opencode-feature-factory 0.2.0

package/dist/tui.js

@@ -0,0 +1,3641 @@
+// src/tui.jsx
+import { createMemo, createSignal, For, Show } from "solid-js";
+
+// src/tui-data.js
+import { existsSync as existsSync3, readFileSync as readFileSync2, readdirSync, statSync as statSync2 } from "node:fs";
+import { dirname as dirname4, join as join6, resolve as resolve5 } from "node:path";
+
+// src/cost-attribution.js
+var COST_ATTRIBUTION_SCHEMA_VERSION = 1;
+var MAX_COST_ATTRIBUTION_ENTRIES = 1e3;
+var COST_ATTRIBUTION_STATUSES = Object.freeze(["available", "partial", "unavailable"]);
+var COST_CURRENCY_PATTERN = /^[A-Z]{3,12}$/u;
+var USAGE_NUMERIC_FIELDS = Object.freeze([
+  "input_tokens",
+  "output_tokens",
+  "total_tokens",
+  "cache_creation_input_tokens",
+  "cache_read_input_tokens",
+  "reasoning_tokens"
+]);
+var COST_NUMERIC_FIELDS = Object.freeze([
+  "cost_total",
+  "cost_input",
+  "cost_output",
+  "cost_cache_creation",
+  "cost_cache_read"
+]);
+var OPTIONAL_STRING_FIELDS = Object.freeze(["step", "slice_id", "source", "operation", "provider", "model", "request_id", "cost_currency"]);
+var NUMERIC_FIELDS = Object.freeze([...USAGE_NUMERIC_FIELDS, ...COST_NUMERIC_FIELDS]);
+var STATUS_SET = new Set(COST_ATTRIBUTION_STATUSES);
+var TERMINAL_CONTROL_PATTERN = /[\u0000-\u001F\u007F-\u009F]/gu;
+function publicCostAttributionSummary(runOrAttribution) {
+  const attribution = runOrAttribution?.cost_attribution || runOrAttribution;
+  const totals = isRecord(attribution?.totals) ? attribution.totals : rollupEntries(Array.isArray(attribution?.entries) ? attribution.entries : []);
+  const status = safeCostStatus(attribution?.status) || safeCostStatus(totals.status) || "unavailable";
+  const summary = {
+    schema_version: COST_ATTRIBUTION_SCHEMA_VERSION,
+    updated_at: attribution?.updated_at === void 0 || attribution?.updated_at === null ? null : sanitizePublicCostText(attribution.updated_at),
+    status,
+    entry_count: totals.entry_count || 0,
+    agent_count: isRecord(attribution?.by_agent) ? Object.keys(attribution.by_agent).length : 0,
+    slice_count: isRecord(attribution?.by_slice) ? Object.keys(attribution.by_slice).length : 0,
+    mixed_currency: totals.mixed_currency === true,
+    missing: Array.isArray(totals.missing) ? totals.missing.map((item) => sanitizePublicCostText(item)).filter(Boolean) : []
+  };
+  for (const field of USAGE_NUMERIC_FIELDS) if (totals[field] !== void 0) summary[field] = totals[field];
+  if (totals.cost_total !== void 0) summary.cost_total = totals.cost_total;
+  const currency = safeCostCurrency(totals.cost_currency);
+  if (currency) summary.cost_currency = currency;
+  return summary;
+}
+function isSafeCostCurrency(value) {
+  return safeCostCurrency(value) !== null;
+}
+function hasTerminalControl(value) {
+  TERMINAL_CONTROL_PATTERN.lastIndex = 0;
+  return typeof value === "string" && TERMINAL_CONTROL_PATTERN.test(value);
+}
+function sanitizePublicCostText(value) {
+  return String(value).replace(/[\t\r\n]+/gu, " ").replace(TERMINAL_CONTROL_PATTERN, "").replace(/\s+/gu, " ").trim();
+}
+function rollupEntries(entries) {
+  const rollup = {
+    status: "unavailable",
+    entry_count: entries.length,
+    request_count: entries.length
+  };
+  const missing = /* @__PURE__ */ new Set();
+  const costCurrencies = /* @__PURE__ */ new Set();
+  const totalCurrencies = /* @__PURE__ */ new Set();
+  let availableEntries = 0;
+  let partial = entries.length === 0;
+  for (const entry of entries) {
+    if (entry.status === "available") availableEntries += 1;
+    if (entry.status !== "available") partial = true;
+    for (const item of Array.isArray(entry.missing) ? entry.missing : []) missing.add(item);
+    for (const field of NUMERIC_FIELDS) {
+      if (entry[field] === void 0 || entry[field] === null) continue;
+      const aggregate = (rollup[field] ?? 0) + entry[field];
+      if (!Number.isFinite(aggregate)) throw new Error(`cost attribution aggregate overflow for ${field}`);
+      rollup[field] = aggregate;
+      if (COST_NUMERIC_FIELDS.includes(field)) {
+        const currency = safeCostCurrency(entry.cost_currency);
+        if (currency) {
+          costCurrencies.add(currency);
+          if (field === "cost_total") totalCurrencies.add(currency);
+        } else {
+          missing.add("cost_currency");
+          partial = true;
+        }
+      }
+    }
+  }
+  if (totalCurrencies.size === 1) rollup.cost_currency = [...totalCurrencies][0];
+  const hasMixedCurrency = costCurrencies.size > 1;
+  if (hasMixedCurrency) {
+    delete rollup.cost_total;
+    delete rollup.cost_currency;
+    missing.add("mixed_currency");
+    partial = true;
+  }
+  if (availableEntries === entries.length && entries.length > 0 && !partial) rollup.status = "available";
+  else if (entries.some((entry) => entry.status === "available" || entry.status === "partial")) rollup.status = "partial";
+  else rollup.status = "unavailable";
+  rollup.mixed_currency = hasMixedCurrency;
+  rollup.missing = entries.length === 0 ? ["entries"] : [...missing].sort();
+  return canonicalRollup(rollup);
+}
+function canonicalRollup(rollup) {
+  const ordered = {
+    status: rollup.status,
+    entry_count: rollup.entry_count,
+    request_count: rollup.request_count
+  };
+  for (const field of NUMERIC_FIELDS) {
+    if (Object.prototype.hasOwnProperty.call(rollup, field)) ordered[field] = rollup[field];
+  }
+  if (Object.prototype.hasOwnProperty.call(rollup, "cost_currency")) ordered.cost_currency = rollup.cost_currency;
+  ordered.mixed_currency = rollup.mixed_currency;
+  ordered.missing = rollup.missing;
+  return ordered;
+}
+function safeCostCurrency(value) {
+  const text = nonEmptyString(value);
+  return text && COST_CURRENCY_PATTERN.test(text) && !hasTerminalControl(text) ? text : null;
+}
+function safeCostStatus(value) {
+  return typeof value === "string" && STATUS_SET.has(value) ? value : null;
+}
+function nonEmptyString(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/factory-diagnostics.js
+import { existsSync as existsSync2, readFileSync, statSync } from "node:fs";
+import { dirname as dirname3, isAbsolute as isAbsolute3, join as join5, resolve as resolve4 } from "node:path";
+
+// src/validate.js
+import { join as join4, relative as relative2, resolve as resolve3, sep as sep3 } from "node:path";
+
+// src/env-snapshot.js
+import { dirname as dirname2, join as join2 } from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
+
+// src/utils.js
+import { existsSync, realpathSync } from "node:fs";
+import { isAbsolute, relative, resolve, sep } from "node:path";
+function requireNonEmptyString(value, label) {
+  if (typeof value !== "string" || value.trim() === "") throw new Error(`${label} must be a non-empty string`);
+  return value.trim();
+}
+function timestamp(value, label = "timestamp") {
+  if (value === void 0 || value === null) return (/* @__PURE__ */ new Date()).toISOString();
+  const parsed = typeof value === "number" ? value : value instanceof Date ? value.getTime() : Date.parse(value);
+  if (!Number.isFinite(parsed)) throw new Error(`invalid ${label}`);
+  return new Date(parsed).toISOString();
+}
+function physicalPath(path, label = "path", options = {}) {
+  const resolved = resolve(requireNonEmptyString(path, label));
+  if (!existsSync(resolved)) {
+    if (options.mustExist) throw new Error(`${label} is unresolvable: ${resolved}`);
+    return resolved;
+  }
+  return realpathSync.native(resolved);
+}
+
+// src/git.js
+var DEFAULT_GIT_MAX_BUFFER = 1024 * 1024;
+var MAX_GIT_MAX_BUFFER = 8 * 1024 * 1024;
+
+// src/plugin.js
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// src/config.js
+import { parse, printParseErrorCode } from "jsonc-parser";
+var POST_PR_CI_DEFAULTS = Object.freeze({
+  enabled: false,
+  wait_ms: 36e5,
+  initial_poll_ms: 3e4,
+  max_poll_ms: 12e4,
+  check_start_grace_ms: 3e5,
+  max_transient_errors: 12
+});
+
+// src/plugin.js
+var root = dirname(dirname(fileURLToPath(import.meta.url)));
+var assets = join(root, "assets");
+
+// src/env-snapshot.js
+var root2 = dirname2(dirname2(fileURLToPath2(import.meta.url)));
+var SENSITIVE_ENV_KEY_PATTERN = /(?:secret|token|password|passwd|pwd|api[_-]?key|private[_-]?key|credential|authorization|auth[_-]?header|access[_-]?key|bearer|cookie)/iu;
+var SENSITIVE_ENV_VALUE_PATTERN = /(?:secret|token|password|passwd|api[_-]?key|private[_-]?key)/iu;
+var TOKEN_SHAPED_ENV_VALUE_PATTERNS = [
+  /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/u,
+  /\bgithub_pat_[A-Za-z0-9_]{20,}\b/u,
+  /\bhc_[A-Za-z0-9][A-Za-z0-9_-]{10,}\b/iu,
+  /\bsk-proj[-_][A-Za-z0-9_-]{20,}\b/u,
+  /\bsk-[A-Za-z0-9_-]{20,}\b/u,
+  /\bxox[abp][_-][A-Za-z0-9-]{10,}(?:-[A-Za-z0-9-]{10,})*\b/u,
+  /\bglpat-[A-Za-z0-9_-]{20,}\b/u,
+  /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}\b/iu,
+  /\beyJ[A-Za-z0-9_-]{7,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/u,
+  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/u,
+  /(?:^|[^A-Za-z0-9-])(?:[A-Fa-f0-9]{32,})(?=$|[^A-Za-z0-9-])/u,
+  /(?:https?|ssh|git|ftp):\/\/[^/\s:@]+:[^/\s@]+@/iu
+];
+var HIGH_ENTROPY_SINGLE_TOKEN_MIN_LENGTH = 32;
+var HIGH_ENTROPY_MIN_SHANNON = 3.5;
+var SAFE_HIGH_ENTROPY_ENV_KEY_PATTERN = /^(?:OTEL_EXPORTER_OTLP(?:_(?:TRACES|METRICS|LOGS))?_(?:ENDPOINT|HEADERS|PROTOCOL|TIMEOUT|COMPRESSION|INSECURE|CERTIFICATE)|FEATURE_FACTORY_OTEL_ENABLED)$/u;
+var REDACTED_ENV_VALUE = "[redacted]";
+function isSensitiveEnvKey(key) {
+  const string = String(key ?? "");
+  return SENSITIVE_ENV_KEY_PATTERN.test(string) || isSecretShapedEnvKey(string);
+}
+function isSensitiveEnvValue(value) {
+  if (typeof value !== "string") return false;
+  const trimmed = value.trim();
+  if (!trimmed) return false;
+  return SENSITIVE_ENV_VALUE_PATTERN.test(trimmed) || TOKEN_SHAPED_ENV_VALUE_PATTERNS.some((pattern) => pattern.test(trimmed)) || credentialBearingUrl(trimmed) || highEntropySingleToken(trimmed);
+}
+function isSecretShapedEnvKey(key) {
+  const trimmed = String(key ?? "").trim();
+  if (!trimmed) return false;
+  return TOKEN_SHAPED_ENV_VALUE_PATTERNS.some((pattern) => pattern.test(trimmed)) || credentialBearingUrl(trimmed) || highEntropySecretKey(trimmed);
+}
+function credentialBearingUrl(value) {
+  try {
+    const parsed = new URL(value);
+    return Boolean(parsed.username || parsed.password);
+  } catch {
+    return false;
+  }
+}
+function highEntropySingleToken(value) {
+  if (value.length < HIGH_ENTROPY_SINGLE_TOKEN_MIN_LENGTH) return false;
+  if (/\s/u.test(value)) return false;
+  if (!/^[A-Za-z0-9._~+/=-]+$/u.test(value)) return false;
+  return shannonEntropy(value) >= HIGH_ENTROPY_MIN_SHANNON;
+}
+function highEntropySecretKey(value) {
+  if (SAFE_HIGH_ENTROPY_ENV_KEY_PATTERN.test(value)) return false;
+  return highEntropySingleToken(value);
+}
+function shannonEntropy(value) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const char of value) counts.set(char, (counts.get(char) || 0) + 1);
+  return [...counts.values()].reduce((entropy, count) => {
+    const probability = count / value.length;
+    return entropy - probability * Math.log2(probability);
+  }, 0);
+}
+
+// src/process-evidence.js
+import { basename, isAbsolute as isAbsolute2, join as join3, normalize, resolve as resolve2, sep as sep2 } from "node:path";
+
+// src/hardening/atomic-write.js
+var ERROR_MESSAGES = Object.freeze({
+  INVALID_ROOT: "protected file root is invalid",
+  UNTRUSTED_ROOT: "protected file root is not trusted",
+  INVALID_PATH: "protected relative path is invalid",
+  INVALID_OPTIONS: "protected file options are invalid",
+  PARENT_MISSING: "protected file parent is missing",
+  PARENT_TYPE: "protected file parent has an unsafe type",
+  PARENT_CHANGED: "protected file parent changed during the operation",
+  TARGET_TYPE: "protected file target has an unsafe type",
+  TARGET_CHANGED: "protected file target changed during the operation",
+  TARGET_EXISTS: "protected file target already exists",
+  TEMP_COLLISION: "protected temporary file name collisions exceeded the limit",
+  TEMP_OPEN_FAILED: "protected temporary file could not be opened",
+  TEMP_TYPE: "protected temporary file has an unsafe type",
+  TEMP_CHANGED: "protected temporary file changed during the operation",
+  WRITE_FAILED: "protected file write failed",
+  CLOSE_FAILED: "protected file close failed",
+  COMMIT_FAILED: "protected file commit failed",
+  CROSS_DEVICE: "protected file commit crossed filesystem devices",
+  LINK_UNSUPPORTED: "protected create-only publication is unsupported",
+  CLEANUP_INDETERMINATE: "protected temporary file cleanup is indeterminate",
+  DIRECTORY_CREATE_FAILED: "protected directory could not be created",
+  APPEND_UNSUPPORTED: "protected no-follow append is unsupported",
+  APPEND_OPEN_FAILED: "protected append file could not be opened"
+});
+
+// src/hardening/process-verification.js
+function normalizeLegacyBooleanLiveness(value) {
+  if (value === true) return "live";
+  if (value === false) return "absent";
+  return "indeterminate";
+}
+function probeLegacyBooleanLiveness(callback, ...args) {
+  if (typeof callback !== "function") return "indeterminate";
+  try {
+    return normalizeLegacyBooleanLiveness(callback(...args));
+  } catch {
+    return "indeterminate";
+  }
+}
+function publicLivenessBoolean(status) {
+  if (status === "live") return true;
+  if (status === "absent") return false;
+  return null;
+}
+var DEFAULT_COMMAND_MAX_BUFFER = 1024 * 1024;
+var DARWIN_WEEKDAYS = Object.freeze(["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"]);
+var DARWIN_MONTHS = Object.freeze(["Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"]);
+var PROCESS_VERIFICATION_CODES = Object.freeze({
+  INVALID_PID: "INVALID_PID",
+  INVALID_OPTIONS: "INVALID_OPTIONS",
+  LIVENESS_LIVE: "LIVENESS_LIVE",
+  LIVENESS_ABSENT: "LIVENESS_ABSENT",
+  LIVENESS_PERMISSION_DENIED: "LIVENESS_PERMISSION_DENIED",
+  LIVENESS_FAILED: "LIVENESS_FAILED",
+  LIVENESS_RESULT_MALFORMED: "LIVENESS_RESULT_MALFORMED",
+  PLATFORM_UNSUPPORTED: "PLATFORM_UNSUPPORTED",
+  METADATA_UNAVAILABLE: "METADATA_UNAVAILABLE",
+  METADATA_MALFORMED: "METADATA_MALFORMED",
+  INSPECTION_TIMEOUT: "INSPECTION_TIMEOUT",
+  IDENTITY_LIVE: "IDENTITY_LIVE",
+  IDENTITY_INVALID: "IDENTITY_INVALID",
+  IDENTITY_MATCH: "IDENTITY_MATCH",
+  IDENTITY_MISMATCH: "IDENTITY_MISMATCH",
+  SIGNAL_INVALID: "SIGNAL_INVALID",
+  SIGNAL_NOT_AUTHORIZED: "SIGNAL_NOT_AUTHORIZED",
+  SIGNAL_SENT: "SIGNAL_SENT",
+  SIGNAL_FAILED: "SIGNAL_FAILED",
+  POST_SIGNAL_NOT_CHECKED: "POST_SIGNAL_NOT_CHECKED",
+  POST_SIGNAL_ABSENT: "POST_SIGNAL_ABSENT",
+  POST_SIGNAL_LIVE: "POST_SIGNAL_LIVE",
+  POST_SIGNAL_MISMATCH: "POST_SIGNAL_MISMATCH",
+  POST_SIGNAL_INDETERMINATE: "POST_SIGNAL_INDETERMINATE"
+});
+var REASONS = Object.freeze({
+  INVALID_PID: "process pid must be a positive integer",
+  INVALID_OPTIONS: "process verification options are invalid",
+  LIVENESS_LIVE: "process is live",
+  LIVENESS_ABSENT: "process is absent",
+  LIVENESS_PERMISSION_DENIED: "process liveness is indeterminate because permission was denied",
+  LIVENESS_FAILED: "process liveness could not be determined",
+  LIVENESS_RESULT_MALFORMED: "process liveness probe returned a malformed result",
+  PLATFORM_UNSUPPORTED: "process identity inspection is unsupported on this platform",
+  METADATA_UNAVAILABLE: "process identity metadata could not be inspected",
+  METADATA_MALFORMED: "process identity metadata is malformed",
+  INSPECTION_TIMEOUT: "process identity inspection timed out",
+  IDENTITY_LIVE: "process identity is live",
+  IDENTITY_INVALID: "expected process identity is invalid",
+  IDENTITY_MATCH: "process identity matches expected identity",
+  IDENTITY_MISMATCH: "process identity does not match expected identity",
+  SIGNAL_INVALID: "only SIGTERM may be sent by verified process signaling",
+  SIGNAL_NOT_AUTHORIZED: "process signal was not authorized by identity verification",
+  SIGNAL_SENT: "SIGTERM was sent to the verified process",
+  SIGNAL_FAILED: "SIGTERM could not be sent to the verified process",
+  POST_SIGNAL_NOT_CHECKED: "process state was not checked after SIGTERM",
+  POST_SIGNAL_ABSENT: "process absence was confirmed after SIGTERM",
+  POST_SIGNAL_LIVE: "the matching process remains live after SIGTERM",
+  POST_SIGNAL_MISMATCH: "a different process identity was observed after SIGTERM",
+  POST_SIGNAL_INDETERMINATE: "process state is indeterminate after SIGTERM"
+});
+function probeProcessLiveness(pid, options = {}) {
+  if (!positivePid(pid)) return result("indeterminate", "INVALID_PID", pid);
+  const injectedProbe = firstFunction(options.livenessProbe, options.livenessProbeFn, options.processLivenessProbe);
+  if (injectedProbe) {
+    try {
+      return normalizeLivenessResult(injectedProbe(pid), pid);
+    } catch (error) {
+      return livenessErrorResult(error, pid);
+    }
+  }
+  try {
+    process.kill(pid, 0);
+    return result("live", "LIVENESS_LIVE", pid);
+  } catch (error) {
+    return livenessErrorResult(error, pid);
+  }
+}
+function normalizeLivenessResult(value, pid) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return result("indeterminate", "LIVENESS_RESULT_MALFORMED", pid);
+  }
+  if (value.status === "live") return result("live", "LIVENESS_LIVE", pid);
+  if (value.status === "absent") return result("absent", "LIVENESS_ABSENT", pid);
+  if (value.status === "indeterminate") return result("indeterminate", "LIVENESS_FAILED", pid);
+  return result("indeterminate", "LIVENESS_RESULT_MALFORMED", pid);
+}
+function livenessErrorResult(error, pid) {
+  if (error?.code === "ESRCH") return result("absent", "LIVENESS_ABSENT", pid);
+  if (error?.code === "EPERM" || error?.code === "EACCES") {
+    return result("indeterminate", "LIVENESS_PERMISSION_DENIED", pid);
+  }
+  return result("indeterminate", "LIVENESS_FAILED", pid);
+}
+function positivePid(value) {
+  return Number.isSafeInteger(value) && value > 0;
+}
+function firstFunction(...values) {
+  return values.find((value) => typeof value === "function") || null;
+}
+function result(status, code, pid, extra = {}) {
+  return { status, code: PROCESS_VERIFICATION_CODES[code], reason: REASONS[code], pid, ...extra };
+}
+
+// src/process-evidence.js
+var PROCESS_EVIDENCE_FILE = "process.json";
+var PROCESS_EVIDENCE_KIND = "opencode-process";
+var PROCESS_EVIDENCE_SCHEMA_VERSION = 1;
+var LAUNCH_CLAIM_DIR = "process-launch.lock";
+var LAUNCH_CLAIM_FILE = "owner.json";
+var LAUNCH_CLAIM_REF = `${LAUNCH_CLAIM_DIR}/${LAUNCH_CLAIM_FILE}`;
+var LAUNCH_CLAIM_PHASES = Object.freeze(["foreground-live", "predecessor-active", "predecessor-released", "spawning"]);
+var LAUNCH_KINDS = Object.freeze(["approval-handoff", "resume-foreground", "resume-detached", "start-resume-foreground", "start-resume-detached"]);
+var PROCESS_STATES = /* @__PURE__ */ new Set(["running", "cancelled", "failed-closed", "exited"]);
+var LAUNCH_PHASE_SET = new Set(LAUNCH_CLAIM_PHASES);
+var LAUNCH_KIND_SET = new Set(LAUNCH_KINDS);
+function processEvidenceProcessesDir(runDir) {
+  return join3(resolve2(runDir), "processes");
+}
+function validateProcessEvidence(evidence, opts = {}) {
+  const errors = [];
+  if (!plainObject(evidence)) return invalid("process evidence must be a JSON object");
+  if (evidence.schema_version !== PROCESS_EVIDENCE_SCHEMA_VERSION) errors.push("schema_version must be 1");
+  if (evidence.kind !== PROCESS_EVIDENCE_KIND) errors.push("kind must be opencode-process");
+  if (!nonEmptyString2(evidence.run_id)) errors.push("run_id must be a non-empty string");
+  if (nonEmptyString2(opts.runId) && evidence.run_id !== opts.runId) errors.push("run_id must match requested run");
+  if (!nonEmptyString2(evidence.execution_id)) errors.push("execution_id must be a non-empty string");
+  if (!positivePid2(evidence.pid)) errors.push("pid must be a positive integer");
+  if (!validTimestamp(evidence.started_at)) errors.push("started_at must be an ISO timestamp");
+  if (!validTimestamp(evidence.updated_at)) errors.push("updated_at must be an ISO timestamp");
+  if (!PROCESS_STATES.has(evidence.state)) errors.push("state must be one of running, cancelled, failed-closed, exited");
+  if (!nonEmptyString2(evidence.cwd) || !isAbsolute2(evidence.cwd)) errors.push("cwd must be an absolute path");
+  if (!plainObject(evidence.identity)) {
+    errors.push("identity must be an object");
+  } else {
+    if (!nonEmptyString2(evidence.identity.inspector)) errors.push("identity.inspector must be a non-empty string");
+    if (!nonEmptyString2(evidence.identity.start_marker)) errors.push("identity.start_marker must be a non-empty string");
+    else if (String(evidence.identity.start_marker).startsWith("unverified:")) errors.push("identity.start_marker must be verifiable process evidence");
+    if (!nonEmptyString2(evidence.identity.command_name)) errors.push("identity.command_name must be a non-empty string");
+  }
+  if (!validProcessLogRef(evidence.log_ref)) errors.push("log_ref must stay under processes/");
+  if (!(evidence.cancel === null || plainObject(evidence.cancel))) errors.push("cancel must be null or an object");
+  if (errors.length) return invalid(`invalid process evidence: ${errors.join("; ")}`);
+  return { ok: true, reason: null, evidence };
+}
+function validProcessLogRef(ref) {
+  if (!nonEmptyString2(ref) || isAbsolute2(ref) || ref.includes("\\") || ref.includes("\0")) return false;
+  const normalized = normalize(ref).replaceAll(sep2, "/");
+  if (normalized === "." || normalized.startsWith("../") || normalized === "..") return false;
+  if (!normalized.startsWith("processes/")) return false;
+  return basename(normalized).length > 0 && normalized !== "processes";
+}
+function positivePid2(value) {
+  return Number.isInteger(value) && value > 0;
+}
+function plainObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value);
+}
+function nonEmptyString2(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function validTimestamp(value) {
+  return nonEmptyString2(value) && Number.isFinite(Date.parse(value));
+}
+function invalid(reason) {
+  return { ok: false, reason, evidence: null };
+}
+
+// src/refs.js
+import { createHash } from "node:crypto";
+var DURABLE_ROOTS = Object.freeze(["artifacts", "evidence", "reviews", "gates", "steering"]);
+function hashValue(value) {
+  return `sha256:${createHash("sha256").update(canonicalJson(value), "utf8").digest("hex")}`;
+}
+function canonicalJson(value) {
+  if (value === null || typeof value !== "object") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(",")}]`;
+  return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(",")}}`;
+}
+
+// src/validate.js
+var TERMINAL_RUN_STATUSES = Object.freeze(["completed", "blocked", "partial", "needs-human"]);
+var HEARTBEAT_PHASES = Object.freeze([
+  "spec-review",
+  "decomposition-review",
+  "builder-wave",
+  "slice-review",
+  "test-verifier",
+  "test-rerun",
+  "test-review",
+  "implementation-validator",
+  "security-reviewer",
+  "remediation",
+  "post-pr-observation",
+  "post-pr-remediation",
+  "post-pr-revalidation"
+]);
+var HEARTBEAT_PROTECTED_GATES = Object.freeze(["story", "brief", "pre_pr"]);
+var MAX_SLICE_DEPENDENCY_WAVES = 3;
+var RUN_STATUSES = /* @__PURE__ */ new Set(["running", ...TERMINAL_RUN_STATUSES]);
+var TERMINAL_STATUSES = new Set(TERMINAL_RUN_STATUSES);
+var RUN_MODES = /* @__PURE__ */ new Set(["interactive", "headless", "autonomous"]);
+var PR_MODES = /* @__PURE__ */ new Set(["draft", "ready"]);
+var GATE_STATUSES = /* @__PURE__ */ new Set(["pending", "approved", "changes_requested", "stopped"]);
+var APPROVAL_SOURCES = /* @__PURE__ */ new Set(["human", "external-driver", "autonomous", "override"]);
+var SAFE_GATE_NAME_PATTERN = /^[a-z0-9](?:[a-z0-9_-]*[a-z0-9])?$/u;
+var SLICE_STATUSES = /* @__PURE__ */ new Set(["pending", "running", "review", "merged", "blocked"]);
+var STEP_STATUSES = /* @__PURE__ */ new Set(["running", "accepted", "rejected", "blocked"]);
+var VALIDATOR_VERDICTS = /* @__PURE__ */ new Set(["GO", "GO-WITH-NITS", "NO-GO"]);
+var PASSING_VALIDATOR_VERDICTS = /* @__PURE__ */ new Set(["GO", "GO-WITH-NITS"]);
+var SECURITY_VERDICTS = /* @__PURE__ */ new Set(["PASS", "BLOCK"]);
+var PASSING_SECURITY_VERDICTS = /* @__PURE__ */ new Set(["PASS"]);
+var CONTINUATION_KINDS = /* @__PURE__ */ new Set(["blocked-run-continuation"]);
+var BLOCKED_CONTINUATION_PARENT_STATUSES = /* @__PURE__ */ new Set(["blocked"]);
+var HASH_PATTERN = /^sha256:[0-9a-f]{64}$/u;
+var HANDOFF_RECEIPT_KIND = "interactive-approval-handoff";
