runcastle 1.3.4 → 1.3.5

package/index.js

@@ -52,8 +52,8 @@ var init_docs = __esm(() => {
 
 // ../core/src/config.ts
 import * as z from "zod";
-function resolveSandboxImage(config) {
-  return config.sandboxImage ?? DEFAULT_SANDBOX_IMAGE;
+function resolveSandboxImage(config, project) {
+  return project?.sandboxImage?.trim() || config.sandboxImage?.trim() || DEFAULT_SANDBOX_IMAGE;
 }
 function resolveBurnCacheMode(config) {
   return BURN_CACHE_SANDBOXES.includes(config.sandbox) ? config.burnCache : "off";
@@ -181,6 +181,14 @@ import * as z2 from "zod";
 function isProjectSessionKind(kind) {
   return PROJECT_SESSION_KINDS.includes(kind);
 }
+function driveDenialOf(result) {
+  return {
+    ...result.deniedReason ? { deniedReason: result.deniedReason } : {},
+    ...result.deniedCode ? { deniedCode: result.deniedCode } : {},
+    ...result.retriable !== undefined ? { retriable: result.retriable } : {},
+    ...result.dirtyFiles ? { dirtyFiles: result.dirtyFiles } : {}
+  };
+}
 function unresolvedMergeConflict(events) {
   let conflict = null;
   for (const event of events) {
@@ -197,7 +205,7 @@ function unresolvedMergeConflict(events) {
   }
   return conflict;
 }
-var Phase, TicketStatus, SessionKind, PROJECT_SESSION_KINDS, SessionPurpose, MergeBranchPair, RunStatus, FeatureStatus, SessionStatus, TicketKind, FindingKind, FindingSeverity, FindingStatus, FindingOpenReason, ReviewFindingInput, ReviewFinding, TicketInput, Ticket, WaypointType, WaypointStatus, WaypointDisposition, WaypointInput, Waypoint, TestNoteStatus, TestNoteAuthor, TestNote, PREPARED_KEYS, PreparedKey, DRIVE_LOOP_KEYS, FindingSource, PROJECT_NAME_MAX = 80, ProjectName, Project, ProjectFinding, Feature, SessionRow, Run, SettingSource, SettingScope, SettingField, SettingsView, SettingsUpdateInput, EventRow, DriveState;
+var Phase, TicketStatus, SessionKind, PROJECT_SESSION_KINDS, SessionPurpose, MergeBranchPair, RunStatus, FeatureStatus, SessionStatus, TicketKind, FindingKind, FindingSeverity, FindingStatus, FindingOpenReason, FindingResolvedBy, ReviewFindingInput, ReviewFinding, TicketInput, Ticket, WaypointType, WaypointStatus, WaypointDisposition, WaypointInput, Waypoint, TestNoteStatus, TestNoteAuthor, TestNote, PREPARED_KEYS, PreparedKey, PROVENANCE_KEYS, ProvenanceKey, DRIVE_LOOP_KEYS, FindingSource, PROJECT_NAME_MAX = 80, ProjectName, Project, ProjectFinding, Feature, SessionRow, Run, SettingSource, SettingScope, SettingField, SettingsView, SettingsUpdateInput, EventRow, DriveState;
 var init_schemas = __esm(() => {
   init_config();
   Phase = z2.enum([
@@ -231,8 +239,9 @@ var init_schemas = __esm(() => {
   TicketKind = z2.enum(["implementation", "review"]);
   FindingKind = z2.enum(["defect", "observation"]);
   FindingSeverity = z2.enum(["high", "medium", "low"]);
-  FindingStatus = z2.enum(["open", "fixing", "fixed", "failed", "dismissed"]);
+  FindingStatus = z2.enum(["open", "fixing", "fixed", "failed", "dismissed", "carried"]);
   FindingOpenReason = z2.enum(["over-cap", "fix-failed", "verification"]);
+  FindingResolvedBy = z2.enum(["fix-ticket", "session"]);
   ReviewFindingInput = z2.object({
     kind: FindingKind,
     severity: FindingSeverity,
@@ -256,6 +265,9 @@ var init_schemas = __esm(() => {
     openReason: FindingOpenReason.nullable(),
     failureReason: z2.string().nullable(),
     fixTicketId: z2.string().nullable(),
+    carriedLap: z2.number().nullable(),
+    resolvedBy: FindingResolvedBy.nullable(),
+    resolutionNote: z2.string().nullable(),
     createdAt: z2.number()
   });
   TicketInput = z2.object({
@@ -332,12 +344,14 @@ var init_schemas = __esm(() => {
     "driveInstructions"
   ];
   PreparedKey = z2.enum(PREPARED_KEYS);
+  PROVENANCE_KEYS = [...PREPARED_KEYS, "sandboxImage"];
+  ProvenanceKey = z2.enum(PROVENANCE_KEYS);
   DRIVE_LOOP_KEYS = [
     "devCommand",
     "driveSetupCommand",
     "driveStopCommand"
   ];
-  FindingSource = z2.enum(["prep", "human", "session"]);
+  FindingSource = z2.enum(["prep", "human", "session", "build"]);
   ProjectName = z2.string().min(1, "a project needs a name").max(PROJECT_NAME_MAX, `a project name can be at most ${PROJECT_NAME_MAX} characters`);
   Project = z2.object({
     id: z2.string(),
@@ -346,6 +360,7 @@ var init_schemas = __esm(() => {
     sessionBranch: z2.string().optional(),
     devCommand: z2.string().optional(),
     model: z2.string().optional(),
+    sandboxImage: z2.string().optional(),
     setupCommand: z2.string().optional(),
     verifyCommands: z2.string().optional(),
     knownFailures: z2.string().optional(),
@@ -356,7 +371,7 @@ var init_schemas = __esm(() => {
     closedAt: z2.number().optional()
   });
   ProjectFinding = z2.object({
-    key: PreparedKey,
+    key: ProvenanceKey,
     source: FindingSource,
     evidence: z2.string().optional(),
     establishedAt: z2.number(),
@@ -644,6 +659,7 @@ var init_db_schema = __esm(() => {
     devCommand: text("dev_command"),
     model: text("model"),
     sandbox: text("sandbox"),
+    sandboxImage: text("sandbox_image"),
     closedAt: integer("closed_at"),
     setupCommand: text("setup_command"),
     verifyCommands: text("verify_commands"),
@@ -738,6 +754,9 @@ var init_db_schema = __esm(() => {
     openReason: text("open_reason").$type(),
     failureReason: text("failure_reason"),
     fixTicketId: text("fix_ticket_id"),
+    carriedLap: integer("carried_lap"),
+    resolvedBy: text("resolved_by").$type(),
+    resolutionNote: text("resolution_note"),
     createdAt: integer("created_at").notNull()
   });
   testNotes = sqliteTable("test_notes", {
@@ -2129,6 +2148,7 @@ function rowToProject(row) {
     sessionBranch: row.sessionBranch ?? undefined,
     devCommand: row.devCommand ?? undefined,
     model: row.model ?? undefined,
+    sandboxImage: row.sandboxImage ?? undefined,
     setupCommand: row.setupCommand ?? undefined,
     verifyCommands: row.verifyCommands ?? undefined,
     knownFailures: row.knownFailures ?? undefined,
@@ -2797,8 +2817,8 @@ var init_drive_env = () => {};
 
 // src/services/findings.ts
 import { and as and4, eq as eq4 } from "drizzle-orm";
-function isPreparedKey(key) {
-  return PREPARED_SET.has(key);
+function isProvenanceKey(key) {
+  return PROVENANCE_SET.has(key);
 }
 function findingRow(ctx, projectId, key) {
   return ctx.db.select({
@@ -2840,7 +2860,7 @@ function recordFinding(ctx, projectId, input) {
   });
 }
 function recordHuman(ctx, projectId, key, value) {
-  if (!isPreparedKey(key))
+  if (!isProvenanceKey(key))
     return;
   const existing = findingRow(ctx, projectId, key);
   if (value === null) {
@@ -2884,8 +2904,8 @@ async function listFindings(ctx, project) {
       distances.set(sha, await commitsSince(project.repoPath, sha, mainLine));
     }
   }
-  const order = new Map(PREPARED_KEYS.map((k, i) => [k, i]));
