loki-mode 11.82.0 → 11.84.0

package/packages/control-plane/dist/server.js

@@ -258,7 +258,7 @@ var ASSIGNMENT, RULES, QUERY_SEGMENT, SECRET_PARAM, redactQuery = (s) => s.repla
   if (!keep || !data || typeof data !== "object" || Array.isArray(data))
     return redactDeep(data);
   return Object.fromEntries(Object.entries(data).map(([k, v]) => typeof v === "string" && keep.get(k)?.test(v) ? [k, v] : [redactSecrets(k), redactDeep(v)]));
-}, redactEnvelope = (e) => Object.fromEntries(Object.entries(e).map(([k, v]) => [redactSecrets(k), k === "data" ? redactEventData(e.type, v) : redactDeep(v)]));
+}, redactEnvelope = (e) => Object.fromEntries(Object.entries(e).map(([k, v]) => [redactSecrets(k), k === "data" ? redactEventData(e.type, v) : redactDeep(v)])), UNSAFE_TERMINAL_CHARS_RE;
 var init_redact = __esm(() => {
   ASSIGNMENT = /((?<![A-Za-z0-9_.-])[_.-]*(?:[A-Za-z0-9]+[_.-]+)*(?:password|passwd|secret|token|api[_-]?key|apikey)["']?\s*[:=]\s*)((?:"(?!\[REDACTED)(?:\\.|[^"\\\n])+")|(?:'(?!\[REDACTED)(?:\\.|[^'\\\n])+')|(?!["']|\[REDACTED)[^\s"',;&]+)/gi;
   RULES = [
@@ -300,6 +300,7 @@ var init_redact = __esm(() => {
     ["log.sealed", new Map([["kid", B64(43)], ["sig", B64(86)], ["events_sha256", HEX64]])],
     ["receipt.sealed", new Map([["kid", B64(43)], ["receipt_sha256", HEX64], ["events_sha256", HEX64]])]
   ]);
+  UNSAFE_TERMINAL_CHARS_RE = /[\x00-\x1f\x7f-\x9f\u00ad\u061c\u200b-\u200f\u2028-\u202e\u2060-\u2064\u2066-\u2069\ufeff]/g;
 });
 
 // ../../loki-ts/src/util/credential_env.ts
@@ -8986,7 +8987,12 @@ function reapLiveGroup(pgid, onReap) {
   onReap();
   killGroupWithGrace(pgid);
 }
+function maxTurnsFor(limitS, env) {
+  const user = Number(env["LOKI_E10_MAX_TURNS"]);
+  return Number.isInteger(user) && user > 0 ? user : Math.max(MIN_TURNS, Math.ceil(limitS / SECONDS_PER_TURN));
+}
 function clampBashTimeoutEnv(env, limitS) {
+  env["LOKI_E10_MAX_TURNS"] = String(maxTurnsFor(limitS, env));
   const budget = Math.max(BASH_CLAMP_FLOOR_MS, Math.floor(limitS * 1000) - BASH_CLAMP_MARGIN_MS);
   for (const [k, dflt] of [["BASH_DEFAULT_TIMEOUT_MS", 120000], ["BASH_MAX_TIMEOUT_MS", 600000]]) {
     const cur = Number(env[k]);
@@ -9074,7 +9080,7 @@ function spawnWorker(argv, env, cwd, backstopMs, escalateMs, onLine, onStopped =
     });
   });
 }
-var CANCEL_GRACE_MS, DRAIN_MS = 2000, KILL_GRACE_MS2 = 2000, BASH_CLAMP_FLOOR_MS = 30000, BASH_CLAMP_MARGIN_MS = 1e4, SAFE_BUN_FLAGS, ULIMIT_REFUSED_EXIT = 97, ULIMIT_KNOBS;
+var CANCEL_GRACE_MS, DRAIN_MS = 2000, KILL_GRACE_MS2 = 2000, BASH_CLAMP_FLOOR_MS = 30000, BASH_CLAMP_MARGIN_MS = 1e4, MAX_TURNS_EXIT = 98, SECONDS_PER_TURN = 3, MIN_TURNS = 10, SAFE_BUN_FLAGS, ULIMIT_REFUSED_EXIT = 97, ULIMIT_KNOBS;
 var init_worker_proc = __esm(() => {
   CANCEL_GRACE_MS = Number(process.env["LOKI_E10_CANCEL_GRACE_MS"]) > 0 ? Number(process.env["LOKI_E10_CANCEL_GRACE_MS"]) : 1e4;
   SAFE_BUN_FLAGS = ["--no-env-file", "--config=/dev/null"];
@@ -12484,6 +12490,7 @@ async function consumeSdkStream(messages, ctx, clock) {
   let refusedNoFallback = false;
   let rateLimit;
   let sawResult = false;
+  let maxTurns = false;
   const usageById = new Map;
   let anonUsageId = 0;
   let firstTurnId;
@@ -12724,10 +12731,11 @@ async function consumeSdkStream(messages, ctx, clock) {
       if (advisorById.size === 0)
         recordRouterUsage(new Map, advisorById, "#result", data.usage ?? {});
       writeResultCost(lokiRoot, ctx.iteration, data, data.model ?? sessionModel, firstTurnPromptTokens, { ...routerTelemetry(reqById, advisorById, advisorFaults), ...toolTelemetry() }, ctx.requestedModel);
-      exitCode = data.is_error ? 1 : 0;
+      maxTurns = data.subtype === "error_max_turns";
+      exitCode = data.is_error || maxTurns ? 1 : 0;
     }
   }
-  return { exitCode, sessionId: sessionId ?? seenSessionId, totalCostUsd, capturedText: captured, rateLimit, sawResult, truncated: guard.truncated || !sawResult, refused, refusedNoFallback };
+  return { exitCode, sessionId: sessionId ?? seenSessionId, totalCostUsd, capturedText: captured, rateLimit, sawResult, truncated: guard.truncated || !sawResult, refused, refusedNoFallback, maxTurns };
 }
 async function* asAsync(src, guard) {
   try {
@@ -53666,6 +53674,7 @@ var exports_providers = {};
 __export(exports_providers, {
   useProviderDefaultModel: () => useProviderDefaultModel,
   truthy: () => truthy,
+  stageMaxTurns: () => stageMaxTurns,
   selectClaudeInvokerKind: () => selectClaudeInvokerKind,
   sdkQueryProvider: () => sdkQueryProvider,
   resolveSystemPrompt: () => resolveSystemPrompt,
@@ -53754,6 +53763,10 @@ function claudeTierToModel(tier) {
       return pinned("DEVELOPMENT", "sonnet");
   }
 }
+function stageMaxTurns(env = process.env) {
+  const n10 = Number(env["LOKI_E10_MAX_TURNS"]);
+  return env["LOKI_E10_STAGE"] && Number.isInteger(n10) && n10 > 0 ? n10 : undefined;
+}
 async function* closeQueryOnResult(q10, enabled) {
   if (!enabled) {
     yield* q10;
@@ -54185,7 +54198,8 @@ function sdkQueryProvider() {
             ...extra.maxBudgetUsd ? { maxBudgetUsd: extra.maxBudgetUsd } : {},
             ...extra.taskBudget ? { taskBudget: extra.taskBudget } : {},
             ...extra.fallbackModel ? { fallbackModel: extra.fallbackModel } : {},
-            ...extra.settings ? { settings: extra.settings } : {}
+            ...extra.settings ? { settings: extra.settings } : {},
+            ...stageMaxTurns() ? { maxTurns: stageMaxTurns() } : {}
           }
         });
         const res = await consumeSdkStream(closeQueryOnResult(q10, !!process.env["LOKI_E10_STAGE"]), {
@@ -54199,7 +54213,11 @@ function sdkQueryProvider() {
         captured = res.capturedText;
         if (process.env["LOKI_E10_STAGE"])
           writeSessionId(call.cwd, process.env["LOKI_ITERATION"] ?? "0", res);
-        exitCode = res.sawResult ? res.exitCode : 1;
+        exitCode = res.sawResult ? res.maxTurns ? MAX_TURNS_EXIT : res.exitCode : 1;
+        if (res.maxTurns)
+          captured += `
+[sdk-loop error: turn cap reached (error_max_turns)]
+`;
         rateLimit = res.rateLimit;
       } catch (e10) {
         captured += `
@@ -54938,6 +54956,8 @@ function childEnv2(opts, cfg) {
       env["LOKI_SDK_LOOP"] = "1";
     env["LOKI_HOST_GUARD"] = "1";
     env["CLAUDE_CODE_DISABLE_BACKGROUND_TASKS"] = "1";
+    if (process.env["LOKI_E10_STAGE"])
+      delete env["LOKI_E10_MAX_TURNS"];
     clampBashTimeoutEnv(env, opts.limitS);
     if (env["LOKI_E10_PREFIX"] === undefined)
       env["LOKI_E10_PREFIX"] = "lean";
@@ -55182,7 +55202,8 @@ var init_session = __esm(() => {
     [127, "command not found"],
     [130, "SIGINT"],
     [137, "SIGKILL"],
-    [143, "SIGTERM"]
+    [143, "SIGTERM"],
+    [98, "turn cap"]
   ].map(([code, what]) => [code, `exit ${code} (${what})`]));
   lastStageEnd = new WeakMap;
   main = sessionChildMain;
@@ -55484,7 +55505,8 @@ async function discoverProjectModel(ctx, signal, opts = {}) {
     const session = raced;
     const raw2 = readAnswer(answerPath, session.summary);
     if (raw2 === undefined && (session.killed || session.exit !== 0)) {
-      return { model: unknownModel("", `owner=provider: the discovery session failed (exit ${session.exit}${session.killed ? ", killed" : ""})`), cached: false, attempts: attempt, owner: "provider" };
+      const capped = session.exit === MAX_TURNS_EXIT && !session.killed;
+      return { model: unknownModel("", `owner=${capped ? "harness" : "provider"}: the discovery session ${capped ? "hit the turn cap" : "failed"} (exit ${session.exit}${session.killed ? ", killed" : ""})`), cached: false, attempts: attempt, owner: capped ? "harness" : "provider" };
     }
     const v3 = raw2 === undefined ? null : validateAnswer(ctx.repoDir, raw2);
     if (v3?.ok) {
@@ -55514,6 +55536,7 @@ async function intakeProjectModel(ctx, signal, startedMs) {
 var PROJECT_FILE = ".loki/project.json", UNKNOWN_TTL_MS, SESSION_LIMIT_S = 60, HARD_GRACE_MS = 5000, MIN_SESSION_S = 8, KILL_GRACE_S = 2, MARGIN_S = 3;
 var init_discover2 = __esm(() => {
   init_model_downgrades();
+  init_worker_proc();
   init_types();
   init_gather();
   init_schema();
@@ -55777,6 +55800,7 @@ var init_test_file_text = __esm(() => {
 var exports_testmap = {};
 __export(exports_testmap, {
   projectInterpreter: () => projectInterpreter,
+  missingJavaTool: () => missingJavaTool,
   isTestFile: () => isTestFile,
   impactedRefs: () => impactedRefs,
   harnessRunners: () => harnessRunners,
@@ -55796,6 +55820,10 @@ function pytestPython(root) {
   }
   return "python";
 }
+function missingJavaTool(files, env = process.env, root) {
+  const want = files.some((f) => /(?:^|\/)pom\.xml$/.test(f)) ? "maven" : files.some((f) => /(?:^|\/)(?:build|settings)\.gradle(?:\.kts)?$|(?:^|\/)gradlew$/.test(f)) ? "gradle" : files.some((f) => /\.java$/.test(f)) ? "javac" : null;
+  return want && !javaToolOk(want, env, root) ? JAVA_TOOLS[want].tool : null;
+}
 function guessRunner(fileName, runners, relPath) {
   if (fileName.endsWith(".py"))
     return runners.includes("unittest") && !runners.includes("pytest") ? "unittest" : "pytest";
@@ -55803,6 +55831,8 @@ function guessRunner(fileName, runners, relPath) {
     return "go";
   if (fileName.endsWith(".rs"))
     return runners.includes("cargo") && relPath !== undefined && CARGO_TEST_FILE_RE.test(relPath) ? "cargo" : null;
+  if (fileName.endsWith(".java"))
+    return ["maven", "gradle", "javac"].find((r) => runners.includes(r)) ?? null;
   return /\.[cm]?[jt]sx?$/.test(fileName) ? ["vitest", "jest", "bun", "node"].find((r) => runners.includes(r)) ?? null : null;
 }
 function projectInterpreter(root) {
@@ -55851,6 +55881,10 @@ function buildTestMap(root) {
       mark("go", rel);
     else if (name === "Cargo.toml")
       mark("cargo", rel);
+    else if (name === "pom.xml")
+      mark("maven", rel);
+    else if (/^(?:build|settings)\.gradle(?:\.kts)?$/.test(name) || name === "gradlew")
+      mark("gradle", rel);
   }
   const jsRunner = evidence["vitest"] ? "vitest" : evidence["jest"] ? "jest" : evidence["bun"] ? "bun" : evidence["node"] ? "node" : null;
   const tests = [];
@@ -55919,7 +55953,10 @@ class RealTestMapProvider {
     return impactedRefs(map, changedFiles);
   }
 }
-var RUNNER_ORDER, COMMANDS, STDLIB_RUNNERS, FOREIGN_SOURCE_RE, harnessRunners = (runners, files = [], env = process.env, root, focus2 = []) => {
+var RUNNER_ORDER, COMMANDS, STDLIB_RUNNERS, FOREIGN_SOURCE_RE, JAVA_TOOLS, javaToolOk = (r, env, root) => {
+  const t = JAVA_TOOLS[r];
+  return !t || !!Bun.which(t.tool, { PATH: env.PATH ?? "" }) || !!t.wrapper && !!root && existsSync36(join53(root, t.wrapper));
+}, harnessRunners = (runners, files = [], env = process.env, root, focus2 = []) => pickHarnessRunners(runners, files, env, root, focus2).filter((r) => javaToolOk(r, env, root)), pickHarnessRunners = (runners, files, env, root, focus2) => {
   const onPath = (tool) => !!Bun.which(tool, { PATH: env.PATH ?? "" }), w = languageBytes(root, files, (f) => STDLIB_RUNNERS.find((r) => r.ext.test(f))?.runner ?? (/\.[cm]?[jt]sx?$/i.test(f) ? "js" : FOREIGN_SOURCE_RE.test(f) ? "other" : null)), at2 = (k3) => w.get(k3) ?? 0, js = at2("js"), top = STDLIB_RUNNERS.reduce((a, r) => at2(r.runner) > at2(a.runner) ? r : a), bun = env.LOKI_WALL_HARNESS_RUNNER !== "0" && onPath("bun") ? ["bun"] : toolchainRunner(files, focus2);
   const t = at2(top.runner), o = at2("other");
   return runners.length > 0 ? runners : js >= t && js >= o ? js === 0 && w.size > 0 ? [] : bun : t > o ? onPath(top.tool) ? [top.runner] : toolchainRunner(files, focus2) : [];
@@ -55939,7 +55976,7 @@ var init_testmap = __esm(() => {
   init_linguist();
   init_scope();
   init_test_file_text();
-  RUNNER_ORDER = ["pytest", "vitest", "jest", "bun", "node", "npm", "go", "cargo"];
+  RUNNER_ORDER = ["pytest", "vitest", "jest", "bun", "node", "npm", "go", "cargo", "maven", "gradle", "javac"];
   COMMANDS = {
     pytest: { cmd: "python -m pytest -q <files>", coarse: false },
     unittest: { cmd: "python3 -m unittest <files>", coarse: false },
@@ -55949,11 +55986,15 @@ var init_testmap = __esm(() => {
     node: { cmd: "node --test <files>", coarse: false },
     npm: { cmd: "npm test --silent", coarse: true },
     go: { cmd: "go test ./<pkg dirs>", coarse: false },
-    cargo: { cmd: "cargo test", coarse: true }
+    cargo: { cmd: "cargo test", coarse: true },
+    maven: { cmd: "mvn test -Dtest=<class>", coarse: false },
+    gradle: { cmd: "gradle cleanTest test --tests <class>", coarse: false },
+    javac: { cmd: "javac + java <test class>", coarse: false }
   };
-  STDLIB_RUNNERS = [{ ext: /\.py$/, runner: "unittest", tool: "python3" }, { ext: /\.go$/, runner: "go", tool: "go" }, { ext: /\.rs$/, runner: "cargo", tool: "cargo" }];
+  STDLIB_RUNNERS = [{ ext: /\.py$/, runner: "unittest", tool: "python3" }, { ext: /\.go$/, runner: "go", tool: "go" }, { ext: /\.rs$/, runner: "cargo", tool: "cargo" }, { ext: /\.java$/, runner: "javac", tool: "javac" }];
   FOREIGN_SOURCE_RE = /\.(?:py|go|rs|java|kt|kts|scala|rb|php|cs|c|cc|cpp|cxx|h|hpp|swift|m|mm|ex|exs|erl|hs|clj|lua|pl|dart|r|jl|zig)$/i;
-  TOOLCHAINS = [[/(?:^|\/)package\.json$/, "node", /\.[cm]?[jt]sx?$/], [/(?:^|\/)go\.mod$/, "go", /\.go$/], [/(?:^|\/)Cargo\.toml$/, "cargo", /\.rs$/], [/(?:^|\/)(?:pyproject\.toml|setup\.py|setup\.cfg|requirements(?:[-_.][\w.-]+)?\.txt|tox\.ini|pytest\.ini)$/, "pytest", /\.py$/]];
+  JAVA_TOOLS = { maven: { tool: "mvn", wrapper: "mvnw" }, gradle: { tool: "gradle", wrapper: "gradlew" }, javac: { tool: "javac" } };
+  TOOLCHAINS = [[/(?:^|\/)package\.json$/, "node", /\.[cm]?[jt]sx?$/], [/(?:^|\/)go\.mod$/, "go", /\.go$/], [/(?:^|\/)Cargo\.toml$/, "cargo", /\.rs$/], [/(?:^|\/)pom\.xml$/, "maven", /\.java$/], [/(?:^|\/)(?:build|settings)\.gradle(?:\.kts)?$|(?:^|\/)gradlew$/, "gradle", /\.java$/], [/(?:^|\/)(?:pyproject\.toml|setup\.py|setup\.cfg|requirements(?:[-_.][\w.-]+)?\.txt|tox\.ini|pytest\.ini)$/, "pytest", /\.py$/]];
   CARGO_TEST_FILE_RE = /(?:^|\/)tests\/[^/]+\.rs$/;
 });
 