+var DEBUG_SNAPSHOT_KEYS = /* @__PURE__ */ new Set(["created_with", "last_resumed_with", "resume_count"]);
+var DEBUG_SNAPSHOT_EVENT_KEYS = /* @__PURE__ */ new Set(["collected_at", "event", "diagnostic_only", "env"]);
+var COST_ATTRIBUTION_STATUS_SET = new Set(COST_ATTRIBUTION_STATUSES);
+var COST_ATTRIBUTION_ENTRY_OPTIONAL_STRINGS = /* @__PURE__ */ new Set(["step", "slice_id", "source", "operation", "provider", "model", "request_id", "cost_currency"]);
+var COST_ATTRIBUTION_NUMERIC_FIELDS = /* @__PURE__ */ new Set([...USAGE_NUMERIC_FIELDS, ...COST_NUMERIC_FIELDS]);
+var POST_PR_PHASES = Object.freeze(["disabled", "awaiting-pr", "observing", "failure-recording", "remediation-planned", "remediation-running", "changes-observed", "committed", "revalidating", "validated", "push-pending", "remote-confirmed", "succeeded", "blocked", "needs-human"]);
+var POST_PR_TERMINAL_REASONS = Object.freeze({
+  completed: ["post-pr-ci-green", "post-pr-draft-ci-green", "post-pr-external-merge"],
+  blocked: ["post-pr-retry-exhausted", "post-pr-observation-timeout", "post-pr-observer-infrastructure", "post-pr-pr-closed"],
+  "needs-human": ["post-pr-review-changes-requested", "post-pr-owner-ambiguous", "post-pr-account-switch-failed", "post-pr-head-mismatch", "post-pr-dispatch-start-unknown", "post-pr-path-lane-violation", "post-pr-remote-head-diverged", "post-pr-metadata-unsafe", "post-pr-push-failed", "post-pr-panel-attribution-unsafe"]
+});
+var POST_PR_PHASE_SET = new Set(POST_PR_PHASES);
+var POST_PR_ACTIVE_PHASES = new Set(POST_PR_PHASES.filter((phase) => !["disabled", "awaiting-pr", "succeeded", "blocked", "needs-human"].includes(phase)));
+var FULL_GIT_SHA_PATTERN = /^[0-9a-f]{40}$/u;
+var ValidationError = class extends Error {
+  constructor(errors) {
+    const safeErrors = errors.map((item) => ({
+      ...item,
+      path: safeValidationText(item.path),
+      message: safeValidationText(item.message)
+    }));
+    super(safeErrors.map((item) => `${item.path}: ${item.message}`).join("; "));
+    this.name = "ValidationError";
+    this.errors = safeErrors;
+  }
+};
+function validateRun(run) {
+  const errors = [];
+  if (!isRecord2(run)) return fail([{ path: "run", message: "must be an object" }]);
+  requiredString(errors, run, "run_id", "run.run_id");
+  optionalNumber(errors, run, "schema_version", "run.schema_version");
+  optionalEnum(errors, run, "mode", RUN_MODES, "run.mode");
+  requiredEnum(errors, run, "status", RUN_STATUSES, "run.status");
+  optionalString(errors, run, "created_at", "run.created_at");
+  optionalString(errors, run, "updated_at", "run.updated_at");
+  optionalString(errors, run, "heartbeat_at", "run.heartbeat_at");
+  optionalString(errors, run, "base_ref", "run.base_ref");
+  optionalString(errors, run, "base_commit", "run.base_commit");
+  optionalString(errors, run, "branch", "run.branch");
+  optionalString(errors, run, "worktree", "run.worktree");
+  optionalNonEmptyString(errors, run, "github_account", "run.github_account");
+  optionalEnum(errors, run, "pr_mode", PR_MODES, "run.pr_mode");
+  optionalString(errors, run, "pr_url", "run.pr_url");
+  optionalInteger(errors, run, "max_parallel_slices", "run.max_parallel_slices");
+  optionalInteger(errors, run, "max_retries", "run.max_retries");
+  optionalNonEmptyString(errors, run, "review_tier", "run.review_tier");
+  validateDebugSnapshot(errors, run.debug_snapshot, "run.debug_snapshot");
+  validateContinuation(errors, run, "run.continuation");
+  validateSteering(errors, run.steering, "run.steering");
+  validatePostPr(errors, run, "run.post_pr");
+  validateGateMap(errors, run.gates, "run.gates");
+  validateRunSlices(errors, run.slices, "run.slices");
+  validateCostAttribution(errors, run.cost_attribution, "run.cost_attribution", run);
+  validateSteps(errors, run.steps, "run.steps");
+  validateVerdict(errors, run.validator, "run.validator", VALIDATOR_VERDICTS);
+  validateVerdict(errors, run.security_review, "run.security_review", SECURITY_VERDICTS);
+  validateTerminalResult(errors, run, "run.terminal_result");
+  if (errors.length) fail(errors);
+  return run;
+}
+function validateSlicesPlan(plan, { enforceDependencyDepth = true } = {}) {
+  const errors = [];
+  if (!isRecord2(plan)) return fail([{ path: "plan", message: "must be an object" }]);
+  if (!Array.isArray(plan.slices)) errors.push({ path: "plan.slices", message: "must be an array" });
+  else validatePlannedSlices(errors, plan.slices, "plan.slices", { enforceDependencyDepth });
+  if (errors.length) fail(errors);
+  return plan;
+}
+function runSlicesMatchPlan(run, plan) {
+  const runGraph = normalizeSliceGraph(run?.slices);
+  const planGraph = normalizeSliceGraph(plan?.slices);
+  if (!runGraph || !planGraph) return false;
+  if (runGraph.size === 0 || runGraph.size !== planGraph.size) return false;
+  for (const [id, deps] of runGraph) {
+    const planDeps = planGraph.get(id);
+    if (!planDeps || planDeps.length !== deps.length || planDeps.some((dep, index) => dep !== deps[index])) return false;
+  }
+  return true;
+}
+function normalizeSliceGraph(slices) {
+  if (!Array.isArray(slices)) return null;
+  const graph = /* @__PURE__ */ new Map();
+  for (const slice of slices) {
+    if (!isRecord2(slice) || !stringValue(slice.id)) return null;
+    const id = String(slice.id).trim();
+    if (graph.has(id)) return null;
+    const deps = Array.isArray(slice.depends_on) ? [...new Set(slice.depends_on.filter(stringValue).map((dep) => String(dep).trim()))].sort() : [];
+    graph.set(id, deps);
+  }
+  return graph;
+}
+function validateHeartbeatState(heartbeat) {
+  const errors = [];
+  if (!isRecord2(heartbeat)) return fail([{ path: "heartbeat", message: "must be an object" }]);
+  requiredInteger(errors, heartbeat, "schema_version", "heartbeat.schema_version");
+  requiredString(errors, heartbeat, "run_id", "heartbeat.run_id");
+  requiredString(errors, heartbeat, "phase", "heartbeat.phase");
+  optionalNullableInteger(errors, heartbeat, "pid", "heartbeat.pid");
+  requiredInteger(errors, heartbeat, "interval_ms", "heartbeat.interval_ms");
+  requiredString(errors, heartbeat, "last_tick_at", "heartbeat.last_tick_at");
+  if (errors.length) fail(errors);
+  return heartbeat;
+}
+function validateFactoryLock(factoryLock) {
+  const errors = [];
+  if (!isRecord2(factoryLock)) return fail([{ path: "factory_lock", message: "must be an object" }]);
+  requiredInteger(errors, factoryLock, "schema_version", "factory_lock.schema_version");
+  requiredString(errors, factoryLock, "run_id", "factory_lock.run_id");
+  optionalString(errors, factoryLock, "session_owner", "factory_lock.session_owner");
+  optionalString(errors, factoryLock, "updated_at", "factory_lock.updated_at");
+  if (errors.length) fail(errors);
+  return factoryLock;
+}
+function validateProcessSidecar(processSidecar, options = {}) {
+  const validation = validateProcessEvidence(processSidecar, { runDir: options.runDir, runId: options.runId });
+  if (!validation.ok) fail([{ path: "process", message: validation.reason }]);
+  const errors = [];
+  validateProcessLogRefContainment(errors, validation.evidence.log_ref, "process.log_ref", options.runDir);
+  if (errors.length) fail(errors);
+  return validation.evidence;
+}
+function pendingProtectedGate(run) {
+  if (!isRecord2(run) || !isRecord2(run.gates)) return null;
+  for (const gateName of HEARTBEAT_PROTECTED_GATES) if (isPendingGate(run.gates[gateName])) return gateName;
+  return null;
+}
+function validateGateMap(errors, gates, path) {
+  if (gates === void 0 || gates === null) return;
+  if (!isRecord2(gates)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  for (const [name, gate] of Object.entries(gates)) {
+    validateGateName(errors, name, `${path}.${name}`);
+    validateGate(errors, gate, `${path}.${name}`, name);
+  }
+}
+function validateDebugSnapshot(errors, snapshotRoot, path) {
+  if (snapshotRoot === void 0 || snapshotRoot === null) return;
+  if (!isRecord2(snapshotRoot)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  for (const key of Object.keys(snapshotRoot)) if (!DEBUG_SNAPSHOT_KEYS.has(key)) errors.push({ path: `${path}.${key}`, message: "is not allowed" });
+  validateDebugSnapshotEvent(errors, snapshotRoot.created_with, `${path}.created_with`);
+  if (snapshotRoot.last_resumed_with !== void 0 && snapshotRoot.last_resumed_with !== null) validateDebugSnapshotEvent(errors, snapshotRoot.last_resumed_with, `${path}.last_resumed_with`);
+  requiredInteger(errors, snapshotRoot, "resume_count", `${path}.resume_count`);
+}
+function validateDebugSnapshotEvent(errors, snapshot, path) {
+  if (!isRecord2(snapshot)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  for (const key of Object.keys(snapshot)) if (!DEBUG_SNAPSHOT_EVENT_KEYS.has(key)) errors.push({ path: `${path}.${key}`, message: "is not allowed" });
+  requiredString(errors, snapshot, "collected_at", `${path}.collected_at`);
+  requiredString(errors, snapshot, "event", `${path}.event`);
+  if (snapshot.diagnostic_only !== true) errors.push({ path: `${path}.diagnostic_only`, message: "must equal true" });
+  const payload = snapshot.env;
+  if (!isRecord2(payload)) {
+    errors.push({ path: `${path}.env`, message: "must be an object" });
+    return;
+  }
+  validateRedactedEnv(errors, payload, `${path}.env`);
+}
+function validateContinuation(errors, run, path) {
+  const continuation = run.continuation;
+  if (continuation === void 0 || continuation === null) return;
+  if (!isRecord2(continuation)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  requiredInteger(errors, continuation, "schema_version", `${path}.schema_version`);
+  if (Number.isInteger(continuation.schema_version) && continuation.schema_version !== 1) errors.push({ path: `${path}.schema_version`, message: "must equal 1" });
+  requiredEnum(errors, continuation, "kind", CONTINUATION_KINDS, `${path}.kind`);
+  requiredString(errors, continuation, "created_at", `${path}.created_at`);
+  requiredString(errors, continuation, "operator_summary", `${path}.operator_summary`);
+  validateContinuationParent(errors, continuation.parent, `${path}.parent`);
+  validateContinuationReview(errors, continuation.review, `${path}.review`);
+  validateContinuationTarget(errors, run, continuation.target, `${path}.target`);
+  validateContinuationRefHashArray(errors, continuation.parent_artifacts, `${path}.parent_artifacts`);
+  validateContinuationRefHashArray(errors, continuation.parent_evidence, `${path}.parent_evidence`);
+  validateContinuationRefHashArray(errors, continuation.parent_reviews, `${path}.parent_reviews`);
+  validateContinuationSelectedReview(errors, continuation, path);
+  validateContinuationPlanningReuse(errors, continuation.planning_reuse, `${path}.planning_reuse`);
+  validateContinuationPostPr(errors, continuation.post_pr, `${path}.post_pr`);
+}
+function validateContinuationPlanningReuse(errors, reuse, path) {
+  if (reuse === void 0 || reuse === null) return;
+  if (!isRecord2(reuse)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  if (typeof reuse.eligible !== "boolean") errors.push({ path: `${path}.eligible`, message: "must be a boolean" });
+  if (reuse.eligible === true) {
+    requiredString(errors, reuse, "spec_review_ref", `${path}.spec_review_ref`);
+    requiredHash(errors, reuse, "spec_review_hash", `${path}.spec_review_hash`);
+    requiredString(errors, reuse, "spec_artifact_ref", `${path}.spec_artifact_ref`);
+    requiredHash(errors, reuse, "spec_artifact_hash", `${path}.spec_artifact_hash`);
+  }
+}
+function validateContinuationPostPr(errors, value, path) {
+  if (value === void 0 || value === null) return;
+  if (!isRecord2(value)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  allowedKeys(errors, value, /* @__PURE__ */ new Set(["pr_url", "repository", "pr_number", "head_sha", "disposition", "policy", "post_pr_hash", "evidence_ref", "evidence_hash", "continuation_review_ref", "continuation_review_hash"]), path);
+  requiredString(errors, value, "pr_url", `${path}.pr_url`);
+  requiredString(errors, value, "repository", `${path}.repository`);
+  boundedInteger(errors, value, "pr_number", 1, Number.MAX_SAFE_INTEGER, `${path}.pr_number`);
+  requiredFullGitSha(errors, value, "head_sha", `${path}.head_sha`);
+  requiredEnum(errors, value, "disposition", /* @__PURE__ */ new Set(["leave-unchanged"]), `${path}.disposition`);
+  validatePostPrPolicy(errors, value.policy, `${path}.policy`);
+  for (const key of ["post_pr_hash", "evidence_hash", "continuation_review_hash"]) requiredHash(errors, value, key, `${path}.${key}`);
+  for (const key of ["evidence_ref", "continuation_review_ref"]) requiredString(errors, value, key, `${path}.${key}`);
+}
+function validatePostPr(errors, run, path) {
+  const value = run.post_pr;
+  if (value === void 0 || value === null) return;
+  if (!isRecord2(value)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  allowedKeys(errors, value, /* @__PURE__ */ new Set(["schema_version", "policy", "phase", "attempt", "observation", "remediation", "evidence_refs", "continuation_review", "terminal_fact"]), path);
+  requiredInteger(errors, value, "schema_version", `${path}.schema_version`);
+  if (value.schema_version !== 1) errors.push({ path: `${path}.schema_version`, message: "must equal 1" });
+  validatePostPrPolicy(errors, value.policy, `${path}.policy`);
+  requiredEnum(errors, value, "phase", POST_PR_PHASE_SET, `${path}.phase`);
+  requiredInteger(errors, value, "attempt", `${path}.attempt`);
+  if (Number.isInteger(value.attempt) && value.attempt < 0) errors.push({ path: `${path}.attempt`, message: "must be non-negative" });
+  if (Number.isInteger(value.attempt) && Number.isInteger(run.max_retries) && value.attempt > run.max_retries) errors.push({ path: `${path}.attempt`, message: "must not exceed run.max_retries" });
+  validatePostPrObservation(errors, value.observation, `${path}.observation`);
+  validatePostPrRemediation(errors, value.remediation, `${path}.remediation`);
+  validatePostPrRefHashArray(errors, value.evidence_refs, `${path}.evidence_refs`);
+  validatePostPrRefHash(errors, value.continuation_review, `${path}.continuation_review`, { optional: true });
+  validatePostPrTerminalFact(errors, run, value, `${path}.terminal_fact`);
+  const enabled = value.policy?.enabled === true;
+  if (!enabled && value.phase !== "disabled") errors.push({ path: `${path}.phase`, message: "disabled policy requires disabled phase" });
+  if (enabled && value.phase === "disabled") errors.push({ path: `${path}.phase`, message: "enabled policy cannot use disabled phase" });
+  if (enabled && POST_PR_ACTIVE_PHASES.has(value.phase)) {
+    if (run.status !== "running") errors.push({ path: "run.status", message: `must be running while post-PR phase is ${value.phase}` });
+    if (!stringValue(run.pr_url)) errors.push({ path: "run.pr_url", message: `is required while post-PR phase is ${value.phase}` });
+    if (run.terminal_result !== void 0 && run.terminal_result !== null) errors.push({ path: "run.terminal_result", message: "must be null during active post-PR state" });
+  }
+  if (["observing", "remote-confirmed", "succeeded"].includes(value.phase) && !isRecord2(value.observation)) errors.push({ path: `${path}.observation`, message: `is required for ${value.phase}` });
+  if (isRecord2(value.observation) && isRecord2(value.policy)) {
+    if (value.observation.current_interval_ms < value.policy.initial_poll_ms || value.observation.current_interval_ms > value.policy.max_poll_ms) errors.push({ path: `${path}.observation.current_interval_ms`, message: "must stay within persisted poll policy" });
+    if (value.observation.consecutive_transient_errors > value.policy.max_transient_errors) errors.push({ path: `${path}.observation.consecutive_transient_errors`, message: "must not exceed persisted transient error budget" });
+  }
+  if (["failure-recording", "remediation-planned", "remediation-running", "changes-observed", "committed", "revalidating", "validated", "push-pending", "remote-confirmed"].includes(value.phase) && !isRecord2(value.remediation)) errors.push({ path: `${path}.remediation`, message: `is required for ${value.phase}` });
+  if (isRecord2(value.remediation) && value.remediation.attempt !== value.attempt) errors.push({ path: `${path}.remediation.attempt`, message: "must equal run.post_pr.attempt" });
+  if (isRecord2(value.remediation)) {
+    const expectedStage = (/* @__PURE__ */ new Map([["remediation-planned", "planned"], ["remediation-running", "running"], ["changes-observed", "changes-observed"], ["committed", "committed"], ["revalidating", "revalidating"], ["validated", "validated"], ["push-pending", "push-pending"], ["remote-confirmed", "remote-confirmed"]])).get(value.phase);
+    if (expectedStage && value.remediation.stage !== expectedStage) errors.push({ path: `${path}.remediation.stage`, message: `must be ${expectedStage} while phase is ${value.phase}` });
+    const boundFailure = Array.isArray(value.evidence_refs) && value.evidence_refs.some((item) => item?.ref === value.remediation.failure_evidence_ref && item?.hash === value.remediation.failure_evidence_hash);
+    if (!boundFailure) errors.push({ path: `${path}.evidence_refs`, message: "must bind the current failure evidence ref/hash" });
+  }
+  if (isRecord2(value.continuation_review) && !(value.phase === "blocked" && run.terminal_result?.reason === "post-pr-retry-exhausted")) errors.push({ path: `${path}.continuation_review`, message: "is allowed only for retry exhaustion" });
+  validatePostPrTerminalConsistency(errors, run, value, path);
+}
+function validatePostPrTerminalFact(errors, run, postPr, path) {
+  const fact = postPr.terminal_fact;
+  const reason = run.terminal_result?.reason;
+  const expectedKinds = /* @__PURE__ */ new Map([
+    ["post-pr-account-switch-failed", "account-switch-failed"],
+    ["post-pr-dispatch-start-unknown", "dispatch-start-unknown"],
+    ["post-pr-path-lane-violation", "path-lane-violation"],
+    ["post-pr-remote-head-diverged", "remote-head-diverged"],
+    ["post-pr-push-failed", "push-failed"],
+    ["post-pr-panel-attribution-unsafe", "panel-attribution-unsafe"]
+  ]);
+  const expectedKind = expectedKinds.get(reason) || (reason === "post-pr-metadata-unsafe" && fact?.kind === "panel-runner-result-malformed" ? "panel-runner-result-malformed" : null);
+  if (fact === void 0 || fact === null) {
+    if (expectedKind) errors.push({ path, message: `is required for ${reason}` });
+    return;
+  }
+  if (!isRecord2(fact)) {
+    errors.push({ path, message: "must be an object or null" });
+    return;
+  }
+  if (!expectedKind) {
+    errors.push({ path, message: "is allowed only for fact-bound post-PR terminal reasons" });
+    return;
+  }
+  requiredInteger(errors, fact, "schema_version", `${path}.schema_version`);
+  if (fact.schema_version !== 1) errors.push({ path: `${path}.schema_version`, message: "must equal 1" });
+  requiredEnum(errors, fact, "kind", /* @__PURE__ */ new Set([expectedKind]), `${path}.kind`);
+  requiredString(errors, fact, "observed_at", `${path}.observed_at`);
+  if (!Number.isFinite(Date.parse(fact.observed_at || ""))) errors.push({ path: `${path}.observed_at`, message: "must be an ISO timestamp" });
+  const remediation = postPr.remediation;
+  if (expectedKind === "account-switch-failed") {
+    const pushPhase = fact.operation !== "gh-auth-switch";
+    allowedKeys(errors, fact, pushPhase ? /* @__PURE__ */ new Set(["schema_version", "kind", "observed_at", "attempt", "operation", "error_class", "exit_code", "classification", "error_count", "error_limit", "expected_remote_sha", "candidate_head_sha", "next_retry_at"]) : /* @__PURE__ */ new Set(["schema_version", "kind", "observed_at", "operation", "github_account", "error_class", "exit_code"]), path);
+    requiredEnum(errors, fact, "operation", pushPhase ? /* @__PURE__ */ new Set(["remote-head", "fast-forward-push", "remote-confirmation"]) : /* @__PURE__ */ new Set(["gh-auth-switch"]), `${path}.operation`);
+    requiredEnum(errors, fact, "error_class", /* @__PURE__ */ new Set(["account-auth", "permission", "not-found", "protocol", "command"]), `${path}.error_class`);
+    if (fact.exit_code !== null) boundedInteger(errors, fact, "exit_code", 0, 255, `${path}.exit_code`);
+    if (pushPhase) {
+      boundedInteger(errors, fact, "attempt", 1, Number.MAX_SAFE_INTEGER, `${path}.attempt`);
+      requiredEnum(errors, fact, "classification", /* @__PURE__ */ new Set(["permanent"]), `${path}.classification`);
+      boundedInteger(errors, fact, "error_count", 1, Number.MAX_SAFE_INTEGER, `${path}.error_count`);
+      boundedInteger(errors, fact, "error_limit", 1, Number.MAX_SAFE_INTEGER, `${path}.error_limit`);
+      for (const key of ["expected_remote_sha", "candidate_head_sha"]) requiredFullGitSha(errors, fact, key, `${path}.${key}`);
+      if (fact.next_retry_at !== null || fact.operation !== remediation?.push?.last_error?.operation) errors.push({ path, message: "must bind the persisted push account failure exactly" });
+    } else {
+      requiredString(errors, fact, "github_account", `${path}.github_account`);
+      if (fact.github_account !== run.github_account) errors.push({ path: `${path}.github_account`, message: "must match run.github_account" });
+      if (fact.error_class !== postPr.observation?.last_error?.class || fact.exit_code !== (postPr.observation?.last_error?.exit_code ?? null) || fact.observed_at !== postPr.observation?.last_error?.occurred_at) errors.push({ path, message: "must bind the persisted account-switch error exactly" });
+    }
+  } else if (expectedKind === "dispatch-start-unknown") {
+    allowedKeys(errors, fact, /* @__PURE__ */ new Set(["schema_version", "kind", "observed_at", "attempt", "activity", "dispatch_id", "dispatch_started_at", "candidate_head_sha", "outcome"]), path);
+    boundedInteger(errors, fact, "attempt", 1, Number.MAX_SAFE_INTEGER, `${path}.attempt`);
+    requiredString(errors, fact, "dispatch_id", `${path}.dispatch_id`);
+    requiredString(errors, fact, "dispatch_started_at", `${path}.dispatch_started_at`);
+    if (fact.activity !== void 0) requiredEnum(errors, fact, "activity", /* @__PURE__ */ new Set(["remediation", "canonical", "validator", "security"]), `${path}.activity`);
+    if (fact.candidate_head_sha !== void 0 && fact.candidate_head_sha !== null) requiredFullGitSha(errors, fact, "candidate_head_sha", `${path}.candidate_head_sha`);
+    requiredEnum(errors, fact, "outcome", /* @__PURE__ */ new Set(["return-unknown"]), `${path}.outcome`);
+    const dispatch = fact.activity && fact.activity !== "remediation" ? remediation?.revalidation?.jobs?.[fact.activity] : remediation?.dispatch;
+    const dispatchId = fact.activity && fact.activity !== "remediation" ? dispatch?.dispatch_id : dispatch?.id;
+    if (fact.attempt !== postPr.attempt || fact.dispatch_id !== dispatchId || fact.dispatch_started_at !== dispatch?.started_at || dispatch?.status !== "running") errors.push({ path, message: "must bind the running dispatch identity exactly" });
+  } else if (expectedKind === "path-lane-violation") {
+    allowedKeys(errors, fact, /* @__PURE__ */ new Set(["schema_version", "kind", "observed_at", "attempt", "lane", "source", "violation", "path_b64url", "changes_hash"]), path);
+    boundedInteger(errors, fact, "attempt", 1, Number.MAX_SAFE_INTEGER, `${path}.attempt`);
+    requiredEnum(errors, fact, "lane", /* @__PURE__ */ new Set(["slice", "test"]), `${path}.lane`);
+    requiredEnum(errors, fact, "source", /* @__PURE__ */ new Set(["remediation-diff"]), `${path}.source`);
+    requiredEnum(errors, fact, "violation", /* @__PURE__ */ new Set(["outside-lane", "unsafe-change-kind", "symlink-escape"]), `${path}.violation`);
+    requiredString(errors, fact, "path_b64url", `${path}.path_b64url`);
+    if (stringValue(fact.path_b64url) && !/^[A-Za-z0-9_-]+$/u.test(fact.path_b64url)) errors.push({ path: `${path}.path_b64url`, message: "must be canonical base64url" });
+    const decodedPath = decodeCanonicalBase64url(fact.path_b64url);
+    if (stringValue(fact.path_b64url) && decodedPath === null) errors.push({ path: `${path}.path_b64url`, message: "must encode valid UTF-8 path bytes canonically" });
+    requiredHash(errors, fact, "changes_hash", `${path}.changes_hash`);
+    if (fact.attempt !== postPr.attempt || fact.lane !== remediation?.lane || fact.changes_hash !== hashValueForValidation(remediation?.changes)) errors.push({ path, message: "must bind the remediation lane and changed paths exactly" });
