loki-mode 11.81.1 → 11.83.0

package/packages/control-plane/dist/server.js

@@ -258,7 +258,7 @@ var ASSIGNMENT, RULES, QUERY_SEGMENT, SECRET_PARAM, redactQuery = (s) => s.repla
   if (!keep || !data || typeof data !== "object" || Array.isArray(data))
     return redactDeep(data);
   return Object.fromEntries(Object.entries(data).map(([k, v]) => typeof v === "string" && keep.get(k)?.test(v) ? [k, v] : [redactSecrets(k), redactDeep(v)]));
-}, redactEnvelope = (e) => Object.fromEntries(Object.entries(e).map(([k, v]) => [redactSecrets(k), k === "data" ? redactEventData(e.type, v) : redactDeep(v)]));
+}, redactEnvelope = (e) => Object.fromEntries(Object.entries(e).map(([k, v]) => [redactSecrets(k), k === "data" ? redactEventData(e.type, v) : redactDeep(v)])), UNSAFE_TERMINAL_CHARS_RE;
 var init_redact = __esm(() => {
   ASSIGNMENT = /((?<![A-Za-z0-9_.-])[_.-]*(?:[A-Za-z0-9]+[_.-]+)*(?:password|passwd|secret|token|api[_-]?key|apikey)["']?\s*[:=]\s*)((?:"(?!\[REDACTED)(?:\\.|[^"\\\n])+")|(?:'(?!\[REDACTED)(?:\\.|[^'\\\n])+')|(?!["']|\[REDACTED)[^\s"',;&]+)/gi;
   RULES = [
@@ -300,6 +300,7 @@ var init_redact = __esm(() => {
     ["log.sealed", new Map([["kid", B64(43)], ["sig", B64(86)], ["events_sha256", HEX64]])],
     ["receipt.sealed", new Map([["kid", B64(43)], ["receipt_sha256", HEX64], ["events_sha256", HEX64]])]
   ]);
+  UNSAFE_TERMINAL_CHARS_RE = /[\x00-\x1f\x7f-\x9f\u00ad\u061c\u200b-\u200f\u2028-\u202e\u2060-\u2064\u2066-\u2069\ufeff]/g;
 });
 
 // ../../loki-ts/src/util/credential_env.ts
@@ -55777,6 +55778,7 @@ var init_test_file_text = __esm(() => {
 var exports_testmap = {};
 __export(exports_testmap, {
   projectInterpreter: () => projectInterpreter,
+  missingJavaTool: () => missingJavaTool,
   isTestFile: () => isTestFile,
   impactedRefs: () => impactedRefs,
   harnessRunners: () => harnessRunners,
@@ -55796,6 +55798,10 @@ function pytestPython(root) {
   }
   return "python";
 }
+function missingJavaTool(files, env = process.env, root) {
+  const want = files.some((f) => /(?:^|\/)pom\.xml$/.test(f)) ? "maven" : files.some((f) => /(?:^|\/)(?:build|settings)\.gradle(?:\.kts)?$|(?:^|\/)gradlew$/.test(f)) ? "gradle" : files.some((f) => /\.java$/.test(f)) ? "javac" : null;
+  return want && !javaToolOk(want, env, root) ? JAVA_TOOLS[want].tool : null;
+}
 function guessRunner(fileName, runners, relPath) {
   if (fileName.endsWith(".py"))
     return runners.includes("unittest") && !runners.includes("pytest") ? "unittest" : "pytest";
@@ -55803,6 +55809,8 @@ function guessRunner(fileName, runners, relPath) {
     return "go";
   if (fileName.endsWith(".rs"))
     return runners.includes("cargo") && relPath !== undefined && CARGO_TEST_FILE_RE.test(relPath) ? "cargo" : null;
+  if (fileName.endsWith(".java"))
+    return ["maven", "gradle", "javac"].find((r) => runners.includes(r)) ?? null;
   return /\.[cm]?[jt]sx?$/.test(fileName) ? ["vitest", "jest", "bun", "node"].find((r) => runners.includes(r)) ?? null : null;
 }
 function projectInterpreter(root) {
@@ -55851,6 +55859,10 @@ function buildTestMap(root) {
       mark("go", rel);
     else if (name === "Cargo.toml")
       mark("cargo", rel);
+    else if (name === "pom.xml")
+      mark("maven", rel);
+    else if (/^(?:build|settings)\.gradle(?:\.kts)?$/.test(name) || name === "gradlew")
+      mark("gradle", rel);
   }
   const jsRunner = evidence["vitest"] ? "vitest" : evidence["jest"] ? "jest" : evidence["bun"] ? "bun" : evidence["node"] ? "node" : null;
   const tests = [];
@@ -55919,7 +55931,10 @@ class RealTestMapProvider {
     return impactedRefs(map, changedFiles);
   }
 }
-var RUNNER_ORDER, COMMANDS, STDLIB_RUNNERS, FOREIGN_SOURCE_RE, harnessRunners = (runners, files = [], env = process.env, root, focus2 = []) => {
+var RUNNER_ORDER, COMMANDS, STDLIB_RUNNERS, FOREIGN_SOURCE_RE, JAVA_TOOLS, javaToolOk = (r, env, root) => {
+  const t = JAVA_TOOLS[r];
+  return !t || !!Bun.which(t.tool, { PATH: env.PATH ?? "" }) || !!t.wrapper && !!root && existsSync36(join53(root, t.wrapper));
+}, harnessRunners = (runners, files = [], env = process.env, root, focus2 = []) => pickHarnessRunners(runners, files, env, root, focus2).filter((r) => javaToolOk(r, env, root)), pickHarnessRunners = (runners, files, env, root, focus2) => {
   const onPath = (tool) => !!Bun.which(tool, { PATH: env.PATH ?? "" }), w = languageBytes(root, files, (f) => STDLIB_RUNNERS.find((r) => r.ext.test(f))?.runner ?? (/\.[cm]?[jt]sx?$/i.test(f) ? "js" : FOREIGN_SOURCE_RE.test(f) ? "other" : null)), at2 = (k3) => w.get(k3) ?? 0, js = at2("js"), top = STDLIB_RUNNERS.reduce((a, r) => at2(r.runner) > at2(a.runner) ? r : a), bun = env.LOKI_WALL_HARNESS_RUNNER !== "0" && onPath("bun") ? ["bun"] : toolchainRunner(files, focus2);
   const t = at2(top.runner), o = at2("other");
   return runners.length > 0 ? runners : js >= t && js >= o ? js === 0 && w.size > 0 ? [] : bun : t > o ? onPath(top.tool) ? [top.runner] : toolchainRunner(files, focus2) : [];
@@ -55939,7 +55954,7 @@ var init_testmap = __esm(() => {
   init_linguist();
   init_scope();
   init_test_file_text();
-  RUNNER_ORDER = ["pytest", "vitest", "jest", "bun", "node", "npm", "go", "cargo"];
+  RUNNER_ORDER = ["pytest", "vitest", "jest", "bun", "node", "npm", "go", "cargo", "maven", "gradle", "javac"];
   COMMANDS = {
     pytest: { cmd: "python -m pytest -q <files>", coarse: false },
     unittest: { cmd: "python3 -m unittest <files>", coarse: false },
@@ -55949,11 +55964,15 @@ var init_testmap = __esm(() => {
     node: { cmd: "node --test <files>", coarse: false },
     npm: { cmd: "npm test --silent", coarse: true },
     go: { cmd: "go test ./<pkg dirs>", coarse: false },
-    cargo: { cmd: "cargo test", coarse: true }
+    cargo: { cmd: "cargo test", coarse: true },
+    maven: { cmd: "mvn test -Dtest=<class>", coarse: false },
+    gradle: { cmd: "gradle cleanTest test --tests <class>", coarse: false },
+    javac: { cmd: "javac + java <test class>", coarse: false }
   };
-  STDLIB_RUNNERS = [{ ext: /\.py$/, runner: "unittest", tool: "python3" }, { ext: /\.go$/, runner: "go", tool: "go" }, { ext: /\.rs$/, runner: "cargo", tool: "cargo" }];
+  STDLIB_RUNNERS = [{ ext: /\.py$/, runner: "unittest", tool: "python3" }, { ext: /\.go$/, runner: "go", tool: "go" }, { ext: /\.rs$/, runner: "cargo", tool: "cargo" }, { ext: /\.java$/, runner: "javac", tool: "javac" }];
   FOREIGN_SOURCE_RE = /\.(?:py|go|rs|java|kt|kts|scala|rb|php|cs|c|cc|cpp|cxx|h|hpp|swift|m|mm|ex|exs|erl|hs|clj|lua|pl|dart|r|jl|zig)$/i;
-  TOOLCHAINS = [[/(?:^|\/)package\.json$/, "node", /\.[cm]?[jt]sx?$/], [/(?:^|\/)go\.mod$/, "go", /\.go$/], [/(?:^|\/)Cargo\.toml$/, "cargo", /\.rs$/], [/(?:^|\/)(?:pyproject\.toml|setup\.py|setup\.cfg|requirements(?:[-_.][\w.-]+)?\.txt|tox\.ini|pytest\.ini)$/, "pytest", /\.py$/]];
+  JAVA_TOOLS = { maven: { tool: "mvn", wrapper: "mvnw" }, gradle: { tool: "gradle", wrapper: "gradlew" }, javac: { tool: "javac" } };
+  TOOLCHAINS = [[/(?:^|\/)package\.json$/, "node", /\.[cm]?[jt]sx?$/], [/(?:^|\/)go\.mod$/, "go", /\.go$/], [/(?:^|\/)Cargo\.toml$/, "cargo", /\.rs$/], [/(?:^|\/)pom\.xml$/, "maven", /\.java$/], [/(?:^|\/)(?:build|settings)\.gradle(?:\.kts)?$|(?:^|\/)gradlew$/, "gradle", /\.java$/], [/(?:^|\/)(?:pyproject\.toml|setup\.py|setup\.cfg|requirements(?:[-_.][\w.-]+)?\.txt|tox\.ini|pytest\.ini)$/, "pytest", /\.py$/]];
   CARGO_TEST_FILE_RE = /(?:^|\/)tests\/[^/]+\.rs$/;
 });
 
@@ -56129,6 +56148,50 @@ function skipped(raw2) {
   return stripAnsi(raw2).split(`
 `).filter((l) => /^(?:=+ )?\d+ \w+.* in [\d.]+s|^\s*Tests?:?\s+\d|^(?:#|\u2139) skipped \d/.test(l.trim())).reduce((t, l) => t + [...l.matchAll(/(\d+) (?:skipped|deselected|xfailed)|skipped (\d+)/g)].reduce((u10, m) => u10 + +(m[1] ?? m[2]), 0), 0);
 }
+function javaSummary(raw2) {
+  const ls2 = stripAnsi(raw2).split(`
+`).map((l) => l.trimEnd()), tail2 = ls2.filter((l) => l.trim()).slice(-40), ok2 = (re2) => {
+    const m = tail2.map((l) => re2.exec(l)).filter(Boolean).pop();
+    return m ? m[1] === "SUCCESS" || m[1] === "SUCCESSFUL" : null;
+  };
+  const wrap = ls2.filter((l) => l.trim()).slice(-1)[0]?.match(/^LOKI_JAVA_TESTS: (\d+) run, (\d+) failed$/);
+  if (wrap) {
+    const ids = ls2.flatMap((l) => l.match(/^FAIL (.+)$/)?.[1] ?? []), failed2 = +wrap[2];
+    return +wrap[1] > 0 && ids.length === failed2 && ls2.filter((l) => /^(?:PASS|FAIL) /.test(l)).length === +wrap[1] ? { executed: +wrap[1], failed: failed2, ids } : null;
+  }
+  const mv2 = ok2(/^\[(?:INFO|ERROR)\] BUILD (SUCCESS|FAILURE)$/), gr2 = ok2(/^BUILD (SUCCESSFUL|FAILED)\b/);
+  if (mv2 !== null) {
+    let executed = 0, failed2 = 0, seen = false;
+    ls2.forEach((l, i) => {
+      if (/^\[(?:INFO|ERROR)\] Results:$/.test(l)) {
+        const m = ls2.slice(i + 1, i + 40).map((x3) => /^\[(?:INFO|WARNING|ERROR)\] Tests run: (\d+), Failures: (\d+), Errors: (\d+), Skipped: (\d+)$/.exec(x3)).find(Boolean);
+        if (m) {
+          seen = true;
+          executed += +m[1] - +m[4];
+          failed2 += +m[2] + +m[3];
+        }
+      }
+    });
+    const ids = [...new Set(ls2.flatMap((l) => {
+      const m = /^\[ERROR\] (?:(\S+)\(([\w.$]+)\)|([\w.$]+\.[\w$]+)(?:\[[^\]]*\])?) .*<<< (?:FAILURE|ERROR)!$/.exec(l);
+      return m ? [m[3] ?? `${m[2]}.${m[1]}`] : [];
+    }))];
+    return seen && executed > 0 && (mv2 ? failed2 === 0 : failed2 > 0) ? { executed, failed: failed2, ids } : null;
+  }
+  if (gr2 !== null) {
+    const ev2 = ls2.flatMap((l) => {
+      const m = /^\s*(\S.*?) > (\S.*?) (PASSED|FAILED|SKIPPED)$/.exec(l);
+      return m ? [{ id: `${m[1]}.${m[2]}`, s: m[3] }] : [];
+    }), bad = ev2.filter((e10) => e10.s === "FAILED");
+    const executed = ev2.filter((e10) => e10.s !== "SKIPPED").length;
+    return executed > 0 && (gr2 ? bad.length === 0 : bad.length > 0) ? { executed, failed: bad.length, ids: [...new Set(bad.map((e10) => e10.id))] } : null;
+  }
+  return null;
+}
+function javaTestClass(path) {
+  const m = /^(.*?)\/?src\/test\/java\/(.+)\.java$/.exec(path), cls = (m ? m[2] : basename12(path, ".java")).split("/").join(".");
+  return { root: m?.[1] || ".", cls, rel: m ? `src/test/java/${m[2]}.java` : path };
+}
 function testCount(raw2, path, ok2) {
   const out3 = stripAnsi(raw2);
   const bu2 = bunCount(out3), ut = unittestCount(out3, ok2);
@@ -56136,6 +56199,9 @@ function testCount(raw2, path, ok2) {
     return bu2;
   if (ut !== null)
     return ut;
+  const jv = javaSummary(out3);
+  if (jv)
+    return jv.executed;
   if (/^\s*(?:Test Files\s+0\b|No test files found)/m.test(out3) && !/^\s*Tests?\s+\d/m.test(out3))
     return 0;
   const r = ran(out3, path, ok2);
@@ -56202,6 +56268,9 @@ function classifyCheck(i) {
     return { result: "fail", ...n10 !== null ? { n: n10 } : {} };
   if (n10 === null)
     return { result: "not_run", reason: UNMEASURED_REASON };
+  const jv = javaSummary(text3);
+  if (jv && jv.failed > 0)
+    return { result: "fail", n: n10 };
   return { result: "pass", n: n10 };
 }
 function checkProvenance(name, ctx) {
@@ -56715,6 +56784,10 @@ function classify(f, status, output, repoDir, interpreter) {
     return status === 1 ? pytestExit1IsRed(output) ? "fail" : "not_run" : status === 2 ? pytestCollectionIsRed(output, repoDir) ? "fail" : "not_run" : "not_run";
   if (f.runner === "jest" || f.runner === "vitest" || f.runner === "bun")
     return parsedFailCount(f.runner, output) > 0 ? "fail" : "not_run";
+  if (f.runner === "maven" || f.runner === "gradle" || f.runner === "javac") {
+    const j10 = javaSummary(output);
+    return j10 && j10.failed > 0 ? "fail" : "not_run";
+  }
   return f.runner === "node" && nodeIsRed(f, output) ? "fail" : "not_run";
 }
 function baseJobs() {
@@ -56809,11 +56882,27 @@ function runnerCmd(t, repoDir) {
       const names = goTestNames(join54(repoDir, t.path));
       return ["go", ["test", "-json", ...names.length ? ["-run", `^(${names.join("|")})$`] : [], `./${dirname23(t.path)}`]];
     }
+    case "maven": {
+      const j10 = javaTestClass(t.path);
+      return [wrapperOr(repoDir, "mvnw", "mvn"), ["-B", "test", `-Dtest=${j10.cls.split(".").pop()}`, "-Dsurefire.failIfNoSpecifiedTests=false", "-DfailIfNoTests=false"]];
+    }
+    case "gradle": {
+      const j10 = javaTestClass(t.path);
+      return [wrapperOr(repoDir, "gradlew", "gradle"), ["cleanTest", "test", "--tests", j10.cls, "-i", "--console=plain"]];
+    }
+    case "javac": {
+      const j10 = javaTestClass(t.path);
+      return ["bash", ["-c", JAVAC_WRAPPER, "loki-javac", j10.root, j10.cls, j10.rel]];
+    }
     case "cargo":
       return CARGO_TEST_FILE_RE.test(t.path) ? ["cargo", ["test", "--test", basename12(t.path, ".rs")]] : ["cargo", ["test"]];
   }
 }
 function fullSuiteCmd(runner, repoDir) {
+  if (runner === "maven" || runner === "gradle") {
+    const s = FULL_SUITE_STATIC[runner];
+    return { ...s, cmd: wrapperOr(repoDir, runner === "maven" ? "mvnw" : "gradlew", s.cmd) };
+  }
   if (runner !== "pytest" && runner !== "unittest")
     return FULL_SUITE_STATIC[runner];
   const [cmd, interpreter, pre2] = resolveTool(repoDir, "python", "python3", "python");
@@ -56896,7 +56985,23 @@ function firstFileLineAnchor(desc2) {
 }
 var NO_TESTS_REASON = "no tests executed", NO_RUNNER_REASON = "no runner of this repo runs this file", harnessSkipCode = (env = process.env) => env.LOKI_WALL_HARNESS_RUNNER === "0" ? "harness_runner_disabled" : Bun.which("bun", { PATH: env.PATH ?? "" }) ? "no_toolchain" : "bun_not_on_path", GO_EXIT0_REASON = "test count could not be confirmed: go test output is produced by the code under test and cannot confirm execution (a Go exit 0 is never a pass)", UNCONFIRMED_REASON = "test count could not be confirmed", FAIL_EVIDENCE, GO_FAIL_EVIDENCE, UNMEASURED_REASON = "executed count unmeasured (Loki could not parse the runner summary, harness-owned)", stripAnsi = (s) => s.replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)/g, "").replace(/(?:\u001b\[|\u009b)[0-9;?]*[ -\/]*[@-~]/g, "").replace(/\r\n?/g, `
 `), tailLines = (out3) => out3.split(`
-`).filter((x3) => x3.trim()).slice(-12), GO_PKG_RE, EXIT_CODED_COUNT = "n/a (exit-coded check, not a test runner)", FRAMEWORK_RE, SCRIPT_RE, isExecutedProof = (c) => c.result === "pass" && typeof c.n === "number" && c.n > 0, hasExecutedProof = (checks) => checks.some(isExecutedProof), LLM_JUDGES, NON_RUNNER, normPath = (p) => p.replace(/^(?:\.\/)+/, ""), hasExogenousProof = (checks, ctx) => checks.some((c) => isExecutedProof(c) && ((p) => p !== "agent_authored" && p !== "llm_judge")(checkProvenance(c.name ?? "", ctx))), CODE_FILE_EXT, DECL_RE, VAR_DECL_RE, stripComments = (src) => src.replace(/\/\*[\s\S]*?\*\//g, " ").split(`
+`).filter((x3) => x3.trim()).slice(-12), GO_PKG_RE, JAVAC_WRAPPER = `set -u
+root="$1"; cls="$2"; shift 2; cd "$root" || exit 70
+if [ "$cls" = "-" ]; then
+  set -- $(find src/test/java -name '*Test.java' 2>/dev/null | sort); cls=""
+  for f in "$@"; do c="\${f#src/test/java/}"; c="\${c%.java}"; cls="$cls \${c//\\//.}"; done
+fi
+out="$(mktemp -d "\${TMPDIR:-/tmp}/loki-javac.XXXXXX")" || exit 70
+trap 'rm -rf -- "\${out:?}"' EXIT
+find src/main/java -name '*.java' 2>/dev/null > "$out/srcs"
+javac -nowarn -d "$out" @"$out/srcs" "$@" || exit 1
+st=0; : > "$out/run.log"
+for c in $cls; do java -cp "$out" "$c" >> "$out/run.log" 2>&1 || st=$?; done
+cat "$out/run.log"
+p=$(grep -c '^PASS ' "$out/run.log"); f=$(grep -c '^FAIL ' "$out/run.log")
+echo "LOKI_JAVA_TESTS: $((p + f)) run, $f failed"
+[ "$f" -gt 0 ] && st=1
+exit $st`, wrapperOr = (repoDir, w, bare) => existsSync37(join54(repoDir, w)) ? `./${w}` : bare, EXIT_CODED_COUNT = "n/a (exit-coded check, not a test runner)", FRAMEWORK_RE, SCRIPT_RE, isExecutedProof = (c) => c.result === "pass" && typeof c.n === "number" && c.n > 0, hasExecutedProof = (checks) => checks.some(isExecutedProof), LLM_JUDGES, NON_RUNNER, normPath = (p) => p.replace(/^(?:\.\/)+/, ""), hasExogenousProof = (checks, ctx) => checks.some((c) => isExecutedProof(c) && ((p) => p !== "agent_authored" && p !== "llm_judge")(checkProvenance(c.name ?? "", ctx))), CODE_FILE_EXT, DECL_RE, VAR_DECL_RE, stripComments = (src) => src.replace(/\/\*[\s\S]*?\*\//g, " ").split(`
 `).map((l) => /^\s*\*/.test(l) ? "" : l.replace(/\/\/.*$/, "").replace(/(^|\s)#.*$/, "$1")).join(`
 `), GO_METHOD_RE, METHOD_RE, NOT_A_NAME, declNames = (line2) => {
   const out3 = [];
@@ -56911,7 +57016,7 @@ var NO_TESTS_REASON = "no tests executed", NO_RUNNER_REASON = "no runner of this
   if (m)
     out3.push(m[1]);
   return out3.filter((n10) => !NOT_A_NAME.has(n10));
-}, printable = (s) => s.replace(/[\x00-\x1f\x7f]/g, "?"), SENSITIVE, API, TEST_CFG, RANK3, FILES_MEDIUM = 4, FILES_HIGH = 15, LINES_MEDIUM = 100, LINES_HIGH = 500, RAN_ALWAYS, REVIEWER_ITEM = "one reviewer", PLAN, LOW_SKIPPED, deferredOf = (tier, selected, executed) => (tier === "low" ? LOW_SKIPPED : selected).filter((c) => !RAN_ALWAYS.includes(c) && !executed.includes(c)), DEEP_ITEMS, NOT_SELECTED = "not selected by risk tier: ", MANIFEST_LOCKS, dirOf = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "", PKG_DEP_KEYS, PYPROJECT_NONDEP, SEM_RULES, DOC_FILE, readOr = (p) => {
+}, printable = (s) => s.replace(UNSAFE_TERMINAL_CHARS_RE, "?"), SENSITIVE, API, TEST_CFG, RANK3, FILES_MEDIUM = 4, FILES_HIGH = 15, LINES_MEDIUM = 100, LINES_HIGH = 500, RAN_ALWAYS, REVIEWER_ITEM = "one reviewer", PLAN, LOW_SKIPPED, deferredOf = (tier, selected, executed) => (tier === "low" ? LOW_SKIPPED : selected).filter((c) => !RAN_ALWAYS.includes(c) && !executed.includes(c)), DEEP_ITEMS, NOT_SELECTED = "not selected by risk tier: ", MANIFEST_LOCKS, dirOf = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "", PKG_DEP_KEYS, PYPROJECT_NONDEP, SEM_RULES, DOC_FILE, readOr = (p) => {
   try {
     return readFileSync49(p, "utf8");
   } catch {
@@ -56990,7 +57095,10 @@ var init_check_result = __esm(() => {
     node: { cmd: "node", args: ["--test"] },
     npm: { cmd: "npm", args: ["test", "--silent"] },
     go: { cmd: "go", args: ["test", "-json", "./..."] },
-    cargo: { cmd: "cargo", args: ["test"] }
+    cargo: { cmd: "cargo", args: ["test"] },
+    maven: { cmd: "mvn", args: ["-B", "test"] },
+    gradle: { cmd: "gradle", args: ["cleanTest", "test", "-i", "--console=plain"] },
+    javac: { cmd: "bash", args: ["-c", JAVAC_WRAPPER, "loki-javac", ".", "-"] }
   };
   URL_RE = /\b[a-z][a-z0-9+.-]{0,63}:\/\/\S+/gi;
   ANCHOR_RE = /(?<![\w./@-])([\w./@-]{1,512})[`'"]?(?::L?|#L|\s*\(line\s+)([1-9]\d*)(?!\d)/g;
@@ -59186,6 +59294,9 @@ function failIds(raw2) {
   const output = stripAnsi(raw2), gc2 = goCargoIds(output);
   if (gc2)
     return gc2;
+  const jv = javaSummary(output);
+  if (jv)
+    return jv.failed > 0 && jv.ids.length >= jv.failed ? jv.ids : [];
   const ids = [...new Set(output.split(`
 `).map((l) => ID_LINE.exec(l.trim())).flatMap((m) => m ? [(m.slice(1).find(Boolean) ?? "").trim()] : []).filter(Boolean))];
   const c = failCount(output);
@@ -64503,7 +64614,10 @@ class TestName(unittest.TestCase):
     def test_it(self): self.assertEqual(fn(1), 2)
   Run: python3 -m unittest <file>.`,
     go: `${COMMANDS.go.cmd.replace(" ./<pkg dirs>", "")}. Write a _test.go file in the package under test. Example: func TestName(t *testing.T) { if got := Fn(1); got != 2 { t.Fatalf("got %v", got) } }  Run: ${COMMANDS.go.cmd.replace("<pkg dirs>", "<dir>")}.`,
-    cargo: `${COMMANDS.cargo.cmd}. Write an integration test file directly under tests/ that calls the crate's public API. Example: #[test] fn name() { assert_eq!(my_crate::f(1), 2); }  Run: ${COMMANDS.cargo.cmd} --test <stem>.`
+    cargo: `${COMMANDS.cargo.cmd}. Write an integration test file directly under tests/ that calls the crate's public API. Example: #[test] fn name() { assert_eq!(my_crate::f(1), 2); }  Run: ${COMMANDS.cargo.cmd} --test <stem>.`,
+    maven: `Maven + JUnit (use the JUnit version already declared in the build file). Put the file in src/test/java/ (add a package line only if the code under test is in a package). The file name must end in Test.java and the public class name must equal the file name without .java, so surefire picks it up. Example: import org.junit.jupiter.api.Test; import static org.junit.jupiter.api.Assertions.*; public class loki_wall_LeapTest { @Test void leap() { assertTrue(Leap.is(2000)); } }  Run: ${COMMANDS.maven.cmd.replace("<class>", "<ClassName>")}.`,
+    gradle: `Gradle + JUnit (use the JUnit version already declared in the build file). Put the file in src/test/java/. The public class name must equal the file name without .java and the file name must end in Test.java. Example: import org.junit.jupiter.api.Test; import static org.junit.jupiter.api.Assertions.*; public class loki_wall_LeapTest { @Test void leap() { assertTrue(Leap.is(2000)); } }  Run: ${COMMANDS.gradle.cmd.replace("<class>", "<ClassName>")}.`,
+    javac: 'Plain Java 8+ with NO test framework and NO build tool (do not import org.junit). Put the file in src/test/java/. The file name must end in Test.java and the public class name must equal the file name without .java. The class has public static void main. For every check print exactly one line, `PASS <name>` or `FAIL <name>` (name on the same line), and at the end System.exit(1) if any check failed. Catch exceptions per check so one failure does not hide the rest. Example: static void check(String n, boolean ok) { System.out.println((ok ? "PASS " : "FAIL ") + n); if (!ok) failed = true; }  Run: javac the sources under src/main/java plus the file, then java <ClassName>.'
   };
 });
 
@@ -65318,27 +65432,102 @@ var init_select = __esm(() => {
   RANK_LABELS = ["wallPasses", "deterministicFails", "passesInS", "flakyInS", "lintFails", "diffLines", "index"];
 });
 
+// ../../loki-ts/src/features/dependents.ts
+import { readFileSync as readFileSync73 } from "fs";
+import { dirname as dirname33, join as join82, normalize as normalize5 } from "path";
+function importTargets(rel, text3) {
+  const out3 = [], dir = dirname33(rel);
+  if (JS2.test(rel))
+    for (const m of text3.matchAll(JS_SPEC_RE)) {
+      const spec = m[1] ?? "";
+      if (!spec.startsWith("."))
+        continue;
+      const p = posix3(join82(dir, spec)), stem = p.replace(/\.[cm]?[jt]sx?$/, "");
+      out3.push(p, ...JS_EXT2.flatMap((e10) => [stem + e10, `${p}/index${e10}`]));
+    }
+  else if (PY3.test(rel)) {
+    const add3 = (dots, mod, names) => {
+      const up2 = dots > 0 ? join82(dir, ...Array(dots - 1).fill("..")) : "", roots = dots > 0 ? [up2] : [".", dir], path = mod.split(".").filter(Boolean).join("/");
+      for (const r of roots) {
+        const b = join82(r, path);
+        if (path)
+          out3.push(...pyMod(posix3(b)).map(posix3));
+        for (const n10 of names)
+          out3.push(...pyMod(posix3(join82(b, n10))));
+      }
+    };
+    for (const m of text3.matchAll(PY_FROM)) {
+      const dots = /^\.*/.exec(m[1])[0].length;
+      add3(dots, m[1].slice(dots), m[2].replace(/[()]/g, "").split(",").map((s) => s.trim().split(/\s+as\s+/)[0]).filter((s) => /^\w+$/.test(s)));
+    }
+    for (const m of text3.matchAll(PY_IMP))
+      for (const part of m[1].split(","))
+        add3(0, part.trim().split(/\s+as\s+/)[0], []);
+  }
+  return out3;
+}
+function dependentTests(repoDir, map, changed, already) {
+  const chg = new Set(changed.map(posix3).filter((f) => JS2.test(f) || PY3.test(f))), none = { tests: [], dropped: 0, truncated: false };
+  if (chg.size === 0)
+    return none;
+  const isTest = new Set(map.tests.map((t) => t.path)), have = new Set(already.map((t) => t.path)), t02 = Date.now();
+  let bytes = 0, truncated = false;
+  const deps = new Set;
+  for (const rel of listProjectFiles(repoDir)) {
+    if (!(JS2.test(rel) || PY3.test(rel)) || isTest.has(rel) || chg.has(rel))
+      continue;
+    if (bytes > SCAN_MAX_BYTES || Date.now() - t02 > SCAN_MAX_MS) {
+      truncated = true;
+      break;
+    }
+    const text3 = read2(repoDir, rel);
+    bytes += text3.length;
+    if (importsAny(text3, rel, chg))
+      deps.add(rel);
+  }
+  if (deps.size === 0)
+    return { ...none, truncated };
+  const all = map.tests.filter((t) => !have.has(t.path) && importsAny(read2(repoDir, t.path), t.path, deps)).sort((a, b) => a.path.localeCompare(b.path));
+  return { tests: all.slice(0, MAX_DEPENDENT_TESTS), dropped: Math.max(0, all.length - MAX_DEPENDENT_TESTS), truncated };
+}
+var MAX_DEPENDENT_TESTS = 20, SCAN_MAX_BYTES = 48000000, SCAN_MAX_MS = 4000, FILE_MAX_BYTES = 256000, JS2, PY3, JS_EXT2, PY_FROM, PY_IMP, posix3 = (p) => normalize5(p).split("\\").join("/").replace(/^\.\//, ""), pyMod = (base) => [`${base}.py`, `${base}/__init__.py`], read2 = (repoDir, rel) => {
+  try {
+    return readFileSync73(join82(repoDir, rel), "utf8").slice(0, FILE_MAX_BYTES);
+  } catch {
+    return "";
+  }
+}, importsAny = (text3, rel, set) => importTargets(rel, text3).some((t) => set.has(t)), dependentNotes = (d) => [...d.truncated ? ["reverse-dependent scan hit its byte or time bound: some importers of changed files may not have been tested"] : [], ...d.dropped ? [`reverse-dependent tests dropped by the ${MAX_DEPENDENT_TESTS}-file cap: ${d.dropped}`] : []];
+var init_dependents = __esm(() => {
+  init_safe_git();
+  init_test_file_text();
+  JS2 = /\.(?:[cm]?[jt]sx?)$/;
+  PY3 = /\.py$/;
+  JS_EXT2 = [".ts", ".tsx", ".js", ".jsx", ".mjs", ".cjs"];
+  PY_FROM = /^[ \t]*from[ \t]+(\.*[\w.]*)[ \t]+import[ \t]+(\([^)]*\)|[^\n#]+)/gm;
+  PY_IMP = /^[ \t]*import[ \t]+([\w., \t]+)/gm;
+});
+
 // ../../loki-ts/src/util/app_probe.ts
 import { spawnSync as spawnSync9 } from "child_process";
-import { existsSync as existsSync56, mkdirSync as mkdirSync40, readFileSync as readFileSync73, renameSync as renameSync18, writeFileSync as writeFileSync38 } from "fs";
-import { join as join82 } from "path";
+import { existsSync as existsSync56, mkdirSync as mkdirSync40, readFileSync as readFileSync74, renameSync as renameSync18, writeFileSync as writeFileSync38 } from "fs";
+import { join as join83 } from "path";
 function readJson5(p) {
   try {
-    const v3 = JSON.parse(readFileSync73(p, "utf8"));
+    const v3 = JSON.parse(readFileSync74(p, "utf8"));
     return v3 && typeof v3 === "object" ? v3 : null;
   } catch {
     return null;
   }
 }
 function stopApp(repoDir, opts = {}) {
-  const runner = opts.runnerPath ?? join82(REPO_ROOT, "autonomy", "app-runner.sh");
-  if (!existsSync56(runner) || !existsSync56(join82(repoDir, ".loki", "app-runner", "app.pid")))
+  const runner = opts.runnerPath ?? join83(REPO_ROOT, "autonomy", "app-runner.sh");
+  if (!existsSync56(runner) || !existsSync56(join83(repoDir, ".loki", "app-runner", "app.pid")))
     return;
   spawnSync9("bash", ["-c", STOP, "app-probe", repoDir, runner], { cwd: repoDir, env: plainTestEnv(), timeout: opts.timeoutMs ?? 60000, killSignal: "SIGKILL", stdio: "ignore" });
 }
 async function appProbe(repoDir, lokiDir2, opts = {}) {
-  const timeoutMs = opts.timeoutMs ?? 60000, runner = opts.runnerPath ?? join82(REPO_ROOT, "autonomy", "app-runner.sh");
-  const dir = join82(repoDir, ".loki", "app-runner"), checks = [];
+  const timeoutMs = opts.timeoutMs ?? 60000, runner = opts.runnerPath ?? join83(REPO_ROOT, "autonomy", "app-runner.sh");
+  const dir = join83(repoDir, ".loki", "app-runner"), checks = [];
   const t02 = Date.now();
   const mk3 = (name, result, reason) => ({ name, cmd: "autonomy/app-runner.sh", result, duration_s: (Date.now() - t02) / 1000, reason });
   const sh3 = (script) => {
@@ -65356,9 +65545,9 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
       return { checks, pid, url };
     }
     const ir2 = Number(m[1]), sr2 = Number(m[2]), hr = Number(m[3]), noApp = m[4] === "1";
-    const pidTxt = existsSync56(join82(dir, "app.pid")) ? readFileSync73(join82(dir, "app.pid"), "utf8").trim() : "";
+    const pidTxt = existsSync56(join83(dir, "app.pid")) ? readFileSync74(join83(dir, "app.pid"), "utf8").trim() : "";
     pid = /^\d+$/.test(pidTxt) && sr2 >= 0 ? Number(pidTxt) : null;
-    const st2 = readJson5(join82(dir, "state.json"));
+    const st2 = readJson5(join83(dir, "state.json"));
     url = typeof st2?.["url"] === "string" ? st2["url"] : null;
     if (sr2 < 0) {
       checks.push(noApp ? mk3("app boot", "n/a", "app-runner detected no app") : mk3("app boot", "not_run", ir2 === 0 ? "app-runner detected no app" : "no runnable app detected or runtime missing"), mk3("http probe", noApp ? "n/a" : "not_run", "app not booted"));
@@ -65369,7 +65558,7 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
       return { checks, pid, url };
     }
     checks.push(mk3("app boot", "pass", "app process started"));
-    const health = readJson5(join82(dir, "health.json"));
+    const health = readJson5(join83(dir, "health.json"));
     checks.push(hr === 0 && health?.["ok"] === true ? mk3("http probe", "pass", "health.json ok") : mk3("http probe", "fail", "app-runner health check failed"));
     if (opts.specText !== undefined && checks[1]?.result === "pass" && url)
       checks.push(await functionalVerify(opts, url, dir, lokiDir2, timeoutMs));
@@ -65382,10 +65571,10 @@ async function appProbe(repoDir, lokiDir2, opts = {}) {
 async function functionalVerify(opts, url, dir, lokiDir2, timeoutMs) {
   const t02 = Date.now();
   const res = (result, reason) => ({ name: "functional verify", cmd: "autonomy/lib/functional-verify.py", result, duration_s: (Date.now() - t02) / 1000, reason });
-  const py2 = await findPython3(), script = opts.verifyPath ?? join82(REPO_ROOT, "autonomy", "lib", "functional-verify.py");
+  const py2 = await findPython3(), script = opts.verifyPath ?? join83(REPO_ROOT, "autonomy", "lib", "functional-verify.py");
   if (!py2 || !existsSync56(script))
     return res("not_run", "python3 or functional-verify.py unavailable");
-  const specFile = join82(dir, "spec.txt");
+  const specFile = join83(dir, "spec.txt");
   writeFileSync38(specFile, opts.specText ?? "");
   const r = spawnSync9(py2, ["-I", script, specFile, url], { env: plainTestEnv(), encoding: "utf8", timeout: timeoutMs, killSignal: "SIGKILL", stdio: ["ignore", "pipe", "ignore"] });
   let out3 = null;
@@ -65397,11 +65586,11 @@ async function functionalVerify(opts, url, dir, lokiDir2, timeoutMs) {
   }
   if (!out3 || r.status !== 0)
     return res("not_run", "functional harness produced no result");
-  const q10 = join82(lokiDir2, "quality");
+  const q10 = join83(lokiDir2, "quality");
   mkdirSync40(q10, { recursive: true });
-  const tmp = join82(q10, `functional-results.json.tmp.${process.pid}`);
+  const tmp = join83(q10, `functional-results.json.tmp.${process.pid}`);
   writeFileSync38(tmp, JSON.stringify(out3, null, 2));
-  renameSync18(tmp, join82(q10, "functional-results.json"));
+  renameSync18(tmp, join83(q10, "functional-results.json"));
   const s = String(out3["functional_status"] ?? "inconclusive");
   return res(s === "verified" ? "pass" : s === "failed" ? "fail" : "not_run", `functional_status ${s}`);
 }
@@ -65433,15 +65622,15 @@ app_runner_stop >/dev/null 2>&1
 });
 
