pomaster 0.6.0 → 0.6.1

package/dist/bin.js

@@ -6461,7 +6461,7 @@ var require_compile = __commonJS({
       const schOrFunc = root.refs[ref];
       if (schOrFunc)
         return schOrFunc;
-      let _sch = resolve3.call(this, root, ref);
+      let _sch = resolve4.call(this, root, ref);
       if (_sch === void 0) {
         const schema2 = (_a = root.localRefs) === null || _a === void 0 ? void 0 : _a[ref];
         const { schemaId } = this.opts;
@@ -6488,7 +6488,7 @@ var require_compile = __commonJS({
     function sameSchemaEnv(s1, s2) {
       return s1.schema === s2.schema && s1.root === s2.root && s1.baseId === s2.baseId;
     }
-    function resolve3(root, ref) {
+    function resolve4(root, ref) {
       let sch;
       while (typeof (sch = this.refs[ref]) == "string")
         ref = sch;
@@ -7313,7 +7313,7 @@ var require_fast_uri = __commonJS({
       }
       return uri;
     }
-    function resolve3(baseURI, relativeURI, options) {
+    function resolve4(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
       const {
         parsed: baseParsed,
@@ -7675,7 +7675,7 @@ var require_fast_uri = __commonJS({
     var fastUri = {
       SCHEMES,
       normalize,
-      resolve: resolve3,
+      resolve: resolve4,
       resolveComponent,
       equal,
       serialize,
@@ -18805,7 +18805,7 @@ var init_design_tokens_schema = __esm({
 });
 
 // packages/schemas/dist/src/vocab.js
-var IR_SCHEMA_DIALECT, LIFECYCLE_VALUES, CONFIDENCE_VALUES, EVIDENCE_VALUES, CHANGE_VALUES, LIFECYCLE_TRANSITIONS, SOURCE_TYPE_ALL_VALUES, SOURCE_TYPE_FORBIDDEN_VALUES, GOVERNED_ID_PREFIXES, ALIASES_V0, TRUTH_BODY_KINDS, CATALOG_ENFORCEMENT_VALUES, CATALOG_CLASSIFICATION_VALUES, CATALOG_LANE_VALUES, CATALOG_CHANGE_CLASS_VALUES, CATALOG_GOVERNANCE_PROFILE_VALUES, RECONCILE_DELTA_KINDS, VERDICT_VALUES, ORIGIN_VALUES, VERIFICATION_VERDICT_VALUES, PRODUCER_KIND_VALUES, ACTOR_TYPE_VALUES, RUN_TRIGGER_VALUES, DENOMINATOR_STATUS_VALUES, DISCOVERY_CHAIN_VALUES, DISCOVERY_CHAIN_TRANSITIONS, DISCOVERY_PROMOTION_BASIS_VALUES, BLUEPRINT_ENVELOPE_STATUS_VALUES, RESEARCH_FINDING_CONFIDENCE_VALUES, RESEARCH_EVIDENCE_LEVEL_VALUES, RESEARCH_AUTHORITY_EFFECT_VALUES, RESEARCH_MODE_VALUES, EXCEPTION_CLASSIFICATION_VALUES, KNOWLEDGE_KIND_VALUES, KNOWLEDGE_STATUS_VALUES, KNOWLEDGE_TRANSITIONS, KNOWLEDGE_PROMOTION_AUTHORITY_VALUES, KNOWLEDGE_CONFIDENCE_VALUES, EXECUTION_RUNTIME_VALUES, EXECUTION_IDENTITY_KIND_VALUES, EXECUTION_ROLE_VALUES, LOCK_KIND_VALUES, AGENT_ROLE_POOL_VALUES, RUNTIME_CAPABILITY_VALUES, RUNTIME_DEGRADATION_RULE_IDS, WORD_FORM_DOMAIN_VALUES, EQUIVALENCE_STATUS_VALUES, PORTABILITY_CANONICAL_SET_VALUES, PORTABILITY_RUNTIME_REBUILD_VALUES, PORTABILITY_FORBIDDEN_DEPENDENCY_VALUES, MEMORY_DRIFT, HARVEST_BUCKET_VALUES, HARVEST_PRIMARY_BUCKETS, HARVEST_SPECIAL_EXIT_VALUES, MEMORY_CLASS_VALUES, REVIEW_STATE_VALUES, HARVEST_SOURCE_VALUES, HARVEST_CONFIDENCE_VALUES, MEMORY_CLI_ERROR_VALUES, OWNER_ESCALATION_REQUIRED, PHASE_TIMELINE_VALUES, PRODUCTION_SIGNAL_SOURCE_VALUES, DIAGNOSIS_KIND_VALUES, BAND_PREDICATE_OPERATOR_VALUES, CONTROL_BAND_EVALUATION_STATUS_VALUES, CAPABILITY_OUTCOME_METRIC_STATUS_VALUES, CAPABILITY_OUTCOME_METRIC_KEY_VALUES, SELF_IMPROVEMENT_SIGNAL_VALUES, SELF_IMPROVEMENT_SIGNAL_PRD_LABELS, POMASTER_SELF_IMPROVEMENT_CANDIDATE, DETECTED_BY_TOOL_SIGNAL, PRODUCTION_CLI_ERROR_VALUES, RELATION_TYPE_VALUES, RELATION_ORIGIN_VALUES, RELATION_ENDPOINT_DOMAIN_VALUES, RELATION_CONFIDENCE_VALUES, SUBSTRATE_LAYER_VALUES, RESOLUTION_MATCH_CLASS_VALUES, OBJECT_FAMILY_VALUES, CATALOG_KIND_VALUES;
+var IR_SCHEMA_DIALECT, LIFECYCLE_VALUES, CONFIDENCE_VALUES, EVIDENCE_VALUES, CHANGE_VALUES, LIFECYCLE_TRANSITIONS, SOURCE_TYPE_ALL_VALUES, SOURCE_TYPE_FORBIDDEN_VALUES, BINDING_CLASS_VALUES, BINDING_STATUS_VALUES, GOVERNED_ID_PREFIXES, ALIASES_V0, TRUTH_BODY_KINDS, CATALOG_ENFORCEMENT_VALUES, CATALOG_CLASSIFICATION_VALUES, CATALOG_LANE_VALUES, CATALOG_CHANGE_CLASS_VALUES, CATALOG_GOVERNANCE_PROFILE_VALUES, RECONCILE_DELTA_KINDS, VERDICT_VALUES, ORIGIN_VALUES, VERIFICATION_VERDICT_VALUES, PRODUCER_KIND_VALUES, ACTOR_TYPE_VALUES, RUN_TRIGGER_VALUES, DENOMINATOR_STATUS_VALUES, DISCOVERY_CHAIN_VALUES, DISCOVERY_CHAIN_TRANSITIONS, DISCOVERY_PROMOTION_BASIS_VALUES, BLUEPRINT_ENVELOPE_STATUS_VALUES, RESEARCH_FINDING_CONFIDENCE_VALUES, RESEARCH_EVIDENCE_LEVEL_VALUES, RESEARCH_AUTHORITY_EFFECT_VALUES, RESEARCH_MODE_VALUES, EXCEPTION_CLASSIFICATION_VALUES, KNOWLEDGE_KIND_VALUES, KNOWLEDGE_STATUS_VALUES, KNOWLEDGE_TRANSITIONS, KNOWLEDGE_PROMOTION_AUTHORITY_VALUES, KNOWLEDGE_CONFIDENCE_VALUES, EXECUTION_RUNTIME_VALUES, EXECUTION_IDENTITY_KIND_VALUES, EXECUTION_ROLE_VALUES, LOCK_KIND_VALUES, AGENT_ROLE_POOL_VALUES, RUNTIME_CAPABILITY_VALUES, RUNTIME_DEGRADATION_RULE_IDS, WORD_FORM_DOMAIN_VALUES, EQUIVALENCE_STATUS_VALUES, PORTABILITY_CANONICAL_SET_VALUES, PORTABILITY_RUNTIME_REBUILD_VALUES, PORTABILITY_FORBIDDEN_DEPENDENCY_VALUES, MEMORY_DRIFT, HARVEST_BUCKET_VALUES, HARVEST_PRIMARY_BUCKETS, HARVEST_SPECIAL_EXIT_VALUES, MEMORY_CLASS_VALUES, REVIEW_STATE_VALUES, HARVEST_SOURCE_VALUES, HARVEST_CONFIDENCE_VALUES, MEMORY_CLI_ERROR_VALUES, OWNER_ESCALATION_REQUIRED, PHASE_TIMELINE_VALUES, PRODUCTION_SIGNAL_SOURCE_VALUES, DIAGNOSIS_KIND_VALUES, BAND_PREDICATE_OPERATOR_VALUES, CONTROL_BAND_EVALUATION_STATUS_VALUES, CAPABILITY_OUTCOME_METRIC_STATUS_VALUES, CAPABILITY_OUTCOME_METRIC_KEY_VALUES, SELF_IMPROVEMENT_SIGNAL_VALUES, SELF_IMPROVEMENT_SIGNAL_PRD_LABELS, POMASTER_SELF_IMPROVEMENT_CANDIDATE, DETECTED_BY_TOOL_SIGNAL, PRODUCTION_CLI_ERROR_VALUES, RELATION_TYPE_VALUES, RELATION_ORIGIN_VALUES, RELATION_ENDPOINT_DOMAIN_VALUES, RELATION_CONFIDENCE_VALUES, SUBSTRATE_LAYER_VALUES, RESOLUTION_MATCH_CLASS_VALUES, OBJECT_FAMILY_VALUES, CATALOG_KIND_VALUES;
 var init_vocab = __esm({
   "packages/schemas/dist/src/vocab.js"() {
     "use strict";
@@ -18850,6 +18850,12 @@ var init_vocab = __esm({
       "prototype_html_scrape",
       "ai_invention"
     ];
+    BINDING_CLASS_VALUES = [
+      "page_to_dir",
+      "contract_operation_to_operationId",
+      "capability_to_file"
+    ];
+    BINDING_STATUS_VALUES = ["confirmed", "derived", "stale"];
     GOVERNED_ID_PREFIXES = [
       "PAGE",
       "CAPABILITY",
@@ -32816,17 +32822,17 @@ async function doctorProbes(store) {
   return { probes, ok };
 }
 function defaultRunner(command, args) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     try {
       const child = spawn(command, [...args], { shell: false, timeout: 1e4 });
       let stdout = "";
       child.stdout?.on("data", (chunk) => {
         stdout += chunk.toString("utf8");
       });
-      child.on("error", () => resolve3({ code: -1, stdout: "" }));
-      child.on("close", (code) => resolve3({ code: code ?? -1, stdout }));
+      child.on("error", () => resolve4({ code: -1, stdout: "" }));
+      child.on("close", (code) => resolve4({ code: code ?? -1, stdout }));
     } catch {
-      resolve3({ code: -1, stdout: "" });
+      resolve4({ code: -1, stdout: "" });
     }
   });
 }
@@ -47236,7 +47242,7 @@ function readCliPackageVersion() {
 }
 function resolveCliVersion() {
   if (true) {
-    return "0.6.0";
+    return "0.6.1";
   }
   return readCliPackageVersion();
 }
@@ -49269,7 +49275,7 @@ var COMMAND_PANORAMA_LINES = [
   "pomaster handoff <task> --to <role>",
   "pomaster session attach/refresh/list",
   "pomaster lock acquire/heartbeat/release/steal/list",
-  "pomaster execution begin/end/list",
+  "pomaster execution begin/end/list/audit",
   "pomaster trace show/list"
 ];
 var CAPABILITY_OVERVIEW = [
@@ -49729,7 +49735,7 @@ var SKILL_MANIFEST = [
         "pomaster agents status",
         "pomaster session attach/refresh/list",
         "pomaster lock acquire/heartbeat/release/steal/list",
-        "pomaster execution begin/end/list",
+        "pomaster execution begin/end/list/audit",
         "pomaster trace show/list",
         "pomaster run <task>",
         "pomaster handoff <task> --to <role>"
@@ -49836,10 +49842,10 @@ var FACET_DIR = {
 };
 async function countSeededAssets(rootDir) {
   const { readdir: readdir3 } = await import("node:fs/promises");
-  const { join: join17 } = await import("node:path");
+  const { join: join18 } = await import("node:path");
   const pomasterDir = toPosix(buildStorePaths(rootDir).pomasterDir);
   async function countFiles(relative3) {
-    const absolute = join17(pomasterDir, ...relative3.split("/"));
+    const absolute = join18(pomasterDir, ...relative3.split("/"));
     let entries;
     try {
       entries = await readdir3(absolute, { withFileTypes: true });
@@ -49869,11 +49875,11 @@ function seededAssetsHumanLine(counts) {
 }
 async function countLegacySpecFiles(rootDir) {
   const { readdir: readdir3 } = await import("node:fs/promises");
-  const { join: join17 } = await import("node:path");
+  const { join: join18 } = await import("node:path");
   const pomasterDir = toPosix(buildStorePaths(rootDir).pomasterDir);
   const legacyDirs = ["specs/hard/frontend", "specs/hard/backend"];
   async function countFiles(relative3) {
-    const absolute = join17(pomasterDir, ...relative3.split("/"));
+    const absolute = join18(pomasterDir, ...relative3.split("/"));
     let entries;
     try {
       entries = await readdir3(absolute, { withFileTypes: true });
@@ -50229,6 +50235,14 @@ import { writeFile } from "node:fs/promises";
 
 // packages/cli/dist/fs-cas.js
 import { existsSync as existsSync10, linkSync as linkSync2, readFileSync as readFileSync10, renameSync as renameSync3, rmSync as rmSync4, writeFileSync as writeFileSync4 } from "node:fs";
+var nodeCasSwapFs = {