+    if (decodedPath !== null && !remediation?.changes?.paths?.includes(decodedPath)) errors.push({ path: `${path}.path_b64url`, message: "must identify a persisted changed path" });
+  } else if (expectedKind === "remote-head-diverged") {
+    allowedKeys(errors, fact, /* @__PURE__ */ new Set(["schema_version", "kind", "observed_at", "attempt", "expected_remote_sha", "candidate_head_sha", "observed_remote_sha"]), path);
+    boundedInteger(errors, fact, "attempt", 1, Number.MAX_SAFE_INTEGER, `${path}.attempt`);
+    for (const key of ["expected_remote_sha", "candidate_head_sha", "observed_remote_sha"]) requiredFullGitSha(errors, fact, key, `${path}.${key}`);
+    if (fact.attempt !== postPr.attempt || fact.expected_remote_sha !== remediation?.push?.remote_before_sha || fact.candidate_head_sha !== remediation?.candidate_head_sha) errors.push({ path, message: "must bind the push-pending remote and candidate heads exactly" });
+    if (fact.observed_remote_sha === fact.expected_remote_sha || fact.observed_remote_sha === fact.candidate_head_sha) errors.push({ path: `${path}.observed_remote_sha`, message: "must differ from both expected remote and candidate heads" });
+  } else if (expectedKind === "panel-runner-result-malformed") {
+    allowedKeys(errors, fact, /* @__PURE__ */ new Set(["schema_version", "kind", "observed_at", "attempt", "activity", "dispatch_id", "candidate_head_sha", "issue"]), path);
+    boundedInteger(errors, fact, "attempt", 1, Number.MAX_SAFE_INTEGER, `${path}.attempt`);
+    requiredEnum(errors, fact, "activity", /* @__PURE__ */ new Set(["validator", "security"]), `${path}.activity`);
+    requiredString(errors, fact, "dispatch_id", `${path}.dispatch_id`);
+    requiredFullGitSha(errors, fact, "candidate_head_sha", `${path}.candidate_head_sha`);
+    requiredEnum(errors, fact, "issue", /* @__PURE__ */ new Set(["non-object", "missing-verdict", "unexpected-result-keys", "invalid-verdict"]), `${path}.issue`);
+    const job = remediation?.revalidation?.jobs?.[fact.activity];
+    if (fact.attempt !== postPr.attempt || fact.candidate_head_sha !== remediation?.candidate_head_sha || fact.dispatch_id !== job?.dispatch_id || job?.status !== "running") errors.push({ path, message: "must bind the running panel job exactly" });
+  } else if (expectedKind === "push-failed") {
+    allowedKeys(errors, fact, /* @__PURE__ */ new Set(["schema_version", "kind", "observed_at", "attempt", "operation", "error_class", "exit_code", "classification", "error_count", "error_limit", "expected_remote_sha", "candidate_head_sha", "next_retry_at"]), path);
+    boundedInteger(errors, fact, "attempt", 1, Number.MAX_SAFE_INTEGER, `${path}.attempt`);
+    requiredEnum(errors, fact, "operation", /* @__PURE__ */ new Set(["remote-head", "fast-forward-push", "remote-confirmation"]), `${path}.operation`);
+    requiredEnum(errors, fact, "error_class", /* @__PURE__ */ new Set(["timeout", "network", "rate-limit", "server", "account-auth", "permission", "not-found", "protocol", "command", "non-fast-forward"]), `${path}.error_class`);
+    if (fact.exit_code !== null) boundedInteger(errors, fact, "exit_code", 0, 255, `${path}.exit_code`);
+    requiredEnum(errors, fact, "classification", /* @__PURE__ */ new Set(["permanent", "exhausted"]), `${path}.classification`);
+    boundedInteger(errors, fact, "error_count", 1, Number.MAX_SAFE_INTEGER, `${path}.error_count`);
+    boundedInteger(errors, fact, "error_limit", 1, Number.MAX_SAFE_INTEGER, `${path}.error_limit`);
+    for (const key of ["expected_remote_sha", "candidate_head_sha"]) requiredFullGitSha(errors, fact, key, `${path}.${key}`);
+    if (fact.next_retry_at !== null) errors.push({ path: `${path}.next_retry_at`, message: "must be null for terminal push failures" });
+    if (fact.attempt !== postPr.attempt || fact.error_count !== remediation?.push?.consecutive_transient_errors || fact.error_limit !== postPr.policy?.max_transient_errors || fact.operation !== remediation?.push?.last_error?.operation) errors.push({ path, message: "must bind the persisted push failure exactly" });
+  } else if (expectedKind === "panel-attribution-unsafe") {
+    allowedKeys(errors, fact, /* @__PURE__ */ new Set(["schema_version", "kind", "observed_at", "attempt", "candidate_head_sha", "panel", "category", "affected_paths_hash"]), path);
+    boundedInteger(errors, fact, "attempt", 1, Number.MAX_SAFE_INTEGER, `${path}.attempt`);
+    requiredFullGitSha(errors, fact, "candidate_head_sha", `${path}.candidate_head_sha`);
+    requiredEnum(errors, fact, "panel", /* @__PURE__ */ new Set(["validator", "security", "combined"]), `${path}.panel`);
+    requiredEnum(errors, fact, "category", /* @__PURE__ */ new Set(["missing-paths", "invalid-paths", "empty-paths", "mixed-owner", "unowned-path", "owner-conflict", "security-block-without-slice-owner"]), `${path}.category`);
+    requiredBareSha256(errors, fact, "affected_paths_hash", `${path}.affected_paths_hash`);
+    if (fact.attempt !== postPr.attempt || fact.candidate_head_sha !== remediation?.candidate_head_sha) errors.push({ path, message: "must bind the current panel candidate exactly" });
+  }
+}
+function hashValueForValidation(value) {
+  return value === void 0 ? null : hashValue(value);
+}
+function requiredBareSha256(errors, object, key, path) {
+  if (typeof object?.[key] !== "string" || !/^[0-9a-f]{64}$/u.test(object[key])) errors.push({ path, message: "must be a bare lowercase SHA-256 digest" });
+}
+function decodeCanonicalBase64url(value) {
+  if (!stringValue(value) || !/^[A-Za-z0-9_-]+$/u.test(value)) return null;
+  const bytes = Buffer.from(value, "base64url");
+  const decoded = bytes.toString("utf8");
+  return Buffer.from(decoded, "utf8").toString("base64url") === value ? decoded : null;
+}
+function validatePostPrPolicy(errors, policy, path) {
+  if (!isRecord2(policy)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  allowedKeys(errors, policy, /* @__PURE__ */ new Set(["enabled", "wait_ms", "initial_poll_ms", "max_poll_ms", "check_start_grace_ms", "max_transient_errors", "review"]), path);
+  requiredBoolean(errors, policy, "enabled", `${path}.enabled`);
+  boundedInteger(errors, policy, "wait_ms", 18e5, 864e5, `${path}.wait_ms`);
+  boundedInteger(errors, policy, "initial_poll_ms", 15e3, 3e5, `${path}.initial_poll_ms`);
+  boundedInteger(errors, policy, "max_poll_ms", 15e3, 6e5, `${path}.max_poll_ms`);
+  boundedInteger(errors, policy, "check_start_grace_ms", 6e4, 9e5, `${path}.check_start_grace_ms`);
+  boundedInteger(errors, policy, "max_transient_errors", 1, 50, `${path}.max_transient_errors`);
+  if (Number.isInteger(policy.initial_poll_ms) && Number.isInteger(policy.max_poll_ms) && policy.max_poll_ms < policy.initial_poll_ms) errors.push({ path: `${path}.max_poll_ms`, message: "must be greater than or equal to initial_poll_ms" });
+  const review = policy.review;
+  if (!isRecord2(review)) errors.push({ path: `${path}.review`, message: "must be an object" });
+  else {
+    allowedKeys(errors, review, /* @__PURE__ */ new Set(["required", "reviewer_login", "source"]), `${path}.review`);
+    requiredBoolean(errors, review, "required", `${path}.review.required`);
+    requiredEnum(errors, review, "source", /* @__PURE__ */ new Set(["driver", "none"]), `${path}.review.source`);
+    if (review.required === true) {
+      requiredString(errors, review, "reviewer_login", `${path}.review.reviewer_login`);
+      if (stringValue(review.reviewer_login) && !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?$/u.test(review.reviewer_login)) errors.push({ path: `${path}.review.reviewer_login`, message: "must be a valid GitHub login" });
+      if (review.source !== "driver") errors.push({ path: `${path}.review.source`, message: "required review must use driver source" });
+    } else if (review.reviewer_login !== null) errors.push({ path: `${path}.review.reviewer_login`, message: "must be null when review is not required" });
+  }
+}
+function validatePostPrObservation(errors, observation, path) {
+  if (observation === void 0 || observation === null) return;
+  if (!isRecord2(observation)) {
+    errors.push({ path, message: "must be an object or null" });
+    return;
+  }
+  allowedKeys(errors, observation, /* @__PURE__ */ new Set(["epoch", "expected_head_sha", "started_at", "deadline_at", "next_poll_at", "poll_count", "unchanged_count", "current_interval_ms", "consecutive_transient_errors", "last_observed_at", "last_fingerprint", "last_check_verdict", "last_review_verdict", "last_verdict", "last_error", "review_request", "snapshot"]), path);
+  boundedInteger(errors, observation, "epoch", 1, Number.MAX_SAFE_INTEGER, `${path}.epoch`);
+  requiredFullGitSha(errors, observation, "expected_head_sha", `${path}.expected_head_sha`);
+  for (const key of ["started_at", "deadline_at", "next_poll_at"]) requiredString(errors, observation, key, `${path}.${key}`);
+  for (const key of ["poll_count", "unchanged_count", "consecutive_transient_errors"]) boundedInteger(errors, observation, key, 0, Number.MAX_SAFE_INTEGER, `${path}.${key}`);
+  boundedInteger(errors, observation, "current_interval_ms", 1, 6e5, `${path}.current_interval_ms`);
+  for (const key of ["last_observed_at", "last_fingerprint"]) optionalNullableString(errors, observation, key, `${path}.${key}`);
+  requiredEnum(errors, observation, "last_check_verdict", /* @__PURE__ */ new Set(["not_started", "not_applicable", "pending", "pass", "red", "indeterminate"]), `${path}.last_check_verdict`);
+  requiredEnum(errors, observation, "last_review_verdict", /* @__PURE__ */ new Set(["not_required", "pending", "pass", "red", "indeterminate", "deferred"]), `${path}.last_review_verdict`);
+  requiredEnum(errors, observation, "last_verdict", /* @__PURE__ */ new Set(["pending", "green", "red", "external-merge", "closed", "head-mismatch", "infrastructure"]), `${path}.last_verdict`);
+  validatePostPrLastError(errors, observation.last_error, `${path}.last_error`);
+  validatePostPrReviewRequest(errors, observation.review_request, `${path}.review_request`);
+  if (observation.snapshot !== void 0 && observation.snapshot !== null) validatePostPrSanitizedSnapshot(errors, observation.snapshot, `${path}.snapshot`);
+  const started = Date.parse(observation.started_at || "");
+  const deadline = Date.parse(observation.deadline_at || "");
+  const nextPoll = Date.parse(observation.next_poll_at || "");
+  if (Number.isFinite(started) && Number.isFinite(deadline) && deadline <= started) errors.push({ path: `${path}.deadline_at`, message: "must be after started_at" });
+  if (Number.isFinite(deadline) && Number.isFinite(nextPoll) && nextPoll > deadline) errors.push({ path: `${path}.next_poll_at`, message: "must not exceed deadline_at" });
+}
+function validatePostPrLastError(errors, value, path) {
+  if (value === void 0 || value === null) return;
+  if (!isRecord2(value)) {
+    errors.push({ path, message: "must be an object or null" });
+    return;
+  }
+  allowedKeys(errors, value, /* @__PURE__ */ new Set(["class", "exit_code", "occurred_at", "next_retry_at"]), path);
+  requiredEnum(errors, value, "class", /* @__PURE__ */ new Set(["timeout", "network", "rate-limit", "server", "account-auth", "permission", "not-found", "protocol", "command"]), `${path}.class`);
+  if (value.exit_code !== void 0) optionalNullableInteger(errors, value, "exit_code", `${path}.exit_code`);
+  requiredString(errors, value, "occurred_at", `${path}.occurred_at`);
+  optionalNullableString(errors, value, "next_retry_at", `${path}.next_retry_at`);
+}
+function validatePostPrReviewRequest(errors, value, path) {
+  if (value === void 0 || value === null) return;
+  if (!isRecord2(value)) {
+    errors.push({ path, message: "must be an object or null" });
+    return;
+  }
+  allowedKeys(errors, value, /* @__PURE__ */ new Set(["status", "attempts", "requested_at"]), path);
+  requiredEnum(errors, value, "status", /* @__PURE__ */ new Set(["pending", "requested"]), `${path}.status`);
+  boundedInteger(errors, value, "attempts", 0, Number.MAX_SAFE_INTEGER, `${path}.attempts`);
+  optionalNullableString(errors, value, "requested_at", `${path}.requested_at`);
+  if (value.status === "requested" && !stringValue(value.requested_at)) errors.push({ path: `${path}.requested_at`, message: "is required after reviewer request" });
+}
+function validatePostPrSanitizedSnapshot(errors, value, path) {
+  if (Array.isArray(value)) {
+    for (const [index, item] of value.entries()) validatePostPrSanitizedSnapshot(errors, item, `${path}[${index}]`);
+    return;
+  }
+  if (!isRecord2(value)) return;
+  for (const [key, item] of Object.entries(value)) {
+    if (/^(?:raw|body|stdout|stderr|headers?|token|credentials?)$/iu.test(key)) errors.push({ path: `${path}.${key}`, message: "untrusted raw or sensitive data is not allowed" });
+    validatePostPrSanitizedSnapshot(errors, item, `${path}.${key}`);
+  }
+}
+function validatePostPrRemediation(errors, remediation, path) {
+  if (remediation === void 0 || remediation === null) return;
+  if (!isRecord2(remediation)) {
+    errors.push({ path, message: "must be an object or null" });
+    return;
+  }
+  allowedKeys(errors, remediation, /* @__PURE__ */ new Set(["schema_version", "attempt", "reason_code", "failure_fingerprint", "failed_head_sha", "failure_evidence_ref", "failure_evidence_hash", "owner", "route", "lane", "stage", "baseline_head_sha", "dispatch", "changes", "candidate_head_sha", "remediation_evidence_ref", "remediation_evidence_hash", "revalidation", "push"]), path);
+  requiredInteger(errors, remediation, "schema_version", `${path}.schema_version`);
+  if (remediation.schema_version !== 1) errors.push({ path: `${path}.schema_version`, message: "must equal 1" });
+  boundedInteger(errors, remediation, "attempt", 1, Number.MAX_SAFE_INTEGER, `${path}.attempt`);
+  requiredEnum(errors, remediation, "reason_code", /* @__PURE__ */ new Set(["check-red", "local-red"]), `${path}.reason_code`);
+  requiredHash(errors, remediation, "failure_fingerprint", `${path}.failure_fingerprint`);
+  requiredFullGitSha(errors, remediation, "failed_head_sha", `${path}.failed_head_sha`);
+  requiredString(errors, remediation, "failure_evidence_ref", `${path}.failure_evidence_ref`);
+  requiredHash(errors, remediation, "failure_evidence_hash", `${path}.failure_evidence_hash`);
+  validatePostPrOwner(errors, remediation.owner, `${path}.owner`, remediation.route, remediation.lane);
+  requiredEnum(errors, remediation, "route", /* @__PURE__ */ new Set(["backend-builder", "frontend-builder", "test-verifier"]), `${path}.route`);
+  requiredEnum(errors, remediation, "lane", /* @__PURE__ */ new Set(["slice", "test"]), `${path}.lane`);
+  requiredEnum(errors, remediation, "stage", /* @__PURE__ */ new Set(["planned", "running", "changes-observed", "committed", "revalidating", "validated", "push-pending", "remote-confirmed"]), `${path}.stage`);
+  requiredFullGitSha(errors, remediation, "baseline_head_sha", `${path}.baseline_head_sha`);
+  validatePostPrDispatch(errors, remediation.dispatch, `${path}.dispatch`, remediation);
+  validatePostPrChanges(errors, remediation.changes, `${path}.changes`);
+  optionalNullableFullGitSha(errors, remediation, "candidate_head_sha", `${path}.candidate_head_sha`);
+  optionalNullableString(errors, remediation, "remediation_evidence_ref", `${path}.remediation_evidence_ref`);
+  optionalNullableHash(errors, remediation, "remediation_evidence_hash", `${path}.remediation_evidence_hash`);
+  if (remediation.remediation_evidence_ref === null !== (remediation.remediation_evidence_hash === null)) errors.push({ path, message: "remediation evidence ref/hash must be set together" });
+  validatePostPrRevalidation(errors, remediation.revalidation, `${path}.revalidation`);
+  validatePostPrPush(errors, remediation.push, `${path}.push`);
+  if (stringValue(remediation.candidate_head_sha) && remediation.candidate_head_sha === remediation.failed_head_sha) errors.push({ path: `${path}.candidate_head_sha`, message: "must differ from failed_head_sha" });
+  if (["validated", "push-pending", "remote-confirmed"].includes(remediation.stage)) validatePostPrValidated(errors, remediation, path);
+  if (remediation.stage === "push-pending" && remediation.push?.local_head_sha !== remediation.candidate_head_sha) errors.push({ path: `${path}.push.local_head_sha`, message: "must equal candidate_head_sha while push is pending" });
+  if (remediation.stage === "remote-confirmed" && (remediation.push?.status !== "confirmed" || remediation.push?.remote_after_sha !== remediation.candidate_head_sha)) errors.push({ path: `${path}.push`, message: "remote-confirmed requires confirmed remote_after_sha equal to candidate_head_sha" });
+}
+function validatePostPrOwner(errors, owner, path, route, lane) {
+  if (!isRecord2(owner)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  allowedKeys(errors, owner, /* @__PURE__ */ new Set(["kind", "slice_id", "stack", "path_b64url", "method"]), path);
+  requiredEnum(errors, owner, "kind", /* @__PURE__ */ new Set(["slice", "integration"]), `${path}.kind`);
+  requiredString(errors, owner, "method", `${path}.method`);
+  if (owner.kind === "slice") {
+    requiredString(errors, owner, "slice_id", `${path}.slice_id`);
+    requiredEnum(errors, owner, "stack", /* @__PURE__ */ new Set(["backend", "frontend"]), `${path}.stack`);
+    if (lane !== "slice" || route !== `${owner.stack}-builder`) errors.push({ path, message: "slice owner requires matching slice lane and builder route" });
+  } else if (lane !== "test" || route !== "test-verifier") errors.push({ path, message: "integration owner requires test lane and test-verifier route" });
+}
+function validatePostPrDispatch(errors, dispatch, path, remediation) {
+  if (!isRecord2(dispatch)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  allowedKeys(errors, dispatch, /* @__PURE__ */ new Set(["id", "status", "role", "subject", "started_at", "returned_at"]), path);
+  requiredString(errors, dispatch, "id", `${path}.id`);
+  requiredEnum(errors, dispatch, "status", /* @__PURE__ */ new Set(["planned", "running", "returned"]), `${path}.status`);
+  requiredString(errors, dispatch, "role", `${path}.role`);
+  requiredString(errors, dispatch, "subject", `${path}.subject`);
+  optionalNullableString(errors, dispatch, "started_at", `${path}.started_at`);
+  optionalNullableString(errors, dispatch, "returned_at", `${path}.returned_at`);
+  if (stringValue(remediation.route) && dispatch.role !== remediation.route) errors.push({ path: `${path}.role`, message: "must match remediation route" });
+}
+function validatePostPrChanges(errors, changes, path) {
+  if (!isRecord2(changes)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  allowedKeys(errors, changes, /* @__PURE__ */ new Set(["paths", "entries", "tree_hash"]), path);
+  validateStringArray(errors, changes.paths, `${path}.paths`, { required: true });
+  if (changes.entries !== void 0) {
+    if (!Array.isArray(changes.entries)) errors.push({ path: `${path}.entries`, message: "must be an array" });
+    else changes.entries.forEach((entry, index) => validatePostPrChangeEntry(errors, entry, `${path}.entries[${index}]`));
+  }
+  optionalNullableHash(errors, changes, "tree_hash", `${path}.tree_hash`);
+}
+function validatePostPrChangeEntry(errors, entry, path) {
+  if (!isRecord2(entry)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  allowedKeys(errors, entry, /* @__PURE__ */ new Set(["source", "status", "index_status", "worktree_status", "path", "previous_path", "old_mode", "new_mode"]), path);
+  requiredEnum(errors, entry, "source", /* @__PURE__ */ new Set(["worktree", "commit"]), `${path}.source`);
+  requiredEnum(errors, entry, "status", /* @__PURE__ */ new Set(["modified", "added", "untracked", "deleted", "renamed", "copied"]), `${path}.status`);
+  requiredString(errors, entry, "path", `${path}.path`);
+  for (const key of ["index_status", "worktree_status", "previous_path", "old_mode", "new_mode"]) if (entry[key] !== void 0 && entry[key] !== null && typeof entry[key] !== "string") errors.push({ path: `${path}.${key}`, message: "must be a string or null" });
+}
+function validatePostPrRevalidation(errors, value, path) {
+  if (!isRecord2(value)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  const refs = ["canonical_evidence", "validator_review", "security_review"];
+  allowedKeys(errors, value, new Set(refs.flatMap((name) => [`${name}_ref`, `${name}_hash`]).concat(["canonical_verdict", "validator_verdict", "security_verdict", "jobs"])), path);
+  for (const name of refs) {
+    optionalNullableString(errors, value, `${name}_ref`, `${path}.${name}_ref`);
+    optionalNullableHash(errors, value, `${name}_hash`, `${path}.${name}_hash`);
+    if (value[`${name}_ref`] === null !== (value[`${name}_hash`] === null)) errors.push({ path, message: `${name} ref/hash must be set together` });
+  }
+  optionalNullableEnum(errors, value, "canonical_verdict", /* @__PURE__ */ new Set(["pass", "fail"]), `${path}.canonical_verdict`);
+  optionalNullableEnum(errors, value, "validator_verdict", VALIDATOR_VERDICTS, `${path}.validator_verdict`);
+  optionalNullableEnum(errors, value, "security_verdict", SECURITY_VERDICTS, `${path}.security_verdict`);
+  if (value.jobs !== void 0) validatePostPrJobs(errors, value.jobs, `${path}.jobs`);
+}
+function validatePostPrJobs(errors, jobs, path) {
+  if (!isRecord2(jobs)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  allowedKeys(errors, jobs, /* @__PURE__ */ new Set(["canonical", "validator", "security"]), path);
+  for (const activity of ["canonical", "validator", "security"]) if (jobs[activity] !== void 0) validatePostPrJob(errors, jobs[activity], `${path}.${activity}`, activity);
+}
+function validatePostPrJob(errors, job, path, activity) {
+  if (!isRecord2(job)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  allowedKeys(errors, job, /* @__PURE__ */ new Set(["dispatch_id", "status", "action_token", "steering_generation", "started_at", "returned_at", "result_ref", "result_hash", "verdict", "transient_error_count", "next_retry_at", "last_error"]), path);
+  requiredString(errors, job, "dispatch_id", `${path}.dispatch_id`);
+  requiredEnum(errors, job, "status", /* @__PURE__ */ new Set(["planned", "running", "retry-wait", "bound"]), `${path}.status`);
+  for (const key of ["action_token", "started_at", "returned_at", "result_ref", "result_hash", "verdict", "next_retry_at", "last_error"]) if (job[key] !== null && job[key] !== void 0 && typeof job[key] !== "string") errors.push({ path: `${path}.${key}`, message: "must be a string or null" });
+  if (job.steering_generation !== null && job.steering_generation !== void 0 && (!Number.isInteger(job.steering_generation) || job.steering_generation < 0)) errors.push({ path: `${path}.steering_generation`, message: "must be a non-negative integer or null" });
+  boundedInteger(errors, job, "transient_error_count", 0, Number.MAX_SAFE_INTEGER, `${path}.transient_error_count`);
+  if (job.status === "running" && (!stringValue(job.action_token) || !stringValue(job.started_at))) errors.push({ path, message: "running job requires action token and start time" });
+  if (job.status === "bound" && (!stringValue(job.returned_at) || !stringValue(job.result_ref) || !stringValue(job.result_hash) || !stringValue(job.verdict))) errors.push({ path, message: "bound job requires return/ref/hash/verdict" });
+  const vocabulary = activity === "canonical" ? /* @__PURE__ */ new Set(["pass", "red"]) : activity === "validator" ? VALIDATOR_VERDICTS : SECURITY_VERDICTS;
+  if (stringValue(job.verdict) && !vocabulary.has(job.verdict)) errors.push({ path: `${path}.verdict`, message: "is outside the activity verdict vocabulary" });
+}
+function validatePostPrPush(errors, push, path) {
+  if (!isRecord2(push)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  allowedKeys(errors, push, /* @__PURE__ */ new Set(["status", "remote_before_sha", "local_head_sha", "remote_after_sha", "consecutive_transient_errors", "next_retry_at", "pushed_at", "last_error"]), path);
+  requiredEnum(errors, push, "status", /* @__PURE__ */ new Set(["not-ready", "pending", "confirmed"]), `${path}.status`);
+  for (const key of ["remote_before_sha", "local_head_sha", "remote_after_sha"]) optionalNullableFullGitSha(errors, push, key, `${path}.${key}`);
+  boundedInteger(errors, push, "consecutive_transient_errors", 0, Number.MAX_SAFE_INTEGER, `${path}.consecutive_transient_errors`);
+  optionalNullableString(errors, push, "next_retry_at", `${path}.next_retry_at`);