 // ../../loki-ts/src/util/secure_scan.ts
-import { copyFileSync as copyFileSync5, existsSync as existsSync57, lstatSync as lstatSync23, mkdirSync as mkdirSync41, mkdtempSync as mkdtempSync9, readFileSync as readFileSync74, realpathSync as realpathSync26, rmSync as rmSync21, statSync as statSync25, writeFileSync as writeFileSync39 } from "fs";
+import { copyFileSync as copyFileSync5, existsSync as existsSync57, lstatSync as lstatSync23, mkdirSync as mkdirSync41, mkdtempSync as mkdtempSync9, readFileSync as readFileSync75, realpathSync as realpathSync26, rmSync as rmSync21, statSync as statSync25, writeFileSync as writeFileSync39 } from "fs";
 import { randomBytes as randomBytes6 } from "crypto";
 import { tmpdir as tmpdir12 } from "os";
-import { basename as basename22, dirname as dirname33, join as join83, resolve as resolve28, sep as sep17 } from "path";
+import { basename as basename22, dirname as dirname34, join as join84, resolve as resolve28, sep as sep17 } from "path";
 function fail(error) {
   return { ok: false, findings: [], error };
 }
 async function runSecureScan(targetDir, opts = {}) {
-  const script = opts.scriptPath ?? join83(REPO_ROOT, "autonomy", "lib", "secure-scan.py");
+  const script = opts.scriptPath ?? join84(REPO_ROOT, "autonomy", "lib", "secure-scan.py");
   if (!existsSync57(script))
     return fail(`secure-scan script not found: ${script}`);
   const py2 = await findPython3();
@@ -65485,12 +65674,12 @@ async function runSecureScan(targetDir, opts = {}) {
   return fail(`secure-scan failed (exit ${res.exitCode}): ${tail2}`);
 }
 async function secureScanChanged(repoDir, changed, scriptPath) {
-  const dir = mkdtempSync9(join83(tmpdir12(), "loki-deep-secure-"));
+  const dir = mkdtempSync9(join84(tmpdir12(), "loki-deep-secure-"));
   try {
     for (const f of changed)
-      if (existsSync57(join83(repoDir, f)) && lstatSync23(join83(repoDir, f)).isFile()) {
-        mkdirSync41(dirname33(join83(dir, f)), { recursive: true });
-        copyFileSync5(join83(repoDir, f), join83(dir, f));
+      if (existsSync57(join84(repoDir, f)) && lstatSync23(join84(repoDir, f)).isFile()) {
+        mkdirSync41(dirname34(join84(dir, f)), { recursive: true });
+        copyFileSync5(join84(repoDir, f), join84(dir, f));
       }
     return await runSecureScan(dir, { ...scriptPath ? { scriptPath } : {}, timeoutMs: 60000 });
   } finally {
@@ -65624,7 +65813,7 @@ async function scanAddedLines(repoDir, opts = {}) {
   const skipped2 = [];
   for (const p of untracked2.split("\x00").filter(Boolean)) {
     try {
-      const st2 = statSync25(join83(repoDir, p));
+      const st2 = statSync25(join84(repoDir, p));
       if (!st2.isFile())
         continue;
       if (st2.size > MAX_ADDED_FILE_BYTES) {
@@ -65639,14 +65828,14 @@ async function scanAddedLines(repoDir, opts = {}) {
         continue;
       }
       const lines2 = new Map;
-      readFileSync74(join83(repoDir, p), "utf8").split(`
+      readFileSync75(join84(repoDir, p), "utf8").split(`
 `).forEach((t, i) => lines2.set(i + 1, t));
       added.set(p, lines2);
     } catch {}
   }
   if (added.size === 0)
     return { ok: true, findings: skipped2 };
-  const mirror = mkdtempSync9(join83(tmpdir12(), "loki-secure-added-"));
+  const mirror = mkdtempSync9(join84(tmpdir12(), "loki-secure-added-"));
   try {
     const root = resolve28(mirror) + sep17;
     const chunkMap = new Map;
@@ -65692,12 +65881,12 @@ async function scanAddedLines(repoDir, opts = {}) {
         chunks.push(cur);
       const whole = chunks.length === 1;
       for (const c of chunks) {
-        const rel = whole ? p : join83(chunkRoot, String(chunkSeq++), basename22(p));
+        const rel = whole ? p : join84(chunkRoot, String(chunkSeq++), basename22(p));
         const out3 = whole ? dest : resolve28(mirror, rel);
         if (!out3.startsWith(root))
           break;
         chunkMap.set(rel, { file: p, lines: c.orig });
-        mkdirSync41(dirname33(out3), { recursive: true });
+        mkdirSync41(dirname34(out3), { recursive: true });
         writeFileSync39(out3, c.body.join(`
 `) + `
 `);
@@ -65744,14 +65933,14 @@ var init_secure_scan = __esm(() => {
 });
 
 // ../../loki-ts/src/util/run_control.ts
-import { existsSync as existsSync58, readFileSync as readFileSync75, renameSync as renameSync19, writeFileSync as writeFileSync40 } from "fs";
-import { join as join84 } from "path";
+import { existsSync as existsSync58, readFileSync as readFileSync76, renameSync as renameSync19, writeFileSync as writeFileSync40 } from "fs";
+import { join as join85 } from "path";
 function readRunControl(runDir) {
-  const p = join84(runDir, RUN_CONTROL_FILE);
+  const p = join85(runDir, RUN_CONTROL_FILE);
   if (!existsSync58(p))
     return null;
   try {
-    const a = JSON.parse(readFileSync75(p, "utf8")).action;
+    const a = JSON.parse(readFileSync76(p, "utf8")).action;
     return typeof a === "string" && ACTIONS2.has(a) ? a : null;
   } catch {
     return null;
@@ -65809,8 +65998,8 @@ var init_run_control = __esm(() => {
 });
 
 // ../../loki-ts/src/project_model/conventions.ts
-import { existsSync as existsSync59, readdirSync as readdirSync27, readFileSync as readFileSync76 } from "fs";
-import { basename as basename23, dirname as dirname34, isAbsolute as isAbsolute15, join as join85, relative as relative16, resolve as resolve29 } from "path";
+import { existsSync as existsSync59, readdirSync as readdirSync27, readFileSync as readFileSync77 } from "fs";
+import { basename as basename23, dirname as dirname35, isAbsolute as isAbsolute15, join as join86, relative as relative16, resolve as resolve29 } from "path";
 function parseJsonc(text3) {
   let out3 = "", i = 0;
   while (i < text3.length) {
@@ -65845,7 +66034,7 @@ function moduleOf(file, depth = 0) {
   const ext = typeof j10.extends === "string" ? j10.extends : null;
   if (!ext || !ext.startsWith("."))
     return null;
-  const next = join85(dirname34(file), ext.endsWith(".json") ? ext : `${ext}.json`);
+  const next = join86(dirname35(file), ext.endsWith(".json") ? ext : `${ext}.json`);
   return existsSync59(next) ? moduleOf(next, depth + 1) : null;
 }
 function readPackageConventions(pkgDir, runner = null) {
@@ -65857,13 +66046,13 @@ function readPackageConventions(pkgDir, runner = null) {
   }
   let packageType = null, tsModule = null;
   for (const n10 of names) {
-    const j10 = readJson6(join85(pkgDir, n10));
+    const j10 = readJson6(join86(pkgDir, n10));
     if (!j10)
       continue;
     if (packageType === null && typeof j10.type === "string" && typeof j10.name === "string")
       packageType = j10.type;
     if (tsModule === null && j10.compilerOptions !== undefined)
-      tsModule = moduleOf(join85(pkgDir, n10));
+      tsModule = moduleOf(join86(pkgDir, n10));
   }
   if (packageType === null && tsModule === null)
     return null;
@@ -65969,13 +66158,13 @@ function vacuousCheck(fileName, content) {
 function nearestPackageRoot(testDir, repoDir, fileName) {
   const api = loadProjectApi(repoDir);
   if (api)
-    return siteFor(api, repoDir, relative16(repoDir, join85(testDir, fileName)))?.cwd ?? repoDir;
+    return siteFor(api, repoDir, relative16(repoDir, join86(testDir, fileName)))?.cwd ?? repoDir;
   const shaped = (d) => {
     try {
       return readdirSync27(d).some((f) => {
         if (!f.endsWith(".json"))
           return false;
-        const j10 = readJson6(join85(d, f));
+        const j10 = readJson6(join86(d, f));
         return !!j10 && typeof j10.name === "string" && Object.keys(j10).length > 1;
       });
     } catch {
@@ -65983,8 +66172,8 @@ function nearestPackageRoot(testDir, repoDir, fileName) {
     }
   };
   let pkg = testDir;
-  while (pkg !== repoDir && pkg !== dirname34(pkg) && !shaped(pkg))
-    pkg = dirname34(pkg);
+  while (pkg !== repoDir && pkg !== dirname35(pkg) && !shaped(pkg))
+    pkg = dirname35(pkg);
   return pkg;
 }
 function phantomRepoPaths(content, fileName, testDir, repoDir, planText) {
@@ -66036,7 +66225,7 @@ function phantomRepoPaths(content, fileName, testDir, repoDir, planText) {
   };
   const strayInTestDir = (out3) => {
     const first = relative16(testDir, out3).split("/")[0];
-    return !!first && first !== "__self__" && !existsSync59(join85(testDir, first)) && [pkg, repoDir].some((d) => d !== testDir && existsSync59(join85(d, first)));
+    return !!first && first !== "__self__" && !existsSync59(join86(testDir, first)) && [pkg, repoDir].some((d) => d !== testDir && existsSync59(join86(d, first)));
   };
   const scan = (cwd) => {
     const vars = new Map, walk = new Set, taint = new Set, reports = new Map, created = [];
@@ -66051,7 +66240,7 @@ function phantomRepoPaths(content, fileName, testDir, repoDir, planText) {
       if (env)
         return ev2(env[1], report);
       if (e10 === "fileURLToPath(import.meta.url)" || e10 === "__filename")
-        return join85(testDir, "__self__");
+        return join86(testDir, "__self__");
       const url = /^fileURLToPath\(new URL\((["'])([^"']*)\1\s*,\s*import\.meta\.url\)\)$/.exec(e10);
       if (url)
         return resolve29(testDir, url[2]);
@@ -66067,11 +66256,11 @@ function phantomRepoPaths(content, fileName, testDir, repoDir, planText) {
       if (args.some((a) => a === null))
         return null;
       if (call[1] === "dirname")
-        return dirname34(args[0]);
+        return dirname35(args[0]);
       const out3 = resolve29(...args);
-      const first = parts.slice(1).map((a) => /^\s*["'`]([^"'`]*)["'`]\s*$/.exec(a)?.[1]).find((x3) => x3), viaWalk = !!first && walk.has(parts[0].trim()) && [pkg, repoDir].some((d) => existsSync59(join85(d, first.split("/").filter(Boolean)[0] ?? "\x00")));
+      const first = parts.slice(1).map((a) => /^\s*["'`]([^"'`]*)["'`]\s*$/.exec(a)?.[1]).find((x3) => x3), viaWalk = !!first && walk.has(parts[0].trim()) && [pkg, repoDir].some((d) => existsSync59(join86(d, first.split("/").filter(Boolean)[0] ?? "\x00")));
       if (report && (viaWalk || !parts.some((a) => walk.has(a.trim()) || taint.has(a.trim())) && (relative16(testDir, out3).startsWith("..") || strayInTestDir(out3))) && parts.some((a) => /^\s*["'`]/.test(a)))
-        reports.set(`${ln2}|${e10}`, { out: out3, rel: relative16(repoDir, out3), tail: viaWalk ? join85(...args.slice(1)) : undefined });
+        reports.set(`${ln2}|${e10}`, { out: out3, rel: relative16(repoDir, out3), tail: viaWalk ? join86(...args.slice(1)) : undefined });
       return out3;
     };
     for (const line2 of walkCode.split(`
@@ -66119,7 +66308,7 @@ function phantomRepoPaths(content, fileName, testDir, repoDir, planText) {
   const runs2 = [...new Set([pkg, repoDir])].map(scan);
   const planned = (rel) => !!planText && rel.split("/").some((_, i, a) => {
     const pre2 = a.slice(0, i + 1).join("/");
-    return (i > 0 || a.length === 1) && !existsSync59(join85(repoDir, pre2)) && new RegExp(`(?<![\\w-])${pre2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![\\w-])`).test(planText);
+    return (i > 0 || a.length === 1) && !existsSync59(join86(repoDir, pre2)) && new RegExp(`(?<![\\w-])${pre2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![\\w-])`).test(planText);
   });
   const phantom = (r, created) => {
     const rel = r.rel;
@@ -66129,11 +66318,11 @@ function phantomRepoPaths(content, fileName, testDir, repoDir, planText) {
       const seen = (from) => {
         let d = from;
         for (let i = 0;i < 64; i++) {
-          if (existsSync59(join85(d, r.tail)))
+          if (existsSync59(join86(d, r.tail)))
             return true;
-          if (d === repoDir || d === dirname34(d))
+          if (d === repoDir || d === dirname35(d))
             return false;
-          d = dirname34(d);
+          d = dirname35(d);
         }
         return false;
       };
@@ -66171,7 +66360,7 @@ function phantomReason(miss, repoFiles, testDir = "", pkgRoot = "") {
 }
 var readJson6 = (p) => {
   try {
-    const v3 = parseJsonc(readFileSync76(p, "utf8"));
+    const v3 = parseJsonc(readFileSync77(p, "utf8"));
     return v3 && typeof v3 === "object" && !Array.isArray(v3) ? v3 : null;
   } catch {
     return null;
@@ -66180,8 +66369,8 @@ var readJson6 = (p) => {
 ${bad.map((b) => `- ${b.name}: ${b.why}`).join(`
 `)}`, `Point every reference at the repository code with repo-relative paths (for example join(import.meta.dir, "..", "<repo path>") or the equivalent for this runner). Do not read the home directory, $HOME or an environment variable that falls back to one. Write nothing else.`].join(`
 
-`), outOfRepoTests = (repoDir, changed) => changed.filter((f) => /(^|[\/._-])(test|spec)s?[\/._-]|_test\./i.test(f) && existsSync59(join85(repoDir, f))).flatMap((name) => {
-  const why = outOfRepoTarget(readFileSync76(join85(repoDir, name), "utf8"));
+`), outOfRepoTests = (repoDir, changed) => changed.filter((f) => /(^|[\/._-])(test|spec)s?[\/._-]|_test\./i.test(f) && existsSync59(join86(repoDir, f))).flatMap((name) => {
+  const why = outOfRepoTarget(readFileSync77(join86(repoDir, name), "utf8"));
   return why ? [{ name, why }] : [];
 }), CREATORS;
 var init_conventions = __esm(() => {
@@ -66191,16 +66380,16 @@ var init_conventions = __esm(() => {
 });
 
 // ../../loki-ts/src/util/pr_lessons.ts
-import { existsSync as existsSync60, mkdirSync as mkdirSync42, mkdtempSync as mkdtempSync10, readFileSync as readFileSync77, rmSync as rmSync22, writeFileSync as writeFileSync41 } from "fs";
+import { existsSync as existsSync60, mkdirSync as mkdirSync42, mkdtempSync as mkdtempSync10, readFileSync as readFileSync78, rmSync as rmSync22, writeFileSync as writeFileSync41 } from "fs";
 import { homedir as homedir10, tmpdir as tmpdir13 } from "os";
-import { dirname as dirname35, join as join86 } from "path";
+import { dirname as dirname36, join as join87 } from "path";
 import { createHash as createHash26 } from "crypto";
 function loadLessons(repoDir) {
   const p = lessonsPath(repoDir);
   if (!existsSync60(p))
     return [];
   try {
-    const j10 = JSON.parse(readFileSync77(p, "utf-8"));
+    const j10 = JSON.parse(readFileSync78(p, "utf-8"));
     return Array.isArray(j10.lessons) ? j10.lessons : [];
   } catch {
     return [];
@@ -66208,12 +66397,12 @@ function loadLessons(repoDir) {
 }
 function save3(repoDir, lessons) {
   const p = lessonsPath(repoDir);
-  mkdirSync42(dirname35(p), { recursive: true });
+  mkdirSync42(dirname36(p), { recursive: true });
   atomicWriteJson(p, { version: 2, lessons });
 }
 function loadPromoted() {
   try {
-    const j10 = JSON.parse(readFileSync77(promotedPath(), "utf-8"));
+    const j10 = JSON.parse(readFileSync78(promotedPath(), "utf-8"));
     return Array.isArray(j10.lessons) ? j10.lessons : [];
   } catch {
     return [];
@@ -66324,7 +66513,7 @@ ${body}
 function learningsBlock(repoDir, limit = 5) {
   let items2 = [];
   try {
-    const parsed = JSON.parse(readFileSync77(join86(repoDir, ".loki", "state", "relevant-learnings.json"), "utf-8"));
+    const parsed = JSON.parse(readFileSync78(join87(repoDir, ".loki", "state", "relevant-learnings.json"), "utf-8"));
     if (Array.isArray(parsed.learnings))
       items2 = parsed.learnings;
   } catch {
@@ -66354,7 +66543,7 @@ ${lines2.join(`
 </untrusted-learnings>
 `;
 }
-var lessonsPath = (repoDir) => join86(repoDir, ".loki", "memory", "semantic", "pr-lessons.json"), promotedPath = () => join86(process.env["LOKI_PROMOTED_DIR"] || join86(homedir10(), ".loki"), "memory", "semantic", "promoted-lessons.json"), DEMOTE_AFTER = 3, demoteOn = () => process.env["LOKI_PR_LESSON_DEMOTE"] !== "0", HEX642, KINDS, VERDICT_BASE, words = (s) => new Set(s.toLowerCase().match(/[a-z0-9_]{4,}/g) ?? []), fence = (s) => s.replace(/[<>]/g, "");
+var lessonsPath = (repoDir) => join87(repoDir, ".loki", "memory", "semantic", "pr-lessons.json"), promotedPath = () => join87(process.env["LOKI_PROMOTED_DIR"] || join87(homedir10(), ".loki"), "memory", "semantic", "promoted-lessons.json"), DEMOTE_AFTER = 3, demoteOn = () => process.env["LOKI_PR_LESSON_DEMOTE"] !== "0", HEX642, KINDS, VERDICT_BASE, words = (s) => new Set(s.toLowerCase().match(/[a-z0-9_]{4,}/g) ?? []), fence = (s) => s.replace(/[<>]/g, "");
 var init_pr_lessons = __esm(() => {
   init_redact();
   init_atomic();
@@ -66374,7 +66563,7 @@ import {
   lstatSync as lstatSync24,
   mkdirSync as mkdirSync43,
   openSync as openSync13,
-  readFileSync as readFileSync78,
+  readFileSync as readFileSync79,
   readlinkSync as readlinkSync5,
   realpathSync as realpathSync27,
   rmSync as rmSync23,
@@ -66382,7 +66571,7 @@ import {
   unlinkSync as unlinkSync8,
   writeFileSync as writeFileSync42
 } from "fs";
-import { dirname as dirname36, isAbsolute as isAbsolute16, join as join87, relative as relative17, resolve as resolve30, sep as sep18 } from "path";
+import { dirname as dirname37, isAbsolute as isAbsolute16, join as join88, relative as relative17, resolve as resolve30, sep as sep18 } from "path";
 function git8(root, args) {
   return safeGit(root, args);
 }
@@ -66422,7 +66611,7 @@ function safeJoin(root, relPath) {
     const segment = segments[i];
     if (segment === undefined)
       continue;
-    cur = join87(cur, segment);
+    cur = join88(cur, segment);
     if (i < segments.length - 1) {
       let st2;
       try {
@@ -66439,7 +66628,7 @@ function safeJoin(root, relPath) {
 function assertSymlinkWithinRoot(root, relPath, target) {
   if (isAbsolute16(target))
     throw new TreeSwapUnsafePathError(`symlink ${relPath} has an absolute target`);
-  const resolvedTarget = resolve30(dirname36(join87(resolve30(root), relPath)), target);
+  const resolvedTarget = resolve30(dirname37(join88(resolve30(root), relPath)), target);
   const rel = relative17(resolve30(root), resolvedTarget);
   if (rel === ".." || rel.startsWith(`..${"/"}`) || isAbsolute16(rel)) {
     throw new TreeSwapUnsafePathError(`symlink ${relPath} escapes tree root`);
@@ -66458,7 +66647,7 @@ function readEntry(root, relPath) {
   }
   const fd2 = openSync13(abs, fsc.O_RDONLY | fsc.O_NOFOLLOW);
   try {
-    return { content: readFileSync78(fd2), mode: st2.mode & 511 };
+    return { content: readFileSync79(fd2), mode: st2.mode & 511 };
   } finally {
     closeSync13(fd2);
   }
@@ -66477,7 +66666,7 @@ function writeEntry(root, relPath, entry2) {
     assertSymlinkWithinRoot(root, relPath, entry2.symlinkTarget);
   }
   const abs = safeJoin(root, relPath);
-  mkdirSync43(dirname36(abs), { recursive: true });
+  mkdirSync43(dirname37(abs), { recursive: true });
   removeEntry(root, relPath);
   if (entry2.symlinkTarget !== undefined) {
     symlinkSync4(entry2.symlinkTarget, abs);
@@ -66600,7 +66789,7 @@ function swapLocked(opts, excludes) {
     pre2.push({ path, kind: "file", content: e10.content, mode: e10.mode, symlinkTarget: e10.symlinkTarget });
   }
   mkdirSync43(opts.runDir, { recursive: true });
-  const undoPath = join87(opts.runDir, UNDO_FILE);
+  const undoPath = join88(opts.runDir, UNDO_FILE);
   const enc = (l) => l.map((e10) => ({ ...e10, content: e10.content?.toString("base64") }));
   let fd2;
   try {
@@ -66640,7 +66829,7 @@ function removeLenient(root, relPath) {
   }
 }
 function restoreFromUndo(primaryRoot, runDir, excludes = DEFAULT_EXCLUDES) {
-  const rec2 = JSON.parse(readFileSync78(join87(runDir, UNDO_FILE), "utf8"));
+  const rec2 = JSON.parse(readFileSync79(join88(runDir, UNDO_FILE), "utf8"));
   const dec = (l) => l.map((e10) => ({ ...e10, content: e10.content === undefined ? undefined : Buffer.from(e10.content, "base64") }));
   const entries = dec(rec2.entries);
   const errors2 = [];
@@ -66660,7 +66849,7 @@ function restoreFromUndo(primaryRoot, runDir, excludes = DEFAULT_EXCLUDES) {
     throw new AggregateError(errors2, "treeswap: rollback incomplete");
 }
 function cleanupAttempt(primaryRoot, runDir, attemptDir) {
-  const attemptsRoot = join87(realpathSync27(resolve30(runDir)), "attempts");
+  const attemptsRoot = join88(realpathSync27(resolve30(runDir)), "attempts");
   let attemptsLst;
   try {
     attemptsLst = lstatSync24(attemptsRoot);
@@ -66677,17 +66866,17 @@ function cleanupAttempt(primaryRoot, runDir, attemptDir) {
   if (isPrimaryOrAncestor(realpathSync27(attemptsRoot)))
     throw new TreeSwapUnsafePathError(`attempts dir ${attemptsRoot} resolves to the primary tree`);
   const lexical = resolve30(attemptDir);
-  const parent = dirname36(lexical);
+  const parent = dirname37(lexical);
   let real3;
   try {
-    real3 = join87(realpathSync27(parent), lexical.slice(parent.length + 1));
+    real3 = join88(realpathSync27(parent), lexical.slice(parent.length + 1));
     lstatSync24(real3);
   } catch (err) {
     if (err.code === "ENOENT")
       return;
     throw err;
   }
-  if (dirname36(real3) !== attemptsRoot)
+  if (dirname37(real3) !== attemptsRoot)
     throw new TreeSwapUnsafePathError(`${attemptDir} is not a direct child of ${attemptsRoot}`);
   if (isPrimaryOrAncestor(real3))
     throw new TreeSwapUnsafePathError(`${attemptDir} is or contains the primary tree`);
@@ -66698,7 +66887,7 @@ function cleanupAttempt(primaryRoot, runDir, attemptDir) {
     throw new TreeSwapUnsafePathError(`${attemptDir} is not a directory`);
   if (process.getuid && lst.uid !== process.getuid())
     throw new TreeSwapUnsafePathError(`refusing to remove ${attemptDir}: not owned by the current user`);
-  const gitFile = join87(real3, ".git");
+  const gitFile = join88(real3, ".git");
   let isLinkedWorktree = false;
   try {
     isLinkedWorktree = lstatSync24(gitFile).isFile();
@@ -66725,8 +66914,8 @@ var init_treeswap = __esm(() => {
 });
 
 // ../../loki-ts/src/features/attempts.ts
-import { existsSync as existsSync61, mkdirSync as mkdirSync44, readFileSync as readFileSync79 } from "fs";
-import { join as join88 } from "path";
+import { existsSync as existsSync61, mkdirSync as mkdirSync44, readFileSync as readFileSync80 } from "fs";
+import { join as join89 } from "path";
 function assertScrubbedEnv(env) {
   for (const v3 of GITHUB_TOKEN_VARS) {
     const val = env[v3] ?? "";
@@ -66777,19 +66966,19 @@ async function runTwoAttempts(ops, S, wall, signal, env = process.env) {
   }
 }
 function treeswapOps(a) {
-  const attemptsDir = join88(a.runDir, "attempts"), bDir = join88(attemptsDir, "B");
+  const attemptsDir = join89(a.runDir, "attempts"), bDir = join89(attemptsDir, "B");
   mkdirSync44(attemptsDir, { recursive: true });
   safeGit(a.primary, ["worktree", "add", "--detach", bDir, a.base]);
   const pre2 = new Set(untracked2(a.primary));
   let snapA = null;
   const wallWeakened = (root, isPrimary, p, touched) => {
-    const sealed = a.wallContent?.get(p), f = join88(root, p);
+    const sealed = a.wallContent?.get(p), f = join89(root, p);
     if (!existsSync61(f))
       return isPrimary ? sealed !== undefined || touched.has(p) : false;
     if (sealed === undefined)
       return touched.has(p);
     try {
-      return readFileSync79(f, "utf8") !== sealed;
+      return readFileSync80(f, "utf8") !== sealed;
     } catch {
       return true;
     }
@@ -66867,8 +67056,8 @@ var init_attempts = __esm(() => {
 });
 
 // ../../loki-ts/src/runner/router/route_record.ts
-import { existsSync as existsSync62, lstatSync as lstatSync25, mkdirSync as mkdirSync45, readFileSync as readFileSync80, writeFileSync as writeFileSync43 } from "fs";
-import { join as join89 } from "path";
+import { existsSync as existsSync62, lstatSync as lstatSync25, mkdirSync as mkdirSync45, readFileSync as readFileSync81, writeFileSync as writeFileSync43 } from "fs";
+import { join as join90 } from "path";
 function buildRouteRecord(i) {
   const notProven = [...i.notProven, ...i.planModelNote ? [`plan model: NOT PROVEN (owner provider): ${i.planModelNote}`] : []];
   const base = { plan_model: i.planModel, shape_key: i.shapeKey, route_not_proven: notProven, applied: PER_UNIT_EXECUTORS_APPLIED };
@@ -66889,16 +67078,16 @@ function buildRouteRecord(i) {
 function writeRouteRecord(runDir, record) {
   try {
     mkdirSync45(runDir, { recursive: true });
-    writeFileSync43(join89(runDir, ROUTE_RECORD_FILE), `${JSON.stringify(record, null, 2)}
+    writeFileSync43(join90(runDir, ROUTE_RECORD_FILE), `${JSON.stringify(record, null, 2)}
 `);
   } catch {}
 }
 function loadRouteRecord(runDir) {
   try {
-    const p = join89(runDir, ROUTE_RECORD_FILE);
+    const p = join90(runDir, ROUTE_RECORD_FILE);
     if (!existsSync62(p) || !lstatSync25(p).isFile())
       return;
-    const v3 = JSON.parse(readFileSync80(p, "utf8"));
+    const v3 = JSON.parse(readFileSync81(p, "utf8"));
     return typeof v3 === "object" && v3 !== null && !Array.isArray(v3) ? v3 : undefined;
   } catch {
     return;
@@ -66973,10 +67162,10 @@ __export(exports_plan, {
   planStage: () => planStage,
   buildPlanBrief: () => buildPlanBrief
 });
-import { existsSync as existsSync63, mkdirSync as mkdirSync46, readFileSync as readFileSync81, writeFileSync as writeFileSync44 } from "fs";
-import { join as join90 } from "path";
+import { existsSync as existsSync63, mkdirSync as mkdirSync46, readFileSync as readFileSync82, writeFileSync as writeFileSync44 } from "fs";
+import { join as join91 } from "path";
 function planOutputPath(runDir) {
-  return join90(runDir, PLAN_OUTPUT_FILENAME);
+  return join91(runDir, PLAN_OUTPUT_FILENAME);
 }
 function truncatePlan(raw2, max = MAX_PLAN_LINES) {
   const lines2 = raw2.split(`
@@ -67046,7 +67235,7 @@ var init_plan = __esm(() => {
       const cardOn = intentCardEnabled(process.env);
       const runPlan = (onSonnet) => ctx.sessions.run({
         stage: "plan",
-        brief: buildPlanBrief(task, relevantFiles, outputPath, join90(ctx.runDir, PLAN_SCOPE_FILE), pr2.routed, cardOn, mutationStrict(), reviewerBriefEnabled()),
+        brief: buildPlanBrief(task, relevantFiles, outputPath, join91(ctx.runDir, PLAN_SCOPE_FILE), pr2.routed, cardOn, mutationStrict(), reviewerBriefEnabled()),
         tier: "fast",
         iterationId,
         limitS: planStage.limitS,
@@ -67065,11 +67254,11 @@ var init_plan = __esm(() => {
       if (!session.killed && session.exit !== 0) {
         pr2.record({ planModel, planModelNote, skipReason: `plan session failed (exit ${session.exit})` });
         mkdirSync46(ctx.runDir, { recursive: true });
-        const stderrPath = join90(ctx.runDir, `${iterationId}.stderr.log`);
+        const stderrPath = join91(ctx.runDir, `${iterationId}.stderr.log`);
         writeFileSync44(stderrPath, session.stderrTail ?? "", "utf8");
         return { status: "failed", reason: classifyExitCause(session.exit, false), data: { iteration_ids: [iterationId], duration_s: session.durationS, stderr_path: stderrPath } };
       }
-      const rawPlan = existsSync63(outputPath) ? readFileSync81(outputPath, "utf8") : "";
+      const rawPlan = existsSync63(outputPath) ? readFileSync82(outputPath, "utf8") : "";
       const ic2 = await applyIntent(rawPlan, cardOn, ctx.runDir, (d) => ctx.emit("variant", "plan", d));
       const plan = truncatePlan(ic2.rest);
       const route_record = pr2.record({ planModel, planModelNote }), oor = planOutOfRepo(ctx.runDir);
@@ -67094,9 +67283,9 @@ var init_plan = __esm(() => {
 
 // ../../loki-ts/src/util/conflict_resume.ts
 import { createHash as createHash27 } from "crypto";
-import { existsSync as existsSync64, mkdtempSync as mkdtempSync11, readFileSync as readFileSync82, rmSync as rmSync24, writeFileSync as writeFileSync45 } from "fs";
+import { existsSync as existsSync64, mkdtempSync as mkdtempSync11, readFileSync as readFileSync83, rmSync as rmSync24, writeFileSync as writeFileSync45 } from "fs";
 import { tmpdir as tmpdir14 } from "os";
-import { basename as basename24, join as join91, relative as relative18 } from "path";
+import { basename as basename24, join as join92, relative as relative18 } from "path";
 async function resumeAfterConflict(ctx, first, firstSession) {
   if ((ctx.implementLeftS?.() ?? Infinity) < RESUME_MIN_LEFT_S)
     return { session: firstSession, iterationId: first.iterationId };
@@ -67120,9 +67309,9 @@ async function adjudicateWallConflict(ctx, first, firstSession, wall) {
   const reason = firstSession.markers.specConflict, rels = wall.map((f10) => relative18(ctx.repoDir, f10.path)), a = reason ? wallAnchor(reason, rels) : null;
   if (!reason || !a)
     return null;
-  const f = wall[rels.indexOf(a.file)], ids = [], o = ctx.outputs(), cwd = mkdtempSync11(join91(tmpdir14(), "loki-e15-wall-")), name = basename24(f.path);
+  const f = wall[rels.indexOf(a.file)], ids = [], o = ctx.outputs(), cwd = mkdtempSync11(join92(tmpdir14(), "loki-e15-wall-")), name = basename24(f.path);
   try {
-    writeFileSync45(join91(cwd, name), f.content, "utf8");
+    writeFileSync45(join92(cwd, name), f.content, "utf8");
     const id2 = `${first.iterationId}-wa`;
     ids.push(id2);
     const au2 = await ctx.sessions.run({
@@ -67142,7 +67331,7 @@ async function adjudicateWallConflict(ctx, first, firstSession, wall) {
 