-  return rows.filter((row) => isPreparedKey(row.key)).sort((a, b) => (order.get(a.key) ?? 0) - (order.get(b.key) ?? 0)).map((row) => {
+  const order = new Map(PROVENANCE_KEYS.map((k, i) => [k, i]));
+  return rows.filter((row) => isProvenanceKey(row.key)).sort((a, b) => (order.get(a.key) ?? 0) - (order.get(b.key) ?? 0)).map((row) => {
     const staleCommits = row.establishedSha ? distances.get(row.establishedSha) : undefined;
     return {
       key: row.key,
@@ -2905,7 +2925,7 @@ function unsetPreparedKeys(project) {
     return value === undefined || value.trim() === "";
   });
 }
-var VALUE_COLUMN, COLUMN_NAME, PREPARED_SET, UNVERIFIED;
+var VALUE_COLUMN, COLUMN_NAME, PREPARED_SET, PROVENANCE_SET, UNVERIFIED;
 var init_findings = __esm(() => {
   init_src();
   init_schema();
@@ -2918,7 +2938,8 @@ var init_findings = __esm(() => {
     driveSetupCommand: projects.driveSetupCommand,
     driveStopCommand: projects.driveStopCommand,
     dbResetCommand: projects.dbResetCommand,
-    driveInstructions: projects.driveInstructions
+    driveInstructions: projects.driveInstructions,
+    sandboxImage: projects.sandboxImage
   };
   COLUMN_NAME = {
     setupCommand: "setupCommand",
@@ -2928,9 +2949,11 @@ var init_findings = __esm(() => {
     driveSetupCommand: "driveSetupCommand",
     driveStopCommand: "driveStopCommand",
     dbResetCommand: "dbResetCommand",
-    driveInstructions: "driveInstructions"
+    driveInstructions: "driveInstructions",
+    sandboxImage: "sandboxImage"
   };
   PREPARED_SET = new Set(PREPARED_KEYS);
+  PROVENANCE_SET = new Set(PROVENANCE_KEYS);
   UNVERIFIED = { verifiedAt: null, verifiedSha: null };
 });
 
@@ -2963,6 +2986,18 @@ function deriveDriveState(info) {
 function migrationPaths(paths) {
   return paths.filter((p) => MIGRATION_DIR_RE.test(p) || DRIZZLE_SQL_RE.test(p));
 }
+function deniedStart(deniedReason, deniedCode, dirtyFiles) {
+  return {
+    ok: false,
+    deniedReason,
+    deniedCode,
+    retriable: deniedCode === "slot_held",
+    ...dirtyFiles ? { dirtyFiles } : {}
+  };
+}
+function truncatedFileList(files) {
+  return `${files.slice(0, 5).join(", ")}${files.length > 5 ? ", \u2026" : ""}`;
+}
 function featureBranch(slug) {
   return `feature/${slug}`;
 }
@@ -3692,6 +3727,10 @@ async function commitPipelineDocs(repoPath) {
     await commitDocs(repoPath, "runcastle: docs the pipeline left uncommitted");
   } catch {}
 }
+async function driveBlockingPaths(repoPath) {
+  await commitPipelineDocs(repoPath);
+  return porcelainPaths((await git(repoPath).raw(["status", "--porcelain"])).trim());
+}
 function activeTestDriveFeatureId() {
   return testDriveState?.kind === "feature" ? testDriveState.featureId : undefined;
 }
@@ -3779,7 +3818,7 @@ async function testDrive(ctx, project, feature, action, purpose = "human") {
     if (carriedChanges.length > 0) {
       emit(ctx, feature.id, {
         type: "testdrive.carried_changes",
-        message: `${carriedChanges.length} uncommitted file(s) came back with you onto ${previousBranch2}: ${carriedChanges.slice(0, 5).join(", ")}${carriedChanges.length > 5 ? ", \u2026" : ""}`,
+        message: `${carriedChanges.length} uncommitted file(s) came back with you onto ${previousBranch2}: ${truncatedFileList(carriedChanges)}`,
         data: { branch: previousBranch2, files: carriedChanges }
       });
     }
@@ -3792,18 +3831,22 @@ async function testDrive(ctx, project, feature, action, purpose = "human") {
       ...teardown?.failure ? { hookFailure: teardown.failure } : {}
     };
   }
-  await commitPipelineDocs(project.repoPath);
-  const porcelain = (await g.raw(["status", "--porcelain"])).trim();
-  if (porcelain !== "")
-    return { ok: false, deniedReason: DENY_DIRTY };
+  const dirtyFiles = await driveBlockingPaths(project.repoPath);
+  if (dirtyFiles.length > 0) {
+    if (purpose === "review") {
+      emit(ctx, feature.id, {
+        type: "reviewdrive.denied",
+        message: `review drive denied \u2014 ${dirtyFiles.length} uncommitted file(s) in the working tree: ${truncatedFileList(dirtyFiles)}`,
+        data: { code: "dirty", dirtyFiles }
+      });
+    }
+    return deniedStart(DENY_DIRTY, "dirty", dirtyFiles);
+  }
   if (testDriveState) {
-    return {
-      ok: false,
-      deniedReason: testDriveState.kind === "dryRun" ? DENY_DRY_RUN_ACTIVE : DENY_ACTIVE
-    };
+    return deniedStart(testDriveState.kind === "dryRun" ? DENY_DRY_RUN_ACTIVE : DENY_ACTIVE, "slot_held");
   }
   if (purpose === "human" && hasActiveRun(ctx, feature.id)) {
-    return { ok: false, deniedReason: DENY_ACTIVE_RUN };
+    return deniedStart(DENY_ACTIVE_RUN, "active_run");
   }
   const talkWorktree = worktreeDir(project.id, feature.slug);
   let detachedWorktree;
@@ -3863,7 +3906,7 @@ async function reviewDrive(ctx, project, feature, action) {
   return {
     ok: stop.ok,
     action: "stop",
-    ...stop.deniedReason ? { deniedReason: stop.deniedReason } : {},
+    ...driveDenialOf(stop),
     drive: activeDriveInfo(),
     ...stop.hookFailure ? { hookFailure: stop.hookFailure } : {}
   };
@@ -3892,7 +3935,7 @@ async function startReviewDrive(ctx, project, feature) {
   return {
     ok: start.ok,
     action: "start",
-    ...start.deniedReason ? { deniedReason: start.deniedReason } : {},
+    ...driveDenialOf(start),
     drive: activeDriveInfo(),
     ...start.hookFailure ? { hookFailure: start.hookFailure } : {}
   };
@@ -4108,15 +4151,17 @@ ${result.output}` : ""}`,
 }
 async function dirtyPaths(g) {
   try {
-    const out = (await g.raw(["status", "--porcelain"])).trim();
-    if (!out)
-      return [];
-    return out.split(`
-`).map((line) => line.slice(3).trim()).map((p) => p.includes(" -> ") ? p.split(" -> ").at(-1) ?? p : p).map((p) => p.replace(/^"|"$/g, "")).filter(Boolean);
+    return porcelainPaths((await g.raw(["status", "--porcelain"])).trim());
   } catch {
     return [];
   }
 }
+function porcelainPaths(out) {
+  if (!out)
+    return [];
+  return out.split(`
+`).map((line) => line.slice(3).trim()).map((p) => p.includes(" -> ") ? p.split(" -> ").at(-1) ?? p : p).map((p) => p.replace(/^"|"$/g, "")).filter(Boolean);
+}
 async function detectDbDrift(ctx, project, feature, previousBranch, driveBranch) {
   let files;
   try {
@@ -4524,7 +4569,7 @@ function reportFinding(ctx, args) {
 }
 function updateStatus(ctx, findingId, patch) {
   const current = getFinding(ctx, findingId);
-  ctx.db.update(reviewFindings).set(patch).where(eq6(reviewFindings.id, findingId)).run();
+  ctx.db.update(reviewFindings).set({ carriedLap: null, resolvedBy: null, resolutionNote: null, ...patch }).where(eq6(reviewFindings.id, findingId)).run();
   emit(ctx, current.featureId, {
     type: "finding.updated",
     message: `finding ${findingId} marked ${patch.status}`,
@@ -4543,7 +4588,8 @@ function markFixed(ctx, findingId) {