@@ -55978,7 +56019,8 @@ var init_python_build_check = __esm(() => {
 // ../../loki-ts/src/util/check_result.ts
 import { spawn as spawn9 } from "child_process";
 import { createHash as createHash13 } from "crypto";
-import { existsSync as existsSync37, mkdirSync as mkdirSync23, readFileSync as readFileSync49, realpathSync as realpathSync19, renameSync as renameSync11, rmSync as rmSync13, writeFileSync as writeFileSync22 } from "fs";
+import { existsSync as existsSync37, mkdirSync as mkdirSync23, mkdtempSync as mkdtempSync5, readFileSync as readFileSync49, realpathSync as realpathSync19, renameSync as renameSync11, rmSync as rmSync13, writeFileSync as writeFileSync22 } from "fs";
+import { tmpdir as tmpdir7 } from "os";
 import { basename as basename12, dirname as dirname23, isAbsolute as isAbsolute6, join as join54, relative as relative6 } from "path";
 function plainTestEnv(base = process.env) {
   const e10 = {};
@@ -56014,7 +56056,7 @@ function ran(raw2, path, ok2) {
 function cargoTrailer(out3) {
   const ls2 = out3.split(`
 `).filter((x3) => x3.trim());
-  while (ls2.length && /^error: /.test(ls2[ls2.length - 1]))
+  while (ls2.length && CARGO_NOISE.test(ls2[ls2.length - 1]))
     ls2.pop();
   const segs = [];
   for (const l of ls2) {
@@ -56103,7 +56145,8 @@ function goRunner(cmd, args) {
   return {};
 }
 function goJson(out3) {
-  let any = false, failed2 = false;
+  let any = false, failed2 = false, dirty = false;
+  const status = new Map, ranSet = new Set, pkgs = new Set, failedTests = new Set, starts = new Map, done = new Map;
   for (const x3 of out3.split(`
 `)) {
     if (!x3.trim() || /^go: /.test(x3))
@@ -56117,10 +56160,97 @@ function goJson(out3) {
     if (!e10 || typeof e10 !== "object" || typeof e10.Action !== "string")
       return null;
     any = true;
-    if (e10.Action === "fail")
+    const pkg = typeof e10.Package === "string" ? e10.Package : "", test = typeof e10.Test === "string" ? e10.Test : "";
+    if (e10.Action === "start" && !test) {
+      pkgs.add(pkg);
+      starts.set(pkg, (starts.get(pkg) ?? 0) + 1);
+    }
+    if (e10.Action === "fail") {
       failed2 = true;
+      if (test)
+        failedTests.add(`${pkg}::${test}`);
+    }
+    if (!/^build-/.test(e10.Action) && !starts.has(pkg))
+      dirty = true;
+    if (!test && e10.Action === "output" && /\[no tests to run\]/.test(String(e10.Output ?? "")))
+      dirty = true;
+    if (!test) {
+      if (/^(?:pass|fail|skip)$/.test(e10.Action))
+        done.set(pkg, (done.get(pkg) ?? 0) + 1);
+      continue;
+    }
+    if (test.includes("/"))
+      continue;
+    const k3 = `${pkg}::${test}`;
+    if (e10.Action === "run") {
+      if (ranSet.has(k3))
+        dirty = true;
+      ranSet.add(k3);
+    } else if (ranSet.has(k3) && /^(?:pass|fail|skip)$/.test(e10.Action))
+      status.set(k3, e10.Action);
   }
-  return any ? { failed: failed2 } : null;
+  if (!any)
+    return null;
+  const passedNames = [...status].filter(([, v3]) => v3 === "pass").map(([k3]) => k3);
+  return { failed: failed2, failedTests: [...failedTests], passed: passedNames.length, passedNames, complete: !dirty && pkgs.size > 0 && [...pkgs].every((p) => starts.get(p) === 1 && done.get(p) === 1) };
+}
+async function corroborateGoPass(c, out3, cmdOrLine, args, o) {
+  if (c.result !== "pass" || goRunner(cmdOrLine, args).runner !== "go")
+    return c;
+  const refuse = { result: "not_run", reason: GO_EXIT0_REASON };
+  const first = goJson(stripAnsi(out3));
+  const names = first?.passedNames ?? [];
+  const toks = args ? [cmdOrLine, ...args] : cmdOrLine.trim().split(/\s+/);
+  if (!names.length || toks.some((t) => /[&|;$`"'<>()\\]/.test(t)) || basename12(toks[0] ?? "") !== "go" || toks[1] !== "test")
+    return refuse;
+  const pkgs = [], run2 = [];
+  for (let k3 = 2;k3 < toks.length; k3++) {
+    const t = toks[k3];
+    if (t === "-json")
+      continue;
+    if (t === "-run") {
+      const v3 = toks[++k3];
+      if (v3 === undefined)
+        return refuse;
+      run2.push("-run", v3);
+      continue;
+    }
+    if (t.startsWith("-"))
+      return refuse;
+    pkgs.push(t);
+  }
+  const dir = mkdtempSync5(join54(tmpdir7(), "loki-gocov-")), prof = join54(dir, "cover.out");
+  try {
+    const r = await spawnCollect("go", ["test", "-json", "-count=1", `-coverprofile=${prof}`, ...run2, ...pkgs.length ? pkgs : ["."]], { cwd: o.cwd, env: o.env, timeoutMs: 600000 });
+    const second = goJson(stripAnsi(r.output));
+    if (r.status !== 0 || !second || second.failed || !second.complete)
+      return refuse;
+    const again = new Set(second.passedNames);
+    if (!names.every((n10) => again.has(n10)))
+      return refuse;
+    const covered = new Set;
+    for (const l of (existsSync37(prof) ? readFileSync49(prof, "utf8") : "").split(`
+`)) {
+      const m = /^(.+)\/[^/:]+:\d+\.\d+,\d+\.\d+ \d+ \d+$/.exec(l);
+      if (m)
+        covered.add(m[1]);
+    }
+    return [...new Set(names.map((n10) => n10.slice(0, n10.indexOf("::"))))].every((pk2) => covered.has(pk2)) ? c : refuse;
+  } finally {
+    rmSync13(dir, { recursive: true, force: true });
+  }
+}
+function readableFailIds(runner, out3) {
+  const text3 = stripAnsi(out3);
+  if (runner === "go")
+    return goJson(text3)?.failedTests ?? [];
+  const failed2 = cargoTrailer(text3).reduce((t, l) => t + +(l.match(/(\d+) failed/)?.[1] ?? 0), 0);
+  const ids = [...new Set(text3.split(`
+`).flatMap((l) => {
+    const m = /^test (.+?) \.\.\. FAILED$/.exec(l.trim());
+    return m ? [m[1]] : [];
+  }))];
+  return failed2 > 0 && ids.length >= failed2 ? ids : [];
 }
 function summaryPassFailCount(out3) {
   return ["pass", "fail"].reduce((t, k3) => t + +([...out3.matchAll(new RegExp(`^(?:#|\\u2139) ${k3} (\\d+)$`, "gm"))].pop()?.[1] ?? 0), 0);
@@ -56129,6 +56259,50 @@ function skipped(raw2) {
   return stripAnsi(raw2).split(`
 `).filter((l) => /^(?:=+ )?\d+ \w+.* in [\d.]+s|^\s*Tests?:?\s+\d|^(?:#|\u2139) skipped \d/.test(l.trim())).reduce((t, l) => t + [...l.matchAll(/(\d+) (?:skipped|deselected|xfailed)|skipped (\d+)/g)].reduce((u10, m) => u10 + +(m[1] ?? m[2]), 0), 0);
 }
+function javaSummary(raw2) {
+  const ls2 = stripAnsi(raw2).split(`
+`).map((l) => l.trimEnd()), tail2 = ls2.filter((l) => l.trim()).slice(-40), ok2 = (re2) => {
+    const m = tail2.map((l) => re2.exec(l)).filter(Boolean).pop();
+    return m ? m[1] === "SUCCESS" || m[1] === "SUCCESSFUL" : null;
+  };
+  const wrap = ls2.filter((l) => l.trim()).slice(-1)[0]?.match(/^LOKI_JAVA_TESTS: (\d+) run, (\d+) failed$/);
+  if (wrap) {
+    const ids = ls2.flatMap((l) => l.match(/^FAIL (.+)$/)?.[1] ?? []), failed2 = +wrap[2];
+    return +wrap[1] > 0 && ids.length === failed2 && ls2.filter((l) => /^(?:PASS|FAIL) /.test(l)).length === +wrap[1] ? { executed: +wrap[1], failed: failed2, ids } : null;
+  }
+  const mv2 = ok2(/^\[(?:INFO|ERROR)\] BUILD (SUCCESS|FAILURE)$/), gr2 = ok2(/^BUILD (SUCCESSFUL|FAILED)\b/);
+  if (mv2 !== null) {
+    let executed = 0, failed2 = 0, seen = false;
+    ls2.forEach((l, i) => {
+      if (/^\[(?:INFO|ERROR)\] Results:$/.test(l)) {
+        const m = ls2.slice(i + 1, i + 40).map((x3) => /^\[(?:INFO|WARNING|ERROR)\] Tests run: (\d+), Failures: (\d+), Errors: (\d+), Skipped: (\d+)$/.exec(x3)).find(Boolean);
+        if (m) {
+          seen = true;
+          executed += +m[1] - +m[4];
+          failed2 += +m[2] + +m[3];
+        }
+      }
+    });
+    const ids = [...new Set(ls2.flatMap((l) => {
+      const m = /^\[ERROR\] (?:(\S+)\(([\w.$]+)\)|([\w.$]+\.[\w$]+)(?:\[[^\]]*\])?) .*<<< (?:FAILURE|ERROR)!$/.exec(l);
+      return m ? [m[3] ?? `${m[2]}.${m[1]}`] : [];
+    }))];
+    return seen && executed > 0 && (mv2 ? failed2 === 0 : failed2 > 0) ? { executed, failed: failed2, ids } : null;
+  }
+  if (gr2 !== null) {
+    const ev2 = ls2.flatMap((l) => {
+      const m = /^\s*(\S.*?) > (\S.*?) (PASSED|FAILED|SKIPPED)$/.exec(l);
+      return m ? [{ id: `${m[1]}.${m[2]}`, s: m[3] }] : [];
+    }), bad = ev2.filter((e10) => e10.s === "FAILED");
+    const executed = ev2.filter((e10) => e10.s !== "SKIPPED").length;
+    return executed > 0 && (gr2 ? bad.length === 0 : bad.length > 0) ? { executed, failed: bad.length, ids: [...new Set(bad.map((e10) => e10.id))] } : null;
+  }
+  return null;
+}
+function javaTestClass(path) {
+  const m = /^(.*?)\/?src\/test\/java\/(.+)\.java$/.exec(path), cls = (m ? m[2] : basename12(path, ".java")).split("/").join(".");
+  return { root: m?.[1] || ".", cls, rel: m ? `src/test/java/${m[2]}.java` : path };
+}
 function testCount(raw2, path, ok2) {
   const out3 = stripAnsi(raw2);
   const bu2 = bunCount(out3), ut = unittestCount(out3, ok2);
@@ -56136,6 +56310,9 @@ function testCount(raw2, path, ok2) {
     return bu2;
   if (ut !== null)
     return ut;
+  const jv = javaSummary(out3);
+  if (jv)
+    return jv.executed;
   if (/^\s*(?:Test Files\s+0\b|No test files found)/m.test(out3) && !/^\s*Tests?\s+\d/m.test(out3))
     return 0;
   const r = ran(out3, path, ok2);
@@ -56184,9 +56361,12 @@ function classifyCheck(i) {
     return { result: i.ok ? "pass" : "fail" };
   const text3 = stripAnsi(i.out);
   if (i.runner === "go") {
-    if (i.ok)
-      return { result: "not_run", reason: GO_EXIT0_REASON };
     const j10 = goJson(text3);
+    if (i.ok) {
+      if (!j10 || j10.failed || !j10.complete)
+        return { result: "not_run", reason: GO_EXIT0_REASON };
+      return j10.passed > 0 ? { result: "pass", n: j10.passed } : { result: "not_run", n: 0, reason: `${NO_TESTS_REASON} (ran 0 tests, empty or all skipped)` };
+    }
     if (j10)
       return j10.failed ? { result: "fail" } : { result: "not_run", reason: UNCONFIRMED_REASON };
     return FAIL_EVIDENCE.test(text3) || GO_FAIL_EVIDENCE.test(text3) ? { result: "fail" } : { result: "not_run", reason: UNCONFIRMED_REASON };
@@ -56202,6 +56382,9 @@ function classifyCheck(i) {
     return { result: "fail", ...n10 !== null ? { n: n10 } : {} };
   if (n10 === null)
     return { result: "not_run", reason: UNMEASURED_REASON };
+  const jv = javaSummary(text3);
+  if (jv && jv.failed > 0)
+    return { result: "fail", n: n10 };
   return { result: "pass", n: n10 };
 }
 function checkProvenance(name, ctx) {
@@ -56708,13 +56891,19 @@ function classify(f, status, output, repoDir, interpreter) {
   if (status === null || status === 126 || status === 127)
     return "not_run";
   if (status === 0)
-    return classifyCheck({ kind: "test", ok: true, out: output, path: f.path, ...f.runner === "go" ? { runner: "go" } : {} }).result === "pass" ? "pass" : "not_run";
+    return f.runner !== "go" && classifyCheck({ kind: "test", ok: true, out: output, path: f.path }).result === "pass" ? "pass" : "not_run";
   if (f.runner === "unittest")
     return status === 1 && unittestCount(output, false) !== null ? /unittest\.loader\._FailedTest|Failed to import test module/.test(output) ? pytestCollectionIsRed(output, repoDir) ? "fail" : "not_run" : "fail" : "not_run";
   if (f.runner === "pytest")
     return status === 1 ? pytestExit1IsRed(output) ? "fail" : "not_run" : status === 2 ? pytestCollectionIsRed(output, repoDir) ? "fail" : "not_run" : "not_run";
   if (f.runner === "jest" || f.runner === "vitest" || f.runner === "bun")
     return parsedFailCount(f.runner, output) > 0 ? "fail" : "not_run";
+  if (f.runner === "maven" || f.runner === "gradle" || f.runner === "javac") {
+    const j10 = javaSummary(output);
+    return j10 && j10.failed > 0 ? "fail" : "not_run";
+  }
+  if (f.runner === "go" || f.runner === "cargo")
+    return readableFailIds(f.runner, output).length > 0 ? "fail" : "not_run";
   return f.runner === "node" && nodeIsRed(f, output) ? "fail" : "not_run";
 }
 function baseJobs() {
@@ -56809,11 +56998,27 @@ function runnerCmd(t, repoDir) {
       const names = goTestNames(join54(repoDir, t.path));
       return ["go", ["test", "-json", ...names.length ? ["-run", `^(${names.join("|")})$`] : [], `./${dirname23(t.path)}`]];
     }
+    case "maven": {
+      const j10 = javaTestClass(t.path);
+      return [wrapperOr(repoDir, "mvnw", "mvn"), ["-B", "test", `-Dtest=${j10.cls.split(".").pop()}`, "-Dsurefire.failIfNoSpecifiedTests=false", "-DfailIfNoTests=false"]];
+    }
+    case "gradle": {
+      const j10 = javaTestClass(t.path);
+      return [wrapperOr(repoDir, "gradlew", "gradle"), ["cleanTest", "test", "--tests", j10.cls, "-i", "--console=plain"]];
+    }
+    case "javac": {
+      const j10 = javaTestClass(t.path);
+      return ["bash", ["-c", JAVAC_WRAPPER, "loki-javac", j10.root, j10.cls, j10.rel]];
+    }
     case "cargo":
       return CARGO_TEST_FILE_RE.test(t.path) ? ["cargo", ["test", "--test", basename12(t.path, ".rs")]] : ["cargo", ["test"]];
   }
 }
 function fullSuiteCmd(runner, repoDir) {
+  if (runner === "maven" || runner === "gradle") {
+    const s = FULL_SUITE_STATIC[runner];
+    return { ...s, cmd: wrapperOr(repoDir, runner === "maven" ? "mvnw" : "gradlew", s.cmd) };
+  }
   if (runner !== "pytest" && runner !== "unittest")
     return FULL_SUITE_STATIC[runner];
   const [cmd, interpreter, pre2] = resolveTool(repoDir, "python", "python3", "python");
@@ -56896,7 +57101,23 @@ function firstFileLineAnchor(desc2) {
 }
 var NO_TESTS_REASON = "no tests executed", NO_RUNNER_REASON = "no runner of this repo runs this file", harnessSkipCode = (env = process.env) => env.LOKI_WALL_HARNESS_RUNNER === "0" ? "harness_runner_disabled" : Bun.which("bun", { PATH: env.PATH ?? "" }) ? "no_toolchain" : "bun_not_on_path", GO_EXIT0_REASON = "test count could not be confirmed: go test output is produced by the code under test and cannot confirm execution (a Go exit 0 is never a pass)", UNCONFIRMED_REASON = "test count could not be confirmed", FAIL_EVIDENCE, GO_FAIL_EVIDENCE, UNMEASURED_REASON = "executed count unmeasured (Loki could not parse the runner summary, harness-owned)", stripAnsi = (s) => s.replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)/g, "").replace(/(?:\u001b\[|\u009b)[0-9;?]*[ -\/]*[@-~]/g, "").replace(/\r\n?/g, `
 `), tailLines = (out3) => out3.split(`
-`).filter((x3) => x3.trim()).slice(-12), GO_PKG_RE, EXIT_CODED_COUNT = "n/a (exit-coded check, not a test runner)", FRAMEWORK_RE, SCRIPT_RE, isExecutedProof = (c) => c.result === "pass" && typeof c.n === "number" && c.n > 0, hasExecutedProof = (checks) => checks.some(isExecutedProof), LLM_JUDGES, NON_RUNNER, normPath = (p) => p.replace(/^(?:\.\/)+/, ""), hasExogenousProof = (checks, ctx) => checks.some((c) => isExecutedProof(c) && ((p) => p !== "agent_authored" && p !== "llm_judge")(checkProvenance(c.name ?? "", ctx))), CODE_FILE_EXT, DECL_RE, VAR_DECL_RE, stripComments = (src) => src.replace(/\/\*[\s\S]*?\*\//g, " ").split(`
+`).filter((x3) => x3.trim()).slice(-12), CARGO_NOISE, GO_PKG_RE, JAVAC_WRAPPER = `set -u
+root="$1"; cls="$2"; shift 2; cd "$root" || exit 70
+if [ "$cls" = "-" ]; then
+  set -- $(find src/test/java -name '*Test.java' 2>/dev/null | sort); cls=""
+  for f in "$@"; do c="\${f#src/test/java/}"; c="\${c%.java}"; cls="$cls \${c//\\//.}"; done
+fi
+out="$(mktemp -d "\${TMPDIR:-/tmp}/loki-javac.XXXXXX")" || exit 70
+trap 'rm -rf -- "\${out:?}"' EXIT
+find src/main/java -name '*.java' 2>/dev/null > "$out/srcs"
+javac -nowarn -d "$out" @"$out/srcs" "$@" || exit 1
+st=0; : > "$out/run.log"
+for c in $cls; do java -cp "$out" "$c" >> "$out/run.log" 2>&1 || st=$?; done
+cat "$out/run.log"
+p=$(grep -c '^PASS ' "$out/run.log"); f=$(grep -c '^FAIL ' "$out/run.log")
+echo "LOKI_JAVA_TESTS: $((p + f)) run, $f failed"
+[ "$f" -gt 0 ] && st=1
+exit $st`, wrapperOr = (repoDir, w, bare) => existsSync37(join54(repoDir, w)) ? `./${w}` : bare, EXIT_CODED_COUNT = "n/a (exit-coded check, not a test runner)", FRAMEWORK_RE, SCRIPT_RE, isExecutedProof = (c) => c.result === "pass" && typeof c.n === "number" && c.n > 0, hasExecutedProof = (checks) => checks.some(isExecutedProof), LLM_JUDGES, NON_RUNNER, normPath = (p) => p.replace(/^(?:\.\/)+/, ""), hasExogenousProof = (checks, ctx) => checks.some((c) => isExecutedProof(c) && ((p) => p !== "agent_authored" && p !== "llm_judge")(checkProvenance(c.name ?? "", ctx))), CODE_FILE_EXT, DECL_RE, VAR_DECL_RE, stripComments = (src) => src.replace(/\/\*[\s\S]*?\*\//g, " ").split(`
 `).map((l) => /^\s*\*/.test(l) ? "" : l.replace(/\/\/.*$/, "").replace(/(^|\s)#.*$/, "$1")).join(`
 `), GO_METHOD_RE, METHOD_RE, NOT_A_NAME, declNames = (line2) => {
   const out3 = [];
@@ -56911,7 +57132,7 @@ var NO_TESTS_REASON = "no tests executed", NO_RUNNER_REASON = "no runner of this
   if (m)
     out3.push(m[1]);
   return out3.filter((n10) => !NOT_A_NAME.has(n10));
-}, printable = (s) => s.replace(/[\x00-\x1f\x7f]/g, "?"), SENSITIVE, API, TEST_CFG, RANK3, FILES_MEDIUM = 4, FILES_HIGH = 15, LINES_MEDIUM = 100, LINES_HIGH = 500, RAN_ALWAYS, REVIEWER_ITEM = "one reviewer", PLAN, LOW_SKIPPED, deferredOf = (tier, selected, executed) => (tier === "low" ? LOW_SKIPPED : selected).filter((c) => !RAN_ALWAYS.includes(c) && !executed.includes(c)), DEEP_ITEMS, NOT_SELECTED = "not selected by risk tier: ", MANIFEST_LOCKS, dirOf = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "", PKG_DEP_KEYS, PYPROJECT_NONDEP, SEM_RULES, DOC_FILE, readOr = (p) => {
+}, printable = (s) => s.replace(UNSAFE_TERMINAL_CHARS_RE, "?"), SENSITIVE, API, TEST_CFG, RANK3, FILES_MEDIUM = 4, FILES_HIGH = 15, LINES_MEDIUM = 100, LINES_HIGH = 500, RAN_ALWAYS, REVIEWER_ITEM = "one reviewer", PLAN, LOW_SKIPPED, deferredOf = (tier, selected, executed) => (tier === "low" ? LOW_SKIPPED : selected).filter((c) => !RAN_ALWAYS.includes(c) && !executed.includes(c)), DEEP_ITEMS, NOT_SELECTED = "not selected by risk tier: ", MANIFEST_LOCKS, dirOf = (p) => p.includes("/") ? p.slice(0, p.lastIndexOf("/")) : "", PKG_DEP_KEYS, PYPROJECT_NONDEP, SEM_RULES, DOC_FILE, readOr = (p) => {
   try {
     return readFileSync49(p, "utf8");
   } catch {
@@ -56935,6 +57156,7 @@ var init_check_result = __esm(() => {
   init_redact();
   FAIL_EVIDENCE = /\[(?:build|setup) failed\]|^--- FAIL|^[\w./-]+\.go:\d+:\d+: \S|\b[1-9]\d* (?:failed|errors?)\b/m;
   GO_FAIL_EVIDENCE = /^FAIL\t\S+\t[\d.]+s$|^panic: /m;
+  CARGO_NOISE = /^\s*(?:Compiling|Finished|Running|Doc-tests|Fresh|Blocking|Downloaded|Downloading|Updating|Locking|Adding|Packaging|Building)\b|^(?:warning|error|note|help)\b|^\s*(?:-->|=\s|\||\d+\s*\||\^|~)|^(?:Some errors have detailed|For more information about)/;
   GO_PKG_RE = /^(?:ok|FAIL|\?)\s+\S+\s+(?:\(cached\)|[\d.]+s\b|\[(?:no test files|build failed|setup failed)\])/;
   FRAMEWORK_RE = /\b(?:pytest|py\.test|unittest|nose2?|tox|nox|jest|vitest|mocha|jasmine|ava|tap|playwright|cypress|karma|rspec|minitest|phpunit|pest|codeception|ctest|busted|prove)\b|\b(?:bun|deno|node|go|cargo|dotnet|swift|mix|dart|flutter|zig)\s+(?:[\w:.=-]+\s+)*test\b|\b(?:npm|pnpm|yarn|bun|npx)\b.*\btest|\b(?:mvn|mvnw|gradle|gradlew|ant|sbt|make|cmake|bazel|rake|composer|lein)\b|test/i;
   SCRIPT_RE = /^(?:python[\d.]*|node|bash|sh|ruby|perl)\s+(?:--?[\w-]+\s+)*([^\s-][^\s]*\.(?:py|js|mjs|cjs|sh|rb|pl))(?:\s|$)/;
@@ -56990,7 +57212,10 @@ var init_check_result = __esm(() => {
     node: { cmd: "node", args: ["--test"] },
     npm: { cmd: "npm", args: ["test", "--silent"] },
     go: { cmd: "go", args: ["test", "-json", "./..."] },
-    cargo: { cmd: "cargo", args: ["test"] }
+    cargo: { cmd: "cargo", args: ["test"] },
+    maven: { cmd: "mvn", args: ["-B", "test"] },
+    gradle: { cmd: "gradle", args: ["cleanTest", "test", "-i", "--console=plain"] },
+    javac: { cmd: "bash", args: ["-c", JAVAC_WRAPPER, "loki-javac", ".", "-"] }
   };
   URL_RE = /\b[a-z][a-z0-9+.-]{0,63}:\/\/\S+/gi;
   ANCHOR_RE = /(?<![\w./@-])([\w./@-]{1,512})[`'"]?(?::L?|#L|\s*\(line\s+)([1-9]\d*)(?!\d)/g;
@@ -59186,6 +59411,9 @@ function failIds(raw2) {
   const output = stripAnsi(raw2), gc2 = goCargoIds(output);
   if (gc2)
     return gc2;
+  const jv = javaSummary(output);
+  if (jv)
+    return jv.failed > 0 && jv.ids.length >= jv.failed ? jv.ids : [];
   const ids = [...new Set(output.split(`
 `).map((l) => ID_LINE.exec(l.trim())).flatMap((m) => m ? [(m.slice(1).find(Boolean) ?? "").trim()] : []).filter(Boolean))];
   const c = failCount(output);
@@ -60715,8 +60943,8 @@ var init_runner_errors = __esm(() => {
 