 `)
     });
-    const next = !au2.killed && au2.exit === 0 && existsSync64(join91(cwd, name)) ? readFileSync82(join91(cwd, name), "utf8") : "";
+    const next = !au2.killed && au2.exit === 0 && existsSync64(join92(cwd, name)) ? readFileSync83(join92(cwd, name), "utf8") : "";
     const rewritten = next.trim() !== "" && next !== f.content;
     if (rewritten) {
       f.content = next;
@@ -67237,8 +67426,8 @@ __export(exports_implement, {
   briefCtx: () => briefCtx,
   applyExternalPatch: () => applyExternalPatch
 });
-import { existsSync as existsSync65, mkdirSync as mkdirSync47, readFileSync as readFileSync83, rmSync as rmSync25, writeFileSync as writeFileSync46 } from "fs";
-import { join as join92, relative as relative19 } from "path";
+import { existsSync as existsSync65, mkdirSync as mkdirSync47, readFileSync as readFileSync84, rmSync as rmSync25, writeFileSync as writeFileSync46 } from "fs";
+import { join as join93, relative as relative19 } from "path";
 function impactedTests(ctx) {
   const o = ctx.outputs();
   const map = o.intake?.testmap;
@@ -67266,7 +67455,7 @@ ${plan}` : "No separate plan was made: plan the change yourself in this session,
 function restoreReadOnly(files) {
   const reverted = [];
   for (const f of files) {
-    const current = existsSync65(f.path) ? readFileSync83(f.path, "utf8") : null;
+    const current = existsSync65(f.path) ? readFileSync84(f.path, "utf8") : null;
     if (current !== f.content) {
       writeFileSync46(f.path, f.content, "utf8");
       reverted.push(f.path);
@@ -67285,7 +67474,7 @@ function specFor(ctx) {
   if (!process.env.LOKI_E10_SPEC_SHA256)
     return null;
   try {
-    return loadSpecFile(join92(ctx.runDir, "spec.snapshot.md"));
+    return loadSpecFile(join93(ctx.runDir, "spec.snapshot.md"));
   } catch {
     return null;
   }
@@ -67298,7 +67487,7 @@ function applyExternalPatch(ctx, patchPath) {
 `)[0]}` };
   }
   const testsReverted = restoreReadOnly(ctx.outputs().wall?.readOnlyFiles ?? []);
-  return { status: "completed", data: { exit: "external", external: true, patch_sha256: sha2562(readFileSync83(patchPath, "utf8")), tests_reverted: testsReverted, impacted_tests: impactedTests(ctx), iteration_ids: [] } };
+  return { status: "completed", data: { exit: "external", external: true, patch_sha256: sha2562(readFileSync84(patchPath, "utf8")), tests_reverted: testsReverted, impacted_tests: impactedTests(ctx), iteration_ids: [] } };
 }
 var briefCtx = (ctx) => briefContext(ctx, { select: selectRelevantFiles, cmd: (t, repoDir) => {
   const c = commandFor(t, repoDir, loadProjectApi(repoDir));
@@ -67330,7 +67519,7 @@ var init_implement = __esm(() => {
     targetS: 180,
     limitS: 480,
     async run(ctx, signal) {
-      rmSync25(join92(ctx.repoDir, ".loki", "supply-declared.json"), { force: true });
+      rmSync25(join93(ctx.repoDir, ".loki", "supply-declared.json"), { force: true });
       if (ctx.externalPatch)
         return applyExternalPatch(ctx, ctx.externalPatch);
       const prior = ctx.outputs();
@@ -67459,7 +67648,7 @@ var init_implement = __esm(() => {
         return { status: "completed", data };
       const stderrTail = session.stderrTail ?? "";
       mkdirSync47(ctx.runDir, { recursive: true });
-      const stderrPath = join92(ctx.runDir, `${iterationId}.stderr.log`);
+      const stderrPath = join93(ctx.runDir, `${iterationId}.stderr.log`);
       writeFileSync46(stderrPath, stderrTail, "utf8");
       data.stderr_path = stderrPath;
       return { status: "failed", reason: classifyExitCause(session.exit, false), data };
@@ -67470,17 +67659,17 @@ var init_implement = __esm(() => {
 
 // ../../loki-ts/src/engine10/machine.ts
 import { existsSync as existsSync66, mkdirSync as mkdirSync48, rmSync as rmSync26, writeFileSync as writeFileSync47 } from "fs";
-import { isAbsolute as isAbsolute17, join as join93, relative as relative20 } from "path";
+import { isAbsolute as isAbsolute17, join as join94, relative as relative20 } from "path";
 async function optional(path) {
-  const abs = isAbsolute17(path) ? path : join93(import.meta.dir, path);
+  const abs = isAbsolute17(path) ? path : join94(import.meta.dir, path);
   if (!existsSync66(abs))
     return null;
   return await import(abs);
 }
 function defaultLoader(dir) {
   return async (name) => {
-    const reg = dir === join93(import.meta.dir, "stages") ? REGISTRY[`./stages/${name}.ts`] : undefined;
-    const mod = reg ? await reg() : await optional(join93(dir, `${name}.ts`));
+    const reg = dir === join94(import.meta.dir, "stages") ? REGISTRY[`./stages/${name}.ts`] : undefined;
+    const mod = reg ? await reg() : await optional(join94(dir, `${name}.ts`));
     return mod ? mod.stage ?? mod.default ?? null : null;
   };
 }
@@ -67489,7 +67678,7 @@ function softCapS(capS) {
   return Math.max(0, Math.min(plain2, budget));
 }
 async function runMachine(ctx, opts = {}) {
-  const load = opts.load ?? defaultLoader(opts.stagesDir ?? join93(import.meta.dir, "stages"));
+  const load = opts.load ?? defaultLoader(opts.stagesDir ?? join94(import.meta.dir, "stages"));
   const outputs = {};
   let capHit = false, fatal = null;
   if (opts.restored)
@@ -67705,9 +67894,9 @@ ${timeBudgetNote(limitS)}`;
         else
           try {
             const w = a;
-            mkdirSync48(join93(base, relative20(ctx.repoDir, w.targetDir)), { recursive: true });
+            mkdirSync48(join94(base, relative20(ctx.repoDir, w.targetDir)), { recursive: true });
             for (const [n10, c] of w.contents)
-              writeFileSync47(join93(base, relative20(ctx.repoDir, w.targetDir), n10), c, "utf8");
+              writeFileSync47(join94(base, relative20(ctx.repoDir, w.targetDir), n10), c, "utf8");
             r = j10.split.install(sctx, a, base);
             const changed = hooks.wall.changedSinceBase(ctx.repoDir, ctx.baseSha);
             if (r.status === "completed") {
@@ -68014,8 +68203,8 @@ __export(exports_worker, {
   main: () => main2,
   assertWorkerEnv: () => assertWorkerEnv
 });
-import { readFileSync as readFileSync84 } from "fs";
-import { join as join94 } from "path";
+import { readFileSync as readFileSync85 } from "fs";
+import { join as join95 } from "path";
 function assertWorkerEnv(env = process.env) {
   if (env.LOKI_ALLOW_AGENT_GITHUB_TOKEN === "1")
     return;
@@ -68045,7 +68234,7 @@ async function main2(args) {
     return 2;
   }
   const repoDir = process.cwd();
-  const lokiRoot = join94(repoDir, ".loki");
+  const lokiRoot = join95(repoDir, ".loki");
   const deep = mode === "deep";
   globalThis[Symbol.for("loki.ownsStopSignals")] = true;
   for (const sig of ["SIGTERM", "SIGINT"])
@@ -68073,7 +68262,7 @@ async function main2(args) {
       externalPatch,
       runId,
       repoDir,
-      runDir: join94(lokiRoot, "runs", runId),
+      runDir: join95(lokiRoot, "runs", runId),
       branch: `loki/${runId}`,
       provider,
       model,
@@ -68087,7 +68276,7 @@ async function main2(args) {
       tests: new RealTestMapProvider,
       cost: {
         read(dir, ids) {
-          const c = sumResultCosts(join94(dir, ".loki"), liveArchivedCosts(join94(dir, ".loki"), ids, UNMETERED));
+          const c = sumResultCosts(join95(dir, ".loki"), liveArchivedCosts(join95(dir, ".loki"), ids, UNMETERED));
           return costTotalsOf(c);
         }
       },
@@ -68097,7 +68286,7 @@ async function main2(args) {
     const resize = deep ? undefined : () => resizeCap(ctx.runDir, loadProjectApi(repoDir), !(Number(parseCapUsd(process.env.LOKI_E10_MAX_COST_USD)) > 0), Number(process.env.LOKI_E10_CAP_FIXED_S) || undefined);
     let flow = FLOW.filter((s) => s !== "pr"), restored;
     if (process.env.LOKI_E10_RESUME === "1") {
-      const p = join94(repoDir, eventsRelPath(runId)), r = (await Promise.resolve().then(() => (init_run_outputs(), exports_run_outputs))).resumeMachineOpts(ctx, readEvents(p), readFileSync84(p, "utf8"), flow);
+      const p = join95(repoDir, eventsRelPath(runId)), r = (await Promise.resolve().then(() => (init_run_outputs(), exports_run_outputs))).resumeMachineOpts(ctx, readEvents(p), readFileSync85(p, "utf8"), flow);
       if (!r.ok) {
         emit("escalated", null, { stop: `resume refused: ${r.reason}` });
         return;
@@ -68145,12 +68334,12 @@ __export(exports_deep, {
 });
 import { existsSync as existsSync67, mkdirSync as mkdirSync49, mkdtempSync as mkdtempSync12, rmSync as rmSync27, writeFileSync as writeFileSync48 } from "fs";
 import { tmpdir as tmpdir15 } from "os";
-import { join as join95 } from "path";
+import { join as join96 } from "path";
 function sessionCouncil(sessions) {
   return { async run(input, signal) {
-    const cwd = mkdtempSync12(join95(tmpdir15(), "loki-deep-council-"));
+    const cwd = mkdtempSync12(join96(tmpdir15(), "loki-deep-council-"));
     try {
-      writeFileSync48(join95(cwd, "diff.patch"), input.diff, "utf8");
+      writeFileSync48(join96(cwd, "diff.patch"), input.diff, "utf8");
       const r = await sessions.run({
         stage: "deep",
         tier: "development",
@@ -68220,7 +68409,7 @@ ${r.stderr}`), lr2 = r.exitCode === 0 ? undefined : await harnessLoadReason({ re
 async function runAppBoot(ctx, opts, checks, notProven) {
   let r;
   try {
-    r = await (opts.appProbe ?? appProbe)(ctx.repoDir, join95(ctx.repoDir, ".loki"));
+    r = await (opts.appProbe ?? appProbe)(ctx.repoDir, join96(ctx.repoDir, ".loki"));
   } catch (err) {
     r = { checks: [{ name: "app boot", cmd: "autonomy/app-runner.sh", result: "not_run", duration_s: 0, reason: `app probe threw: ${err.message}` }], pid: null, url: null };
   }
@@ -68278,7 +68467,7 @@ async function runSecretScan(ctx, changed, opts, checks, notProven) {
   }
   const inline = 'script="$1"; shift; . "$script" || exit 3; hit=0; for f in "$@"; do if _commit_scan_secret_file "$f" || _commit_path_looks_secret "$f"; then printf "%s\\n" "$f"; hit=1; fi; done; exit "$hit"';
   const started = Date.now();
-  const r = await run(["bash", "-c", inline, "_", scriptPath, ...changed.map((f) => join95(ctx.repoDir, f))], { cwd: ctx.repoDir, timeoutMs: 30000 });
+  const r = await run(["bash", "-c", inline, "_", scriptPath, ...changed.map((f) => join96(ctx.repoDir, f))], { cwd: ctx.repoDir, timeoutMs: 30000 });
   const sec = await secureScanChanged(ctx.repoDir, changed, opts.secureScanPath), gaps = [], reasons = [];
   const hits = r.exitCode === 3 ? [] : r.stdout.split(`
 `).map((l) => l.trim()).filter(Boolean), high = sec.findings.filter((f) => String(f.severity).toUpperCase() === "HIGH");
@@ -68331,7 +68520,7 @@ async function runDeep(ctx, signal, opts = {}) {
   const sig = signReceipt(`${ctx.runId}-deep`, addendumSha256);
   const addendum = { ...addendumBody, addendum_sha256: addendumSha256, verification: { jwt: sig.jwt, kid: sig.kid } };
   mkdirSync49(ctx.runDir, { recursive: true });
-  writeFileSync48(join95(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
+  writeFileSync48(join96(ctx.runDir, "receipt-addendum-1.json"), JSON.stringify(addendum, null, 2) + `
 `);
   const headSha = (await safeGitRun(ctx.repoDir, ["rev-parse", "HEAD"], { timeoutMs: 1e4 })).stdout.trim();
   const pushNotProven = await postDeepResults({
@@ -68357,11 +68546,11 @@ async function deepWorker(args, deps = {}) {
 `);
     return 2;
   }
-  const repoDir = process.cwd(), lokiRoot = join95(repoDir, ".loki"), runDir = join95(lokiRoot, "runs", runId);
+  const repoDir = process.cwd(), lokiRoot = join96(repoDir, ".loki"), runDir = join96(lokiRoot, "runs", runId);
   const { readEvents: readEvents2 } = await Promise.resolve().then(() => (init_events(), exports_events)), { eventsRelPath: eventsRelPath2 } = await Promise.resolve().then(() => (init_engine_origin(), exports_engine_origin)), { outputsFromEvents: outputsFromEvents2 } = await Promise.resolve().then(() => (init_run_outputs(), exports_run_outputs));
   let outputs;
   try {
-    outputs = outputsFromEvents2(readEvents2(join95(repoDir, eventsRelPath2(runId))));
+    outputs = outputsFromEvents2(readEvents2(join96(repoDir, eventsRelPath2(runId))));
   } catch (err) {
     process.stderr.write(`engine10 deep-worker: cannot read run events: ${err.message}
 `);
@@ -68451,9 +68640,9 @@ __export(exports_verify, {
   commandFor: () => commandFor,
   changedFiles: () => changedFiles
 });
-import { existsSync as existsSync68, mkdtempSync as mkdtempSync13, readFileSync as readFileSync85, rmSync as rmSync28 } from "fs";
+import { existsSync as existsSync68, mkdtempSync as mkdtempSync13, readFileSync as readFileSync86, rmSync as rmSync28 } from "fs";
 import { tmpdir as tmpdir16 } from "os";
-import { basename as basename25, isAbsolute as isAbsolute18, join as join96, relative as relative21 } from "path";
+import { basename as basename25, isAbsolute as isAbsolute18, join as join97, relative as relative21 } from "path";
 async function runOnce3(cmd, args, cwd, signal, opts) {
   if (!Bun.which(cmd, { PATH: opts.path ?? process.env["PATH"] ?? "" }))
     return { ok: false, missing: true, cut: false, out: "" };
@@ -68535,7 +68724,7 @@ async function probeZeroChecks(repoDir, tests, signal, budgetS = 120, cap = 300)
   rmNewUntracked(repoDir, before);
   return { measured: measured.sort(), zero: zero.sort() };
 }
-async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal, zeroOk = true, zeroIntake = new Set) {
+async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal, zeroOk = true, zeroIntake = new Set, dep = new Set) {
   const out3 = { ids: [], names: [], weak: [], zero: [], cnt: {} };
   const pairs = checks.flatMap((c) => {
     const t = tests.find((x3) => testCheckName(x3) === c.name);
@@ -68546,7 +68735,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal,
   const zc2 = zeroOk ? un2.filter(({ c, t }) => c.result === "not_run" && !c.owner && (c.reason ?? "").startsWith(NO_TESTS_REASON) && !wall.has(c.name) && !isHoldoutCheck(c.name) && !changed.includes(t.path) && zeroIntake.has(c.name)) : [];
   if (!(un2.some(({ c }) => c.result === "fail" && c.ids?.length) || sus.length || zc2.length) || signal.aborted)
     return out3;
-  const dir = mkdtempSync13(join96(tmpdir16(), "e10-base-"));
+  const dir = mkdtempSync13(join97(tmpdir16(), "e10-base-"));
   const git9 = (args) => {
     safeGit(ctx.repoDir, args, { stdio: "ignore", repoDrivers: true });
   };
@@ -68565,9 +68754,9 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal,
       out3.cnt[c.name] = { b: { run: base.get(c).n, skipped: base.get(c).sk }, h: { run: c.n ?? 0, skipped: c.sk ?? 0 } };
     }
     const progress = checks.some((c) => wall.has(c.name) && c.result === "pass") || sus.some(({ c }) => !out3.weak.includes(c.name) && base.get(c).red.length > 0 && (c.n ?? 0) >= base.get(c).n);
-    if (progress) {
+    {
       for (const { c } of un2) {
-        if (!rel.has(c.name) && c.result === "fail" && c.ids?.length && c.ids.every((i) => base.get(c).red.includes(i))) {
+        if ((progress || dep.has(c.name)) && !rel.has(c.name) && c.result === "fail" && c.ids?.length && c.ids.every((i) => base.get(c).red.includes(i))) {
           out3.names.push(c.name);
           out3.ids.push(...c.ids);
         }
@@ -68585,15 +68774,15 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal,
   return out3;
 }
 function isLokiModeRepo(repoDir) {
-  return existsSync68(join96(repoDir, "scripts", "select-tests.sh"));
+  return existsSync68(join97(repoDir, "scripts", "select-tests.sh"));
 }
 function projectDeclaresRuff(repoDir) {
-  if (["ruff.toml", ".ruff.toml"].some((f) => existsSync68(join96(repoDir, f))))
+  if (["ruff.toml", ".ruff.toml"].some((f) => existsSync68(join97(repoDir, f))))
     return true;
   const files = ["pyproject.toml", "setup.cfg", "tox.ini", ".pre-commit-config.yaml", "Pipfile", "requirements.txt", "requirements-dev.txt", "dev-requirements.txt"];
   return files.some((f) => {
     try {
-      return /\bruff\b/i.test(readFileSync85(join96(repoDir, f), "utf8"));
+      return /\bruff\b/i.test(readFileSync86(join97(repoDir, f), "utf8"));
     } catch {
       return false;
     }
@@ -68619,9 +68808,9 @@ async function runLintChecks(ctx, changed, signal, checks, opts = {}) {
   }
   for (const g of groupByPackage(api, ctx.repoDir, changed.filter((f) => /\.(ts|tsx|js|jsx)$/.test(f)))) {
     const sfx = g.root === "." ? "" : `:${g.root}`, co = g.root === "." ? opts : { ...opts, cwd: g.cwd };
-    if (existsSync68(join96(g.cwd, "tsconfig.json")))
+    if (existsSync68(join97(g.cwd, "tsconfig.json")))
       await runCheck(ctx, `lint:tsc${sfx}`, "npx", ["--no-install", "tsc", "--noEmit", "-p", "."], signal, checks, { ...co, kind: "static" });
-    if (ESLINT_CONFIGS.some((f) => existsSync68(join96(g.cwd, f)))) {
+    if (ESLINT_CONFIGS.some((f) => existsSync68(join97(g.cwd, f)))) {
       const c = await runCheck(ctx, `lint:eslint${sfx}`, "npx", ["--no-install", "eslint", ...g.rel], signal, checks, { ...co, kind: "static" });
       if (await excuseLint(ctx, signal, c, "eslint", "npx", ["--no-install", "eslint"], g.cwd, g.rel, co))
         pre2.push(c.name);
@@ -68636,7 +68825,7 @@ var CHECK_TIMEOUT_MS = 60000, excerpts, isHold = (c) => isHoldoutCheck(c.name),
   return r.missing || r.cut ? null : r;
 }, base: (f) => {
   try {
-    return safeGit(ctx.repoDir, ["show", `${ctx.baseSha}:${relative21(ctx.repoDir, join96(cwd, f))}`], { stdio: ["ignore", "pipe", "ignore"] });
+    return safeGit(ctx.repoDir, ["show", `${ctx.baseSha}:${relative21(ctx.repoDir, join97(cwd, f))}`], { stdio: ["ignore", "pipe", "ignore"] });
   } catch {
     return null;
   }
@@ -68648,6 +68837,7 @@ var init_verify = __esm(() => {
   init_assert_delta();
   init_failures();
   init_select();
+  init_dependents();
   init_load_owner();
   init_sizing();
   init_testmap();
@@ -68711,7 +68901,8 @@ var init_verify = __esm(() => {
         const runner = rec2 ?? guessRunner(basename25(p), map.runners, p);
         return runner && (runner !== "bun" || map.runners.includes("bun") || /[._](?:test|spec)\.[cm]?[jt]sx?$/.test(p)) ? [{ runner, path: p }] : [];
       });
-      const tests = failedFirst(dedupeTests([...impacted, ...changedTestFiles, ...wallTests, ...relevant2]), ctx.outputs().verify?.checks);
+      const dep = dependentTests(ctx.repoDir, map, changed, [...impacted, ...changedTestFiles, ...wallTests, ...relevant2]), depNames = new Set(dep.tests.map(testCheckName));
+      const tests = failedFirst(dedupeTests([...impacted, ...dep.tests, ...changedTestFiles, ...wallTests, ...relevant2]), ctx.outputs().verify?.checks);
       const scopedOut = scopedOutOf(map);
       if (scopedOut.length)
         ctx.emit("test.scoped_out", "verify", { tests: scopedOut });
@@ -68740,7 +68931,7 @@ var init_verify = __esm(() => {
       }
       const targetNames = new Set([...[...wallTests, ...relevant2].map(testCheckName), ...checks.filter(isHold).map((c) => c.name)]);
       const cfgChanged = testConfigChanged(ctx.repoDir, ctx.baseSha, changed);
-      const preRed = await subtractBase(ctx, api, checks, tests, changed, new Set(wallTests.map(testCheckName)), new Set(relevant2.map(testCheckName)), signal, cfgChanged.length === 0, new Set(ctx.outputs().intake?.zero_baseline?.zero ?? []));
+      const preRed = await subtractBase(ctx, api, checks, tests, changed, new Set(wallTests.map(testCheckName)), new Set(relevant2.map(testCheckName)), signal, cfgChanged.length === 0, new Set(ctx.outputs().intake?.zero_baseline?.zero ?? []), depNames);
       const attr = attribute(ctx.repoDir, ctx.baseSha, checks.filter((c) => c.result === "fail" && !preRed.names.includes(c.name)).map((c) => ({ name: c.name, ids: c.ids, eligible: !targetNames.has(c.name) && !changed.includes(c.name.slice(c.name.indexOf(":") + 1)) })));
       attr.introducedChecks = [...new Set(attr.introducedChecks.map((n10) => isHoldoutCheck(n10) ? "holdout" : n10))];
       preRed.names.push(...attr.preExistingChecks);
@@ -68808,11 +68999,11 @@ ${x3}` : c.cmd };
         return [`weakened test: ${t.path}`, ...assertDeltaNotes(ctx.repoDir, ctx.baseSha, null, t.path, intake?.task ?? "", k3?.b, k3?.h) ?? []];
       });
       const weakened = [...modifiedRel, ...cfgChanged.map((f) => `test configuration changed: ${f}`), ...preRed.weak.map((n10) => `skipped or fewer tests than base: ${n10}`)];
-      const notProven = [...weakened, ...intake?.deps_not_proven ?? [], ...pub.filter((c) => c.name === "holdout" && c.result !== "pass").map((c) => c.result === "not_run" ? "holdout not executed" : "holdout check failed"), ...[...fullNotProven].filter((n10) => !naNote(n10)), ...pub.filter((c) => c.owner === "harness" && c.name !== "holdout").map((c) => `${c.reason} (${c.name}; harness-owned, no fix rounds)`), ...new Set(checks.filter((c) => c.interpreter === "system" && c.result !== "not_run").map((c) => c.name.startsWith("lint:") ? "lint ran on the system ruff" : "tests ran on the system interpreter"))];
+      const notProven = [...weakened, ...dependentNotes(dep), ...intake?.deps_not_proven ?? [], ...pub.filter((c) => c.name === "holdout" && c.result !== "pass").map((c) => c.result === "not_run" ? "holdout not executed" : "holdout check failed"), ...[...fullNotProven].filter((n10) => !naNote(n10)), ...pub.filter((c) => c.owner === "harness" && c.name !== "holdout").map((c) => `${c.reason} (${c.name}; harness-owned, no fix rounds)`), ...new Set(checks.filter((c) => c.interpreter === "system" && c.result !== "not_run").map((c) => c.name.startsWith("lint:") ? "lint ran on the system ruff" : "tests ran on the system interpreter"))];
       const wallDropped2 = [...wallPaths].filter((p) => !wallTests.some((t) => t.path === p));
       notProven.push(...wallDropped2.map((p) => `Wall test not executed: ${p}: ${NO_RUNNER_REASON}`));
       const wallNames = new Set(wallTests.map(testCheckName)), wallRun = checks.filter((c) => wallNames.has(c.name) || isHold(c)), wallPassed = wallRun.some((c) => c.result === "fail") ? false : wallRun.length > 0 && wallDropped2.length === 0 && wallRun.every((c) => c.result === "pass") ? true : undefined;
-      return { status: "completed", data: { checks: pub, flaky, ...wallPassed === undefined ? {} : { wall_passed: wallPassed }, failures_grouped: failuresGrouped, holdout_failed: holdoutFailed, changed_files: changed, not_proven: notProven, ...fullNotProven.size ? { not_applicable: [...fullNotProven].filter(naNote).map(naText) } : {}, pre_red: preRed.ids, pre_red_checks: preRed.names, skipped_on_base: preRed.zero, ...attr.line ? { baseline_line: attr.line, introduced_checks: attr.introducedChecks } : {}, test_counts: testCounts, uncovered_changed: uncoveredChanged, target_checks: checks.filter((c) => c.result === "pass" && targetNames.has(c.name)).map((c) => isHold(c) ? "holdout" : c.name), risk } };
+      return { status: "completed", data: { checks: pub, flaky, ...wallPassed === undefined ? {} : { wall_passed: wallPassed }, failures_grouped: failuresGrouped, holdout_failed: holdoutFailed, changed_files: changed, ...depNames.size ? { dependent_checks: [...depNames] } : {}, not_proven: notProven, ...fullNotProven.size ? { not_applicable: [...fullNotProven].filter(naNote).map(naText) } : {}, pre_red: preRed.ids, pre_red_checks: preRed.names, skipped_on_base: preRed.zero, ...attr.line ? { baseline_line: attr.line, introduced_checks: attr.introducedChecks } : {}, test_counts: testCounts, uncovered_changed: uncoveredChanged, target_checks: checks.filter((c) => c.result === "pass" && targetNames.has(c.name)).map((c) => isHold(c) ? "holdout" : c.name), risk } };
     }
   };
   stage5 = verifyStage;
@@ -68843,9 +69034,9 @@ __export(exports_wall, {
   BASE_RUN_TIMEOUT_MS: () => BASE_RUN_TIMEOUT_MS
 });
 import { spawnSync as spawnSync10 } from "child_process";
-import { existsSync as existsSync69, mkdirSync as mkdirSync50, mkdtempSync as mkdtempSync14, readFileSync as readFileSync86, readdirSync as readdirSync28, rmSync as rmSync29, writeFileSync as writeFileSync49 } from "fs";
+import { existsSync as existsSync69, mkdirSync as mkdirSync50, mkdtempSync as mkdtempSync14, readFileSync as readFileSync87, readdirSync as readdirSync28, rmSync as rmSync29, writeFileSync as writeFileSync49 } from "fs";
 import { tmpdir as tmpdir17 } from "os";
-import { dirname as dirname38, join as join97, relative as relative22 } from "path";
+import { dirname as dirname39, join as join98, relative as relative22 } from "path";
 
 class RealBaseTestRunner {
   api;
@@ -68911,10 +69102,10 @@ ${acceptance2.map((a) => `Acceptance: ${a}`).join(`
 function loadTaskText(ctx, fromPrior) {
   if (fromPrior)
     return fromPrior;
-  const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join97(ctx.runDir, "issue.json");
+  const issueJsonPath = process.env.LOKI_E10_ISSUE_JSON ?? join98(ctx.runDir, "issue.json");
   if (existsSync69(issueJsonPath)) {
     try {
-      const issue = JSON.parse(readFileSync86(issueJsonPath, "utf8"));
+      const issue = JSON.parse(readFileSync87(issueJsonPath, "utf8"));
       const text3 = [issue.title, issue.body].filter((s) => typeof s === "string" && s.length > 0).join(`
 
 `);
@@ -68924,9 +69115,11 @@ function loadTaskText(ctx, fromPrior) {
   }
   return process.env.LOKI_E10_TASK_TEXT ?? "";
 }
-function wallTargetDir(repoDir, existingTests) {
+function wallTargetDir(repoDir, existingTests, runners = []) {
   const first = existingTests[0];
-  return first ? join97(repoDir, dirname38(first.path)) : join97(repoDir, "tests");
+  if (!first && runners.some((r) => r === "maven" || r === "gradle" || r === "javac"))
+    return join98(repoDir, "src", "test", "java");
+  return first ? join98(repoDir, dirname39(first.path)) : join98(repoDir, "tests");
 }
 async function wallAuthor(ctx, signal, retry) {
   const done = (result) => ({ kind: "done", result });
@@ -68945,18 +69138,20 @@ async function wallAuthor(ctx, signal, retry) {
   if (!ctx.externalPatch && planMode() !== "always" && smallTaskPath(sz2.size, hasRelevantTests(task, repoMap, testMap, ctx.tests.impacted)) === "lean") {
     return done({ status: "skipped", data: { size: sz2.size }, reason: "small task with a relevant test: cascade skips Wall" });
   }
-  if (testMap && runners.length === 0)
-    return done({ status: "skipped", data: { size: sz2.size, files: [], no_runner: true, skip_code: harnessSkipCode(), not_proven: ["Wall skipped: no runnable test command for this stack"] }, reason: "no runnable test command detected: the Wall cannot write a runnable check" });
+  if (testMap && runners.length === 0) {
+    const miss = missingJavaTool(repoMap?.files ?? [], process.env, ctx.repoDir);
+    return done({ status: "skipped", data: { size: sz2.size, files: [], no_runner: true, skip_code: harnessSkipCode(), not_proven: [miss ? `Wall not run: ${miss} is not installed on this machine, so this Java repo could not be tested (harness-owned)` : "Wall skipped: no runnable test command for this stack"] }, reason: miss ? `${miss} is not installed: the Wall cannot run Java tests (harness-owned, not proven)` : "no runnable test command detected: the Wall cannot write a runnable check" });
+  }
   if (testMap && runners.every((r) => r === "pytest") && projectInterpreter(ctx.repoDir) === "system" && wallHoldoutRatio() === 0)
     return done({ status: "skipped", data: { size: sz2.size, files: [], no_interpreter: true, not_proven: ["Wall skipped: no project test interpreter"] }, reason: "Wall skipped: no project test interpreter" });
   const tree = prior.intake?.tree;
   const repomapText = repoMapText(ctx.repoDir, tree, repomapRef, WALL_MAP_MAX_LINES);
-  const targetDir = wallTargetDir(ctx.repoDir, existingTests), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative22(ctx.repoDir, targetDir)}/x`);
-  const conv2 = readPackageConventions(join97(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
-  const cwd = mkdtempSync14(join97(tmpdir17(), "loki-e15-wall-"));
+  const targetDir = wallTargetDir(ctx.repoDir, existingTests, runners), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative22(ctx.repoDir, targetDir)}/x`);
+  const conv2 = readPackageConventions(join98(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
+  const cwd = mkdtempSync14(join98(tmpdir17(), "loki-e15-wall-"));
   const wm2 = wallManifestFor(ctx.repoDir, tree, task);
   for (const [n10, c] of [["task.md", task], ["repomap.txt", repomapText], ...wm2 ? [["wall_manifest.txt", wm2.text]] : []])
-    writeFileSync49(join97(cwd, n10), c, "utf8");
+    writeFileSync49(join98(cwd, n10), c, "utf8");
   const clauseSet = extractClauses(task);
   const model = retry?.model ?? wallFirstModel(sz2.size), iterationId = `${ctx.runId}-wall${retry?.suffix ?? ""}`;
   const session = await ctx.sessions.run({
@@ -68975,21 +69170,21 @@ async function wallAuthor(ctx, signal, retry) {
   }
   const planText = typeof prior.plan?.plan === "string" ? prior.plan.plan : null, repoFiles = repoMap?.files ?? [];
   const oor = () => readdirSync28(cwd).filter((f) => f.startsWith(WALL_PREFIX)).flatMap((name) => {
-    const text3 = readFileSync86(join97(cwd, name), "utf8"), why = outOfRepoTarget(text3) ?? vacuousCheck(name, text3) ?? phantomReason(phantomRepoPaths(text3, name, targetDir, ctx.repoDir, planText), repoFiles, relative22(ctx.repoDir, targetDir), pkg?.root ?? "");
+    const text3 = readFileSync87(join98(cwd, name), "utf8"), why = outOfRepoTarget(text3) ?? vacuousCheck(name, text3) ?? phantomReason(phantomRepoPaths(text3, name, targetDir, ctx.repoDir, planText), repoFiles, relative22(ctx.repoDir, targetDir), pkg?.root ?? "");
     return why ? [{ name, why }] : [];
   });
   const bad1 = oor();
   if (bad1.length > 0 && !signal.aborted && !ctx.overCap?.())
     await ctx.sessions.run({ stage: "wall", brief: withStagePrefix(outOfRepoReask("Rewrite these Wall files in place, keeping the same names and acceptance coverage.", bad1)), tier: "development", model, iterationId: `${iterationId}-oor`, limitS: wallLimitS(sz2.size), signal, cwd });
-  const oorBad = new Map(oor().map((b) => [b.name, b.why])), all = readdirSync28(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n10) => !oorBad.has(n10) && !conventionViolation(conv2, n10, readFileSync86(join97(cwd, n10), "utf8"))), runnerOf: (n10) => guessRunner(n10, runners) }), generated = all.filter((n10) => !held?.names.has(n10));
-  const sealedDir = join97(ctx.runDir, "wall");
+  const oorBad = new Map(oor().map((b) => [b.name, b.why])), all = readdirSync28(cwd).filter((f) => f.startsWith(WALL_PREFIX)), held = stashHoldout({ runId: ctx.runId, repoDir: ctx.repoDir, srcDir: cwd, targetDir, names: all.filter((n10) => !oorBad.has(n10) && !conventionViolation(conv2, n10, readFileSync87(join98(cwd, n10), "utf8"))), runnerOf: (n10) => guessRunner(n10, runners) }), generated = all.filter((n10) => !held?.names.has(n10));
+  const sealedDir = join98(ctx.runDir, "wall");
   if (generated.length > 0)
     mkdirSync50(sealedDir, { recursive: true });
   const contents = new Map;
   const discarded = [];
   for (const name of generated) {
-    const content = readFileSync86(join97(cwd, name), "utf8"), oorWhy = oorBad.get(name), bad = oorWhy ?? conventionViolation(conv2, name, content);
-    writeFileSync49(join97(sealedDir, name), content, "utf8");
+    const content = readFileSync87(join98(cwd, name), "utf8"), oorWhy = oorBad.get(name), bad = oorWhy ?? conventionViolation(conv2, name, content);
+    writeFileSync49(join98(sealedDir, name), content, "utf8");
     if (oorWhy)
       discarded.push({ file: name, reason: `${oorWhy}; wall test discarded after one rewrite request` });
     else if (bad)
@@ -69018,7 +69213,7 @@ function* installCore(ctx, a, baseDir, opts) {
     const content = contents.get(name);
     if (content === undefined)
       continue;
-    const dest = join97(targetDir, name), runner = guessRunner(name, runners, relative22(ctx.repoDir, dest));
+    const dest = join98(targetDir, name), runner = guessRunner(name, runners, relative22(ctx.repoDir, dest));
     writeFileSync49(dest, content, "utf8");
     sealedFiles.push({ path: dest, sha256: sha2562(content), ...runner ? { runner } : {} });
     readOnlyFiles.push({ path: dest, content });
@@ -69035,7 +69230,7 @@ function* installCore(ctx, a, baseDir, opts) {
   }
   const each = yield { runner: baseRunner, tests: wallTests };
   for (const [i, t] of wallTests.entries()) {
-    const e10 = each?.[i], r = e10 ?? baseRunner.run(baseDir, [t]), abs = join97(ctx.repoDir, t.path);
+    const e10 = each?.[i], r = e10 ?? baseRunner.run(baseDir, [t]), abs = join98(ctx.repoDir, t.path);
     baseRun.pass += r.pass;
     baseRun.fail += r.fail;
     baseRun.not_run += r.not_run ?? 0;
@@ -69078,7 +69273,7 @@ async function runWall(ctx, signal, opts = {}) {
   if (a.kind === "authored") {
     for (const f of first.data.files ?? [])
       rmSync29(f.path, { force: true });
-    rmSync29(join97(ctx.runDir, "wall"), { recursive: true, force: true });
+    rmSync29(join98(ctx.runDir, "wall"), { recursive: true, force: true });
     ctx.wallSealed = false;
   }
   removeHoldout(ctx.runId, ctx.repoDir);
@@ -69118,15 +69313,15 @@ var init_wall = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/discard.ts
-import { chmodSync as chmodSync6, closeSync as closeSync14, lstatSync as lstatSync26, mkdirSync as mkdirSync51, openSync as openSync14, readFileSync as readFileSync87, realpathSync as realpathSync29, rmdirSync, unlinkSync as unlinkSync9, writeFileSync as writeFileSync50 } from "fs";
-import { dirname as dirname39, join as join98, relative as relative23, sep as sep19 } from "path";
+import { chmodSync as chmodSync6, closeSync as closeSync14, lstatSync as lstatSync26, mkdirSync as mkdirSync51, openSync as openSync14, readFileSync as readFileSync88, realpathSync as realpathSync29, rmdirSync, unlinkSync as unlinkSync9, writeFileSync as writeFileSync50 } from "fs";
+import { dirname as dirname40, join as join99, relative as relative23, sep as sep19 } from "path";
 function safeRestore(repoDir, f, want, mode) {
-  const root = realpathSync29(repoDir), fp2 = join98(root, f), rel = relative23(root, dirname39(fp2));
+  const root = realpathSync29(repoDir), fp2 = join99(root, f), rel = relative23(root, dirname40(fp2));
   if (rel.startsWith(".."))
     throw new Error("outside repo");
   let cur = root;
   for (const part of rel === "" ? [] : rel.split(sep19)) {
-    cur = join98(cur, part);
+    cur = join99(cur, part);
     let st3;
     try {
       st3 = lstatSync26(cur);
@@ -69143,7 +69338,7 @@ function safeRestore(repoDir, f, want, mode) {
   } catch {
     st2 = null;
   }
-  if (st2?.isFile() && readFileSync87(fp2).equals(want)) {
+  if (st2?.isFile() && readFileSync88(fp2).equals(want)) {
     chmodSync6(fp2, mode);
     return;
   }
@@ -69180,7 +69375,7 @@ async function discardIfSatisfied(git9, base, o, staged, keep, repoDir) {
     return { status: "failed", data: {}, reason: "already-satisfied discard failed" };
   const notProven = [];
   for (const [f, v3] of Object.entries(o.intake?.preexisting_untracked_blobs ?? {})) {
-    const fp2 = join98(repoDir, f);
+    const fp2 = join99(repoDir, f);
     try {
       if (v3.startsWith("!")) {
         const st2 = lstatSync26(fp2);
@@ -69199,7 +69394,7 @@ async function discardIfSatisfied(git9, base, o, staged, keep, repoDir) {
       try {
         let m = 420;
         try {
-          const l = lstatSync26(join98(repoDir, f));
+          const l = lstatSync26(join99(repoDir, f));
           if (l.isFile())
             m = l.mode & 511;
         } catch {}
@@ -69215,7 +69410,7 @@ var init_discard = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/scope.ts
-import { basename as basename26, dirname as dirname40 } from "path";
+import { basename as basename26, dirname as dirname41 } from "path";
 function contractText(o) {
   const c = o.intake?.contract_snapshot?.contract;
   return Array.isArray(c?.criteria) ? c.criteria.map((x3) => typeof x3?.text === "string" ? x3.text : "").join(`
@@ -69229,8 +69424,8 @@ function outsideScope(o, staged) {
   const text3 = `${plan}
 ${typeof o.intake?.task === "string" ? o.intake.task : ""}
 ${contractText(o)}`, pre2 = o.intake?.preexisting_dirty ?? {};
-  const toks = surfaceTokens(text3), plannedDirs = new Set(rel.map((r) => dirname40(r)).filter((d) => d !== "."));
-  return staged.filter(({ st: st2, f }) => st2 !== "A" && !isTestFile(f) && !Object.hasOwn(pre2, f) && !rel.includes(f) && !mentions(text3, f) && !mentions(text3, basename26(f)) && !plannedDirs.has(dirname40(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
+  const toks = surfaceTokens(text3), plannedDirs = new Set(rel.map((r) => dirname41(r)).filter((d) => d !== "."));
+  return staged.filter(({ st: st2, f }) => st2 !== "A" && !isTestFile(f) && !Object.hasOwn(pre2, f) && !rel.includes(f) && !mentions(text3, f) && !mentions(text3, basename26(f)) && !plannedDirs.has(dirname41(f)) && !dirSegs(f).some((d) => toks.has(d))).map(({ f }) => f);
 }
 function flagOutsideScope(o, staged) {
   const unit = unitFlags(staged, process.env, o.intake?.preexisting_dirty ?? {});
@@ -69245,14 +69440,14 @@ var init_scope2 = __esm(() => {
 });
 