   return updateStatus(ctx, findingId, {
     status: "fixed",
     openReason: null,
-    failureReason: null
+    failureReason: null,
+    resolvedBy: "fix-ticket"
   });
 }
 function markFailed(ctx, findingId, reason) {
@@ -4570,6 +4616,8 @@ function dismiss(ctx, findingId) {
 function defectState(finding, fixTicket) {
   if (finding.status === "dismissed")
     return "dismissed";
+  if (finding.status === "carried")
+    return "carried";
   if (finding.status === "fixed" || fixTicket?.status === "done")
     return "fixed";
   if (fixTicket && fixTicket.status !== "failed" && fixTicket.status !== "cancelled") {
@@ -4578,11 +4626,15 @@ function defectState(finding, fixTicket) {
   return finding.status === "open" || finding.status === "failed" || fixTicket?.status === "failed" || fixTicket?.status === "cancelled" ? "open" : "fixing";
 }
 function viewByFeature(ctx, featureId) {
+  const feature = getFeatureRow(ctx, featureId);
   const findings = listByFeature3(ctx, featureId);
   const tickets2 = listByFeature2(ctx, featureId);
   const summary = { found: 0, fixed: 0, open: 0, observations: 0 };
   const openDefects = [];
+  const carriedFindings = findings.filter(isCarried);
   for (const finding of findings) {
+    if (finding.lap !== feature.lap)
+      continue;
     if (finding.kind === "observation") {
       summary.observations += 1;
       continue;
@@ -4596,11 +4648,75 @@ function viewByFeature(ctx, featureId) {
       openDefects.push(finding);
     }
   }
-  return { findings, openDefects, summary };
+  return { findings, openDefects, carriedFindings, summary };
+}
+function openDefectsAcrossLaps(ctx, featureId) {
+  const tickets2 = listByFeature2(ctx, featureId);
+  return listByFeature3(ctx, featureId).filter((finding) => finding.kind === "defect" && defectState(finding, fixTicketOf(finding, tickets2)) === "open");
+}
+function isCarried(finding) {
+  return finding.status === "carried";
+}
+function carriedDefectsAcrossLaps(ctx, featureId) {
+  return listByFeature3(ctx, featureId).filter(isCarried);
+}
+function undispositionedDefects(ctx, featureId) {
+  const { lap } = getFeatureRow(ctx, featureId);
+  return openDefectsAcrossLaps(ctx, featureId).filter((finding) => finding.lap < lap);
 }
 function fixTicketOf(finding, tickets2) {
   return finding.fixTicketId ? tickets2.find((t) => t.id === finding.fixTicketId) : undefined;
 }
+function requireDispositionable(ctx, featureId, findingId) {
+  const finding = getFinding(ctx, findingId);
+  const eligible = finding.featureId === featureId && (finding.status === "carried" || openDefectsAcrossLaps(ctx, featureId).some((defect) => defect.id === findingId));
+  if (!eligible) {
+    throw new InvalidInputError(`finding ${findingId} is not an open or carried defect of this feature`);
+  }
+  return finding;
+}
+function carryFinding(ctx, featureId, findingId, note) {
+  requireDispositionable(ctx, featureId, findingId);
+  return updateStatus(ctx, findingId, {
+    status: "carried",
+    openReason: null,
+    failureReason: null,
+    carriedLap: getFeatureRow(ctx, featureId).lap,
+    resolutionNote: note?.trim() || null
+  });
+}
+function closeAsAddressed(ctx, featureId, findingId, note) {
+  const attestation = note.trim();
+  if (!attestation) {
+    throw new InvalidInputError("closing a defect as addressed requires a note saying what addressed it");
+  }
+  requireDispositionable(ctx, featureId, findingId);
+  return updateStatus(ctx, findingId, {
+    status: "fixed",
+    openReason: null,
+    failureReason: null,
+    resolvedBy: "session",
+    resolutionNote: attestation
+  });
+}
+function requireLinkableFindings(ctx, featureId, findingIds) {
+  if (new Set(findingIds).size !== findingIds.length) {
+    throw new InvalidInputError("two tickets in this batch link to the same finding");
+  }
+  for (const findingId of findingIds)
+    requireDispositionable(ctx, featureId, findingId);
+}
+function linkFixTicket(ctx, featureId, findingId, fixTicketId) {
+  requireDispositionable(ctx, featureId, findingId);
+  ctx.db.update(reviewFindings).set({ fixTicketId }).where(eq6(reviewFindings.id, findingId)).run();
+  return markFixing(ctx, findingId);
+}
+function reopenFinding(ctx, findingId) {
+  const finding = getFinding(ctx, findingId);
+  if (finding.status !== "carried")
+    throw new InvalidInputError("only a carried finding can be reopened");
+  return updateStatus(ctx, findingId, { status: "open", openReason: null, failureReason: null });
+}
 function promoteOpenDefects(ctx, featureId, findingIds) {
   const open = viewByFeature(ctx, featureId).openDefects;
   const defects = findingIds ? findingIds.map((id) => {
@@ -4646,12 +4762,17 @@ function carriedWork(ctx, featureId) {
   const carried = ctx.db.select({ id: testNotes.id }).from(testNotes).where(and7(eq7(testNotes.featureId, featureId), eq7(testNotes.status, "carried"))).all();
   return {
     carriedNotes: carried.length,
-    openDefects: viewByFeature(ctx, featureId).openDefects.map((defect) => ({
-      title: defect.title,
-      location: defect.location,
-      detail: defect.detail,
-      reproStep: defect.reproStep
-    }))
+    openDefects: openDefectsAcrossLaps(ctx, featureId).map(toCarriedDefect),
+    carriedDefects: carriedDefectsAcrossLaps(ctx, featureId).map(toCarriedDefect)
+  };
+}
+function toCarriedDefect(defect) {
+  return {
+    id: defect.id,
+    title: defect.title,
+    location: defect.location,
+    detail: defect.detail,
+    reproStep: defect.reproStep
   };
 }
 function hasCarriedWork(carried) {
@@ -4956,8 +5077,12 @@ function renderRevisitPrompt(feature, lap, purpose, runtime = DEFAULT_RUNTIME, c
       `**${carriedSummary} \u2014 address them.** They are this lap's opening agenda:`,
       `- \`${docs2}/test-notes.md\`, section \`## Carried, still open\` \u2014 every note carried`,
       "  and not yet done, whatever lap captured it. It exists; read it.",
-      "- `get_feature_context` \u2192 `openDefects` \u2014 each open defect with its title,",
-      "  location, detail and repro step.",
+      "- `get_feature_context` \u2192 `openDefects` \u2014 each open defect with its `id`, title,",
+      "  location, detail and repro step; and `carriedDefects`, the ones an earlier lap",
+      "  parked (agenda, never an obligation to re-carry). Every open defect from an",
+      '  EARLIER lap needs one of three answers before `complete_phase("tickets")` will',
+      "  pass: **link** it (emit this lap's ticket for it with `originFindingId` set),",
+      "  **carry** it, or **close it as addressed** \u2014 the last two are `resolve_finding`.",
       `- \`${docs2}/spec.md\`, section \`## Later laps\` \u2014 scope parked by earlier laps,`,
       "  OPTIONAL; a missing one is normal, not an error."
