   if (sha4(ibytes) !== receipt["integration_sha256"])
     return bad("integration.json does not match its recorded hash");
-  const integ = readJson7(join134(runDir, "integration.json"));
+  const integ = readJson7(join135(runDir, "integration.json"));
   if (jsonTooDeep(integ))
     return deep("integration.json");
   if (!isObj10(integ) || !isObj10(integ["outcomes"]))
@@ -79796,10 +79920,10 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
       return bad(`child ${text3(repo, 80) || "?"} has an invalid receipt path`);
     if (outcomes[repo] !== "ok")
       return bad(`child ${text3(repo, 80)} did not finish ok in integration.json`);
-    const rp = join134(runDir, rel);
+    const rp = join135(runDir, rel);
     let bytes;
     try {
-      bytes = readFileSync118(rp);
+      bytes = readFileSync119(rp);
     } catch {
       return bad(`child ${repo} receipt missing`);
     }
@@ -79859,16 +79983,16 @@ __export(exports_verify_cmd, {
   main: () => main9,
   computeReceiptHash: () => computeReceiptHash
 });
-import { existsSync as existsSync95, readFileSync as readFileSync119, renameSync as renameSync23, statSync as statSync37, writeFileSync as writeFileSync68 } from "fs";
-import { basename as basename34, dirname as dirname52, join as join135 } from "path";
-import { createHash as createHash38, createPublicKey as createPublicKey6, verify as verify4 } from "crypto";
+import { existsSync as existsSync96, readFileSync as readFileSync120, renameSync as renameSync23, statSync as statSync37, writeFileSync as writeFileSync69 } from "fs";
+import { basename as basename35, dirname as dirname52, join as join136 } from "path";
+import { createHash as createHash39, createPublicKey as createPublicKey6, verify as verify4 } from "crypto";
 function pubFor(kid, given) {
   if (given)
     return kidOf2(given) === kid ? given : undefined;
   const active = loadSigningKey(false);
   const pubs = (process.env["LOKI_RECEIPT_RETIRED_PUBKEYS"] ?? "").split(":").map((f) => f.trim()).filter(Boolean).flatMap((f) => {
     try {
-      return [createPublicKey6(readFileSync119(f))];
+      return [createPublicKey6(readFileSync120(f))];
     } catch {
       return [];
     }
@@ -79898,21 +80022,21 @@ function checkAttestation(jwt, expectedHash, given) {
 }
 function wallTamperProblem(receiptPath, receipt) {
   const wall = receipt["wall"], files = Array.isArray(wall?.files) ? wall.files : [];
-  const wallDir = join135(dirname52(receiptPath), "wall"), haveWallDir = existsSync95(wallDir);
+  const wallDir = join136(dirname52(receiptPath), "wall"), haveWallDir = existsSync96(wallDir);
   for (const f of files) {
     if (typeof f?.path !== "string" || typeof f.sha256 !== "string")
       continue;
-    const copy = join135(wallDir, basename34(f.path));
+    const copy = join136(wallDir, basename35(f.path));
     let cur;
     try {
-      cur = createHash38("sha256").update(readFileSync119(copy)).digest("hex");
+      cur = createHash39("sha256").update(readFileSync120(copy)).digest("hex");
     } catch {
       if (haveWallDir)
-        return `sealed Wall file ${basename34(f.path)} is missing from the run's wall directory: it was deleted after the seal`;
+        return `sealed Wall file ${basename35(f.path)} is missing from the run's wall directory: it was deleted after the seal`;
       continue;
     }
     if (cur !== f.sha256)
-      return `sealed Wall file ${basename34(f.path)} changed after the seal: receipt recorded sha256 ${f.sha256}, on disk ${cur}`;
+      return `sealed Wall file ${basename35(f.path)} changed after the seal: receipt recorded sha256 ${f.sha256}, on disk ${cur}`;
   }
   return null;
 }
@@ -79927,15 +80051,15 @@ function checkEventLog(receiptPath, receipt) {
   }
   if (typeof bound !== "string")
     return null;
-  if (bound === createHash38("sha256").digest("hex")) {
+  if (bound === createHash39("sha256").digest("hex")) {
     const st2 = receipt["time"]?.stages;
     const claims = st2 !== null && typeof st2 === "object" && Object.keys(st2).length > 0;