+  writeFileSync: writeFileSync4,
+  renameSync: renameSync3,
+  readFileSync: readFileSync10,
+  linkSync: linkSync2,
+  existsSync: existsSync10,
+  rmSync: rmSync4
+};
 var CLAIM_RETRY_DELAYS_MS = [20, 50, 100];
 function sleepSync2(ms) {
   if (ms <= 0)
@@ -50242,29 +50256,40 @@ function sleepSync2(ms) {
     }
   }
 }
+function errnoOf(error) {
+  if (typeof error !== "object" || error === null || !("code" in error))
+    return null;
+  const code = error.code;
+  return typeof code === "string" ? code : null;
+}
 function isNotFoundError2(error) {
-  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+  return errnoOf(error) === "ENOENT";
 }
 function isTransientClaimError(error) {
-  if (typeof error !== "object" || error === null || !("code" in error))
-    return false;
-  const code = error.code;
+  const code = errnoOf(error);
   return code === "EPERM" || code === "EACCES";
 }
-function renameWithLiarDefense(op, dst) {
-  withBoundedRetry2(() => {
+function classifyContentionOrFault(error, stepCause) {
+  const code = errnoOf(error);
+  if (code === "ENOENT" || code === "EPERM" || code === "EACCES") {
+    return { kind: "contended", cause: `${stepCause}\uFF08${code}\uFF09\u2014\u2014\u5E76\u53D1\u4EA4\u9519/\u77AC\u65F6\u9501\uFF0C\u6574\u94FE\u91CD\u8BFB\u91CD\u7B97` };
+  }
+  return { kind: "fault", code: code ?? "UNKNOWN", cause: `${stepCause}\u2014\u2014\u6301\u7EED\u73AF\u5883\u6545\u969C\uFF08\u91CD\u8BD5\u65E0\u76CA\uFF09` };
+}
+function renameWithLiarDefense(fs, op, dst) {
+  withBoundedRetry2(fs, () => {
     try {
       op();
     } catch (error) {
-      if (isNotFoundError2(error) && existsSync10(dst))
+      if (isNotFoundError2(error) && fs.existsSync(dst))
         return;
       throw error;
     }
   });
 }
-function removeBestEffort2(path) {
+function removeBestEffort2(fs, path) {
   try {
-    rmSync4(path, { force: true });
+    fs.rmSync(path, { force: true });
   } catch {
   }
 }
@@ -50273,7 +50298,7 @@ function uniqueAdjacentPath2(target, tag) {
   casSequence += 1;
   return `${target}.${tag}-${process.pid}-${casSequence}`;
 }
-function withBoundedRetry2(op) {
+function withBoundedRetry2(fs, op) {
   for (let attempt = 0; ; attempt += 1) {
     try {
       op();
@@ -50285,45 +50310,76 @@ function withBoundedRetry2(op) {
     }
   }
 }
-function casSwapFile(target, expected, next) {
+function casSwapFile(target, expected, next, fs = nodeCasSwapFs) {
   const tmp = uniqueAdjacentPath2(target, "r1tmp");
   try {
-    writeFileSync4(tmp, next, "utf8");
+    fs.writeFileSync(tmp, next, "utf8");
   } catch (error) {
-    removeBestEffort2(tmp);
-    throw error;
+    removeBestEffort2(fs, tmp);
+    return classifyContentionOrFault(error, "tmp \u843D\u76D8\u5931\u8D25\uFF08\u8BA4\u9886\u524D\u843D\u76D8\u4F4D\uFF09");
   }
   const claim = uniqueAdjacentPath2(target, "r1claim");
   try {
-    renameWithLiarDefense(() => renameSync3(target, claim), claim);
+    renameWithLiarDefense(fs, () => fs.renameSync(target, claim), claim);
   } catch (error) {
-    removeBestEffort2(tmp);
+    removeBestEffort2(fs, tmp);
     if (isNotFoundError2(error))
       return { kind: "absent" };
-    throw error;
+    if (isTransientClaimError(error)) {
+      return {
+        kind: "contended",
+        cause: `\u8BA4\u9886 rename \u77AC\u65F6\u9501\u6709\u754C\u91CD\u8BD5\u8017\u5C3D\uFF08${errnoOf(error) ?? "UNKNOWN"}\uFF09\u2014\u2014\u76EE\u6807\u6301\u7EED\u88AB\u5E76\u53D1\u65B9\u9501\u4F4F`
+      };
+    }
+    return {
+      kind: "fault",
+      code: errnoOf(error) ?? "UNKNOWN",
+      cause: "\u8BA4\u9886 rename \u6301\u7EED\u73AF\u5883\u6545\u969C\uFF08\u91CD\u8BD5\u65E0\u76CA\uFF09"
+    };
   }
   let claimedBytes = null;
   try {
-    claimedBytes = readFileSync10(claim, "utf8");
+    claimedBytes = fs.readFileSync(claim, "utf8");
   } catch {
     claimedBytes = null;
   }
   if (claimedBytes !== expected) {
-    renameWithLiarDefense(() => renameSync3(claim, target), target);
-    removeBestEffort2(tmp);
+    try {
+      renameWithLiarDefense(fs, () => fs.renameSync(claim, target), target);
+    } catch (error) {
+      removeBestEffort2(fs, tmp);
+      if (isNotFoundError2(error)) {
+        return {
+          kind: "contended",
+          cause: "\u56DE\u88C5\u6B65\u8BA4\u9886\u6587\u4EF6\u88AB\u5E76\u53D1\u65B9\u4EA4\u9519\u53D6\u8D70\uFF08claim \u4F4D ENOENT \u4E14 target \u7F3A\u5E2D\uFF09\u2014\u2014\u4E16\u4EE3\u968F\u5BF9\u624B\u8BA4\u9886\u6536\u655B\uFF0C\u6574\u94FE\u91CD\u8BFB"
+        };
+      }
+      if (isTransientClaimError(error)) {
+        return {
+          kind: "contended",
+          cause: `\u56DE\u88C5\u5F52\u8FD8\u539F\u4F4D rename \u77AC\u65F6\u9501\u6709\u754C\u91CD\u8BD5\u8017\u5C3D\uFF08${errnoOf(error) ?? "UNKNOWN"}\uFF09\u2014\u2014claim \u539F\u6837\u7559\u76D8`
+        };
+      }
+      return {
+        kind: "fault",
+        code: errnoOf(error) ?? "UNKNOWN",
+        cause: "\u56DE\u88C5\u5F52\u8FD8\u539F\u4F4D rename \u6301\u7EED\u73AF\u5883\u6545\u969C\u2014\u2014claim \u539F\u6837\u7559\u76D8\uFF08\u8BA4\u9886\u5185\u5BB9\u672A\u53D7\u635F\uFF09"
+      };
+    }
+    removeBestEffort2(fs, tmp);
     return { kind: "conflict" };
   }
   try {
-    linkSync2(tmp, target);
+    fs.linkSync(tmp, target);
   } catch (error) {
-    removeBestEffort2(tmp);
-    if (error.code === "EEXIST") {
+    removeBestEffort2(fs, tmp);
+    if (errnoOf(error) === "EEXIST") {
       return { kind: "conflict" };
     }
-    throw error;
+    return classifyContentionOrFault(error, "link \u56DE\u88C5\u5931\u8D25\uFF08\u5B89\u88C5\u4F4D\uFF09\u2014\u2014claim \u539F\u6837\u7559\u76D8\uFF08\u8BA4\u9886\u5185\u5BB9\u672A\u53D7\u635F\uFF09");
   }
-  removeBestEffort2(tmp);
-  removeBestEffort2(claim);
+  removeBestEffort2(fs, tmp);
+  removeBestEffort2(fs, claim);
   return { kind: "swapped" };
 }
 
@@ -51654,7 +51710,7 @@ var BASELINE_SET_TX_BACKOFF_MS = [20, 50, 100];
 function settled(outcome) {
   return { kind: "settled", outcome };
 }
-async function baselineSetAttempt(rootDir, input, lane, attempt) {
+async function baselineSetAttempt(rootDir, input, lane, attempt, casFs = nodeCasSwapFs) {
   const stackRelative = baselineStackRelative(lane);
   const stackFile = await readTextFile(`${rootDir}/${stackRelative}`);
   if (stackFile.kind !== "ok") {
@@ -51737,17 +51793,23 @@ async function baselineSetAttempt(rootDir, input, lane, attempt) {
   }
   let manifestCommitted = false;
   if (nextManifest !== manifestFile.text) {
-    const cas = casSwapFile(`${rootDir}/${BASELINE_MANIFEST_RELATIVE}`, manifestFile.text, nextManifest);
+    const cas = casSwapFile(`${rootDir}/${BASELINE_MANIFEST_RELATIVE}`, manifestFile.text, nextManifest, casFs);
+    if (cas.kind === "fault") {
+      return settled(failBaselineSet("BASELINE_WRITE_CONFLICT", `baseline \u63D0\u4EA4\u9047\u6301\u7EED\u6587\u4EF6\u7CFB\u7EDF\u6545\u969C\uFF08${BASELINE_MANIFEST_RELATIVE}\uFF1A${cas.cause}\uFF1Berrno=${cas.code}\uFF09\u2014\u2014\u975E\u5E76\u53D1\u4EA4\u9519\uFF0C\u91CD\u8BD5\u65E0\u76CA`, "\u5148\u5904\u7F6E\u6587\u4EF6\u7CFB\u7EDF\u6545\u969C\uFF08\u78C1\u76D8\u7A7A\u95F4/\u6743\u9650/\u6740\u8F6F\u9501\uFF09\uFF0C\u518D\u91CD\u8DD1\u672C\u547D\u4EE4\uFF1A\u91CD\u8DD1\u5728\u65B0\u9C9C\u76D8\u9762\u4E0A\u91CD\u653E\u540C\u4E00\u5224\u5377\u94FE\uFF08\u5E76\u53D1\u4FEE\u6539\u6309\u4E32\u884C\u91CD\u8BD5\u6536\u655B\uFF09\u3002", input));
+    }
     if (cas.kind !== "swapped") {
-      return { kind: "contended" };
+      return cas.kind === "contended" ? { kind: "contended", viaCasCause: `manifest\uFF1A${cas.cause}` } : { kind: "contended" };
     }
     manifestCommitted = true;
     change = "UPDATED";
   }
   if (nextStack !== stackFile.text) {
-    const cas = casSwapFile(`${rootDir}/${stackRelative}`, stackFile.text, nextStack);
+    const cas = casSwapFile(`${rootDir}/${stackRelative}`, stackFile.text, nextStack, casFs);
+    if (cas.kind === "fault") {
+      return settled(failBaselineSet("BASELINE_WRITE_CONFLICT", `baseline \u63D0\u4EA4\u9047\u6301\u7EED\u6587\u4EF6\u7CFB\u7EDF\u6545\u969C\uFF08${stackRelative}\uFF1A${cas.cause}\uFF1Berrno=${cas.code}\uFF09\u2014\u2014\u975E\u5E76\u53D1\u4EA4\u9519\uFF0C\u91CD\u8BD5\u65E0\u76CA`, "\u5148\u5904\u7F6E\u6587\u4EF6\u7CFB\u7EDF\u6545\u969C\uFF08\u78C1\u76D8\u7A7A\u95F4/\u6743\u9650/\u6740\u8F6F\u9501\uFF09\uFF0C\u518D\u91CD\u8DD1\u672C\u547D\u4EE4\uFF1A\u91CD\u8DD1\u5728\u65B0\u9C9C\u76D8\u9762\u4E0A\u91CD\u653E\u540C\u4E00\u5224\u5377\u94FE\uFF08\u5E76\u53D1\u4FEE\u6539\u6309\u4E32\u884C\u91CD\u8BD5\u6536\u655B\uFF09\u3002", input));
+    }
     if (cas.kind !== "swapped") {
-      return { kind: "contended" };
+      return cas.kind === "contended" ? { kind: "contended", viaCasCause: `stack\uFF1A${cas.cause}` } : { kind: "contended" };
     }
     change = "UPDATED";
   }
@@ -51775,7 +51837,7 @@ async function baselineSetAttempt(rootDir, input, lane, attempt) {
   ];
   return settled(okOutcome("baseline set", result2, human));
 }
-async function runBaselineSet(rootDir, input) {
+async function runBaselineSet(rootDir, input, casFs = nodeCasSwapFs) {
   if (!BASELINE_LANES.includes(input.lane)) {
     return failBaselineSet("SCHEMA_INVALID", `\u975E\u6CD5 lane \u8BCD\u5F62\uFF1A${input.lane}\uFF1B\u5408\u6CD5\u8BCD\u5F62\uFF1A${BASELINE_LANES.join(" | ")}`, "\u793A\u4F8B\uFF1Apomaster baseline set --lane frontend --key framework --value vue3", input);
   }
@@ -51791,21 +51853,24 @@ async function runBaselineSet(rootDir, input) {