+  optionalNullableString(errors, push, "pushed_at", `${path}.pushed_at`);
+  if (push.last_error !== void 0 && push.last_error !== null) {
+    const error = push.last_error;
+    if (!isRecord2(error)) errors.push({ path: `${path}.last_error`, message: "must be an object or null" });
+    else {
+      allowedKeys(errors, error, /* @__PURE__ */ new Set(["operation", "observed_at", "error_class", "exit_code", "classification", "error_count", "error_limit", "expected_remote_sha", "candidate_head_sha", "next_retry_at"]), `${path}.last_error`);
+      requiredEnum(errors, error, "operation", /* @__PURE__ */ new Set(["remote-head", "fast-forward-push", "remote-confirmation"]), `${path}.last_error.operation`);
+      requiredEnum(errors, error, "classification", /* @__PURE__ */ new Set(["transient", "permanent", "exhausted"]), `${path}.last_error.classification`);
+      requiredString(errors, error, "observed_at", `${path}.last_error.observed_at`);
+    }
+  }
+}
+function validatePostPrValidated(errors, remediation, path) {
+  const value = remediation.revalidation;
+  if (value?.canonical_verdict !== "pass") errors.push({ path: `${path}.revalidation.canonical_verdict`, message: "must be pass when validated" });
+  if (!PASSING_VALIDATOR_VERDICTS.has(value?.validator_verdict)) errors.push({ path: `${path}.revalidation.validator_verdict`, message: "must be GO or GO-WITH-NITS when validated" });
+  if (!PASSING_SECURITY_VERDICTS.has(value?.security_verdict)) errors.push({ path: `${path}.revalidation.security_verdict`, message: "must be PASS when validated" });
+  for (const key of ["canonical_evidence_ref", "canonical_evidence_hash", "validator_review_ref", "validator_review_hash", "security_review_ref", "security_review_hash"]) if (!stringValue(value?.[key])) errors.push({ path: `${path}.revalidation.${key}`, message: "is required when validated" });
+  if (!stringValue(remediation.candidate_head_sha)) errors.push({ path: `${path}.candidate_head_sha`, message: "is required when validated" });
+}
+function validatePostPrTerminalConsistency(errors, run, postPr, path) {
+  const expected = postPr.phase === "succeeded" ? "completed" : postPr.phase === "blocked" ? "blocked" : postPr.phase === "needs-human" ? "needs-human" : null;
+  if (!expected) return;
+  if (run.status !== expected) errors.push({ path: "run.status", message: `must be ${expected} when post-PR phase is ${postPr.phase}` });
+  const reason = run.terminal_result?.reason;
+  if (!POST_PR_TERMINAL_REASONS[expected]?.includes(reason)) errors.push({ path: "run.terminal_result.reason", message: `must be a closed post-PR ${expected} reason` });
+}
+function validatePostPrRefHashArray(errors, items, path) {
+  if (!Array.isArray(items)) {
+    errors.push({ path, message: "must be an array" });
+    return;
+  }
+  const refs = /* @__PURE__ */ new Set();
+  for (const [index, item] of items.entries()) {
+    validatePostPrRefHash(errors, item, `${path}[${index}]`);
+    if (stringValue(item?.ref) && refs.has(item.ref)) errors.push({ path: `${path}[${index}].ref`, message: "must be unique" });
+    if (stringValue(item?.ref)) refs.add(item.ref);
+  }
+}
+function validatePostPrRefHash(errors, value, path, { optional = false } = {}) {
+  if (value === void 0 || value === null) {
+    if (!optional) errors.push({ path, message: "must be an object" });
+    return;
+  }
+  if (!isRecord2(value)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  allowedKeys(errors, value, /* @__PURE__ */ new Set(["ref", "hash"]), path);
+  requiredString(errors, value, "ref", `${path}.ref`);
+  requiredHash(errors, value, "hash", `${path}.hash`);
+}
+function validateSteering(errors, steering, path) {
+  if (steering === void 0 || steering === null) return;
+  if (!isRecord2(steering)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  requiredInteger(errors, steering, "schema_version", `${path}.schema_version`);
+  if (Number.isInteger(steering.schema_version) && steering.schema_version !== 1) errors.push({ path: `${path}.schema_version`, message: "must equal 1" });
+  optionalInteger(errors, steering, "generation", `${path}.generation`);
+  if (Number.isInteger(steering.generation) && steering.generation < 0) errors.push({ path: `${path}.generation`, message: "must be non-negative" });
+  if (steering.pending !== void 0 && steering.pending !== null) validateSteeringEntry(errors, steering.pending, `${path}.pending`, { pending: true });
+  if (steering.pending !== void 0 && steering.pending !== null && !isRecord2(steering.pending)) errors.push({ path: `${path}.pending`, message: "must be an object or null" });
+  if (steering.uncheckpointed !== void 0 && steering.uncheckpointed !== null) validateSteeringEntry(errors, steering.uncheckpointed, `${path}.uncheckpointed`, { consumed: true });
+  if (steering.uncheckpointed !== void 0 && steering.uncheckpointed !== null && !isRecord2(steering.uncheckpointed)) errors.push({ path: `${path}.uncheckpointed`, message: "must be an object or null" });
+  validateSteeringBoundary(errors, steering.boundary, `${path}.boundary`, { fence: false });
+  validateSteeringAction(errors, steering.action_claim, `${path}.action_claim`, { claim: true });
+  validateSteeringAction(errors, steering.last_action, `${path}.last_action`, { resolved: true });
+  validateSteeringBoundary(errors, steering.pr_fence, `${path}.pr_fence`, { fence: true });
+  if (steering.pending !== void 0 && steering.pending !== null && steering.uncheckpointed !== void 0 && steering.uncheckpointed !== null) {
+    errors.push({ path, message: "cannot have both pending and uncheckpointed steering" });
+  }
+  if (steering.boundary !== void 0 && steering.boundary !== null && (steering.pending !== void 0 && steering.pending !== null || steering.uncheckpointed !== void 0 && steering.uncheckpointed !== null)) {
+    errors.push({ path, message: "boundary cannot coexist with pending or uncheckpointed steering" });
+  }
+  if (steering.action_claim !== void 0 && steering.action_claim !== null && (steering.pending !== void 0 && steering.pending !== null || steering.uncheckpointed !== void 0 && steering.uncheckpointed !== null || steering.boundary !== void 0 && steering.boundary !== null)) {
+    errors.push({ path, message: "action claim cannot coexist with pending, uncheckpointed, or boundary steering state" });
+  }
+  if (steering.pr_fence !== void 0 && steering.pr_fence !== null && (steering.pending !== void 0 && steering.pending !== null || steering.uncheckpointed !== void 0 && steering.uncheckpointed !== null || steering.boundary !== void 0 && steering.boundary !== null || steering.action_claim !== void 0 && steering.action_claim !== null)) {
+    errors.push({ path, message: "pre-PR fence cannot coexist with pending, uncheckpointed, boundary, or action claim steering state" });
+  }
+  if (steering.history === void 0 || steering.history === null) return;
+  if (!Array.isArray(steering.history)) {
+    errors.push({ path: `${path}.history`, message: "must be an array" });
+    return;
+  }
+  for (const [index, entry] of steering.history.entries()) validateSteeringEntry(errors, entry, `${path}.history[${index}]`, { history: true });
+}
+function validateSteeringEntry(errors, entry, path, options = {}) {
+  if (!isRecord2(entry)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  if (options.history) requiredEnum(errors, entry, "event", /* @__PURE__ */ new Set(["queued", "consumed", "acknowledged"]), `${path}.event`);
+  requiredString(errors, entry, "id", `${path}.id`);
+  requiredString(errors, entry, "ref", `${path}.ref`);
+  if (stringValue(entry.ref) && (options.consumed || entry.event === "consumed" || entry.event === "acknowledged") && !/^steering\/consumed-[^/]+\.json$/u.test(entry.ref)) errors.push({ path: `${path}.ref`, message: "must name a consumed steering file" });
+  requiredHash(errors, entry, "hash", `${path}.hash`);
+  requiredInteger(errors, entry, "message_chars", `${path}.message_chars`);
+  requiredString(errors, entry, "created_at", `${path}.created_at`);
+  if (entry.event === "consumed") {
+    requiredString(errors, entry, "source_ref", `${path}.source_ref`);
+    requiredString(errors, entry, "consumed_at", `${path}.consumed_at`);
+  }
+  if (options.consumed || entry.event === "acknowledged") requiredString(errors, entry, "consumed_at", `${path}.consumed_at`);
+  if (entry.event === "acknowledged") {
+    requiredString(errors, entry, "acknowledged_at", `${path}.acknowledged_at`);
+    requiredEnum(errors, entry, "outcome", /* @__PURE__ */ new Set(["applied-prospectively"]), `${path}.outcome`);
+  }
+}
+function validateSteeringBoundary(errors, boundary, path, options = {}) {
+  if (boundary === void 0 || boundary === null) return;
+  if (!isRecord2(boundary)) {
+    errors.push({ path, message: "must be an object or null" });
+    return;
+  }
+  if (!options.fence) requiredEnum(errors, boundary, "kind", /* @__PURE__ */ new Set(["gate", "dispatch", "remediation", "terminal", "post-pr-observe", "post-pr-push"]), `${path}.kind`);
+  requiredString(errors, boundary, "token", `${path}.token`);
+  if (stringValue(boundary.token) && !/^[A-Za-z0-9_-]{8,128}$/u.test(boundary.token)) errors.push({ path: `${path}.token`, message: "must use 8-128 safe characters" });
+  requiredInteger(errors, boundary, "generation", `${path}.generation`);
+  if (Number.isInteger(boundary.generation) && boundary.generation < 0) errors.push({ path: `${path}.generation`, message: "must be non-negative" });
+  requiredHash(errors, boundary, "state_hash", `${path}.state_hash`);
+  requiredString(errors, boundary, "created_at", `${path}.created_at`);
+}
+function validateSteeringAction(errors, action, path, options = {}) {
+  if (action === void 0 || action === null) return;
+  if (!isRecord2(action)) {
+    errors.push({ path, message: "must be an object or null" });
+    return;
+  }
+  requiredEnum(errors, action, "kind", /* @__PURE__ */ new Set(["dispatch", "remediation", "terminal", "post-pr-observe", "post-pr-push"]), `${path}.kind`);
+  requiredString(errors, action, "token", `${path}.token`);
+  if (stringValue(action.token) && !/^[A-Za-z0-9_-]{8,128}$/u.test(action.token)) errors.push({ path: `${path}.token`, message: "must use 8-128 safe characters" });
+  requiredInteger(errors, action, "generation", `${path}.generation`);
+  if (Number.isInteger(action.generation) && action.generation < 0) errors.push({ path: `${path}.generation`, message: "must be non-negative" });
+  requiredString(errors, action, "claimed_at", `${path}.claimed_at`);
+  if (options.resolved) {
+    requiredEnum(errors, action, "outcome", /* @__PURE__ */ new Set(["started", "aborted", "closed"]), `${path}.outcome`);
+    requiredString(errors, action, "resolved_at", `${path}.resolved_at`);
+  }
+}
+function validateContinuationParent(errors, parent, path) {
+  if (!isRecord2(parent)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  requiredString(errors, parent, "run_id", `${path}.run_id`);
+  requiredEnum(errors, parent, "status", BLOCKED_CONTINUATION_PARENT_STATUSES, `${path}.status`);
+  requiredString(errors, parent, "run_ref", `${path}.run_ref`);
+  requiredHash(errors, parent, "run_hash", `${path}.run_hash`);
+  requiredString(errors, parent, "branch", `${path}.branch`);
+  requiredString(errors, parent, "commit", `${path}.commit`);
+  requiredString(errors, parent, "worktree", `${path}.worktree`);
+}
+function validateContinuationReview(errors, review, path) {
+  if (!isRecord2(review)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  requiredString(errors, review, "ref", `${path}.ref`);
+  requiredString(errors, review, "kind", `${path}.kind`);
+  optionalString(errors, review, "source", `${path}.source`);
+  requiredHash(errors, review, "hash", `${path}.hash`);
+  requiredString(errors, review, "subject", `${path}.subject`);
+  optionalString(errors, review, "verdict", `${path}.verdict`);
+  optionalString(errors, review, "summary", `${path}.summary`);
+  validateStringArray(errors, review.required_fixes, `${path}.required_fixes`, { required: false });
+  if (!stringValue(review.summary) && !hasNonEmptyStringItem(review.required_fixes)) {
+    errors.push({ path, message: "requires summary or required_fixes" });
+  }
+}
+function validateContinuationTarget(errors, run, target, path) {
+  if (!isRecord2(target)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  requiredString(errors, target, "run_id", `${path}.run_id`);
+  requiredString(errors, target, "branch", `${path}.branch`);
+  requiredString(errors, target, "worktree", `${path}.worktree`);
+  requiredString(errors, target, "base_ref", `${path}.base_ref`);
+  requiredString(errors, target, "base_commit", `${path}.base_commit`);
+  if (stringValue(target.run_id) && stringValue(run.run_id) && target.run_id !== run.run_id) errors.push({ path: `${path}.run_id`, message: "must match run.run_id" });
+  if (stringValue(target.branch) && stringValue(run.branch) && target.branch !== run.branch) errors.push({ path: `${path}.branch`, message: "must match run.branch" });
+  if (stringValue(target.worktree) && stringValue(run.worktree) && target.worktree !== run.worktree) errors.push({ path: `${path}.worktree`, message: "must match run.worktree" });
+}
+function validateContinuationRefHashArray(errors, items, path) {
+  if (!Array.isArray(items)) {
+    errors.push({ path, message: "must be an array" });
+    return;
+  }
+  for (const [index, item] of items.entries()) {
+    const itemPath = `${path}[${index}]`;
+    if (!isRecord2(item)) {
+      errors.push({ path: itemPath, message: "must be an object" });
+      continue;
+    }
+    requiredString(errors, item, "kind", `${itemPath}.kind`);
+    requiredString(errors, item, "ref", `${itemPath}.ref`);
+    requiredHash(errors, item, "hash", `${itemPath}.hash`);
+  }
+}
+function validateContinuationSelectedReview(errors, continuation, path) {
+  const review = continuation.review;
+  if (!isRecord2(review) || !Array.isArray(continuation.parent_reviews)) return;
+  if (!stringValue(review.ref) || typeof review.hash !== "string" || !HASH_PATTERN.test(review.hash)) return;
+  const match = continuation.parent_reviews.find((item) => isRecord2(item) && item.ref === review.ref);
+  if (!match) {
+    errors.push({ path: `${path}.parent_reviews`, message: "must include selected review ref" });
+    return;
+  }
+  if (match.hash !== review.hash) {
+    errors.push({ path: `${path}.parent_reviews`, message: "selected review hash must match review.hash" });
+  }
+}
+function validateRedactedEnv(errors, value, path) {
+  if (Array.isArray(value)) {
+    for (const [index, item] of value.entries()) validateRedactedEnv(errors, item, `${path}[${index}]`);
+    return;
+  }
+  if (typeof value === "string") {
+    if (value !== REDACTED_ENV_VALUE && isSensitiveEnvValue(value)) errors.push({ path, message: "must be redacted in debug snapshot" });
+    return;
+  }
+  if (!isRecord2(value)) return;
+  for (const [key, item] of Object.entries(value)) {
+    const itemPath = `${path}.${key}`;
+    if (isSensitiveEnvKey(key) && item !== REDACTED_ENV_VALUE) errors.push({ path: itemPath, message: "is not allowed in debug snapshot" });
+    validateRedactedEnv(errors, item, itemPath);
+  }
+}
+function validateGate(errors, gate, path, gateName) {
+  if (!isRecord2(gate)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  requiredEnum(errors, gate, "status", GATE_STATUSES, `${path}.status`);
+  optionalString(errors, gate, "artifact", `${path}.artifact`);
+  optionalString(errors, gate, "question_ref", `${path}.question_ref`);
+  optionalString(errors, gate, "answer_ref", `${path}.answer_ref`);
+  optionalString(errors, gate, "answered_at", `${path}.answered_at`);
+  optionalString(errors, gate, "answer", `${path}.answer`);
+  optionalString(errors, gate, "decision_note", `${path}.decision_note`);
+  optionalEnum(errors, gate, "approval_source", APPROVAL_SOURCES, `${path}.approval_source`);
+  validatePendingSnapshot(errors, gate.pending_snapshot, `${path}.pending_snapshot`);
+  validateGateHandoffReceipt(errors, gate.handoff_receipt, `${path}.handoff_receipt`, gateName);
+}
+function validateGateHandoffReceipt(errors, receipt, path, gateName) {
+  if (receipt === void 0 || receipt === null) return;
+  if (!isRecord2(receipt)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  requiredInteger(errors, receipt, "schema_version", `${path}.schema_version`);
+  if (Number.isInteger(receipt.schema_version) && receipt.schema_version !== 1) errors.push({ path: `${path}.schema_version`, message: "must equal 1" });
+  requiredString(errors, receipt, "kind", `${path}.kind`);
+  if (stringValue(receipt.kind) && receipt.kind !== HANDOFF_RECEIPT_KIND) errors.push({ path: `${path}.kind`, message: `must equal ${HANDOFF_RECEIPT_KIND}` });
+  requiredString(errors, receipt, "gate", `${path}.gate`);
+  if (stringValue(receipt.gate) && receipt.gate !== gateName) errors.push({ path: `${path}.gate`, message: "must match its gate key" });
+  requiredHash(errors, receipt, "approval_fingerprint", `${path}.approval_fingerprint`);
+  requiredHash(errors, receipt, "pending_snapshot_hash", `${path}.pending_snapshot_hash`);
+  requiredHash(errors, receipt, "answer_hash", `${path}.answer_hash`);
+  requiredInteger(errors, receipt, "steering_generation", `${path}.steering_generation`);
+  if (Number.isInteger(receipt.steering_generation) && receipt.steering_generation < 0) errors.push({ path: `${path}.steering_generation`, message: "must be non-negative" });
+  requiredString(errors, receipt, "accepted_at", `${path}.accepted_at`);
+}
+function validatePendingSnapshot(errors, pendingSnapshot, path) {
+  if (pendingSnapshot === void 0 || pendingSnapshot === null) return;
+  if (!isRecord2(pendingSnapshot)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  requiredString(errors, pendingSnapshot, "question_ref", `${path}.question_ref`);
+  requiredHash(errors, pendingSnapshot, "question_hash", `${path}.question_hash`);
+  requiredString(errors, pendingSnapshot, "artifact_ref", `${path}.artifact_ref`);
+  requiredHash(errors, pendingSnapshot, "artifact_hash", `${path}.artifact_hash`);
+  optionalString(errors, pendingSnapshot, "answer_ref", `${path}.answer_ref`);
+  optionalHash(errors, pendingSnapshot, "answer_hash", `${path}.answer_hash`);
+  requiredString(errors, pendingSnapshot, "created_at", `${path}.created_at`);
+}
+function isPendingGate(gate) {
+  return isRecord2(gate) && gate.status === "pending";
+}
+function validateRunSlices(errors, slices, path) {
+  if (slices === void 0 || slices === null) return;
+  if (!Array.isArray(slices)) {
+    errors.push({ path, message: "must be an array" });
+    return;
+  }
+  const ids = validateSliceIDs(errors, slices, path);
+  for (const [index, slice] of slices.entries()) validateRunSlice(errors, slice, `${path}[${index}]`, ids);
+}
+function validateRunSlice(errors, slice, path, ids) {
+  if (!isRecord2(slice)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  requiredTerminalSafeString(errors, slice, "id", `${path}.id`);
+  optionalString(errors, slice, "stack", `${path}.stack`);
+  validateStringArray(errors, slice.depends_on, `${path}.depends_on`, { required: false, values: ids });
+  optionalEnum(errors, slice, "status", SLICE_STATUSES, `${path}.status`);
+  optionalString(errors, slice, "branch", `${path}.branch`);
+  optionalString(errors, slice, "worktree", `${path}.worktree`);
+  optionalInteger(errors, slice, "attempts", `${path}.attempts`);
+  optionalString(errors, slice, "evidence_ref", `${path}.evidence_ref`);
+  optionalString(errors, slice, "review_ref", `${path}.review_ref`);
+  optionalString(errors, slice, "merge_commit", `${path}.merge_commit`);
+  optionalString(errors, slice, "blocked_reason", `${path}.blocked_reason`);
+}
+function validatePlannedSlices(errors, slices, path, { enforceDependencyDepth }) {
+  const ids = validateSliceIDs(errors, slices, path);
+  for (const [index, slice] of slices.entries()) {
+    if (!isRecord2(slice)) {
+      errors.push({ path: `${path}[${index}]`, message: "must be an object" });
+      continue;
+    }
+    requiredTerminalSafeString(errors, slice, "id", `${path}[${index}].id`);
+    requiredString(errors, slice, "stack", `${path}[${index}].stack`);
+    validateStringArray(errors, slice.paths, `${path}[${index}].paths`, { required: true, nonEmpty: true });
+    validateStringArray(errors, slice.depends_on, `${path}[${index}].depends_on`, { required: true, values: ids });
+    validateStringArray(errors, slice.acceptance, `${path}[${index}].acceptance`, { required: true, nonEmpty: true });
+    validateStringArray(errors, slice.test_plan, `${path}[${index}].test_plan`, { required: true, nonEmpty: true });
+  }
+  const acyclic = validateAcyclic(errors, slices, ids, path);
+  if (enforceDependencyDepth && errors.length === 0 && acyclic) validateDependencyDepth(errors, slices, path);
+}
+function validateSliceIDs(errors, slices, path) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const [index, slice] of slices.entries()) {
+    if (!isRecord2(slice) || typeof slice.id !== "string" || !slice.id.trim()) continue;
+    if (ids.has(slice.id)) errors.push({ path: `${path}[${index}].id`, message: `duplicate id '${safeValidationIdentifier(slice.id)}'` });
+    ids.add(slice.id);
+  }
+  return ids;
+}
+function validateAcyclic(errors, slices, ids, path) {
+  const graph = /* @__PURE__ */ new Map();
+  for (const slice of slices) if (isRecord2(slice) && typeof slice.id === "string" && ids.has(slice.id)) graph.set(slice.id, Array.isArray(slice.depends_on) ? slice.depends_on.filter((id) => ids.has(id)) : []);
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  let acyclic = true;
+  const visit = (id, chain) => {
+    if (visited.has(id)) return;
+    if (visiting.has(id)) {
+      errors.push({ path, message: `dependency cycle: ${[...chain, id].join(" -> ")}` });
+      acyclic = false;
+      return;
+    }
+    visiting.add(id);
+    for (const dep of graph.get(id) || []) visit(dep, [...chain, id]);
+    visiting.delete(id);
+    visited.add(id);
+  };
+  for (const id of graph.keys()) visit(id, []);
+  return acyclic;
+}
+function validateDependencyDepth(errors, slices, path) {
+  const byId = new Map(slices.map((slice, index) => [slice.id, { slice, index }]));
+  const memo = /* @__PURE__ */ new Map();
+  const longestPath = (id) => {
+    if (memo.has(id)) return memo.get(id);
+    const dependencies = byId.get(id).slice.depends_on;
+    let result2 = { depth: 1, ids: [id] };
+    for (const dependency of dependencies) {
+      const parent = longestPath(dependency);
+      if (parent.depth + 1 > result2.depth) result2 = { depth: parent.depth + 1, ids: [...parent.ids, id] };
+    }
+    memo.set(id, result2);
+    return result2;
+  };
+  for (const [id, { index }] of byId) {
+    const result2 = longestPath(id);
+    if (result2.depth > MAX_SLICE_DEPENDENCY_WAVES) {
+      errors.push({
+        path: `${path}[${index}].depends_on`,
+        message: `dependency depth ${result2.depth} exceeds maximum ${MAX_SLICE_DEPENDENCY_WAVES} waves: ${result2.ids.join(" -> ")}`
+      });
+    }
+  }
+}
+function validateSteps(errors, steps, path) {
+  if (steps === void 0 || steps === null) return;
+  if (!Array.isArray(steps)) {
+    errors.push({ path, message: "must be an array" });
+    return;
+  }
+  for (const [index, step] of steps.entries()) {
+    if (!isRecord2(step)) {
+      errors.push({ path: `${path}[${index}]`, message: "must be an object" });
+      continue;
+    }
+    requiredTerminalSafeString(errors, step, "agent", `${path}[${index}].agent`);
+    requiredEnum(errors, step, "status", STEP_STATUSES, `${path}[${index}].status`);
+    optionalInteger(errors, step, "attempts", `${path}[${index}].attempts`);
+    optionalString(errors, step, "artifact_ref", `${path}[${index}].artifact_ref`);
+    optionalString(errors, step, "review_ref", `${path}[${index}].review_ref`);
+    optionalString(errors, step, "evidence_ref", `${path}[${index}].evidence_ref`);
+    validateStepAcceptance(errors, step.acceptance, `${path}[${index}].acceptance`);
+    validateStepInheritedAcceptance(errors, step.inherited_acceptance, `${path}[${index}].inherited_acceptance`);
+  }
+}
+function validateStepAcceptance(errors, acceptance, path) {
+  if (acceptance === void 0 || acceptance === null) return;
+  if (!isRecord2(acceptance)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  requiredString(errors, acceptance, "artifact_ref", `${path}.artifact_ref`);