     return claims ? "the receipt records stages but binds the empty-log hash, so no events.jsonl can back it (missing, empty or non-empty); the receipt is forged or was sealed without a log. Re-run the task to produce a fresh receipt" : null;
   }
-  const path = join135(dirname52(receiptPath), "events.jsonl");
-  if (!existsSync95(path))
+  const path = join136(dirname52(receiptPath), "events.jsonl");
+  if (!existsSync96(path))
     return "events.jsonl is missing";
-  const raw2 = readFileSync119(path, "utf8"), events2 = readEvents(path), all = raw2.split(`
+  const raw2 = readFileSync120(path, "utf8"), events2 = readEvents(path), all = raw2.split(`
 `).filter((l) => l.trim() !== ""), lines2 = tornTail(raw2) ? all.slice(0, -1) : all;
   if (events2.length !== lines2.length || events2.some((e10, i) => e10.seq !== i))
     return "events.jsonl has a forged, edited or missing line";
@@ -79945,7 +80069,7 @@ function checkEventLog(receiptPath, receipt) {
     return "events.jsonl has bytes the engine never writes (a blank line or stray whitespace); it was appended to after the seal";
   if (events2.some((e10) => e10.type === "tamper.detected"))
     return "the supervisor detected events.jsonl being modified during the run";
-  const h10 = createHash38("sha256");
+  const h10 = createHash39("sha256");
   for (const l of lines2) {
     if (h10.copy().digest("hex") === bound)
       return null;
@@ -79955,7 +80079,7 @@ function checkEventLog(receiptPath, receipt) {
   return h10.digest("hex") === bound ? null : "events.jsonl does not match the hash recorded at seal";
 }
 function checkLogSeal(receiptPath, hash, kid, given) {
-  const path = join135(dirname52(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e10) => e10.type === "run.completed");
+  const path = join136(dirname52(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e10) => e10.type === "run.completed");
   if (!events2.some((e10) => e10.type === "receipt.sealed" && e10.data["receipt_sha256"] === hash))
     return { verdict: "TAMPERED", reason: "events.jsonl has no receipt.sealed event for this receipt" };
   if (done < 0)
@@ -79963,8 +80087,8 @@ function checkLogSeal(receiptPath, hash, kid, given) {
   const seal = events2[done + 1], d = seal?.type === "log.sealed" ? seal.data : null;
   if (!d)
     return { verdict: "TAMPERED", reason: "events.jsonl has no signed log.sealed line after run.completed" };
-  const lines2 = readFileSync119(path, "utf8").split(`
-`).filter((l) => l.trim() !== ""), sha7 = createHash38("sha256").update(lines2.slice(0, done + 1).join(`
+  const lines2 = readFileSync120(path, "utf8").split(`
+`).filter((l) => l.trim() !== ""), sha7 = createHash39("sha256").update(lines2.slice(0, done + 1).join(`
 `) + `
 `).digest("hex");
   const pub = d["kid"] === kid ? pubFor(kid, given) : undefined;
@@ -79973,11 +80097,11 @@ function checkLogSeal(receiptPath, hash, kid, given) {
   return null;
 }
 async function verifyReceipt(receiptPath, deps = {}) {
-  if (!existsSync95(receiptPath))
+  if (!existsSync96(receiptPath))
     return { verdict: "UNCHECKED", reasons: [`receipt not found: ${receiptPath}`] };
   let receipt;
   try {
-    receipt = JSON.parse((deps.read ?? ((p) => readFileSync119(p, "utf8")))(receiptPath));
+    receipt = JSON.parse((deps.read ?? ((p) => readFileSync120(p, "utf8")))(receiptPath));
   } catch {
     return { verdict: "UNCHECKED", reasons: ["receipt.json is not valid JSON"] };
   }
@@ -80062,7 +80186,7 @@ async function verifyCompositeFile(receiptPath, receipt, deps) {
 }
 function sealCompositeCmd(runDir) {
   let body;
-  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(basename34(runDir.replace(/\/+$/, ""))))
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(basename35(runDir.replace(/\/+$/, ""))))
     return process.stderr.write(`loki verify: run directory name is not a valid run id; composite would never verify
 `), 2;
   try {
@@ -80072,8 +80196,8 @@ function sealCompositeCmd(runDir) {
 `), 2;
   }
   const hash = compositeHash(body), sig = signReceipt(body.run_id, hash);
-  const out3 = { ...body, composite_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } }, path = join135(runDir, "composite.json");