     return failBaselineSet("SCHEMA_INVALID", `\u503C\u8BCD\u5F62\u975E\u6CD5\uFF1A${input.value}\uFF08\u5141\u8BB8 [A-Za-z0-9] \u8D77\u59CB\u3001[A-Za-z0-9 _./+#()-]\u3001\u2264${STACK_VALUE_MAX_LENGTH} \u5B57\u7B26\uFF09`, "\u793A\u4F8B\uFF1A--value vue3\u3001--value 'Spring Boot'\u3001--value none", input);
   }
   let lastContendedViaStackAbsent = false;
+  let lastContendedCasCause = null;
   for (let attempt = 0; ; attempt += 1) {
     if (attempt >= BASELINE_SET_TX_ATTEMPTS) {
       if (lastContendedViaStackAbsent) {
         return failBaselineSet("BASELINE_WRITE_CONFLICT", `baseline \u5199\u5165\u94FE\u672A\u6536\u655B\uFF08${BASELINE_SET_TX_ATTEMPTS} \u8F6E\u6709\u754C\u91CD\u8BD5\u5185 ${baselineStackRelative(lane)} \u6301\u7EED\u7F3A\u5E2D\uFF09\uFF1A\u53EF\u80FD\u4E3A\u5E76\u53D1 CAS \u8BA4\u9886\u7A97\u53E3\u672A\u6536\u655B\uFF0C\u4E5F\u53EF\u80FD\u4E3A\u8BE5\u6587\u4EF6\u88AB\u771F\u5B9E\u5220\u9664\u2014\u2014\u7F3A\u5E2D\u4E0D\u731C\u6D4B\u91CD\u5199`, "\u7A0D\u540E\u91CD\u8DD1\u672C\u547D\u4EE4\u5373\u53EF\uFF1A\u8BA4\u9886\u7A97\u53E3\u6536\u655B\u540E\u91CD\u8DD1\u5728\u65B0\u9C9C\u76D8\u9762\u4E0A\u6309\u4E32\u884C\u8BED\u4E49\u843D\u76D8\uFF1B\u82E5\u91CD\u8DD1\u4ECD\u62A5\u672C\u9519\u8BEF\uFF0C\u8BE5\u6587\u4EF6\u5F88\u53EF\u80FD\u5DF2\u88AB\u771F\u5B9E\u5220\u9664\u2014\u2014\u4ECE git \u6062\u590D\u6216\u91CD\u8DD1 pomaster init \u64AD\u79CD\uFF08seed-once-missing-only\uFF09\u3002", input);
       }
-      return failBaselineSet("BASELINE_WRITE_CONFLICT", `baseline \u5E76\u53D1\u5199\u5165\u51B2\u7A81\uFF08${BASELINE_SET_TX_ATTEMPTS} \u8F6E\u91CD\u8BFB\u91CD\u7B97\u540E\u4ECD\u4E0E\u4ED6\u4EBA\u5199\u5165\u4EA4\u9519\uFF1B${baselineStackRelative(lane)} \u4E0E ${BASELINE_MANIFEST_RELATIVE} \u7684\u8BFB-\u6539-\u5199\u94FE\uFF09`, "\u7A0D\u540E\u91CD\u8DD1\u672C\u547D\u4EE4\u5373\u53EF\uFF1A\u91CD\u8DD1\u5728\u65B0\u9C9C\u76D8\u9762\u4E0A\u91CD\u653E\u540C\u4E00\u5224\u5377\u94FE\uFF08\u5E76\u53D1\u4FEE\u6539\u6309\u4E32\u884C\u91CD\u8BD5\u6536\u655B\u2014\u2014\u5BA1\u8BA1 R1 \u4FEE\u590D\u8BED\u4E49\uFF09\u3002", input);
+      const causeNote = lastContendedCasCause === null ? "" : `\uFF08\u6700\u8FD1\u8BA4\u9886\u4EA4\u9519\u6210\u56E0\uFF1A${lastContendedCasCause}\uFF09`;
+      return failBaselineSet("BASELINE_WRITE_CONFLICT", `baseline \u5E76\u53D1\u5199\u5165\u51B2\u7A81\uFF08${BASELINE_SET_TX_ATTEMPTS} \u8F6E\u91CD\u8BFB\u91CD\u7B97\u540E\u4ECD\u4E0E\u4ED6\u4EBA\u5199\u5165\u4EA4\u9519\uFF1B${baselineStackRelative(lane)} \u4E0E ${BASELINE_MANIFEST_RELATIVE} \u7684\u8BFB-\u6539-\u5199\u94FE\uFF09${causeNote}`, "\u7A0D\u540E\u91CD\u8DD1\u672C\u547D\u4EE4\u5373\u53EF\uFF1A\u91CD\u8DD1\u5728\u65B0\u9C9C\u76D8\u9762\u4E0A\u91CD\u653E\u540C\u4E00\u5224\u5377\u94FE\uFF08\u5E76\u53D1\u4FEE\u6539\u6309\u4E32\u884C\u91CD\u8BD5\u6536\u655B\u2014\u2014\u5BA1\u8BA1 R1 \u4FEE\u590D\u8BED\u4E49\uFF09\u3002", input);
     }
     if (attempt > 0) {
       sleepSync2(BASELINE_SET_TX_BACKOFF_MS[Math.min(attempt - 1, BASELINE_SET_TX_BACKOFF_MS.length - 1)]);
     }
-    const attemptOutcome = await baselineSetAttempt(rootDir, input, lane, attempt);
+    const attemptOutcome = await baselineSetAttempt(rootDir, input, lane, attempt, casFs);
     if (attemptOutcome.kind === "settled") {
       return attemptOutcome.outcome;
     }
     lastContendedViaStackAbsent = attemptOutcome.viaStackAbsent === true;
+    lastContendedCasCause = attemptOutcome.viaCasCause ?? null;
   }
 }
 function renderBaselineQuizHumanLine(baseline) {
@@ -59582,9 +59647,524 @@ async function runReconSbom(rootDir, input) {
   }
 }
 
+// packages/cli/dist/execution-audit.js
+init_dist2();
+init_dist();
+init_src();
+import { spawnSync as spawnSync15 } from "node:child_process";
+import { readdirSync as readdirSync20, readFileSync as readFileSync26, realpathSync, statSync as statSync5 } from "node:fs";
+import { join as join11, resolve as resolve2 } from "node:path";
+var EXECUTION_AUDIT_SENSOR_CAPABILITY = "SENSOR.BUILD.STATIC";
+var EXECUTION_AUDIT_OPERATION = "audit_mutation_scope";
+var EXECUTION_AUDIT_ADAPTER = "pomaster-cli";
+var EXECUTION_AUDIT_GIT_TIMEOUT_MS = 12e4;
+var EXECUTION_AUDIT_PRESENTATION_CAP = 20;
+var KEYBINDINGS_DIR_RELATIVE = `${TRUTH_OBJECTS_DIR_RELATIVE.replace(/\/objects$/, "")}/keybindings`;
+var KEYBINDING_ROW_ID_PATTERN = /^KEYBINDING\.[A-Z][A-Z0-9_]{0,31}\.[A-Z][A-Z0-9_]{0,31}(\.[A-Z][A-Z0-9_]{0,31})*$/;
+var KEYBINDING_OPERATION_ID_TOKEN_PATTERN = /^[A-Za-z][A-Za-z0-9_.-]*$/;
+if (!SENSOR_ID_PATTERN.test(EXECUTION_AUDIT_SENSOR_CAPABILITY)) {
+  throw new Error(`EXECUTION_AUDIT_SENSOR_CAPABILITY \u8BCD\u5F62\u6F02\u79FB\uFF08\u987B SENSOR.<DOMAIN>.<KIND>\uFF09\uFF1A${EXECUTION_AUDIT_SENSOR_CAPABILITY}`);
+}
+function emptyExecutionAuditResult() {
+  return {
+    observation: null,
+    observation_id: null,
+    receipt_path: null,
+    execution_id: null,
+    diff_base: null,
+    diff_base_resolved: null,
+    captured_at_seq: null,
+    changed_files: null,
+    in_scope: null,
+    out_of_scope: null,
+    unmapped: null,
+    excluded_skip_dirs: null,
+    tracked_changed: null,
+    untracked: null,
+    binding_files: null,
+    binding_rows: null,
+    binding_rows_path_anchored: null,
+    binding_rows_non_path: null,
+    binding_rows_malformed: null,
+    permits: null,
+    permits_missing: null,
+    out_of_scope_items: [],
+    report_blob: null,
+    out_of_scope_stdout_capped: false
+  };
+}
+function executionAuditFail(error) {
+  return failOutcome("execution audit", emptyExecutionAuditResult(), [error], [`execution audit: FAILED \u2014 ${error.code}
+  hint: ${error.hint}`]);
+}
+function isPlainObject9(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isRepoRelativePosixAnchor(value) {
+  return value.length > 0 && !value.includes("\\") && !value.startsWith("/") && !/^[A-Za-z]:[\\/]/.test(value);
+}
+function loadKeybindingTable(rootDir) {
+  const dir = join11(rootDir, ...KEYBINDINGS_DIR_RELATIVE.split("/"));
+  let names;
+  try {
+    names = readdirSync20(dir).filter((name) => name.endsWith(".json")).sort();
+  } catch {
+    return { present: false, files: 0, rows: [], malformed: [] };
+  }
+  if (names.length === 0) {
+    return { present: false, files: 0, rows: [], malformed: [] };
+  }
+  const rows = [];
+  const malformed2 = [];
+  for (const name of names) {
+    const file = `${KEYBINDINGS_DIR_RELATIVE}/${name}`;
+    let parsed;
+    try {
+      parsed = JSON.parse(readFileSync26(join11(dir, name), "utf8"));
+    } catch (error) {
+      malformed2.push({
+        file,
+        reason: `json_parse_failed (${error instanceof Error ? error.message : String(error)})`
+      });
+      continue;
+    }
+    if (!isPlainObject9(parsed)) {
+      malformed2.push({ file, reason: "row_not_object" });
+      continue;
+    }
+    const id = parsed["id"];
+    const bindingClass = parsed["binding_class"];
+    const canonicalId = parsed["canonical_id"];
+    const physicalPath = parsed["physical_path"];
+    const bindingStatus = parsed["binding_status"];
+    if (typeof id !== "string" || !KEYBINDING_ROW_ID_PATTERN.test(id)) {
+      malformed2.push({ file, reason: `id \u8BCD\u5F62\u975E\u6CD5\uFF08\u987B KEYBINDING.<DOMAIN>.<NAME> \u81F3\u5C11\u4E24\u6BB5\uFF09: ${JSON.stringify(id ?? null)}` });
+      continue;
+    }
+    if (typeof bindingClass !== "string" || !BINDING_CLASS_VALUES.includes(bindingClass)) {
+      malformed2.push({ file, reason: `binding_class \u8BCD\u8868\u5916: ${JSON.stringify(bindingClass ?? null)}` });
+      continue;
+    }
+    if (typeof canonicalId !== "string") {
+      malformed2.push({ file, reason: "canonical_id \u7F3A\u5E2D\u6216\u975E\u5B57\u7B26\u4E32" });
+      continue;
+    }
+    try {
+      parseGovernedId(canonicalId);
+    } catch {
+      malformed2.push({ file, reason: `canonical_id \u975E closed-world governed id: ${canonicalId}` });
+      continue;
+    }
+    if (typeof physicalPath !== "string") {
+      malformed2.push({ file, reason: "physical_path \u7F3A\u5E2D\u6216\u975E\u5B57\u7B26\u4E32" });
+      continue;
+    }
+    if (bindingClass === "contract_operation_to_operationId") {
+      if (!KEYBINDING_OPERATION_ID_TOKEN_PATTERN.test(physicalPath)) {
+        malformed2.push({ file, reason: `operationId token \u8BCD\u5F62\u975E\u6CD5: ${JSON.stringify(physicalPath)}` });
+        continue;
+      }
+    } else if (!isRepoRelativePosixAnchor(physicalPath)) {
+      malformed2.push({ file, reason: `physical_path \u975E repo \u76F8\u5BF9 posix \u951A: ${JSON.stringify(physicalPath)}` });
+      continue;
+    }
+    if (typeof bindingStatus !== "string" || !BINDING_STATUS_VALUES.includes(bindingStatus)) {
+      malformed2.push({ file, reason: `binding_status \u8BCD\u8868\u5916: ${JSON.stringify(bindingStatus ?? null)}` });
+      continue;
+    }
+    rows.push({ file, id, bindingClass, canonicalId, physicalPath, bindingStatus });
+  }
+  return { present: true, files: names.length, rows, malformed: malformed2 };
+}
+function bindingMatchesPath(row2, posixPath) {
+  if (row2.bindingClass === "contract_operation_to_operationId")
+    return false;
+  if (row2.bindingClass === "capability_to_file")
+    return row2.physicalPath === posixPath;
+  return posixPath === row2.physicalPath || posixPath.startsWith(`${row2.physicalPath}/`);
+}
+function loadPermitScopes(rootDir, permitIds, currentSeq) {
+  let raw;
+  try {
+    raw = readFileSync26(join11(rootDir, ...PERMITS_RELATIVE.split("/")), "utf8");
+  } catch {
+    return { scopes: [], missing: [...permitIds] };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (error) {