 // ../../loki-ts/src/council/role_agents.ts
-import { existsSync as existsSync70, readdirSync as readdirSync29, readFileSync as readFileSync88 } from "fs";
+import { existsSync as existsSync70, readdirSync as readdirSync29, readFileSync as readFileSync89 } from "fs";
 import { homedir as homedir11 } from "os";
-import { join as join99 } from "path";
+import { join as join100 } from "path";
 function agentDirs(repoDir, env = process.env) {
-  return [env["LOKI_AGENTS_PROJECT_DIR"] || join99(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join99(env["XDG_CONFIG_HOME"] || join99(homedir11(), ".config"), "loki", "agents")];
+  return [env["LOKI_AGENTS_PROJECT_DIR"] || join100(repoDir, ".loki", "agents"), env["LOKI_AGENTS_USER_DIR"] || join100(env["XDG_CONFIG_HOME"] || join100(homedir11(), ".config"), "loki", "agents")];
 }
 function parseAgent(file, stem2) {
-  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync88(file, "utf8"));
+  const m = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/.exec(readFileSync89(file, "utf8"));
   if (!m)
     return null;
   const body = m[2].trim();
@@ -69277,7 +69472,7 @@ function loadRoleAgent(repoDir, role, env = process.env) {
     const ordered = [...names.filter((n10) => n10 === `${role}.md`), ...names.filter((n10) => n10 !== `${role}.md`)];
     for (const n10 of ordered) {
       try {
-        const a = parseAgent(join99(d, n10), n10.slice(0, -3));
+        const a = parseAgent(join100(d, n10), n10.slice(0, -3));
         if (a && a.role === role)
           return a;
       } catch {}
@@ -69296,11 +69491,11 @@ function explicitReview(repoDir, env) {
   if (flag && isOff(ev2))
     return "off";
   for (const f of ["loki.yaml", "loki.yml"]) {
-    const p = join99(repoDir, f);
+    const p = join100(repoDir, f);
     if (!existsSync70(p))
       continue;
     try {
-      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync88(p, "utf8"));
+      const m = /^review:[ \t]*["']?([A-Za-z]+)["']?[ \t]*(?:#.*)?$/m.exec(readFileSync89(p, "utf8"));
       const v3 = asProvider(m?.[1]);
       if (v3)
         return v3;
@@ -69333,7 +69528,7 @@ var init_role_agents = __esm(() => {
 
 // ../../loki-ts/src/util/child_ledger.ts
 import { appendFileSync as appendFileSync10, mkdirSync as mkdirSync52 } from "fs";
-import { join as join100 } from "path";
+import { join as join101 } from "path";
 function unmeasuredRecord(phase, model, source) {
   return { phase, model, input_tokens: 0, output_tokens: 0, cache_creation_tokens: 0, cache_read_tokens: 0, source, cost_status: "unmeasured" };
 }
@@ -69358,9 +69553,9 @@ function recordFromClaudeResult(phase, payload, source = "claude-json") {
 }
 function appendChildLedger(lokiDir2, rec2) {
   try {
-    const dir = join100(lokiDir2, "metrics");
+    const dir = join101(lokiDir2, "metrics");
     mkdirSync52(dir, { recursive: true });
-    appendFileSync10(join100(dir, "child-sessions.jsonl"), `${JSON.stringify(rec2)}
+    appendFileSync10(join101(dir, "child-sessions.jsonl"), `${JSON.stringify(rec2)}
 `);
     return true;
   } catch {
@@ -69390,7 +69585,7 @@ var init_child_ledger = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/stages/xreview.ts
-import { join as join101 } from "path";
+import { join as join102 } from "path";
 function minVerdict(verdict, review) {
   const ceiling = review?.level === "block" ? "PARTIAL" : verdict;
   return RANK4[ceiling] < RANK4[verdict] ? ceiling : verdict;
@@ -69488,9 +69683,9 @@ Review ONLY the diff below. Do not modify files.` : "You are an independent code
   try {
     if (p === "claude")
       await ensureClaudeHelpCache();
-    const r = await withChildLedger(run, join101(ctx.repoDir, ".loki"), "xreview")(reviewArgv(p, prompt, process.env, p === "claude" ? agent?.model || pin : undefined), { cwd: ctx.repoDir, timeoutMs: boxFor(ctx) * 1000, group: true, signal });
+    const r = await withChildLedger(run, join102(ctx.repoDir, ".loki"), "xreview")(reviewArgv(p, prompt, process.env, p === "claude" ? agent?.model || pin : undefined), { cwd: ctx.repoDir, timeoutMs: boxFor(ctx) * 1000, group: true, signal });
     const costId = `${ctx.runId}-xreview-${p}`;
-    writeReviewerCost(join101(ctx.repoDir, ".loki"), costId, { reviewer: `xreview-${p}`, provider: p, model: p === "claude" ? agent?.model || pin : undefined, stdout: r.stdout, stderr: r.stderr });
+    writeReviewerCost(join102(ctx.repoDir, ".loki"), costId, { reviewer: `xreview-${p}`, provider: p, model: p === "claude" ? agent?.model || pin : undefined, stdout: r.stdout, stderr: r.stderr });
     if (r.exitCode !== 0)
       return { ...tag({ provider: p, level: "not_run", notes: [`cross-review not run: ${p} exited ${r.exitCode}`] }), cost_iteration: costId };
     return { ...tag(parseReview(p, r.stdout)), cost_iteration: costId };
@@ -69671,9 +69866,9 @@ __export(exports_contract, {
   MAX_CONTRACT_BYTES: () => MAX_CONTRACT_BYTES,
   CONSTRAINT_KINDS: () => CONSTRAINT_KINDS
 });
-import { existsSync as existsSync71, lstatSync as lstatSync27, mkdirSync as mkdirSync53, readFileSync as readFileSync89, rmSync as rmSync30, writeFileSync as writeFileSync51 } from "fs";
+import { existsSync as existsSync71, lstatSync as lstatSync27, mkdirSync as mkdirSync53, readFileSync as readFileSync90, rmSync as rmSync30, writeFileSync as writeFileSync51 } from "fs";
 import { spawnSync as spawnSync11 } from "child_process";
-import { dirname as dirname41, join as join102 } from "path";
+import { dirname as dirname42, join as join103 } from "path";
 import { createHash as createHash28 } from "crypto";
 function contractEnabled(env = process.env) {
   return env["LOKI_CONTRACT"] !== "0";
@@ -69740,7 +69935,7 @@ function assignCriteria(units, criteria2) {
   return { units: out3, orphans: criteria2.filter((c) => !owned.has(c.id)) };
 }
 function groupContractPath(repoDir, groupId) {
-  return join102(repoDir, ".loki", "groups", groupId.replace(/[^A-Za-z0-9._-]/g, "_"), "contract.json");
+  return join103(repoDir, ".loki", "groups", groupId.replace(/[^A-Za-z0-9._-]/g, "_"), "contract.json");
 }
 function freezeGroupContract(repoDir, groupId, units, contract) {
   const a = assignCriteria(units, contract.criteria);
@@ -69748,7 +69943,7 @@ function freezeGroupContract(repoDir, groupId, units, contract) {
     return { ok: false, reason: `NOT PROVEN: group contract has ${a.orphans.length} criterion owned by no unit: ${a.orphans.map((o) => `${sanitizeCriterion(o.id)} ${sanitizeCriterion(o.text)}`).join("; ")}`, orphans: a.orphans };
   const gc2 = { group: groupId, units: a.units, orphans: [] };
   const path = groupContractPath(repoDir, groupId);
-  mkdirSync53(dirname41(path), { recursive: true });
+  mkdirSync53(dirname42(path), { recursive: true });
   atomicWriteJson(path, gc2);
   return { ok: true, path, contract: gc2 };
 }
@@ -69805,7 +70000,7 @@ function untracedLines(trace) {
   return trace.criteria.filter((c) => c.status === "no_match").map((c) => `contract ${sanitizeCriterion(c.id)} untraced (no keyword match in changed files): ${sanitizeCriterion(c.text)}`);
 }
 function contractPath(repoDir) {
-  return join102(repoDir, ".loki", "contract.json");
+  return join103(repoDir, ".loki", "contract.json");
 }
 function readContract(repoDir) {
   const p = contractPath(repoDir);
@@ -69821,7 +70016,7 @@ function readContract(repoDir) {
     return { contract: null, notes: ["contract unreadable: too large"], sha256: null };
   let raw2;
   try {
-    raw2 = readFileSync89(p);
+    raw2 = readFileSync90(p);
   } catch {
     return { contract: null, notes: ["contract unreadable: read failed"], sha256: null };
   }
@@ -69893,9 +70088,9 @@ function main3(args) {
 `);
     return 2;
   }
-  const contract = parseContract(readFileSync89(file, "utf8"), file);
+  const contract = parseContract(readFileSync90(file, "utf8"), file);
   const out3 = contractPath(repoRoot(process.cwd()));
-  mkdirSync53(dirname41(out3), { recursive: true });
+  mkdirSync53(dirname42(out3), { recursive: true });
   writeFileSync51(out3, JSON.stringify(contract, null, 2) + `
 `);
   process.stdout.write(renderContract(contract));
@@ -69952,7 +70147,7 @@ function fromSpecText(raw2) {
   }
 }
 function fromPrdText(text3, python = "python3") {
-  const script = join102(REPO_ROOT, "autonomy", "lib", "requirements_contract.py");
+  const script = join103(REPO_ROOT, "autonomy", "lib", "requirements_contract.py");
   if (!existsSync71(script))
     return null;
   const code = `import sys,json,importlib.util as u
@@ -69995,12 +70190,12 @@ function mapRequirements(reqs, ran2, revision) {
   return { version: 1, revision, requirements: out3 };
 }
 function fromChecklist(lokiDir2) {
-  const p = join102(lokiDir2, "checklist", "checklist.json");
+  const p = join103(lokiDir2, "checklist", "checklist.json");
   if (!existsSync71(p))
     return null;
   let doc;
   try {
-    doc = JSON.parse(readFileSync89(p, "utf8"));
+    doc = JSON.parse(readFileSync90(p, "utf8"));
   } catch {
     return null;
   }
@@ -70032,7 +70227,7 @@ function writeRequirementsMap(repoDir, lokiDir2, reqs, ran2) {
     if (!reqs || reqs.length === 0)
       return null;
     const m = mapRequirements(reqs, ran2, currentRevision(repoDir));
-    atomicWriteJson(join102(lokiDir2, "state", "requirements-map.json"), m);
+    atomicWriteJson(join103(lokiDir2, "state", "requirements-map.json"), m);
     return m;
   } catch {
     return null;
@@ -70044,17 +70239,17 @@ function writeFromChecklist(repoDir, lokiDir2) {
 }
 function writeFromEngine10(repoDir, lokiDir2, runDir, task, events2) {
   let reqs = null;
-  const snap = join102(runDir, "spec.snapshot.md");
+  const snap = join103(runDir, "spec.snapshot.md");
   if (existsSync71(snap)) {
     try {
-      reqs = fromSpecText(readFileSync89(snap, "utf8"));
+      reqs = fromSpecText(readFileSync90(snap, "utf8"));
     } catch {
       reqs = null;
     }
   }
   if (!reqs && task)
     reqs = fromPrdText(task);
-  const mapPath = join102(lokiDir2, "state", "requirements-map.json");
+  const mapPath = join103(lokiDir2, "state", "requirements-map.json");
   if (!reqs || reqs.length === 0) {
     try {
       rmSync30(mapPath, { force: true });
@@ -70080,7 +70275,7 @@ function uncoveredCount(m) {
 }
 function readRequirementsMap(lokiDir2) {
   try {
-    const m = JSON.parse(readFileSync89(join102(lokiDir2, "state", "requirements-map.json"), "utf8"));
+    const m = JSON.parse(readFileSync90(join103(lokiDir2, "state", "requirements-map.json"), "utf8"));
     return m.version === 1 && Array.isArray(m.requirements) ? m : null;
   } catch {
     return null;
@@ -70108,17 +70303,17 @@ var init_contract = __esm(() => {
   BULLET = /^\s*(?:[-*+]|\d+[.)])\s+(.+)$/;
   STOP3 = new Set(["the", "and", "for", "with", "that", "this", "must", "should", "shall", "when", "then", "are", "was", "all", "any", "can", "not", "has", "have", "from", "into", "each", "user", "users"]);
   MAX_CONTRACT_BYTES = 1024 * 1024;
-  REQ_MAP_REL = join102(".loki", "state", "requirements-map.json");
+  REQ_MAP_REL = join103(".loki", "state", "requirements-map.json");
   REQ_STOP = new Set(["with", "that", "this", "from", "have", "will", "should", "must", "when", "then", "into", "each", "every", "user", "users", "page", "able", "allow", "support", "ensure", "using", "their", "there", "which", "shall"]);
   LINK_RE = /\s*\[checks?:\s*([^\]]+)\]\s*$/i;
 });
 
 // ../../loki-ts/src/features/speed/seal_group.ts
 import { createHash as createHash29 } from "crypto";
-import { existsSync as existsSync72, mkdirSync as mkdirSync54, readdirSync as readdirSync30, readFileSync as readFileSync90, renameSync as renameSync20, statSync as statSync26, writeFileSync as writeFileSync52 } from "fs";
-import { dirname as dirname42, join as join103 } from "path";
+import { existsSync as existsSync72, mkdirSync as mkdirSync54, readdirSync as readdirSync30, readFileSync as readFileSync91, renameSync as renameSync20, statSync as statSync26, writeFileSync as writeFileSync52 } from "fs";
+import { dirname as dirname43, join as join104 } from "path";
 function sealGroup(runDir, rh) {
-  const manifestPath = join103(runDir, "group", "manifest.json");
+  const manifestPath = join104(runDir, "group", "manifest.json");
   if (!existsSync72(manifestPath))
     return { section: undefined, notProven: [], problems: 0, allUnitsPass: true };
   const notProven = [];
@@ -70143,10 +70338,10 @@ function sealGroup(runDir, rh) {
       return fail2(`unit ${index2} has an invalid, duplicate or case-colliding id`);
     seen.add(id2);
     seenLower.add(id2.toLowerCase());
-    const dir = join103(unitsDir(runDir), id2), rp = join103(dir, "receipt.json"), ep2 = join103(dir, "events.jsonl");
+    const dir = join104(unitsDir(runDir), id2), rp = join104(dir, "receipt.json"), ep2 = join104(dir, "events.jsonl");
     let bytes;
     try {
-      bytes = readFileSync90(rp);
+      bytes = readFileSync91(rp);
     } catch {
       return fail2(`unit ${id2} sub-receipt missing`);
     }
@@ -70165,7 +70360,7 @@ function sealGroup(runDir, rh) {
       unit_id: id2,
       sub_receipt_sha256: sha4(bytes),
       receipt_sha256: sub["receipt_sha256"],
-      events_file_sha256: existsSync72(ep2) ? sha4(readFileSync90(ep2)) : null,
+      events_file_sha256: existsSync72(ep2) ? sha4(readFileSync91(ep2)) : null,
       verdict,
       goal: text3(u10["goal"], 200),
       files: (Array.isArray(u10["files"]) ? u10["files"] : []).map((f) => text3(f, 200)).filter(Boolean).slice(0, 50),
@@ -70185,12 +70380,12 @@ function capGroupVerdict(v3, g) {
   return !g.allUnitsPass && (v3 === "VERIFIED" || v3 === "ALREADY_SATISFIED") ? "PARTIAL" : v3;
 }
 async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
-  const runDir = dirname42(receiptPath);
+  const runDir = dirname43(receiptPath);
   const signed = isObj10(receipt["verification"]) && typeof receipt["verification"]["jwt"] === "string";
   const bad = (reason) => ({ verdict: "TAMPERED", reason: `group: ${reason}` });
   const g = receipt["group"];
   if (g === undefined)
-    return existsSync72(join103(runDir, "group", "manifest.json")) ? bad("group directory present but the receipt has no group section") : null;
+    return existsSync72(join104(runDir, "group", "manifest.json")) ? bad("group directory present but the receipt has no group section") : null;
   if (!isObj10(g) || !ID_RE.test(String(g["group_id"] ?? "")) || !Array.isArray(g["units"]) || g["units"].length === 0)
     return bad("group section malformed");
   const entries = g["units"];
@@ -70202,20 +70397,20 @@ async function verifyGroup(receiptPath, receipt, rh, verifyOne, deps = {}) {
     return bad("unit directories do not match the receipt (missing or extra unit)");
   let unchecked = null;
   for (let i = 0;i < entries.length; i++) {
-    const e10 = entries[i], id2 = ids[i], dir = join103(unitsDir(runDir), id2), rp = join103(dir, "receipt.json"), ep2 = join103(dir, "events.jsonl");
+    const e10 = entries[i], id2 = ids[i], dir = join104(unitsDir(runDir), id2), rp = join104(dir, "receipt.json"), ep2 = join104(dir, "events.jsonl");
     if (e10["index"] !== i)
       return bad(`unit ${id2} is out of order (index ${String(e10["index"])} at position ${i})`);
     let bytes;
     try {
       if (!statSync26(dir).isDirectory())
         return bad(`unit ${id2} is not a directory`);
-      bytes = readFileSync90(rp);
+      bytes = readFileSync91(rp);
     } catch {
       return bad(`unit ${id2} sub-receipt missing`);
     }
     if (sha4(bytes) !== e10["sub_receipt_sha256"])
       return bad(`unit ${id2} sub-receipt does not match its recorded hash`);
-    const evSha = existsSync72(ep2) ? sha4(readFileSync90(ep2)) : null;
+    const evSha = existsSync72(ep2) ? sha4(readFileSync91(ep2)) : null;
     if (evSha !== (e10["events_file_sha256"] ?? null))
       return bad(`unit ${id2} events.jsonl does not match its recorded hash`);
     const sub = readJson7(rp);
@@ -70244,7 +70439,7 @@ function composeGroupReceipt(groupDir, rh, o) {
   const body = { schema: GROUP_SCHEMA, run_id: gid, verdict, base_sha: o.baseRef, head_sha: o.head, not_proven: seal.notProven, group: seal.section };
   const hash = rh(body), sig = signReceipt(gid, hash);
   const receipt = { ...body, receipt_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } };
-  const path = join103(groupDir, "receipt.json"), tmp = `${path}.${process.pid}.tmp`;
+  const path = join104(groupDir, "receipt.json"), tmp = `${path}.${process.pid}.tmp`;
   mkdirSync54(groupDir, { recursive: true });
   writeFileSync52(tmp, JSON.stringify(receipt, null, 2) + `
 `);
@@ -70256,9 +70451,9 @@ function compositeVerdict(childVerdicts) {
   const failed2 = childVerdicts.filter((v3) => v3 === "FAILED" || !["VERIFIED", "ALREADY_SATISFIED", "PARTIAL", "SPEC_CONFLICT"].includes(v3)).length;
   return capGroupVerdict(base, { section: undefined, notProven: [], problems: failed2, allUnitsPass: childVerdicts.every((v3) => PASSING.has(v3)) });
 }
-var ID_RE, PASSING, sha4 = (b) => createHash29("sha256").update(b).digest("hex"), isObj10 = (v3) => v3 !== null && typeof v3 === "object" && !Array.isArray(v3), text3 = (v3, cap) => typeof v3 === "string" ? v3.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v3) => typeof v3 === "number" && Number.isFinite(v3) && v3 >= 0 ? v3 : 0, unitsDir = (runDir) => join103(runDir, "group", "units"), readJson7 = (p) => {
+var ID_RE, PASSING, sha4 = (b) => createHash29("sha256").update(b).digest("hex"), isObj10 = (v3) => v3 !== null && typeof v3 === "object" && !Array.isArray(v3), text3 = (v3, cap) => typeof v3 === "string" ? v3.replace(/[\x00-\x1f\x7f]+/g, " ").trim().slice(0, cap) : "", num4 = (v3) => typeof v3 === "number" && Number.isFinite(v3) && v3 >= 0 ? v3 : 0, unitsDir = (runDir) => join104(runDir, "group", "units"), readJson7 = (p) => {
   try {
-    return JSON.parse(readFileSync90(p, "utf8"));
+    return JSON.parse(readFileSync91(p, "utf8"));
   } catch {
     return;
   }
@@ -70276,8 +70471,8 @@ var init_seal_group = __esm(() => {
 });
 
 // ../../loki-ts/src/supply/supply_guard.ts
-import { existsSync as existsSync73, readFileSync as readFileSync91, statSync as statSync27 } from "fs";
-import { basename as basename27, join as join104 } from "path";
+import { existsSync as existsSync73, readFileSync as readFileSync92, statSync as statSync27 } from "fs";
+import { basename as basename27, join as join105 } from "path";
 function supplyEnabled(env) {
   return env["LOKI_SUPPLY_GUARD"] !== "0";
 }
@@ -70292,13 +70487,13 @@ function isManifestPath(path) {
   return MANIFESTS2.test(basename27(path));
 }
 function readDeclared(repoDir) {
-  const p = join104(repoDir, ".loki", DECLARED_FILE);
+  const p = join105(repoDir, ".loki", DECLARED_FILE);
   if (!existsSync73(p))
     return { deps: [], problem: null };
   try {
     if (statSync27(p).size > MAX_FILE_BYTES)
       return { deps: [], problem: "declaration file too large" };
-    const j10 = JSON.parse(readFileSync91(p, "utf8"));
+    const j10 = JSON.parse(readFileSync92(p, "utf8"));
     if (!Array.isArray(j10))
       return { deps: [], problem: "declaration is not a JSON array" };
     const deps = [];
@@ -70318,11 +70513,11 @@ function readDeclared(repoDir) {
   }
 }
 function readAllowlist(repoDir) {
-  const p = join104(repoDir, ".loki", "supply-allowlist");
+  const p = join105(repoDir, ".loki", "supply-allowlist");
   if (!existsSync73(p))
     return new Set;
   try {
-    return new Set(readFileSync91(p, "utf8").split(`
+    return new Set(readFileSync92(p, "utf8").split(`
 `).map((l) => l.replace(/#.*$/, "").trim()).filter(Boolean));
   } catch {
     return new Set;
@@ -70363,7 +70558,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "npm") {
     if (privateUrlList([env["npm_config_registry"] ?? "", env["NPM_CONFIG_REGISTRY"] ?? ""]))
       return true;
-    return files(join104(repoDir, ".npmrc"), home ? join104(home, ".npmrc") : "").some((t) => t.split(`
+    return files(join105(repoDir, ".npmrc"), home ? join105(home, ".npmrc") : "").some((t) => t.split(`
 `).some((l) => {
       const m = /^\s*(?:(@[^:\s]+):)?registry\s*=\s*(\S+)/.exec(l);
       return !!m && privateUrl(m[2]) && (m[1] === undefined || name.startsWith(`${m[1]}/`));
@@ -70372,7 +70567,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "pypi") {
     if (privateUrlList([env["PIP_INDEX_URL"] ?? "", env["PIP_EXTRA_INDEX_URL"] ?? ""]))
       return true;
-    const cfg = [env["PIP_CONFIG_FILE"] ?? "", home ? join104(home, ".config", "pip", "pip.conf") : "", home ? join104(home, ".pip", "pip.conf") : "", join104(repoDir, "pip.conf")];
+    const cfg = [env["PIP_CONFIG_FILE"] ?? "", home ? join105(home, ".config", "pip", "pip.conf") : "", home ? join105(home, ".pip", "pip.conf") : "", join105(repoDir, "pip.conf")];
     return files(...cfg).some((t) => t.split(`
 `).some((l) => {
       const m = /^\s*(?:extra-)?index-url\s*[=:]\s*(.+)$/.exec(l);
@@ -70382,7 +70577,7 @@ function userConfigPrivate(eco, repoDir, env, goEnv = {}, name = "") {
   if (eco === "cargo") {
     if (Object.keys(env).some((k3) => /^CARGO_REGISTRIES_.+_INDEX$/.test(k3) || /^CARGO_SOURCE_/.test(k3)))
       return true;
-    return files(join104(repoDir, ".cargo", "config.toml"), join104(repoDir, ".cargo", "config"), home ? join104(home, ".cargo", "config.toml") : "", home ? join104(home, ".cargo", "config") : "").some((t) => /^\s*\[(registries\.|source\.)/m.test(t) || /replace-with\s*=/.test(t));
+    return files(join105(repoDir, ".cargo", "config.toml"), join105(repoDir, ".cargo", "config"), home ? join105(home, ".cargo", "config.toml") : "", home ? join105(home, ".cargo", "config") : "").some((t) => /^\s*\[(registries\.|source\.)/m.test(t) || /replace-with\s*=/.test(t));
   }
   if (eco === "go") {
     const gp2 = goEnv["GOPROXY"] ?? env["GOPROXY"] ?? "";
@@ -70505,7 +70700,7 @@ var MIN_AGE_DAYS = 7, DECLARED_FILE = "supply-declared.json", MAX_CHECKED = 50,
   }
 }, PUBLIC_HOSTS, hostOf = (u10) => u10.trim().toLowerCase().replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^www\./, "").split(/[/?#\s]/)[0].replace(/^[^@]*@/, "").replace(/:\d+$/, ""), privateUrl = (u10) => /[a-z0-9]/i.test(u10) && !PUBLIC_HOSTS.has(hostOf(u10)), readSmall = (p) => {
   try {
-    return statSync27(p).size <= MAX_FILE_BYTES ? readFileSync91(p, "utf8") : "";
+    return statSync27(p).size <= MAX_FILE_BYTES ? readFileSync92(p, "utf8") : "";
   } catch {
     return "";
   }
@@ -70544,8 +70739,8 @@ __export(exports_seal, {
   AGENT_ONLY_REASON: () => AGENT_ONLY_REASON
 });
 import { createHash as createHash30 } from "crypto";
-import { existsSync as existsSync74, readdirSync as readdirSync31, mkdirSync as mkdirSync55, readFileSync as readFileSync92 } from "fs";
-import { basename as basename28, isAbsolute as isAbsolute20, join as join105, relative as relative24 } from "path";
+import { existsSync as existsSync74, readdirSync as readdirSync31, mkdirSync as mkdirSync55, readFileSync as readFileSync93 } from "fs";
+import { basename as basename28, isAbsolute as isAbsolute20, join as join106, relative as relative24 } from "path";
 async function leanSymbolGap(ctx, o, rawDiff, head, vraw) {
   if (externalRun(o) || Array.isArray(o.wall?.files) && o.wall.files.length > 0 || o.intake?.already_satisfied === true || o.implement?.exit === "already_done")
     return [];
@@ -70566,7 +70761,7 @@ async function leanSymbolGap(ctx, o, rawDiff, head, vraw) {
       const n11 = String(c.name ?? ""), p = n11.slice(n11.indexOf(":") + 1);
       if (n11.includes(":") && isTestFile(p))
         try {
-          sources2.push(readFileSync92(join105(ctx.repoDir, p), "utf8"));
+          sources2.push(readFileSync93(join106(ctx.repoDir, p), "utf8"));
         } catch {}
     }
   return symbolGap(changedSymbols(d.stdout), sources2);
@@ -70649,7 +70844,7 @@ function renderReceiptMd(r) {
 `);
 }
 var SIGNING_UNAVAILABLE = "receipt signing unavailable (no usable signing key: invalid key or unwritable ~/.loki/keys)", AGENT_ONLY_REASON = "only agent-authored tests executed (no agent-independent proof)", WALL_GREEN_ON_BASE_REASON = "Wall green on base: no Wall test discriminates the change", EXCLUDE_LOKI = ":(exclude).loki", sha2562 = (s) => createHash30("sha256").update(s).digest("hex"), str3 = (v3) => typeof v3 === "string" && v3 !== "" ? v3 : null, EXTERNAL_MODEL_LABEL = "external (no Loki implement session)", EXTERNAL_DIFF_NOT_ISOLATED = "Wall author not filesystem-isolated from the external diff", EXTERNAL_NO_WALL = "external diff sealed with no Wall file that ran; the only checks are the repo's existing tests", externalRun = (o) => o.implement?.exit === "external", LEAN_NO_SYMBOL = "no passing check references a changed symbol and no Wall file ran", strs2 = (v3) => Array.isArray(v3) ? v3.filter((x3) => typeof x3 === "string" && x3 !== "") : [], g = (ctx) => (a) => git9(ctx, a), receiptRel = (ctx) => {
-  const r = relative24(ctx.repoDir, join105(ctx.runDir, "receipt.json"));
+  const r = relative24(ctx.repoDir, join106(ctx.runDir, "receipt.json"));
   return r.startsWith("..") || isAbsolute20(r) ? `.loki/runs/${ctx.runId}/receipt.json` : r;
 }, commitStage, wallGreenOnBaseOf = (o) => {
   const b = o.wall?.base_run ?? {};
@@ -70791,7 +70986,7 @@ var init_seal = __esm(() => {
       if (wallNotRun > 0) {
         try {
           const kept = new Set((Array.isArray(o.wall?.files) ? o.wall.files : []).map((f) => basename28(String(f.path))));
-          for (const n11 of readdirSync31(join105(ctx.runDir, "wall")).sort())
+          for (const n11 of readdirSync31(join106(ctx.runDir, "wall")).sort())
             if (!kept.has(n11))
               notProven.add(`wall test discarded: ${n11} (not_run)`);
         } catch {}
@@ -70862,19 +71057,19 @@ var init_seal = __esm(() => {
       for (const [s, d] of Object.entries(o))
         if (typeof d?.duration_s === "number")
           stages[s] = d.duration_s;
-      const T = hooks.time, time = T ? T.build(ctx, stages, T.firstEventMs(join105(ctx.runDir, "events.jsonl"))) : { wall_s: Object.values(stages).reduce((a, b) => a + (b ?? 0), 0), stages }, totalS = T?.reconciled(time) ?? null;
+      const T = hooks.time, time = T ? T.build(ctx, stages, T.firstEventMs(join106(ctx.runDir, "events.jsonl"))) : { wall_s: Object.values(stages).reduce((a, b) => a + (b ?? 0), 0), stages }, totalS = T?.reconciled(time) ?? null;
       const iterIds = [...new Set([...Object.values(o).flatMap((d) => [...strs2(d?.iteration_ids), ...strs2([d?.iteration_id])]), ...ctx.sessionIds?.() ?? [], ...xr2?.cost_iteration ? [xr2.cost_iteration] : []])];
       if (iterIds.length === 0)
         notProven.add("cost not measured (no iteration ids recorded)");
       const cost = ctx.cost.read(ctx.repoDir, iterIds);
       if (cost.unmetered)
         notProven.add("cost unmetered (CLI invoker; recorded as 0)");
-      const eventsPath = join105(ctx.runDir, "events.jsonl");
+      const eventsPath = join106(ctx.runDir, "events.jsonl");
       const wallFiles = Array.isArray(o.wall?.files) ? o.wall.files : [];
       const wallPassed = typeof o.verify?.wall_passed === "boolean" ? o.verify.wall_passed : null;
       if (wallFiles.length > 0 && wallPassed === null)
         notProven.add("wall result not recorded by verify");
-      const routeBlock = buildRouteBlock(process.env, ctx.provider, o.implement?.route ?? o.plan?.route_record ?? (routerEnabled(process.env) ? loadRouteRecord(ctx.runDir) : undefined), cost.router ?? (routerEnabled(process.env) ? sumResultCosts(join105(ctx.repoDir, ".loki"), liveArchivedCosts(join105(ctx.repoDir, ".loki"), iterIds, UNMETERED)).router : undefined), ctx.model);
+      const routeBlock = buildRouteBlock(process.env, ctx.provider, o.implement?.route ?? o.plan?.route_record ?? (routerEnabled(process.env) ? loadRouteRecord(ctx.runDir) : undefined), cost.router ?? (routerEnabled(process.env) ? sumResultCosts(join106(ctx.repoDir, ".loki"), liveArchivedCosts(join106(ctx.repoDir, ".loki"), iterIds, UNMETERED)).router : undefined), ctx.model);
       if (routeBlock)
         for (const l of routeNotProven(routeBlock))
           notProven.add(l);
@@ -70917,7 +71112,7 @@ var init_seal = __esm(() => {
         model: externalRun(o) ? EXTERNAL_MODEL_LABEL : ctx.model,
         ...externalRun(o) ? { implement: { exit: "external", patch_sha256: str3(o.implement?.patch_sha256) ?? "" } } : {},
         resumed: o.intake?.resumed === true,
-        events_sha256: sha2562(existsSync74(eventsPath) ? readFileSync92(eventsPath) : ""),
+        events_sha256: sha2562(existsSync74(eventsPath) ? readFileSync93(eventsPath) : ""),
         ...await sealEvidence(ctx.repoDir, ctx.runDir, o, notProven, signal, ctx.emit),
         log_seal: true,
         toolchain: collectToolchain(),
@@ -70945,10 +71140,10 @@ var init_seal = __esm(() => {
       }
       const receipt = { ...body, receipt_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } };
       mkdirSync55(ctx.runDir, { recursive: true });
-      const path = join105(ctx.runDir, "receipt.json");
+      const path = join106(ctx.runDir, "receipt.json");
       atomicWriteText(path, JSON.stringify(receipt, null, 2) + `
 `);
-      atomicWriteText(join105(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
+      atomicWriteText(join106(ctx.runDir, "receipt.md"), renderReceiptMd(receipt));
       recordRun(process.env, ctx.repoDir, ranModel(o.implement, ctx.model, o.fix), verdict, cost.usd, cost.unmetered === true, totalS);
       try {
         hooks.sealed?.(ctx.runDir, JSON.parse(JSON.stringify(receipt), (_k2, v3) => v3 && typeof v3 === "object" ? Object.freeze(v3) : v3));
@@ -71022,7 +71217,7 @@ var init_github_token = __esm(() => {
 // ../../loki-ts/src/engine10/fetch_issue.ts
 import { execFileSync as execFileSync7 } from "child_process";
 import { writeFileSync as writeFileSync54 } from "fs";
-import { join as join106 } from "path";
+import { join as join107 } from "path";
 function defaultExec(cmd, args) {
   const ms = Number(process.env.LOKI_FETCH_ISSUE_TIMEOUT_MS) || 60000;
   return execFileSync7(cmd, args, { encoding: "utf8", env: process.env, timeout: ms, killSignal: "SIGKILL" });
@@ -71049,7 +71244,7 @@ function fetchIssueToFile(ref, outFile, exec = defaultExec) {
 var ISSUE_PROVIDERS_SH;
 var init_fetch_issue = __esm(() => {
   init_paths();
-  ISSUE_PROVIDERS_SH = join106(REPO_ROOT, "autonomy/issue-providers.sh");
+  ISSUE_PROVIDERS_SH = join107(REPO_ROOT, "autonomy/issue-providers.sh");
   if (false) {}
 });
 