+  requiredHash(errors, acceptance, "artifact_hash", `${path}.artifact_hash`);
+  optionalString(errors, acceptance, "review_ref", `${path}.review_ref`);
+  if (acceptance.review_ref !== void 0 && acceptance.review_ref !== null) requiredHash(errors, acceptance, "review_hash", `${path}.review_hash`);
+}
+function validateStepInheritedAcceptance(errors, inherited, path) {
+  if (inherited === void 0 || inherited === null) return;
+  if (!isRecord2(inherited)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  requiredString(errors, inherited, "from_run_id", `${path}.from_run_id`);
+  requiredString(errors, inherited, "parent_spec_review_ref", `${path}.parent_spec_review_ref`);
+  requiredHash(errors, inherited, "artifact_hash", `${path}.artifact_hash`);
+  requiredHash(errors, inherited, "review_hash", `${path}.review_hash`);
+}
+function validateVerdict(errors, value, path, allowed) {
+  if (value === void 0 || value === null) return;
+  if (!isRecord2(value)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  optionalEnum(errors, value, "verdict", allowed, `${path}.verdict`);
+  optionalString(errors, value, "report", `${path}.report`);
+  optionalString(errors, value, "review_ref", `${path}.review_ref`);
+  optionalInteger(errors, value, "loops", `${path}.loops`);
+}
+function validateTerminalResult(errors, run, path) {
+  const terminal = TERMINAL_STATUSES.has(run.status);
+  if (!terminal && (run.terminal_result === void 0 || run.terminal_result === null)) return;
+  if (terminal && !isRecord2(run.terminal_result)) {
+    errors.push({ path, message: "must be present when run.status is terminal" });
+    return;
+  }
+  if (!isRecord2(run.terminal_result)) {
+    errors.push({ path, message: "must be an object or null" });
+    return;
+  }
+  requiredEnum(errors, run.terminal_result, "status", TERMINAL_STATUSES, `${path}.status`);
+  requiredString(errors, run.terminal_result, "run_id", `${path}.run_id`);
+  optionalString(errors, run.terminal_result, "pr_url", `${path}.pr_url`);
+  optionalString(errors, run.terminal_result, "reason", `${path}.reason`);
+  optionalString(errors, run.terminal_result, "summary", `${path}.summary`);
+  validateStringMap(errors, run.terminal_result.artifacts, `${path}.artifacts`);
+  if (run.terminal_result.status && run.terminal_result.status !== run.status) errors.push({ path: `${path}.status`, message: `must match run.status '${run.status}'` });
+  if (run.terminal_result.run_id && run.terminal_result.run_id !== run.run_id) errors.push({ path: `${path}.run_id`, message: "must match run.run_id" });
+  if (["blocked", "partial", "needs-human"].includes(run.status) && !stringValue(run.terminal_result.reason)) errors.push({ path: `${path}.reason`, message: `is required for ${run.status}` });
+}
+function validateCostAttribution(errors, attribution, path, run) {
+  if (attribution === void 0 || attribution === null) return;
+  if (!isRecord2(attribution)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  requiredInteger(errors, attribution, "schema_version", `${path}.schema_version`);
+  if (Number.isInteger(attribution.schema_version) && attribution.schema_version !== COST_ATTRIBUTION_SCHEMA_VERSION) errors.push({ path: `${path}.schema_version`, message: `must equal ${COST_ATTRIBUTION_SCHEMA_VERSION}` });
+  requiredString(errors, attribution, "updated_at", `${path}.updated_at`);
+  requiredEnum(errors, attribution, "status", COST_ATTRIBUTION_STATUS_SET, `${path}.status`);
+  validateCostAttributionRollup(errors, attribution.totals, `${path}.totals`, { required: true });
+  validateCostAttributionRollupMap(errors, attribution.by_agent, `${path}.by_agent`, { required: true });
+  validateCostAttributionRollupMap(errors, attribution.by_slice, `${path}.by_slice`, { required: true, knownKeys: knownRunSliceIds(run) });
+  const knownSlices = knownRunSliceIds(run);
+  const runId = stringValue(run?.run_id) ? run.run_id : null;
+  if (!Array.isArray(attribution.entries)) {
+    errors.push({ path: `${path}.entries`, message: "must be an array" });
+    return;
+  }
+  if (attribution.entries.length > MAX_COST_ATTRIBUTION_ENTRIES) errors.push({ path: `${path}.entries`, message: `must have at most ${MAX_COST_ATTRIBUTION_ENTRIES} entries` });
+  for (const [index, entry] of attribution.entries.entries()) validateCostAttributionEntry(errors, entry, `${path}.entries[${index}]`, knownSlices, runId);
+}
+function validateCostAttributionEntry(errors, entry, path, knownSlices, runId) {
+  if (!isRecord2(entry)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  requiredString(errors, entry, "id", `${path}.id`);
+  requiredString(errors, entry, "recorded_at", `${path}.recorded_at`);
+  requiredString(errors, entry, "run_id", `${path}.run_id`);
+  requiredString(errors, entry, "agent", `${path}.agent`);
+  requiredEnum(errors, entry, "status", COST_ATTRIBUTION_STATUS_SET, `${path}.status`);
+  validateStringArray(errors, entry.missing, `${path}.missing`, { required: true, noControlChars: true });
+  for (const field of COST_ATTRIBUTION_ENTRY_OPTIONAL_STRINGS) optionalString(errors, entry, field, `${path}.${field}`);
+  optionalCostCurrency(errors, entry, "cost_currency", `${path}.cost_currency`);
+  validateCostAttributionNumbers(errors, entry, path);
+  if (hasCostNumber(entry) && !stringValue(entry.cost_currency)) errors.push({ path: `${path}.cost_currency`, message: "is required when cost fields are present" });
+  if (runId && stringValue(entry.run_id) && entry.run_id !== runId) errors.push({ path: `${path}.run_id`, message: "must match run.run_id" });
+  validateCostAttributionAvailability(errors, entry, path);
+  if ((entry.status === "partial" || entry.status === "unavailable") && Array.isArray(entry.missing) && !hasNonEmptyStringItem(entry.missing)) errors.push({ path: `${path}.missing`, message: `is required when status is ${entry.status}` });
+  if (stringValue(entry.slice_id) && knownSlices && !knownSlices.has(entry.slice_id)) errors.push({ path: `${path}.slice_id`, message: `unknown slice '${entry.slice_id}'` });
+}
+function validateCostAttributionAvailability(errors, entry, path) {
+  const missing = costAttributionAvailabilityMissing(entry);
+  const hasUsage = hasUsageNumber(entry);
+  const hasCost = hasCostNumber(entry);
+  if (entry.status === "available" && Array.isArray(entry.missing) && entry.missing.length > 0) {
+    errors.push({ path: `${path}.missing`, message: "must be empty when status is available" });
+  }
+  if (entry.status === "available" && missing.length > 0) {
+    errors.push({ path: `${path}.status`, message: "available requires provider, model, usage, cost_total, and cost_currency" });
+  }
+  if (entry.status === "unavailable" && (hasUsage || hasCost)) errors.push({ path: `${path}.status`, message: "must be partial or available when usage or cost fields are present" });
+}
+function costAttributionAvailabilityMissing(entry) {
+  const missing = [];
+  if (!stringValue(entry.provider)) missing.push("provider");
+  if (!stringValue(entry.model)) missing.push("model");
+  if (!hasUsageNumber(entry)) missing.push("usage");
+  if (entry.cost_total === void 0 || entry.cost_total === null) missing.push("cost_total");
+  if (!stringValue(entry.cost_currency)) missing.push("cost_currency");
+  return missing;
+}
+function validateCostAttributionRollupMap(errors, map, path, options = {}) {
+  if (!isRecord2(map)) {
+    if (options.required) errors.push({ path, message: "must be an object" });
+    return;
+  }
+  for (const [key, rollup] of Object.entries(map)) {
+    if (!stringValue(key)) errors.push({ path: `${path}.${key}`, message: "must be keyed by non-empty strings" });
+    if (options.knownKeys && !options.knownKeys.has(key)) errors.push({ path: `${path}.${key}`, message: `unknown slice '${key}'` });
+    validateCostAttributionRollup(errors, rollup, `${path}.${key}`, { required: true });
+  }
+}
+function validateCostAttributionRollup(errors, rollup, path, options = {}) {
+  if (!isRecord2(rollup)) {
+    if (options.required) errors.push({ path, message: "must be an object" });
+    return;
+  }
+  requiredEnum(errors, rollup, "status", COST_ATTRIBUTION_STATUS_SET, `${path}.status`);
+  requiredInteger(errors, rollup, "entry_count", `${path}.entry_count`);
+  optionalInteger(errors, rollup, "request_count", `${path}.request_count`);
+  validateStringArray(errors, rollup.missing, `${path}.missing`, { required: true, noControlChars: true });
+  optionalBoolean(errors, rollup, "mixed_currency", `${path}.mixed_currency`);
+  optionalString(errors, rollup, "cost_currency", `${path}.cost_currency`);
+  optionalCostCurrency(errors, rollup, "cost_currency", `${path}.cost_currency`);
+  validateCostAttributionNumbers(errors, rollup, path);
+  if (rollup.mixed_currency === true && rollup.cost_total !== void 0 && rollup.cost_total !== null) errors.push({ path: `${path}.cost_total`, message: "must be omitted when mixed_currency is true" });
+  if (hasCostNumber(rollup) && rollup.mixed_currency !== true && rollup.cost_total !== void 0 && !stringValue(rollup.cost_currency)) errors.push({ path: `${path}.cost_currency`, message: "is required when cost_total is present" });
+}
+function validateCostAttributionNumbers(errors, value, path) {
+  for (const field of COST_ATTRIBUTION_NUMERIC_FIELDS) {
+    if (value[field] === void 0 || value[field] === null) continue;
+    if (typeof value[field] !== "number" || !Number.isFinite(value[field]) || value[field] < 0) errors.push({ path: `${path}.${field}`, message: "must be a finite non-negative number" });
+  }
+}
+function knownRunSliceIds(run) {
+  if (!Array.isArray(run?.slices)) return null;
+  const ids = /* @__PURE__ */ new Set();
+  for (const slice of run.slices) if (stringValue(slice?.id)) ids.add(slice.id);
+  return ids;
+}
+function hasCostNumber(value) {
+  return COST_NUMERIC_FIELDS.some((field) => value[field] !== void 0 && value[field] !== null);
+}
+function hasUsageNumber(value) {
+  return USAGE_NUMERIC_FIELDS.some((field) => value[field] !== void 0 && value[field] !== null);
+}
+function validateGateName(errors, name, path) {
+  if (!SAFE_GATE_NAME_PATTERN.test(name)) errors.push({ path, message: "must match safe gate name pattern [a-z0-9][a-z0-9_-]*[a-z0-9]" });
+}
+function validateStringMap(errors, value, path) {
+  if (value === void 0 || value === null) return;
+  if (!isRecord2(value)) {
+    errors.push({ path, message: "must be an object" });
+    return;
+  }
+  for (const [key, item] of Object.entries(value)) if (typeof item !== "string") errors.push({ path: `${path}.${key}`, message: "must be a string" });
+}
+function validateProcessLogRefContainment(errors, ref, path, runDir) {
+  if (!stringValue(ref) || !stringValue(runDir)) return;
+  const processesDir = resolve3(processEvidenceProcessesDir(runDir));
+  const resolvedLog = resolve3(runDir, ref);
+  const relativeLog = relative2(processesDir, resolvedLog);
+  if (relativeLog === "" || relativeLog === ".." || relativeLog.startsWith(`..${sep3}`)) {
+    errors.push({ path, message: "must stay under run processes directory" });
+  }
+}
+function validateStringArray(errors, value, path, options = {}) {
+  if (value === void 0 || value === null) {
+    if (options.required) errors.push({ path, message: "must be an array" });
+    return;
+  }
+  if (!Array.isArray(value)) {
+    errors.push({ path, message: "must be an array" });
+    return;
+  }
+  if (options.nonEmpty && value.length === 0) errors.push({ path, message: "must not be empty" });
+  for (const [index, item] of value.entries()) {
+    if (!stringValue(item)) errors.push({ path: `${path}[${index}]`, message: "must be a non-empty string" });
+    else if (options.noControlChars && hasTerminalControl(item)) errors.push({ path: `${path}[${index}]`, message: "must not contain control characters" });
+    else if (options.values && !options.values.has(item)) errors.push({ path: `${path}[${index}]`, message: `unknown dependency '${item}'` });
+  }
+}
+function hasNonEmptyStringItem(value) {
+  return Array.isArray(value) && value.some((item) => stringValue(item));
+}
+function requiredString(errors, obj, key, path) {
+  if (!stringValue(obj[key])) errors.push({ path, message: "must be a non-empty string" });
+}
+function requiredTerminalSafeString(errors, obj, key, path) {
+  requiredString(errors, obj, key, path);
+  if (typeof obj[key] === "string" && hasTerminalControl(obj[key])) errors.push({ path, message: "must not contain control characters" });
+}
+function optionalString(errors, obj, key, path) {
+  if (obj[key] === void 0 || obj[key] === null) return;
+  if (typeof obj[key] !== "string") errors.push({ path, message: "must be a string or null" });
+}
+function optionalCostCurrency(errors, obj, key, path) {
+  if (obj[key] === void 0 || obj[key] === null) return;
+  if (typeof obj[key] === "string" && !isSafeCostCurrency(obj[key])) errors.push({ path, message: "must be an uppercase currency code (3-12 letters) with no control characters" });
+}
+function optionalNonEmptyString(errors, obj, key, path) {
+  if (obj[key] === void 0 || obj[key] === null) return;
+  if (!stringValue(obj[key])) errors.push({ path, message: "must be a non-empty string" });
+}
+function requiredEnum(errors, obj, key, values, path) {
+  if (typeof obj[key] !== "string" || !values.has(obj[key])) errors.push({ path, message: `must be one of ${[...values].join(", ")}` });
+}
+function optionalEnum(errors, obj, key, values, path) {
+  if (obj[key] === void 0 || obj[key] === null) return;
+  requiredEnum(errors, obj, key, values, path);
+}
+function optionalNumber(errors, obj, key, path) {
+  if (obj[key] === void 0 || obj[key] === null) return;
+  if (typeof obj[key] !== "number" || !Number.isFinite(obj[key])) errors.push({ path, message: "must be a number" });
+}
+function optionalInteger(errors, obj, key, path) {
+  if (obj[key] === void 0 || obj[key] === null) return;
+  if (!Number.isInteger(obj[key]) || obj[key] < 0) errors.push({ path, message: "must be a non-negative integer" });
+}
+function optionalBoolean(errors, obj, key, path) {
+  if (obj[key] === void 0 || obj[key] === null) return;
+  if (typeof obj[key] !== "boolean") errors.push({ path, message: "must be a boolean" });
+}
+function requiredBoolean(errors, obj, key, path) {
+  if (typeof obj[key] !== "boolean") errors.push({ path, message: "must be a boolean" });
+}
+function boundedInteger(errors, obj, key, min, max, path) {
+  if (!Number.isInteger(obj?.[key]) || obj[key] < min || obj[key] > max) errors.push({ path, message: `must be an integer from ${min} to ${max}` });
+}
+function optionalNullableString(errors, obj, key, path) {
+  if (obj[key] === void 0 || obj[key] === null) return;
+  if (!stringValue(obj[key])) errors.push({ path, message: "must be a non-empty string or null" });
+}
+function optionalNullableEnum(errors, obj, key, values, path) {
+  if (obj[key] === void 0 || obj[key] === null) return;
+  requiredEnum(errors, obj, key, values, path);
+}
+function optionalNullableHash(errors, obj, key, path) {
+  if (obj[key] === void 0 || obj[key] === null) return;
+  requiredHash(errors, obj, key, path);
+}
+function requiredFullGitSha(errors, obj, key, path) {
+  if (typeof obj[key] !== "string" || !FULL_GIT_SHA_PATTERN.test(obj[key])) errors.push({ path, message: "must be a full 40-character lowercase git SHA" });
+}
+function optionalNullableFullGitSha(errors, obj, key, path) {
+  if (obj[key] === void 0 || obj[key] === null) return;
+  requiredFullGitSha(errors, obj, key, path);
+}
+function allowedKeys(errors, value, allowed, path) {
+  for (const key of Object.keys(value)) if (!allowed.has(key)) errors.push({ path: `${path}.${key}`, message: "is not allowed" });
+}
+function requiredInteger(errors, obj, key, path) {
+  if (!Number.isInteger(obj[key]) || obj[key] < 0) errors.push({ path, message: "must be a non-negative integer" });
+}
+function optionalNullableInteger(errors, obj, key, path) {
+  if (obj[key] === null) return;
+  requiredInteger(errors, obj, key, path);
+}
+function requiredHash(errors, obj, key, path) {
+  if (typeof obj[key] !== "string" || !HASH_PATTERN.test(obj[key])) errors.push({ path, message: "must be a sha256 hash" });
+}
+function optionalHash(errors, obj, key, path) {
+  if (obj[key] === void 0 || obj[key] === null) return;
+  requiredHash(errors, obj, key, path);
+}
+function stringValue(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+function safeValidationIdentifier(value) {
+  return safeValidationText(value) || "<control characters removed>";
+}
+function safeValidationText(value) {
+  if (!hasTerminalControl(value)) return value;
+  return sanitizePublicCostText(value);
+}
+function fail(errors) {
+  throw new ValidationError(errors);
+}
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/run-state.js
+var HEARTBEAT_STEP_IN_FLIGHT_STATUSES = /* @__PURE__ */ new Set(["running"]);
+var HEARTBEAT_SLICE_IN_FLIGHT_STATUSES = /* @__PURE__ */ new Set(["running", "review"]);
+var POST_PR_HEARTBEAT_PHASES = /* @__PURE__ */ new Set(["observing", "remediation-running", "revalidating"]);
+var POST_PR_TERMINAL_PHASE = Object.freeze({ completed: "succeeded", blocked: "blocked", "needs-human": "needs-human" });
+function hasInFlightHeartbeatWork(run) {
+  if (Array.isArray(run.steps) && run.steps.some((step) => HEARTBEAT_STEP_IN_FLIGHT_STATUSES.has(step?.status))) return true;
+  if (Array.isArray(run.slices) && run.slices.some((slice) => HEARTBEAT_SLICE_IN_FLIGHT_STATUSES.has(slice?.status))) return true;
+  if (run?.status === "running" && run?.post_pr?.policy?.enabled === true && POST_PR_HEARTBEAT_PHASES.has(run.post_pr.phase)) return true;
+  return false;
+}
+
+// src/hardening/sensitive-data.js
+var BASELINE_SENSITIVE_KEY_PATTERN = /(?:secret|token|password|passwd|pwd|api[_-]?key|private[_-]?key|credential|authorization|auth[_-]?header|access[_-]?key|bearer|cookie)/iu;
+var BASELINE_SENSITIVE_VALUE_PATTERN = /(?:secret|token|password|passwd|api[_-]?key|private[_-]?key)/iu;
+var FLATTENED_BASIC_HEADER_PATTERN = /(^|[\r\n]|[^A-Za-z0-9_-])((?:Proxy-)?Authorization[ \t]*[:=][ \t]*Basic[ \t]+)([A-Za-z0-9._~+/-]+={0,})(?![A-Za-z0-9._~+/=-])/iu;
+var FLATTENED_BASIC_HEADER_GLOBAL_PATTERN = /(^|[\r\n]|[^A-Za-z0-9_-])((?:Proxy-)?Authorization[ \t]*[:=][ \t]*Basic[ \t]+)([A-Za-z0-9._~+/-]+={0,})(?![A-Za-z0-9._~+/=-])/giu;
+var TOKEN_SHAPED_VALUE_PATTERNS = Object.freeze([
+  /\bgh[pousr]_[A-Za-z0-9_]{20,}\b/iu,
+  /\bgithub_pat_[A-Za-z0-9_]{20,}\b/iu,
+  /\bhc_[A-Za-z0-9][A-Za-z0-9_-]{10,}\b/iu,
+  /\bsk-proj[-_][A-Za-z0-9_-]{20,}\b/iu,
+  /\bsk-[A-Za-z0-9_-]{20,}\b/iu,
+  /\bxox[abp][_-][A-Za-z0-9-]{10,}(?:-[A-Za-z0-9-]{10,})*\b/iu,
+  /\bglpat-[A-Za-z0-9_-]{20,}\b/iu,
+  /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}\b/iu,
+  /\beyJ[A-Za-z0-9_-]{7,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/iu,
+  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/iu,
+  /(?:^|[^A-Za-z0-9-])(?:[A-Fa-f0-9]{32,})(?=$|[^A-Za-z0-9-])/u,
+  /(?:https?|ssh|git|ftp):\/\/[^/\s:@]+:[^/\s@]+@/iu
+]);
+var ENDPOINT_PROVIDER_PREFIX_PATTERN = /(?:hc[a-z0-9_-]*|gh[pousr]|github_pat|sk(?:-proj)?|xox[abp]|glpat)[_-][A-Za-z0-9_-]{10,}/iu;
+var ENDPOINT_BARE_HEX_PATTERN = /^[A-Fa-f0-9]{32,}$/u;
+var ENDPOINT_SECRET_ASSIGNMENT_PATTERN = /(?:(?:key|token|secret|password|authorization|credential|access|team|api[_-]?key)\s*[=:]|[=:]\s*(?:key|token|secret|password|authorization|credential|access|team|api[_-]?key))/iu;
+var ENDPOINT_LONG_TOKEN_PATTERN = /^[A-Za-z0-9._~+/-]{24,}$/u;
+var HIGH_ENTROPY_SINGLE_TOKEN_MIN_LENGTH2 = 32;
+var HIGH_ENTROPY_MIN_SHANNON2 = 3.5;
+var SAFE_HIGH_ENTROPY_KEY_PATTERN = /^(?:OTEL_EXPORTER_OTLP(?:_(?:TRACES|METRICS|LOGS))?_(?:ENDPOINT|HEADERS|PROTOCOL|TIMEOUT|COMPRESSION|INSECURE|CERTIFICATE)|FEATURE_FACTORY_OTEL_ENABLED)$/u;
+var ARRAY_INDEX_MAX = 2 ** 32 - 2;
+var REDACTED_VALUE = "[redacted]";
+var REDACTED_KEY = "[redacted-key]";
+var SCRUB_MARKERS = Object.freeze({
+  circular: "[circular]",
+  repeated: "[repeated]",
+  truncated: "[truncated]",
+  unsupported: "[unsupported]",
+  unavailable: "[unavailable]"
+});
+function isSensitiveKey(value, { mode = "baseline" } = {}) {
+  assertMode(mode);
+  if (typeof value !== "string") return false;
+  return BASELINE_SENSITIVE_KEY_PATTERN.test(value) || isSecretShapedKey(value, { mode });
+}
+function isSecretShapedKey(value, { mode = "baseline" } = {}) {
+  assertMode(mode);
+  if (typeof value !== "string") return false;
+  const trimmed = value.trim();
+  if (!trimmed || SAFE_HIGH_ENTROPY_KEY_PATTERN.test(trimmed)) return false;
+  return tokenShapedValue(trimmed) || credentialBearingUrl2(trimmed) || highEntropySingleToken2(trimmed) || mode === "endpoint" && endpointValueLooksSensitive(trimmed);
+}
+function isSensitiveValue(value, { mode = "baseline" } = {}) {
+  assertMode(mode);
+  if (typeof value !== "string") return false;
+  const trimmed = value.trim();
+  if (!trimmed) return false;
+  return FLATTENED_BASIC_HEADER_PATTERN.test(value) || BASELINE_SENSITIVE_VALUE_PATTERN.test(trimmed) || tokenShapedValue(trimmed) || credentialBearingUrl2(trimmed) || highEntropySingleToken2(trimmed) || mode === "endpoint" && endpointValueLooksSensitive(trimmed);
+}
+function scrubSensitiveString(value, { mode = "baseline" } = {}) {
+  assertMode(mode);
+  if (typeof value !== "string") return SCRUB_MARKERS.unsupported;
+  const flattenedCredentialsRedacted = value.replace(
+    FLATTENED_BASIC_HEADER_GLOBAL_PATTERN,
+    `$1$2${REDACTED_VALUE}`
+  );
+  return isSensitiveValue(flattenedCredentialsRedacted, { mode }) ? REDACTED_VALUE : flattenedCredentialsRedacted;
+}
+function scrubSensitiveData(value, {
+  mode = "baseline",
+  keyMode = "omit",
+  maxDepth = 32,
+  maxNodes = 1e4,
+  maxKeys = 1e4,
+  maxArrayLength = 1e4,
+  maxStringLength = 65536
+} = {}) {
+  assertMode(mode);
+  if (keyMode !== "omit" && keyMode !== "redact") throw new TypeError("invalid sensitive-data key mode");
+  assertBound("maxDepth", maxDepth);
+  assertBound("maxNodes", maxNodes);
+  assertBound("maxKeys", maxKeys);
+  assertBound("maxArrayLength", maxArrayLength, 2 ** 32 - 1, 1);
+  assertBound("maxStringLength", maxStringLength);
+  const state = {
+    mode,
+    keyMode,
+    maxDepth,
+    maxNodes,
+    maxKeys,
+    maxArrayLength,
+    maxStringLength,
+    nodes: 0,
+    keys: 0,
+    active: /* @__PURE__ */ new WeakSet(),
+    completed: /* @__PURE__ */ new WeakSet()
+  };
+  return scrubValue(value, 0, state).value;
+}
+function scrubValue(value, depth, state) {
+  if (state.nodes >= state.maxNodes) return { value: SCRUB_MARKERS.truncated, stop: true };
+  state.nodes += 1;
+  if (value === null || typeof value === "boolean") return { value, stop: false };
+  if (typeof value === "number") {
+    return { value: Number.isFinite(value) && !Object.is(value, -0) ? value : SCRUB_MARKERS.unsupported, stop: false };
+  }
+  if (typeof value === "string") {
+    if (value.length > state.maxStringLength) return { value: REDACTED_VALUE, stop: false };
+    return { value: scrubSensitiveString(value, { mode: state.mode }), stop: false };
+  }
+  if (typeof value !== "object") return { value: SCRUB_MARKERS.unsupported, stop: false };
+  let array;
+  let prototype;
+  try {
+    array = Array.isArray(value);
+    prototype = Object.getPrototypeOf(value);
+  } catch {
+    return { value: SCRUB_MARKERS.unavailable, stop: false };
+  }
+  if (array && prototype !== Array.prototype || !array && prototype !== Object.prototype && prototype !== null) {
+    return { value: SCRUB_MARKERS.unsupported, stop: false };
+  }
+  if (depth >= state.maxDepth) return { value: SCRUB_MARKERS.truncated, stop: false };
+  if (state.active.has(value)) return { value: SCRUB_MARKERS.circular, stop: false };
+  if (state.completed.has(value)) return { value: SCRUB_MARKERS.repeated, stop: false };
+  state.active.add(value);
+  let result2;
+  try {
+    result2 = array ? scrubArray(value, depth, state) : scrubObject(value, depth, state);
+  } catch {
+    result2 = { value: SCRUB_MARKERS.unavailable, stop: false };
+  }
+  state.active.delete(value);
+  state.completed.add(value);
+  return result2;
+}
+function scrubObject(source, depth, state) {
+  let keys;
+  try {
+    keys = Reflect.ownKeys(source);
+  } catch {
+    return { value: SCRUB_MARKERS.unavailable, stop: false };
+  }
+  const output = /* @__PURE__ */ Object.create(null);
+  return projectKeys(source, output, keys, depth, state, () => true);
+}
+function scrubArray(source, depth, state) {
+  let lengthDescriptor;