 // ../../loki-ts/src/runner/load_owner.ts
 import { spawnSync as spawnSync5 } from "child_process";
-import { mkdtempSync as mkdtempSync5, realpathSync as realpathSync23, rmSync as rmSync16 } from "fs";
-import { tmpdir as tmpdir7 } from "os";
+import { mkdtempSync as mkdtempSync6, realpathSync as realpathSync23, rmSync as rmSync16 } from "fs";
+import { tmpdir as tmpdir8 } from "os";
 import { basename as basename17, extname as extname3, join as join66 } from "path";
 function changedFilesNamed(out3, repoDir, changed) {
   return changed.filter((f) => {
@@ -60839,7 +61067,7 @@ async function loadErrorIsHarnessOwned(i) {
     return false;
   if (i.args.some((a) => changed.includes(a.replace(/^\.\//, ""))))
     return false;
-  const dir = mkdtempSync5(join66(tmpdir7(), "e10-loadown-"));
+  const dir = mkdtempSync6(join66(tmpdir8(), "e10-loadown-"));
   const git3 = (args) => {
     safeGit(i.repoDir, args, { stdio: "ignore" });
   };
@@ -60918,7 +61146,7 @@ ${r.stderr}`);
       notProven.add(`${lr2} (${name}; harness-owned)`);
       continue;
     }
-    const cls = classifyCheck({ kind: "test", ok: r.exitCode === 0, out: out3, ...goRunner(line2), exitCoded: isExitCodedScript(line2) });
+    const cls = await corroborateGoPass(classifyCheck({ kind: "test", ok: r.exitCode === 0, out: out3, ...goRunner(line2), exitCoded: isExitCodedScript(line2) }), out3, line2, undefined, { cwd: join67(repoDir, cwd), env: suiteEnv(opts.path) });
     checks.push({ name, cmd, result: cls.result, duration_s, ...cls.count ? { count: cls.count } : {}, ...cls.result === "fail" ? { ids: cls.count ? [exitCodedId(line2, out3, repoDir) ?? []].flat() : failIds(out3), excerpt: failureExcerpt(out3, repoDir) } : {} });
     if (cls.result === "not_run")
       notProven.add(`not run: ${name} (${cls.reason ?? NO_TESTS_REASON})`);
@@ -63731,8 +63959,8 @@ var init_wall_owned = __esm(() => {
 });
 