+    return {
+      error: {
+        code: "SCHEMA_INVALID",
+        message: `state/permits.json \u65E0\u6CD5\u89E3\u6790\uFF08\u635F\u574F\u6216\u624B\u6539\uFF09\uFF1A${error instanceof Error ? error.message : String(error)}`,
+        hint: "\u8BB8\u53EF\u53F0\u8D26\u7531 kernel \u4E8B\u52A1\u7EF4\u62A4\uFF1B\u4ECE git \u6062\u590D\u540E\u91CD\u8BD5\u3002"
+      }
+    };
+  }
+  const record = isPlainObject9(parsed) ? parsed : null;
+  const permits = record === null ? null : record["permits"];
+  if (!Array.isArray(permits)) {
+    return {
+      error: {
+        code: "SCHEMA_INVALID",
+        message: "state/permits.json \u7ED3\u6784\u975E\u6CD5\uFF08permits \u975E\u6570\u7EC4\uFF09",
+        hint: "\u8BB8\u53EF\u53F0\u8D26\u7531 kernel \u4E8B\u52A1\u7EF4\u62A4\uFF1B\u4ECE git \u6062\u590D\u540E\u91CD\u8BD5\u3002"
+      }
+    };
+  }
+  const scopes = [];
+  const missing = [];
+  for (const permitId of permitIds) {
+    const row2 = permits.find((entry) => isPlainObject9(entry) && entry["permit_ref"] === permitId);
+    if (row2 === void 0 || !isPlainObject9(row2)) {
+      missing.push(permitId);
+      continue;
+    }
+    const scope = row2["scope"];
+    const subjectIdsRaw = isPlainObject9(scope) ? scope["subject_ids"] : void 0;
+    const subjectIds = Array.isArray(subjectIdsRaw) ? subjectIdsRaw.filter((entry) => typeof entry === "string") : [];
+    const stolenAtSeq = row2["stolen_at_seq"];
+    const expiresAtSeq = row2["expires_at_seq"];
+    const status = typeof stolenAtSeq === "number" ? "stolen" : typeof expiresAtSeq === "number" && currentSeq >= expiresAtSeq ? "expired" : "active";
+    scopes.push({ permit_ref: permitId, subject_ids: subjectIds, status });
+  }
+  return { scopes, missing };
+}
+function judgeMutationScope(changedPaths, rows, scopes) {
+  const pathAnchoredRows = rows.filter((row2) => row2.bindingClass !== "contract_operation_to_operationId");
+  const scopeSurface = scopes.length === 0 ? "\u7A7A scope \u9762\uFF08execution \u65E0\u5728\u518C permit \u6216\u5F15\u7528\u672A\u89E3\u6790\u2014\u2014scope \u9762\u4E3A\u7A7A\uFF0C\u4EFB\u4F55\u6620\u5C04\u5747\u4E0D\u53EF\u6388\u4E88 in-scope\uFF09" : scopes.map((permit) => `${permit.permit_ref}[${permit.status}]`).join(", ");
+  return changedPaths.map((path) => {
+    const matched = pathAnchoredRows.filter((row2) => bindingMatchesPath(row2, path));
+    if (matched.length === 0) {
+      return {
+        path,
+        classification: "unmapped",
+        mappings: [],
+        basis: `unmapped\uFF1A\u65E0 KEYBINDING \u5728\u518C\u7ED1\u5B9A\u547D\u4E2D\uFF08path-anchored \u884C ${String(pathAnchoredRows.length)} \u884C\u5206\u6BCD\uFF09\u2014\u2014\u8BDA\u5B9E\u6E05\u5355\u975E\u9519\u8BEF\uFF08recon unmapped \u540C\u6B3E\u7981\u9759\u9ED8\u4E22\u5F03\uFF09`
+      };
+    }
+    const mappings = matched.map((row2) => {
+      const hit = scopes.find((permit) => permit.subject_ids.includes(row2.canonicalId));
+      return {
+        governed_id: row2.canonicalId,
+        binding_id: row2.id,
+        binding_class: row2.bindingClass,
+        binding_status: row2.bindingStatus,
+        in_scope: hit !== void 0,
+        permit_ref: hit?.permit_ref ?? null,
+        permit_status: hit?.status ?? null
+      };
+    });
+    const inScope = mappings.some((mapping) => mapping.in_scope);
+    const basis = inScope ? `in-scope\uFF1A${mappings.filter((mapping) => mapping.in_scope).map((mapping) => `${mapping.governed_id}\uFF08${mapping.binding_id}\xB7${mapping.binding_status}\uFF09\u2208 ${mapping.permit_ref}[${mapping.permit_status}] scope.subject_ids`).join("; ")}` : `out-of-scope\uFF1A${mappings.map((mapping) => `${mapping.governed_id}\uFF08${mapping.binding_id}\xB7${mapping.binding_status}\uFF09`).join("; ")} \u2209 ${scopeSurface}\u2014\u2014\u5224\u5B9A\u4F9D\u636E = kernel checkPermit scope.subject_ids \u6210\u5458\u5224\u636E`;
+    return {
+      path,
+      classification: inScope ? "in_scope" : "out_of_scope",
+      mappings,
+      basis
+    };
+  });
+}
+function gitRun(rootDir, args) {
+  const res = spawnSync15("git", [...args], {
+    cwd: rootDir,
+    timeout: EXECUTION_AUDIT_GIT_TIMEOUT_MS,
+    maxBuffer: SPAWN_MAX_BUFFER_BYTES,
+    encoding: "utf8",
+    windowsHide: true
+  });
+  return {
+    status: res.status,
+    stdout: res.stdout ?? "",
+    stderr: res.stderr ?? "",
+    error: res.error?.message ?? null
+  };
+}
+function splitNulList(stdout) {
+  return stdout.split("\0").filter((entry) => entry.length > 0).map((entry) => toPosix(entry));
+}
+function pathHasSkippedSegment(posixPath) {
+  return posixPath.split("/").some((segment) => RECON_SKIP_DIRS.has(segment));
+}
+function normalizedDirIdentity(path) {
+  let resolved = path;
+  try {
+    resolved = realpathSync(path);
+  } catch {
+    resolved = resolve2(path);
+  }
+  return toPosix(resolved).toLowerCase().replace(/\/$/, "");
+}
+function sameDirectoryIdentity(a, b) {
+  if (normalizedDirIdentity(a) === normalizedDirIdentity(b))
+    return true;
+  try {
+    const sa = statSync5(a, { bigint: true });
+    const sb = statSync5(b, { bigint: true });
+    return sa.dev === sb.dev && sa.ino === sb.ino && sa.ino !== 0n;
+  } catch {
+    return false;
+  }
+}
+async function runExecutionAudit(rootDir, input) {
+  const executionResolution = resolveExecutionId(input.executionId, void 0);
+  if ("fail" in executionResolution || executionResolution.executionId === null) {
+    return executionAuditFail({
+      code: "SCHEMA_INVALID",
+      message: "fail" in executionResolution ? executionResolution.fail : `execution_id \u7F3A\u5E2D\uFF08OBS \u56DE\u6267 execution_id \u5FC5\u586B\u2014\u2014\xA76.13 \u8BC1\u660E\u4E49\u52A1\uFF09`,
+      hint: "\u5148 pomaster execution begin \u767B\u8BB0\u6267\u884C\u8EAB\u4EFD\uFF08AGX-n\uFF09\uFF0C\u518D\u4EE5 --execution-id \u4F20\u5165\uFF08S1 \u7981\u81EA\u9020\u8EAB\u4EFD\uFF09\u3002"
+    });
+  }
+  const executionId = executionResolution.executionId;
+  const diffBase = typeof input.diffBase === "string" ? input.diffBase.trim() : "";
+  if (diffBase.length === 0) {
+    return executionAuditFail({
+      code: "MUTATION_SCOPE_NO_ANCHOR",
+      message: "--diff-base \u7F3A\u5E2D\uFF08git diff \u8D77\u59CB\u951A\u5FC5\u586B\u2014\u2014execution record \u5B9E\u8BFB\u786E\u8BA4\u65E0 ref/seq \u951A\u5B57\u6BB5\uFF0C\u951A\u7531\u8C03\u7528\u65B9\u7533\u62A5\uFF09",
+      hint: "\u4EE5 execution begin \u65F6\u523B\u7684\u5DE5\u4F5C\u533A\u57FA\u7EBF ref\uFF08commit/branch/tag\uFF09\u4F20\u5165 --diff-base\uFF1B\u975E git \u5DE5\u4F5C\u533A\u5BA1\u8BA1\u4E0D\u53EF\u7528\uFF08PRD Out of Scope\uFF1A\u65E0\u7248\u672C\u951A\u663E\u5F0F\u62A5\u9519\uFF0C\u4E0D\u505A fs \u5FEB\u7167\u515C\u5E95\uFF09\u3002"
+    });
+  }
+  const initialized = await requireInitialized(rootDir);
+  if ("error" in initialized)
+    return executionAuditFail(initialized.error);
+  let executionRecord;
+  try {
+    executionRecord = readExecutionRecordById(buildStorePaths(rootDir), executionId);
+  } catch (error) {
+    if (error instanceof GovernanceError)
+      return executionAuditFail(governanceErrorToCliError(error));
+    throw error;
+  }
+  if (executionRecord === null) {
+    return executionAuditFail({
+      code: "EXECUTION_NOT_FOUND",
+      message: `execution_id \u672A\u767B\u8BB0\uFF08executions/ \u6863\u6848\u7F3A\u5931\uFF09\uFF1A${executionId}`,
+      hint: "\u5148 pomaster execution begin \u767B\u8BB0\u6267\u884C\u8EAB\u4EFD\uFF08.pomaster/executions/AGX-*.json \u662F\u8EAB\u4EFD\u552F\u4E00\u4E8B\u5B9E\u6E90\uFF09\uFF1B\u5DF2\u5C01\u53E3\u6267\u884C\u5141\u8BB8\u4E8B\u540E\u5BA1\u8BA1\u3002"
+    });
+  }
+  const toplevel = gitRun(rootDir, ["rev-parse", "--show-toplevel"]);
+  if (toplevel.error !== null || toplevel.status !== 0 || toplevel.stdout.trim().length === 0) {
+    return executionAuditFail({
+      code: "MUTATION_SCOPE_NOT_GIT_WORKTREE",
+      message: `\u975E git \u5DE5\u4F5C\u533A\uFF08git rev-parse --show-toplevel \u5931\u8D25\uFF1A${toplevel.error ?? `exit ${String(toplevel.status)}`}\uFF09\u2014\u2014\u65E0\u7248\u672C\u951A\u5BA1\u8BA1\u4E0D\u53EF\u7528\uFF0C\u96F6\u843D\u76D8`,
+      hint: "PRD Out of Scope\uFF1A\u975E git \u5DE5\u4F5C\u533A\u663E\u5F0F\u62A5\u9519\uFF0C\u4E0D\u505A fs \u5FEB\u7167\u515C\u5E95\uFF1B\u786E\u8BA4\u5BBF\u4E3B\u9879\u76EE\u4E3A git \u4ED3\u5E93\u540E\u91CD\u8DD1\u3002"
+    });
+  }
+  if (!sameDirectoryIdentity(toplevel.stdout.trim(), rootDir)) {
+    return executionAuditFail({
+      code: "MUTATION_SCOPE_NOT_WORKTREE_ROOT",
+      message: `store \u6839\u975E worktree \u6839\uFF08toplevel=${toPosix(toplevel.stdout.trim())} \u2260 root=${toPosix(resolve2(rootDir))}\uFF09\u2014\u2014diff \u8DEF\u5F84\u9762\u53EA\u5BF9 worktree \u6839\u6210\u7ACB\uFF0C\u7981\u8DEF\u5F84\u524D\u7F00\u63A8\u65AD`,
+      hint: "\u5728 git worktree \u6839\uFF08.pomaster/ \u6240\u5728\u7684\u4ED3\u5E93\u6839\uFF09\u91CD\u8DD1\uFF1B\u5B50\u76EE\u5F55 store \u4E0D\u5728\u672C\u901A\u8DEF\u652F\u6301\u9762\u3002"
+    });
+  }
+  const baseResolved = gitRun(rootDir, ["rev-parse", "--verify", "--quiet", diffBase]);
+  const baseResolvedSha = baseResolved.stdout.trim();
+  if (baseResolved.error !== null || baseResolved.status !== 0 || baseResolvedSha.length === 0) {
+    return executionAuditFail({
+      code: "MUTATION_SCOPE_BAD_BASE",
+      message: `--diff-base \u65E0\u6CD5\u89E3\u6790\u4E3A\u5BF9\u8C61\uFF08git rev-parse --verify ${diffBase} \u5931\u8D25\uFF1A${baseResolved.error ?? `exit ${String(baseResolved.status)}`}\uFF09\u2014\u2014\u96F6\u843D\u76D8`,