     ] : [
@@ -5537,8 +5662,152 @@ function codexLoggedIn(env = process.env, fileExists = existsSync8) {
 }
 var init_codex_auth = () => {};
 
+// src/services/sandbox-image.ts
+import { createHash as createHash2 } from "crypto";
+import { existsSync as existsSync9, readFileSync as readFileSync4 } from "fs";
+import { join as join10 } from "path";
+function projectSandboxDir(repoPath) {
+  return join10(repoPath, ".runcastle", "sandbox");
+}
+function projectDockerfilePath(repoPath) {
+  return join10(projectSandboxDir(repoPath), "Dockerfile");
+}
+function projectImageTag(projectId) {
+  return `${DEFAULT_SANDBOX_IMAGE}-${projectId}`;
+}
+function hashDockerfileContents(contents) {
+  return createHash2("sha256").update(contents).digest("hex");
+}
+function hashDockerfile(path) {
+  try {
+    return hashDockerfileContents(readFileSync4(path));
+  } catch {
+    return null;
+  }
+}
+async function inspectBuiltImage(exec, runtime, tag) {
+  const out = await exec(runtime, [
+    "image",
+    "inspect",
+    "--format",
+    `{{index .Config.Labels "${DOCKERFILE_HASH_LABEL}"}}`,
+    tag
+  ]);
+  if (!(out.ok && out.code === 0))
+    return { present: false, hash: null };
+  const value = out.stdout.trim();
+  return { present: true, hash: value === "" || value === "<no value>" ? null : value };
+}
+function unmanagedImageReason(imageName, projectDockerfilePresent = false) {
+  const route = projectDockerfilePresent ? "clear the sandbox image setting to let runcastle build the .runcastle/sandbox/Dockerfile this repo already ships" : `clear the sandbox image setting to go back to ${DEFAULT_SANDBOX_IMAGE}, or commit a .runcastle/sandbox/Dockerfile for runcastle to build`;
+  return `${imageName} is a custom image managed outside runcastle \u2014 ${route}.`;
+}
+function unmanagedImage(project) {
+  const { id, overwritable } = project;
+  const stored = project.stored?.trim() ?? "";
+  if (stored === "" || overwritable)
+    return null;
+  if (stored === DEFAULT_SANDBOX_IMAGE || stored === projectImageTag(id))
+    return null;
+  return stored;
+}
+function stockBuildArgs(runtime, ids2 = {
+  uid: process.getuid?.(),
+  gid: process.getgid?.()
+}) {
+  if (runtime === "podman")
+    return {};
+  return {
+    ...ids2.uid === undefined ? {} : { AGENT_UID: String(ids2.uid) },
+    ...ids2.gid === undefined ? {} : { AGENT_GID: String(ids2.gid) }
+  };
+}
+function shippedDockerfile(project) {
+  if (!project)
+    return null;
+  const path = projectDockerfilePath(project.repoPath);
+  return existsSync9(path) ? path : null;
+}
+function planImageBuild(input) {
+  const { config: config2, project, stockContext, stockFresh, buildArgs } = input;
+  const stockHash = hashDockerfile(join10(stockContext, "Dockerfile")) ?? "";
+  const stockStep = {
+    tag: DEFAULT_SANDBOX_IMAGE,
+    context: stockContext,
+    dockerfileHash: stockHash,
+    buildArgs
+  };
+  const projectDockerfile = shippedDockerfile(project);
+  const handTyped = project ? unmanagedImage({
+    id: project.id,
+    stored: project.sandboxImage ?? null,
+    overwritable: project.sandboxImageOverwritable
+  }) : null;
+  if (handTyped !== null) {
+    return {
+      kind: "refused",
+      imageName: handTyped,
+      reason: unmanagedImageReason(handTyped, projectDockerfile !== null)
+    };
+  }
+  if (project && projectDockerfile) {
+    const projectTag = projectImageTag(project.id);
+    return {
+      kind: "chain",
+      projectTag,
+      steps: [
+        ...stockFresh ? [] : [stockStep],
+        {
+          tag: projectTag,
+          context: projectSandboxDir(project.repoPath),
+          dockerfileHash: hashDockerfile(projectDockerfile) ?? "",
+          buildArgs: {}
+        }
+      ]
+    };
+  }
+  const imageName = resolveSandboxImage(config2, project);
+  const managed = imageName === DEFAULT_SANDBOX_IMAGE || project !== null && imageName === projectImageTag(project.id);
+  if (!managed)
+    return { kind: "refused", imageName, reason: unmanagedImageReason(imageName) };
+  return { kind: "stock", steps: [stockStep] };
+}
+function buildStepArgs(step) {
+  return [
+    "build",
+    "-t",
+    step.tag,
+    "--label",
+    `${DOCKERFILE_HASH_LABEL}=${step.dockerfileHash}`,
+    ...Object.entries(step.buildArgs).flatMap(([key, value]) => ["--build-arg", `${key}=${value}`]),
+    step.context
+  ];
+}
+function shellQuote(arg, platform) {
+  if (/^[\w@%+=:,./\\-]+$/.test(arg))
+    return arg;
+  if (platform === "win32")
+    return `"${arg}"`;
+  return `'${arg.replace(/'/g, `'\\''`)}'`;
+}
+function imageBuildTerminal(runtime, plan, platform = process.platform) {
+  const steps = plan.steps;
+  const last = steps[steps.length - 1];
+  if (!last)
+    throw new Error("image build plan has no steps");
+  const cwd = last.context;
+  if (steps.length === 1)
+    return { cmd: runtime, args: buildStepArgs(last), cwd };
+  const line = steps.map((step) => [runtime, ...buildStepArgs(step)].map((a) => shellQuote(a, platform)).join(" ")).join(" && ");
+  return platform === "win32" ? { cmd: process.env.ComSpec ?? "cmd.exe", args: ["/d", "/s", "/c", line], cwd } : { cmd: "/bin/sh", args: ["-c", line], cwd };
+}
+var DOCKERFILE_HASH_LABEL = "runcastle.dockerfile-hash";
+var init_sandbox_image = __esm(() => {
+  init_src();
+});
+
 // src/doctor/doctor.ts
-import { existsSync as existsSync9, statSync } from "fs";
+import { existsSync as existsSync10 } from "fs";
 async function versionProbe(exec, id, label, bin, fix) {
   const out = await exec(bin, ["--version"]);
   if (out.ok && out.code === 0) {
@@ -5651,7 +5920,7 @@ function runtimeAfkKeyProbe(spec, env, severity = "error") {
   };
 }
 async function runtimeProbes(spec, deps) {
-  const fileExists = deps.fileExists ?? existsSync9;
+  const fileExists = deps.fileExists ?? existsSync10;
   const afkKeyProbe = runtimeAfkKeyProbe(spec, deps.env, deps.severity);
   return [
     await runtimeBinaryProbe(spec, deps.exec, deps.severity),
@@ -5745,49 +6014,98 @@ async function containerRuntimeProbe(exec) {
     fix: "Install Docker Desktop or Podman (see docs/research/PREREQS-NOTES.md \xA74). Not needed for interactive-only use."
   };
 }
-async function sandcastleImageProbe(exec, imageName, burnerDockerfile, fileMtime) {
-  const id = "sandcastle-image";
-  const label = "Sandcastle container image";
-  for (const runtime of ["docker", "podman"]) {
-    const present = await exec(runtime, ["--version"]);
-    if (!(present.ok && present.code === 0))
-      continue;
-    const inspect = await exec(runtime, ["image", "inspect", "--format", "{{.Created}}", imageName]);
-    if (inspect.ok && inspect.code === 0) {
-      const created = new Date(inspect.stdout.trim());
-      const dockerfileChanged = fileMtime(burnerDockerfile);
-      if (dockerfileChanged > created) {
-        const date = (value) => value.toISOString().slice(0, 10);
-        return {
-          id,
-          label,
-          tier: 2,
-          status: "stale",
-          severity: "error",
-          detail: `${imageName} built ${date(created)}, burner Dockerfile changed ${date(dockerfileChanged)} \u2014 rebuild`,
-          fix: "Open Settings \u2192 Burns (Rebuild image)."
-        };
-      }
-      return { id, label, tier: 2, status: "ok", severity: "error", detail: `${imageName} present` };
+async function sandcastleImageProbe(input) {
+  const { exec, burnerDockerfile, dockerfileHash, project } = input;
+  const runtime = await presentRuntime(exec);
+  if (!runtime) {
+    return {
+      ...IMAGE_ROW,
+      status: "missing",
+      severity: "error",
+      detail: "no container runtime available to inspect the image",
+      fix: "Install a container runtime (Docker or Podman) first, then build the image from the Enable AFK burns card in the app."
+    };
+  }
+  const projectHash = project ? dockerfileHash(projectDockerfilePath(project.repoPath)) : null;
+  const handTyped = project ? unmanagedImage(project) : null;
+  let stored = project?.stored ?? null;
+  if (project && stored !== null && projectHash === null && project.overwritable) {
+    project.clearStored();
+    stored = null;
+  }
+  const stockHash = dockerfileHash(burnerDockerfile);
+  const stock = await inspectBuiltImage(exec, runtime, DEFAULT_SANDBOX_IMAGE);
+  const stockFresh = stock.present && (stockHash === null || stock.hash === stockHash);
+  if (project && handTyped === null && projectHash !== null) {
+    const tag = projectImageTag(project.id);
+    const image = await inspectBuiltImage(exec, runtime, tag);
+    if (!image.present || project.overwritable && stored !== tag) {
+      return {
+        ...IMAGE_ROW,
+        status: "not-built-yet",
+        severity: "error",
+        detail: image.present ? `${tag} is built but is not this project's image yet` : `.runcastle/sandbox/Dockerfile is not built \u2014 ${tag} does not exist`,
+        fix: "Open Settings \u2192 Burns (Build image) \u2014 runcastle builds .runcastle/sandbox/Dockerfile for you."