 // ../../loki-ts/src/util/mutation_proof.ts
-import { existsSync as existsSync53, mkdirSync as mkdirSync38, mkdtempSync as mkdtempSync6, readFileSync as readFileSync68, rmSync as rmSync17, symlinkSync as symlinkSync3, writeFileSync as writeFileSync36 } from "fs";
-import { tmpdir as tmpdir8 } from "os";
+import { existsSync as existsSync53, mkdirSync as mkdirSync38, mkdtempSync as mkdtempSync7, readFileSync as readFileSync68, rmSync as rmSync17, symlinkSync as symlinkSync3, writeFileSync as writeFileSync36 } from "fs";
+import { tmpdir as tmpdir9 } from "os";
 import { basename as basename18, dirname as dirname30, isAbsolute as isAbsolute14, join as join77, relative as relative14 } from "path";
 function mutationProof(i) {
   const rels = i.wallFiles.map((f) => isAbsolute14(f.path) ? relative14(i.repoDir, f.path) : f.path);
@@ -63751,7 +63979,7 @@ function mutationProof(i) {
   const deadline = Date.now() + budgetS * 1000, remaining = () => deadline - Date.now();
   let parent = null, wt = null, added = false;
   try {
-    parent = mkdtempSync6(join77(tmpdir8(), "loki-mutproof-"));
+    parent = mkdtempSync7(join77(tmpdir9(), "loki-mutproof-"));
     wt = join77(parent, "wt");
     const add3 = git5(i.repoDir, ["worktree", "add", "--detach", wt, i.baseSha], Math.max(1000, Math.min(30000, remaining())));
     added = existsSync53(wt) || add3.status === 0;
@@ -63837,10 +64065,10 @@ var init_mutation_proof = __esm(() => {
 });
 
 // ../../loki-ts/src/util/python.ts
-import { accessSync, constants as constants4, existsSync as existsSync54, mkdtempSync as mkdtempSync7, readFileSync as readFileSync69, realpathSync as realpathSync25, rmSync as rmSync18, statSync as statSync24 } from "fs";
+import { accessSync, constants as constants4, existsSync as existsSync54, mkdtempSync as mkdtempSync8, readFileSync as readFileSync69, realpathSync as realpathSync25, rmSync as rmSync18, statSync as statSync24 } from "fs";
 import { join as join78 } from "path";
 import { spawnSync as spawnSync8 } from "child_process";
-import { tmpdir as tmpdir9 } from "os";
+import { tmpdir as tmpdir10 } from "os";
 async function findPython3() {
   if (_pythonCache !== undefined)
     return _pythonCache;
@@ -63879,7 +64107,7 @@ function pySignatures2(src) {
     const r = spawnSync8(py2, ["-I", "-S", "-c", PY_SCRIPT], {
       input: src.replace(/\r\n?/g, `
 `),
-      cwd: tmpdir9(),
+      cwd: tmpdir10(),
       timeout: PY_TIMEOUT_MS,
       encoding: "utf8",
       env: { PATH: process.env.PATH ?? "/usr/bin:/bin" },
@@ -64022,8 +64250,8 @@ ${res.stderr ?? ""}`, res.status, timedOut, junitXml);
   };
 }
 function spawnPytest(pythonBin, repoDir, timeoutMs, extra, withJunit) {
-  const pycPrefix = mkdtempSync7(join78(tmpdir9(), "loki-pyc-"));
-  const junitDir = mkdtempSync7(join78(tmpdir9(), "loki-junit-"));
+  const pycPrefix = mkdtempSync8(join78(tmpdir10(), "loki-pyc-"));
+  const junitDir = mkdtempSync8(join78(tmpdir10(), "loki-junit-"));
   const junit = join78(junitDir, "junit.xml");
   let junitXml;
   try {
@@ -64503,14 +64731,17 @@ class TestName(unittest.TestCase):
     def test_it(self): self.assertEqual(fn(1), 2)
   Run: python3 -m unittest <file>.`,
     go: `${COMMANDS.go.cmd.replace(" ./<pkg dirs>", "")}. Write a _test.go file in the package under test. Example: func TestName(t *testing.T) { if got := Fn(1); got != 2 { t.Fatalf("got %v", got) } }  Run: ${COMMANDS.go.cmd.replace("<pkg dirs>", "<dir>")}.`,
-    cargo: `${COMMANDS.cargo.cmd}. Write an integration test file directly under tests/ that calls the crate's public API. Example: #[test] fn name() { assert_eq!(my_crate::f(1), 2); }  Run: ${COMMANDS.cargo.cmd} --test <stem>.`
+    cargo: `${COMMANDS.cargo.cmd}. Write an integration test file directly under tests/ that calls the crate's public API. Example: #[test] fn name() { assert_eq!(my_crate::f(1), 2); }  Run: ${COMMANDS.cargo.cmd} --test <stem>.`,
+    maven: `Maven + JUnit (use the JUnit version already declared in the build file). Put the file in src/test/java/ (add a package line only if the code under test is in a package). The file name must end in Test.java and the public class name must equal the file name without .java, so surefire picks it up. Example: import org.junit.jupiter.api.Test; import static org.junit.jupiter.api.Assertions.*; public class loki_wall_LeapTest { @Test void leap() { assertTrue(Leap.is(2000)); } }  Run: ${COMMANDS.maven.cmd.replace("<class>", "<ClassName>")}.`,
+    gradle: `Gradle + JUnit (use the JUnit version already declared in the build file). Put the file in src/test/java/. The public class name must equal the file name without .java and the file name must end in Test.java. Example: import org.junit.jupiter.api.Test; import static org.junit.jupiter.api.Assertions.*; public class loki_wall_LeapTest { @Test void leap() { assertTrue(Leap.is(2000)); } }  Run: ${COMMANDS.gradle.cmd.replace("<class>", "<ClassName>")}.`,
+    javac: 'Plain Java 8+ with NO test framework and NO build tool (do not import org.junit). Put the file in src/test/java/. The file name must end in Test.java and the public class name must equal the file name without .java. The class has public static void main. For every check print exactly one line, `PASS <name>` or `FAIL <name>` (name on the same line), and at the end System.exit(1) if any check failed. Catch exceptions per check so one failure does not hide the rest. Example: static void check(String n, boolean ok) { System.out.println((ok ? "PASS " : "FAIL ") + n); if (!ok) failed = true; }  Run: javac the sources under src/main/java plus the file, then java <ClassName>.'
   };
 });
 