@@ -71582,9 +71777,21 @@ var init_provider = __esm(() => {
 });
 
 // ../../loki-ts/src/util/funnel.ts
+function blockerOf(v3) {
+  return typeof v3 === "string" && PREFLIGHT_BLOCKERS.includes(v3) ? v3 : null;
+}
+function noteRefusal(b) {
+  if (b)
+    refusal = b;
+}
+function noteRefusalFromEvents(events2) {
+  noteRefusal(blockerOf(events2.find((e10) => e10.type === "stage.failed" && e10.stage === "intake")?.data["blocker"]));
+}
+var PREFLIGHT_BLOCKERS, refusal = null;
 var init_funnel = __esm(() => {
   init_paths();
   init_safe_git();
+  PREFLIGHT_BLOCKERS = ["not_a_repo", "git_identity", "dirty_tracked_tree", "no_provider", "not_logged_in", "prd_missing", "unsupported_flag", "disk", "other"];
 });
 
 // ../../loki-ts/src/cockpit/capability.ts
@@ -71597,14 +71804,14 @@ var init_capability = __esm(() => {
 var init_raster = () => {};
 
 // ../../loki-ts/src/commands/doctor.ts
-import { appendFileSync as appendFileSync11, writeFileSync as writeFileSync56, mkdirSync as mkdirSync56, accessSync as accessSync2, constants as fsConstants2, existsSync as existsSync75, lstatSync as lstatSync28, readdirSync as readdirSync32, readFileSync as readFileSync93, readlinkSync as readlinkSync6, realpathSync as realpathSync31, statSync as statSync29, statfsSync } from "fs";
+import { appendFileSync as appendFileSync11, writeFileSync as writeFileSync56, mkdirSync as mkdirSync56, accessSync as accessSync2, constants as fsConstants2, existsSync as existsSync75, lstatSync as lstatSync28, readdirSync as readdirSync32, readFileSync as readFileSync94, readlinkSync as readlinkSync6, realpathSync as realpathSync31, statSync as statSync29, statfsSync } from "fs";
 import { spawnSync as spawnSync12 } from "child_process";
 import { homedir as homedir12, tmpdir as tmpdir18 } from "os";
-import { join as join107, resolve as resolve31 } from "path";
+import { join as join108, resolve as resolve31 } from "path";
 function loadRequirements(file = REQUIREMENTS_FILE) {
   if (file === REQUIREMENTS_FILE && cached)
     return cached;
-  const t = JSON.parse(readFileSync93(file, "utf8"));
+  const t = JSON.parse(readFileSync94(file, "utf8"));
   if (file === REQUIREMENTS_FILE)
     cached = t;
   return t;
@@ -71635,7 +71842,7 @@ function providerLoginIssue(provider, cli, env) {
     const said = `${r.stdout}${r.stderr}`;
     return /not logged in/i.test(said) || classifyFailure(said).reason === "auth" ? { fatal: "codex is not logged in; run: codex login (or set OPENAI_API_KEY)" } : { warn: "could not confirm the Codex login (codex login status gave no answer); continuing" };
   }
-  if (PROVIDER_API_KEY_VARS.some(key) || provider === "opencode" && existsSync75(join107(env.XDG_DATA_HOME || join107(home, ".local", "share"), "opencode", "auth.json")) || provider === "cline" && existsSync75(join107(home, ".cline")))
+  if (PROVIDER_API_KEY_VARS.some(key) || provider === "opencode" && existsSync75(join108(env.XDG_DATA_HOME || join108(home, ".local", "share"), "opencode", "auth.json")) || provider === "cline" && existsSync75(join108(home, ".cline")))
     return null;
   return provider === "aider" || provider === "opencode" || provider === "cline" ? { warn: `no ${provider} login or API key found (set a provider API key such as ANTHROPIC_API_KEY or OPENAI_API_KEY${provider === "opencode" ? ", or run: opencode auth login" : ""}); continuing` } : null;
 }
@@ -71646,9 +71853,9 @@ function providerAuthPath(provider, env) {
   const v3 = own.find(set);
   if (v3)
     return `${v3 === "CLAUDE_CODE_OAUTH_TOKEN" ? "oauth_token" : "api_key"}:${v3}`;
-  if (provider === "opencode" && existsSync75(join107(env.XDG_DATA_HOME || join107(home, ".local", "share"), "opencode", "auth.json")))
+  if (provider === "opencode" && existsSync75(join108(env.XDG_DATA_HOME || join108(home, ".local", "share"), "opencode", "auth.json")))
     return "cli_login:opencode";
-  if (provider === "cline" && existsSync75(join107(home, ".cline")))
+  if (provider === "cline" && existsSync75(join108(home, ".cline")))
     return "cli_login:cline";
   return provider === "claude" || provider === "codex" ? `cli_login:${provider}` : "none";
 }
@@ -71673,9 +71880,9 @@ function claudeAuthStatusLoggedIn(cli = "claude", env = process.env) {
   }
 }
 function claudeLoginProbeCached(cli, env = process.env, now2 = Date.now()) {
-  const file = join107(env.HOME || homedir12(), ".loki", "claude-login-ok.json");
+  const file = join108(env.HOME || homedir12(), ".loki", "claude-login-ok.json");
   try {
-    const c = JSON.parse(readFileSync93(file, "utf8"));
+    const c = JSON.parse(readFileSync94(file, "utf8"));
     if (c?.cli === cli && typeof c.at === "number" && now2 - c.at >= 0 && now2 - c.at < CLAUDE_LOGIN_TTL_MS)
       return "yes";
   } catch {}
@@ -71684,7 +71891,7 @@ function claudeLoginProbeCached(cli, env = process.env, now2 = Date.now()) {
     li2 = claudeAuthStatusLoggedIn(cli, env);
   if (li2 === "yes") {
     try {
-      mkdirSync56(join107(file, ".."), { recursive: true });
+      mkdirSync56(join108(file, ".."), { recursive: true });
       writeFileSync56(file, JSON.stringify({ cli, at: now2 }));
     } catch {}
   }
@@ -71693,16 +71900,16 @@ function claudeLoginProbeCached(cli, env = process.env, now2 = Date.now()) {
 async function ghAuthProbeCached(env, probe, now2 = Date.now()) {
   const bin = "gh";
   const gh = Bun.which(bin, { PATH: env.PATH ?? process.env.PATH ?? "" }) ?? bin;
-  const file = join107(env.HOME || homedir12(), ".loki", "gh-auth-ok.json");
+  const file = join108(env.HOME || homedir12(), ".loki", "gh-auth-ok.json");
   try {
-    const c = JSON.parse(readFileSync93(file, "utf8"));
+    const c = JSON.parse(readFileSync94(file, "utf8"));
     if (c?.gh === gh && typeof c.at === "number" && now2 - c.at >= 0 && now2 - c.at < CLAUDE_LOGIN_TTL_MS)
       return true;
   } catch {}
   const ok3 = await probe();
   if (ok3) {
     try {
-      mkdirSync56(join107(file, ".."), { recursive: true });
+      mkdirSync56(join108(file, ".."), { recursive: true });
       writeFileSync56(file, JSON.stringify({ gh, at: now2 }));
     } catch {}
   }
@@ -71777,7 +71984,7 @@ var init_first_run_repo = __esm(() => {
 
 // ../../loki-ts/src/engine10/preflight.ts
 import { accessSync as accessSync3, constants as fsc2, mkdirSync as mkdirSync57, statfsSync as statfsSync2, writeFileSync as writeFileSync57 } from "fs";
-import { join as join108 } from "path";
+import { join as join109 } from "path";
 async function sh3(argv, opts) {
   try {
     return await run(argv, opts);
@@ -71819,18 +72026,19 @@ async function checkPreflight(o) {
       pinErr = `${e10.message}; set a valid value or unset it (the run would otherwise drop the pin and use the provider default model)`;
     }
   }
-  const fatal = wt.exitCode !== 0 || wt.stdout.trim() !== "true" ? initFatal ?? NOT_A_REPO(o.repoDir) : !name.stdout.trim() || !email.stdout.trim() ? `git identity is not set; run: git config user.name "you" && git config user.email "you@example.com"` : !envVar ? `the v10 engine has no ${o.provider} invoker yet` : o.provider !== "claude" && truthy(env["LOKI_HOST_GUARD"]) ? `LOKI_HOST_GUARD=1 is set but provider '${o.provider}' has no enforced PreToolUse hook; unset LOKI_HOST_GUARD or use --provider claude` : pinErr ? pinErr : !cliOk ? `provider CLI '${cli}' is not on PATH; install it or set ${envVar} to its path${requirementFix(o.provider) ? `. Fix: ${requirementFix(o.provider)}` : ""}` : head.exitCode !== 0 ? "repository has no commits; run: git add . && git commit -m init" : null;
-  if (fatal)
-    return { fatal, warnings };
+  const refuse = (b, f) => [b, f];
+  const hit = wt.exitCode !== 0 || wt.stdout.trim() !== "true" ? refuse("not_a_repo", initFatal ?? NOT_A_REPO(o.repoDir)) : !name.stdout.trim() || !email.stdout.trim() ? refuse("git_identity", `git identity is not set; run: git config user.name "you" && git config user.email "you@example.com"`) : !envVar ? refuse("unsupported_flag", `the v10 engine has no ${o.provider} invoker yet`) : o.provider !== "claude" && truthy(env["LOKI_HOST_GUARD"]) ? refuse("other", `LOKI_HOST_GUARD=1 is set but provider '${o.provider}' has no enforced PreToolUse hook; unset LOKI_HOST_GUARD or use --provider claude`) : pinErr ? refuse("other", pinErr) : !cliOk ? refuse("no_provider", `provider CLI '${cli}' is not on PATH; install it or set ${envVar} to its path${requirementFix(o.provider) ? `. Fix: ${requirementFix(o.provider)}` : ""}`) : head.exitCode !== 0 ? refuse("other", "repository has no commits; run: git add . && git commit -m init") : null;
+  if (hit)
+    return { fatal: hit[1], warnings, blocker: hit[0] };
   try {
     accessSync3(o.repoDir, fsc2.W_OK);
   } catch {
-    return { fatal: `${o.repoDir} is not writable; run: chmod u+w "${o.repoDir}" (or run loki from a writable checkout)`, warnings };
+    return { fatal: `${o.repoDir} is not writable; run: chmod u+w "${o.repoDir}" (or run loki from a writable checkout)`, warnings, blocker: "other" };
   }
   const free = freeMb(o.repoDir, o.statfs ?? statfsSync2);
   const minMb = Number(env["LOKI_MIN_FREE_MB"]) > 0 ? Number(env["LOKI_MIN_FREE_MB"]) : 200;
   if (free !== null && free < minMb)
-    return { fatal: `only ${Math.floor(free)} MB free on the volume holding ${o.repoDir} (need ${minMb} MB); free disk space, or lower LOKI_MIN_FREE_MB`, warnings };
+    return { fatal: `only ${Math.floor(free)} MB free on the volume holding ${o.repoDir} (need ${minMb} MB); free disk space, or lower LOKI_MIN_FREE_MB`, warnings, blocker: "disk" };
   if (free !== null && free < Math.max(2048, minMb))
     warnings.push(`low disk: ${Math.floor(free)} MB free on the volume holding ${o.repoDir}; a long run may fail mid-way (warns under 2 GB)`);
   const auth_path = providerAuthPath(o.provider, env);
@@ -71861,16 +72069,16 @@ async function checkPreflight(o) {
   if (o.runDir) {
     try {
       mkdirSync57(o.runDir, { recursive: true });
-      writeFileSync57(join108(o.runDir, "preflight.json"), JSON.stringify({ provider: o.provider, auth_path, probe }) + `
+      writeFileSync57(join109(o.runDir, "preflight.json"), JSON.stringify({ provider: o.provider, auth_path, probe }) + `
 `);
     } catch {}
   }
   if (authFatal)
-    return { fatal: authFatal, warnings };
+    return { fatal: authFatal, warnings, blocker: "not_logged_in" };
   if (o.pr && GITHUB_ORIGIN_RE.test((await git10(["config", "--get", "remote.origin.url"])).stdout.trim())) {
     const ghOk = await ghAuthProbeCached(env, async () => (await sh3(["gh", "--version"], { env, timeoutMs: 5000 })).exitCode === 0 && (await sh3(["gh", "auth", "status"], { env, timeoutMs: 1e4 })).exitCode === 0);
     if (!ghOk)
-      return { fatal: `gh (GitHub CLI) is missing or not authenticated; run gh auth login, or pass --no-pr`, warnings };
+      return { fatal: `gh (GitHub CLI) is missing or not authenticated; run gh auth login, or pass --no-pr`, warnings, blocker: "other" };
     const plan = await probePublish((await git10(["config", "--get", "remote.origin.url"])).stdout.trim(), env);
     if (plan) {
       if (plan.warning)
@@ -71887,7 +72095,7 @@ async function assertPreflight(o) {
     process.stderr.write(`${w}
 `);
   if (r.fatal)
-    throw new PreflightError(r.fatal);
+    throw new PreflightError(r.fatal, r.blocker);
 }
 var CLI_ENV_VAR, GITHUB_ORIGIN_RE, PreflightError;
 var init_preflight = __esm(() => {
@@ -71898,9 +72106,15 @@ var init_preflight = __esm(() => {
   init_first_run_repo();
   init_engine_origin();
   init_shell();
+  init_funnel();
   CLI_ENV_VAR = { claude: "LOKI_CLAUDE_CLI", codex: "LOKI_CODEX_CLI", cline: "LOKI_CLINE_CLI", aider: "LOKI_AIDER_CLI", opencode: "LOKI_OPENCODE_CLI" };
   GITHUB_ORIGIN_RE = /^(?:https:\/\/(?:[^@/]+@)?github\.com\/|git@github\.com:|ssh:\/\/git@github\.com\/)/;
   PreflightError = class PreflightError extends Error {
+    blocker;
+    constructor(message, blocker = "other") {
+      super(message);
+      this.blocker = blocker;
+    }
   };
 });
 
@@ -71909,7 +72123,7 @@ var exports_ship_hook = {};
 __export(exports_ship_hook, {
   startShip: () => startShip
 });
-import { dirname as dirname44 } from "path";
+import { dirname as dirname45 } from "path";
 async function startShip(repoDir, eventsPath, env) {
   let url = shipEnabled(env);
   if (!url) {
@@ -71919,7 +72133,7 @@ async function startShip(repoDir, eventsPath, env) {
   }
   if (!url)
     return;
-  startShipLoop({ runDir: dirname44(eventsPath), url, source: sourceId(repoDir), token: env.LOKI_CONTROL_TOKEN });
+  startShipLoop({ runDir: dirname45(eventsPath), url, source: sourceId(repoDir), token: env.LOKI_CONTROL_TOKEN });
 }
 var init_ship_hook = __esm(() => {
   init_discover();
@@ -72526,10 +72740,10 @@ __export(exports_run_group, {
   groupCostLine: () => groupCostLine,
   NOT_PROVEN: () => NOT_PROVEN
 });
-import { cpSync as cpSync2, existsSync as existsSync76, mkdirSync as mkdirSync58, readdirSync as readdirSync34, readFileSync as readFileSync94, rmSync as rmSync32, statSync as statSync30 } from "fs";
+import { cpSync as cpSync2, existsSync as existsSync76, mkdirSync as mkdirSync58, readdirSync as readdirSync34, readFileSync as readFileSync95, rmSync as rmSync32, statSync as statSync30 } from "fs";
 import { createHash as createHash31 } from "crypto";
 import { spawn as spawn12 } from "child_process";
-import { join as join109, resolve as resolve32 } from "path";
+import { join as join110, resolve as resolve32 } from "path";
 function scopedEnv(env) {
   const out3 = {};
   for (const [k3, v3] of Object.entries(env))
@@ -72566,7 +72780,7 @@ function groupCostLine(costs, provider = "claude") {
 `;
 }
 function writeGroupCostRecord(repoDir, name, costs, provider) {
-  const dir = join109(repoDir, ".loki", "metrics", "efficiency");
+  const dir = join110(repoDir, ".loki", "metrics", "efficiency");
   const timestamp = new Date().toISOString();
   try {
     const base = { phase: "implement", provider, status: "group", kind: "group_cost", timestamp };
@@ -72580,7 +72794,7 @@ function writeGroupCostRecord(repoDir, name, costs, provider) {
     if (recs.length === 0)
       return;
     mkdirSync58(dir, { recursive: true });
-    recs.forEach((r, k3) => atomicWriteJson(join109(dir, `iteration-group-${name}-${String(k3).padStart(3, "0")}.json`), r));
+    recs.forEach((r, k3) => atomicWriteJson(join110(dir, `iteration-group-${name}-${String(k3).padStart(3, "0")}.json`), r));
   } catch {}
 }
 function testCommand(repoDir, env) {
@@ -72593,7 +72807,7 @@ function testCommand(repoDir, env) {
   return [];
 }
 function findResumable(repoDir, specSha, unitIds) {
-  const root = join109(repoDir, ".loki", "groups");
+  const root = join110(repoDir, ".loki", "groups");
   let names = [];
   try {
     names = readdirSync34(root);
@@ -72604,7 +72818,7 @@ function findResumable(repoDir, specSha, unitIds) {
   for (const gid of names) {
     if (!GID_RE.test(gid))
       continue;
-    const p = join109(root, gid, "dag.json"), d = readJson8(p);
+    const p = join110(root, gid, "dag.json"), d = readJson8(p);
     if (!d || (unitIds ? JSON.stringify((Array.isArray(d["units"]) ? d["units"] : []).filter((u10) => !u10.fixKind).map((u10) => u10.id)) !== JSON.stringify(unitIds) : d["spec_sha256"] !== specSha) || typeof d["base_ref"] !== "string" || !Array.isArray(d["units"]))
       continue;
     let at2 = 0;
@@ -72621,7 +72835,7 @@ function findResumable(repoDir, specSha, unitIds) {
 async function unitDone(verifyReceipt, repoDir, gid, n11, id2) {
   if (!UNIT_ID_RE.test(id2))
     return false;
-  const rp = join109(repoDir, ".loki", "groups", gid, "group", "units", id2, "receipt.json");
+  const rp = join110(repoDir, ".loki", "groups", gid, "group", "units", id2, "receipt.json");
   const rec2 = readJson8(rp);
   if (!rec2 || rec2["verdict"] !== "VERIFIED")
     return false;
@@ -72636,7 +72850,7 @@ async function adoptJournaled(verifyReceipt, repoDir, dir, key, gid, n11, id2, t
     return false;
   if (!await unitDone(verifyReceipt, repoDir, e10.gid, e10.n, id2))
     return false;
-  const signed = readJson8(join109(repoDir, ".loki", "groups", e10.gid, "group", "units", id2, "receipt.json"));
+  const signed = readJson8(join110(repoDir, ".loki", "groups", e10.gid, "group", "units", id2, "receipt.json"));
   const signedTask = (signed?.["task"] ?? {}).sha256;
   const signedSpec = (signed?.["unit_spec"] ?? {}).sha256;
   if (typeof signedSpec !== "string" || signedSpec === "" || signedSpec !== specSha)
@@ -72646,9 +72860,9 @@ async function adoptJournaled(verifyReceipt, repoDir, dir, key, gid, n11, id2, t
   const tip = git11(repoDir, ["rev-parse", "--verify", "--quiet", `refs/heads/loki/unit-${e10.gid}-${e10.n}`]);
   if (tip === "" || tip !== e10.head)
     return false;
-  const dst = join109(repoDir, ".loki", "groups", gid, "group", "units", id2);
+  const dst = join110(repoDir, ".loki", "groups", gid, "group", "units", id2);
   rmSync32(dst, { recursive: true, force: true });
-  cpSync2(join109(repoDir, ".loki", "groups", e10.gid, "group", "units", id2), dst, { recursive: true });
+  cpSync2(join110(repoDir, ".loki", "groups", e10.gid, "group", "units", id2), dst, { recursive: true });
   if (safeGitSpawn(repoDir, ["update-ref", `refs/heads/loki/unit-${gid}-${n11}`, tip], { encoding: "utf8" }).status !== 0)
     return false;
   if (!await unitDone(verifyReceipt, repoDir, gid, n11, id2))
@@ -72683,8 +72897,8 @@ async function runGroup(launcher, dag, ctx) {
   const revised = resumable !== null && exact === null;
   const changed = new Set;
   const groupId = resumable?.gid ?? `g${Date.now().toString(36)}`;
-  const groupDir = join109(repoDir, ".loki", "groups", groupId);
-  const receiptPath = join109(groupDir, "receipt.json");
+  const groupDir = join110(repoDir, ".loki", "groups", groupId);
+  const receiptPath = join110(groupDir, "receipt.json");
   const slugOf = () => originSlug(repoDir);
   let baseRef;
   let startBranch = "";
@@ -72776,10 +72990,10 @@ async function runGroup(launcher, dag, ctx) {
   const accOf = new Map;
   for (const cu2 of Array.isArray(gc2?.["units"]) ? gc2["units"] : [])
     accOf.set(cu2.id, cu2.criteria.map((c) => c.text));
-  const specDir = join109(groupDir, "unit_specs");
+  const specDir = join110(groupDir, "unit_specs");
   mkdirSync58(specDir, { recursive: true });
   for (const u10 of units) {
-    const spec = join109(specDir, `${u10.id}.json`);
+    const spec = join110(specDir, `${u10.id}.json`);
     const isFix = !!u10.fixKind;
     if (!isFix)
       u10.base = baseRef;
@@ -72805,19 +73019,19 @@ async function runGroup(launcher, dag, ctx) {
         say(`loki: unit ${u10.id} skipped-unchanged
 `);
     } else if (resumable && UNIT_ID_RE.test(u10.id))
-      rmSync32(join109(groupDir, "group", "units", u10.id), { recursive: true, force: true });
+      rmSync32(join110(groupDir, "group", "units", u10.id), { recursive: true, force: true });
   }
   const cut2 = units.findIndex((u10) => u10.fixKind && !u10.done);
   if (cut2 >= 0)
     for (const u10 of units.splice(cut2)) {
       if (u10.done)
         doneCount--;
-      rmSync32(join109(groupDir, "group", "units", u10.id), { recursive: true, force: true });
+      rmSync32(join110(groupDir, "group", "units", u10.id), { recursive: true, force: true });
     }
   if (resumable)
     say(`loki: resuming group ${groupId}: ${doneCount} of ${units.length} units already VERIFIED
 `);
-  const dagPath = join109(groupDir, "dag.json");
+  const dagPath = join110(groupDir, "dag.json");
   atomicWriteJson(dagPath, { group: groupId, spec_sha256: specSha, base_ref: baseRef, start_branch: startBranch, ...full, units });
   try {
     const chk = await checkDecomposable(full, { map: (() => {
@@ -72847,7 +73061,7 @@ async function runGroup(launcher, dag, ctx) {
     const n11 = Math.min(slots, pending);
     say(`loki: group ${groupId}: ${units.length} units, ${n11} parallel slot(s) (provider ${provider})
 `);
-    const backlog = join109(REPO_ROOT, "autonomy", "lib", "backlog.py");
+    const backlog = join110(REPO_ROOT, "autonomy", "lib", "backlog.py");
     const feed = createGroupFeed(groupId, units, createGroupRenderer({ write: say, isTTY: false }));
     const res = await run2([backlog, slug, "--dag", dagPath, "--group", groupId, "--slots", String(n11), "--provider", provider], scopedEnv({ ...env, LOKI_PROVIDER: provider }), repoDir, (c) => feed.feed(c));
     launchCode = res.code;
@@ -72887,7 +73101,7 @@ async function runGroup(launcher, dag, ctx) {
   const testCmd = testCommand(repoDir, env), fixes = units.filter((u10) => u10.fixKind);
   const putDag = (us2) => atomicWriteJson(dagPath, { group: groupId, spec_sha256: specSha, base_ref: baseRef, start_branch: startBranch, ...full, units: us2 });
   const launchFix = async (fix) => {
-    const key = `unit-${groupId}-${units.length + 1}`, spec = join109(specDir, `${fix.id}.json`), slug = slugOf();
+    const key = `unit-${groupId}-${units.length + 1}`, spec = join110(specDir, `${fix.id}.json`), slug = slugOf();
     if (!slug)
       return null;
     atomicWriteJson(spec, { id: fix.id, writeSet: fix.writeSet, pack: fix.writeSet, tokenBudget: 1e9, acceptance: fix.acceptance });
@@ -72896,7 +73110,7 @@ async function runGroup(launcher, dag, ctx) {
     fix.base = git11(repoDir, ["rev-parse", "HEAD"]);
     units.push(fix);
     putDag(units.map((u10) => u10 === fix ? u10 : { ...u10, done: true }));
-    const res = await run2([join109(REPO_ROOT, "autonomy", "lib", "backlog.py"), slug, "--dag", dagPath, "--group", groupId, "--slots", "1", "--provider", provider], scopedEnv({ ...env, LOKI_PROVIDER: provider }), repoDir);
+    const res = await run2([join110(REPO_ROOT, "autonomy", "lib", "backlog.py"), slug, "--dag", dagPath, "--group", groupId, "--slots", "1", "--provider", provider], scopedEnv({ ...env, LOKI_PROVIDER: provider }), repoDir);
     costs.push(parseGroupCost(res.stdout));
     if (res.code !== 0 || !new RegExp(`^backlog: ${key} (VERIFIED|PR \\S+)$`, "m").test(res.stdout)) {
       units.pop();
@@ -72930,7 +73144,7 @@ async function runGroup(launcher, dag, ctx) {
     return 1;
   }
   const order2 = units.map((u10) => ({ unit_id: u10.id, goal: u10.items.join("; "), files: u10.writeSet }));
-  atomicWriteJson(join109(groupDir, "group", "manifest.json"), { group_id: groupId, units: order2 });
+  atomicWriteJson(join110(groupDir, "group", "manifest.json"), { group_id: groupId, units: order2 });
   const head = git11(repoDir, ["rev-parse", "--verify", `refs/heads/${r.branch}`]);
   let verdict = "", unitVerdicts = [], why = "";
   try {
@@ -72976,7 +73190,7 @@ var NOT_PROVEN = 4, ENV_KEEP, defaultLauncher = (argv, env, cwd, onOut) => new P
   return r.status === 0 ? String(r.stdout).trim() : "";
 }, SLUG_RE, originSlug = (repoDir) => SLUG_RE.exec(git11(repoDir, ["remote", "get-url", "origin"]))?.[1], sha2563 = (s) => createHash31("sha256").update(s).digest("hex"), UNIT_ID_RE, GID_RE, readJson8 = (p) => {
   try {
-    const v3 = JSON.parse(readFileSync94(p, "utf8"));
+    const v3 = JSON.parse(readFileSync95(p, "utf8"));
     return v3 !== null && typeof v3 === "object" && !Array.isArray(v3) ? v3 : null;
   } catch {
     return null;
@@ -73011,7 +73225,7 @@ __export(exports_route, {
   MAX_SPEC_BYTES: () => MAX_SPEC_BYTES2,
   MAX_SEQ_TASK_BYTES: () => MAX_SEQ_TASK_BYTES
 });
-import { closeSync as closeSync15, constants as constants5, fstatSync as fstatSync8, openSync as openSync15, readFileSync as readFileSync95, realpathSync as realpathSync32 } from "fs";
+import { closeSync as closeSync15, constants as constants5, fstatSync as fstatSync8, openSync as openSync15, readFileSync as readFileSync96, realpathSync as realpathSync32 } from "fs";
 import { isAbsolute as isAbsolute21, relative as relative25, resolve as resolve33 } from "path";
 function providerSlots(env, provider) {
   provider = (provider || env.LOKI_PROVIDER || "claude").toLowerCase();
@@ -73038,7 +73252,7 @@ function readSpec(task, repoDir, cwd) {
       return { kind: "text" };
     if (st2.size > MAX_SPEC_BYTES2)
       return { kind: "reject", reason: `spec file over ${MAX_SPEC_BYTES2} bytes` };
-    const buf = readFileSync95(fd2);
+    const buf = readFileSync96(fd2);
     if (buf.length > MAX_SPEC_BYTES2)
       return { kind: "reject", reason: `spec file over ${MAX_SPEC_BYTES2} bytes` };
     if (buf.includes(0))
@@ -73157,15 +73371,15 @@ var init_route = __esm(() => {
 });
 
 // ../../loki-ts/src/contrib/forecast.ts
-import { appendFileSync as appendFileSync12, existsSync as existsSync77, mkdirSync as mkdirSync59, readFileSync as readFileSync96 } from "fs";
-import { join as join110 } from "path";
+import { appendFileSync as appendFileSync12, existsSync as existsSync77, mkdirSync as mkdirSync59, readFileSync as readFileSync97 } from "fs";
+import { join as join111 } from "path";
 function readWindowDeltas(lokiDir2) {
   const p = historyPath2(lokiDir2);
   if (!existsSync77(p))
     return [];
   const out3 = [];
   try {
-    for (const line2 of readFileSync96(p, "utf8").split(`
+    for (const line2 of readFileSync97(p, "utf8").split(`
 `)) {
       if (!line2.trim())
         continue;
@@ -73216,17 +73430,17 @@ function forecastLine(reading, history, opts = {}) {
   const w = range(history.map((h10) => h10.week));
   return fit(`forecast: ~${s}% of session window, ~${w}% of week (basis: ${history.length} past runs; ${used})`, width);
 }
-async function printForecast(lokiDir2, read2, write, env = process.env) {
+async function printForecast(lokiDir2, read3, write, env = process.env) {
   if (!forecastOn(env))
     return;
   try {
-    const line2 = forecastLine(await read2(), readWindowDeltas(lokiDir2), { env });
+    const line2 = forecastLine(await read3(), readWindowDeltas(lokiDir2), { env });
     if (line2)
       write(line2 + `
 `);
   } catch {}
 }
-var MIN_FORECAST_RUNS = 3, KEEP_RUNS = 20, forecastOn = (env = process.env) => env["LOKI_FORECAST"] !== "0", finite = (v3) => typeof v3 === "number" && Number.isFinite(v3), historyPath2 = (lokiDir2) => join110(lokiDir2, "quota-runs.jsonl"), range = (xs2) => {
+var MIN_FORECAST_RUNS = 3, KEEP_RUNS = 20, forecastOn = (env = process.env) => env["LOKI_FORECAST"] !== "0", finite = (v3) => typeof v3 === "number" && Number.isFinite(v3), historyPath2 = (lokiDir2) => join111(lokiDir2, "quota-runs.jsonl"), range = (xs2) => {
   const lo = Math.floor(Math.min(...xs2)), hi2 = Math.ceil(Math.max(...xs2));
   return lo === hi2 ? `${hi2}` : `${lo}-${hi2}`;
 };
@@ -73235,8 +73449,8 @@ var init_forecast = __esm(() => {
 });
 