+  let keys;
+  try {
+    lengthDescriptor = Reflect.getOwnPropertyDescriptor(source, "length");
+    keys = Reflect.ownKeys(source);
+  } catch {
+    return { value: SCRUB_MARKERS.unavailable, stop: false };
+  }
+  if (!lengthDescriptor || !("value" in lengthDescriptor) || !Number.isInteger(lengthDescriptor.value) || lengthDescriptor.value < 0 || lengthDescriptor.value > 2 ** 32 - 1) {
+    return { value: SCRUB_MARKERS.unavailable, stop: false };
+  }
+  const sourceLength = lengthDescriptor.value;
+  const outputLength = Math.min(sourceLength, state.maxArrayLength);
+  const output = new Array(outputLength);
+  const overCap = sourceLength > state.maxArrayLength;
+  const forcedTruncationIndex = overCap && outputLength > 0 ? outputLength - 1 : -1;
+  if (forcedTruncationIndex >= 0) defineData(output, String(forcedTruncationIndex), SCRUB_MARKERS.truncated);
+  return projectKeys(source, output, keys, depth, state, (key) => {
+    if (key === "length") return false;
+    const index = arrayIndex(key);
+    if (index === null) return true;
+    if (index >= outputLength) return false;
+    return index !== forcedTruncationIndex;
+  });
+}
+function projectKeys(source, output, keys, depth, state, include) {
+  const prepared = prepareKeys(source, keys, state, include);
+  const allocated = new Set(prepared.reserved);
+  for (const item of prepared.items) {
+    const { key, sensitive, descriptor } = item;
+    if (state.keys >= state.maxKeys) {
+      addTruncationProperty(output, allocated);
+      return { value: output, stop: true };
+    }
+    state.keys += 1;
+    if (item.unavailable) {
+      if (state.keyMode === "omit" && sensitive) continue;
+      const outputKey = sensitive ? allocateName(REDACTED_KEY, allocated) : key;
+      defineData(output, outputKey, SCRUB_MARKERS.unavailable);
+      continue;
+    }
+    if (sensitive) {
+      if (state.keyMode === "redact") defineData(output, allocateName(REDACTED_KEY, allocated), REDACTED_VALUE);
+      continue;
+    }
+    if (!("value" in descriptor)) {
+      defineData(output, key, SCRUB_MARKERS.unavailable);
+      continue;
+    }
+    const scrubbed = scrubValue(descriptor.value, depth + 1, state);
+    defineData(output, key, scrubbed.value);
+    if (scrubbed.stop) return { value: output, stop: true };
+  }
+  if (prepared.truncated) {
+    addTruncationProperty(output, allocated);
+    return { value: output, stop: true };
+  }
+  return { value: output, stop: false };
+}
+function prepareKeys(source, keys, state, include) {
+  const items = [];
+  const reserved = /* @__PURE__ */ new Set();
+  const remaining = state.maxKeys - state.keys;
+  for (const key of keys) {
+    if (typeof key !== "string" || !include(key)) continue;
+    const sensitive = key.length > state.maxStringLength || isSensitiveKey(key, { mode: state.mode });
+    let descriptor;
+    try {
+      descriptor = Reflect.getOwnPropertyDescriptor(source, key);
+    } catch {
+      descriptor = null;
+    }
+    if (descriptor && descriptor.enumerable !== true) continue;
+    if (items.length >= remaining) return { items, reserved, truncated: true };
+    items.push({ key, sensitive, descriptor, unavailable: descriptor === null || descriptor === void 0 });
+    if (!sensitive) reserved.add(key);
+  }
+  return { items, reserved, truncated: false };
+}
+function addTruncationProperty(output, allocated) {
+  defineData(output, allocateName(SCRUB_MARKERS.truncated, allocated), SCRUB_MARKERS.truncated);
+}
+function allocateName(base, allocated) {
+  if (!allocated.has(base)) {
+    allocated.add(base);
+    return base;
+  }
+  for (let suffix = 2; ; suffix += 1) {
+    const candidate = `${base}#${suffix}`;
+    if (!allocated.has(candidate)) {
+      allocated.add(candidate);
+      return candidate;
+    }
+  }
+}
+function defineData(target, key, value) {
+  Object.defineProperty(target, key, {
+    value,
+    enumerable: true,
+    configurable: true,
+    writable: true
+  });
+}
+function arrayIndex(key) {
+  if (key === "") return null;
+  const number = Number(key);
+  if (!Number.isInteger(number) || number < 0 || number > ARRAY_INDEX_MAX || String(number) !== key) return null;
+  return number;
+}
+function endpointValueLooksSensitive(value) {
+  return ENDPOINT_PROVIDER_PREFIX_PATTERN.test(value) || ENDPOINT_BARE_HEX_PATTERN.test(value) || ENDPOINT_SECRET_ASSIGNMENT_PATTERN.test(value) || ENDPOINT_LONG_TOKEN_PATTERN.test(value) && mixedTokenChars(value);
+}
+function tokenShapedValue(value) {
+  return TOKEN_SHAPED_VALUE_PATTERNS.some((pattern) => pattern.test(value));
+}
+function credentialBearingUrl2(value) {
+  try {
+    const parsed = new URL(value);
+    return Boolean(parsed.username || parsed.password);
+  } catch {
+    return false;
+  }
+}
+function highEntropySingleToken2(value) {
+  if (value.length < HIGH_ENTROPY_SINGLE_TOKEN_MIN_LENGTH2 || /\s/u.test(value)) return false;
+  if (!/^[A-Za-z0-9._~+/=-]+$/u.test(value)) return false;
+  return shannonEntropy2(value) >= HIGH_ENTROPY_MIN_SHANNON2;
+}
+function shannonEntropy2(value) {
+  const counts = /* @__PURE__ */ new Map();
+  for (const character of value) counts.set(character, (counts.get(character) || 0) + 1);
+  let entropy = 0;
+  for (const count of counts.values()) {
+    const probability = count / value.length;
+    entropy -= probability * Math.log2(probability);
+  }
+  return entropy;
+}
+function mixedTokenChars(value) {
+  return /[A-Z]/u.test(value) && /[a-z]/u.test(value) && /[0-9]/u.test(value);
+}
+function assertMode(mode) {
+  if (mode !== "baseline" && mode !== "endpoint") throw new TypeError("invalid sensitive-data mode");
+}
+function assertBound(name, value, maximum = Number.MAX_SAFE_INTEGER, minimum = 0) {
+  if (!Number.isSafeInteger(value) || value < minimum || value > maximum) {
+    throw new TypeError(`invalid sensitive-data ${name}`);
+  }
+}
+
+// src/hardening/terminal-encoding.js
+var ASCII_IDENTITY_PROFILE = "ascii-identity";
+var UNICODE_PROSE_PROFILE = "unicode-prose";
+var SAFE_JSON_MESSAGE = "Value is not valid safe JSON data.";
+var UNICODE_PROSE_SCALAR = /^[\p{L}\p{M}\p{N}\p{P}\p{S}]$/u;
+var DEFAULT_IGNORABLE_SCALAR = /^\p{Default_Ignorable_Code_Point}$/u;
+var SafeJsonError = class extends Error {
+  constructor() {
+    super(SAFE_JSON_MESSAGE);
+    this.name = "SafeJsonError";
+  }
+};
+function encodeTerminalText(value, options = void 0) {
+  return encodeTerminalValue(value, readProfile(options, UNICODE_PROSE_PROFILE), false);
+}
+function serializeTerminalJson(value, options = void 0) {
+  try {
+    const space = readJsonSpace(options);
+    const clone = cloneJsonValue(value, /* @__PURE__ */ new WeakSet());
+    return escapeJsonTransport(JSON.stringify(clone, null, space));
+  } catch {
+    throw new SafeJsonError();
+  }
+}
+function readProfile(options, fallback) {
+  try {
+    if (options === void 0) return fallback;
+    if (options === null || typeof options !== "object" && typeof options !== "function") {
+      throw new TypeError();
+    }
+    const profile = options.profile === void 0 ? fallback : options.profile;
+    if (profile !== ASCII_IDENTITY_PROFILE && profile !== UNICODE_PROSE_PROFILE) {
+      throw new TypeError();
+    }
+    return profile;
+  } catch {
+    throw new TypeError("Invalid terminal encoding options.");
+  }
+}
+function encodeTerminalValue(value, profile, quoteIsReserved) {
+  let text;
+  try {
+    text = String(value);
+  } catch {
+    throw new TypeError("Terminal text encoding failed.");
+  }
+  let encoded = "";
+  for (let index = 0; index < text.length; ) {
+    const first = text.charCodeAt(index);
+    if (first === 92) {
+      encoded += "\\\\";
+      index += 1;
+      continue;
+    }
+    if (quoteIsReserved && first === 34) {
+      encoded += '\\"';
+      index += 1;
+      continue;
+    }
+    if (profile === ASCII_IDENTITY_PROFILE) {
+      encoded += first >= 32 && first <= 126 ? text[index] : unicodeEscape(first);
+      index += 1;
+      continue;
+    }
+    const second = text.charCodeAt(index + 1);
+    const isPair = first >= 55296 && first <= 56319 && second >= 56320 && second <= 57343;
+    if (isPair) {
+      const scalar2 = text.slice(index, index + 2);
+      encoded += isSafeUnicodeProseScalar(scalar2) ? scalar2 : `${unicodeEscape(first)}${unicodeEscape(second)}`;
+      index += 2;
+      continue;
+    }
+    const scalar = text[index];
+    encoded += isSafeUnicodeProseScalar(scalar) ? scalar : unicodeEscape(first);
+    index += 1;
+  }
+  return encoded;
+}
+function isSafeUnicodeProseScalar(scalar) {
+  if (scalar === " ") return true;
+  return UNICODE_PROSE_SCALAR.test(scalar) && !DEFAULT_IGNORABLE_SCALAR.test(scalar);
+}
+function unicodeEscape(codeUnit) {
+  return `\\u${codeUnit.toString(16).toUpperCase().padStart(4, "0")}`;
+}
+function readJsonSpace(options) {
+  if (options === void 0) return 0;
+  if (options === null || typeof options !== "object" && typeof options !== "function") failJson();
+  const space = options.space === void 0 ? 0 : options.space;
+  if (space !== 0 && space !== 2) failJson();
+  return space;
+}
+function cloneJsonValue(value, seen) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value) || Object.is(value, -0)) failJson();
+    return value;
+  }
+  if (typeof value !== "object") failJson();
+  if (seen.has(value)) failJson();
+  seen.add(value);
+  if (Array.isArray(value)) return cloneJsonArray(value, seen);
+  return cloneJsonObject(value, seen);
+}
+function cloneJsonArray(value, seen) {
+  if (Object.getPrototypeOf(value) !== Array.prototype) failJson();
+  const keys = Reflect.ownKeys(value);
+  const lengthDescriptor = Object.getOwnPropertyDescriptor(value, "length");
+  if (!isDataDescriptor(lengthDescriptor) || lengthDescriptor.enumerable || !Number.isInteger(lengthDescriptor.value) || lengthDescriptor.value < 0 || lengthDescriptor.value > 4294967295 || keys.length !== lengthDescriptor.value + 1) {
+    failJson();
+  }
+  const clone = [];
+  Object.setPrototypeOf(clone, null);
+  for (const key of keys) {
+    if (key === "length") continue;
+    if (typeof key !== "string" || !isArrayIndex(key, lengthDescriptor.value)) failJson();
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!isDataDescriptor(descriptor) || !descriptor.enumerable) failJson();
+    defineJsonProperty(clone, key, cloneJsonValue(descriptor.value, seen));
+  }
+  return clone;
+}
+function cloneJsonObject(value, seen) {
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) failJson();
+  const clone = /* @__PURE__ */ Object.create(null);
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string" || key === "toJSON") failJson();
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!isDataDescriptor(descriptor) || !descriptor.enumerable) failJson();
+    defineJsonProperty(clone, key, cloneJsonValue(descriptor.value, seen));
+  }
+  return clone;
+}
+function isDataDescriptor(descriptor) {
+  return descriptor !== void 0 && Object.hasOwn(descriptor, "value");
+}
+function isArrayIndex(key, length) {
+  if (key.length === 0) return false;
+  const index = Number(key);
+  return Number.isInteger(index) && index >= 0 && index < length && String(index) === key;
+}
+function defineJsonProperty(target, key, value) {
+  Object.defineProperty(target, key, {
+    value,
+    enumerable: true,
+    configurable: true,
+    writable: true
+  });
+}
+function escapeJsonTransport(serialized) {
+  let safe = "";
+  for (let index = 0; index < serialized.length; ) {
+    const first = serialized.charCodeAt(index);
+    if (first <= 126) {
+      safe += serialized[index];
+      index += 1;
+      continue;
+    }
+    const second = serialized.charCodeAt(index + 1);
+    const isPair = first >= 55296 && first <= 56319 && second >= 56320 && second <= 57343;
+    if (isPair) {
+      const scalar = serialized.slice(index, index + 2);
+      safe += isSafeUnicodeProseScalar(scalar) ? scalar : `${unicodeEscape(first)}${unicodeEscape(second)}`;
+      index += 2;
+      continue;
+    }
+    safe += isSafeUnicodeProseScalar(serialized[index]) ? serialized[index] : unicodeEscape(first);
+    index += 1;
+  }
+  return safe;
+}
+function failJson() {
+  throw new Error();
+}
+
+// src/hardening/output-policy.js
+var SAFE_OUTPUT_FALLBACK = "Output rendering failed safely.";
+var DIAGNOSTIC_FREEFORM_FIELDS = Object.freeze([
+  "error",
+  "message",
+  "reason",
+  "detail",
+  "summary",
+  "action"
+]);
+var OUTPUT_POLICY_ERROR_CODE = "ERR_OUTPUT_POLICY";
+var segmentBrand = /* @__PURE__ */ new WeakSet();
+var TRUSTED_FRAMING_TEXT = Object.freeze({
+  EMPTY: "",
+  SPACE: " ",
+  COLON_SPACE: ": ",
+  COMMA_SPACE: ", ",
+  DASH_SEPARATOR: " - ",
+  SLASH: "/",
+  EQUALS: "=",
+  TAB: "	",
+  LINE_FEED: "\n",
+  OPEN_PAREN: "(",
+  CLOSE_PAREN: ")",
+  OPEN_BRACKET: "[",
+  CLOSE_BRACKET: "]",
+  ERROR_PREFIX: "error: ",
+  WARNING_PREFIX: "warning: "
+});
+var TRUSTED_SEGMENTS = createTrustedSegments();
+var OutputPolicyError = class extends Error {
+  constructor(stage = "output") {
+    super(SAFE_OUTPUT_FALLBACK);
+    this.name = "OutputPolicyError";
+    this.code = OUTPUT_POLICY_ERROR_CODE;
+    this.stage = safeStage(stage);
+  }
+};
+function identitySegment(value) {
+  return makeSegment("identity", value);
+}
+function freeformSegment(value) {
+  return makeSegment("freeform", value);
+}
+function isOutputSegment(value) {
+  return (typeof value === "object" || typeof value === "function") && value !== null && segmentBrand.has(value);
+}
+function renderTerminalSegments(segments) {
+  try {
+    return normalizeSegments(segments).map(renderSegment).join("");
+  } catch (error) {
+    if (error instanceof OutputPolicyError) throw error;
+    fail2("render");
+  }
+}
+function renderTerminalSegmentsOrFallback(segments) {
+  try {
+    return renderTerminalSegments(segments);
+  } catch {
+    return SAFE_OUTPUT_FALLBACK;
+  }
+}
+function projectFreeformData(value) {
+  try {
+    return scrubSensitiveData(value, { mode: "baseline" });
+  } catch {
+    fail2("projection");
+  }
+}
+function projectDiagnosticData(value, options = void 0) {
+  try {
+    const policy = readDiagnosticPolicy(options);
+    return projectDiagnosticValue(value, policy, [], 0, createDiagnosticState(policy)).value;
+  } catch (error) {
+    if (error instanceof OutputPolicyError) throw error;
+    fail2("projection");
+  }
+}
+function makeSegment(kind, value) {
+  const segment = Object.freeze({ kind, value });
+  segmentBrand.add(segment);
+  return segment;
+}
+function createTrustedSegments() {
+  const output = /* @__PURE__ */ Object.create(null);
+  for (const name of Object.keys(TRUSTED_FRAMING_TEXT)) {
+    defineData2(output, name, makeSegment("trusted", TRUSTED_FRAMING_TEXT[name]));
+  }
+  return Object.freeze(output);
+}
+function renderSegment(segment) {
+  if (segment.kind === "trusted") return segment.value;
+  if (segment.kind === "identity") return encodeTerminalText(segment.value, { profile: "ascii-identity" });
+  const scrubbed = projectFreeformData(segment.value);
+  if (scrubbed !== null && typeof scrubbed === "object") return serializeTerminalJson(scrubbed);
+  return encodeTerminalText(scrubbed, { profile: "unicode-prose" });
+}
+function normalizeSegments(segments) {
+  try {
+    if (!Array.isArray(segments) || Object.getPrototypeOf(segments) !== Array.prototype) fail2("segment");
+    const keys = Reflect.ownKeys(segments);
+    const lengthDescriptor = Reflect.getOwnPropertyDescriptor(segments, "length");
+    if (!isDataDescriptor2(lengthDescriptor) || !Number.isSafeInteger(lengthDescriptor.value) || lengthDescriptor.value < 0 || keys.length !== lengthDescriptor.value + 1) fail2("segment");
+    const normalized = [];
+    for (let index = 0; index < lengthDescriptor.value; index += 1) {
+      const descriptor = Reflect.getOwnPropertyDescriptor(segments, String(index));
+      if (!isDataDescriptor2(descriptor) || descriptor.enumerable !== true || !isOutputSegment(descriptor.value)) fail2("segment");
+      normalized.push(descriptor.value);
+    }
+    return Object.freeze(normalized);
+  } catch (error) {
+    if (error instanceof OutputPolicyError) throw error;
+    fail2("segment");
+  }
+}
+function readDiagnosticPolicy(options) {
+  if (options === void 0) return defaultDiagnosticPolicy();
+  if (options === null || typeof options !== "object" && typeof options !== "function") fail2("projection");
+  const fields = options.freeformFields === void 0 ? DIAGNOSTIC_FREEFORM_FIELDS : options.freeformFields;
+  if (!Array.isArray(fields) || fields.some((field) => typeof field !== "string")) fail2("projection");
+  const paths = options.validatedIdentityPaths === void 0 ? [] : options.validatedIdentityPaths;
+  if (!Array.isArray(paths)) fail2("projection");
+  return {
+    freeformFields: new Set(fields),
+    validatedIdentityPaths: paths.map(readIdentityPath),
+    maxDepth: readDiagnosticBound(options, "maxDepth", 32),
+    maxNodes: readDiagnosticBound(options, "maxNodes", 1e4),
+    maxKeys: readDiagnosticBound(options, "maxKeys", 1e4),
+    maxArrayLength: readDiagnosticBound(options, "maxArrayLength", 1e4, 2 ** 32 - 1, 1),
+    maxStringLength: readDiagnosticBound(options, "maxStringLength", 65536)
+  };
+}
+function defaultDiagnosticPolicy() {
+  return {
+    freeformFields: new Set(DIAGNOSTIC_FREEFORM_FIELDS),
+    validatedIdentityPaths: [],
+    maxDepth: 32,
+    maxNodes: 1e4,
+    maxKeys: 1e4,
+    maxArrayLength: 1e4,
+    maxStringLength: 65536
+  };
+}
+function readDiagnosticBound(options, name, fallback, maximum = Number.MAX_SAFE_INTEGER, minimum = 0) {
+  const value = options[name] === void 0 ? fallback : options[name];
+  if (!Number.isSafeInteger(value) || value < minimum || value > maximum) fail2("projection");
+  return value;
+}
+function readIdentityPath(path) {
+  if (!Array.isArray(path) || path.length === 0) fail2("projection");
+  const normalized = [];
+  for (let index = 0; index < path.length; index += 1) {
+    const descriptor = Reflect.getOwnPropertyDescriptor(path, String(index));
+    if (!isDataDescriptor2(descriptor) || typeof descriptor.value !== "string" || descriptor.value.length === 0) fail2("projection");
+    normalized.push(descriptor.value);
+  }
+  if (Reflect.ownKeys(path).length !== path.length + 1) fail2("projection");
+  return Object.freeze(normalized);
+}
+function createDiagnosticState(policy) {
+  return { nodes: 0, keys: 0, active: /* @__PURE__ */ new WeakSet(), completed: /* @__PURE__ */ new WeakSet(), ...policy };
+}
+function projectDiagnosticValue(value, policy, path, depth, state) {
+  if (state.nodes >= state.maxNodes) return { value: SCRUB_MARKERS.truncated, stop: true };
+  state.nodes += 1;
+  if (isValidatedIdentityPath(policy.validatedIdentityPaths, path)) {
+    return { value: validatedIdentityScalar(value), stop: false };
+  }
+  if (value === null || typeof value === "boolean") return { value, stop: false };
+  if (typeof value === "string") {
+    return { value: value.length > state.maxStringLength ? REDACTED_VALUE : scrubSensitiveString(value, { mode: "baseline" }), stop: false };
+  }
+  if (typeof value === "number") {
+    return { value: Number.isFinite(value) && !Object.is(value, -0) ? value : SCRUB_MARKERS.unsupported, stop: false };
+  }
+  if (typeof value !== "object") return { value: SCRUB_MARKERS.unsupported, stop: false };
+  let array;
+  let prototype;
+  try {
+    array = Array.isArray(value);
+    prototype = Object.getPrototypeOf(value);
+  } catch {
+    return { value: SCRUB_MARKERS.unavailable, stop: false };
+  }
+  if (array && prototype !== Array.prototype || !array && prototype !== Object.prototype && prototype !== null) {
+    return { value: SCRUB_MARKERS.unsupported, stop: false };
+  }
+  if (depth >= state.maxDepth) return { value: SCRUB_MARKERS.truncated, stop: false };
+  if (state.active.has(value)) return { value: SCRUB_MARKERS.circular, stop: false };
+  if (state.completed.has(value)) return { value: SCRUB_MARKERS.repeated, stop: false };
+  state.active.add(value);
+  let result2;
+  try {
+    result2 = array ? projectDiagnosticArray(value, policy, path, depth, state) : projectDiagnosticObject(value, policy, path, depth, state);
+  } catch (error) {
+    if (error instanceof OutputPolicyError) throw error;
+    result2 = { value: SCRUB_MARKERS.unavailable, stop: false };
+  }
+  state.active.delete(value);
+  state.completed.add(value);
+  return result2;
+}
+function projectDiagnosticArray(value, policy, path, depth, state) {
+  let keys;
+  let lengthDescriptor;
+  try {
+    keys = Reflect.ownKeys(value);
+    lengthDescriptor = Reflect.getOwnPropertyDescriptor(value, "length");
+  } catch {
+    return { value: SCRUB_MARKERS.unavailable, stop: false };
+  }
+  if (!isDataDescriptor2(lengthDescriptor) || !Number.isInteger(lengthDescriptor.value) || lengthDescriptor.value < 0 || lengthDescriptor.value > 2 ** 32 - 1 || keys.length !== lengthDescriptor.value + 1) fail2("projection");
+  const sourceLength = lengthDescriptor.value;
+  const outputLength = Math.min(sourceLength, state.maxArrayLength);
+  const forcedTruncationIndex = sourceLength > state.maxArrayLength ? outputLength - 1 : -1;
+  const output = [];
+  for (let index = 0; index < outputLength; index += 1) {
+    if (index === forcedTruncationIndex) {
+      defineData2(output, String(index), SCRUB_MARKERS.truncated);
+      return { value: output, stop: false };
+    }
+    const descriptor = Reflect.getOwnPropertyDescriptor(value, String(index));
+    if (!isDataDescriptor2(descriptor) || descriptor.enumerable !== true) fail2("projection");
+    if (state.keys >= state.maxKeys) {
+      defineData2(output, String(index), SCRUB_MARKERS.truncated);
+      return { value: output, stop: true };
+    }
+    state.keys += 1;
+    const projected = projectDiagnosticValue(
+      descriptor.value,
+      policy,
+      [...path, String(index)],
+      depth + 1,
+      state
+    );
+    defineData2(output, String(index), projected.value);
+    if (projected.stop) return { value: output, stop: true };
+  }
+  return { value: output, stop: false };
+}
+function projectDiagnosticObject(value, policy, path, depth, state) {
+  let keys;
+  try {
+    keys = Reflect.ownKeys(value);
+  } catch {
+    return { value: SCRUB_MARKERS.unavailable, stop: false };
+  }
+  const output = /* @__PURE__ */ Object.create(null);
+  const allocated = /* @__PURE__ */ new Set();
+  for (const key of keys) {
+    if (typeof key !== "string") continue;
+    const classified = key.length > state.maxStringLength || isSensitiveKey(key, { mode: "baseline" });
+    let descriptor;
+    try {
+      descriptor = Reflect.getOwnPropertyDescriptor(value, key);
+    } catch {
+      descriptor = void 0;
+    }
+    if (descriptor && descriptor.enumerable !== true) continue;
+    if (state.keys >= state.maxKeys) {
+      addDiagnosticTruncation(output, allocated);
+      return { value: output, stop: true };
+    }
+    state.keys += 1;
+    if (classified) continue;
+    if (key === "toJSON") fail2("projection");
+    allocated.add(key);
+    if (!isDataDescriptor2(descriptor)) {
+      defineData2(output, key, SCRUB_MARKERS.unavailable);
+      continue;
+    }
+    const projected = projectDiagnosticValue(
+      descriptor.value,
+      policy,
+      [...path, key],
+      depth + 1,
+      state
+    );
+    defineData2(output, key, projected.value);
+    if (projected.stop) return { value: output, stop: true };
+  }
+  return { value: output, stop: false };
+}
+function addDiagnosticTruncation(output, allocated) {
+  let key = SCRUB_MARKERS.truncated;
+  for (let suffix = 2; allocated.has(key); suffix += 1) key = `${SCRUB_MARKERS.truncated}#${suffix}`;
+  defineData2(output, key, SCRUB_MARKERS.truncated);
+}
+function validatedIdentityScalar(value) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number" && Number.isFinite(value) && !Object.is(value, -0)) return value;
+  fail2("projection");
+}
+function isValidatedIdentityPath(patterns, path) {
+  return patterns.some((pattern) => pattern.length === path.length && pathMatches(pattern, path));
+}
+function pathMatches(pattern, path) {
+  return pattern.every((part, index) => part === "*" || part === path[index]);
+}
+function isDataDescriptor2(descriptor) {
+  return descriptor !== void 0 && Object.hasOwn(descriptor, "value");
+}
+function defineData2(target, key, value) {
+  Object.defineProperty(target, key, { value, enumerable: true, configurable: true, writable: true });