 // ../../loki-ts/src/util/holdout.ts
 import { createHash as createHash25 } from "crypto";
 import { appendFileSync as appendFileSync9, copyFileSync as copyFileSync4, existsSync as existsSync55, mkdirSync as mkdirSync39, readFileSync as readFileSync70, rmSync as rmSync19, writeFileSync as writeFileSync37 } from "fs";
-import { tmpdir as tmpdir10 } from "os";
+import { tmpdir as tmpdir11 } from "os";
 import { basename as basename20, join as join79, relative as relative15 } from "path";
 function wallHoldoutRatio(env = process.env) {
   if (env["LOKI_WALL_HOLDOUT"]?.trim() === "0")
@@ -64581,7 +64812,7 @@ function recordHoldoutTriage(runDir, entry2) {
 `, { mode: 384 });
   } catch {}
 }
-var sha3 = (s) => createHash25("sha256").update(s).digest("hex"), WALL_HOLDOUT_DEFAULT_RATIO = 0.2, isHoldoutCheck = (name) => name.startsWith("holdout:"), holdoutDirFor = (runId, repoDir) => join79(tmpdir10(), `loki-e10-holdout-${sha3(`${runId}:${repoDir}`).slice(0, 16)}`), MANIFEST = "manifest.json", WALL_HOLDOUT_MIN = 5, HOLDOUT_TRIAGE_FILE = "holdout-triage.jsonl";
+var sha3 = (s) => createHash25("sha256").update(s).digest("hex"), WALL_HOLDOUT_DEFAULT_RATIO = 0.2, isHoldoutCheck = (name) => name.startsWith("holdout:"), holdoutDirFor = (runId, repoDir) => join79(tmpdir11(), `loki-e10-holdout-${sha3(`${runId}:${repoDir}`).slice(0, 16)}`), MANIFEST = "manifest.json", WALL_HOLDOUT_MIN = 5, HOLDOUT_TRIAGE_FILE = "holdout-triage.jsonl";
 var init_holdout = () => {};
 
 // ../../loki-ts/src/features/runner_config.ts
@@ -64984,8 +65215,8 @@ var init_runner_config = __esm(() => {
 
 // ../../loki-ts/src/e10ext/assert_delta.ts
 import { execFileSync as execFileSync6 } from "child_process";
-import { mkdtempSync as mkdtempSync8, readFileSync as readFileSync72, rmSync as rmSync20 } from "fs";
-import { tmpdir as tmpdir11 } from "os";
+import { mkdtempSync as mkdtempSync9, readFileSync as readFileSync72, rmSync as rmSync20 } from "fs";
+import { tmpdir as tmpdir12 } from "os";
 import { join as join81 } from "path";
 import { basename as basename21 } from "path";
 function classifyAssertDelta(inp) {
@@ -64996,7 +65227,7 @@ function classifyAssertDelta(inp) {
     return WEAKENED;
   let cwd = "";
   try {
-    cwd = mkdtempSync8(join81(tmpdir11(), "loki-ad-"));
+    cwd = mkdtempSync9(join81(tmpdir12(), "loki-ad-"));
     const raw2 = execFileSync6("python3", ["-I", "-c", PY2], {
       input: JSON.stringify({ path: inp.path, base: inp.base, head: inp.head, task: inp.task }),
       cwd,
@@ -65508,9 +65739,9 @@ app_runner_stop >/dev/null 2>&1
 });
 
 // ../../loki-ts/src/util/secure_scan.ts
-import { copyFileSync as copyFileSync5, existsSync as existsSync57, lstatSync as lstatSync23, mkdirSync as mkdirSync41, mkdtempSync as mkdtempSync9, readFileSync as readFileSync75, realpathSync as realpathSync26, rmSync as rmSync21, statSync as statSync25, writeFileSync as writeFileSync39 } from "fs";
+import { copyFileSync as copyFileSync5, existsSync as existsSync57, lstatSync as lstatSync23, mkdirSync as mkdirSync41, mkdtempSync as mkdtempSync10, readFileSync as readFileSync75, realpathSync as realpathSync26, rmSync as rmSync21, statSync as statSync25, writeFileSync as writeFileSync39 } from "fs";
 import { randomBytes as randomBytes6 } from "crypto";
-import { tmpdir as tmpdir12 } from "os";
+import { tmpdir as tmpdir13 } from "os";
 import { basename as basename22, dirname as dirname34, join as join84, resolve as resolve28, sep as sep17 } from "path";
 function fail(error) {
   return { ok: false, findings: [], error };
@@ -65560,7 +65791,7 @@ async function runSecureScan(targetDir, opts = {}) {
   return fail(`secure-scan failed (exit ${res.exitCode}): ${tail2}`);
 }
 async function secureScanChanged(repoDir, changed, scriptPath) {
-  const dir = mkdtempSync9(join84(tmpdir12(), "loki-deep-secure-"));
+  const dir = mkdtempSync10(join84(tmpdir13(), "loki-deep-secure-"));
   try {
     for (const f of changed)
       if (existsSync57(join84(repoDir, f)) && lstatSync23(join84(repoDir, f)).isFile()) {
@@ -65721,7 +65952,7 @@ async function scanAddedLines(repoDir, opts = {}) {
   }
   if (added.size === 0)
     return { ok: true, findings: skipped2 };
-  const mirror = mkdtempSync9(join84(tmpdir12(), "loki-secure-added-"));
+  const mirror = mkdtempSync10(join84(tmpdir13(), "loki-secure-added-"));
   try {
     const root = resolve28(mirror) + sep17;
     const chunkMap = new Map;
@@ -66266,8 +66497,8 @@ var init_conventions = __esm(() => {
 });
 
 // ../../loki-ts/src/util/pr_lessons.ts
-import { existsSync as existsSync60, mkdirSync as mkdirSync42, mkdtempSync as mkdtempSync10, readFileSync as readFileSync78, rmSync as rmSync22, writeFileSync as writeFileSync41 } from "fs";
-import { homedir as homedir10, tmpdir as tmpdir13 } from "os";
+import { existsSync as existsSync60, mkdirSync as mkdirSync42, mkdtempSync as mkdtempSync11, readFileSync as readFileSync78, rmSync as rmSync22, writeFileSync as writeFileSync41 } from "fs";
+import { homedir as homedir10, tmpdir as tmpdir14 } from "os";
 import { dirname as dirname36, join as join87 } from "path";
 import { createHash as createHash26 } from "crypto";
 function loadLessons(repoDir) {
@@ -67081,6 +67312,7 @@ ${relevantFiles.join(`
 var MAX_PLAN_LINES = 10, PLAN_OUTPUT_FILENAME = "plan-output.txt", planStage, stage2;
 var init_plan = __esm(() => {
   init_relevant_files();
+  init_worker_proc();
   init_session();
   init_sizing();
   init_types();
@@ -67134,7 +67366,7 @@ var init_plan = __esm(() => {
       let planModelNote = null;
       if (pr2.pinOpus && !session.killed && session.exit !== 0) {
         planModel = planFallbackModel(ctx.model);
-        planModelNote = `Opus plan session failed (exit ${session.exit}); the plan ran on ${planModel}`;
+        planModelNote = `Opus plan session failed (${session.exit === MAX_TURNS_EXIT ? "turn cap reached" : `exit ${session.exit}`}); the plan ran on ${planModel}`;
         session = await runPlan(true);
       }
       if (!session.killed && session.exit !== 0) {
@@ -67169,8 +67401,8 @@ var init_plan = __esm(() => {
 