-  writeFileSync68(`${path}.tmp`, JSON.stringify(out3, null, 2) + `
+  const out3 = { ...body, composite_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } }, path = join136(runDir, "composite.json");
+  writeFileSync69(`${path}.tmp`, JSON.stringify(out3, null, 2) + `
 `);
   renameSync23(`${path}.tmp`, path);
   process.stdout.write(`composite: ${path}
@@ -80088,7 +80212,7 @@ ${compositeLines(out3).join(`
 function independentLine(receiptPath) {
   let checks = [];
   try {
-    const c = JSON.parse(readFileSync119(receiptPath, "utf8")).checks;
+    const c = JSON.parse(readFileSync120(receiptPath, "utf8")).checks;
     if (Array.isArray(c))
       checks = c;
   } catch {}
@@ -80145,14 +80269,14 @@ ${/^(unknown option|expected at most one)/.test(pk2.error) ? `Usage: loki verify
   args = pk2.args;
   if (pk2.pubkey)
     deps = { ...deps, pubkey: pk2.pubkey };
-  const runsRoot2 = deps.runsRoot ?? join135(lokiDir(), "runs");
+  const runsRoot2 = deps.runsRoot ?? join136(lokiDir(), "runs");
   const runId2 = args[0] ?? latestRunId(runsRoot2) ?? undefined;
   if (!runId2)
     return process.stderr.write(`loki verify: no runs found
 `), 66;
-  const isFile = existsSync95(runId2) && statSync37(runId2).isFile();
+  const isFile = existsSync96(runId2) && statSync37(runId2).isFile();
   const isPath = isFile || /[\\/]/.test(runId2) || runId2.endsWith(".json");
-  const receiptPath = isPath ? runId2 : join135(runsRoot2, runId2, "receipt.json");
+  const receiptPath = isPath ? runId2 : join136(runsRoot2, runId2, "receipt.json");
   const byRunId = !isPath;
   rec2.runId = runId2;
   rec2.receiptPath = receiptPath;
@@ -80168,7 +80292,7 @@ verdict: TAMPERED
   if (result.verdict === "VERIFIED" || result.verdict === "UNSIGNED") {
     const d = (() => {
       try {
-        return sealDrift(receiptPath, JSON.parse(readFileSync119(receiptPath, "utf8")));
+        return sealDrift(receiptPath, JSON.parse(readFileSync120(receiptPath, "utf8")));
       } catch {
         return null;
       }
@@ -80181,7 +80305,7 @@ verdict: TAMPERED
   {
     const id2 = (() => {
       try {
-        const r = JSON.parse(readFileSync119(receiptPath, "utf8"));
+        const r = JSON.parse(readFileSync120(receiptPath, "utf8"));
         const j10 = r["verification"]?.jwt;
         const k3 = result.verdict === "VERIFIED" && typeof j10 === "string" ? JSON.parse(Buffer.from(j10.split(".")[0], "base64url").toString()).kid : null;
         return { kid: typeof k3 === "string" ? k3 : null, head: typeof r["head_sha"] === "string" ? r["head_sha"] : null, verdict: typeof r["verdict"] === "string" ? r["verdict"] : null, run: typeof r["run_id"] === "string" ? r["run_id"] : null };
@@ -80199,7 +80323,7 @@ verdict: TAMPERED
   if (result.verdict === "VERIFIED" || result.verdict === "UNSIGNED") {
     const outcome = (() => {
       try {
-        return outcomeOf2(JSON.parse(readFileSync119(receiptPath, "utf8")));
+        return outcomeOf2(JSON.parse(readFileSync120(receiptPath, "utf8")));
       } catch {
         return "UNREADABLE";
       }
@@ -80228,7 +80352,7 @@ verdict: ${result.verdict}
 `);
   if (result.verdict !== "TAMPERED")
     try {
-      const r = JSON.parse(readFileSync119(receiptPath, "utf8"));
+      const r = JSON.parse(readFileSync120(receiptPath, "utf8"));
       if (isComposite(r))
         for (const l of compositeLines(r))
           process.stdout.write(`${l}
@@ -80286,8 +80410,8 @@ var init_verify_cmd = __esm(() => {
 });
 
 // src/server/app.ts
-import { existsSync as existsSync97, readFileSync as readFileSync122, statSync as statSync38 } from "fs";
-import { join as join138, resolve as resolve40, sep as sep23 } from "path";
+import { existsSync as existsSync98, readFileSync as readFileSync123, statSync as statSync38 } from "fs";
+import { join as join139, resolve as resolve40, sep as sep23 } from "path";
 
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = Symbol();
@@ -90598,9 +90722,9 @@ function mount20(ctx) {
 }
 
 // src/server/routes/verify.ts
-import { readFileSync as readFileSync120, realpathSync as realpathSync36 } from "fs";