+      };
+    }
+    if (image.hash !== projectHash) {
+      return staleImage(`${tag} no longer matches .runcastle/sandbox/Dockerfile`);
+    }
+    if (!stockFresh) {
+      const base = stock.present ? "no longer matches the burner Dockerfile" : "is not built";
+      return staleImage(`${tag} is built on ${DEFAULT_SANDBOX_IMAGE}, which ${base}`);
     }
     return {
-      id,
-      label,
-      tier: 2,
+      ...IMAGE_ROW,
+      status: "ok",
+      severity: "error",
+      detail: `${tag} built from .runcastle/sandbox/Dockerfile`
+    };
+  }
+  const imageName = resolveSandboxImage({ sandboxImage: input.imageName }, { sandboxImage: stored });
+  if (imageName !== DEFAULT_SANDBOX_IMAGE) {
+    const custom = await inspectBuiltImage(exec, runtime, imageName);
+    const clauses = [
+      `${imageName} is a custom image, managed outside runcastle`,
+      ...projectHash === null ? [] : [`and outranks this repo's .runcastle/sandbox/Dockerfile`],
+      ...custom.present ? [] : ["and is not built locally"]
+    ];
+    return {
+      ...IMAGE_ROW,
+      status: "custom",
+      severity: custom.present ? "info" : "error",
+      detail: clauses.join(" \u2014 "),
+      fix: unmanagedImageReason(imageName, projectHash !== null)
+    };
+  }
+  if (!stock.present) {
+    return {
+      ...IMAGE_ROW,
       status: "missing",
       severity: "error",
       detail: `image ${imageName} not found locally`,
       fix: 'Start runcastle and click "Build image" on the Enable AFK burns card \u2014 it builds this for you (one click). Only needed for AFK/sandboxed burns.'
     };
   }
+  if (!stockFresh)
+    return staleImage(`${imageName} no longer matches the burner Dockerfile`);
+  return { ...IMAGE_ROW, status: "ok", severity: "error", detail: `${imageName} present` };
+}
+async function presentRuntime(exec) {
+  for (const runtime of ["docker", "podman"]) {
+    const present = await exec(runtime, ["--version"]);
+    if (present.ok && present.code === 0)
+      return runtime;
+  }
+  return null;
+}
+function staleImage(detail) {
   return {
-    id,
-    label,
-    tier: 2,
-    status: "missing",
+    ...IMAGE_ROW,
+    status: "stale",
     severity: "error",
-    detail: "no container runtime available to inspect the image",
-    fix: "Install a container runtime (Docker or Podman) first, then build the image from the Enable AFK burns card in the app."
+    detail: `${detail} \u2014 rebuild`,
+    fix: "Open Settings \u2192 Burns (Rebuild image)."
   };
 }
 async function runDoctor(env) {
@@ -5795,7 +6113,7 @@ async function runDoctor(env) {
   const processEnv = env.env ?? process.env;
   const imageName = env.imageName ?? DEFAULT_SANDBOX_IMAGE;
   const burnerDockerfile = env.burnerDockerfile ?? burnerDockerfilePath();
-  const fileMtime = env.fileMtime ?? ((path) => statSync(path).mtime);
+  const dockerfileHash = env.dockerfileHash ?? hashDockerfile;
   const required = new Set(env.runtimes ?? [DEFAULT_RUNTIME]);
   const results = [
     await bunProbe(exec),
@@ -5810,7 +6128,13 @@ async function runDoctor(env) {
       severity: required.has(runtime) ? "error" : "info"
     }));
   }
-  results.push(await gitIdentityProbe(exec, env.cwd), await containerRuntimeProbe(exec), await sandcastleImageProbe(exec, imageName, burnerDockerfile, fileMtime));
+  results.push(await gitIdentityProbe(exec, env.cwd), await containerRuntimeProbe(exec), await sandcastleImageProbe({
+    exec,
+    imageName,
+    burnerDockerfile,
+    dockerfileHash,
+    ...env.projectImage ? { project: env.projectImage } : {}
+  }));
   const counts = (r) => r.severity === "error";
   return {
     results,
@@ -5823,11 +6147,12 @@ function exitCodeFor(report, mode) {
     return report.tier1Ok ? 0 : 1;
   return report.ok ? 0 : 1;
 }
-var RUNTIME_SPECS;
+var RUNTIME_SPECS, IMAGE_ROW;
 var init_doctor = __esm(() => {
   init_src();
   init_asset_paths();
   init_codex_auth();
+  init_sandbox_image();
   RUNTIME_SPECS = {
     "claude-code": {
       runtime: "claude-code",
@@ -5859,21 +6184,22 @@ var init_doctor = __esm(() => {
       authFile: codexAuthFile
     }
   };
+  IMAGE_ROW = { id: "sandcastle-image", label: "Sandcastle container image", tier: 2 };
 });
 
 // src/launcher/runtimes/codex.ts
 import {
   copyFileSync,
-  existsSync as existsSync10,
+  existsSync as existsSync11,
   mkdirSync as mkdirSync4,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   readdirSync as readdirSync2,
-  statSync as statSync2,
+  statSync,
   writeFileSync as writeFileSync3
 } from "fs";
-import { basename, dirname as dirname4, join as join10, resolve as resolve7 } from "path";
+import { basename, dirname as dirname4, join as join11, resolve as resolve7 } from "path";
 function codexHomeDir2(sessionId) {
-  return join10(sessionDir(sessionId), "codex-home");
+  return join11(sessionDir(sessionId), "codex-home");
 }
 function realCodexAuthFile(env = process.env) {
   return codexAuthFile(env);
@@ -5921,11 +6247,11 @@ function mcpServerTables(userConfigToml) {
 `).trim();
 }
 function readInheritedMcpServers(env = process.env) {
-  const path = join10(dirname4(realCodexAuthFile(env)), "config.toml");
-  if (!existsSync10(path))
+  const path = join11(dirname4(realCodexAuthFile(env)), "config.toml");
+  if (!existsSync11(path))
     return "";
   try {
-    return mcpServerTables(readFileSync4(path, "utf8"));
+    return mcpServerTables(readFileSync5(path, "utf8"));
   } catch {
     return "";
   }
@@ -5946,19 +6272,19 @@ function renderCodexHooks(hookClient, kind, platform = process.platform) {
   };
 }
 function writeCodexSkills(worktreePath, packDir) {
-  if (!existsSync10(worktreePath))
+  if (!existsSync11(worktreePath))
     return [];
-  const source = join10(packDir, "skills");
-  if (!existsSync10(source))
+  const source = join11(packDir, "skills");
+  if (!existsSync11(source))
     return [];
   const written = [];
   for (const name of readdirSync2(source)) {
-    const skill = join10(source, name, "SKILL.md");
-    if (!existsSync10(skill))
+    const skill = join11(source, name, "SKILL.md");
+    if (!existsSync11(skill))
       continue;
-    const target = join10(worktreePath, CODEX_SKILLS_REL, name);
+    const target = join11(worktreePath, CODEX_SKILLS_REL, name);
     mkdirSync4(target, { recursive: true });
-    const path = join10(target, "SKILL.md");
+    const path = join11(target, "SKILL.md");
     copyFileSync(skill, path);
     written.push(path);
   }
@@ -5972,8 +6298,8 @@ function excludeFromGit(worktreePath, entry) {
     if (!info)
       return;
     mkdirSync4(info, { recursive: true });
-    const path = join10(info, "exclude");
-    const existing = existsSync10(path) ? readFileSync4(path, "utf8") : "";
+    const path = join11(info, "exclude");
+    const existing = existsSync11(path) ? readFileSync5(path, "utf8") : "";
     if (existing.split(/\r?\n/).some((line) => line.trim() === entry))
       return;
     const head = existing.length > 0 && !existing.endsWith(`
@@ -5984,17 +6310,17 @@ function excludeFromGit(worktreePath, entry) {
   } catch {}
 }
 function gitInfoDir(worktreePath) {
-  const dotGit = join10(worktreePath, ".git");
-  if (!existsSync10(dotGit))
+  const dotGit = join11(worktreePath, ".git");
+  if (!existsSync11(dotGit))
     return null;
-  if (statSync2(dotGit).isDirectory())
-    return join10(dotGit, "info");
-  const named = /^gitdir:\s*(.+)$/m.exec(readFileSync4(dotGit, "utf8"));
+  if (statSync(dotGit).isDirectory())
+    return join11(dotGit, "info");
+  const named = /^gitdir:\s*(.+)$/m.exec(readFileSync5(dotGit, "utf8"));
   if (!named)
     return null;
   const gitDir = resolve7(worktreePath, named[1].trim());
   const parent = dirname4(gitDir);
-  return basename(parent) === "worktrees" ? join10(dirname4(parent), "info") : join10(gitDir, "info");
+  return basename(parent) === "worktrees" ? join11(dirname4(parent), "info") : join11(gitDir, "info");
 }
 function buildCodexArgs(input) {
   return [
@@ -6013,7 +6339,7 @@ var init_codex = __esm(() => {
   init_skills_root();
   init_skills();
   CODEX = RUNTIME_SPECS.codex;
-  CODEX_SKILLS_REL = join10(".agents", "skills");
+  CODEX_SKILLS_REL = join11(".agents", "skills");
   KICKOFF_LINES2 = kickoffLinesFor("codex");
   codexRuntime = {
     id: "codex",
@@ -6029,7 +6355,7 @@ var init_codex = __esm(() => {
           doctorHint: 'Run `runcastle doctor` and fix its "Codex CLI" probe, then restart runcastle from a ' + "terminal where `codex --version` works."