 // ../../loki-ts/src/commands/queue.ts
-import { existsSync as existsSync78, mkdirSync as mkdirSync60, readFileSync as readFileSync97, readdirSync as readdirSync35, renameSync as renameSync21, statSync as statSync31, writeFileSync as writeFileSync58 } from "fs";
-import { join as join111, resolve as resolve34 } from "path";
+import { existsSync as existsSync78, mkdirSync as mkdirSync60, readFileSync as readFileSync98, readdirSync as readdirSync35, renameSync as renameSync21, statSync as statSync31, writeFileSync as writeFileSync58 } from "fs";
+import { join as join112, resolve as resolve34 } from "path";
 function normalizeRef(raw2) {
   const m = URL_RE2.exec(raw2);
   if (m)
@@ -73246,11 +73460,11 @@ function normalizeRef(raw2) {
   return /^0+$/.test(raw2.replace(/^.*#/, "")) ? null : raw2;
 }
 function queuePath(lokiDir2) {
-  return join111(lokiDir2, "issue-queue.json");
+  return join112(lokiDir2, "issue-queue.json");
 }
 function readQueue(lokiDir2) {
   try {
-    const d = JSON.parse(readFileSync97(queuePath(lokiDir2), "utf8"));
+    const d = JSON.parse(readFileSync98(queuePath(lokiDir2), "utf8"));
     return Array.isArray(d.items) ? d.items.filter((i) => typeof i?.ref === "string") : [];
   } catch {
     return [];
@@ -73261,7 +73475,7 @@ function quarantineCorruptQueue(lokiDir2, now2, warn) {
   if (!existsSync78(p))
     return;
   try {
-    const d = JSON.parse(readFileSync97(p, "utf8"));
+    const d = JSON.parse(readFileSync98(p, "utf8"));
     if (d !== null && typeof d === "object" && Array.isArray(d.items))
       return;
   } catch {}
@@ -73463,8 +73677,8 @@ ${QUEUE_USAGE}`);
   try {
     mkdirSync60(d.lokiDir, { recursive: true });
     const stamp2 = finished.toISOString().replace(/[:.]/g, "-");
-    writeFileSync58(join111(d.lokiDir, `queue-digest-${stamp2}.txt`), text4);
-    writeFileSync58(join111(d.lokiDir, "queue-digest-latest.txt"), text4);
+    writeFileSync58(join112(d.lokiDir, `queue-digest-${stamp2}.txt`), text4);
+    writeFileSync58(join112(d.lokiDir, "queue-digest-latest.txt"), text4);
   } catch (e10) {
     d.err(`loki queue: could not write digest: ${e10 instanceof Error ? e10.message : String(e10)}
 `);
@@ -73474,11 +73688,11 @@ ${QUEUE_USAGE}`);
 }
 function newestRecord(lokiDir2, since) {
   for (const [sub2, file] of [["runs", "receipt.json"], ["proofs", "proof.json"]]) {
-    const dir = join111(lokiDir2, sub2);
+    const dir = join112(lokiDir2, sub2);
     let best = null;
     try {
       for (const name of readdirSync35(dir)) {
-        const p = join111(dir, name, file);
+        const p = join112(dir, name, file);
         if (!existsSync78(p))
           continue;
         const t = statSync31(p).mtimeMs;
@@ -73487,7 +73701,7 @@ function newestRecord(lokiDir2, since) {
       }
       if (!best)
         continue;
-      const d = JSON.parse(readFileSync97(best.p, "utf8"));
+      const d = JSON.parse(readFileSync98(best.p, "utf8"));
       const usd = d.cost?.usd;
       const unmetered = d.cost?.source === "cli-invoker-unmetered";
       return {
@@ -73521,7 +73735,7 @@ function makeDefaultRunner(lokiDir2) {
   return async (ref, opts) => {
     const since = Date.now();
     const argv = [resolve34(REPO_ROOT, "bin", "loki"), ...queueStartArgs(ref, !!opts.pr)];
-    const runLoki = opts.cwd ? join111(opts.cwd, ".loki") : lokiDir2;
+    const runLoki = opts.cwd ? join112(opts.cwd, ".loki") : lokiDir2;
     const env = runnerEnv(opts, runLoki);
     const proc = Bun.spawn(argv, { stdout: "pipe", stderr: "pipe", stdin: "ignore", env, ...opts.cwd ? { cwd: opts.cwd } : {} });
     const mins2 = itemTimeoutMin(process.env["LOKI_QUEUE_ITEM_TIMEOUT_MIN"]);
@@ -73531,9 +73745,9 @@ function makeDefaultRunner(lokiDir2) {
     clearTimeout(timer);
     const output = so + se2;
     try {
-      const logDir = join111(lokiDir2, "queue-logs");
+      const logDir = join112(lokiDir2, "queue-logs");
       mkdirSync60(logDir, { recursive: true });
-      writeFileSync58(join111(logDir, `${(opts.logName ?? ref).replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 120)}.log`), output);
+      writeFileSync58(join112(logDir, `${(opts.logName ?? ref).replace(/[^A-Za-z0-9_.-]/g, "_").slice(0, 120)}.log`), output);
     } catch {}
     const proof = newestRecord(runLoki, since);
     return { rc: rc2, output, verdict: proof.verdict, costUsd: proof.costUsd, runId: proof.runId ?? null };
@@ -73713,13 +73927,13 @@ function renderEpicTree(n11, title, rows) {
 }
 function makeSessionDecompose(repoDir, lokiDir2, provider) {
   return async (slug, issue, triageReason) => {
-    const { mkdirSync: mkdirSync61, readFileSync: readFileSync98, existsSync: existsSync79 } = await import("fs");
-    const { join: join112 } = await import("path");
+    const { mkdirSync: mkdirSync61, readFileSync: readFileSync99, existsSync: existsSync79 } = await import("fs");
+    const { join: join113 } = await import("path");
     const { createSessionRunner: createSessionRunner2 } = await Promise.resolve().then(() => (init_session(), exports_session));
     const { envOverride: envOverride2 } = await Promise.resolve().then(() => (init_decision(), exports_decision));
-    const dir = join112(lokiDir2, "issues-run", "decompose");
+    const dir = join113(lokiDir2, "issues-run", "decompose");
     mkdirSync61(dir, { recursive: true });
-    const outPath = join112(dir, `issue-${issue.number}-${Date.now()}.json`);
+    const outPath = join113(dir, `issue-${issue.number}-${Date.now()}.json`);
     const runner = createSessionRunner2({ provider, lokiRoot: lokiDir2 });
     const r = await runner.run({
       stage: "plan",
@@ -73732,7 +73946,7 @@ function makeSessionDecompose(repoDir, lokiDir2, provider) {
       ...provider === "claude" && envOverride2(process.env) === null ? { model: "opus" } : {}
     });
     if (existsSync79(outPath))
-      return readFileSync98(outPath, "utf8");
+      return readFileSync99(outPath, "utf8");
     return r.summary ?? "";
   };
 }
@@ -73759,7 +73973,7 @@ __export(exports_issues_run, {
 import { spawnSync as spawnSync15 } from "child_process";
 import { cpSync as cpSync3, existsSync as existsSync79, mkdirSync as mkdirSync61, mkdtempSync as mkdtempSync15, rmSync as rmSync33, writeFileSync as writeFileSync59 } from "fs";
 import { tmpdir as tmpdir19 } from "os";
-import { join as join112, resolve as resolve35 } from "path";
+import { join as join113, resolve as resolve35 } from "path";
 import { createInterface as createInterface3 } from "readline";
 function parseIssuesArgs(args) {
   const a = { slug: null, label: null, milestone: null, limit: DEFAULT_LIMIT, parallel: 1, draft: false, dryRun: false, yes: false, comment: false, split: true, json: false };
@@ -74015,7 +74229,7 @@ ${USAGE}`);
     }
   }
   const stamp2 = started.toISOString().replace(/[:.]/g, "-");
-  const runDir = join112(d.lokiDir, "issues-run", stamp2);
+  const runDir = join113(d.lokiDir, "issues-run", stamp2);
   mkdirSync61(runDir, { recursive: true });
   const byRef = new Map(actionable.map((i) => [`${slug}#${i.number}`, i]));
   const sink = () => {};
@@ -74105,14 +74319,14 @@ ${USAGE}`);
 ${trees.join(`
 `)}` : "");
   try {
-    writeFileSync59(join112(runDir, "digest.md"), text4);
+    writeFileSync59(join113(runDir, "digest.md"), text4);
   } catch (e10) {
     d.err(`loki issues run: could not write digest: ${e10 instanceof Error ? e10.message : String(e10)}
 `);
   }
   d.out(`
 ${text4}
-digest: ${join112(runDir, "digest.md")}
+digest: ${join113(runDir, "digest.md")}
 `);
   return 0;
 }
@@ -74122,11 +74336,11 @@ function perRun(est) {
   return est.prior ? { usd: est.prior.usd, tilde: "~", label: " (rough prior)" } : null;
 }
 function keepReceipt(wt, runId2, runDir, err) {
-  const src = join112(wt, ".loki", "runs", runId2);
+  const src = join113(wt, ".loki", "runs", runId2);
   if (!/^[A-Za-z0-9_.-]+$/.test(runId2) || !existsSync79(src))
     return;
   try {
-    cpSync3(src, join112(runDir, "receipts", runId2), { recursive: true });
+    cpSync3(src, join113(runDir, "receipts", runId2), { recursive: true });
   } catch (e10) {
     err(`loki issues run: could not keep the receipt of ${runId2}: ${e10 instanceof Error ? e10.message : String(e10)}
 `);
@@ -74173,8 +74387,8 @@ function makeWorktrees(repoDir) {
   let root = null;
   return {
     create: (name, base) => {
-      root ??= mkdtempSync15(join112(tmpdir19(), "loki-issues-"));
-      const p = join112(root, name);
+      root ??= mkdtempSync15(join113(tmpdir19(), "loki-issues-"));
+      const p = join113(root, name);
       safeGit(repoDir, ["worktree", "add", "-B", `loki/${name}`, p, base]);
       return p;
     },
@@ -74267,7 +74481,7 @@ __export(exports_satisfaction, {
 });
 import { appendFileSync as appendFileSync13, mkdirSync as mkdirSync62 } from "fs";
 import { homedir as homedir13 } from "os";
-import { join as join113 } from "path";
+import { join as join114 } from "path";
 import { createInterface as createInterface4 } from "readline";
 function satisfactionEnabled(env, tty) {
   if (!tty)
@@ -74287,9 +74501,9 @@ function parseScore(line2) {
   return { score: Number(m[1]), again: m[2] ? m[2].toLowerCase() === "y" : null };
 }
 function recordSatisfaction(home, row) {
-  const dir = join113(home, ".loki");
+  const dir = join114(home, ".loki");
   mkdirSync62(dir, { recursive: true, mode: 448 });
-  appendFileSync13(join113(dir, "satisfaction.jsonl"), `${JSON.stringify(row)}
+  appendFileSync13(join114(dir, "satisfaction.jsonl"), `${JSON.stringify(row)}
 `, { mode: 384 });
 }
 async function maybeAsk(o) {
@@ -74360,8 +74574,8 @@ __export(exports_supervisor, {
 });
 import { spawn as spawn13, spawnSync as spawnSync16 } from "child_process";
 import { createHash as createHash32, createPublicKey as createPublicKey3, sign as sign2 } from "crypto";
-import { existsSync as existsSync80, mkdirSync as mkdirSync63, readFileSync as readFileSync98, writeFileSync as writeFileSync60 } from "fs";
-import { join as join114, relative as relative26, resolve as resolve36 } from "path";
+import { existsSync as existsSync80, mkdirSync as mkdirSync63, readFileSync as readFileSync99, writeFileSync as writeFileSync60 } from "fs";
+import { join as join115, relative as relative26, resolve as resolve36 } from "path";
 async function slackEvent(...a) {
   try {
     await (await Promise.resolve().then(() => (init_slack_events(), exports_slack_events))).notifyEvent(...a);
@@ -74390,7 +74604,7 @@ class SupervisorLog {
     this.log = new EventLog(path, runId2);
     this.hash = createHash32("sha256");
     try {
-      this.hash.update(readFileSync98(path));
+      this.hash.update(readFileSync99(path));
     } catch {}
   }
   implementOpen = false;
@@ -74445,7 +74659,7 @@ class SupervisorLog {
     const expected = this.hash.copy().digest("hex");
     let actual = "";
     try {
-      actual = createHash32("sha256").update(readFileSync98(this.path)).digest("hex");
+      actual = createHash32("sha256").update(readFileSync99(this.path)).digest("hex");
     } catch {}
     if (actual === expected)
       return true;
@@ -74467,15 +74681,15 @@ async function runSupervisor(opts) {
   const t02 = Date.now();
   const startedProvider = opts.started?.["provider"];
   const env = opts.env ?? process.env;
-  await assertPreflight({ repoDir: opts.repoDir, provider: typeof startedProvider === "string" ? startedProvider : "claude", pr: opts.pr !== undefined, env, runDir: join114(opts.repoDir, ".loki", "runs", opts.runId) });
+  await assertPreflight({ repoDir: opts.repoDir, provider: typeof startedProvider === "string" ? startedProvider : "claude", pr: opts.pr !== undefined, env, runDir: join115(opts.repoDir, ".loki", "runs", opts.runId) });
   writeEngineMarker(opts.repoDir, opts.runId);
   const origin = readOriginUrl(opts.repoDir);
-  const rmRunPid = writeRunPid(join114(opts.repoDir, ".loki", "runs", opts.runId), opts.runId);
+  const rmRunPid = writeRunPid(join115(opts.repoDir, ".loki", "runs", opts.runId), opts.runId);
   process.once("exit", rmRunPid);
-  const log = new SupervisorLog(join114(opts.repoDir, eventsRelPath(opts.runId)), opts.runId);
+  const log = new SupervisorLog(join115(opts.repoDir, eventsRelPath(opts.runId)), opts.runId);
   if ((env.LOKI_CONTROL ?? process.env.LOKI_CONTROL) !== "0")
     Promise.resolve().then(() => (init_ship_hook(), exports_ship_hook)).then((m) => m.startShip(opts.repoDir, log.path, env)).catch(() => {});
-  const aliveDir = join114(opts.repoDir, ".loki", "runs", opts.runId), lastAlive = opts.resume ? readAliveBeat(aliveDir) : null;
+  const aliveDir = join115(opts.repoDir, ".loki", "runs", opts.runId), lastAlive = opts.resume ? readAliveBeat(aliveDir) : null;
   log.append(opts.resume ? "run.resumed" : "run.started", null, { ...opts.started, ...opts.resume ? { phase: "stage", ...lastAlive ? { last_alive_ts: new Date(lastAlive).toISOString() } : {} } : {}, origin_repo: githubRepoFromUrl(origin) });
   if (!opts.resume)
     Promise.resolve().then(() => (init_writeback(), exports_writeback)).then((m) => m.writeBack({ phase: "started", verdict: "", prUrl: null, receiptSha256: null, task: "" }, env));
@@ -74510,7 +74724,7 @@ async function runSupervisor(opts) {
     if (e10?.type === "receipt.sealed")
       sealed = e10.data;
     if (e10?.type === "variant" && e10.data.intent_confirm === true && workerEnv.LOKI_INTENT_TTY === "1") {
-      askIntent(String(e10.data.card ?? ""), join114(opts.repoDir, ".loki", "runs", opts.runId));
+      askIntent(String(e10.data.card ?? ""), join115(opts.repoDir, ".loki", "runs", opts.runId));
     }
   }, (stopped) => {
     for (const g10 of sessionGroups)
@@ -74609,8 +74823,8 @@ async function runSupervisor(opts) {
   }
   log.append("run.completed", null, { verdict, ...cancelled2 ? { cancelled: true, signal: cancelled2, outcome: "CANCELLED" } : {}, pr_url: prUrl, not_proven: notProven, cost_usd: costUsd, wall_s: wallS, pre_model: preModelTiming(allEvents, t02) });
   log.sealLog();
-  recordFingerprints(join114(opts.repoDir, ".loki", "state"), opts.runId, "failed", failedCheckNames(folded.stages["verify"]?.data.checks, folded.stages["verify"]?.data.pre_red_checks), cleanTreeId(opts.repoDir));
-  const stages = allEvents.filter((e10) => e10.type === "stage.completed" && typeof e10.data.duration_s === "number").map((e10) => ({ label: String(e10.stage), seconds: e10.data.duration_s })), pc2 = partialCost(allEvents, log.tampered), summary = { pr: prUrl ? { url: prUrl, draft: verdict !== "VERIFIED" } : null, verdict, outcome, notProven, flaky: recordFingerprints(join114(opts.repoDir, ".loki", "state"), opts.runId, "flaky", folded.stages["verify"]?.data.flaky, cleanTreeId(opts.repoDir)), wallS, stages, cost: { usd: costUsd, provider: String(opts.started?.provider ?? ""), tokens: summaryTokens(folded, allEvents.some((e10) => e10.type === "cost")), ...summaryCache(allEvents, log.tampered), partialUsd: pc2.usd, measuredSessions: pc2.measured, totalSessions: pc2.total, stageShares: log.tampered ? null : stageShareText(allEvents), capUsd: Number(opts.started?.["max_cost_usd"]) > 0 ? Number(opts.started?.["max_cost_usd"]) : undefined } };
+  recordFingerprints(join115(opts.repoDir, ".loki", "state"), opts.runId, "failed", failedCheckNames(folded.stages["verify"]?.data.checks, folded.stages["verify"]?.data.pre_red_checks), cleanTreeId(opts.repoDir));
+  const stages = allEvents.filter((e10) => e10.type === "stage.completed" && typeof e10.data.duration_s === "number").map((e10) => ({ label: String(e10.stage), seconds: e10.data.duration_s })), pc2 = partialCost(allEvents, log.tampered), summary = { pr: prUrl ? { url: prUrl, draft: verdict !== "VERIFIED" } : null, verdict, outcome, notProven, flaky: recordFingerprints(join115(opts.repoDir, ".loki", "state"), opts.runId, "flaky", folded.stages["verify"]?.data.flaky, cleanTreeId(opts.repoDir)), wallS, stages, cost: { usd: costUsd, provider: String(opts.started?.provider ?? ""), tokens: summaryTokens(folded, allEvents.some((e10) => e10.type === "cost")), ...summaryCache(allEvents, log.tampered), partialUsd: pc2.usd, measuredSessions: pc2.measured, totalSessions: pc2.total, stageShares: log.tampered ? null : stageShareText(allEvents), capUsd: Number(opts.started?.["max_cost_usd"]) > 0 ? Number(opts.started?.["max_cost_usd"]) : undefined } };
   await slackEvent(env, "finished", { summary: formatSummary(summary), outcome: String(outcome), cost: summary.cost.usd != null ? `$${summary.cost.usd.toFixed(2)}` : "not measured", time: `${Math.round(wallS)}s`, receipt: log.tampered ? "TAMPERED" : receiptVerdict ? verdict : undefined });
   rmRunPid();
   process.off("exit", rmRunPid);
@@ -74636,6 +74850,7 @@ async function main4(args) {
       if (v3 === undefined || v3 === "" || v3.startsWith("-")) {
         process.stderr.write(`engine10: --max-cost needs a value
 `);
+        noteRefusal("unsupported_flag");
         return 2;
       }
       maxCost = v3;
@@ -74647,6 +74862,7 @@ async function main4(args) {
       if (v3 === undefined || v3 === "" || v3.startsWith("-")) {
         process.stderr.write(`engine10: --provider needs a value
 `);
+        noteRefusal("unsupported_flag");
         return 2;
       }
       provider = v3;
@@ -74656,6 +74872,7 @@ async function main4(args) {
       if (v3 === undefined || v3 === "" || v3.startsWith("-")) {
         process.stderr.write(`engine10: --spec needs a value
 `);
+        noteRefusal("unsupported_flag");
         return 2;
       }
       specFile = v3;
@@ -74671,6 +74888,7 @@ async function main4(args) {
       if (v3 === undefined || v3 === "" || v3.startsWith("-")) {
         process.stderr.write(`engine10: --seal-existing needs a patch file
 `);
+        noteRefusal("unsupported_flag");
         return 2;
       }
       sealPatch = resolve36(v3);
@@ -74682,6 +74900,7 @@ async function main4(args) {
       process.stderr.write(`engine10: unknown flag ${a}
 usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-cost N] [--provider P] [--spec F] [--seal-existing PATCH] [--resume] [--fresh] [-- <task>]
 `);
+      noteRefusal("unsupported_flag");
       return 2;
     } else
       words3.push(a);
@@ -74696,6 +74915,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
     } catch (e10) {
       process.stderr.write(`engine10: ${e10.message}
 `);
+      noteRefusal("prd_missing");
       return 2;
     }
     if (!task)
@@ -74712,6 +74932,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
   if (!task) {
     process.stderr.write(`engine10: no task given
 `);
+    noteRefusal("prd_missing");
     return 2;
   }
   let repoDir;
@@ -74722,6 +74943,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
     if (!i.notice) {
       process.stderr.write(`engine10: ${i.fatal ?? "not inside a git repository"}
 `);
+      noteRefusal("not_a_repo");
       return 2;
     }
     process.stderr.write(`engine10: ${i.notice}
@@ -74731,6 +74953,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
     } catch {
       process.stderr.write(`engine10: not inside a git repository
 `);
+      noteRefusal("not_a_repo");
       return 2;
     }
   }
@@ -74740,7 +74963,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
       return rec2;
   }
   const runId2 = `e10-${new Date().toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z")}-${Math.random().toString(16).slice(2, 6)}`;
-  const runDir = join114(repoDir, ".loki", "runs", runId2);
+  const runDir = join115(repoDir, ".loki", "runs", runId2);
   const cap = resolveCap(maxCost, repoDir);
   if ("error" in cap) {
     process.stderr.write(`engine10: ${cap.error}
@@ -74778,7 +75001,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
   }
   if (spec) {
     mkdirSync63(runDir, { recursive: true });
-    writeFileSync60(join114(runDir, "spec.snapshot.md"), spec.raw);
+    writeFileSync60(join115(runDir, "spec.snapshot.md"), spec.raw);
     for (const e10 of [env, process.env]) {
       e10.LOKI_E10_SPEC_PATH = relative26(repoDir, spec.path);
       e10.LOKI_E10_SPEC_SHA256 = spec.sha256;
@@ -74803,9 +75026,9 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
     mkdirSync63(runDir, { recursive: true });
     try {
       if (trackerRef)
-        await fetchTrackerIssueToFile(trackerRef, join114(runDir, "issue.json"));
+        await fetchTrackerIssueToFile(trackerRef, join115(runDir, "issue.json"));
       else
-        fetchIssueToFile(task, join114(runDir, "issue.json"));
+        fetchIssueToFile(task, join115(runDir, "issue.json"));
     } catch (err) {
       process.stderr.write(`engine10: issue fetch failed: ${err.message.split(`
 `)[0]}
@@ -74835,7 +75058,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
     process.stdout.write(`${capLine}
 `);
   const t02 = Date.now();
-  const eventsPath = join114(repoDir, eventsRelPath(runId2));
+  const eventsPath = join115(repoDir, eventsRelPath(runId2));
   const live2 = (e10) => {
     const clockS = (Date.parse(e10.ts) - t02) / 1000;
     const d = e10.data;
@@ -74882,7 +75105,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
   const reqOnce = async (evs) => {
     if (reqMap === undefined) {
       const rq2 = await Promise.resolve().then(() => (init_contract(), exports_contract));
-      reqMap = rq2.writeFromEngine10(repoDir, join114(repoDir, ".loki"), runDir, isIssue ? null : task, evs);
+      reqMap = rq2.writeFromEngine10(repoDir, join115(repoDir, ".loki"), runDir, isIssue ? null : task, evs);
     }
     return reqMap;
   };
@@ -74892,6 +75115,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
     if (e10.type === "stage.completed" && e10.stage === "plan")
       statusStep();
   }, { intervalMs: 500 }) : () => {};
+  let refusedAs = "other";
   const res = await runSupervisor({
     runId: runId2,
     repoDir,
@@ -74945,7 +75169,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
     comment: noPr ? undefined : async ({ issueRef, reason, prUrl }) => {
       const { DEFAULT_PUSH_SH: DEFAULT_PUSH_SH2 } = await Promise.resolve().then(() => (init_pr(), exports_pr));
       mkdirSync63(runDir, { recursive: true });
-      const bodyFile = join114(runDir, "backstop-comment.md");
+      const bodyFile = join115(runDir, "backstop-comment.md");
       writeFileSync60(bodyFile, `<!-- loki-backstop -->
 Loki 10 run ${runId2} ${prUrl ? `opened draft PR ${prUrl}` : "ended without a PR"}.
 
@@ -74960,6 +75184,7 @@ ${prUrl ? "One question" : "Reason"}: ${reason}
       throw e10;
     process.stderr.write(`${e10.message}
 `);
+    refusedAs = e10.blocker;
     return null;
   });
   clearInterval(tailTimer);
@@ -74967,12 +75192,14 @@ ${prUrl ? "One question" : "Reason"}: ${reason}
   if (!res) {
     stopTail();
     liveStop();
+    noteRefusal(refusedAs);
     return 2;
   }
   await new Promise((r) => setTimeout(r, 300));
   stopTail();
   liveStop();
   const events2 = readEvents(eventsPath), f = fold(events2);
+  noteRefusalFromEvents(events2);
   const sawCost = events2.some((e10) => e10.type === "cost"), cli = process.env.LOKI_E10_INVOKER === "cli";
   const { usd, pc: pc2 } = summaryCost(events2, res.tampered);
   const out3 = json2 ? `${JSON.stringify({ ok: EXIT[res.outcome] === 0, outcome: res.outcome, stop: res.stop, run_id: runId2, receipt_sha256: res.receiptSha })}
@@ -75007,7 +75234,7 @@ ${prUrl ? "One question" : "Reason"}: ${reason}
   const rr2 = resultOf(res.outcome);
   if (res.outcome === "BUDGET_STOP" && cap.usd > 0)
     writeBudgetStop(repoDir, runId2, { task: task.trim(), cap_usd: cap.usd, spent_usd: seed + (usd ?? 0), source: cap.source });
-  const ui2 = { result: rr2, filesChanged: ds2?.files ?? null, insertions: ds2?.ins, deletions: ds2?.del, costUsd: usd, elapsedS: Number(f.run.completed?.data.wall_s ?? (Date.now() - t02) / 1000), receiptPath: res.receiptSha ? join114(runDir, "receipt.json") : null, next: res.outcome === "BUDGET_STOP" && cap.usd > 0 ? budgetNext(seed + (usd ?? 0), cap.usd) : nextOf(rr2, ds2?.files ?? null, reasonOf(events2, res.tampered, res.stop, res.outcome), provider, runId2), uncovered };
+  const ui2 = { result: rr2, filesChanged: ds2?.files ?? null, insertions: ds2?.ins, deletions: ds2?.del, costUsd: usd, elapsedS: Number(f.run.completed?.data.wall_s ?? (Date.now() - t02) / 1000), receiptPath: res.receiptSha ? join115(runDir, "receipt.json") : null, next: res.outcome === "BUDGET_STOP" && cap.usd > 0 ? budgetNext(seed + (usd ?? 0), cap.usd) : nextOf(rr2, ds2?.files ?? null, reasonOf(events2, res.tampered, res.stop, res.outcome), provider, runId2), uncovered };
   const rdy = events2.find((e10) => e10.type === "stage.completed" && e10.stage === "intake")?.data.readiness, foldTail = [handoffRef, typeof rdy === "string" ? rdy : ""].filter(Boolean).join("; ");
   const riskLine = readRiskSummary(repoDir, t02);
   process.stdout.write(json2 ? `${JSON.stringify({ ...JSON.parse(out3), summary: { ...summaryObject(ui2), ...riskLine ? { risk: riskLine } : {} } })}
@@ -75046,6 +75273,7 @@ var init_supervisor = __esm(() => {
   init_worker_proc();
   init_intent_card();
   init_preflight();
+  init_funnel();
   init_session();
   init_failure_memory();
   init_model_downgrades();
@@ -75062,8 +75290,8 @@ var init_supervisor = __esm(() => {
 });
 
 // ../../loki-ts/src/e10ext/compound_match.ts
-import { readFileSync as readFileSync99 } from "fs";
-import { basename as basename29, join as join115 } from "path";
+import { readFileSync as readFileSync100 } from "fs";
+import { basename as basename29, join as join116 } from "path";
 function parts(s) {
   return s.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().match(/[a-z0-9]+/g) ?? [];
 }
@@ -75090,7 +75318,7 @@ function linkedHits(word, repoMap, testMap, repoDir) {
       continue;
     let body;
     try {
-      body = importLines(readFileSync99(join115(repoDir, t.path), "utf8"));
+      body = importLines(readFileSync100(join116(repoDir, t.path), "utf8"));
     } catch {
       continue;
     }
@@ -75111,8 +75339,8 @@ var init_compound_match = __esm(() => {
 });
 
 // ../../loki-ts/src/util/already_done_evidence.ts
-import { existsSync as existsSync81, readFileSync as readFileSync100 } from "fs";
-import { basename as basename30, join as join116 } from "path";
+import { existsSync as existsSync81, readFileSync as readFileSync101 } from "fs";
+import { basename as basename30, join as join117 } from "path";
 function keywords2(task) {
   const words3 = task.toLowerCase().match(/[a-z0-9_]+/g) ?? [];
   return Array.from(new Set(words3.filter((w) => w.length > 2 && !STOP_WORDS.has(w))));
@@ -75144,7 +75372,7 @@ function docEvidence(words3, repoDir) {
   for (const name of DOC_FILES) {
     let text4;
     try {
-      text4 = readFileSync100(join116(repoDir, name), "utf8");
+      text4 = readFileSync101(join117(repoDir, name), "utf8");
     } catch {
       continue;
     }
@@ -75206,7 +75434,7 @@ function citesToken(text4, token) {
 function citesRealHit(text4, hit, repoDir) {
   if (hit.source === "changelog")
     return false;
-  return (citesToken(text4, hit.path) || citesToken(text4, basename30(hit.path))) && existsSync81(join116(repoDir, hit.path));
+  return (citesToken(text4, hit.path) || citesToken(text4, basename30(hit.path))) && existsSync81(join117(repoDir, hit.path));
 }
 function renderAlreadyDoneComment(evidence) {
   return ["Loki 10: no change needed. This already appears to be implemented.", "", "Evidence:", ...evidence.map((e10) => `- ${e10}`), ""].join(`
@@ -75408,9 +75636,9 @@ __export(exports_warm, {
   WarmEngine: () => WarmEngine
 });
 import { createHash as createHash33 } from "crypto";
-import { existsSync as existsSync82, mkdirSync as mkdirSync64, readFileSync as readFileSync101, statSync as statSync32, unlinkSync as unlinkSync11 } from "fs";
+import { existsSync as existsSync82, mkdirSync as mkdirSync64, readFileSync as readFileSync102, statSync as statSync32, unlinkSync as unlinkSync11 } from "fs";
 import { createServer as createServer2 } from "net";
-import { dirname as dirname45, resolve as resolve37 } from "path";
+import { dirname as dirname46, resolve as resolve37 } from "path";
 function speedEnabled() {
   return process.env["LOKI_SPEED"] !== "0";
 }
@@ -75438,7 +75666,7 @@ function dirtyHash(repoDir) {
     try {
       const p = resolve37(repoDir, rel);
       if (existsSync82(p) && statSync32(p).isFile() && statSync32(p).size <= MAX_HASHED_BYTES)
-        h10.update(readFileSync101(p));
+        h10.update(readFileSync102(p));
     } catch {}
   }
   return h10.digest("hex");
@@ -75491,7 +75719,7 @@ function startWarmIfEnabled() {
   }
 }
 function startWarmServer(path = warmSocketPath(), engine = new WarmEngine) {
-  mkdirSync64(dirname45(path), { recursive: true });
+  mkdirSync64(dirname46(path), { recursive: true });
   try {
     unlinkSync11(path);
   } catch {}
@@ -75550,7 +75778,7 @@ var init_warm = __esm(() => {
 import { execFile as execFile3 } from "child_process";
 import { mkdirSync as mkdirSync65, mkdtempSync as mkdtempSync16, rmSync as rmSync34 } from "fs";
 import { tmpdir as tmpdir20 } from "os";
-import { join as join117 } from "path";
+import { join as join118 } from "path";
 function hitsUnchangedFromBase(repoDir, baseSha, paths) {
   if (paths.length === 0 || !baseSha)
     return false;
@@ -75588,23 +75816,23 @@ function dropRoot(root) {
 function pinBaseTree(ctx, signal) {
   let root;
   try {
-    root = mkdtempSync16(join117(tmpdir20(), "loki-already-done-"));
+    root = mkdtempSync16(join118(tmpdir20(), "loki-already-done-"));
   } catch {
     return Promise.resolve(null);
   }
   trackRoot(root);
   try {
-    mkdirSync65(join117(root, "tree"));
+    mkdirSync65(join118(root, "tree"));
   } catch {
     dropRoot(root);
     return Promise.resolve(null);
   }
-  const tarball = join117(root, "base.tar");
+  const tarball = join118(root, "base.tar");
   const step = (cmd2, args, cwd) => new Promise((res) => {
     execFile3(cmd2, args, { env: process.env, signal, cwd }, (err) => res(!err));
   });
   return (async () => {
-    if (!ctx.baseSha || (await safeGitRun(ctx.repoDir, ["archive", "-o", tarball, ctx.baseSha], { signal })).exitCode !== 0 || !await step("tar", ["-x", "-f", tarball, "-C", join117(root, "tree")], root)) {
+    if (!ctx.baseSha || (await safeGitRun(ctx.repoDir, ["archive", "-o", tarball, ctx.baseSha], { signal })).exitCode !== 0 || !await step("tar", ["-x", "-f", tarball, "-C", join118(root, "tree")], root)) {
       dropRoot(root);
       return null;
     }
@@ -75662,7 +75890,7 @@ function deferAlreadyDone(ctx, signal, task, repoMap, testMap, apply) {
     if (!root)
       return;
     try {
-      const r = await checkAlreadyDone({ ...ctx, repoDir: join117(root, "tree"), sessions: inner }, check.signal, task, repoMap, testMap);
+      const r = await checkAlreadyDone({ ...ctx, repoDir: join118(root, "tree"), sessions: inner }, check.signal, task, repoMap, testMap);
       const ph = phase;
       if (r && ph !== "done" && !check.signal.aborted) {
         hit = r;
@@ -75688,8 +75916,8 @@ __export(exports_intake, {
   stage: () => stage8,
   runIntake: () => runIntake
 });
-import { appendFileSync as appendFileSync14, existsSync as existsSync83, mkdirSync as mkdirSync66, readFileSync as readFileSync102, writeFileSync as writeFileSync61 } from "fs";
-import { dirname as dirname46, join as join118, resolve as resolve38 } from "path";
+import { appendFileSync as appendFileSync14, existsSync as existsSync83, mkdirSync as mkdirSync66, readFileSync as readFileSync103, writeFileSync as writeFileSync61 } from "fs";
+import { dirname as dirname47, join as join119, resolve as resolve38 } from "path";
 function issueRefOf(raw2) {
   return typeof raw2.repo === "string" && raw2.repo && typeof raw2.number === "number" ? `${raw2.repo}#${raw2.number}` : null;
 }
@@ -75709,15 +75937,15 @@ function ensureBranch(repoDir, branch, from) {
   }
 }
 function excludeLokiDir(repoDir) {
-  let path = join118(repoDir, ".git", "info", "exclude");
+  let path = join119(repoDir, ".git", "info", "exclude");
   try {
     path = resolve38(repoDir, git13(repoDir, ["rev-parse", "--git-path", "info/exclude"]));
   } catch {}
-  const existing = existsSync83(path) ? readFileSync102(path, "utf8") : "";
+  const existing = existsSync83(path) ? readFileSync103(path, "utf8") : "";
   if (existing.split(`
 `).some((l) => l.trim() === ".loki/"))
     return;
-  mkdirSync66(dirname46(path), { recursive: true });
+  mkdirSync66(dirname47(path), { recursive: true });
   const sep20 = existing.length > 0 && !existing.endsWith(`
 `) ? `
 ` : "";
@@ -75725,7 +75953,7 @@ function excludeLokiDir(repoDir) {
 `);
 }
 function loadIssue(path) {
-  const raw2 = JSON.parse(readFileSync102(path, "utf8"));
+  const raw2 = JSON.parse(readFileSync103(path, "utf8"));
   return { state: typeof raw2.state === "string" ? raw2.state.toLowerCase() : null, closed_by_merged_pr: raw2.closed_by_merged_pr === true };
 }
 function isAlreadyDone(issue) {
@@ -75756,7 +75984,7 @@ async function runIntakeBody(ctx, signal, opts, held) {
     return { status: "failed", data: {}, reason: "aborted before intake started" };
   const { blocking: dirty, preexisting } = splitDirty(ctx.repoDir, dirtyTrackedFiles(ctx.repoDir));
   if (dirty.length > 0)
-    return { status: "failed", data: {}, reason: `dirty tracked tree: ${dirty.join(", ")}` };
+    return { status: "failed", data: { blocker: "dirty_tracked_tree" }, reason: `dirty tracked tree: ${dirty.join(", ")}` };
   let baseSha = git13(ctx.repoDir, ["rev-parse", "HEAD"]);
   const startBranch = git13(ctx.repoDir, ["symbolic-ref", "-q", "--short", "HEAD"]);
   let stacked = stackedOnLokiRun(ctx.repoDir);
@@ -75775,7 +76003,7 @@ async function runIntakeBody(ctx, signal, opts, held) {
     ensureBranch(ctx.repoDir, ctx.branch);
   const tree = git13(ctx.repoDir, ["rev-parse", "HEAD^{tree}"]);
   excludeLokiDir(ctx.repoDir);
-  const issueJsonPath = opts.issueJsonPath ?? process.env.LOKI_E10_ISSUE_JSON ?? join118(ctx.runDir, "issue.json");
+  const issueJsonPath = opts.issueJsonPath ?? process.env.LOKI_E10_ISSUE_JSON ?? join119(ctx.runDir, "issue.json");
   const taskText = opts.taskText ?? process.env.LOKI_E10_TASK_TEXT;
   let source;
   let taskSha256;
@@ -75784,7 +76012,7 @@ async function runIntakeBody(ctx, signal, opts, held) {
   let issueRef = null;
   if (existsSync83(issueJsonPath)) {
     source = "issue";
-    const raw2 = readFileSync102(issueJsonPath, "utf8");
+    const raw2 = readFileSync103(issueJsonPath, "utf8");
     taskSha256 = sha2562(raw2);
     const i = JSON.parse(raw2);
     task = [i.title, i.body].filter((x3) => typeof x3 === "string" && x3 !== "").join(`
@@ -75805,7 +76033,7 @@ async function runIntakeBody(ctx, signal, opts, held) {
     return { status: "completed", data: { ...common, task_sha256: taskSha256, source, base_sha: baseSha, tree, branch: ctx.branch, already_satisfied: true } };
   }
   mkdirSync66(ctx.runDir, { recursive: true });
-  const repomapRef = join118(ctx.runDir, "repomap.json");
+  const repomapRef = join119(ctx.runDir, "repomap.json");
   const cacheDir = repoCacheDir(repoKey(null, ctx.repoDir));
   const repoMap = cachedRepoMap(cacheDir, tree, () => buildRepoMap(ctx.repoDir));
   writeFileSync61(repomapRef, JSON.stringify(repoMap));
@@ -75826,7 +76054,7 @@ async function runIntakeBody(ctx, signal, opts, held) {
   const already = speedEnabled() ? null : await checkAlreadyDone(ctx, signal, task, repoMap, testmap);
   const alreadyData = (already2) => {
     const comment = renderAlreadyDoneComment(already2.evidence);
-    const bodyFile = join118(ctx.runDir, "already-done-comment.md");
+    const bodyFile = join119(ctx.runDir, "already-done-comment.md");
     writeFileSync61(bodyFile, comment, "utf8");
     const commentArgv = source === "issue" && issueRef ? buildAlreadyDoneCommentArgv(ctx.runId, issueRef, bodyFile) : undefined;
     return { already_satisfied: true, evidence: already2.evidence, iteration_ids: [`${ctx.runId}-already-done`], comment, ...commentArgv ? { comment_argv: commentArgv } : {} };
@@ -76020,7 +76248,7 @@ __export(exports_keys_cmd, {
   takePubkey: () => takePubkey,
   main: () => main5
 });
-import { readFileSync as readFileSync103 } from "fs";
+import { readFileSync as readFileSync104 } from "fs";
 import { parseArgs } from "util";
 import { createPublicKey as createPublicKey4 } from "crypto";
 function takePubkey(args) {
@@ -76033,7 +76261,7 @@ function takePubkey(args) {
       return { args: rest };
     if (!(file = pubkey[0]))
       throw new Error("--pubkey requires a file argument");
-    const t = readFileSync103(file, "utf8"), key = createPublicKey4(t.trim().startsWith("{") ? { key: JSON.parse(t), format: "jwk" } : t);
+    const t = readFileSync104(file, "utf8"), key = createPublicKey4(t.trim().startsWith("{") ? { key: JSON.parse(t), format: "jwk" } : t);
     return key.asymmetricKeyType === "ed25519" ? { args: rest, pubkey: key } : { args: rest, error: `cannot read an Ed25519 public key from ${file}` };
   } catch (e10) {
     return { args: [], error: file ? `cannot read an Ed25519 public key from ${file}` : e10.message.replace(/^./, (c) => c.toLowerCase()) };
@@ -76291,7 +76519,7 @@ var groupRoute = async (repoDir, rawGroup) => {
 };
 