 // ../../loki-ts/src/util/conflict_resume.ts
 import { createHash as createHash27 } from "crypto";
-import { existsSync as existsSync64, mkdtempSync as mkdtempSync11, readFileSync as readFileSync83, rmSync as rmSync24, writeFileSync as writeFileSync45 } from "fs";
-import { tmpdir as tmpdir14 } from "os";
+import { existsSync as existsSync64, mkdtempSync as mkdtempSync12, readFileSync as readFileSync83, rmSync as rmSync24, writeFileSync as writeFileSync45 } from "fs";
+import { tmpdir as tmpdir15 } from "os";
 import { basename as basename24, join as join92, relative as relative18 } from "path";
 async function resumeAfterConflict(ctx, first, firstSession) {
   if ((ctx.implementLeftS?.() ?? Infinity) < RESUME_MIN_LEFT_S)
@@ -67195,7 +67427,7 @@ async function adjudicateWallConflict(ctx, first, firstSession, wall) {
   const reason = firstSession.markers.specConflict, rels = wall.map((f10) => relative18(ctx.repoDir, f10.path)), a = reason ? wallAnchor(reason, rels) : null;
   if (!reason || !a)
     return null;
-  const f = wall[rels.indexOf(a.file)], ids = [], o = ctx.outputs(), cwd = mkdtempSync11(join92(tmpdir14(), "loki-e15-wall-")), name = basename24(f.path);
+  const f = wall[rels.indexOf(a.file)], ids = [], o = ctx.outputs(), cwd = mkdtempSync12(join92(tmpdir15(), "loki-e15-wall-")), name = basename24(f.path);
   try {
     writeFileSync45(join92(cwd, name), f.content, "utf8");
     const id2 = `${first.iterationId}-wa`;
@@ -67392,6 +67624,7 @@ var init_implement = __esm(() => {
   init_verify();
   init_resolve();
   init_session();
+  init_worker_proc();
   init_conflict_resume();
   init_session_resume();
   init_implement_route();
@@ -67454,7 +67687,7 @@ var init_implement = __esm(() => {
       } }) : null;
       let session = two ? two.session : await ctx.sessions.run(first);
       const ids = two ? two.ids : [first.iterationId];
-      if (resumeId && !session.killed && session.exit !== 0) {
+      if (resumeId && !session.killed && session.exit !== 0 && session.exit !== MAX_TURNS_EXIT) {
         planChainMode = "fallback (resume failed)";
         if (ownId) {
           sessionResume = "fallback (resume failed)";
@@ -67501,7 +67734,7 @@ var init_implement = __esm(() => {
       const testsReverted = restoreReadOnly(readOnly);
       const iterationId = ids[ids.length - 1];
       let exit;
-      if (session.killed) {
+      if (session.killed || session.exit === MAX_TURNS_EXIT) {
         exit = "killed";
       } else if (session.markers.specConflict) {
         exit = "spec_conflict";
@@ -67526,6 +67759,7 @@ var init_implement = __esm(() => {
         ...rt2 ? { route_model: rt2.current, route_escalations: rt2.escalations } : {},
         session_id: readSessionId(ctx.repoDir, iterationId),
         duration_s: session.durationS,
+        ...session.exit === MAX_TURNS_EXIT && !session.killed ? { stop_cause: "max_turns", owner: "harness", limit_s: implementStage.limitS, elapsed_s: session.durationS } : {},
         ...planChainMode ? { plan_chain: planChainMode } : {},
         ...sessionResume ? { session_resume: sessionResume } : {},
         ...two ? { attempts: two.summary } : {}
@@ -68218,12 +68452,12 @@ __export(exports_deep, {
   deepStage: () => deepStage,
   DEFAULT_SECRET_SCAN_SH: () => DEFAULT_SECRET_SCAN_SH
 });
-import { existsSync as existsSync67, mkdirSync as mkdirSync49, mkdtempSync as mkdtempSync12, rmSync as rmSync27, writeFileSync as writeFileSync48 } from "fs";
-import { tmpdir as tmpdir15 } from "os";
+import { existsSync as existsSync67, mkdirSync as mkdirSync49, mkdtempSync as mkdtempSync13, rmSync as rmSync27, writeFileSync as writeFileSync48 } from "fs";
+import { tmpdir as tmpdir16 } from "os";
 import { join as join96 } from "path";
 function sessionCouncil(sessions) {
   return { async run(input, signal) {
-    const cwd = mkdtempSync12(join96(tmpdir15(), "loki-deep-council-"));
+    const cwd = mkdtempSync13(join96(tmpdir16(), "loki-deep-council-"));
     try {
       writeFileSync48(join96(cwd, "diff.patch"), input.diff, "utf8");
       const r = await sessions.run({
@@ -68286,7 +68520,7 @@ ${r.stderr}`), lr2 = r.exitCode === 0 ? undefined : await harnessLoadReason({ re
       notProven.add(`${lr2} (${name}; harness-owned)`);
       continue;
     }
-    const cls = classifyCheck({ kind: "test", ok: r.exitCode === 0, out: out3, ...goRunner(spec.cmd, spec.args) });
+    const cls = await corroborateGoPass(classifyCheck({ kind: "test", ok: r.exitCode === 0, out: out3, ...goRunner(spec.cmd, spec.args) }), out3, spec.cmd, spec.args, { cwd: ctx.repoDir, env: suiteEnv(opts.path) });
     checks.push({ name, cmd: [spec.cmd, ...spec.args].join(" "), result: cls.result, duration_s: durationS, ...cls.result === "fail" ? { ids: failIds(out3), excerpt: failureExcerpt(out3, ctx.repoDir) } : {} });
     if (cls.result === "not_run")
       notProven.add(`not run: ${name} (${cls.reason ?? NO_TESTS_REASON})`);
@@ -68526,8 +68760,8 @@ __export(exports_verify, {
   commandFor: () => commandFor,
   changedFiles: () => changedFiles
 });
-import { existsSync as existsSync68, mkdtempSync as mkdtempSync13, readFileSync as readFileSync86, rmSync as rmSync28 } from "fs";
-import { tmpdir as tmpdir16 } from "os";
+import { existsSync as existsSync68, mkdtempSync as mkdtempSync14, readFileSync as readFileSync86, rmSync as rmSync28 } from "fs";
+import { tmpdir as tmpdir17 } from "os";
 import { basename as basename25, isAbsolute as isAbsolute18, join as join97, relative as relative21 } from "path";
 async function runOnce3(cmd, args, cwd, signal, opts) {
   if (!Bun.which(cmd, { PATH: opts.path ?? process.env["PATH"] ?? "" }))
@@ -68564,7 +68798,7 @@ async function runCheck(ctx, name, cmd, args, signal, checks, opts = {}) {
   const kind = opts.kind ?? "test";
   const cwd = opts.cwd ?? ctx.repoDir;
   const one2 = async (a) => {
-    let c10 = classifyCheck({ kind, ok: a.ok, cut: a.cut, missing: a.missing, out: a.out, ...goRunner(cmd, args), path: /\.[cm]?[jt]s$/.test(args[args.length - 1] ?? "") ? args[args.length - 1] : undefined });
+    let c10 = await corroborateGoPass(classifyCheck({ kind, ok: a.ok, cut: a.cut, missing: a.missing, out: a.out, ...goRunner(cmd, args), path: /\.[cm]?[jt]s$/.test(args[args.length - 1] ?? "") ? args[args.length - 1] : undefined }), a.out, cmd, args, { cwd, env: opts.path ? { ...plainTestEnv(), PATH: opts.path } : plainTestEnv() });
     const lr2 = kind === "test" && !a.ok && !a.cut && !a.missing ? await harnessLoadReason({ repoDir: ctx.repoDir, baseSha: ctx.baseSha, skip: installOwned(ctx.repoDir, ctx.outputs?.().intake?.install_created), out: a.out, cmd, args, signal, cwd, protect: opts.protect, ...opts.path ? { env: { PATH: opts.path } } : {} }) : undefined;
     if (lr2)
       c10 = { result: "not_run", reason: lr2, owner: "harness" };
@@ -68621,7 +68855,7 @@ async function subtractBase(ctx, api, checks, tests, changed, wall, rel, signal,
   const zc2 = zeroOk ? un2.filter(({ c, t }) => c.result === "not_run" && !c.owner && (c.reason ?? "").startsWith(NO_TESTS_REASON) && !wall.has(c.name) && !isHoldoutCheck(c.name) && !changed.includes(t.path) && zeroIntake.has(c.name)) : [];
   if (!(un2.some(({ c }) => c.result === "fail" && c.ids?.length) || sus.length || zc2.length) || signal.aborted)
     return out3;
-  const dir = mkdtempSync13(join97(tmpdir16(), "e10-base-"));
+  const dir = mkdtempSync14(join97(tmpdir17(), "e10-base-"));
   const git9 = (args) => {
     safeGit(ctx.repoDir, args, { stdio: "ignore", repoDrivers: true });
   };
@@ -68920,8 +69154,8 @@ __export(exports_wall, {
   BASE_RUN_TIMEOUT_MS: () => BASE_RUN_TIMEOUT_MS
 });
 import { spawnSync as spawnSync10 } from "child_process";
-import { existsSync as existsSync69, mkdirSync as mkdirSync50, mkdtempSync as mkdtempSync14, readFileSync as readFileSync87, readdirSync as readdirSync28, rmSync as rmSync29, writeFileSync as writeFileSync49 } from "fs";
-import { tmpdir as tmpdir17 } from "os";
+import { existsSync as existsSync69, mkdirSync as mkdirSync50, mkdtempSync as mkdtempSync15, readFileSync as readFileSync87, readdirSync as readdirSync28, rmSync as rmSync29, writeFileSync as writeFileSync49 } from "fs";
+import { tmpdir as tmpdir18 } from "os";
 import { dirname as dirname39, join as join98, relative as relative22 } from "path";
 
 class RealBaseTestRunner {
@@ -69001,8 +69235,10 @@ function loadTaskText(ctx, fromPrior) {
   }
   return process.env.LOKI_E10_TASK_TEXT ?? "";
 }
-function wallTargetDir(repoDir, existingTests) {
+function wallTargetDir(repoDir, existingTests, runners = []) {
   const first = existingTests[0];
+  if (!first && runners.some((r) => r === "maven" || r === "gradle" || r === "javac"))
+    return join98(repoDir, "src", "test", "java");
   return first ? join98(repoDir, dirname39(first.path)) : join98(repoDir, "tests");
 }
 async function wallAuthor(ctx, signal, retry) {
@@ -69022,15 +69258,17 @@ async function wallAuthor(ctx, signal, retry) {
   if (!ctx.externalPatch && planMode() !== "always" && smallTaskPath(sz2.size, hasRelevantTests(task, repoMap, testMap, ctx.tests.impacted)) === "lean") {
     return done({ status: "skipped", data: { size: sz2.size }, reason: "small task with a relevant test: cascade skips Wall" });
   }
-  if (testMap && runners.length === 0)
-    return done({ status: "skipped", data: { size: sz2.size, files: [], no_runner: true, skip_code: harnessSkipCode(), not_proven: ["Wall skipped: no runnable test command for this stack"] }, reason: "no runnable test command detected: the Wall cannot write a runnable check" });
+  if (testMap && runners.length === 0) {
+    const miss = missingJavaTool(repoMap?.files ?? [], process.env, ctx.repoDir);
+    return done({ status: "skipped", data: { size: sz2.size, files: [], no_runner: true, skip_code: harnessSkipCode(), not_proven: [miss ? `Wall not run: ${miss} is not installed on this machine, so this Java repo could not be tested (harness-owned)` : "Wall skipped: no runnable test command for this stack"] }, reason: miss ? `${miss} is not installed: the Wall cannot run Java tests (harness-owned, not proven)` : "no runnable test command detected: the Wall cannot write a runnable check" });
+  }
   if (testMap && runners.every((r) => r === "pytest") && projectInterpreter(ctx.repoDir) === "system" && wallHoldoutRatio() === 0)
     return done({ status: "skipped", data: { size: sz2.size, files: [], no_interpreter: true, not_proven: ["Wall skipped: no project test interpreter"] }, reason: "Wall skipped: no project test interpreter" });
   const tree = prior.intake?.tree;
   const repomapText = repoMapText(ctx.repoDir, tree, repomapRef, WALL_MAP_MAX_LINES);
-  const targetDir = wallTargetDir(ctx.repoDir, existingTests), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative22(ctx.repoDir, targetDir)}/x`);
+  const targetDir = wallTargetDir(ctx.repoDir, existingTests, runners), pkg = loadProjectApi(ctx.repoDir)?.packageOf(`${relative22(ctx.repoDir, targetDir)}/x`);
   const conv2 = readPackageConventions(join98(ctx.repoDir, pkg?.root ?? "."), pkg?.runner ?? null);
-  const cwd = mkdtempSync14(join98(tmpdir17(), "loki-e15-wall-"));
+  const cwd = mkdtempSync15(join98(tmpdir18(), "loki-e15-wall-"));
   const wm2 = wallManifestFor(ctx.repoDir, tree, task);
   for (const [n10, c] of [["task.md", task], ["repomap.txt", repomapText], ...wm2 ? [["wall_manifest.txt", wm2.text]] : []])
     writeFileSync49(join98(cwd, n10), c, "utf8");
@@ -70968,7 +71206,7 @@ var init_seal = __esm(() => {
         checks,
         not_proven: [],
         verdict,
-        ...typeof o.implement?.limit_s === "number" ? { implement_limit: { limit_s: o.implement.limit_s, elapsed_s: typeof o.implement.elapsed_s === "number" ? o.implement.elapsed_s : 0 } } : {},
+        ...typeof o.implement?.limit_s === "number" ? { implement_limit: { limit_s: o.implement.limit_s, elapsed_s: typeof o.implement.elapsed_s === "number" ? o.implement.elapsed_s : 0, ...o.implement.stop_cause === "max_turns" ? { stop_cause: "max_turns", owner: "harness" } : {} } } : {},
         ...grp.section ? { group: grp.section } : {},
         ...ctx.failovers && ctx.failovers().length > 0 ? { failover: ctx.failovers() } : {},
         ...str3(o.implement?.spec_conflict_reason) !== null ? { spec_conflict_reason: sanitizeReason(str3(o.implement?.spec_conflict_reason)) } : {},
@@ -71659,9 +71897,21 @@ var init_provider = __esm(() => {
 });
 
 // ../../loki-ts/src/util/funnel.ts
+function blockerOf(v3) {
+  return typeof v3 === "string" && PREFLIGHT_BLOCKERS.includes(v3) ? v3 : null;
+}
+function noteRefusal(b) {
+  if (b)
+    refusal = b;
+}
+function noteRefusalFromEvents(events2) {
+  noteRefusal(blockerOf(events2.find((e10) => e10.type === "stage.failed" && e10.stage === "intake")?.data["blocker"]));
+}
+var PREFLIGHT_BLOCKERS, refusal = null;
 var init_funnel = __esm(() => {
   init_paths();
   init_safe_git();
+  PREFLIGHT_BLOCKERS = ["not_a_repo", "git_identity", "dirty_tracked_tree", "no_provider", "not_logged_in", "prd_missing", "unsupported_flag", "disk", "other"];
 });
 