+      hint: "\u8D77\u59CB\u951A\u987B\u4E3A\u53EF\u89E3\u6790\u7684 commit/branch/tag\uFF08\u5982 execution begin \u65F6\u7684 HEAD sha\uFF09\uFF1Bgit rev-parse <ref> \u53EF\u5148\u884C\u4EBA\u5DE5\u5BF9\u8D26\u3002"
+    });
+  }
+  const trackedRun = gitRun(rootDir, ["diff", "--name-only", "-z", baseResolvedSha]);
+  if (trackedRun.error !== null || trackedRun.status !== 0) {
+    return executionAuditFail({
+      code: "MUTATION_SCOPE_GIT_FAILED",
+      message: `git diff \u6536\u96C6\u5931\u8D25\uFF08exit=${String(trackedRun.status)}, error=${trackedRun.error ?? "unknown"}\uFF09\u2014\u2014diff \u9762\u4E0D\u53EF\u5F97\u96F6\u843D\u76D8${trackedRun.stderr.trim().length > 0 ? `\uFF1Bstderr \u6458\u5F55\uFF1A${trackedRun.stderr.trim().slice(0, 200)}` : ""}`,
+      hint: "\u6838\u67E5 git \u53EF\u7528\u6027\u4E0E\u4ED3\u5E93\u5065\u5EB7\uFF08git status\uFF09\u540E\u91CD\u8DD1\uFF1B\u8D85\u65F6\u4E0A\u754C 120s\u3002"
+    });
+  }
+  const untrackedRun = gitRun(rootDir, ["ls-files", "--others", "--exclude-standard", "-z"]);
+  if (untrackedRun.error !== null || untrackedRun.status !== 0) {
+    return executionAuditFail({
+      code: "MUTATION_SCOPE_GIT_FAILED",
+      message: `git ls-files \u6536\u96C6\u5931\u8D25\uFF08untracked \u9762\uFF1Bexit=${String(untrackedRun.status)}, error=${untrackedRun.error ?? "unknown"}\uFF09\u2014\u2014diff \u9762\u4E0D\u53EF\u5F97\u96F6\u843D\u76D8`,
+      hint: "\u6838\u67E5 git \u53EF\u7528\u6027\u540E\u91CD\u8DD1\u3002"
+    });
+  }
+  const trackedPaths = splitNulList(trackedRun.stdout);
+  const untrackedPaths = splitNulList(untrackedRun.stdout);
+  const merged = [.../* @__PURE__ */ new Set([...trackedPaths, ...untrackedPaths])];
+  const excludedPaths = merged.filter((path) => pathHasSkippedSegment(path)).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+  const changedPaths = merged.filter((path) => !pathHasSkippedSegment(path)).sort((a, b) => a < b ? -1 : a > b ? 1 : 0);
+  const table = loadKeybindingTable(rootDir);
+  const permitLoad = loadPermitScopes(rootDir, executionRecord.permit_ids, initialized.seq);
+  if ("error" in permitLoad)
+    return executionAuditFail(permitLoad.error);
+  const scopes = permitLoad.scopes;
+  const missingPermits = permitLoad.missing;
+  const judgments = judgeMutationScope(changedPaths, table.rows, scopes);
+  const inScopeItems = judgments.filter((item) => item.classification === "in_scope");
+  const outScopeItems = judgments.filter((item) => item.classification === "out_of_scope");
+  const unmappedItems = judgments.filter((item) => item.classification === "unmapped");
+  try {
+    const storePaths = buildStorePaths(rootDir);
+    const reportBytes = Buffer.from(`${JSON.stringify({
+      audit_surface: "mutation-scope",
+      execution_id: executionRecord.execution_id,
+      execution_started_at: executionRecord.started_at,
+      execution_ended_at: executionRecord.ended_at,
+      diff_base: diffBase,
+      diff_base_resolved: baseResolvedSha,
+      counts: {
+        tracked_changed: trackedPaths.length,
+        untracked: untrackedPaths.length,
+        changed_files: changedPaths.length,
+        in_scope: inScopeItems.length,
+        out_of_scope: outScopeItems.length,
+        unmapped: unmappedItems.length,
+        excluded_skip_dirs: excludedPaths.length,
+        binding_files: table.files,
+        binding_rows: table.rows.length,
+        binding_rows_path_anchored: table.rows.filter((row2) => row2.bindingClass !== "contract_operation_to_operationId").length,
+        binding_rows_non_path: table.rows.filter((row2) => row2.bindingClass === "contract_operation_to_operationId").length,
+        binding_rows_malformed: table.malformed.length,
+        permits: scopes.length,
+        permits_missing: missingPermits.length
+      },
+      in_scope: inScopeItems,
+      out_of_scope: outScopeItems,
+      unmapped: unmappedItems,
+      excluded_paths: excludedPaths,
+      malformed_rows: table.malformed,
+      binding_table_present: table.present,
+      permits_view: scopes.map((permit) => ({
+        permit_ref: permit.permit_ref,
+        status: permit.status,
+        subject_ids: permit.subject_ids
+      }))
+    }, null, 2)}
+`, "utf8");
+    const blob = persistEvidenceArtifact(storePaths.evidenceDir, {
+      media: "json",
+      bytes: reportBytes
+    });
+    const observationId = allocateObservationId(storePaths.observationsDir);
+    const receipt = buildObservationReceipt({
+      observationId,
+      executionId,
+      sensorCapability: EXECUTION_AUDIT_SENSOR_CAPABILITY,
+      adapter: EXECUTION_AUDIT_ADAPTER,
+      operation: EXECUTION_AUDIT_OPERATION,
+      surface: "STRUCTURAL_REALITY",
+      result: "OBSERVED",
+      capturedAtSeq: initialized.seq,
+      artifactRefs: [
+        {
+          sha256: blob.sha256,
+          media: blob.media,
+          byteSize: blob.byteSize,
+          storagePath: blob.storagePath
+        }
+      ],
+      normalizedFacts: [
+        "audit_surface: mutation-scope",
+        `diff_base_resolved: ${baseResolvedSha}`,
+        `tracked_changed: ${String(trackedPaths.length)}`,
+        `untracked: ${String(untrackedPaths.length)}`,
+        `changed_files: ${String(changedPaths.length)}`,
+        `in_scope: ${String(inScopeItems.length)}`,
+        `out_of_scope: ${String(outScopeItems.length)}`,
+        `unmapped: ${String(unmappedItems.length)}`,
+        `excluded_skip_dirs: ${String(excludedPaths.length)}`,
+        `binding_rows: ${String(table.rows.length)}`,
+        `binding_rows_malformed: ${String(table.malformed.length)}`,
+        `permits: ${String(scopes.length)}`,
+        `permits_missing: ${String(missingPermits.length)}`,
+        ...changedPaths.length === 0 ? ["zero_diff: true"] : []
+      ]
+    });
+    const persisted = persistObservationRecord(storePaths.evidenceDir, observationRecordOf(receipt));
+    const receiptPath = `${POMASTER_DIR}/evidence/${persisted.relativePath}`;
+    const human = [
+      `execution audit: OBSERVED \u2014 \u53D8\u66F4\u6587\u4EF6 ${String(changedPaths.length)}\uFF08in ${String(inScopeItems.length)} / out ${String(outScopeItems.length)} / unmapped ${String(unmappedItems.length)}\uFF1Bexcluded ${String(excludedPaths.length)}\u2014\u2014node_modules/dist/.git/coverage/.pomaster \u6392\u9664\u95ED\u5305\uFF09`,
+      `diff \u951A: ${diffBase} \u2192 ${baseResolvedSha}\uFF08execution ${executionRecord.execution_id} started_at=${executionRecord.started_at}\u2014\u2014\u951A\u7531\u8C03\u7528\u65B9\u7533\u62A5\uFF0Cexecution record \u65E0 ref/seq \u951A\u5B57\u6BB5\uFF09`
+    ];
+    if (outScopeItems.length > 0) {
+      human.push(`\u8D8A\u754C\uFF08${String(outScopeItems.length)} \u9879\u2014\u2014\u53D8\u66F4\u8DEF\u5F84 \u2209 permit scope\uFF0C\u5904\u7F6E\u5F52 Owner\uFF09\uFF1A`);
+      for (const item of outScopeItems.slice(0, EXECUTION_AUDIT_PRESENTATION_CAP)) {
+        human.push(`  - ${item.path} \u2014 ${item.basis}`);
+      }
+      if (outScopeItems.length > EXECUTION_AUDIT_PRESENTATION_CAP) {
+        human.push(`  \u2026\uFF08\u5176\u4F59 ${String(outScopeItems.length - EXECUTION_AUDIT_PRESENTATION_CAP)} \u6761\u89C1 report blob ${blob.storagePath}\uFF09`);
+      }
+    }
+    if (unmappedItems.length > 0) {
+      human.push(`unmapped\uFF08${String(unmappedItems.length)} \u6761\u2014\u2014\u65E0 KEYBINDING \u5728\u518C\u7ED1\u5B9A\u547D\u4E2D\uFF0C\u8BDA\u5B9E\u6E05\u5355\u975E\u9519\u8BEF${table.present ? "" : "\uFF1B\u672C\u5DE5\u4F5C\u533A\u65E0 KEYBINDING \u7ED1\u5B9A\u8868\uFF08\u5168 unmapped \u5408\u6CD5\u6001\uFF09"}\uFF09\uFF1A`);
+      for (const item of unmappedItems.slice(0, EXECUTION_AUDIT_PRESENTATION_CAP)) {
+        human.push(`  - ${item.path}`);
+      }
+      if (unmappedItems.length > EXECUTION_AUDIT_PRESENTATION_CAP) {
+        human.push(`  \u2026\uFF08\u5176\u4F59 ${String(unmappedItems.length - EXECUTION_AUDIT_PRESENTATION_CAP)} \u6761\u89C1 report blob ${blob.storagePath}\uFF09`);
+      }
+    }
+    human.push(`binding \u8868: ${String(table.files)} \u6587\u4EF6 / ${String(table.rows.length)} \u884C\uFF08path-anchored ${String(table.rows.length - table.rows.filter((row2) => row2.bindingClass === "contract_operation_to_operationId").length)} / non-path(operationId) ${String(table.rows.filter((row2) => row2.bindingClass === "contract_operation_to_operationId").length)} / malformed ${String(table.malformed.length)}${table.present ? "" : "\uFF1B\u76EE\u5F55\u7F3A\u5E2D=\u65E0\u8868"})`, `permit scope \u9762: ${String(scopes.length)} \u4E2A permit\uFF08${scopes.map((permit) => `${permit.permit_ref}:${permit.status}`).join(", ") || "\u65E0"}\uFF09+ missing ${String(missingPermits.length)}`, `report blob: ${blob.storagePath}\uFF08${blob.sha256}\uFF1Bmedia=json\u2014\u2014\u4E09\u5206\u7C7B\u5168\u91CF\u6E05\u5355/\u6392\u9664\u6E05\u5355/malformed \u884C\u8F7D\u4F53\uFF09`, `observation receipt: ${receiptPath}\uFF08result=OBSERVED\uFF1Bsurface=STRUCTURAL_REALITY\uFF1Bcaptured_at_seq=${String(initialized.seq)}\uFF09`, "\u96F6\u6743\u5A01\u5199\u53E3\uFF1A\u4EA7\u7269\u53EA\u843D evidence/{blobs,observations}/ sidecar\uFF08\u5B57\u8282\u5FEB\u7167\u6D4B\u8BD5\u9489\uFF09\uFF1B\u8D8A\u754C\u5448\u62A5\u4E0D\u963B\u65AD\u2014\u2014\u5904\u7F6E\u5F52 Owner\uFF08Detection \u534A\u8FB9\uFF09");
+    const warnings = [];
+    if (missingPermits.length > 0) {
+      warnings.push({
+        code: "PERMIT_REF_UNRESOLVED",