 // ../../loki-ts/src/engine10/modernize/types.ts
-import { join as join119 } from "path";
+import { join as join120 } from "path";
 function makeModernizeId(now2 = new Date) {
   const utc = now2.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
   const short = Math.floor(Math.random() * 16777215).toString(16).padStart(6, "0");
@@ -76301,13 +76529,13 @@ function isModernizeId(mid) {
   return MID_RE.test(mid);
 }
 function modernizeRoot(repoDir, mid) {
-  return join119(repoDir, ".loki", "modernize", mid);
+  return join120(repoDir, ".loki", "modernize", mid);
 }
 function modernizeEventsPath(repoDir, mid) {
-  return join119(modernizeRoot(repoDir, mid), "events.jsonl");
+  return join120(modernizeRoot(repoDir, mid), "events.jsonl");
 }
 function planPath(repoDir, mid) {
-  return join119(modernizeRoot(repoDir, mid), "plan.json");
+  return join120(modernizeRoot(repoDir, mid), "plan.json");
 }
 function isSafeUnitId(unit) {
   return typeof unit === "string" && unit.length <= MAX_UNIT_ID && UNIT_ID_RE2.test(unit) && !unit.includes("..");
@@ -76318,13 +76546,13 @@ function encodeUnitId(unit) {
   return unit.replace(/\//g, "%2F");
 }
 function oracleDir(repoDir, mid, unit) {
-  return join119(modernizeRoot(repoDir, mid), "oracle", encodeUnitId(unit));
+  return join120(modernizeRoot(repoDir, mid), "oracle", encodeUnitId(unit));
 }
 function reportJsonPath(repoDir, mid) {
-  return join119(modernizeRoot(repoDir, mid), "report.json");
+  return join120(modernizeRoot(repoDir, mid), "report.json");
 }
 function reportMdPath(repoDir, mid) {
-  return join119(modernizeRoot(repoDir, mid), "report.md");
+  return join120(modernizeRoot(repoDir, mid), "report.md");
 }
 var MID_RE, UNIT_ID_SEGMENT = "[A-Za-z0-9][A-Za-z0-9_.-]*", UNIT_ID_RE2, MAX_UNIT_ID = 128;
 var init_types2 = __esm(() => {
@@ -76364,9 +76592,9 @@ __export(exports_dashboard, {
   listModernizeIds: () => listModernizeIds
 });
 import { existsSync as existsSync84, readdirSync as readdirSync36 } from "fs";
-import { join as join120 } from "path";
+import { join as join121 } from "path";
 function modernizeDir(repoDir) {
-  return join120(repoDir, ".loki", "modernize");
+  return join121(repoDir, ".loki", "modernize");
 }
 function listModernizeIds(repoDir) {
   const dir = modernizeDir(repoDir);
@@ -76701,11 +76929,11 @@ var init_engine10_dashboard = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/modernize/inventory.ts
-import { readFileSync as readFileSync104 } from "fs";
-import { extname as extname4, join as join121 } from "path";
+import { readFileSync as readFileSync105 } from "fs";
+import { extname as extname4, join as join122 } from "path";
 function readCapped2(absPath) {
   try {
-    return readFileSync104(absPath, "utf8").slice(0, MAX_SCAN_BYTES2);
+    return readFileSync105(absPath, "utf8").slice(0, MAX_SCAN_BYTES2);
   } catch {
     return "";
   }
@@ -76722,9 +76950,9 @@ function detectEntryPoints(repoDir, files) {
   const out3 = [];
   for (const rel of files) {
     const ext = extname4(rel);
-    if (ext === ".py" && PY_MAIN_RE.test(readCapped2(join121(repoDir, rel))))
+    if (ext === ".py" && PY_MAIN_RE.test(readCapped2(join122(repoDir, rel))))
       out3.push(rel);
-    else if (ext === ".java" && JAVA_MAIN_RE.test(readCapped2(join121(repoDir, rel))))
+    else if (ext === ".java" && JAVA_MAIN_RE.test(readCapped2(join122(repoDir, rel))))
       out3.push(rel);
   }
   return out3;
@@ -76774,7 +77002,7 @@ var init_inventory = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/modernize/lang/python.ts
-import { join as join122 } from "path";
+import { join as join123 } from "path";
 async function buildPythonGraph(repoDir, files, opts = {}) {
   if (files.length === 0)
     return { graph: { nodes: [], edges: [] }, unresolved: [] };
@@ -76813,7 +77041,7 @@ var init_python2 = __esm(() => {
   init_paths();
   init_python();
   init_shell();
-  SCRIPT = join122(REPO_ROOT, "autonomy", "lib", "modernize", "py_imports.py");
+  SCRIPT = join123(REPO_ROOT, "autonomy", "lib", "modernize", "py_imports.py");
 });
 
 // ../../loki-ts/src/engine10/modernize/cluster.ts
@@ -76992,8 +77220,8 @@ var init_codemod = __esm(() => {
 
 // ../../loki-ts/src/engine10/modernize/oracle/seal.ts
 import { createHash as createHash34 } from "crypto";
-import { existsSync as existsSync85, mkdirSync as mkdirSync67, readFileSync as readFileSync105, writeFileSync as writeFileSync62 } from "fs";
-import { join as join123 } from "path";
+import { existsSync as existsSync85, mkdirSync as mkdirSync67, readFileSync as readFileSync106, writeFileSync as writeFileSync62 } from "fs";
+import { join as join124 } from "path";
 function normalizersSha(n11) {
   return sha2564(JSON.stringify({
     float_tolerance: n11.float_tolerance,
@@ -77055,9 +77283,9 @@ function alreadySealedInLog(repoDir, mid, unit) {
 }
 function sealOracle(repoDir, mid, unit, log, normalizers = DEFAULT_NORMALIZERS) {
   const dir = oracleDir(repoDir, mid, unit);
-  const casesPath = join123(dir, "cases.jsonl");
-  const coveragePath = join123(dir, "coverage.json");
-  const sealedPath = join123(dir, "sealed.json");
+  const casesPath = join124(dir, "cases.jsonl");
+  const coveragePath = join124(dir, "coverage.json");
+  const sealedPath = join124(dir, "sealed.json");
   if (alreadySealedInLog(repoDir, mid, unit)) {
     throw new Error(`oracle seal: ${unit} already has a sealing event in the modernize log; re-seal refused (seal is write-once)`);
   }
@@ -77068,8 +77296,8 @@ function sealOracle(repoDir, mid, unit, log, normalizers = DEFAULT_NORMALIZERS)
     throw new Error(`oracle seal: missing ${casesPath}`);
   if (!existsSync85(coveragePath))
     throw new Error(`oracle seal: missing ${coveragePath}`);
-  const casesRaw = readFileSync105(casesPath, "utf8");
-  const coverageRaw = readFileSync105(coveragePath, "utf8");
+  const casesRaw = readFileSync106(casesPath, "utf8");
+  const coverageRaw = readFileSync106(coveragePath, "utf8");
   const normalizersHash = normalizersSha(normalizers);
   const sealed = buildSealedOracle(unit, casesRaw, coverageRaw, normalizersHash);
   mkdirSync67(dir, { recursive: true });
@@ -77088,9 +77316,9 @@ function sealOracle(repoDir, mid, unit, log, normalizers = DEFAULT_NORMALIZERS)
 }
 function verifySeal(repoDir, mid, unit) {
   const dir = oracleDir(repoDir, mid, unit);
-  const sealedPath = join123(dir, "sealed.json");
-  const casesPath = join123(dir, "cases.jsonl");
-  const coveragePath = join123(dir, "coverage.json");
+  const sealedPath = join124(dir, "sealed.json");
+  const casesPath = join124(dir, "cases.jsonl");
+  const coveragePath = join124(dir, "coverage.json");
   if (!existsSync85(sealedPath))
     return { ok: false, reason: "no sealed.json" };
   if (!existsSync85(casesPath))
@@ -77101,11 +77329,11 @@ function verifySeal(repoDir, mid, unit) {
   if (!sealEvent) {
     return { ok: false, reason: "no sealing event for this unit in the modernize log; sealed.json is not anchored" };
   }
-  const casesRaw = readFileSync105(casesPath, "utf8");
+  const casesRaw = readFileSync106(casesPath, "utf8");
   if (sha2564(casesRaw) !== sealEvent.data.cases_sha256) {
     return { ok: false, reason: "cases.jsonl does not match the sealing event's hash (tampered or re-captured)" };
   }
-  const coverageRaw = readFileSync105(coveragePath, "utf8");
+  const coverageRaw = readFileSync106(coveragePath, "utf8");
   if (sha2564(coverageRaw) !== sealEvent.data.coverage_sha256) {
     return { ok: false, reason: "coverage.json does not match the sealing event's hash (tampered or re-captured)" };
   }
@@ -77121,7 +77349,7 @@ function verifySeal(repoDir, mid, unit) {
       reason: `verdict does not match the sealing event (event type ${sealEvent.type}, recomputed verdict ${recomputed.verdict})`
     };
   }
-  const sealed = JSON.parse(readFileSync105(sealedPath, "utf8"));
+  const sealed = JSON.parse(readFileSync106(sealedPath, "utf8"));
   if (JSON.stringify(sealed) !== JSON.stringify(recomputed)) {
     return { ok: false, reason: "sealed.json does not match the record recomputed from cases.jsonl and coverage.json (hand-edited)" };
   }
@@ -77137,9 +77365,9 @@ var init_seal2 = __esm(() => {
 
 // ../../loki-ts/src/engine10/modernize/oracle/search.ts
 import { spawnSync as spawnSync18 } from "child_process";
-import { copyFileSync as copyFileSync6, existsSync as existsSync86, linkSync as linkSync4, mkdirSync as mkdirSync68, mkdtempSync as mkdtempSync17, readFileSync as readFileSync106, renameSync as renameSync22, rmSync as rmSync35, rmdirSync as rmdirSync2, writeFileSync as writeFileSync63 } from "fs";
+import { copyFileSync as copyFileSync6, existsSync as existsSync86, linkSync as linkSync4, mkdirSync as mkdirSync68, mkdtempSync as mkdtempSync17, readFileSync as readFileSync107, renameSync as renameSync22, rmSync as rmSync35, rmdirSync as rmdirSync2, writeFileSync as writeFileSync63 } from "fs";
 import { tmpdir as tmpdir21 } from "os";
-import { basename as basename31, dirname as dirname47, join as join124 } from "path";
+import { basename as basename31, dirname as dirname48, join as join125 } from "path";
 function search(unitSource, seedCases, propose, runCapture, opts = {}) {
   const maxRounds = opts.maxRounds ?? 10;
   const plateauLimit = opts.plateauRounds ?? 2;
@@ -77196,10 +77424,10 @@ function realCaptureRunner(unitPath, cases, outPath) {
     return captureFailed("old runtime unavailable");
   let dir = "";
   try {
-    dir = mkdtempSync17(join124(tmpdir21(), "m10-search-"));
-    const casesFile = join124(dir, "cases.jsonl");
-    const outFile = join124(dir, "out.jsonl");
-    const covFile = join124(dir, "coverage.json");
+    dir = mkdtempSync17(join125(tmpdir21(), "m10-search-"));
+    const casesFile = join125(dir, "cases.jsonl");
+    const outFile = join125(dir, "out.jsonl");
+    const covFile = join125(dir, "coverage.json");
     const lines2 = cases.map((c) => JSON.stringify({ entry: c.entry, args: c.args, kwargs: c.kwargs }));
     writeFileSync63(casesFile, lines2.length ? lines2.join(`
 `) + `
@@ -77220,7 +77448,7 @@ function realCaptureRunner(unitPath, cases, outPath) {
 `).find((l) => l.trim().length > 0) ?? "(no stderr)";
       return captureFailed(`py_capture.py exit ${r.status}: ${firstErrLine}`);
     }
-    const raw2 = JSON.parse(readFileSync106(covFile, "utf8"));
+    const raw2 = JSON.parse(readFileSync107(covFile, "utf8"));
     if (outPath)
       copyFileSync6(outFile, outPath);
     return {
@@ -77247,13 +77475,13 @@ function resolveOldRuntimeSync() {
 }
 function makeProposeInputs(session, cap = 20) {
   return (unitPath, missing, round2) => {
-    const cwd = mkdtempSync17(join124(tmpdir21(), "m27-propose-"));
+    const cwd = mkdtempSync17(join125(tmpdir21(), "m27-propose-"));
     try {
-      const unitFile = join124(cwd, basename31(unitPath));
+      const unitFile = join125(cwd, basename31(unitPath));
       copyFileSync6(unitPath, unitFile);
       session({ cwd, env: tokenFreeEnv(), unitFile, missing, round: round2 });
       const out3 = [];
-      for (const line2 of readFileSync106(join124(cwd, "proposals.jsonl"), "utf8").split(`
+      for (const line2 of readFileSync107(join125(cwd, "proposals.jsonl"), "utf8").split(`
 `)) {
         try {
           const c = JSON.parse(line2);
@@ -77271,7 +77499,7 @@ function makeProposeInputs(session, cap = 20) {
 }
 function captureUnitOracle(a) {
   const dir = oracleDir(a.repoDir, a.mid, a.unit);
-  if (existsSync86(join124(dir, "cases.jsonl")) || alreadySealedInLog(a.repoDir, a.mid, a.unit)) {
+  if (existsSync86(join125(dir, "cases.jsonl")) || alreadySealedInLog(a.repoDir, a.mid, a.unit)) {
     return { ok: false, reason: "oracle already captured (write-once)" };
   }
   const run2 = a.runCapture ?? realCaptureRunner;
@@ -77291,21 +77519,21 @@ function captureUnitOracle(a) {
   }
   if (r.cases.length === 0)
     return { ok: false, reason: "no cases captured" };
-  const scratch = mkdtempSync17(join124(tmpdir21(), "m27-replay-"));
-  const t12 = join124(scratch, "cases"), t22 = join124(scratch, "replay");
+  const scratch = mkdtempSync17(join125(tmpdir21(), "m27-replay-"));
+  const t12 = join125(scratch, "cases"), t22 = join125(scratch, "replay");
   const created = [];
-  for (let p = dir;!existsSync86(p) && !created.includes(p); p = dirname47(p))
+  for (let p = dir;!existsSync86(p) && !created.includes(p); p = dirname48(p))
     created.push(p);
-  const read2 = (p) => readFileSync106(p, "utf8").split(`
+  const read3 = (p) => readFileSync107(p, "utf8").split(`
 `).filter(Boolean).map((l) => JSON.parse(l));
-  const tmpCases = join124(dir, `.cases.${process.pid}.tmp`);
-  const tmpCov = join124(dir, `.coverage.${process.pid}.tmp`);
+  const tmpCases = join125(dir, `.cases.${process.pid}.tmp`);
+  const tmpCov = join125(dir, `.coverage.${process.pid}.tmp`);
   try {
     const cov = run2(a.unitPath, r.cases, t12);
     const cov2 = run2(a.unitPath, r.cases, t22);
     if (cov.branchesTotal < 0 || cov2.branchesTotal < 0)
       return { ok: false, reason: cov.error ?? cov2.error ?? "replay failed" };
-    const recs = read2(t12), again = read2(t22);
+    const recs = read3(t12), again = read3(t22);
     if (recs.length !== r.cases.length || again.length !== recs.length)
       return { ok: false, reason: "capture records missing" };
     recs.forEach((rec2, i) => {
@@ -77327,10 +77555,10 @@ function captureUnitOracle(a) {
       branch_pct: cov.branchPct,
       missing: cov.missing
     }));
-    if (existsSync86(join124(dir, "cases.jsonl")))
+    if (existsSync86(join125(dir, "cases.jsonl")))
       return { ok: false, reason: "oracle already captured (write-once)" };
-    renameSync22(tmpCov, join124(dir, "coverage.json"));
-    (a.link ?? linkSync4)(tmpCases, join124(dir, "cases.jsonl"));
+    renameSync22(tmpCov, join125(dir, "coverage.json"));
+    (a.link ?? linkSync4)(tmpCases, join125(dir, "cases.jsonl"));
     return { ok: true, cases: r.cases.length, branchPct: cov.branchPct, stoppedReason: r.stoppedReason };
   } catch (e10) {
     return { ok: false, reason: `capture error: ${e10 instanceof Error ? e10.message : String(e10)}` };
@@ -77338,8 +77566,8 @@ function captureUnitOracle(a) {
     rmSync35(scratch, { recursive: true, force: true });
     for (const t of [tmpCases, tmpCov])
       rmSync35(t, { force: true });
-    if (created[0] === dir && !existsSync86(join124(dir, "cases.jsonl")))
-      rmSync35(join124(dir, "coverage.json"), { force: true });
+    if (created[0] === dir && !existsSync86(join125(dir, "cases.jsonl")))
+      rmSync35(join125(dir, "coverage.json"), { force: true });
     for (const p of created) {
       try {
         rmdirSync2(p);
@@ -77355,12 +77583,12 @@ var init_search = __esm(() => {
   init_safe_git();
   init_types2();
   init_seal2();
-  PY_CAPTURE_SCRIPT = join124(REPO_ROOT, "autonomy", "lib", "modernize", "py_capture.py");
+  PY_CAPTURE_SCRIPT = join125(REPO_ROOT, "autonomy", "lib", "modernize", "py_capture.py");
 });
 
 // ../../loki-ts/src/engine10/modernize/equiv.ts
-import { readFileSync as readFileSync107 } from "fs";
-import { join as join125 } from "path";
+import { readFileSync as readFileSync108 } from "fs";
+import { join as join126 } from "path";
 function parseCases(raw2) {
   const out3 = [];
   for (const line2 of raw2.split(`
@@ -77555,11 +77783,11 @@ function checkEquivalence(repoDir, mid, unit, newTreeDir, normalizers, runNew, l
     return notProvenResult(unit, "normalizers invalid: skip_fields covers every field, nothing would be compared", log);
   }
   const dir = oracleDir(repoDir, mid, unit);
-  const sealed = JSON.parse(readFileSync107(join125(dir, "sealed.json"), "utf8"));
+  const sealed = JSON.parse(readFileSync108(join126(dir, "sealed.json"), "utf8"));
   const normCheck = verifyNormalizersAgainstSeal(sealed, normalizers);
   if (!normCheck.ok)
     return notProvenResult(unit, `normalizers: ${normCheck.reason ?? "check failed"}`, log);
-  const records = parseCases(readFileSync107(join125(dir, "cases.jsonl"), "utf8"));
+  const records = parseCases(readFileSync108(join126(dir, "cases.jsonl"), "utf8"));
   const heldOutSet = new Set(sealed.held_out);
   let pass = 0;
   let fail2 = 0;
@@ -77750,7 +77978,7 @@ var init_reslice = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/modernize/scheduler.ts
-import { join as join126 } from "path";
+import { join as join127 } from "path";
 function mergeOnce(unit, ops, log, completed, worktree) {
   if (completed.has(unit))
     return "already_completed";
@@ -77871,7 +78099,7 @@ async function schedule(plan, opts) {
         reason = hit ? "budget stop" : "per-unit cost cap reached";
         break;
       }
-      const path = join126(modernizeRoot(opts.repoDir, opts.mid), "wt", variant === 0 ? encodeUnitId(unit.id) : `${encodeUnitId(unit.id)}${VARIANT_SEP}${variant}`);
+      const path = join127(modernizeRoot(opts.repoDir, opts.mid), "wt", variant === 0 ? encodeUnitId(unit.id) : `${encodeUnitId(unit.id)}${VARIANT_SEP}${variant}`);
       let outcome;
       attempts++;
       let resumeRunId;
@@ -77980,21 +78208,21 @@ var init_scheduler = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/modernize/resume.ts
-import { existsSync as existsSync87, readFileSync as readFileSync108 } from "fs";
+import { existsSync as existsSync87, readFileSync as readFileSync109 } from "fs";
 function loadResumeState(repoDir, mid) {
   const path = modernizeEventsPath(repoDir, mid);
   if (!existsSync87(path))
     return { ok: false, reason: `no modernize log at ${path}` };
   let text4;
   try {
-    text4 = readFileSync108(path, "utf8");
+    text4 = readFileSync109(path, "utf8");
   } catch (e10) {
     return { ok: false, reason: `modernize log unreadable: ${e10 instanceof Error ? e10.message : String(e10)}` };
   }
   const pj2 = planPath(repoDir, mid);
   if (existsSync87(pj2)) {
     try {
-      JSON.parse(readFileSync108(pj2, "utf8"));
+      JSON.parse(readFileSync109(pj2, "utf8"));
     } catch {
       return { ok: false, reason: `plan.json is corrupt or partial: ${pj2}` };
     }
@@ -78107,8 +78335,8 @@ var init_resume = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/modernize/report.ts
-import { mkdirSync as mkdirSync69, readFileSync as readFileSync109, writeFileSync as writeFileSync64 } from "fs";
-import { dirname as dirname48 } from "path";
+import { mkdirSync as mkdirSync69, readFileSync as readFileSync110, writeFileSync as writeFileSync64 } from "fs";
+import { dirname as dirname49 } from "path";
 function buildReport(o) {
   const units = o.units.map((x3) => ({ unit: x3.unit, verdict: x3.verdict, not_proven: [...x3.not_proven], rate: x3.rate, branchPct: x3.branchPct, receiptPath: x3.receiptPath, receiptSha256: x3.receiptSha256 }));
   const waves = o.waves.map((w) => ({
@@ -78151,7 +78379,7 @@ function renderReportMd(r) {
 function writeReport(o) {
   const sealed = sealReport(buildReport(o), o.sign);
   const jp2 = reportJsonPath(o.repoDir, o.mid);
-  mkdirSync69(dirname48(jp2), { recursive: true });
+  mkdirSync69(dirname49(jp2), { recursive: true });
   writeFileSync64(jp2, JSON.stringify(sealed, null, 2) + `
 `, "utf8");
   writeFileSync64(reportMdPath(o.repoDir, o.mid), renderReportMd(sealed), "utf8");
@@ -78168,7 +78396,7 @@ var init_report = __esm(() => {
 
 // ../../loki-ts/src/engine10/modernize/ship.ts
 import { mkdirSync as mkdirSync70, writeFileSync as writeFileSync65 } from "fs";
-import { join as join127 } from "path";
+import { join as join128 } from "path";
 function waveIsDraft(verdict, units) {
   return verdict === null || verdict.verified !== true || units.length === 0 || units.some((x3) => x3.verdict !== "PROVEN");
 }
@@ -78189,9 +78417,9 @@ function shipWave(o) {
     return fail2("no pinned origin: refusing to push (Rule of Two)");
   if (draft)
     return fail2("wave not verified: branch stays local, not pushed");
-  const dir = join127(o.repoDir, ".loki", "modernize", o.mid);
+  const dir = join128(o.repoDir, ".loki", "modernize", o.mid);
   mkdirSync70(dir, { recursive: true });
-  const bodyFile = join127(dir, `wave-${o.wave}-pr-body.md`);
+  const bodyFile = join128(dir, `wave-${o.wave}-pr-body.md`);
   writeFileSync65(bodyFile, renderWaveBody(o.wave, o.verdict, o.units), "utf8");
   const r = (o.push ?? runPushPr)({ repoDir: o.repoDir, branch: o.branch, title: `Loki modernize: wave ${o.wave}`, bodyFile, draft, pinnedOrigin });
   if (!r.ok)
@@ -78211,8 +78439,8 @@ var init_ship2 = __esm(() => {
 });
 
 // ../../loki-ts/src/engine10/modernize/presealed_wall.ts
-import { existsSync as existsSync88, mkdirSync as mkdirSync71, readFileSync as readFileSync110, writeFileSync as writeFileSync66 } from "fs";
-import { join as join128 } from "path";
+import { existsSync as existsSync88, mkdirSync as mkdirSync71, readFileSync as readFileSync111, writeFileSync as writeFileSync66 } from "fs";
+import { join as join129 } from "path";
 function isRealFailCount(n11) {
   return typeof n11 === "number" && Number.isInteger(n11) && n11 >= 1;
 }
@@ -78235,7 +78463,7 @@ function classifyBaseRun(o, repoDir) {
   return "not_run";
 }
 function preSealedPath(repoDir, mid, unit) {
-  return join128(oracleDir(repoDir, mid, unit), "presealed_wall.json");
+  return join129(oracleDir(repoDir, mid, unit), "presealed_wall.json");
 }
 function alreadySealed(repoDir, mid, unit) {
   return readModernizeEvents(repoDir, mid).some((e10) => e10.type === SEALED_EVENT && e10.data.unit === unit);
@@ -78249,7 +78477,7 @@ function sealPreSealedWall(repoDir, mid, unit, target, runConformance, log, base
   if (!oracleCheck.ok)
     return refuse(`oracle seal invalid: ${oracleCheck.reason ?? "unknown"}; presealed wall refused`);
   const dir = oracleDir(repoDir, mid, unit);
-  const oracleSealed = JSON.parse(readFileSync110(join128(dir, "sealed.json"), "utf8"));
+  const oracleSealed = JSON.parse(readFileSync111(join129(dir, "sealed.json"), "utf8"));
   if (oracleSealed.verdict !== "PROVEN_ORACLE") {
     return refuse(`oracle seal invalid: oracle is ${oracleSealed.verdict} (${oracleSealed.not_proven ?? "no reason recorded"}); presealed wall refused`);
   }
@@ -78318,7 +78546,7 @@ function verifyPreSealedWall(repoDir, mid, unit) {
   const expectedSha = event.data.sealed_sha256;
   if (typeof expectedSha !== "string")
     return { ok: false, reason: "sealing event has no sealed_sha256" };
-  const sealedRaw = readFileSync110(sealedPath, "utf8");
+  const sealedRaw = readFileSync111(sealedPath, "utf8");
   const actualSha = sha2564(sealedRaw);
   if (actualSha !== expectedSha) {
     return { ok: false, reason: "presealed_wall.json does not match the sealing event's hash (tampered or rewritten)" };
@@ -78327,7 +78555,7 @@ function verifyPreSealedWall(repoDir, mid, unit) {
   if (!oracleCheck.ok) {
     return { ok: false, reason: `bound oracle seal is no longer valid: ${oracleCheck.reason ?? "unknown"}` };
   }
-  const oracleSealed = JSON.parse(readFileSync110(join128(oracleDir(repoDir, mid, unit), "sealed.json"), "utf8"));
+  const oracleSealed = JSON.parse(readFileSync111(join129(oracleDir(repoDir, mid, unit), "sealed.json"), "utf8"));
   const carried = JSON.parse(sealedRaw);
   if (carried.oracle_cases_sha256 !== oracleSealed.cases_sha256 || carried.oracle_coverage_sha256 !== oracleSealed.coverage_sha256 || typeof carried.oracle_normalizers_sha256 !== "string" || typeof oracleSealed.normalizers_sha256 !== "string" || carried.oracle_normalizers_sha256 !== oracleSealed.normalizers_sha256) {
     return { ok: false, reason: "carried oracle hashes do not match the current oracle seal" };
@@ -78353,9 +78581,9 @@ var init_presealed_wall = __esm(() => {
 // ../../loki-ts/src/engine10/modernize/unit.ts
 import { spawnSync as spawnSync19 } from "child_process";
 import { createHash as createHash35 } from "crypto";
-import { lstatSync as lstatSync29, readFileSync as readFileSync111, readdirSync as readdirSync37, readlinkSync as readlinkSync7, realpathSync as realpathSync33, rmSync as rmSync36 } from "fs";
+import { lstatSync as lstatSync29, readFileSync as readFileSync112, readdirSync as readdirSync37, readlinkSync as readlinkSync7, realpathSync as realpathSync33, rmSync as rmSync36 } from "fs";
 import { tmpdir as tmpdir22 } from "os";
-import { join as join129, sep as sep20 } from "path";
+import { join as join130, sep as sep20 } from "path";
 function isSealedName(rel) {
   return TEST_FILE2.test(rel) || PYTEST_CFG.test(rel);
 }
@@ -78370,7 +78598,7 @@ function purgePycache(dir) {
     for (const e10 of ents) {
       if (!e10.isDirectory())
         continue;
-      const full = join129(d, e10.name);
+      const full = join130(d, e10.name);
       if (e10.name === "__pycache__")
         rmSync36(full, { recursive: true, force: true });
       else if (!skipName(e10.name))
@@ -78425,13 +78653,13 @@ function outsideTargetDigest(dir, full) {
       }
       for (const n11 of names) {
         h10.update("D" + n11);
-        walk(join129(p, n11));
+        walk(join130(p, n11));
       }
       return;
     }
     if (st2.isFile()) {
       try {
-        h10.update(readFileSync111(p));
+        h10.update(readFileSync112(p));
       } catch {
         h10.update("unreadable");
       }
@@ -78446,7 +78674,7 @@ function conformanceHashes(dir) {
   const walk = (sub2, inSkip) => {
     let ents;
     try {
-      ents = readdirSync37(join129(dir, sub2), { withFileTypes: true });
+      ents = readdirSync37(join130(dir, sub2), { withFileTypes: true });
     } catch {
       return;
     }
@@ -78477,14 +78705,14 @@ function conformanceHashes(dir) {
   for (const rel of rels) {
     let data;
     try {
-      const st2 = lstatSync29(join129(dir, rel));
+      const st2 = lstatSync29(join130(dir, rel));
       if (st2.isSymbolicLink()) {
-        out3[rel] = `${LINK}${readlinkSync7(join129(dir, rel))}|${outsideTargetDigest(dir, join129(dir, rel))}`;
+        out3[rel] = `${LINK}${readlinkSync7(join130(dir, rel))}|${outsideTargetDigest(dir, join130(dir, rel))}`;
         continue;
       }
       if (!st2.isFile())
         continue;
-      data = readFileSync111(join129(dir, rel));
+      data = readFileSync112(join130(dir, rel));
     } catch {
       continue;
     }
@@ -78543,7 +78771,7 @@ function notProvenUnitResult(unit, reason, oracle, wall) {
   return { unit, verdict: "NOT_PROVEN", oracle, wall, equiv: null, not_proven: [reason], conformance: null };
 }
 function readOracleSealed(repoDir, mid, unit) {
-  return JSON.parse(readFileSync111(join129(oracleDir(repoDir, mid, unit), "sealed.json"), "utf8"));
+  return JSON.parse(readFileSync112(join130(oracleDir(repoDir, mid, unit), "sealed.json"), "utf8"));
 }
 function runUnit(card, log, runConformance, implement, runNew, runStub, collect) {
   const { repoDir, mid, unit } = card;
@@ -78654,8 +78882,8 @@ var init_unit = __esm(() => {
 
 // ../../loki-ts/src/engine10/modernize/wave.ts
 import { spawnSync as spawnSync20 } from "child_process";
-import { readFileSync as readFileSync112, statSync as statSync33 } from "fs";
-import { join as join130 } from "path";
+import { readFileSync as readFileSync113, statSync as statSync33 } from "fs";
+import { join as join131 } from "path";
 function clampTimeout(ms) {
   if (ms === undefined || !Number.isFinite(ms) || ms <= 0)
     return DEFAULT_STEP_TIMEOUT_MS;
@@ -78724,7 +78952,7 @@ function detectWaveCommands(inv, target) {
   const none = { build: null, integration: null, original_suite: null };
   const text4 = () => {
     try {
-      return readFileSync112(join130(target, marker ?? ""), "utf8");
+      return readFileSync113(join131(target, marker ?? ""), "utf8");
     } catch {
       return "";
     }
@@ -78736,7 +78964,7 @@ function detectWaveCommands(inv, target) {
   if (system === "gradle") {
     let gw2 = "gradle";
     try {
-      if (inv.files.includes("gradlew") && (statSync33(join130(target, "gradlew")).mode & 73) !== 0)
+      if (inv.files.includes("gradlew") && (statSync33(join131(target, "gradlew")).mode & 73) !== 0)
         gw2 = "./gradlew";
     } catch {}
     return { build: { argv: [gw2, "assemble"] }, integration: text4().includes("integrationTest") ? { argv: [gw2, "integrationTest"] } : null, original_suite: { argv: [gw2, "test"] } };
@@ -78748,7 +78976,7 @@ function detectWaveCommands(inv, target) {
   let toxIni = "";
   if (inv.files.includes("tox.ini")) {
     try {
-      toxIni = readFileSync112(join130(target, "tox.ini"), "utf8");
+      toxIni = readFileSync113(join131(target, "tox.ini"), "utf8");
     } catch {}
   }
   const integration = toxIni.includes("[testenv:integration") ? { argv: ["tox", "-e", "integration"] } : itDir && pytest ? { argv: ["python3", "-m", "pytest", "-q", itDir] } : null;
@@ -78780,9 +79008,9 @@ var init_wave = __esm(() => {
 
 // ../../loki-ts/src/util/modernize_unit.ts
 import { spawnSync as spawnSync21 } from "child_process";
-import { existsSync as existsSync89, lstatSync as lstatSync30, mkdtempSync as mkdtempSync18, readFileSync as readFileSync113, realpathSync as realpathSync34, rmSync as rmSync37, statSync as statSync34, writeFileSync as writeFileSync67 } from "fs";
+import { existsSync as existsSync89, lstatSync as lstatSync30, mkdtempSync as mkdtempSync18, readFileSync as readFileSync114, realpathSync as realpathSync34, rmSync as rmSync37, statSync as statSync34, writeFileSync as writeFileSync67 } from "fs";
 import { tmpdir as tmpdir23 } from "os";
-import { join as join131, sep as sep21 } from "path";
+import { join as join132, sep as sep21 } from "path";
 function parseUnitArgs(args) {
   const f = {};
   for (let i = 0;i < args.length; i++) {
@@ -78854,7 +79082,7 @@ function makeUnitRunners(o) {
 }
 function makeSessionRunner(o) {
   const limitS = o.sessionLimitS ?? SESSION_LIMIT_S2;
-  const cli = import.meta.path.endsWith("modernize_unit.ts") ? join131(import.meta.dir, "..", "cli.ts") : import.meta.path;
+  const cli = import.meta.path.endsWith("modernize_unit.ts") ? join132(import.meta.dir, "..", "cli.ts") : import.meta.path;
   return o.session ?? ((_brief, cwd, env) => spawnSync21(process.execPath, [...SAFE_BUN_FLAGS, cli, "engine10", "session"], { cwd, env, stdio: ["ignore", "ignore", "pipe"], timeout: limitS * 1000 }));
 }
 function defaultUnitFile(unitId, newTreeDir) {
@@ -78862,7 +79090,7 @@ function defaultUnitFile(unitId, newTreeDir) {
     return null;
   try {
     const root = realpathSync34(newTreeDir);
-    const real3 = realpathSync34(join131(root, unitId));
+    const real3 = realpathSync34(join132(root, unitId));
     return real3.startsWith(root + sep21) ? real3 : null;
   } catch {
     return null;
@@ -78899,16 +79127,16 @@ function runPythonCase(o, unitId, newTreeDir, rec2, stub) {
   const src = o.unitFile ? o.unitFile(unitId, newTreeDir) : defaultUnitFile(unitId, newTreeDir);
   if (!src || !src.endsWith(".py") || !existsSync89(src))
     throw new Error(`cannot locate the source of unit ${unitId} in the new tree`);
-  const dir = mkdtempSync18(join131(tmpdir23(), "loki-newcase-"));
+  const dir = mkdtempSync18(join132(tmpdir23(), "loki-newcase-"));
   try {
-    const cases = join131(dir, "in.jsonl"), out3 = join131(dir, "out.jsonl");
+    const cases = join132(dir, "in.jsonl"), out3 = join132(dir, "out.jsonl");
     writeFileSync67(cases, JSON.stringify({ entry: rec2.entry, args: rec2.args, kwargs: rec2.kwargs, boundaries: boundariesFromCase(rec2) }) + `
 `, "utf8");
-    const r = spawnSync21(o.pythonBin ?? "python3", [join131(REPO_ROOT, "autonomy", "lib", "modernize", "py_capture.py"), "--unit", src, "--cases", cases, "--out", out3, ...stub ? ["--stub"] : []], { cwd: newTreeDir, encoding: "utf8", timeout: CASE_TIMEOUT_MS, env: { ...tokenFreeEnv(), PYTHONDONTWRITEBYTECODE: "1" } });
+    const r = spawnSync21(o.pythonBin ?? "python3", [join132(REPO_ROOT, "autonomy", "lib", "modernize", "py_capture.py"), "--unit", src, "--cases", cases, "--out", out3, ...stub ? ["--stub"] : []], { cwd: newTreeDir, encoding: "utf8", timeout: CASE_TIMEOUT_MS, env: { ...tokenFreeEnv(), PYTHONDONTWRITEBYTECODE: "1" } });
     if (r.status !== 0 || !existsSync89(out3))
       throw new Error(`new-tree case runner failed (${r.status ?? r.signal ?? "no status"}): ${String(r.stderr ?? "").trim().split(`
 `).pop() ?? ""}`);
-    const line2 = readFileSync113(out3, "utf8").split(`
+    const line2 = readFileSync114(out3, "utf8").split(`
 `).find((l) => l.trim() !== "");
     if (!line2)
       throw new Error("new-tree case runner produced no record");
@@ -78934,7 +79162,7 @@ Usage: ${UNIT_USAGE}
   const root = u10.tmpRoot ?? (runTmp !== "" && isRealDir(runTmp) ? runTmp : tmpdir23());
   let repoDir;
   try {
-    repoDir = mkdtempSync18(join131(root, "loki-unit-"));
+    repoDir = mkdtempSync18(join132(root, "loki-unit-"));
   } catch (e10) {
     process.stderr.write(`modernize unit: cannot create a temp checkout directory: ${e10.message}
 `);
@@ -79030,11 +79258,11 @@ var init_modernize_unit = __esm(() => {
 