         };
       }
-      if (!existsSync10(realCodexAuthFile())) {
+      if (!existsSync11(realCodexAuthFile())) {
         return {
           ok: false,
           reason: "Codex is installed but not logged in \u2014 runcastle copies your own credentials into " + `each session's home, and there are none at ${realCodexAuthFile()}`,
@@ -6041,9 +6367,9 @@ var init_codex = __esm(() => {
     async writeArtifacts(input) {
       const home = codexHomeDir2(input.session.id);
       mkdirSync4(home, { recursive: true });
-      const configPath2 = join10(home, "config.toml");
-      const hooksPath = join10(home, "hooks.json");
-      const agentsPath = join10(home, "AGENTS.md");
+      const configPath2 = join11(home, "config.toml");
+      const hooksPath = join11(home, "hooks.json");
+      const agentsPath = join11(home, "AGENTS.md");
       writeFileSync3(configPath2, renderCodexConfig({
         session: input.session,
         config: input.config,
@@ -6056,8 +6382,8 @@ var init_codex = __esm(() => {
       writeFileSync3(agentsPath, renderSessionPrompt({ ...input, runtime: this.id }), "utf8");
       const files = [configPath2, hooksPath, agentsPath];
       const auth = realCodexAuthFile();
-      if (existsSync10(auth)) {
-        const copied = join10(home, "auth.json");
+      if (existsSync11(auth)) {
+        const copied = join11(home, "auth.json");
         copyFileSync(auth, copied);
         files.push(copied);
       }
@@ -6099,7 +6425,7 @@ var init_runtimes = __esm(() => {
 });
 
 // src/launcher/sessions.ts
-import { statSync as statSync3 } from "fs";
+import { statSync as statSync2 } from "fs";
 import { and as and8, desc as desc3, eq as eq8, inArray as inArray2, isNotNull as isNotNull2, sql as sql2 } from "drizzle-orm";
 function createSessionRow(ctx, input) {
   const row = ctx.db.insert(sessions).values({
@@ -6454,7 +6780,7 @@ function transcriptBytes(session) {
   if (!session?.transcriptPath)
     return;
   try {
-    return statSync3(session.transcriptPath).size;
+    return statSync2(session.transcriptPath).size;
   } catch {
     return;
   }
@@ -6550,7 +6876,7 @@ async function getRuntimeCtx() {
 var current = null;
 
 // src/services/gates.ts
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync12 } from "fs";
 import { and as and9, desc as desc4, eq as eq9, inArray as inArray4 } from "drizzle-orm";
 function checkGate(ctx, check, feature) {
   switch (check) {
@@ -6586,6 +6912,10 @@ function checkGate(ctx, check, feature) {
           reason: 'no review ticket on this lap \u2014 every batch closes with one (kind: "review"); emit it, ' + "fix the kind on a review-shaped ticket, or override this gate with a reason"
         };
       }
+      const undispositioned = undispositionedDefects(ctx, feature.id);
+      if (undispositioned.length > 0) {
+        return { satisfied: false, reason: undispositionedReason(undispositioned) };
+      }
       return { satisfied: true };
     }
     case "all-tickets-terminal": {
@@ -6602,6 +6932,10 @@ function checkGate(ctx, check, feature) {
       return { satisfied: false, reason: "use the Merge button to ship" };
   }
 }
+function undispositionedReason(defects) {
+  const titles = defects.map((defect) => `"${defect.title}"`).join(", ");
+  return `${defects.length} defect${defects.length === 1 ? "" : "s"} from an earlier lap ${defects.length === 1 ? "is" : "are"} still un-dispositioned: ${titles} \u2014 for each, either emit this lap's ticket for it with ` + "`originFindingId` set (link), or call `resolve_finding` to carry it or close it as " + "addressed. The human can also dismiss it from the review page.";
+}
 function notYetTerminal(noun, statuses, order) {
   const counts = new Map;
   for (const s of statuses)
@@ -6615,7 +6949,7 @@ function notYetTerminal(noun, statuses, order) {
 }
 function fileGate(ctx, feature, fileName, reason) {
   const project = projectForFeature(ctx, feature);
-  return existsSync11(featureDocPath(project, feature, fileName)) ? { satisfied: true } : { satisfied: false, reason };
+  return existsSync12(featureDocPath(project, feature, fileName)) ? { satisfied: true } : { satisfied: false, reason };
 }
 function lapWorked(ctx, feature) {
   return ctx.db.select({ id: sessions.id }).from(sessions).where(and9(eq9(sessions.featureId, feature.id), eq9(sessions.lap, feature.lap), inArray4(sessions.kind, [...DOC_WRITING_KINDS]))).all().length > 0;
@@ -6675,20 +7009,21 @@ var init_gates = __esm(() => {
   init_events();
   init_feature_docs();
   init_repo();
+  init_review_findings();
   init_tickets();
   init_waypoints();
   DOC_WRITING_KINDS = ["ideation", "revisit", "converge"];
 });
 
 // src/services/knowledge.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync5, readdirSync as readdirSync3, statSync as statSync4, writeFileSync as writeFileSync4 } from "fs";
-import { join as join11, relative as relative2, resolve as resolve8, sep } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync6, readdirSync as readdirSync3, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
+import { join as join12, relative as relative2, resolve as resolve8, sep } from "path";
 function scaffoldDocs(ctx, feature, opts = {}) {
   const project = projectForFeature(ctx, feature);
   const dir = featureDocsDir(project, feature);
   mkdirSync5(dir, { recursive: true });
   const briefPath = featureDocPath(project, feature, "brief.md");
-  if (!existsSync12(briefPath)) {
+  if (!existsSync13(briefPath)) {
     const override = opts.brief?.trim();
     const created = new Date().toISOString();
     const brief = override ? `${override}
@@ -6715,7 +7050,7 @@ function scaffoldDocs(ctx, feature, opts = {}) {
 function scaffoldMapDoc(project, feature, seed) {
   mkdirSync5(featureDocsDir(project, feature), { recursive: true });
   const mapPath = featureDocPath(project, feature, "map.md");
-  if (existsSync12(mapPath))
+  if (existsSync13(mapPath))
     return;
   writeFileSync4(mapPath, mapDocBody(feature, seed), "utf8");
 }
@@ -6735,18 +7070,18 @@ function mapDocBody(feature, seed) {
 `);
 }
 function readCharter(repoRoot) {
-  const path = join11(repoRoot, CHARTER_FILE);
-  if (!existsSync12(path))
+  const path = join12(repoRoot, CHARTER_FILE);
+  if (!existsSync13(path))
     return;
   try {
-    return readFileSync5(path, "utf8");
+    return readFileSync6(path, "utf8");
   } catch {
     return;
   }
 }
 function listLiveAdrs(repoRoot) {
-  const dir = join11(repoRoot, ADR_DIR_REL);
-  if (!existsSync12(dir))
+  const dir = join12(repoRoot, ADR_DIR_REL);
+  if (!existsSync13(dir))
     return [];
   const docs2 = [];
   for (const entry of readdirSync3(dir, { withFileTypes: true })) {
@@ -6754,7 +7089,7 @@ function listLiveAdrs(repoRoot) {
       continue;