+        message: `execution.permit_ids \u5F15\u7528\u7684 ${String(missingPermits.length)} \u4E2A permit \u672A\u5728\u53F0\u8D26\u89E3\u6790\uFF08scope \u9762\u6536\u7A84\u2014\u2014\u7F3A\u5931 scope \u4E0D\u6388\u4E88 in-scope\uFF09\uFF1A${missingPermits.join("; ")}`,
+        hint: "\u6838\u67E5 execution begin --permit \u4E0E permit issue \u53F0\u8D26\uFF08state/permits.json\uFF09\u5BF9\u8D26\uFF1B\u5F15\u7528\u7F3A\u5931\u5C5E\u62AB\u9732\u975E\u653E\u884C\u3002"
+      });
+    }
+    if (table.malformed.length > 0) {
+      warnings.push({
+        code: "KEYBINDING_ROW_MALFORMED",
+        message: `${String(table.malformed.length)} \u4E2A KEYBINDING \u884C\u8BCD\u5F62\u6821\u9A8C\u5931\u8D25\uFF08\u5DF2\u62AB\u9732\u975E\u9759\u9ED8\u8DF3\u8FC7\uFF0C\u4E0D\u5165\u6620\u5C04\u5206\u6BCD\uFF09\uFF1A${table.malformed.map((row2) => row2.file).join("; ")}`,
+        hint: "04-keybinding \u884C\u5BF9\u8C61\u8BCD\u5F62\u5951\u7EA6\u89C1 packages/schemas/assets/04-keybinding.schema.json\uFF1Bmalformed \u6E05\u5355\u5DF2\u968F report blob \u843D\u76D8\u3002"
+      });
+    }
+    const result2 = {
+      observation: "OBSERVED",
+      observation_id: receipt.observation_id,
+      receipt_path: receiptPath,
+      execution_id: executionRecord.execution_id,
+      diff_base: diffBase,
+      diff_base_resolved: baseResolvedSha,
+      captured_at_seq: initialized.seq,
+      changed_files: changedPaths.length,
+      in_scope: inScopeItems.length,
+      out_of_scope: outScopeItems.length,
+      unmapped: unmappedItems.length,
+      excluded_skip_dirs: excludedPaths.length,
+      tracked_changed: trackedPaths.length,
+      untracked: untrackedPaths.length,
+      binding_files: table.files,
+      binding_rows: table.rows.length,
+      binding_rows_path_anchored: table.rows.filter((row2) => row2.bindingClass !== "contract_operation_to_operationId").length,
+      binding_rows_non_path: table.rows.filter((row2) => row2.bindingClass === "contract_operation_to_operationId").length,
+      binding_rows_malformed: table.malformed.length,
+      permits: scopes.length,
+      permits_missing: missingPermits.length,
+      out_of_scope_items: outScopeItems,
+      report_blob: {
+        sha256: blob.sha256,
+        storage_path: blob.storagePath,
+        byte_size: blob.byteSize
+      },
+      out_of_scope_stdout_capped: outScopeItems.length > EXECUTION_AUDIT_PRESENTATION_CAP
+    };
+    if (outScopeItems.length > 0) {
+      return failOutcome("execution audit", result2, [
+        {
+          code: "MUTATION_SCOPE_OUT_OF_SCOPE",
+          message: `\u8D8A\u754C\u53D8\u66F4 ${String(outScopeItems.length)} \u9879\uFF08execution ${executionRecord.execution_id} vs \u951A ${diffBase}\uFF09\uFF1A${outScopeItems.map((item) => item.path).join("; ")}`,
+          hint: "\u8D8A\u754C\u660E\u7EC6\u89C1 stdout/result/report blob\uFF1B\u628A\u76EE\u6807\u5BF9\u8C61\u7EB3\u5165 permit \u8303\u56F4\u987B\u56DE FRAMEWORK LOCK \u91CD\u5BA1\u5347\u7EA7\uFF08D20\uFF09\uFF0C\u4E0D\u5F97\u65C1\u8DEF\u6269\u6743\u2014\u2014\u672C\u547D\u4EE4\u53EA\u89C2\u5BDF\u5448\u62A5\uFF0C\u5904\u7F6E\u5F52 Owner\u3002"
+        }
+      ], human, warnings);
+    }
+    return okOutcome("execution audit", result2, human, warnings);
+  } catch (error) {
+    if (error instanceof GovernanceError)
+      return executionAuditFail(governanceErrorToCliError(error));
+    throw error;
+  }
+}
+
 // packages/cli/dist/record.js
 init_dist();
-import { existsSync as existsSync20, readFileSync as readFileSync26 } from "node:fs";
+import { existsSync as existsSync20, readFileSync as readFileSync27 } from "node:fs";
 function emptyGateRunResult() {
   return {
     grn: null,
@@ -59603,7 +60183,7 @@ function gateRunFail(error) {
 }
 function readFromBytes(path) {
   try {
-    return { bytes: readFileSync26(path, "utf8") };
+    return { bytes: readFileSync27(path, "utf8") };
   } catch (err) {
     return {
       code: EVIDENCE_MALFORMED_CODE,
@@ -59741,7 +60321,7 @@ async function runRecordGateRun(rootDir, input) {
     grn = input.grn;
     let targetBytes = null;
     try {
-      targetBytes = readFileSync26(`${runsDir}/${grn}.json`, "utf8");
+      targetBytes = readFileSync27(`${runsDir}/${grn}.json`, "utf8");
     } catch {
       targetBytes = null;
     }
@@ -59963,7 +60543,7 @@ async function runRecordClaim(rootDir, input) {
     clm = input.clm;
     let targetBytes = null;
     try {
-      targetBytes = readFileSync26(`${claimsDir}/${clm}.json`, "utf8");
+      targetBytes = readFileSync27(`${claimsDir}/${clm}.json`, "utf8");
     } catch {
       targetBytes = null;
     }
@@ -60077,7 +60657,7 @@ async function runRecordVerification(rootDir, input) {
   const claimPath = `${claimsDirPath(rootDir)}/${input.clm}.json`;
   let bytes = null;
   try {
-    bytes = readFileSync26(claimPath, "utf8");
+    bytes = readFileSync27(claimPath, "utf8");
   } catch {
     bytes = null;
   }
@@ -60184,9 +60764,9 @@ async function runRecordVerification(rootDir, input) {
 // packages/cli/dist/closeout.js
 init_dist();
 init_src();
-import { readdirSync as readdirSync20 } from "node:fs";
+import { readdirSync as readdirSync21 } from "node:fs";
 import { readFile as readFile13 } from "node:fs/promises";
-import { join as join11 } from "node:path";
+import { join as join12 } from "node:path";
 function emptyResult4(task) {
   return {
     task,
@@ -60251,7 +60831,7 @@ function grnOrdinal(grn) {
 var GRN_SIDECAR_PATTERN = /^GRN-[0-9]+(?:\..+)?$/;
 function listGrnSidecarFiles(runsDir) {
   try {
-    return readdirSync20(runsDir).filter((name) => GRN_SIDECAR_PATTERN.test(name) && !name.endsWith(".json")).sort();
+    return readdirSync21(runsDir).filter((name) => GRN_SIDECAR_PATTERN.test(name) && !name.endsWith(".json")).sort();
   } catch {
     return [];
   }
@@ -60259,7 +60839,7 @@ function listGrnSidecarFiles(runsDir) {
 async function readRunRecord(runsDir, fileName) {
   let parsed;
   try {
-    parsed = JSON.parse(await readFile13(join11(runsDir, fileName), "utf8"));
+    parsed = JSON.parse(await readFile13(join12(runsDir, fileName), "utf8"));
   } catch (err) {
     return { damage: `evidence/runs/${fileName}: JSON \u65E0\u6CD5\u89E3\u6790 \u2014 ${err instanceof Error ? err.message : String(err)}` };
   }
@@ -60280,7 +60860,7 @@ async function readRunRecord(runsDir, fileName) {
 async function readClaimRecord(claimsDir, fileName) {
   let bytes;
   try {
-    bytes = await readFile13(join11(claimsDir, fileName), "utf8");
+    bytes = await readFile13(join12(claimsDir, fileName), "utf8");
   } catch {
     return { missing: true };
   }
@@ -60343,7 +60923,7 @@ async function runCloseout(rootDir, input) {
       hint: "change \u7684\u5B8C\u6210\u5224\u5377\u7ECF\u7531\u5176 affected TASKs \u9010\u4EFB\u52A1 closeout\uFF1Bkind \u8BCD\u5F62\u89C1 02b kind-payloads\u3002"
     }, withKind);
   }
-  const bodyPath = join11(rootDir, POMASTER_DIR, ...row2.bodyRef.split("/"));
+  const bodyPath = join12(rootDir, POMASTER_DIR, ...row2.bodyRef.split("/"));
   let bodyRaw;
   try {
     bodyRaw = await readFile13(bodyPath, "utf8");
@@ -60480,7 +61060,7 @@ async function runCloseout(rootDir, input) {
   const claimsDirForSpec = claimsDirPath(rootDir);
   const specRows = index.objects.filter((row3) => row3.id.startsWith("SPEC."));
   for (const specRow of specRows) {
-    const specBodyPath = join11(rootDir, POMASTER_DIR, ...specRow.bodyRef.split("/"));
+    const specBodyPath = join12(rootDir, POMASTER_DIR, ...specRow.bodyRef.split("/"));
     let specRaw;
     try {
       specRaw = await readFile13(specBodyPath, "utf8");
@@ -60866,7 +61446,7 @@ function kernelErrorOf2(err) {
 // packages/cli/dist/catalog.js
 init_dist();
 import { writeFileSync as writeFileSync5 } from "node:fs";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 function emptyMaterial() {
   return {
     title_zh: null,
@@ -61084,7 +61664,7 @@ async function runCatalogRelock(deps) {
   try {
     catalogRoot = catalogRootOf(deps);
     report = relockCatalog(catalogRoot);
-    writeFileSync5(join12(catalogRoot, LOCK_FILE_NAME), `${JSON.stringify(report.next, null, 2)}
+    writeFileSync5(join13(catalogRoot, LOCK_FILE_NAME), `${JSON.stringify(report.next, null, 2)}
 `, "utf8");
     verification = verifyCatalogLock(catalogRoot);
   } catch (error) {
@@ -61433,7 +62013,7 @@ async function runGraph(input) {
 }
 
 // packages/cli/dist/eval.js
-import { existsSync as existsSync21, readFileSync as readFileSync27 } from "node:fs";
+import { existsSync as existsSync21, readFileSync as readFileSync28 } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 init_dist();
 var EVAL_SUITES = ["behavioral"];
@@ -61454,7 +62034,7 @@ function loadSeeds(seedsPath = BEHAVIORAL_SEEDS_PATH) {
   if (lower.endsWith(".yaml") || lower.endsWith(".yml")) {
     throw new Error(`eval \u547D\u4EE4\u6D88\u8D39\u9762\u4E3A seeds.json\uFF0C\u4E0D\u63A5\u53D7 yaml \u8F7D\u7269\uFF08${seedsPath}\uFF09\u3002PRD \xA794.2 yaml \u8F7D\u7269\uFF08tests/behavioral/eval-cases.yaml\uFF09\u662F\u767B\u8BB0\u5F62\u6001\uFF1Aschema \u6821\u9A8C\u4E0E json \u540C\u6784\u951A\u5B9A\u5728 tests/behavioral/eval-carrier.spec.ts\uFF08js-yaml devDependency + ajv\uFF0Ctests \u9762\uFF09\uFF1B\u5224\u5377\u8BF7\u6CE8\u5165 seeds.json \u6216\u7701\u7565 seedsPath \u7528\u4ED3\u5E93\u7F3A\u7701\u8D26\u672C\u3002`);
   }
-  const raw = JSON.parse(readFileSync27(seedsPath, "utf8"));
+  const raw = JSON.parse(readFileSync28(seedsPath, "utf8"));
   const file = raw;
   if (!Array.isArray(file.seeds)) {