 // ../../loki-ts/src/cockpit/capability.ts
@@ -71676,7 +71926,7 @@ var init_raster = () => {};
 // ../../loki-ts/src/commands/doctor.ts
 import { appendFileSync as appendFileSync11, writeFileSync as writeFileSync56, mkdirSync as mkdirSync56, accessSync as accessSync2, constants as fsConstants2, existsSync as existsSync75, lstatSync as lstatSync28, readdirSync as readdirSync32, readFileSync as readFileSync94, readlinkSync as readlinkSync6, realpathSync as realpathSync31, statSync as statSync29, statfsSync } from "fs";
 import { spawnSync as spawnSync12 } from "child_process";
-import { homedir as homedir12, tmpdir as tmpdir18 } from "os";
+import { homedir as homedir12, tmpdir as tmpdir19 } from "os";
 import { join as join108, resolve as resolve31 } from "path";
 function loadRequirements(file = REQUIREMENTS_FILE) {
   if (file === REQUIREMENTS_FILE && cached)
@@ -71706,7 +71956,7 @@ function providerLoginIssue(provider, cli, env) {
   if (provider === "codex") {
     if (key("OPENAI_API_KEY") || key("CODEX_API_KEY"))
       return null;
-    const r = spawnSync12(cli, ["login", "status"], { env: providerProbeEnv(env), encoding: "utf8", timeout: 5000, cwd: tmpdir18() });
+    const r = spawnSync12(cli, ["login", "status"], { env: providerProbeEnv(env), encoding: "utf8", timeout: 5000, cwd: tmpdir19() });
     if (r.status === 0)
       return null;
     const said = `${r.stdout}${r.stderr}`;
@@ -71896,18 +72146,19 @@ async function checkPreflight(o) {
       pinErr = `${e10.message}; set a valid value or unset it (the run would otherwise drop the pin and use the provider default model)`;
     }
   }
-  const fatal = wt.exitCode !== 0 || wt.stdout.trim() !== "true" ? initFatal ?? NOT_A_REPO(o.repoDir) : !name.stdout.trim() || !email.stdout.trim() ? `git identity is not set; run: git config user.name "you" && git config user.email "you@example.com"` : !envVar ? `the v10 engine has no ${o.provider} invoker yet` : o.provider !== "claude" && truthy(env["LOKI_HOST_GUARD"]) ? `LOKI_HOST_GUARD=1 is set but provider '${o.provider}' has no enforced PreToolUse hook; unset LOKI_HOST_GUARD or use --provider claude` : pinErr ? pinErr : !cliOk ? `provider CLI '${cli}' is not on PATH; install it or set ${envVar} to its path${requirementFix(o.provider) ? `. Fix: ${requirementFix(o.provider)}` : ""}` : head.exitCode !== 0 ? "repository has no commits; run: git add . && git commit -m init" : null;
-  if (fatal)
-    return { fatal, warnings };
+  const refuse = (b, f) => [b, f];
+  const hit = wt.exitCode !== 0 || wt.stdout.trim() !== "true" ? refuse("not_a_repo", initFatal ?? NOT_A_REPO(o.repoDir)) : !name.stdout.trim() || !email.stdout.trim() ? refuse("git_identity", `git identity is not set; run: git config user.name "you" && git config user.email "you@example.com"`) : !envVar ? refuse("unsupported_flag", `the v10 engine has no ${o.provider} invoker yet`) : o.provider !== "claude" && truthy(env["LOKI_HOST_GUARD"]) ? refuse("other", `LOKI_HOST_GUARD=1 is set but provider '${o.provider}' has no enforced PreToolUse hook; unset LOKI_HOST_GUARD or use --provider claude`) : pinErr ? refuse("other", pinErr) : !cliOk ? refuse("no_provider", `provider CLI '${cli}' is not on PATH; install it or set ${envVar} to its path${requirementFix(o.provider) ? `. Fix: ${requirementFix(o.provider)}` : ""}`) : head.exitCode !== 0 ? refuse("other", "repository has no commits; run: git add . && git commit -m init") : null;
+  if (hit)
+    return { fatal: hit[1], warnings, blocker: hit[0] };
   try {
     accessSync3(o.repoDir, fsc2.W_OK);
   } catch {
-    return { fatal: `${o.repoDir} is not writable; run: chmod u+w "${o.repoDir}" (or run loki from a writable checkout)`, warnings };
+    return { fatal: `${o.repoDir} is not writable; run: chmod u+w "${o.repoDir}" (or run loki from a writable checkout)`, warnings, blocker: "other" };
   }
   const free = freeMb(o.repoDir, o.statfs ?? statfsSync2);
   const minMb = Number(env["LOKI_MIN_FREE_MB"]) > 0 ? Number(env["LOKI_MIN_FREE_MB"]) : 200;
   if (free !== null && free < minMb)
-    return { fatal: `only ${Math.floor(free)} MB free on the volume holding ${o.repoDir} (need ${minMb} MB); free disk space, or lower LOKI_MIN_FREE_MB`, warnings };
+    return { fatal: `only ${Math.floor(free)} MB free on the volume holding ${o.repoDir} (need ${minMb} MB); free disk space, or lower LOKI_MIN_FREE_MB`, warnings, blocker: "disk" };
   if (free !== null && free < Math.max(2048, minMb))
     warnings.push(`low disk: ${Math.floor(free)} MB free on the volume holding ${o.repoDir}; a long run may fail mid-way (warns under 2 GB)`);
   const auth_path = providerAuthPath(o.provider, env);
@@ -71943,11 +72194,11 @@ async function checkPreflight(o) {
     } catch {}
   }
   if (authFatal)
-    return { fatal: authFatal, warnings };
+    return { fatal: authFatal, warnings, blocker: "not_logged_in" };
   if (o.pr && GITHUB_ORIGIN_RE.test((await git10(["config", "--get", "remote.origin.url"])).stdout.trim())) {
     const ghOk = await ghAuthProbeCached(env, async () => (await sh3(["gh", "--version"], { env, timeoutMs: 5000 })).exitCode === 0 && (await sh3(["gh", "auth", "status"], { env, timeoutMs: 1e4 })).exitCode === 0);
     if (!ghOk)
-      return { fatal: `gh (GitHub CLI) is missing or not authenticated; run gh auth login, or pass --no-pr`, warnings };
+      return { fatal: `gh (GitHub CLI) is missing or not authenticated; run gh auth login, or pass --no-pr`, warnings, blocker: "other" };
     const plan = await probePublish((await git10(["config", "--get", "remote.origin.url"])).stdout.trim(), env);
     if (plan) {
       if (plan.warning)
@@ -71964,7 +72215,7 @@ async function assertPreflight(o) {
     process.stderr.write(`${w}
 `);
   if (r.fatal)
-    throw new PreflightError(r.fatal);
+    throw new PreflightError(r.fatal, r.blocker);
 }
 var CLI_ENV_VAR, GITHUB_ORIGIN_RE, PreflightError;
 var init_preflight = __esm(() => {
@@ -71975,9 +72226,15 @@ var init_preflight = __esm(() => {
   init_first_run_repo();
   init_engine_origin();
   init_shell();
+  init_funnel();
   CLI_ENV_VAR = { claude: "LOKI_CLAUDE_CLI", codex: "LOKI_CODEX_CLI", cline: "LOKI_CLINE_CLI", aider: "LOKI_AIDER_CLI", opencode: "LOKI_OPENCODE_CLI" };
   GITHUB_ORIGIN_RE = /^(?:https:\/\/(?:[^@/]+@)?github\.com\/|git@github\.com:|ssh:\/\/git@github\.com\/)/;
   PreflightError = class PreflightError extends Error {
+    blocker;
+    constructor(message, blocker = "other") {
+      super(message);
+      this.blocker = blocker;
+    }
   };
 });
 
@@ -73834,8 +74091,8 @@ __export(exports_issues_run, {
   TRIAGE_RE: () => TRIAGE_RE
 });
 import { spawnSync as spawnSync15 } from "child_process";
-import { cpSync as cpSync3, existsSync as existsSync79, mkdirSync as mkdirSync61, mkdtempSync as mkdtempSync15, rmSync as rmSync33, writeFileSync as writeFileSync59 } from "fs";
-import { tmpdir as tmpdir19 } from "os";
+import { cpSync as cpSync3, existsSync as existsSync79, mkdirSync as mkdirSync61, mkdtempSync as mkdtempSync16, rmSync as rmSync33, writeFileSync as writeFileSync59 } from "fs";
+import { tmpdir as tmpdir20 } from "os";
 import { join as join113, resolve as resolve35 } from "path";
 import { createInterface as createInterface3 } from "readline";
 function parseIssuesArgs(args) {
@@ -74250,7 +74507,7 @@ function makeWorktrees(repoDir) {
   let root = null;
   return {
     create: (name, base) => {
-      root ??= mkdtempSync15(join113(tmpdir19(), "loki-issues-"));
+      root ??= mkdtempSync16(join113(tmpdir20(), "loki-issues-"));
       const p = join113(root, name);
       safeGit(repoDir, ["worktree", "add", "-B", `loki/${name}`, p, base]);
       return p;
@@ -74713,6 +74970,7 @@ async function main4(args) {
       if (v3 === undefined || v3 === "" || v3.startsWith("-")) {
         process.stderr.write(`engine10: --max-cost needs a value
 `);
+        noteRefusal("unsupported_flag");
         return 2;
       }
       maxCost = v3;
@@ -74724,6 +74982,7 @@ async function main4(args) {
       if (v3 === undefined || v3 === "" || v3.startsWith("-")) {
         process.stderr.write(`engine10: --provider needs a value
 `);
+        noteRefusal("unsupported_flag");
         return 2;
       }
       provider = v3;
@@ -74733,6 +74992,7 @@ async function main4(args) {
       if (v3 === undefined || v3 === "" || v3.startsWith("-")) {
         process.stderr.write(`engine10: --spec needs a value
 `);
+        noteRefusal("unsupported_flag");
         return 2;
       }
       specFile = v3;
@@ -74748,6 +75008,7 @@ async function main4(args) {
       if (v3 === undefined || v3 === "" || v3.startsWith("-")) {
         process.stderr.write(`engine10: --seal-existing needs a patch file
 `);
+        noteRefusal("unsupported_flag");
         return 2;
       }
       sealPatch = resolve36(v3);
@@ -74759,6 +75020,7 @@ async function main4(args) {
       process.stderr.write(`engine10: unknown flag ${a}
 usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-cost N] [--provider P] [--spec F] [--seal-existing PATCH] [--resume] [--fresh] [-- <task>]
 `);
+      noteRefusal("unsupported_flag");
       return 2;
     } else
       words3.push(a);
@@ -74773,6 +75035,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
     } catch (e10) {
       process.stderr.write(`engine10: ${e10.message}
 `);
+      noteRefusal("prd_missing");
       return 2;
     }
     if (!task)
@@ -74789,6 +75052,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
   if (!task) {
     process.stderr.write(`engine10: no task given
 `);
+    noteRefusal("prd_missing");
     return 2;
   }
   let repoDir;
@@ -74799,6 +75063,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
     if (!i.notice) {
       process.stderr.write(`engine10: ${i.fatal ?? "not inside a git repository"}
 `);
+      noteRefusal("not_a_repo");
       return 2;
     }
     process.stderr.write(`engine10: ${i.notice}
@@ -74808,6 +75073,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
     } catch {
       process.stderr.write(`engine10: not inside a git repository
 `);
+      noteRefusal("not_a_repo");
       return 2;
     }
   }
@@ -74969,6 +75235,7 @@ usage: loki "<task>" [--no-pr] [--deep] [--json] [--verbose] [--quiet] [--max-co
     if (e10.type === "stage.completed" && e10.stage === "plan")
       statusStep();
   }, { intervalMs: 500 }) : () => {};
+  let refusedAs = "other";
   const res = await runSupervisor({
     runId: runId2,
     repoDir,
@@ -75037,6 +75304,7 @@ ${prUrl ? "One question" : "Reason"}: ${reason}
       throw e10;
     process.stderr.write(`${e10.message}
 `);
+    refusedAs = e10.blocker;
     return null;
   });
   clearInterval(tailTimer);
@@ -75044,12 +75312,14 @@ ${prUrl ? "One question" : "Reason"}: ${reason}
   if (!res) {
     stopTail();
     liveStop();
+    noteRefusal(refusedAs);
     return 2;
   }
   await new Promise((r) => setTimeout(r, 300));
   stopTail();
   liveStop();
   const events2 = readEvents(eventsPath), f = fold(events2);
+  noteRefusalFromEvents(events2);
   const sawCost = events2.some((e10) => e10.type === "cost"), cli = process.env.LOKI_E10_INVOKER === "cli";
   const { usd, pc: pc2 } = summaryCost(events2, res.tampered);
   const out3 = json2 ? `${JSON.stringify({ ok: EXIT[res.outcome] === 0, outcome: res.outcome, stop: res.stop, run_id: runId2, receipt_sha256: res.receiptSha })}
@@ -75123,6 +75393,7 @@ var init_supervisor = __esm(() => {
   init_worker_proc();
   init_intent_card();
   init_preflight();
+  init_funnel();
   init_session();
   init_failure_memory();
   init_model_downgrades();
@@ -75625,8 +75896,8 @@ var init_warm = __esm(() => {
 