+import { readFileSync as readFileSync121, realpathSync as realpathSync36 } from "fs";
 import { createPublicKey as createPublicKey7 } from "crypto";
-import { join as join136, sep as sep22 } from "path";
+import { join as join137, sep as sep22 } from "path";
 init_verify_cmd();
 init_seal();
 init_receipt_dsse();
@@ -90627,11 +90751,11 @@ function mount21(ctx) {
       return done(404, "receipt not available", "not_found");
     let runDir, file;
     try {
-      const root = realpathSync36(join136(repo.p, ".loki", "runs"));
-      runDir = realpathSync36(join136(root, run2));
-      if (runDir !== join136(root, run2))
+      const root = realpathSync36(join137(repo.p, ".loki", "runs"));
+      runDir = realpathSync36(join137(root, run2));
+      if (runDir !== join137(root, run2))
         return done(404, "receipt not found", "not_found");
-      file = realpathSync36(join136(runDir, "receipt.json"));
+      file = realpathSync36(join137(runDir, "receipt.json"));
     } catch {
       return done(404, "receipt not found", "not_found");
     }
@@ -90650,7 +90774,7 @@ function mount21(ctx) {
         sha7 = r.receiptSha256 ?? null;
       }
       try {
-        outcome = outcomeOf2(JSON.parse(readFileSync120(file, "utf8")));
+        outcome = outcomeOf2(JSON.parse(readFileSync121(file, "utf8")));
       } catch {
         outcome = "UNREADABLE";
       }
@@ -90712,8 +90836,8 @@ function ttlCache(ttlMs = PROBE_CACHE_MS, now2 = Date.now) {
 }
 
 // src/server/legacy/shim.ts
-import { existsSync as existsSync96, readFileSync as readFileSync121 } from "fs";
-import { join as join137 } from "path";
+import { existsSync as existsSync97, readFileSync as readFileSync122 } from "fs";
+import { join as join138 } from "path";
 
 // src/server/legacy/routes.ts
 var LEGACY_ROUTES = [
@@ -91091,10 +91215,10 @@ var logged = new Set;
 var toHono = (p) => p.replace(/\{([A-Za-z_]+):path\}/g, ":$1{.+}").replace(/\{([A-Za-z_]+)\}/g, ":$1");
 var NOT_SUPPORTED = "not yet supported by the Control Plane";
 var repoVersion = () => {
-  for (const f of [join137(import.meta.dir, "../../../../../VERSION")]) {
+  for (const f of [join138(import.meta.dir, "../../../../../VERSION")]) {
     try {
-      if (existsSync96(f))
-        return readFileSync121(f, "utf8").trim();
+      if (existsSync97(f))
+        return readFileSync122(f, "utf8").trim();
     } catch {}
   }
   return "unknown";
@@ -91276,7 +91400,7 @@ function legacyShim(opts) {
 
 // src/server/app.ts
 var MAX_BODY2 = 1e6;
-var defaultUiDir = () => [join138(import.meta.dir, "../../ui/dist"), join138(import.meta.dir, "../ui/dist")].find((d) => existsSync97(join138(d, "index.html")));
+var defaultUiDir = () => [join139(import.meta.dir, "../../ui/dist"), join139(import.meta.dir, "../ui/dist")].find((d) => existsSync98(join139(d, "index.html")));
 function createApp(opts) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db: db2, sqlite } = openDb(opts.dbPath);
@@ -91305,10 +91429,10 @@ function createApp(opts) {
     await next();
   });
   const readInstalled = () => {
-    for (const f of [process.env.LOKI_VERSION_FILE, join138(import.meta.dir, "../../../../VERSION")]) {
+    for (const f of [process.env.LOKI_VERSION_FILE, join139(import.meta.dir, "../../../../VERSION")]) {
       try {
         if (f)
-          return readFileSync122(f, "utf8").trim() || "unknown";
+          return readFileSync123(f, "utf8").trim() || "unknown";
       } catch {}
     }
     return "unknown";
@@ -91419,11 +91543,11 @@ function createApp(opts) {
       return c.json({ error: "not found" }, 404);
     const root = resolve40(uiDir);
     const f = resolve40(root, `.${p}`);
-    if (f.startsWith(root + sep23) && existsSync97(f) && statSync38(f).isFile())
+    if (f.startsWith(root + sep23) && existsSync98(f) && statSync38(f).isFile())
       return new Response(Bun.file(f));
     if (/\.[a-z0-9]+$/i.test(p))
       return c.json({ error: "not found" }, 404);
-    return new Response(Bun.file(join138(root, "index.html")));
+    return new Response(Bun.file(join139(root, "index.html")));
   });
   return { app, db: db2, close: () => {
     clearInterval(reconciler);