     let content;
     try {
-      content = readFileSync5(join11(dir, entry.name), "utf8");
+      content = readFileSync6(join12(dir, entry.name), "utf8");
     } catch {
       continue;
     }
@@ -6767,10 +7102,10 @@ function listLiveAdrs(repoRoot) {
 function listDocs(ctx, feature) {
   const project = projectForFeature(ctx, feature);
   const dir = featureDocsDir(project, feature);
-  if (!existsSync12(dir))
+  if (!existsSync13(dir))
     return [];
   return readdirSync3(dir, { withFileTypes: true }).filter((e) => e.isFile() && e.name.endsWith(".md")).map((e) => {
-    const path = join11(dir, e.name);
+    const path = join12(dir, e.name);
     return { relPath: e.name, title: readTitle(path, e.name), ...writtenAt(path) };
   }).sort((a, b) => a.relPath.localeCompare(b.relPath));
 }
@@ -6783,20 +7118,20 @@ function readDoc(ctx, feature, relPath) {
   if (rel === "" || rel.startsWith("..") || rel.split(sep).includes("..")) {
     throw new InvalidInputError(`doc path escapes the feature docs dir: ${relPath}`);
   }
-  if (!existsSync12(target))
+  if (!existsSync13(target))
     throw new NotFoundError(`doc not found: ${relPath}`);
-  return { content: readFileSync5(target, "utf8") };
+  return { content: readFileSync6(target, "utf8") };
 }
 function writtenAt(path) {
   try {
-    return { updatedAt: Math.floor(statSync4(path).mtimeMs) };
+    return { updatedAt: Math.floor(statSync3(path).mtimeMs) };
   } catch {
     return {};
   }
 }
 function readTitle(path, fallback) {
   try {
-    const firstLine = readFileSync5(path, "utf8").split(`
+    const firstLine = readFileSync6(path, "utf8").split(`
 `, 1)[0] ?? "";
     const heading = firstLine.match(/^#\s+(.+)$/);
     return heading ? heading[1].trim() : fallback;
@@ -7009,6 +7344,13 @@ var require$1, __create, __defProp2, __getOwnPropDesc, __getOwnPropNames, __getP
   toString() {
     return this.items.join(this.separator);
   }
+}, elidePayloadTokens = (command) => command.replace(/'[A-Za-z0-9+\/=]{120,}'/g, "'\u2026'"), formatExecFailureMessage = (command, result, maxTailChars = MAX_TAIL_CHARS) => {
+  const output = [result.stdout, result.stderr].map((stream) => (stream ?? "").trimEnd()).filter((stream) => stream.length > 0).join(`
+`);
+  const tail = output.length > maxTailChars ? output.slice(output.length - maxTailChars) : output;
+  const headline = `Command failed (exit ${result.exitCode}): ${elidePayloadTokens(command)}`;
+  return tail ? `${headline}
+${tail}` : headline;
 };
 var init_chunk_NGBM7T3E = __esm(() => {
   require$1 = createRequire3(import.meta.url);
@@ -7033,7 +7375,7 @@ import { createRequire as createRequire4 } from "module";
 import * as clack from "@clack/prompts";
 import { join as join$1, basename as basename2, dirname as dirname5, resolve as resolve9, posix as posix2, normalize, isAbsolute as isAbsolute2 } from "path";
 import { styleText, promisify } from "util";
-import { existsSync as existsSync13, statSync as statSync5 } from "fs";
+import { existsSync as existsSync14, statSync as statSync4 } from "fs";
 import { tmpdir as tmpdir2, homedir as homedir3 } from "os";
 import { mkdtemp, writeFile, mkdir, readFile, rm, readdir, stat } from "fs/promises";
 import { exec, execFile } from "child_process";
@@ -8112,7 +8454,7 @@ var Effect_exports, isFunction = (input) => typeof input === "function", dual =
     next4 = b2;
   }
   return out;
-}, getEquivalence2, dedupeWith, dedupe = (self) => dedupeWith(self, equivalence()), join12, TypeId4, emptyArray, getEquivalence3 = (isEquivalent) => make((self, that) => self.length === that.length && toReadonlyArray(self).every((value5, i) => isEquivalent(value5, unsafeGet2(that, i)))), _equivalence3, ChunkProto, makeChunk = (backing) => {
+}, getEquivalence2, dedupeWith, dedupe = (self) => dedupeWith(self, equivalence()), join13, TypeId4, emptyArray, getEquivalence3 = (isEquivalent) => make((self, that) => self.length === that.length && toReadonlyArray(self).every((value5, i) => isEquivalent(value5, unsafeGet2(that, i)))), _equivalence3, ChunkProto, makeChunk = (backing) => {
   const chunk4 = Object.create(ChunkProto);
   chunk4.backing = backing;
   switch (backing._tag) {
@@ -9811,7 +10153,7 @@ ${prefix}}`;
   Object.defineProperty(error3, "toString", {
     enumerable: false,
     value() {
-      const path2 = pipe(this.path, join12(options.pathDelim));
+      const path2 = pipe(this.path, join13(options.pathDelim));
       return `(Invalid data at ${path2}: "${this.message}")`;
     }
   });
@@ -9826,7 +10168,7 @@ ${prefix}}`;
   Object.defineProperty(error3, "toString", {
     enumerable: false,
     value() {
-      const path2 = pipe(this.path, join12(options.pathDelim));
+      const path2 = pipe(this.path, join13(options.pathDelim));
       return `(Missing data at ${path2}: "${this.message}")`;
     }
   });
@@ -9842,7 +10184,7 @@ ${prefix}}`;
   Object.defineProperty(error3, "toString", {
     enumerable: false,
     value() {
-      const path2 = pipe(this.path, join12(options.pathDelim));
+      const path2 = pipe(this.path, join13(options.pathDelim));
       return `(Source unavailable at ${path2}: "${this.message}")`;
     }
   });
@@ -9857,7 +10199,7 @@ ${prefix}}`;
   Object.defineProperty(error3, "toString", {
     enumerable: false,
     value() {
-      const path2 = pipe(this.path, join12(options.pathDelim));
+      const path2 = pipe(this.path, join13(options.pathDelim));
       return `(Unsupported operation at ${path2}: "${this.message}")`;
     }
   });
@@ -9887,7 +10229,7 @@ ${prefix}}`;
     pathDelim: "_",
     seqDelim: ","
   }, options);
-  const makePathString = (path) => pipe(path, join12(pathDelim));
+  const makePathString = (path) => pipe(path, join13(pathDelim));
   const unmakePathString = (pathString) => pathString.split(pathDelim);
   const getEnv = () => typeof process !== "undefined" && ("env" in process) && typeof process.env === "object" ? process.env : {};
   const load = (path, primitive2, split2 = true) => {
@@ -10008,7 +10350,7 @@ ${prefix}}`;
           return fail2(right3.left);
         }
         if (isRight2(left3) && isRight2(right3)) {
-          const path = pipe(prefix, join12("."));
+          const path = pipe(prefix, join13("."));
           const fail19 = fromFlatLoopFail(prefix, path);
           const [lefts, rights] = extend(fail19, fail19, pipe(left3.right, map3(right2)), pipe(right3.right, map3(right2)));
           return pipe(lefts, zip(rights), forEachSequential(([left4, right4]) => pipe(zip2(left4, right4), map10(([left5, right5]) => op.zip(left5, right5)))));
@@ -17940,7 +18282,7 @@ schema (${ast._tag}): ${ast}`;
     const cowFlags = getCopyOnWriteFlags(process.platform);
     for (const relativePath of paths) {