     throw new Error(`seeds.json \u5F62\u6001\u975E\u6CD5\uFF1A\u7F3A seeds \u6570\u7EC4\uFF08${seedsPath}\uFF09`);
@@ -62025,7 +62605,7 @@ async function runAuditTask(rootDir, input) {
 init_dist();
 init_src();
 import { readFile as readFile15 } from "node:fs/promises";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 async function runLedgerRecord(rootDir, input, deps) {
   const emptyResult6 = {
     ledger_ref: "",
@@ -62114,7 +62694,7 @@ async function runLedgerRecord(rootDir, input, deps) {
 }
 async function runLedgerList(rootDir, input) {
   const classificationFilter = input.classification?.trim() ? input.classification.trim() : null;
-  const path = join13(rootDir, POMASTER_DIR, "state", "exception-ledger.json");
+  const path = join14(rootDir, POMASTER_DIR, "state", "exception-ledger.json");
   let raw;
   try {
     raw = await readFile15(path, "utf8");
@@ -62204,30 +62784,30 @@ async function runLedgerList(rootDir, input) {
 // packages/cli/dist/knowledge.js
 init_dist();
 import { existsSync as existsSync24 } from "node:fs";
-import { join as join16 } from "node:path";
+import { join as join17 } from "node:path";
 
 // packages/cli/dist/research.js
 init_src();
 init_dist();
 import { existsSync as existsSync23 } from "node:fs";
 import { mkdir as mkdir2, readFile as readFile17, readdir as readdir2, writeFile as writeFile5 } from "node:fs/promises";
-import { join as join15 } from "node:path";
+import { join as join16 } from "node:path";
 
 // packages/cli/dist/brainstorm.js
 init_src();
 init_dist();
 import { existsSync as existsSync22 } from "node:fs";
 import { mkdir, readdir, readFile as readFile16, writeFile as writeFile4 } from "node:fs/promises";
-import { isAbsolute, join as join14, relative as relative2, resolve as resolve2 } from "node:path";
+import { isAbsolute, join as join15, relative as relative2, resolve as resolve3 } from "node:path";
 var PROMOTE_TARGETS = ["CHANGE", "TASK"];
 function scratchpadRefOf(id) {
   return `.pomaster/discovery/scratchpads/${id}/`;
 }
 function stateFilePath(rootDir, id) {
-  return join14(discoveryScratchpadDirPath(rootDir, id), "state.json");
+  return join15(discoveryScratchpadDirPath(rootDir, id), "state.json");
 }
 function metaFilePath(rootDir, id) {
-  return join14(discoveryScratchpadDirPath(rootDir, id), "meta.json");
+  return join15(discoveryScratchpadDirPath(rootDir, id), "meta.json");
 }
 function cliError(err) {
   if (err instanceof GovernedIdParseError) {
@@ -62851,7 +63431,7 @@ async function runBrainstormPromote(rootDir, input) {
   let txPath = null;
   let txOutError = null;
   if (input.txOut !== void 0) {
-    const resolvedTx = resolve2(rootDir, input.txOut);
+    const resolvedTx = resolve3(rootDir, input.txOut);
     const relPosix = relative2(rootDir, resolvedTx).split("\\").join("/");
     const escapes = relPosix.length === 0 || relPosix === ".." || relPosix.startsWith("../") || isAbsolute(relPosix);
     if (escapes) {
@@ -62881,7 +63461,7 @@ async function runBrainstormPromote(rootDir, input) {
     return fail6(txOutError, [`brainstorm promote: FAILED \u2014 SCHEMA_INVALID (--tx-out)`]);
   }
   if (txPath === null) {
-    txPath = join14(discoveryScratchpadDirPath(rootDir, input.discoveryId), "promote-tx.json");
+    txPath = join15(discoveryScratchpadDirPath(rootDir, input.discoveryId), "promote-tx.json");
   }
   try {
     await mkdir(discoveryScratchpadDirPath(rootDir, input.discoveryId), { recursive: true });
@@ -63008,11 +63588,11 @@ var UNKNOWN_TRIAGE_KEYS = [
 ];
 var DECISION_GRAPH_FILENAME = "decision-graph.json";
 function decisionGraphPath(rootDir, id) {
-  return join14(discoveryScratchpadDirPath(rootDir, id), DECISION_GRAPH_FILENAME);
+  return join15(discoveryScratchpadDirPath(rootDir, id), DECISION_GRAPH_FILENAME);
 }
 var DECISION_INPUTS_FILENAME = "decision-inputs.json";
 function decisionInputsPath(rootDir, id) {
-  return join14(discoveryScratchpadDirPath(rootDir, id), DECISION_INPUTS_FILENAME);
+  return join15(discoveryScratchpadDirPath(rootDir, id), DECISION_INPUTS_FILENAME);
 }
 async function loadDecisionGraph(rootDir, id) {
   const graphPath = decisionGraphPath(rootDir, id);
@@ -63757,7 +64337,7 @@ async function resolveResearchHost(rootDir, hostOption) {
         }
       };
     }
-    if (!existsSync23(join15(rootDir, ...host.split("/")))) {
+    if (!existsSync23(join16(rootDir, ...host.split("/")))) {
       return {
         error: {
           code: "RESEARCH_HOST_NOT_FOUND",
@@ -63782,7 +64362,7 @@ async function resolveResearchHost(rootDir, hostOption) {
   const active = [];
   for (const id of entries) {
     try {
-      const raw = JSON.parse(await readFile17(join15(padsDir, id, "state.json"), "utf8"));
+      const raw = JSON.parse(await readFile17(join16(padsDir, id, "state.json"), "utf8"));
       if (typeof raw.state === "string" && (raw.state === "DISCOVERY" || raw.state === "READY_TO_PROMOTE")) {
         active.push(id);
       }
@@ -63897,10 +64477,10 @@ async function runResearchStart(rootDir, input) {
   const created = [];
   const skipped = [];
   try {
-    const researchDir = join15(rootDir, ...artifactRoot.split("/"));
+    const researchDir = join16(rootDir, ...artifactRoot.split("/"));
     await mkdir2(researchDir, { recursive: true });
     for (const fileName of RESEARCH_ARTIFACT_FILES) {
-      const filePath = join15(researchDir, fileName);
+      const filePath = join16(researchDir, fileName);
       if (existsSync23(filePath)) {
         skipped.push(`${artifactRoot}${fileName}`);
         continue;
@@ -63972,7 +64552,7 @@ async function runResearchList(rootDir, hostArg) {
     ], [`research list: FAILED \u2014 SCHEMA_INVALID`]);
   }
   const hostRef = normalizeDir(hostArg);
-  const hostDir = join15(rootDir, ...hostRef.split("/"));
+  const hostDir = join16(rootDir, ...hostRef.split("/"));
   if (!existsSync23(hostDir)) {
     return failOutcome("research list", { host_ref: hostRef, artifacts: [] }, [
       {
@@ -63982,7 +64562,7 @@ async function runResearchList(rootDir, hostArg) {
       }
     ], [`research list: FAILED \u2014 RESEARCH_HOST_NOT_FOUND (${hostRef})`]);
   }
-  const indexPath = join15(hostDir, "research", "index.yaml");
+  const indexPath = join16(hostDir, "research", "index.yaml");
   const index = await readIndexYaml(indexPath);
   const artifacts = [];
   if (index !== null) {
@@ -64039,7 +64619,7 @@ async function runResearchInspect(rootDir, researchId) {
       }
     ], [`research inspect: FAILED \u2014 SCHEMA_INVALID`]);
   }
-  const hostDir = join15(rootDir, ...hostRef.split("/"));
+  const hostDir = join16(rootDir, ...hostRef.split("/"));
   if (!existsSync23(hostDir)) {
     return failOutcome("research inspect", {
       research_id: researchId,
@@ -64057,8 +64637,8 @@ async function runResearchInspect(rootDir, researchId) {
       }
     ], [`research inspect: FAILED \u2014 RESEARCH_HOST_NOT_FOUND (${hostRef})`]);
   }
-  const researchDir = join15(hostDir, "research");
-  const indexPath = join15(researchDir, "index.yaml");
+  const researchDir = join16(hostDir, "research");
+  const indexPath = join16(researchDir, "index.yaml");
   if (!existsSync23(indexPath)) {
     return failOutcome("research inspect", {
       research_id: researchId,
@@ -64113,7 +64693,7 @@ async function runResearchInspect(rootDir, researchId) {
   }
   const files = RESEARCH_ARTIFACT_FILES.map((f) => ({
     file: f,
-    present: existsSync23(join15(researchDir, f))
+    present: existsSync23(join16(researchDir, f))
   }));
   const missing = files.filter((f) => !f.present).map((f) => f.file);
   const rawFindings = Array.isArray(index.findings) ? index.findings : [];
@@ -64222,7 +64802,7 @@ async function runResearchInspect(rootDir, researchId) {
   }, human, warnings);
 }
 async function scratchpadDiscoveryState(rootDir, id) {
-  const statePath = join15(discoveryScratchpadDirPath(rootDir, id), "state.json");
+  const statePath = join16(discoveryScratchpadDirPath(rootDir, id), "state.json");
   if (!existsSync23(statePath)) {
     return {
       error: {
@@ -64298,7 +64878,7 @@ async function mutateIndexRequests(indexPath, artifactRoot, hostRef, mutate) {
   const changed = mutate(index);
   if (!changed && !created)
     return { created, changed: false };
-  await mkdir2(join15(indexPath, ".."), { recursive: true });
+  await mkdir2(join16(indexPath, ".."), { recursive: true });
   await writeFile5(indexPath, `${JSON.stringify(index, null, 2)}
 `, "utf8");
   return { created, changed: true };
@@ -64367,7 +64947,7 @@ async function runResearchRequest(rootDir, input) {
       hint: `\u8DEF\u7531\u952E\u8BCD\u5F62\uFF1A${Object.keys(RESEARCH_MODE_ROUTE_HINTS).join(" | ")}\u3002`
     }, [`research request: FAILED \u2014 SCHEMA_INVALID (--gap)`]);
   }
-  const indexPath = join15(discoveryScratchpadDirPath(rootDir, input.discoveryId), "research", "index.yaml");
+  const indexPath = join16(discoveryScratchpadDirPath(rootDir, input.discoveryId), "research", "index.yaml");
   let existingIndex = null;
   if (existsSync23(indexPath)) {
     try {
@@ -64612,7 +65192,7 @@ async function runResearchHandoff(rootDir, input) {
       }
     }
   }
-  const indexPath = join15(discoveryScratchpadDirPath(rootDir, input.discoveryId), "research", "index.yaml");
+  const indexPath = join16(discoveryScratchpadDirPath(rootDir, input.discoveryId), "research", "index.yaml");
   const statusMap = /* @__PURE__ */ new Map();
   for (const id of handoff.answered_requests)
     statusMap.set(id, "answered");