+}
+function safeStage(stage) {
+  return ["segment", "render", "projection", "error", "output"].includes(stage) ? stage : "output";
+}
+function fail2(stage) {
+  throw new OutputPolicyError(stage);
+}
+
+// src/factory-diagnostics.js
+var DIAGNOSTIC_SCHEMA_VERSION = 1;
+var HEARTBEAT_FILE = "heartbeat.json";
+var DEFAULT_HEARTBEAT_INTERVAL_MS = 3e4;
+var MIN_STALE_HEARTBEAT_MS = 12e4;
+var CONDITIONS = Object.freeze([
+  Object.freeze({ condition: "invalid-run-state", classification: "invalid", severity: "critical", status: "error", message: "Factory run state is invalid or cannot be parsed.", action: "Treat the run as untrusted until run.json and required sidecars validate." }),
+  Object.freeze({ condition: "missing-worktree", classification: "blocked", severity: "error", status: "error", message: "A recorded worktree path is missing or inaccessible.", action: "Restore the worktree or complete cleanup/recovery from durable state." }),
+  Object.freeze({ condition: "missing-heartbeat-process", classification: "recoverable", severity: "warning", status: "warning", message: "The heartbeat helper process recorded in heartbeat.json is not alive.", action: "Inspect the run log and validate durable state before resuming; do not infer run failure from PID liveness alone." }),
+  Object.freeze({ condition: "stale-heartbeat", classification: "recoverable", severity: "warning", status: "warning", message: "Heartbeat has not advanced within the stale threshold.", action: "Inspect the run log and validate durable state before resuming; do not restart blindly." }),
+  Object.freeze({ condition: "protected-gate", classification: "needs-human", severity: "warning", status: "warning", message: "Run is waiting at a protected human gate.", action: "Answer the pending protected gate or stop the run; heartbeat liveness alarms are suppressed while waiting." }),
+  Object.freeze({ condition: "terminal-run", classification: "terminal", severity: "info", status: "ok", message: "Run is terminal.", action: "Read terminal_result for the durable outcome." })
+]);
+var DIAGNOSTIC_CONDITIONS = Object.freeze(CONDITIONS.map((item) => item.condition));
+var DIAGNOSTIC_CLASSIFICATIONS = Object.freeze(["healthy", "recoverable", "blocked", "needs-human", "terminal", "invalid"]);
+var DIAGNOSTIC_STATUSES = Object.freeze(["ok", "warning", "error"]);
+var DIAGNOSTIC_SEVERITIES = Object.freeze(["info", "warning", "error", "critical"]);
+var CONDITION_BY_NAME = new Map(CONDITIONS.map((item, index) => [item.condition, { ...item, index }]));
+var TERMINAL_OVERRIDES = Object.freeze({
+  completed: Object.freeze({ classification: "terminal", severity: "info", status: "ok" }),
+  partial: Object.freeze({ classification: "terminal", severity: "info", status: "ok" }),
+  blocked: Object.freeze({ classification: "blocked", severity: "error", status: "error" }),
+  "needs-human": Object.freeze({ classification: "needs-human", severity: "warning", status: "warning" })
+});
+var TERMINAL_STATUSES2 = new Set(TERMINAL_RUN_STATUSES);
+var DIAGNOSTIC_IDENTITY_FIELDS = Object.freeze({
+  status: new Set(DIAGNOSTIC_STATUSES),
+  severity: new Set(DIAGNOSTIC_SEVERITIES),
+  classification: new Set(DIAGNOSTIC_CLASSIFICATIONS),
+  condition: new Set(DIAGNOSTIC_CONDITIONS)
+});
+function diagnoseRunFile(runFile, options = {}) {
+  const runDir = options.runDir || dirname3(runFile);
+  const checkedAt = timestamp(options.now);
+  let raw;
+  try {
+    raw = readFileSync(runFile, "utf8");
+  } catch (error) {
+    return diagnosticEnvelope([
+      diagnosticItem("invalid-run-state", {
+        checkedAt,
+        authoritative: false,
+        message: `Factory run state is unavailable: ${error.message}`,
+        evidence: { source: "run.json", run_dir: runDir, run_path: runFile, error: error.message }
+      })
+    ], { checkedAt, authoritative: false });
+  }
+  try {
+    return diagnoseRunObject(JSON.parse(raw), { ...options, runDir, runFile, checkedAt });
+  } catch (error) {
+    return diagnosticEnvelope([
+      diagnosticItem("invalid-run-state", {
+        checkedAt,
+        authoritative: false,
+        message: `Factory run state is invalid: ${error.message}`,
+        evidence: { source: "run.json", run_dir: runDir, run_path: runFile, error: error.message }
+      })
+    ], { checkedAt, authoritative: false });
+  }
+}
+function diagnoseRunObject(input, options = {}) {
+  const checkedAt = options.checkedAt || timestamp(options.now);
+  const runDir = options.runDir || null;
+  const runFile = options.runFile || (runDir ? join5(runDir, "run.json") : null);
+  const items = [];
+  let run;
+  try {
+    run = validateRun(input);
+  } catch (error) {
+    return diagnosticEnvelope([
+      diagnosticItem("invalid-run-state", {
+        checkedAt,
+        authoritative: false,
+        message: `Factory run state is invalid: ${error.message}`,
+        evidence: { source: "run.json", run_dir: runDir, run_path: runFile, error: error.message }
+      })
+    ], { checkedAt, authoritative: false });
+  }
+  const invalidSidecar = runDir ? inspectSidecars(runDir, checkedAt, run) : null;
+  if (invalidSidecar) {
+    return diagnosticEnvelope([invalidSidecar], { checkedAt, authoritative: false });
+  }
+  const terminal = TERMINAL_STATUSES2.has(run.status);
+  const authoritative = Boolean(runDir);
+  const protectedGate = pendingProtectedGate(run);
+  if (terminal) {
+    items.push(terminalRunItem(run, { checkedAt, runDir, runFile, authoritative }));
+    return diagnosticEnvelope(items, { checkedAt, authoritative });
+  }
+  if (protectedGate) {
+    items.push(diagnosticItem("protected-gate", {
+      checkedAt,
+      authoritative,
+      message: `Run is waiting at protected gate '${protectedGate}'.`,
+      evidence: { source: "run.json", run_dir: runDir, run_path: runFile, gate: protectedGate }
+    }));
+  } else if (hasInFlightHeartbeatWork(run)) {
+    const heartbeat = inspectHeartbeat(run, { ...options, checkedAt, runDir });
+    if (heartbeat.invalid) {
+      items.push(diagnosticItem("invalid-run-state", {
+        checkedAt,
+        authoritative: false,
+        message: `Heartbeat state is invalid: ${heartbeat.error}`,
+        evidence: { source: "heartbeat.json", run_dir: runDir, heartbeat_path: heartbeat.path, error: heartbeat.error }
+      }));
+    } else {
+      if (heartbeat.missingProcess) items.push(heartbeat.missingProcess);
+      if (heartbeat.stale) items.push(heartbeat.stale);
+    }
+  }
+  const missingWorktree = inspectWorktree(run, { ...options, checkedAt, runDir, authoritative });
+  if (missingWorktree) items.push(missingWorktree);
+  return diagnosticEnvelope(items, { checkedAt, authoritative });
+}
+function diagnosticEnvelope(items = [], options = {}) {
+  const checkedAt = options.checkedAt || timestamp(options.now);
+  const normalized = items.map((item) => normalizeDiagnosticItem(item, checkedAt));
+  const aggregate = aggregateDiagnostics(normalized);
+  const envelope = {
+    schema_version: DIAGNOSTIC_SCHEMA_VERSION,
+    checked_at: checkedAt,
+    authoritative: Boolean(options.authoritative) && aggregate.classification !== "invalid",
+    status: aggregate.status,
+    severity: aggregate.severity,
+    classification: aggregate.classification,
+    summary: aggregate.summary,
+    items: normalized
+  };
+  return plainDiagnosticProjection(projectDiagnosticData(envelope, {
+    validatedIdentityPaths: validatedDiagnosticIdentityPaths(envelope)
+  }));
+}
+function aggregateDiagnostics(items = []) {
+  if (!items.length) {
+    return { classification: "healthy", status: "ok", severity: "info", summary: "No diagnostics", primary: null };
+  }
+  const primary = items.map((item, index) => ({ item, index })).sort((left, right) => conditionOrder(left.item.condition) - conditionOrder(right.item.condition) || left.index - right.index)[0].item;
+  return {
+    classification: primary.classification,
+    status: primary.status,
+    severity: primary.severity,
+    summary: primary.message,
+    primary
+  };
+}
+function diagnosticItem(condition, options = {}) {
+  const definition = condition === "terminal-run" ? terminalDefinition(options.terminalStatus) : CONDITION_BY_NAME.get(condition);
+  if (!definition) throw new Error(`unknown diagnostic condition: ${condition}`);
+  const checkedAt = options.checkedAt || timestamp(options.now);
+  return normalizeDiagnosticItem({
+    condition,
+    classification: definition.classification,
+    severity: definition.severity,
+    status: definition.status,
+    message: options.message || definition.message,
+    action: options.action || definition.action || terminalAction(options.terminalStatus),
+    authoritative: Boolean(options.authoritative),
+    checked_at: checkedAt,
+    evidence: options.evidence || {}
+  }, checkedAt);
+}
+function normalizeDiagnosticItem(item, checkedAt) {
+  return {
+    condition: item.condition,
+    classification: item.classification,
+    severity: item.severity,
+    status: item.status,
+    message: item.message,
+    action: item.action,
+    authoritative: Boolean(item.authoritative),
+    checked_at: item.checked_at || checkedAt,
+    evidence: item.evidence && typeof item.evidence === "object" && !Array.isArray(item.evidence) ? item.evidence : {}
+  };
+}
+function terminalRunItem(run, options) {
+  return diagnosticItem("terminal-run", {
+    ...options,
+    terminalStatus: run.status,
+    message: terminalMessage(run.status),
+    evidence: { source: "run.json", run_dir: options.runDir, run_path: options.runFile, run_status: run.status }
+  });
+}
+function inspectSidecars(runDir, checkedAt, run) {
+  const checks = [
+    { path: join5(runDir, HEARTBEAT_FILE), source: HEARTBEAT_FILE, validator: validateHeartbeatState },
+    { path: join5(runDir, "factory.lock"), source: "factory.lock", validator: validateFactoryLock },
+    { path: join5(runDir, PROCESS_EVIDENCE_FILE), source: PROCESS_EVIDENCE_FILE, validator: (value) => validateProcessSidecar(value, { runDir, runId: run.run_id }), failClosed: true },
+    { path: join5(runDir, "plan", "slices.json"), source: "plan/slices.json", validator: (value) => validateSlicesPlan(value, { enforceDependencyDepth: !runSlicesMatchPlan(run, value) }) }
+  ];
+  for (const check of checks) {
+    if (!existsSync2(check.path)) continue;
+    let parsed = null;
+    try {
+      parsed = JSON.parse(readFileSync(check.path, "utf8"));
+      const sidecar = check.validator(parsed);
+      if ((check.source === HEARTBEAT_FILE || check.source === "factory.lock") && sidecar.run_id !== run.run_id) {
+        return diagnosticItem("invalid-run-state", {
+          checkedAt,
+          authoritative: false,
+          message: `Factory sidecar state contradicts run.json: ${check.source}.run_id does not match run.run_id.`,
+          evidence: {
+            source: check.source,
+            run_dir: runDir,
+            path: check.path,
+            error: `${check.source}.run_id does not match run.run_id`,
+            run_id: run.run_id,
+            sidecar_run_id: sidecar.run_id
+          }
+        });
+      }
+    } catch (error) {
+      const failClosed = Boolean(check.failClosed);
+      return diagnosticItem("invalid-run-state", {
+        checkedAt,
+        authoritative: false,
+        message: failClosed ? `Factory process sidecar state is invalid; cancellation must fail closed: ${error.message}` : `Factory sidecar state is invalid: ${error.message}`,
+        action: failClosed ? "Treat process evidence as untrusted; do not signal any process until the sidecar is repaired or manually verified." : void 0,
+        evidence: {
+          source: check.source,
+          run_dir: runDir,
+          path: check.path,
+          error: error.message,
+          ...failClosed ? { fail_closed: true, sidecar_run_id: parsed?.run_id || null } : {}
+        }
+      });
+    }
+  }
+  return null;
+}
+function inspectHeartbeat(run, options) {
+  const checkedAt = options.checkedAt;
+  const runDir = options.runDir;
+  const heartbeatPath = runDir ? join5(runDir, HEARTBEAT_FILE) : null;
+  const nowMs = Date.parse(checkedAt);
+  let heartbeat = null;
+  let source = "run.json";
+  if (heartbeatPath && existsSync2(heartbeatPath)) {
+    try {
+      heartbeat = validateHeartbeatState(JSON.parse(readFileSync(heartbeatPath, "utf8")));
+      if (heartbeat.run_id !== run.run_id) {
+        return { invalid: true, error: "heartbeat.run_id does not match run.run_id", path: heartbeatPath };
+      }
+      source = "heartbeat.json";
+    } catch (error) {
+      return { invalid: true, error: error.message, path: heartbeatPath };
+    }
+  }
+  const lastTickAt = heartbeat?.last_tick_at || run.heartbeat_at || null;
+  const intervalMs = positiveInteger(heartbeat?.interval_ms) || DEFAULT_HEARTBEAT_INTERVAL_MS;
+  const staleMs = Math.max(2 * intervalMs, MIN_STALE_HEARTBEAT_MS);
+  const lastTickMs = Date.parse(lastTickAt || "");
+  const ageMs = Number.isFinite(nowMs) && Number.isFinite(lastTickMs) ? Math.max(0, nowMs - lastTickMs) : null;
+  const evidence = {
+    source,
+    liveness_only: true,
+    run_dir: runDir,
+    heartbeat_path: heartbeatPath,
+    heartbeat_phase: heartbeat?.phase || null,
+    pid: heartbeat?.pid || null,
+    process_alive: null,
+    last_tick_at: lastTickAt,
+    interval_ms: intervalMs,
+    stale_after: Number.isFinite(lastTickMs) ? new Date(lastTickMs + staleMs).toISOString() : null,
+    age_ms: ageMs
+  };
+  const result2 = {};
+  if (heartbeat) {
+    const liveness = processLiveness(heartbeat.pid, options);
+    evidence.process_alive = publicLivenessBoolean(liveness);
+    if (liveness === "absent") result2.missingProcess = diagnosticItem("missing-heartbeat-process", {
+      checkedAt,
+      authoritative: false,
+      evidence: { ...evidence }
+    });
+  }
+  if (ageMs !== null && ageMs > staleMs) {
+    result2.stale = diagnosticItem("stale-heartbeat", {
+      checkedAt,
+      authoritative: false,
+      evidence
+    });
+  }
+  return result2;
+}
+function inspectWorktree(run, options) {
+  if (!stringValue2(run.worktree)) return null;
+  const repoRoot = options.repoRoot || options.cwd || process.cwd();
+  const worktree = isAbsolute3(run.worktree) ? run.worktree : resolve4(repoRoot, run.worktree);
+  try {
+    const physical = realpath(options, worktree);
+    if (!statSync(physical).isDirectory()) throw new Error(`worktree is not a directory: ${worktree}`);
+    return null;
+  } catch (error) {
+    return diagnosticItem("missing-worktree", {
+      checkedAt: options.checkedAt,
+      authoritative: options.authoritative,
+      evidence: {
+        source: "filesystem",
+        run_dir: options.runDir,
+        worktree,
+        error: error.message
+      }
+    });
+  }
+}
+function processLiveness(pid, options = {}) {
+  if (typeof options.processAliveFn === "function") {
+    return probeLegacyBooleanLiveness(options.processAliveFn, pid);
+  }
+  return probeProcessLiveness(pid, options).status;
+}
+function validatedDiagnosticIdentityPaths(envelope) {
+  const paths = [];
+  for (const field of ["status", "severity", "classification"]) {
+    if (DIAGNOSTIC_IDENTITY_FIELDS[field].has(envelope[field])) paths.push([field]);
+  }
+  for (let index = 0; index < envelope.items.length; index += 1) {
+    const item = envelope.items[index];
+    for (const field of ["condition", "status", "severity", "classification"]) {
+      if (DIAGNOSTIC_IDENTITY_FIELDS[field].has(item[field])) paths.push(["items", String(index), field]);
+    }
+  }
+  return paths;
+}
+function plainDiagnosticProjection(value) {
+  if (Array.isArray(value)) return value.map(plainDiagnosticProjection);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, plainDiagnosticProjection(item)]));
+  }
+  return value;
+}
+function realpath(options, path) {
+  if (typeof options.realpathFn === "function") return options.realpathFn(path);
+  return physicalPath(path, "worktree", { mustExist: true });
+}
+function terminalDefinition(status) {
+  return { ...CONDITION_BY_NAME.get("terminal-run"), ...TERMINAL_OVERRIDES[status] || TERMINAL_OVERRIDES.completed };
+}
+function terminalMessage(status) {
+  if (status === "completed") return "Run completed.";
+  if (status === "partial") return "Run ended with a partial result.";
+  if (status === "blocked") return "Run ended blocked.";
+  if (status === "needs-human") return "Run is terminal and needs human attention.";
+  return "Run is terminal.";
+}
+function terminalAction(status) {
+  if (status === "completed" || status === "partial") return "No liveness action is required.";
+  if (status === "blocked") return "Inspect the terminal result and resolve the blocker before attempting follow-up work.";
+  return "Inspect the terminal result and provide the required human input.";
+}
+function conditionOrder(condition) {
+  return CONDITION_BY_NAME.get(condition)?.index ?? Number.MAX_SAFE_INTEGER;
+}
+function positiveInteger(value) {
+  return Number.isInteger(value) && value > 0 ? value : null;
+}
+function stringValue2(value) {
+  return typeof value === "string" && value.trim().length > 0;
+}
+
+// src/tui-data.js
+var SKIP_DIRS = /* @__PURE__ */ new Set([".git", "node_modules", "dist", "coverage", ".cache", ".next"]);
+var MAX_SCAN_DIRS = 2e3;
+var MAX_DIAGNOSTIC_SUMMARY = 180;
+var ROOT_CACHE_TTL_MS = 3e4;
+var FAIL_CLOSED_CONDITIONS = /* @__PURE__ */ new Set(["invalid-run-state"]);
+var DIAGNOSTIC_IDENTITIES = Object.freeze({
+  condition: new Set(DIAGNOSTIC_CONDITIONS),
+  classification: new Set(DIAGNOSTIC_CLASSIFICATIONS),
+  severity: new Set(DIAGNOSTIC_SEVERITIES),
+  status: new Set(DIAGNOSTIC_STATUSES)
+});
+var rootCache = /* @__PURE__ */ new Map();
+function factoryRoots(api, options = {}) {
+  const starts = tuiStartPaths(api);
+  const cacheKey = starts.map((start) => resolve5(start)).join("\0");
+  const now = Date.now();
+  const cached = rootCache.get(cacheKey);
+  if (!options.noCache && !options.notes && cached && cached.expiresAt > now && cached.roots.some((root3) => existsSync3(root3))) return cached.roots;
+  const roots = /* @__PURE__ */ new Set();
+  for (const start of starts) {
+    for (const root3 of findFactoryRoots(start, options)) roots.add(root3);
+  }
+  const sorted = [...roots].sort();
+  if (!options.noCache) rootCache.set(cacheKey, { expiresAt: now + ROOT_CACHE_TTL_MS, roots: sorted });
+  return sorted;
+}
+function tuiStartPaths(api) {
+  const path = api?.state?.path;
+  const starts = [path?.worktree, path?.directory].filter(isUsablePath);
+  if (starts.length) return [...new Set(starts)];
+  const cwd = typeof process.cwd === "function" ? process.cwd() : null;
+  return isUsablePath(cwd) ? [cwd] : [];
+}
+function isUsablePath(value) {
+  if (typeof value !== "string" || value.trim().length === 0) return false;
+  const resolved = resolve5(value);
+  return dirname4(resolved) !== resolved;
+}
+function readRuns(roots, options = {}) {
+  return roots.flatMap((root3) => readRootRuns(root3, options)).sort(compareRunRows);
+}
+function runHasNonOkDiagnostic(run) {
+  return Boolean(run?.diagnostic_status && run.diagnostic_status !== "ok");
+}
+function selectVisibleRuns(runs) {
+  const rows = Array.isArray(runs) ? runs : [];
+  const list = rows.filter((run) => run?.status !== "completed" || runHasNonOkDiagnostic(run));
+  const latestCompleted = rows.find((run) => run?.status === "completed");
+  if (latestCompleted && !list.some((run) => run.run_id === latestCompleted.run_id)) return [...list, latestCompleted];
+  return list;
+}
+function findFactoryRoots(start, options = {}) {
+  if (!isUsablePath(start)) return [];
+  const dir = resolve5(start);
+  const roots = /* @__PURE__ */ new Set();
+  const nearest = findNearestFactoryRoot(dir);
+  if (nearest) roots.add(nearest);
+  for (const root3 of findNestedFactoryRoots(dir, options)) roots.add(root3);
+  if (!roots.size) roots.add(join6(dir, ".opencode", "factory"));
+  return [...roots];
+}
+function findNearestFactoryRoot(start) {
+  let dir = resolve5(start);
+  while (true) {
+    const candidate = join6(dir, ".opencode", "factory");
+    if (existsSync3(candidate)) return candidate;
+    const parent = dirname4(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function findNestedFactoryRoots(start, options = {}) {
+  const roots = [];
+  const queue = [resolve5(start)];
+  const maxScanDirs = Number.isInteger(options.maxScanDirs) && options.maxScanDirs > 0 ? options.maxScanDirs : MAX_SCAN_DIRS;
+  let scanned = 0;
+  while (queue.length && scanned < maxScanDirs) {
+    const dir = queue.shift();
+    scanned += 1;
+    const candidate = join6(dir, ".opencode", "factory");
+    if (existsSync3(candidate)) roots.push(candidate);
+    for (const child of safeReadDir(dir)) {
+      if (SKIP_DIRS.has(child.name)) continue;
+      const path = join6(dir, child.name);
+      if (child.isDirectory()) queue.push(path);
+    }
+  }
+  if (queue.length && Array.isArray(options.notes)) {
+    options.notes.push({ type: "scan-truncated", start: resolve5(start), scanned, remaining: queue.length, max_scan_dirs: maxScanDirs });
+  }
+  return roots;
+}
+function compareRunRows(a, b) {
+  return Number(isInvalidRow(b)) - Number(isInvalidRow(a)) || String(b.updated_at || "").localeCompare(String(a.updated_at || "")) || String(b.run_id || "").localeCompare(String(a.run_id || ""));
+}
+function isInvalidRow(row) {
+  return row?.status === "invalid" || row?.diagnostic_classification === "invalid";
+}
+function safeReadDir(dir) {
+  try {
+    return readdirSync(dir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+}
+function readRootRuns(root3, options = {}) {
+  if (!root3 || !existsSync3(root3)) return [];
+  const repoRoot = dirname4(dirname4(root3));
+  return readdirSync(root3).flatMap((runID) => {
+    const file = join6(root3, runID, "run.json");
+    if (!existsSync3(file) || !statSync2(file).isFile()) return [];
+    try {
+      const run = JSON.parse(readFileSync2(file, "utf8"));
+      const diagnostics = options.diagnostics === false ? healthyDiagnostics() : safeDiagnoseRunObject(run, file, { repoRoot });
+      if (shouldUseFallbackRow(diagnostics)) return [fallbackRun(runID, file, diagnostics)];
+      return [summarize(run, runID, file, diagnostics)];
+    } catch (error) {
+      const diagnostics = options.diagnostics === false ? parseErrorDiagnostics(file, error) : safeDiagnoseRunFile(file, { repoRoot });
+      return [fallbackRun(runID, file, diagnostics)];
+    }
+  });
+}
+function parseErrorDiagnostics(file, error) {
+  const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+  return diagnosticEnvelope([
+    diagnosticItem("invalid-run-state", {
+      checkedAt,
+      authoritative: false,
+      message: `Factory run JSON could not be parsed: ${error.message}`,
+      evidence: { source: "tui-data", run_path: file, error: error.message }
+    })
+  ], { checkedAt, authoritative: false });
+}
+function summarize(run, fallbackID, file, diagnostics = healthyDiagnostics()) {
+  return {
+    run_id: projectFreeformText(run.run_id || fallbackID),
+    status: projectFreeformText(run.status || "unknown"),
+    mode: projectOptionalFreeformText(run.mode),
+    gate: projectOptionalFreeformText(pendingGate(run)),
+    branch: projectOptionalFreeformText(run.branch),
+    pr_url: projectOptionalFreeformText(run.pr_url),
+    review_tier: projectOptionalFreeformText(stringOrNull(run.review_tier)),
+    review_tier_source: null,
+    updated_at: projectOptionalFreeformText(run.updated_at),
+    current: projectOptionalFreeformText(currentSummary(run)),
+    steering: steeringSummary(run),
+    cost: costSummary(run.cost_attribution),
+    slices: sliceSummary(run),
+    panel: projectOptionalFreeformText(panelSummary(run)),
+    terminal_reason: projectOptionalFreeformText(run.terminal_result?.reason),
+    file: projectFreeformText(file),
+    run_dir: projectFreeformText(dirname4(file)),
+    ...diagnosticSummary(diagnostics)
+  };
+}
+function fallbackRun(fallbackID, file, diagnostics) {
+  return {
+    run_id: projectFreeformText(fallbackID),
+    status: "invalid",
+    mode: null,
+    gate: null,
+    branch: null,
+    pr_url: null,
+    review_tier: null,
+    review_tier_source: null,
+    updated_at: null,
+    current: null,
+    steering: null,
+    cost: null,
+    slices: null,
+    panel: null,
+    terminal_reason: null,
+    file: projectFreeformText(file),
+    run_dir: projectFreeformText(dirname4(file)),