 // ../../loki-ts/src/util/modernize_coordinator.ts
 import { createHash as createHash36 } from "crypto";
-import { existsSync as existsSync90, mkdtempSync as mkdtempSync19, readFileSync as readFileSync114, rmSync as rmSync38 } from "fs";
+import { existsSync as existsSync90, mkdtempSync as mkdtempSync19, readFileSync as readFileSync115, rmSync as rmSync38 } from "fs";
 import { tmpdir as tmpdir24 } from "os";
-import { join as join132 } from "path";
+import { join as join133 } from "path";
 function shipUnitOf(d, unit, o) {
-  const sealed = join132(oracleDir(d.repoDir, d.mid, unit), "sealed.json");
+  const sealed = join133(oracleDir(d.repoDir, d.mid, unit), "sealed.json");
   const eq3 = o?.result?.equiv;
   return {
     unit,
@@ -79051,7 +79279,7 @@ function scopeBuildToWave(cmd2, repoDir, units) {
   const x3 = cmd2?.argv.indexOf("-x") ?? -1;
   if (!cmd2 || !cmd2.argv.includes("compileall") || x3 < 0)
     return cmd2;
-  const files = [...new Set(units.flatMap((u10) => u10.nodes))].filter((n11) => n11.endsWith(".py") && isSafeUnitId(n11) && existsSync90(join132(repoDir, n11)));
+  const files = [...new Set(units.flatMap((u10) => u10.nodes))].filter((n11) => n11.endsWith(".py") && isSafeUnitId(n11) && existsSync90(join133(repoDir, n11)));
   return files.length ? { ...cmd2, argv: [...cmd2.argv.slice(0, x3 + 2), ...files] } : cmd2;
 }
 async function runWaves(plan, d) {
@@ -79210,16 +79438,16 @@ function makeAttemptRunner(o) {
 }
 function makeUnitPrep(o) {
   const runtimeOk = o.runtimeOk ?? (() => {
-    const dir = mkdtempSync19(join132(tmpdir24(), "loki-probe-"));
+    const dir = mkdtempSync19(join133(tmpdir24(), "loki-probe-"));
     try {
-      return realCaptureRunner(join132(dir, "probe.py"), []).error !== "old runtime unavailable";
+      return realCaptureRunner(join133(dir, "probe.py"), []).error !== "old runtime unavailable";
     } finally {
       rmSync38(dir, { recursive: true, force: true });
     }
   });
   let runtime = null;
   return (unit) => {
-    if (existsSync90(join132(oracleDir(o.repoDir, o.mid, unit.id), "cases.jsonl")) || alreadySealedInLog(o.repoDir, o.mid, unit.id))
+    if (existsSync90(join133(oracleDir(o.repoDir, o.mid, unit.id), "cases.jsonl")) || alreadySealedInLog(o.repoDir, o.mid, unit.id))
       return null;
     runtime ??= runtimeOk();
     if (!runtime)
@@ -79227,7 +79455,7 @@ function makeUnitPrep(o) {
     const node = unit.nodes.length === 1 ? unit.nodes[0] : "";
     if (!node.endsWith(".py") || !isSafeUnitId(node))
       return MULTI_FILE_REASON;
-    const r = (o.capture ?? captureUnitOracle)({ repoDir: o.repoDir, mid: o.mid, unit: unit.id, unitPath: join132(o.repoDir, node), propose: o.propose });
+    const r = (o.capture ?? captureUnitOracle)({ repoDir: o.repoDir, mid: o.mid, unit: unit.id, unitPath: join133(o.repoDir, node), propose: o.propose });
     return r.ok ? null : r.reason;
   };
 }
@@ -79286,7 +79514,7 @@ function productionWaveDeps(o) {
     }
   };
 }
-var productionReslice, sha2565 = (p) => existsSync90(p) ? createHash36("sha256").update(readFileSync114(p)).digest("hex") : "n/a", MULTI_FILE_REASON = "multi-file unit: capture not supported (founder default)";
+var productionReslice, sha2565 = (p) => existsSync90(p) ? createHash36("sha256").update(readFileSync115(p)).digest("hex") : "n/a", MULTI_FILE_REASON = "multi-file unit: capture not supported (founder default)";
 var init_modernize_coordinator = __esm(() => {
   init_codemod();
   init_search();
@@ -79619,8 +79847,8 @@ __export(exports_export_sarif, {
   preRedFromEvents: () => preRedFromEvents,
   main: () => main8
 });
-import { existsSync as existsSync92, readFileSync as readFileSync115, writeFileSync as writeFileSync68 } from "fs";
-import { join as join133 } from "path";
+import { existsSync as existsSync92, readFileSync as readFileSync116, writeFileSync as writeFileSync68 } from "fs";
+import { join as join134 } from "path";
 function scanDiff(diff) {
   const out3 = [];
   let file = "";
@@ -79651,7 +79879,7 @@ function scanDiff(diff) {
 function preRedFromEvents(runDir) {
   try {
     let pre2 = [];
-    for (const l of readFileSync115(join133(runDir, "events.jsonl"), "utf8").split(`
+    for (const l of readFileSync116(join134(runDir, "events.jsonl"), "utf8").split(`
 `)) {
       if (!l.includes('"stage.completed"'))
         continue;
@@ -79680,19 +79908,19 @@ async function main8(args, deps = {}) {
   if (bad || rest.length > 1)
     return process.stderr.write(`loki export --sarif: ${bad ? `unknown flag ${bad}` : "more than one run-id"}
 `), 2;
-  const runsRoot2 = deps.runsRoot ?? join133(lokiDir(), "runs");
+  const runsRoot2 = deps.runsRoot ?? join134(lokiDir(), "runs");
   const runId2 = rest[0] ?? latestRunId(runsRoot2);
   if (!runId2)
     return process.stderr.write(`loki export --sarif: no runs found
 `), 66;
-  const runDir = join133(runsRoot2, runId2);
-  const receiptPath = join133(runDir, "receipt.json");
+  const runDir = join134(runsRoot2, runId2);
+  const receiptPath = join134(runDir, "receipt.json");
   if (runId2.includes("/") || runId2.includes("..") || !existsSync92(receiptPath))
     return process.stderr.write(`loki export --sarif: unknown run ${runId2}
 `), 66;
   let receipt;
   try {
-    receipt = JSON.parse(readFileSync115(receiptPath, "utf8"));
+    receipt = JSON.parse(readFileSync116(receiptPath, "utf8"));
   } catch {
     return process.stderr.write(`loki export --sarif: unreadable receipt for ${runId2}
 `), 66;
@@ -79709,9 +79937,9 @@ async function main8(args, deps = {}) {
   findings.push(...receiptFindings(receipt, preRedFromEvents(runDir)));
   let version2 = "0.0.0";
   try {
-    version2 = readFileSync115(join133(REPO_ROOT, "VERSION"), "utf8").trim() || version2;
+    version2 = readFileSync116(join134(REPO_ROOT, "VERSION"), "utf8").trim() || version2;
   } catch {}
-  const out3 = join133(runDir, "findings.sarif");
+  const out3 = join134(runDir, "findings.sarif");
   writeFileSync68(out3, JSON.stringify(toSarif(findings, version2, deps.repoDir ?? process.cwd()), null, 2) + `
 `);
   process.stdout.write(`run: ${runId2}
@@ -79930,7 +80158,7 @@ var init_output = __esm(() => {
 
 // ../../loki-ts/src/features/receipt_dsse.ts
 import { createPublicKey as createPublicKey5, sign as sign3, verify as verify3 } from "crypto";
-import { readFileSync as readFileSync116 } from "fs";
+import { readFileSync as readFileSync117 } from "fs";
 function pae2(payloadType, body) {
   const t = Buffer.from(payloadType, "utf8");
   return Buffer.concat([Buffer.from(`DSSEv1 ${t.length} `), t, Buffer.from(` ${body.length} `), body]);
@@ -80026,7 +80254,7 @@ function verifyDsseReceipt(env, d) {
 }
 function runIdGuard(receiptPath, runId2) {
   try {
-    return envelopeRunIdProblem(JSON.parse(readFileSync116(receiptPath, "utf8")), runId2);
+    return envelopeRunIdProblem(JSON.parse(readFileSync117(receiptPath, "utf8")), runId2);
   } catch {
     return null;
   }
@@ -80034,7 +80262,7 @@ function runIdGuard(receiptPath, runId2) {
 async function exportDsseReceipt(a) {
   const fail2 = (rc2, m) => (process.stderr.write(`loki verify --export-dsse: ${m}
 `), rc2);
-  const rd2 = a.deps.read ?? ((p) => readFileSync116(p, "utf8"));
+  const rd2 = a.deps.read ?? ((p) => readFileSync117(p, "utf8"));
   let text4;
   try {
     text4 = rd2(a.receiptPath);
@@ -80091,10 +80319,10 @@ var init_undo = __esm(() => {
 });
 
 // ../../loki-ts/src/commands/run_status.ts
-import { existsSync as existsSync93, readdirSync as readdirSync38, readFileSync as readFileSync117, statSync as statSync36 } from "fs";
-import { basename as basename32, dirname as dirname49, join as join134, resolve as resolve39 } from "path";
+import { existsSync as existsSync93, readdirSync as readdirSync38, readFileSync as readFileSync118, statSync as statSync36 } from "fs";
+import { basename as basename32, dirname as dirname50, join as join135, resolve as resolve39 } from "path";
 function runsRoot(env, repoDir) {
-  return env.LOKI_DIR ? join134(resolve39(repoDir, env.LOKI_DIR), "runs") : join134(repoDir, ".loki", "runs");
+  return env.LOKI_DIR ? join135(resolve39(repoDir, env.LOKI_DIR), "runs") : join135(repoDir, ".loki", "runs");
 }
 function listRunIds(root) {
   if (!existsSync93(root))
@@ -80106,7 +80334,7 @@ function latestRunId(root) {
   return ids.length ? ids[ids.length - 1] : null;
 }
 function eventsPath(root, runId2) {
-  return join134(root, runId2, "events.jsonl");
+  return join135(root, runId2, "events.jsonl");
 }
 var TERMINAL2;
 var init_run_status = __esm(() => {
@@ -80123,8 +80351,8 @@ var init_run_status = __esm(() => {
 
 // ../../loki-ts/src/util/seal_drift.ts
 import { createHash as createHash38 } from "crypto";
-import { existsSync as existsSync94, readFileSync as readFileSync118, realpathSync as realpathSync35 } from "fs";
-import { basename as basename33, dirname as dirname50, join as join135, relative as relative27 } from "path";
+import { existsSync as existsSync94, readFileSync as readFileSync119, realpathSync as realpathSync35 } from "fs";
+import { basename as basename33, dirname as dirname51, join as join136, relative as relative27 } from "path";
 function tornTail(raw2) {
   if (raw2 === "" || raw2.endsWith(`
 `))
@@ -80143,7 +80371,7 @@ function tornTail(raw2) {
 function boundEvents(log, bound) {
   if (!existsSync94(log))
     return null;
-  const lines2 = readFileSync118(log, "utf8").split(`
+  const lines2 = readFileSync119(log, "utf8").split(`
 `).filter((l) => l.trim() !== ""), h10 = createHash38("sha256");
   let n11 = -1;
   for (let i = 0;i <= lines2.length; i++) {
@@ -80171,7 +80399,7 @@ function fabricatedPass(receiptPath, r) {
   const bound = r["events_sha256"];
   if (typeof bound !== "string" || bound === EMPTY_SHA || !Array.isArray(r["checks"]))
     return null;
-  const events2 = boundEvents(join135(dirname50(receiptPath), "events.jsonl"), bound);
+  const events2 = boundEvents(join136(dirname51(receiptPath), "events.jsonl"), bound);
   if (!events2 || !events2.some((e10) => e10.stage === "verify"))
     return null;
   const passed = new Set(events2.filter((e10) => e10.type === "test.result" && e10.stage === "verify" && e10.data["result"] === "pass").map((e10) => String(e10.data["name"])));
@@ -80179,12 +80407,12 @@ function fabricatedPass(receiptPath, r) {
   return missing.length ? `receipt claims pass with no test.result pass in events.jsonl: ${missing.join(", ")}` : null;
 }
 function currentTaskSha(runDir, source, env) {
-  const f = source === "issue" ? join135(runDir, "issue.json") : env["LOKI_VERIFY_TASK_FILE"];
-  return f && existsSync94(f) ? sha6(readFileSync118(f)) : null;
+  const f = source === "issue" ? join136(runDir, "issue.json") : env["LOKI_VERIFY_TASK_FILE"];
+  return f && existsSync94(f) ? sha6(readFileSync119(f)) : null;
 }
 function repoOf(receiptPath) {
-  const runs2 = dirname50(dirname50(receiptPath));
-  return basename33(runs2) === "runs" && basename33(dirname50(runs2)) === ".loki" ? dirname50(dirname50(runs2)) : null;
+  const runs2 = dirname51(dirname51(receiptPath));
+  return basename33(runs2) === "runs" && basename33(dirname51(runs2)) === ".loki" ? dirname51(dirname51(runs2)) : null;
 }
 function overlap(repo, base, sealedHead, head) {
   if (typeof base !== "string" || !/^[0-9a-f]{40,64}$/.test(base) || !/^[0-9a-f]{40,64}$/.test(sealedHead))
@@ -80210,7 +80438,7 @@ function onlyWallPublish(repo, r, sealedHead, head) {
       } catch {
         return x3;
       }
-    }, rr2 = real3(repo), want = new Map(wall.map((w) => [relative27(rr2, join135(real3(dirname50(String(w.path))), basename33(String(w.path)))), String(w.sha256)]));
+    }, rr2 = real3(repo), want = new Map(wall.map((w) => [relative27(rr2, join136(real3(dirname51(String(w.path))), basename33(String(w.path)))), String(w.sha256)]));
     const commits = safeGit(repo, ["rev-list", "--reverse", "--topo-order", `${sealedHead}..${head}`]).split(`
 `).filter(Boolean);
     if (commits.length === 0 || safeGit(repo, ["rev-list", "--merges", "--count", `${sealedHead}..${head}`]).trim() !== "0")
@@ -80248,18 +80476,18 @@ function claimsWallPublish(repo, r, sealedHead, head) {
 function sealDrift(given, r, env = process.env) {
   let receiptPath = given;
   try {
-    receiptPath = join135(realpathSync35(dirname50(given)), basename33(given));
+    receiptPath = join136(realpathSync35(dirname51(given)), basename33(given));
   } catch {}
   const fab = fabricatedPass(receiptPath, r);
   if (fab)
     return { verdict: "TAMPERED", reason: fab };
   try {
-    const log = join135(dirname50(receiptPath), "events.jsonl");
-    if (existsSync94(log) && tornTail(readFileSync118(log, "utf8")))
+    const log = join136(dirname51(receiptPath), "events.jsonl");
+    if (existsSync94(log) && tornTail(readFileSync119(log, "utf8")))
       return { verdict: "UNCHECKED", reason: "events.jsonl ends in a torn, unterminated line (an append cut mid-write); every complete line is intact but the log is not whole" };
   } catch {}
   const task = r["task"] ?? {};
-  const cur = currentTaskSha(dirname50(receiptPath), task.source, env);
+  const cur = currentTaskSha(dirname51(receiptPath), task.source, env);
   if (cur !== null && typeof task.sha256 === "string" && task.sha256 !== "" && cur !== task.sha256)
     return { verdict: "UNCHECKED", reason: `intent drift: sealed task sha256 ${task.sha256} differs from the current spec ${cur}` };
   const repo = repoOf(receiptPath);
@@ -80282,6 +80510,17 @@ function sealDrift(given, r, env = process.env) {
   }
   return null;
 }
+function wallNotComparedNote(receiptPath) {
+  try {
+    const r = JSON.parse(readFileSync119(receiptPath, "utf8"));
+    if (r["schema"] !== "loki.v10.receipt/1")
+      return null;
+    const files = r["wall"]?.files;
+    return Array.isArray(files) && files.length > 0 && !existsSync94(join136(dirname51(receiptPath), "wall")) ? "sealed Wall copies not present: not compared" : null;
+  } catch {
+    return null;
+  }
+}
 var EMPTY_SHA, sha6 = (s) => createHash38("sha256").update(s).digest("hex");
 var init_seal_drift = __esm(() => {
   init_safe_git();
@@ -80289,14 +80528,14 @@ var init_seal_drift = __esm(() => {
 });
 
 // ../../loki-ts/src/util/composite_seal.ts
-import { existsSync as existsSync95, readFileSync as readFileSync119 } from "fs";
-import { basename as basename34, dirname as dirname51, join as join136 } from "path";
+import { existsSync as existsSync95, readFileSync as readFileSync120 } from "fs";
+import { basename as basename34, dirname as dirname52, join as join137 } from "path";
 function logProblem(runDir, integ) {
   if (typeof integ["log_sha256"] !== "string")
     return null;
   let b;
   try {
-    b = readFileSync119(join136(runDir, "integration.log"));
+    b = readFileSync120(join137(runDir, "integration.log"));
   } catch {
     return "integration.log is missing but integration.json records its hash";
   }
@@ -80311,10 +80550,10 @@ function integrationProblem(integ) {
   return null;
 }
 function composeComposite(runDir, rh, toolchain = collectToolchain()) {
-  const ip = join136(runDir, "integration.json");
+  const ip = join137(runDir, "integration.json");
   let ibytes;
   try {
-    ibytes = readFileSync119(ip);
+    ibytes = readFileSync120(ip);
   } catch {
     throw new Error("integration.json missing; the workspace run did not finish");
   }
@@ -80338,12 +80577,12 @@ function composeComposite(runDir, rh, toolchain = collectToolchain()) {
     const outcome = String(integ["outcomes"][repo] ?? "");
     if (outcome !== "ok")
       throw new Error(`repo ${text3(repo, 80)} did not finish (${text3(outcome, 80) || "no outcome"}); no composite`);
-    const runsDir = join136(runDir, "worktrees", slugOf(repo), ".loki", "runs");
-    const ids = (dirNames(runsDir) ?? []).filter((n11) => existsSync95(join136(runsDir, n11, "receipt.json")));
+    const runsDir = join137(runDir, "worktrees", slugOf(repo), ".loki", "runs");
+    const ids = (dirNames(runsDir) ?? []).filter((n11) => existsSync95(join137(runsDir, n11, "receipt.json")));
     const id2 = ids[ids.length - 1];
     if (!id2)
       throw new Error(`repo ${text3(repo, 80)} has no receipt.json under worktrees/${slugOf(repo)}/.loki/runs`);
-    const rp = join136(runsDir, id2, "receipt.json"), bytes = readFileSync119(rp), r = readJson7(rp);
+    const rp = join137(runsDir, id2, "receipt.json"), bytes = readFileSync120(rp), r = readJson7(rp);
     if (jsonTooDeep(r))
       throw new Error(`repo ${text3(repo, 80)} receipt cannot be hashed (nested too deeply); no composite`);
     if (!isObj10(r) || typeof r["receipt_sha256"] !== "string" || rh(r) !== r["receipt_sha256"])
@@ -80361,7 +80600,7 @@ function composeComposite(runDir, rh, toolchain = collectToolchain()) {
     throw new Error("workspace has no repos");
   return {
     schema: COMPOSITE_SCHEMA,
-    workspace: basename34(dirname51(runDir)),
+    workspace: basename34(dirname52(runDir)),
     run_id: basename34(runDir),
     integration_sha256: sha4(ibytes),
     integration: { status: String(integ["status"]), exit_code: typeof integ["exit_code"] === "number" ? integ["exit_code"] : null, log_sha256: typeof integ["log_sha256"] === "string" ? integ["log_sha256"] : null, heads },
@@ -80371,7 +80610,7 @@ function composeComposite(runDir, rh, toolchain = collectToolchain()) {
   };
 }
 async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
-  const runDir = dirname51(receiptPath);
+  const runDir = dirname52(receiptPath);
   const signed = isObj10(receipt["verification"]) && typeof receipt["verification"]["jwt"] === "string";
   const bad = (reason) => ({ problem: { verdict: "TAMPERED", reason: `composite: ${reason}` }, verdict: "FAILED" });
   const deep = (what) => ({ problem: { verdict: "UNCHECKED", reason: `composite: ${what} cannot be hashed (nested too deeply)` }, verdict: "FAILED" });
@@ -80380,13 +80619,13 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
     return bad("body malformed");
   let ibytes;
   try {
-    ibytes = readFileSync119(join136(runDir, "integration.json"));
+    ibytes = readFileSync120(join137(runDir, "integration.json"));
   } catch {
     return bad("integration.json missing");
   }
   if (sha4(ibytes) !== receipt["integration_sha256"])
     return bad("integration.json does not match its recorded hash");
-  const integ = readJson7(join136(runDir, "integration.json"));
+  const integ = readJson7(join137(runDir, "integration.json"));
   if (jsonTooDeep(integ))
     return deep("integration.json");
   if (!isObj10(integ) || !isObj10(integ["outcomes"]))
@@ -80423,10 +80662,10 @@ async function verifyComposite(receiptPath, receipt, rh, verifyOne, deps = {}) {
       return bad(`child ${text3(repo, 80) || "?"} has an invalid receipt path`);
     if (outcomes[repo] !== "ok")
       return bad(`child ${text3(repo, 80)} did not finish ok in integration.json`);
-    const rp = join136(runDir, rel);
+    const rp = join137(runDir, rel);
     let bytes;
     try {
-      bytes = readFileSync119(rp);
+      bytes = readFileSync120(rp);
     } catch {
       return bad(`child ${repo} receipt missing`);
     }
@@ -80486,8 +80725,8 @@ __export(exports_verify_cmd, {
   main: () => main9,
   computeReceiptHash: () => computeReceiptHash
 });
-import { existsSync as existsSync96, readFileSync as readFileSync120, renameSync as renameSync23, statSync as statSync37, writeFileSync as writeFileSync69 } from "fs";
-import { basename as basename35, dirname as dirname52, join as join137 } from "path";
+import { existsSync as existsSync96, readFileSync as readFileSync121, renameSync as renameSync23, statSync as statSync37, writeFileSync as writeFileSync69 } from "fs";
+import { basename as basename35, dirname as dirname53, join as join138 } from "path";
 import { createHash as createHash39, createPublicKey as createPublicKey6, verify as verify4 } from "crypto";
 function pubFor(kid, given) {
   if (given)
@@ -80495,7 +80734,7 @@ function pubFor(kid, given) {
   const active = loadSigningKey(false);
   const pubs = (process.env["LOKI_RECEIPT_RETIRED_PUBKEYS"] ?? "").split(":").map((f) => f.trim()).filter(Boolean).flatMap((f) => {
     try {
-      return [createPublicKey6(readFileSync120(f))];
+      return [createPublicKey6(readFileSync121(f))];
     } catch {
       return [];
     }
@@ -80525,14 +80764,14 @@ function checkAttestation(jwt, expectedHash, given) {
 }
 function wallTamperProblem(receiptPath, receipt) {
   const wall = receipt["wall"], files = Array.isArray(wall?.files) ? wall.files : [];
-  const wallDir = join137(dirname52(receiptPath), "wall"), haveWallDir = existsSync96(wallDir);
+  const wallDir = join138(dirname53(receiptPath), "wall"), haveWallDir = existsSync96(wallDir);
   for (const f of files) {
     if (typeof f?.path !== "string" || typeof f.sha256 !== "string")
       continue;
-    const copy = join137(wallDir, basename35(f.path));
+    const copy = join138(wallDir, basename35(f.path));
     let cur;
     try {
-      cur = createHash39("sha256").update(readFileSync120(copy)).digest("hex");
+      cur = createHash39("sha256").update(readFileSync121(copy)).digest("hex");
     } catch {
       if (haveWallDir)
         return `sealed Wall file ${basename35(f.path)} is missing from the run's wall directory: it was deleted after the seal`;
@@ -80559,10 +80798,10 @@ function checkEventLog(receiptPath, receipt) {
     const claims = st2 !== null && typeof st2 === "object" && Object.keys(st2).length > 0;
     return claims ? "the receipt records stages but binds the empty-log hash, so no events.jsonl can back it (missing, empty or non-empty); the receipt is forged or was sealed without a log. Re-run the task to produce a fresh receipt" : null;
   }
-  const path = join137(dirname52(receiptPath), "events.jsonl");
+  const path = join138(dirname53(receiptPath), "events.jsonl");
   if (!existsSync96(path))
     return "events.jsonl is missing";
-  const raw2 = readFileSync120(path, "utf8"), events2 = readEvents(path), all = raw2.split(`
+  const raw2 = readFileSync121(path, "utf8"), events2 = readEvents(path), all = raw2.split(`
 `).filter((l) => l.trim() !== ""), lines2 = tornTail(raw2) ? all.slice(0, -1) : all;
   if (events2.length !== lines2.length || events2.some((e10, i) => e10.seq !== i))
     return "events.jsonl has a forged, edited or missing line";
@@ -80582,7 +80821,7 @@ function checkEventLog(receiptPath, receipt) {
   return h10.digest("hex") === bound ? null : "events.jsonl does not match the hash recorded at seal";
 }
 function checkLogSeal(receiptPath, hash, kid, given) {
-  const path = join137(dirname52(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e10) => e10.type === "run.completed");
+  const path = join138(dirname53(receiptPath), "events.jsonl"), events2 = readEvents(path), done = events2.findIndex((e10) => e10.type === "run.completed");
   if (!events2.some((e10) => e10.type === "receipt.sealed" && e10.data["receipt_sha256"] === hash))
     return { verdict: "TAMPERED", reason: "events.jsonl has no receipt.sealed event for this receipt" };
   if (done < 0)
@@ -80590,7 +80829,7 @@ function checkLogSeal(receiptPath, hash, kid, given) {
   const seal = events2[done + 1], d = seal?.type === "log.sealed" ? seal.data : null;
   if (!d)
     return { verdict: "TAMPERED", reason: "events.jsonl has no signed log.sealed line after run.completed" };
-  const lines2 = readFileSync120(path, "utf8").split(`
+  const lines2 = readFileSync121(path, "utf8").split(`
 `).filter((l) => l.trim() !== ""), sha7 = createHash39("sha256").update(lines2.slice(0, done + 1).join(`
 `) + `
 `).digest("hex");
@@ -80604,7 +80843,7 @@ async function verifyReceipt(receiptPath, deps = {}) {
     return { verdict: "UNCHECKED", reasons: [`receipt not found: ${receiptPath}`] };
   let receipt;
   try {
-    receipt = JSON.parse((deps.read ?? ((p) => readFileSync120(p, "utf8")))(receiptPath));
+    receipt = JSON.parse((deps.read ?? ((p) => readFileSync121(p, "utf8")))(receiptPath));
   } catch {
     return { verdict: "UNCHECKED", reasons: ["receipt.json is not valid JSON"] };
   }
@@ -80699,7 +80938,7 @@ function sealCompositeCmd(runDir) {
 `), 2;
   }
   const hash = compositeHash(body), sig = signReceipt(body.run_id, hash);
-  const out3 = { ...body, composite_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } }, path = join137(runDir, "composite.json");
+  const out3 = { ...body, composite_sha256: hash, verification: { jwt: sig.jwt, kid: sig.kid } }, path = join138(runDir, "composite.json");
   writeFileSync69(`${path}.tmp`, JSON.stringify(out3, null, 2) + `
 `);
   renameSync23(`${path}.tmp`, path);
@@ -80715,7 +80954,7 @@ ${compositeLines(out3).join(`
 function independentLine(receiptPath) {
   let checks = [];
   try {
-    const c = JSON.parse(readFileSync120(receiptPath, "utf8")).checks;
+    const c = JSON.parse(readFileSync121(receiptPath, "utf8")).checks;
     if (Array.isArray(c))
       checks = c;
   } catch {}
@@ -80725,6 +80964,14 @@ function independentLine(receiptPath) {
   const k3 = pass.filter((c) => isExecutedProof(c) && (c.provenance === "exogenous" || c.provenance === "independent")).length, m = pass.filter((c) => c.provenance === "agent_authored" || c.provenance === "llm_judge").length;
   return { line: `agent-independent: ${k3} of ${pass.length} passing checks (wall/holdout/pre-existing/static/probe); advisory: ${m}`, k: k3, of: pass.length };
 }
+function signedRunIdProblem(receiptPath, runId2) {
+  try {
+    const r = JSON.parse(readFileSync121(receiptPath, "utf8")), s = r["run_id"];
+    return isEnvelope(r) || typeof s !== "string" || s === runId2 ? null : `receipt run_id ${JSON.stringify(printable(s).slice(0, 128))} does not match the run id ${JSON.stringify(runId2)} it was found under (a sealed run copied under another id)`;
+  } catch {
+    return null;
+  }
+}
 async function verifyMain(args, deps, rec2) {
   const allowUnsigned = args.includes("--allow-unsigned") || process.env["LOKI_VERIFY_ALLOW_UNSIGNED"] === "1";
   const exportDsse = args.includes("--export-dsse"), requireExo = args.includes("--require-exogenous") || process.env["LOKI_VERIFY_REQUIRE_EXOGENOUS"] === "1";
@@ -80772,20 +81019,20 @@ ${/^(unknown option|expected at most one)/.test(pk2.error) ? `Usage: loki verify
   args = pk2.args;
   if (pk2.pubkey)
     deps = { ...deps, pubkey: pk2.pubkey };
-  const runsRoot2 = deps.runsRoot ?? join137(lokiDir(), "runs");
+  const runsRoot2 = deps.runsRoot ?? join138(lokiDir(), "runs");
   const runId2 = args[0] ?? latestRunId(runsRoot2) ?? undefined;
   if (!runId2)
     return process.stderr.write(`loki verify: no runs found
 `), 66;
   const isFile = existsSync96(runId2) && statSync37(runId2).isFile();
   const isPath = isFile || /[\\/]/.test(runId2) || runId2.endsWith(".json");
-  const receiptPath = isPath ? runId2 : join137(runsRoot2, runId2, "receipt.json");
+  const receiptPath = isPath ? runId2 : join138(runsRoot2, runId2, "receipt.json");
   const byRunId = !isPath;
   rec2.runId = runId2;
   rec2.receiptPath = receiptPath;
   if (exportDsse)
     return exportDsseReceipt({ receiptPath, runId: byRunId ? runId2 : null, deps, verify: verifyReceipt, key: loadSigningKey(false), kidOf: kidOf2 });
-  const bad = byRunId ? runIdGuard(receiptPath, runId2) : null;
+  const bad = byRunId ? runIdGuard(receiptPath, runId2) ?? signedRunIdProblem(receiptPath, runId2) : null;
   if (bad)
     return rec2.verdict = "TAMPERED", rec2.reasons = [bad], process.stdout.write(`run: ${runId2}
 verdict: TAMPERED
@@ -80795,7 +81042,7 @@ verdict: TAMPERED
   if (result.verdict === "VERIFIED" || result.verdict === "UNSIGNED") {
     const d = (() => {
       try {
-        return sealDrift(receiptPath, JSON.parse(readFileSync120(receiptPath, "utf8")));
+        return sealDrift(receiptPath, JSON.parse(readFileSync121(receiptPath, "utf8")));
       } catch {
         return null;
       }
@@ -80808,7 +81055,7 @@ verdict: TAMPERED
   {
     const id2 = (() => {
       try {
-        const r = JSON.parse(readFileSync120(receiptPath, "utf8"));
+        const r = JSON.parse(readFileSync121(receiptPath, "utf8"));
         const j10 = r["verification"]?.jwt;
         const k3 = result.verdict === "VERIFIED" && typeof j10 === "string" ? JSON.parse(Buffer.from(j10.split(".")[0], "base64url").toString()).kid : null;
         return { kid: typeof k3 === "string" ? k3 : null, head: typeof r["head_sha"] === "string" ? r["head_sha"] : null, verdict: typeof r["verdict"] === "string" ? r["verdict"] : null, run: typeof r["run_id"] === "string" ? r["run_id"] : null };
@@ -80826,7 +81073,7 @@ verdict: TAMPERED
   if (result.verdict === "VERIFIED" || result.verdict === "UNSIGNED") {
     const outcome = (() => {
       try {
-        return outcomeOf2(JSON.parse(readFileSync120(receiptPath, "utf8")));
+        return outcomeOf2(JSON.parse(readFileSync121(receiptPath, "utf8")));
       } catch {
         return "UNREADABLE";
       }
@@ -80840,6 +81087,11 @@ verdict: NOT VERIFIED (run outcome ${outcome}; receipt integrity ${result.verdic
       return 4;
     }
   }
+  if (result.verdict === "VERIFIED" || result.verdict === "UNSIGNED") {
+    const note = wallNotComparedNote(receiptPath);
+    if (note)
+      result = { ...result, reasons: [...result.reasons, note] };
+  }
   rec2.verdict = result.verdict;
   rec2.reasons = result.reasons;
   rec2.receiptSha256 = result.receiptSha256 ?? null;
@@ -80855,7 +81107,7 @@ verdict: ${result.verdict}
 `);
   if (result.verdict !== "TAMPERED")
     try {
-      const r = JSON.parse(readFileSync120(receiptPath, "utf8"));
+      const r = JSON.parse(readFileSync121(receiptPath, "utf8"));
       if (isComposite(r))
         for (const l of compositeLines(r))
           process.stdout.write(`${l}
@@ -80913,8 +81165,8 @@ var init_verify_cmd = __esm(() => {
 });
 
 // src/server/app.ts
-import { existsSync as existsSync98, readFileSync as readFileSync123, statSync as statSync38 } from "fs";
-import { join as join140, resolve as resolve40, sep as sep23 } from "path";
+import { existsSync as existsSync98, readFileSync as readFileSync124, statSync as statSync38 } from "fs";
+import { join as join141, resolve as resolve40, sep as sep23 } from "path";
 
 // node_modules/hono/dist/request/constants.js
 var GET_MATCH_RESULT = Symbol();
@@ -91225,9 +91477,9 @@ function mount20(ctx) {
 }
 
 // src/server/routes/verify.ts
-import { readFileSync as readFileSync121, realpathSync as realpathSync36 } from "fs";
+import { readFileSync as readFileSync122, realpathSync as realpathSync36 } from "fs";
 import { createPublicKey as createPublicKey7 } from "crypto";
-import { join as join138, sep as sep22 } from "path";
+import { join as join139, sep as sep22 } from "path";
 init_verify_cmd();
 init_seal();
 init_receipt_dsse();
@@ -91254,11 +91506,11 @@ function mount21(ctx) {
       return done(404, "receipt not available", "not_found");
     let runDir, file;
     try {
-      const root = realpathSync36(join138(repo.p, ".loki", "runs"));
-      runDir = realpathSync36(join138(root, run2));
-      if (runDir !== join138(root, run2))
+      const root = realpathSync36(join139(repo.p, ".loki", "runs"));
+      runDir = realpathSync36(join139(root, run2));
+      if (runDir !== join139(root, run2))
         return done(404, "receipt not found", "not_found");
-      file = realpathSync36(join138(runDir, "receipt.json"));
+      file = realpathSync36(join139(runDir, "receipt.json"));
     } catch {
       return done(404, "receipt not found", "not_found");
     }
@@ -91277,7 +91529,7 @@ function mount21(ctx) {
         sha7 = r.receiptSha256 ?? null;
       }
       try {
-        outcome = outcomeOf2(JSON.parse(readFileSync121(file, "utf8")));
+        outcome = outcomeOf2(JSON.parse(readFileSync122(file, "utf8")));
       } catch {
         outcome = "UNREADABLE";
       }
@@ -91339,8 +91591,8 @@ function ttlCache(ttlMs = PROBE_CACHE_MS, now2 = Date.now) {
 }
 
 // src/server/legacy/shim.ts
-import { existsSync as existsSync97, readFileSync as readFileSync122 } from "fs";
-import { join as join139 } from "path";
+import { existsSync as existsSync97, readFileSync as readFileSync123 } from "fs";
+import { join as join140 } from "path";
 
 // src/server/legacy/routes.ts
 var LEGACY_ROUTES = [
@@ -91718,10 +91970,10 @@ var logged = new Set;
 var toHono = (p) => p.replace(/\{([A-Za-z_]+):path\}/g, ":$1{.+}").replace(/\{([A-Za-z_]+)\}/g, ":$1");
 var NOT_SUPPORTED = "not yet supported by the Control Plane";
 var repoVersion = () => {
-  for (const f of [join139(import.meta.dir, "../../../../../VERSION")]) {
+  for (const f of [join140(import.meta.dir, "../../../../../VERSION")]) {
     try {
       if (existsSync97(f))
-        return readFileSync122(f, "utf8").trim();
+        return readFileSync123(f, "utf8").trim();
     } catch {}
   }
   return "unknown";
@@ -91903,7 +92155,7 @@ function legacyShim(opts) {
 
 // src/server/app.ts
 var MAX_BODY2 = 1e6;
-var defaultUiDir = () => [join140(import.meta.dir, "../../ui/dist"), join140(import.meta.dir, "../ui/dist")].find((d) => existsSync98(join140(d, "index.html")));
+var defaultUiDir = () => [join141(import.meta.dir, "../../ui/dist"), join141(import.meta.dir, "../ui/dist")].find((d) => existsSync98(join141(d, "index.html")));
 function createApp(opts) {
   const uiDir = opts.uiDir ?? defaultUiDir();
   const { db: db2, sqlite } = openDb(opts.dbPath);
@@ -91932,10 +92184,10 @@ function createApp(opts) {
     await next();
   });
   const readInstalled = () => {
-    for (const f of [process.env.LOKI_VERSION_FILE, join140(import.meta.dir, "../../../../VERSION")]) {
+    for (const f of [process.env.LOKI_VERSION_FILE, join141(import.meta.dir, "../../../../VERSION")]) {
       try {
         if (f)
-          return readFileSync123(f, "utf8").trim() || "unknown";
+          return readFileSync124(f, "utf8").trim() || "unknown";
       } catch {}
     }
     return "unknown";
@@ -92050,7 +92302,7 @@ function createApp(opts) {
       return new Response(Bun.file(f));
     if (/\.[a-z0-9]+$/i.test(p))
       return c.json({ error: "not found" }, 404);
-    return new Response(Bun.file(join140(root, "index.html")));
+    return new Response(Bun.file(join141(root, "index.html")));
   });
   return { app, db: db2, close: () => {
     clearInterval(reconciler);
@@ -92059,9 +92311,9 @@ function createApp(opts) {
 }
 
 // src/server/serve.ts
-var refusal = bindRefusal(process.env);
-if (refusal) {
-  console.error(refusal);
+var refusal2 = bindRefusal(process.env);
+if (refusal2) {
+  console.error(refusal2);
   process.exit(2);
 }
 var warning = insecureBindWarning(process.env);