@@ -64913,7 +65493,7 @@ async function loadResearchFinding(rootDir, researchId, findingNumber) {
       }
     };
   }
-  const indexPath = join16(rootDir, ...artifactRoot.split("/"), "index.yaml");
+  const indexPath = join17(rootDir, ...artifactRoot.split("/"), "index.yaml");
   if (!existsSync24(indexPath)) {
     return {
       error: {
@@ -65129,7 +65709,7 @@ async function runKnowledgeDemote(rootDir, input, deps) {
 
 // packages/cli/dist/memory.js
 init_dist();
-import { readFileSync as readFileSync28 } from "node:fs";
+import { readFileSync as readFileSync29 } from "node:fs";
 import { homedir as homedir3 } from "node:os";
 var [MEMORY_ENTRY_NOT_FOUND, MEMORY_ALREADY_REVIEWED, MEMORY_REVIEW_REQUIRED, MEMORY_ALREADY_PROMOTED, MEMORY_PROMOTE_OWNER_REQUIRED, MEMORY_CAPTURE_DUPLICATE, MEMORY_HARVEST_NOT_RUN] = MEMORY_CLI_ERROR_VALUES;
 function toCliError2(err, docSection) {
@@ -65198,7 +65778,7 @@ function readStdinText() {
     };
   }
   try {
-    return { text: readFileSync28(0, "utf8") };
+    return { text: readFileSync29(0, "utf8") };
   } catch (err) {
     return {
       error: {
@@ -65776,7 +66356,7 @@ async function runMemoryAudit(rootDir, input) {
 
 // packages/cli/dist/production.js
 init_dist();
-import { readFileSync as readFileSync29 } from "node:fs";
+import { readFileSync as readFileSync30 } from "node:fs";
 var [BAND_SCHEMA_INVALID, BAND_NOT_FOUND, OBSERVATION_NOT_EVALUABLE, CHALLENGE_REJECTED, EVIDENCE_NOT_FOUND] = PRODUCTION_CLI_ERROR_VALUES;
 var NO_AUTO_APPLY_NOTE = "\u5448\u62A5\u6001\u2014\u2014\u4E0D\u5F97\u81EA\u52A8\u5E94\u7528\uFF08PRD \xA790.4 L5695 \u9010\u5B57\uFF09\uFF1APOMASTER_SELF_IMPROVEMENT_CANDIDATE \u65E0\u4EFB\u4F55\u81EA\u52A8\u5E94\u7528\u901A\u8DEF\uFF0C\u300C\u5E94\u7528\u300D\u6C38\u8FDC\u662F\u4EBA/Owner \u7ECF\u6CBB\u7406\u9762\u7684\u663E\u5F0F\u52A8\u4F5C";
 function fail5(result2, command, error) {
@@ -66038,7 +66618,7 @@ async function runProductionEvaluate(rootDir, input) {
     const filePath = input.observationsFile.trim();
     let text;
     try {
-      text = readFileSync29(filePath, "utf8");
+      text = readFileSync30(filePath, "utf8");
     } catch (err) {
       return fail5(empty, command, {
         code: OBSERVATION_NOT_EVALUABLE,
@@ -66622,7 +67202,7 @@ async function runTraceList(rootDir) {
 
 // packages/cli/dist/agents.js
 init_dist();
-import { existsSync as existsSync25, readFileSync as readFileSync30, writeFileSync as writeFileSync6 } from "node:fs";
+import { existsSync as existsSync25, readFileSync as readFileSync31, writeFileSync as writeFileSync6 } from "node:fs";
 var GATEKEEPER_DRIFT_OBSERVED = "GATEKEEPER_DRIFT_OBSERVED";
 var SUPERVISOR_TRIGGER_OBSERVED = "SUPERVISOR_TRIGGER_OBSERVED";
 async function runAgentsStatus(rootDir, input = {}) {
@@ -66785,7 +67365,7 @@ async function referenceSection(rootDir, taskId, warnings) {
   if (existsSync25(manifestPath)) {
     let generatedAtSeq = null;
     try {
-      const parsed = JSON.parse(readFileSync30(manifestPath, "utf8"));
+      const parsed = JSON.parse(readFileSync31(manifestPath, "utf8"));
       const seq2 = isRecord6(parsed) ? parsed.generated_at_seq : void 0;
       if (typeof seq2 === "number")
         generatedAtSeq = seq2;
@@ -68202,6 +68782,17 @@ function createProgram(runs, io = defaultIo) {
       asJson: command.opts().json === true
     });
   });
+  execution.command("audit").description("\u53D8\u66F4\u8D8A\u754C\u5BA1\u8BA1\uFF08Detection \u534A\u8FB9\uFF09\uFF1Agit diff \u8D77\u59CB\u951A\u6536\u96C6\u6267\u884C\u671F\u5B9E\u9645\u53D8\u66F4\u6587\u4EF6\u96C6\uFF08--diff-base \u8C03\u7528\u65B9\u7533\u62A5\u2014\u2014execution record \u65E0 ref/seq \u951A\u5B57\u6BB5\uFF1Buntracked \u540C\u6536\uFF1B\u8DEF\u5F84\u6E05\u6D17\u6CBF recon \u679A\u4E3E\u6392\u9664\u95ED\u5305 node_modules/dist/.git/coverage/.pomaster\uFF09\u2192 KEYBINDING \u5728\u518C\u7ED1\u5B9A\u89E3\u6790 governed id\uFF08\u672A\u547D\u4E2D unmapped \u8BDA\u5B9E\u6E05\u5355\u7981\u9759\u9ED8\u4E22\u5F03\uFF1B\u65E0\u7ED1\u5B9A\u8868\u5DE5\u4F5C\u533A\u5168 unmapped \u8BDA\u5B9E\u5448\u73B0\u975E\u9519\u8BEF\uFF09\u2192 \u5BF9\u7167 execution.permit_ids \u7684 permit scope.subject_ids \u5224 in/out-of-scope\uFF08\u5224\u5377\u951A kernel checkPermit \u6210\u5458\u5224\u5B9A\u5355\u4E00\u5B9E\u73B0\uFF09\u2192 \u5BA1\u8BA1\u62A5\u544A blob + OBS \u56DE\u6267\u843D 17 sidecar\uFF08result=OBSERVED \u5E26 blob ref\uFF09+ stdout \u8D8A\u754C\u9010\u6761\u660E\u7EC6\uFF08path + \u5224\u5B9A\u4F9D\u636E\uFF09\uFF1B\u8D8A\u754C\u5B58\u5728 exit 1 \u4E0D\u4F2A\u9020\u7EFF\uFF1B\u975E git \u5DE5\u4F5C\u533A/\u951A\u7F3A\u5E2D/\u951A\u65E0\u6548 fail-closed \u96F6\u843D\u76D8\uFF08\u4E0D\u505A fs \u5FEB\u7167\u515C\u5E95\uFF09").requiredOption("--execution-id <AGX-n>", "\u6267\u884C\u8EAB\u4EFD\u951A\uFF08AGX-<\u5E74\u4EFD>-<\u5E8F\u53F7>\uFF1BOBS \u56DE\u6267 execution_id \u5FC5\u586B\u2014\u2014S1 \u7981\u81EA\u9020\u8EAB\u4EFD\uFF0C\u987B\u4E3A executions/ \u5DF2\u767B\u8BB0\u6863\u6848\uFF0C\u5DF2\u5C01\u53E3\u6267\u884C\u5141\u8BB8\u4E8B\u540E\u5BA1\u8BA1\uFF09").requiredOption("--diff-base <git-ref>", "diff \u8D77\u59CB\u951A\uFF08commit/branch/tag\u2014\u2014execution begin \u65F6\u523B\u7684\u5DE5\u4F5C\u533A\u57FA\u7EBF ref\uFF1Bexecution record \u5B9E\u8BFB\u65E0 ref/seq \u951A\u5B57\u6BB5\uFF0C\u951A\u7531\u8C03\u7528\u65B9\u7533\u62A5\uFF1A\u7F3A\u5E2D/\u65E0\u6548 = \u663E\u5F0F\u62A5\u9519\u96F6\u843D\u76D8\uFF09").option("--json", "machine-readable JSON output (\xA745)").action(async (opts, command) => {
+    const outcome = await runExecutionAudit(resolveDir(command), {
+      executionId: opts.executionId,
+      diffBase: opts.diffBase
+    });
+    record({
+      command: "execution audit",
+      outcome,
+      asJson: command.opts().json === true
+    });
+  });
   const trace = program2.command("trace").description("Execution Trace \u547D\u4EE4\u9762\uFF08\xA78/\xA714 P0.5-3\uFF09\uFF1Ashow = \u6D3E\u751F\u6295\u5F71\u7EAF\u8BFB\uFF08\u5C01\u5B58\u5728\u5EA7=\u5C01\u5B58\u5FEB\u7167+stale \u5BF9\u8D26\u663E\u5F0F\uFF1B--seal --retention <\u56DB\u6863> = \u663E\u5F0F\u7269\u5316\u5BA1\u8BA1\u5FEB\u7167\uFF09/ list = \u5C01\u5B58\u6E05\u5355\uFF1BTrace \u662F Identity \u7684\u6D3E\u751F\u6295\u5F71\u4FA7\u8F66\uFF08A19 Identity Is Not Trace\uFF09\uFF0CCLI \u96F6\u5224\u5377\u96F6 GC");
   trace.command("show").description("\u6309 AGX \u5448\u73B0 Execution Trace Manifest\uFF08\xA78.2 \u95ED\u5F62\u6001 12 \u952E\uFF09\uFF1A\u7F3A\u7701 = \u7EAF\u6295\u5F71 on-demand\uFF08journal TX_APPLIED \u5199\u8DB3\u8FF9 + evidence GRN/CLM \u6536\u636E\u2014\u2014\u96F6\u65B0\u91C7\u96C6\u5668\uFF0C\u540C state \u91CD\u653E\u5B57\u8282\u7A33\u5B9A\uFF09\uFF1B\u5C01\u5B58\u5728\u5EA7 = \u5C01\u5B58\u5FEB\u7167 + canonical \u91CD\u653E\u5BF9\u8D26\uFF08stale \u663E\u5F0F\u5448\u73B0\u975E\u9519\u8BEF\u2014\u2014\u5FEB\u7167\u4E0D\u5192\u5145\u65B0\u9C9C\uFF09\uFF1B--seal --retention <\u6863> = \u663E\u5F0F\u7269\u5316\uFF08retention \u5FC5\u586B\u6210\u5BF9\uFF1AEPHEMERAL\u2192runtime/traces \u53EF\u4E22\u5F03\uFF0CTASK/INCIDENT/AUDIT_RETENTION\u2192traces/ durable \u8FDB Git\uFF1B\u4EC5\u8BB0\u5F55\u4E0D GC\u2014\u2014\u88C1\u51B3 8 \u2461\uFF09\uFF1B\u8BCD\u5F62\u975E\u6CD5/\u672A\u767B\u8BB0\u6863\u6848/\u8BCD\u8868\u5916/\u91CD\u590D\u5C01\u5B58\u539F\u7801\u900F\u4F20\uFF08SCHEMA_INVALID/EXECUTION_NOT_FOUND/VOCAB_INVALID_VALUE/TRACE_ALREADY_SEALED\uFF09").argument("<execution-id>", "\u6267\u884C\u8EAB\u4EFD\uFF08AGX-<4\u4F4D\u5E74\u4EFD>-<\u5E8F\u53F7>\uFF1B\u7981\u81EA\u9020\u7B2C\u4E8C\u79CD EXEC-* \u8EAB\u4EFD\u2014\u2014\xA716 Case A\uFF09").option("--seal", "\u663E\u5F0F\u5C01\u5B58\uFF1A\u7269\u5316\u5F53\u524D\u6295\u5F71\u4E3A\u5BA1\u8BA1\u5FEB\u7167\uFF08\u4E0E --retention \u6210\u5BF9\u5FC5\u586B\uFF1B\u91CD\u590D\u5C01\u5B58 TRACE_ALREADY_SEALED \u663E\u5F0F\u62D2\u7EDD\uFF09").option("--retention <retention>", "\u7559\u5B58\u6863\uFF08PRD \xA78.3 \u56DB\u6863\u9010\u5B57\uFF1AEPHEMERAL | TASK_RETENTION | INCIDENT_RETENTION | AUDIT_RETENTION\uFF1B\u8BCD\u8868\u5916 VOCAB_INVALID_VALUE fail-closed\u2014\u2014\u4EC5\u8BB0\u5F55\u4E0D GC\uFF09").option("--json", "machine-readable JSON output (\xA745)").action(async (executionId, opts, command) => {
     const outcome = await runTraceShow(resolveDir(command), executionId, {
@@ -68299,12 +68890,12 @@ function collectValues(value, previous) {
 }
 function readLineFromStdin() {
   const rl = createInterface({ input: process.stdin });
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     rl.once("line", (line) => {
-      resolve3(line);
+      resolve4(line);
       rl.close();
     });
-    rl.once("close", () => resolve3(null));
+    rl.once("close", () => resolve4(null));
   });
 }
 function takeKeyToken(buffer) {
@@ -68322,7 +68913,7 @@ function takeKeyToken(buffer) {
   return head === void 0 ? null : { token: head, rest: buffer.slice(1) };
 }
 function pumpStdinKeys(handler) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     let buffer = "";
     const cleanup = () => {
       process.stdin.removeListener("data", onData);
@@ -68331,7 +68922,7 @@ function pumpStdinKeys(handler) {
     };
     const onDone = () => {
       cleanup();
-      resolve3();
+      resolve4();
     };
     const onData = (chunk) => {
       buffer += typeof chunk === "string" ? chunk : chunk.toString("utf8");
@@ -68342,7 +68933,7 @@ function pumpStdinKeys(handler) {
         buffer = token.rest;
         if (!handler(token.token)) {
           cleanup();
-          resolve3();
+          resolve4();
           return;
         }
       }