+    ...diagnosticSummary(diagnostics)
+  };
+}
+function shouldUseFallbackRow(diagnostics) {
+  return Array.isArray(diagnostics?.items) && diagnostics.items.some((item) => FAIL_CLOSED_CONDITIONS.has(item?.condition));
+}
+function safeDiagnoseRunFile(file, options) {
+  try {
+    return diagnoseRunFile(file, options);
+  } catch (error) {
+    const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+    return diagnosticEnvelope([
+      diagnosticItem("invalid-run-state", {
+        checkedAt,
+        authoritative: false,
+        message: `Factory diagnostics failed: ${error.message}`,
+        evidence: { source: "tui-data", run_path: file, error: error.message }
+      })
+    ], { checkedAt, authoritative: false });
+  }
+}
+function safeDiagnoseRunObject(run, file, options) {
+  try {
+    return diagnoseRunObject(run, { ...options, runDir: dirname4(file), runFile: file });
+  } catch (error) {
+    const checkedAt = (/* @__PURE__ */ new Date()).toISOString();
+    return diagnosticEnvelope([
+      diagnosticItem("invalid-run-state", {
+        checkedAt,
+        authoritative: false,
+        message: `Factory diagnostics failed: ${error.message}`,
+        evidence: { source: "tui-data", run_path: file, error: error.message }
+      })
+    ], { checkedAt, authoritative: false });
+  }
+}
+function diagnosticSummary(diagnostics) {
+  const envelope = projectTuiDiagnosticData(diagnostics || healthyDiagnostics());
+  return {
+    diagnostics: envelope,
+    diagnostic_status: stringOrDefault(envelope.status, "ok"),
+    diagnostic_severity: stringOrDefault(envelope.severity, "info"),
+    diagnostic_classification: stringOrDefault(envelope.classification, "healthy"),
+    diagnostic_summary: truncateDiagnosticSummary(stringOrDefault(envelope.summary, "No diagnostics"))
+  };
+}
+function projectTuiDiagnosticData(diagnostics) {
+  return terminalSafeProjection(plainProjection(projectDiagnosticData(diagnostics, {
+    validatedIdentityPaths: validatedDiagnosticIdentityPaths2(diagnostics)
+  })));
+}
+function healthyDiagnostics() {
+  return diagnosticEnvelope([], { authoritative: true });
+}
+function truncateDiagnosticSummary(value) {
+  const text = String(value || "");
+  if (text.length <= MAX_DIAGNOSTIC_SUMMARY) return text;
+  return `${text.slice(0, MAX_DIAGNOSTIC_SUMMARY - 3)}...`;
+}
+function pendingGate(run) {
+  for (const [name, gate] of Object.entries(run.gates || {})) {
+    if (gate?.status === "pending") return name;
+  }
+  return null;
+}
+function sliceSummary(run) {
+  const slices = Array.isArray(run.slices) ? run.slices : [];
+  if (!slices.length) return null;
+  return {
+    merged: slices.filter((item) => item?.status === "merged").length,
+    blocked: slices.filter((item) => item?.status === "blocked").length,
+    total: slices.length
+  };
+}
+function currentSummary(run) {
+  const activeSlice = firstByStatus(run.slices, ["running", "review"]);
+  if (activeSlice) return summarizeWorkItem(activeSlice.id, activeSlice.status, activeSlice.attempts);
+  const activeStep = firstByStatus(run.steps, ["running", "review"]);
+  if (activeStep) return summarizeWorkItem(activeStep.agent, activeStep.status, activeStep.attempts);
+  const blockedSlice = firstByStatus(run.slices, ["blocked"]);
+  if (blockedSlice) return summarizeWorkItem(blockedSlice.id, blockedSlice.status, blockedSlice.attempts);
+  const step = firstByStatus(run.steps, ["blocked", "pending"]);
+  if (step) return summarizeWorkItem(step.agent, step.status, step.attempts);
+  const panel = inferredPrePrPanelSummary(run);
+  if (panel) return panel;
+  return null;
+}
+function steeringSummary(run) {
+  const steering = run?.steering;
+  if (!steering || typeof steering !== "object" || Array.isArray(steering)) return { pending: null, uncheckpointed: null, consumed_count: 0, latest_consumed: null, boundary: null, action_claim: null, last_action: null, pr_fence: null };
+  const pending = steering.pending && typeof steering.pending === "object" && !Array.isArray(steering.pending) ? {
+    id: projectOptionalFreeformText(stringOrNull(steering.pending.id)),
+    ref: projectOptionalFreeformText(stringOrNull(steering.pending.ref)),
+    hash: projectOptionalFreeformText(stringOrNull(steering.pending.hash)),
+    message_chars: Number.isInteger(steering.pending.message_chars) ? steering.pending.message_chars : null,
+    created_at: projectOptionalFreeformText(stringOrNull(steering.pending.created_at))
+  } : null;
+  const consumed = Array.isArray(steering.history) ? steering.history.filter((item) => item?.event === "consumed") : [];
+  const latest = consumed[consumed.length - 1];
+  const uncheckpointed = steering.uncheckpointed && typeof steering.uncheckpointed === "object" && !Array.isArray(steering.uncheckpointed) ? {
+    id: projectOptionalFreeformText(stringOrNull(steering.uncheckpointed.id)),
+    ref: projectOptionalFreeformText(stringOrNull(steering.uncheckpointed.ref)),
+    hash: projectOptionalFreeformText(stringOrNull(steering.uncheckpointed.hash)),
+    message_chars: Number.isInteger(steering.uncheckpointed.message_chars) ? steering.uncheckpointed.message_chars : null,
+    created_at: projectOptionalFreeformText(stringOrNull(steering.uncheckpointed.created_at)),
+    consumed_at: projectOptionalFreeformText(stringOrNull(steering.uncheckpointed.consumed_at))
+  } : null;
+  return {
+    pending,
+    uncheckpointed,
+    consumed_count: consumed.length,
+    latest_consumed: latest ? {
+      ref: projectOptionalFreeformText(stringOrNull(latest.ref)),
+      consumed_at: projectOptionalFreeformText(stringOrNull(latest.consumed_at))
+    } : null,
+    boundary: steering.boundary && typeof steering.boundary === "object" ? {
+      kind: projectOptionalFreeformText(stringOrNull(steering.boundary.kind)),
+      token: projectOptionalFreeformText(stringOrNull(steering.boundary.token)),
+      generation: Number.isInteger(steering.boundary.generation) ? steering.boundary.generation : null,
+      created_at: projectOptionalFreeformText(stringOrNull(steering.boundary.created_at))
+    } : null,
+    action_claim: steeringActionSummary(steering.action_claim),
+    last_action: steeringActionSummary(steering.last_action),
+    pr_fence: steering.pr_fence && typeof steering.pr_fence === "object" ? {
+      token: projectOptionalFreeformText(stringOrNull(steering.pr_fence.token)),
+      generation: Number.isInteger(steering.pr_fence.generation) ? steering.pr_fence.generation : null,
+      created_at: projectOptionalFreeformText(stringOrNull(steering.pr_fence.created_at))
+    } : null
+  };
+}
+function steeringActionSummary(action) {
+  if (!action || typeof action !== "object" || Array.isArray(action)) return null;
+  return {
+    kind: projectOptionalFreeformText(stringOrNull(action.kind)),
+    token: projectOptionalFreeformText(stringOrNull(action.token)),
+    generation: Number.isInteger(action.generation) ? action.generation : null,
+    claimed_at: projectOptionalFreeformText(stringOrNull(action.claimed_at)),
+    outcome: projectOptionalFreeformText(stringOrNull(action.outcome)),
+    resolved_at: projectOptionalFreeformText(stringOrNull(action.resolved_at))
+  };
+}
+function costSummary(costAttribution) {
+  if (!costAttribution || typeof costAttribution !== "object" || Array.isArray(costAttribution)) return null;
+  const summary = projectPublicStrings(publicCostAttributionSummary(costAttribution));
+  return { ...summary, label: formatProjectedCostSummary(summary) };
+}
+function inferredPrePrPanelSummary(run) {
+  if (run?.status !== "running" || pendingGate(run)) return null;
+  const testAccepted = Array.isArray(run.steps) && run.steps.some((step) => step?.agent === "test-verifier" && step?.status === "accepted");
+  if (!testAccepted) return null;
+  const validatorVerdict = stringOrNull(run.validator?.verdict);
+  const securityVerdict = stringOrNull(run.security_review?.verdict);
+  if (!validatorVerdict && !securityVerdict) return "pre-PR panel running";
+  if (validatorVerdict === "NO-GO" || securityVerdict === "BLOCK") return "panel remediation running";
+  if (!validatorVerdict) return "implementation-validator running";
+  if (!securityVerdict) return "security-reviewer running";
+  if (!run.pr_url) return "PR pending";
+  return null;
+}
+function firstByStatus(items, statuses) {
+  if (!Array.isArray(items)) return null;
+  for (const status of statuses) {
+    const item = items.find((candidate) => candidate?.status === status);
+    if (item) return item;
+  }
+  return null;
+}
+function summarizeWorkItem(name, status, attempts) {
+  const label = projectOptionalFreeformData(stringOrNull(name));
+  if (!label || !status) return null;
+  const normalizedStatus = projectFreeformData(String(status));
+  const attempt = Number.isInteger(attempts) && attempts > 0 ? ` a${attempts}` : "";
+  return `${label} ${normalizedStatus}${attempt}`;
+}
+function panelSummary(run) {
+  const validator = projectOptionalFreeformData(run.validator?.verdict);
+  const security = projectOptionalFreeformData(run.security_review?.verdict);
+  if (!validator && !security) return null;
+  return [validator, security].filter(Boolean).join(" / ");
+}
+function validatedDiagnosticIdentityPaths2(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return [];
+  const paths = [];
+  for (const field of ["status", "severity", "classification"]) {
+    if (DIAGNOSTIC_IDENTITIES[field].has(value[field])) paths.push([field]);
+  }
+  if (!Array.isArray(value.items)) return paths;
+  for (let index = 0; index < value.items.length; index += 1) {
+    const item = value.items[index];
+    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+    for (const field of ["condition", "status", "severity", "classification"]) {
+      if (DIAGNOSTIC_IDENTITIES[field].has(item[field])) paths.push(["items", String(index), field]);
+    }
+  }
+  return paths;
+}
+function plainProjection(value) {
+  if (Array.isArray(value)) return value.map(plainProjection);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, plainProjection(item)]));
+  }
+  return value;
+}
+function terminalSafeProjection(value) {
+  if (typeof value === "string") return projectFreeformText(value);
+  if (Array.isArray(value)) return value.map(terminalSafeProjection);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, terminalSafeProjection(item)]));
+  }
+  return value;
+}
+function projectPublicStrings(value) {
+  if (typeof value === "string") return projectFreeformText(value);
+  if (Array.isArray(value)) return value.map(projectPublicStrings);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, projectPublicStrings(item)]));
+  }
+  return value;
+}
+function projectFreeformText(value) {
+  return renderTerminalSegmentsOrFallback([freeformSegment(String(value))]);
+}
+function projectOptionalFreeformText(value) {
+  return value === null || value === void 0 ? null : projectFreeformText(value);
+}
+function projectOptionalFreeformData(value) {
+  return value === null || value === void 0 ? null : projectFreeformData(String(value));
+}
+function formatProjectedCostSummary(summary) {
+  const parts = [`cost ${summary.status}`, `${summary.entry_count} ${summary.entry_count === 1 ? "entry" : "entries"}`];
+  if (summary.total_tokens !== void 0) parts.push(`${summary.total_tokens} tokens`);
+  else if (summary.input_tokens !== void 0 || summary.output_tokens !== void 0) {
+    parts.push(`${summary.input_tokens ?? "?"}/${summary.output_tokens ?? "?"} tokens`);
+  }
+  if (summary.mixed_currency) parts.push("mixed currency");
+  else if (summary.cost_total !== void 0) parts.push(`${formatCost(summary.cost_total)} ${summary.cost_currency || ""}`.trim());
+  if (summary.missing.length > 0) parts.push(`missing ${summary.missing.join(",")}`);
+  return parts.join(" \xB7 ");
+}
+function formatCost(value) {
+  return Number.isInteger(value) ? String(value) : value.toFixed(6).replace(/0+$/u, "").replace(/\.$/u, "");
+}
+function stringOrNull(value) {
+  return typeof value === "string" ? value : null;
+}
+function stringOrDefault(value, fallback) {
+  return typeof value === "string" ? value : fallback;
+}
+
+// src/tui-rendering.js
+var RUN_STATUSES2 = /* @__PURE__ */ new Set(["running", "completed", "blocked", "partial", "needs-human", "invalid"]);
+var RUN_MODES2 = /* @__PURE__ */ new Set(["interactive", "headless", "autonomous"]);
+var DIAGNOSTIC_CLASSIFICATION_SET = new Set(DIAGNOSTIC_CLASSIFICATIONS);
+var DIAGNOSTIC_STATUS_SET = new Set(DIAGNOSTIC_STATUSES);
+var COST_STATUSES = /* @__PURE__ */ new Set(["available", "partial", "unavailable"]);
+var COST_CURRENCY_PATTERN2 = /^[A-Z]{3,12}$/u;
+function renderFreeformText(value, max) {
+  return truncate(renderTerminalSegmentsOrFallback([freeformSegment(value)]), max);
+}
+function renderRunStatus(value) {
+  return renderValidatedIdentity(value, RUN_STATUSES2);
+}
+function renderRunMode(value) {
+  return renderValidatedIdentity(value, RUN_MODES2);
+}
+function renderDiagnosticLine(run, max = 42) {
+  const segments = [];
+  if (run?.diagnostic_classification) {
+    segments.push(validatedIdentitySegment(run.diagnostic_classification, DIAGNOSTIC_CLASSIFICATION_SET));
+    segments.push(TRUSTED_SEGMENTS.COLON_SPACE);
+  }
+  segments.push(freeformSegment(run?.diagnostic_summary || "Diagnostics require attention"));
+  return truncate(renderTerminalSegmentsOrFallback(segments), max);
+}
+function renderRunTextFields(run) {
+  const status = renderRunStatus(run?.status);
+  const mode = run?.mode ? renderRunMode(run.mode) : null;
+  const steering = renderSteeringLine(run?.steering);
+  const slices = renderSliceLine(run?.slices);
+  const diagnostic = renderDiagnosticLine(run);
+  return {
+    run_id: renderFreeformText(run?.run_id, 31),
+    status_line: mode ? `${status} | ${mode}` : status,
+    gate_line: run?.gate ? `gate: ${renderFreeformText(run.gate)}` : null,
+    current_line: run?.current ? `current: ${renderFreeformText(run.current, 34)}` : null,
+    steering_line: steering,
+    slices_line: slices,
+    cost_line: renderCostLine(run?.cost),
+    panel_line: run?.panel ? `panel: ${renderFreeformText(run.panel)}` : null,
+    pr_line: run?.pr_url ? `PR: ${renderFreeformText(run.pr_url, 34)}` : null,
+    terminal_reason_line: run?.terminal_reason ? `reason: ${renderFreeformText(run.terminal_reason, 30)}` : null,
+    diagnostic_line: `diagnostic: ${diagnostic}`,
+    branch_line: run?.branch ? `branch: ${renderFreeformText(run.branch, 30)}` : null
+  };
+}
+function renderHiddenRunsLine(value) {
+  const count = Number.isSafeInteger(value) && value >= 0 ? value : 0;
+  return `+ ${renderTerminalSegmentsOrFallback([identitySegment(count)])} more runs`;
+}
+function renderSteeringLine(steering) {
+  if (!steering || typeof steering !== "object") return null;
+  if (steering.pending) {
+    return `steering pending: ${renderFreeformText(steering.pending.ref || "pending", 34)}`;
+  }
+  if (steering.latest_consumed) {
+    const count = Number.isSafeInteger(steering.consumed_count) && steering.consumed_count >= 0 ? steering.consumed_count : 0;
+    const renderedCount = renderTerminalSegmentsOrFallback([identitySegment(count)]);
+    const ref = renderFreeformText(steering.latest_consumed.ref || "consumed", 24);
+    return `steering consumed: ${renderedCount} latest ${ref}`;
+  }
+  return null;
+}
+function renderSliceLine(slices) {
+  if (!slices || typeof slices !== "object") return null;
+  const merged = nonNegativeInteger(slices.merged);
+  const total = nonNegativeInteger(slices.total);
+  const blocked = nonNegativeInteger(slices.blocked);
+  const base = `slices: ${renderNumber(merged)}/${renderNumber(total)}`;
+  return blocked > 0 ? `${base} | blocked ${renderNumber(blocked)}` : base;
+}
+function renderNumber(value) {
+  return renderTerminalSegmentsOrFallback([identitySegment(value)]);
+}
+function nonNegativeInteger(value) {
+  return Number.isSafeInteger(value) && value >= 0 ? value : 0;
+}
+function renderCostLine(cost) {
+  if (!cost || typeof cost !== "object" || !COST_STATUSES.has(cost.status)) return null;
+  const entryCount = nonNegativeInteger(cost.entry_count);
+  const parts = [`cost ${cost.status}`, `${entryCount} ${entryCount === 1 ? "entry" : "entries"}`];
+  if (Number.isFinite(cost.total_tokens) && cost.total_tokens >= 0) parts.push(`${cost.total_tokens} tokens`);
+  else if (Number.isFinite(cost.input_tokens) && cost.input_tokens >= 0 || Number.isFinite(cost.output_tokens) && cost.output_tokens >= 0) {
+    parts.push(`${validCostNumber(cost.input_tokens)}/${validCostNumber(cost.output_tokens)} tokens`);
+  }
+  if (cost.mixed_currency === true) parts.push("mixed currency");
+  else if (Number.isFinite(cost.cost_total) && cost.cost_total >= 0) {
+    const currency = typeof cost.cost_currency === "string" && COST_CURRENCY_PATTERN2.test(cost.cost_currency) ? cost.cost_currency : "";
+    parts.push(`${formatCost2(cost.cost_total)} ${currency}`.trim());
+  }
+  if (Array.isArray(cost.missing) && cost.missing.length > 0) {
+    parts.push(`missing ${cost.missing.map((item) => renderFreeformText(item)).join(",")}`);
+  }
+  return truncate(parts.join(" \xB7 "), 42);
+}
+function validCostNumber(value) {
+  return Number.isFinite(value) && value >= 0 ? value : "?";
+}
+function formatCost2(value) {
+  return Number.isInteger(value) ? String(value) : value.toFixed(6).replace(/0+$/u, "").replace(/\.$/u, "");
+}
+function renderValidatedIdentity(value, allowed) {
+  return renderTerminalSegmentsOrFallback([validatedIdentitySegment(value, allowed)]);
+}
+function validatedIdentitySegment(value, allowed) {
+  return typeof value === "string" && allowed.has(value) ? identitySegment(value) : freeformSegment(value ?? "unknown");
+}
+function truncate(value, max) {
+  if (!Number.isSafeInteger(max) || max < 0 || value.length <= max) return value;
+  return `${value.slice(0, Math.max(0, max - 3))}...`;
+}
+
+// src/tui.jsx
+import { jsx, jsxs } from "@opentui/solid/jsx-runtime";
+var REFRESH_INTERVAL_MS = 5e3;
+var MAX_VISIBLE_RUNS = 3;
+var DEFAULT_THEME = {
+  text: "white",
+  textMuted: "gray",
+  success: "green",
+  error: "red",
+  warning: "yellow",
+  info: "cyan"
+};
+var runStore = null;
+function currentTheme(api) {
+  const theme = api?.theme?.current;
+  return theme && typeof theme === "object" ? { ...DEFAULT_THEME, ...theme } : DEFAULT_THEME;
+}
+function statusColor(theme, status) {
+  if (status === "completed") return theme.success;
+  if (status === "blocked" || status === "invalid") return theme.error;
+  if (status === "needs-human" || status === "partial") return theme.warning;
+  if (status === "running") return theme.info;
+  return theme.textMuted;
+}
+function diagnosticColor(theme, status) {
+  if (status === "error") return theme.error;
+  if (status === "warning") return theme.warning;
+  return theme.textMuted;
+}
+function scanRuns(api) {
+  return readRuns(factoryRoots(api));
+}
+function runSnapshot(runs) {
+  return JSON.stringify(runs.map((run) => ({
+    run_id: run.run_id,
+    status: run.status,
+    mode: run.mode,
+    gate: run.gate,
+    current: run.current,
+    steering: run.steering,
+    cost: run.cost,
+    slices: run.slices,
+    panel: run.panel,
+    pr_url: run.pr_url,
+    terminal_reason: run.terminal_reason,
+    branch: run.branch,
+    diagnostic_status: run.diagnostic_status,
+    diagnostic_classification: run.diagnostic_classification,
+    diagnostic_summary: run.diagnostic_summary,
+    updated_at: run.updated_at
+  })));
+}
+function sharedRunStore(api) {
+  if (!runStore) {
+    const initialRuns = scanRuns(api);
+    const [runs, setRuns] = createSignal(initialRuns, { equals: false });
+    const [version, setVersion] = createSignal(1);
+    runStore = { api, runs, setRuns, version, setVersion, snapshot: runSnapshot(initialRuns), refreshing: false };
+    setInterval(() => refreshRunStore(), REFRESH_INTERVAL_MS);
+    return runStore;
+  }
+  runStore.api = api;
+  refreshRunStore();
+  return runStore;
+}
+function refreshRunStore() {
+  if (!runStore || runStore.refreshing) return;
+  runStore.refreshing = true;
+  let nextRuns;
+  let nextSnapshot;
+  try {
+    nextRuns = scanRuns(runStore.api);
+    nextSnapshot = runSnapshot(nextRuns);
+  } finally {
+    runStore.refreshing = false;
+  }
+  if (nextSnapshot === runStore.snapshot) return;
+  runStore.snapshot = nextSnapshot;
+  runStore.setRuns(nextRuns);
+  runStore.setVersion((value) => value + 1);
+}
+function View(props) {
+  const store = sharedRunStore(props.api);
+  const runs = store.runs;
+  const version = store.version;
+  const theme = () => currentTheme(props.api);
+  const visible = createMemo(() => runs().length > 0);
+  const shown = createMemo(() => selectVisibleRuns(runs()));
+  const visibleRuns = createMemo(() => shown().slice(0, MAX_VISIBLE_RUNS));
+  const hiddenCount = createMemo(() => Math.max(0, runs().length - visibleRuns().length));
+  return /* @__PURE__ */ jsxs("box", { flexDirection: "column", flexGrow: 1, flexShrink: 1, minHeight: 0, overflow: "hidden", children: [
+    /* @__PURE__ */ jsx("text", { fg: theme().text, children: /* @__PURE__ */ jsx("b", { children: "Feature Factory" }) }),
+    /* @__PURE__ */ jsx(Show, { when: visible(), fallback: /* @__PURE__ */ jsx("text", { fg: theme().textMuted, children: "No factory runs yet" }), children: /* @__PURE__ */ jsx(Show, { keyed: true, when: version(), children: () => /* @__PURE__ */ jsxs("box", { flexDirection: "column", flexGrow: 1, flexShrink: 1, minHeight: 0, overflow: "hidden", children: [
+      /* @__PURE__ */ jsx(For, { each: visibleRuns(), children: (run) => {
+        const rendered = renderRunTextFields(run);
+        return /* @__PURE__ */ jsxs("box", { paddingTop: 1, children: [
+          /* @__PURE__ */ jsxs("box", { flexDirection: "row", gap: 1, children: [
+            /* @__PURE__ */ jsx("text", { fg: statusColor(theme(), run.status), children: "*" }),
+            /* @__PURE__ */ jsx("text", { fg: theme().text, wrapMode: "none", children: rendered.run_id })
+          ] }),
+          /* @__PURE__ */ jsx("text", { fg: theme().textMuted, children: rendered.status_line }),
+          /* @__PURE__ */ jsx(Show, { when: run.gate, children: /* @__PURE__ */ jsx("text", { fg: theme().warning, children: rendered.gate_line }) }),
+          /* @__PURE__ */ jsx(Show, { when: run.current, children: /* @__PURE__ */ jsx("text", { fg: theme().textMuted, children: rendered.current_line }) }),
+          /* @__PURE__ */ jsx(Show, { when: rendered.steering_line, children: /* @__PURE__ */ jsx("text", { fg: theme().warning, children: rendered.steering_line }) }),
+          /* @__PURE__ */ jsx(Show, { when: rendered.slices_line, children: /* @__PURE__ */ jsx("text", { fg: theme().textMuted, children: rendered.slices_line }) }),
+          /* @__PURE__ */ jsx(Show, { when: rendered.cost_line, children: /* @__PURE__ */ jsx("text", { fg: theme().textMuted, children: rendered.cost_line }) }),
+          /* @__PURE__ */ jsx(Show, { when: run.panel, children: /* @__PURE__ */ jsx("text", { fg: theme().textMuted, children: rendered.panel_line }) }),
+          /* @__PURE__ */ jsx(Show, { when: run.pr_url, children: /* @__PURE__ */ jsx("text", { fg: theme().success, children: rendered.pr_line }) }),
+          /* @__PURE__ */ jsx(Show, { when: run.terminal_reason, children: /* @__PURE__ */ jsx("text", { fg: theme().warning, children: rendered.terminal_reason_line }) }),
+          /* @__PURE__ */ jsx(Show, { when: runHasNonOkDiagnostic(run), children: /* @__PURE__ */ jsx("text", { fg: diagnosticColor(theme(), run.diagnostic_status), children: rendered.diagnostic_line }) }),
+          /* @__PURE__ */ jsx(Show, { when: run.branch, children: /* @__PURE__ */ jsx("text", { fg: theme().textMuted, children: rendered.branch_line }) })
+        ] });
+      } }),
+      /* @__PURE__ */ jsx(Show, { when: hiddenCount() > 0, children: /* @__PURE__ */ jsx("text", { fg: theme().textMuted, children: renderHiddenRunsLine(hiddenCount()) }) })
+    ] }) }) })
+  ] });
+}
+var plugin = {
+  id: "opencode-feature-factory",
+  async tui(api) {
+    if (typeof api?.slots?.register !== "function") return;
+    api.slots.register({
+      order: 450,
+      slots: {
+        sidebar_content(_ctx, props) {
+          return /* @__PURE__ */ jsx(View, { api, session_id: props?.session_id });
+        }
+      }
+    });
+  }
+};
+var tui_default = plugin;
+export {
+  tui_default as default
+};