 // ../../loki-ts/src/features/speed/already_done_async.ts
 import { execFile as execFile3 } from "child_process";
-import { mkdirSync as mkdirSync65, mkdtempSync as mkdtempSync16, rmSync as rmSync34 } from "fs";
-import { tmpdir as tmpdir20 } from "os";
+import { mkdirSync as mkdirSync65, mkdtempSync as mkdtempSync17, rmSync as rmSync34 } from "fs";
+import { tmpdir as tmpdir21 } from "os";
 import { join as join118 } from "path";
 function hitsUnchangedFromBase(repoDir, baseSha, paths) {
   if (paths.length === 0 || !baseSha)
@@ -75665,7 +75936,7 @@ function dropRoot(root) {
 function pinBaseTree(ctx, signal) {
   let root;
   try {
-    root = mkdtempSync16(join118(tmpdir20(), "loki-already-done-"));
+    root = mkdtempSync17(join118(tmpdir21(), "loki-already-done-"));
   } catch {
     return Promise.resolve(null);
   }
@@ -75833,7 +76104,7 @@ async function runIntakeBody(ctx, signal, opts, held) {
     return { status: "failed", data: {}, reason: "aborted before intake started" };
   const { blocking: dirty, preexisting } = splitDirty(ctx.repoDir, dirtyTrackedFiles(ctx.repoDir));
   if (dirty.length > 0)
-    return { status: "failed", data: {}, reason: `dirty tracked tree: ${dirty.join(", ")}` };
+    return { status: "failed", data: { blocker: "dirty_tracked_tree" }, reason: `dirty tracked tree: ${dirty.join(", ")}` };
   let baseSha = git13(ctx.repoDir, ["rev-parse", "HEAD"]);
   const startBranch = git13(ctx.repoDir, ["symbolic-ref", "-q", "--short", "HEAD"]);
   let stacked = stackedOnLokiRun(ctx.repoDir);
@@ -77214,8 +77485,8 @@ var init_seal2 = __esm(() => {
 
 // ../../loki-ts/src/engine10/modernize/oracle/search.ts
 import { spawnSync as spawnSync18 } from "child_process";
-import { copyFileSync as copyFileSync6, existsSync as existsSync86, linkSync as linkSync4, mkdirSync as mkdirSync68, mkdtempSync as mkdtempSync17, readFileSync as readFileSync107, renameSync as renameSync22, rmSync as rmSync35, rmdirSync as rmdirSync2, writeFileSync as writeFileSync63 } from "fs";
-import { tmpdir as tmpdir21 } from "os";
+import { copyFileSync as copyFileSync6, existsSync as existsSync86, linkSync as linkSync4, mkdirSync as mkdirSync68, mkdtempSync as mkdtempSync18, readFileSync as readFileSync107, renameSync as renameSync22, rmSync as rmSync35, rmdirSync as rmdirSync2, writeFileSync as writeFileSync63 } from "fs";
+import { tmpdir as tmpdir22 } from "os";
 import { basename as basename31, dirname as dirname48, join as join125 } from "path";
 function search(unitSource, seedCases, propose, runCapture, opts = {}) {
   const maxRounds = opts.maxRounds ?? 10;
@@ -77273,7 +77544,7 @@ function realCaptureRunner(unitPath, cases, outPath) {
     return captureFailed("old runtime unavailable");
   let dir = "";
   try {
-    dir = mkdtempSync17(join125(tmpdir21(), "m10-search-"));
+    dir = mkdtempSync18(join125(tmpdir22(), "m10-search-"));
     const casesFile = join125(dir, "cases.jsonl");
     const outFile = join125(dir, "out.jsonl");
     const covFile = join125(dir, "coverage.json");
@@ -77324,7 +77595,7 @@ function resolveOldRuntimeSync() {
 }
 function makeProposeInputs(session, cap = 20) {
   return (unitPath, missing, round2) => {
-    const cwd = mkdtempSync17(join125(tmpdir21(), "m27-propose-"));
+    const cwd = mkdtempSync18(join125(tmpdir22(), "m27-propose-"));
     try {
       const unitFile = join125(cwd, basename31(unitPath));
       copyFileSync6(unitPath, unitFile);
@@ -77368,7 +77639,7 @@ function captureUnitOracle(a) {
   }
   if (r.cases.length === 0)
     return { ok: false, reason: "no cases captured" };
-  const scratch = mkdtempSync17(join125(tmpdir21(), "m27-replay-"));
+  const scratch = mkdtempSync18(join125(tmpdir22(), "m27-replay-"));
   const t12 = join125(scratch, "cases"), t22 = join125(scratch, "replay");
   const created = [];
   for (let p = dir;!existsSync86(p) && !created.includes(p); p = dirname48(p))
@@ -78431,7 +78702,7 @@ var init_presealed_wall = __esm(() => {
 import { spawnSync as spawnSync19 } from "child_process";
 import { createHash as createHash35 } from "crypto";
 import { lstatSync as lstatSync29, readFileSync as readFileSync112, readdirSync as readdirSync37, readlinkSync as readlinkSync7, realpathSync as realpathSync33, rmSync as rmSync36 } from "fs";
-import { tmpdir as tmpdir22 } from "os";
+import { tmpdir as tmpdir23 } from "os";
 import { join as join130, sep as sep20 } from "path";
 function isSealedName(rel) {
   return TEST_FILE2.test(rel) || PYTEST_CFG.test(rel);
@@ -78578,7 +78849,7 @@ for n in sys.argv[1:]:
         if n in sys.stdlib_module_names or u.find_spec(n): print(n)
     except Exception: print(n)
 `;
-  const r = spawnSync19(target, ["-I", "-c", code, ...names], { cwd: tmpdir22(), encoding: "utf8", timeout: 30000, env: tokenFreeEnv() });
+  const r = spawnSync19(target, ["-I", "-c", code, ...names], { cwd: tmpdir23(), encoding: "utf8", timeout: 30000, env: tokenFreeEnv() });
   return r.status === 0 ? new Set(r.stdout.split(`
 `).filter(Boolean)) : new Set(names);
 }
@@ -78857,8 +79128,8 @@ var init_wave = __esm(() => {
 
 // ../../loki-ts/src/util/modernize_unit.ts
 import { spawnSync as spawnSync21 } from "child_process";
-import { existsSync as existsSync89, lstatSync as lstatSync30, mkdtempSync as mkdtempSync18, readFileSync as readFileSync114, realpathSync as realpathSync34, rmSync as rmSync37, statSync as statSync34, writeFileSync as writeFileSync67 } from "fs";
-import { tmpdir as tmpdir23 } from "os";
+import { existsSync as existsSync89, lstatSync as lstatSync30, mkdtempSync as mkdtempSync19, readFileSync as readFileSync114, realpathSync as realpathSync34, rmSync as rmSync37, statSync as statSync34, writeFileSync as writeFileSync67 } from "fs";
+import { tmpdir as tmpdir24 } from "os";
 import { join as join132, sep as sep21 } from "path";
 function parseUnitArgs(args) {
   const f = {};
@@ -78976,7 +79247,7 @@ function runPythonCase(o, unitId, newTreeDir, rec2, stub) {
   const src = o.unitFile ? o.unitFile(unitId, newTreeDir) : defaultUnitFile(unitId, newTreeDir);
   if (!src || !src.endsWith(".py") || !existsSync89(src))
     throw new Error(`cannot locate the source of unit ${unitId} in the new tree`);
-  const dir = mkdtempSync18(join132(tmpdir23(), "loki-newcase-"));
+  const dir = mkdtempSync19(join132(tmpdir24(), "loki-newcase-"));
   try {
     const cases = join132(dir, "in.jsonl"), out3 = join132(dir, "out.jsonl");
     writeFileSync67(cases, JSON.stringify({ entry: rec2.entry, args: rec2.args, kwargs: rec2.kwargs, boundaries: boundariesFromCase(rec2) }) + `
@@ -79008,10 +79279,10 @@ Usage: ${UNIT_USAGE}
   const runners = u10.implement && u10.runNew && u10.runStub ? null : makeUnitRunners({ target: o.target });
   const implement = u10.implement ?? runners.implement, runNew = u10.runNew ?? runners.runNew, runStub = u10.runStub ?? runners.runStub;
   const runTmp = process.env["LOKI_RUN_TMP"] ?? "";
-  const root = u10.tmpRoot ?? (runTmp !== "" && isRealDir(runTmp) ? runTmp : tmpdir23());
+  const root = u10.tmpRoot ?? (runTmp !== "" && isRealDir(runTmp) ? runTmp : tmpdir24());
   let repoDir;
   try {
-    repoDir = mkdtempSync18(join132(root, "loki-unit-"));
+    repoDir = mkdtempSync19(join132(root, "loki-unit-"));
   } catch (e10) {
     process.stderr.write(`modernize unit: cannot create a temp checkout directory: ${e10.message}
 `);
@@ -79107,8 +79378,8 @@ var init_modernize_unit = __esm(() => {
 
 // ../../loki-ts/src/util/modernize_coordinator.ts
 import { createHash as createHash36 } from "crypto";
-import { existsSync as existsSync90, mkdtempSync as mkdtempSync19, readFileSync as readFileSync115, rmSync as rmSync38 } from "fs";
-import { tmpdir as tmpdir24 } from "os";
+import { existsSync as existsSync90, mkdtempSync as mkdtempSync20, readFileSync as readFileSync115, rmSync as rmSync38 } from "fs";
+import { tmpdir as tmpdir25 } from "os";
 import { join as join133 } from "path";
 function shipUnitOf(d, unit, o) {
   const sealed = join133(oracleDir(d.repoDir, d.mid, unit), "sealed.json");
@@ -79287,7 +79558,7 @@ function makeAttemptRunner(o) {
 }
 function makeUnitPrep(o) {
   const runtimeOk = o.runtimeOk ?? (() => {
-    const dir = mkdtempSync19(join133(tmpdir24(), "loki-probe-"));
+    const dir = mkdtempSync20(join133(tmpdir25(), "loki-probe-"));
     try {
       return realCaptureRunner(join133(dir, "probe.py"), []).error !== "old runtime unavailable";
     } finally {
@@ -80359,6 +80630,17 @@ function sealDrift(given, r, env = process.env) {
   }
   return null;
 }
+function wallNotComparedNote(receiptPath) {
+  try {
+    const r = JSON.parse(readFileSync119(receiptPath, "utf8"));
+    if (r["schema"] !== "loki.v10.receipt/1")
+      return null;
+    const files = r["wall"]?.files;
+    return Array.isArray(files) && files.length > 0 && !existsSync94(join136(dirname51(receiptPath), "wall")) ? "sealed Wall copies not present: not compared" : null;
+  } catch {
+    return null;
+  }
+}
 var EMPTY_SHA, sha6 = (s) => createHash38("sha256").update(s).digest("hex");
 var init_seal_drift = __esm(() => {
   init_safe_git();
@@ -80802,6 +81084,14 @@ function independentLine(receiptPath) {
   const k3 = pass.filter((c) => isExecutedProof(c) && (c.provenance === "exogenous" || c.provenance === "independent")).length, m = pass.filter((c) => c.provenance === "agent_authored" || c.provenance === "llm_judge").length;
   return { line: `agent-independent: ${k3} of ${pass.length} passing checks (wall/holdout/pre-existing/static/probe); advisory: ${m}`, k: k3, of: pass.length };
 }
+function signedRunIdProblem(receiptPath, runId2) {
+  try {
+    const r = JSON.parse(readFileSync121(receiptPath, "utf8")), s = r["run_id"];
+    return isEnvelope(r) || typeof s !== "string" || s === runId2 ? null : `receipt run_id ${JSON.stringify(printable(s).slice(0, 128))} does not match the run id ${JSON.stringify(runId2)} it was found under (a sealed run copied under another id)`;
+  } catch {
+    return null;
+  }
+}
 async function verifyMain(args, deps, rec2) {
   const allowUnsigned = args.includes("--allow-unsigned") || process.env["LOKI_VERIFY_ALLOW_UNSIGNED"] === "1";
   const exportDsse = args.includes("--export-dsse"), requireExo = args.includes("--require-exogenous") || process.env["LOKI_VERIFY_REQUIRE_EXOGENOUS"] === "1";
@@ -80862,7 +81152,7 @@ ${/^(unknown option|expected at most one)/.test(pk2.error) ? `Usage: loki verify
   rec2.receiptPath = receiptPath;
   if (exportDsse)
     return exportDsseReceipt({ receiptPath, runId: byRunId ? runId2 : null, deps, verify: verifyReceipt, key: loadSigningKey(false), kidOf: kidOf2 });
-  const bad = byRunId ? runIdGuard(receiptPath, runId2) : null;
+  const bad = byRunId ? runIdGuard(receiptPath, runId2) ?? signedRunIdProblem(receiptPath, runId2) : null;
   if (bad)
     return rec2.verdict = "TAMPERED", rec2.reasons = [bad], process.stdout.write(`run: ${runId2}
 verdict: TAMPERED
@@ -80917,6 +81207,11 @@ verdict: NOT VERIFIED (run outcome ${outcome}; receipt integrity ${result.verdic
       return 4;
     }
   }
+  if (result.verdict === "VERIFIED" || result.verdict === "UNSIGNED") {
+    const note = wallNotComparedNote(receiptPath);
+    if (note)
+      result = { ...result, reasons: [...result.reasons, note] };
+  }
   rec2.verdict = result.verdict;
   rec2.reasons = result.reasons;
   rec2.receiptSha256 = result.receiptSha256 ?? null;
@@ -92136,9 +92431,9 @@ function createApp(opts) {
 }
 
 // src/server/serve.ts
-var refusal = bindRefusal(process.env);
-if (refusal) {
-  console.error(refusal);
+var refusal2 = bindRefusal(process.env);
+if (refusal2) {
+  console.error(refusal2);
   process.exit(2);
 }
 var warning = insecureBindWarning(process.env);