       const src = join$1(hostRepoDir, relativePath);
-      if (!existsSync13(src)) {
+      if (!existsSync14(src)) {
         continue;
       }
       const dest = join$1(worktreePath, relativePath);
@@ -18082,7 +18424,7 @@ ${e instanceof Error ? e.message : String(e)}`
     await mkdir(patchesRoot, { recursive: true });
     let dirName = base;
     let counter6 = 0;
-    while (existsSync13(join$1(patchesRoot, dirName))) {
+    while (existsSync14(join$1(patchesRoot, dirName))) {
       counter6++;
       dirName = `${base}-${counter6}`;
     }
@@ -18254,8 +18596,7 @@ ${msg}`);
 }), GIT_SETUP_TIMEOUT_MS = 1e4, HOOK_TIMEOUT_MS = 60000, COMMIT_COLLECTION_TIMEOUT_MS = 30000, MERGE_TO_HOST_TIMEOUT_MS = 30000, GIT_SETUP_MAX_RETRIES = 2, GIT_SETUP_RETRY_DELAY_MS = 250, TRANSIENT_EXEC_EXIT_CODES, isTransientExecError = (err) => err._tag === "ExecError" && err.exitCode !== undefined && TRANSIENT_EXEC_EXIT_CODES.has(err.exitCode), execOk2 = (sandbox3, command, options) => Effect_exports.flatMap(sandbox3.exec(command, options), (result) => result.exitCode !== 0 ? Effect_exports.fail(new ExecError({
   command,
   exitCode: result.exitCode,
-  message: `Command failed (exit ${result.exitCode}): ${command}
-${result.stderr}`
+  message: formatExecFailureMessage(command, result, sandbox3.maxOutputTailChars)
 })) : Effect_exports.succeed(result)), execOkWithGitTimeout = (sandbox3, command, gitSetupTimeoutMs, options) => execOk2(sandbox3, command, options).pipe(withTimeout(gitSetupTimeoutMs, () => new GitSetupTimeoutError({
   message: `Git command timed out after ${gitSetupTimeoutMs}ms: ${command}`,
   timeoutMs: gitSetupTimeoutMs,
@@ -18591,7 +18932,7 @@ ${result.stderr}`
     yield* Effect_exports.gen(function* () {
       for (const relativePath of pathsToCopy) {
         const hostPath = join$1(options.hostRepoDir, relativePath);
-        if (!existsSync13(hostPath)) {
+        if (!existsSync14(hostPath)) {
           continue;
         }
         const sandboxPath = posix2.join(handle.worktreePath, relativePath);
@@ -18634,6 +18975,7 @@ ${result.stderr}`
     message: "copyIn is not supported for this sandbox provider"
   }));
 }, makeSandboxFromHandle = (handle) => ({
+  maxOutputTailChars: handle.maxOutputTailChars,
   exec: (command, options) => Effect_exports.tryPromise({
     try: () => handle.exec(command, options),
     catch: (e) => new ExecError({
@@ -18732,7 +19074,7 @@ Worktree removed (no uncommitted changes)`);
     };
   }
   const resolvedHostPath = resolveHostPath(m.hostPath);
-  if (!existsSync13(resolvedHostPath)) {
+  if (!existsSync14(resolvedHostPath)) {
     throw new Error(`Mount hostPath does not exist: ${m.hostPath}` + (m.hostPath !== resolvedHostPath ? ` (resolved to ${resolvedHostPath})` : ""));
   }
   return {
@@ -18845,7 +19187,7 @@ Worktree removed (no uncommitted changes)`);
   const selinux = mount.volume !== undefined ? undefined : selinuxLabel || undefined;
   const options = [mount.readonly ? "ro" : undefined, selinux].filter((option5) => option5 !== undefined).join(",");
   return options ? `${base}:${options}` : base;
-}, processFileMountParents = (mounts, sandboxHomedir, statFn = statSync5) => {
+}, processFileMountParents = (mounts, sandboxHomedir, statFn = statSync4) => {
   const parentDirs = /* @__PURE__ */ new Set;
   for (const mount of mounts) {
     let isFile2;
@@ -19846,7 +20188,7 @@ var init_chunk_VOG34SRF = __esm(() => {
     }
     return [];
   });
-  join12 = /* @__PURE__ */ dual(2, (self, sep2) => fromIterable2(self).join(sep2));
+  join13 = /* @__PURE__ */ dual(2, (self, sep2) => fromIterable2(self).join(sep2));
   TypeId4 = /* @__PURE__ */ Symbol.for("effect/Chunk");
   emptyArray = [];
   _equivalence3 = /* @__PURE__ */ getEquivalence3(equals);
@@ -53503,6 +53845,7 @@ var noSandbox = (options) => ({
     const maxOutputTailChars = options?.maxOutputTailChars ?? MAX_TAIL_CHARS;
     const handle = {
       worktreePath,
+      maxOutputTailChars,
       exec: (command, opts) => {
         const cwd = opts?.cwd ?? worktreePath;
         const isWindows = process.platform === "win32";
@@ -53599,7 +53942,7 @@ var init_chunk_62WN33RK = __esm(() => {
 // ../../node_modules/.bun/@ai-hero+sandcastle@0.12.0/node_modules/@ai-hero/sandcastle/dist/index.js
 import { createRequire as createRequire8 } from "module";
 import { mkdirSync as mkdirSync6, appendFileSync } from "fs";
-import path, { join as join14, posix as posix4, dirname as dirname7, relative as relative3 } from "path";
+import path, { join as join15, posix as posix4, dirname as dirname7, relative as relative3 } from "path";
 import { styleText as styleText2 } from "util";
 import * as clack2 from "@clack/prompts";
 import { readdir as readdir2, access as access3, readFile as readFile3, mkdir as mkdir3, writeFile as writeFile3, rm as rm3 } from "fs/promises";
@@ -53668,7 +54011,7 @@ async function run6(options) {
   const targetBranch = effectiveBranchType === "merge-to-head" ? currentHostBranch : undefined;
   const resolvedLogging = options.logging ?? {
     type: "file",
-    path: join14(hostRepoDir, ".sandcastle", "logs", buildLogFilename(resolvedBranch, targetBranch, options.name))
+    path: join15(hostRepoDir, ".sandcastle", "logs", buildLogFilename(resolvedBranch, targetBranch, options.name))
   };
   const displayLayer = resolvedLogging.type === "file" ? (() => {
     printFileDisplayStartup({
@@ -54302,7 +54645,7 @@ ${errorDetail}`
   }
   return vars;
 }), resolveEnv = (repoDir) => Effect_exports.gen(function* () {
-  const sandcastleEnv = yield* parseEnvFile2(join14(repoDir, ".sandcastle", ".env"));
+  const sandcastleEnv = yield* parseEnvFile2(join15(repoDir, ".sandcastle", ".env"));
   const result = {};
   for (const key of Object.keys(sandcastleEnv)) {
     const value = sandcastleEnv[key] || process.env[key];
@@ -54524,11 +54867,11 @@ Emit only a corrected <${error.tag}> block. Do not change files or run commands.
   const normalized = isRoot ? cwd : cwd.replace(/[\\/]+$/, "");
   return normalized.replace(/^([A-Za-z]):/, "$1").replace(/[\\/]/g, "-");
 }, claudeHostSessionPath = (cwd, id3, projectsDir) => {
-  const base = projectsDir ?? join14(process.env.HOME ?? "~", ".claude", "projects");
-  return join14(base, encodeProjectPath(cwd), `${id3}.jsonl`);
+  const base = projectsDir ?? join15(process.env.HOME ?? "~", ".claude", "projects");
+  return join15(base, encodeProjectPath(cwd), `${id3}.jsonl`);
 }, claudeSandboxSessionPath = (cwd, id3, projectsDir) => posix4.join(projectsDir, encodeProjectPath(cwd), `${id3}.jsonl`), claudeSubagentsDirInSandbox = (cwd, id3, projectsDir) => posix4.join(projectsDir, encodeProjectPath(cwd), id3, "subagents"), claudeSubagentsDirOnHost = (cwd, id3, projectsDir) => {
-  const base = projectsDir ?? join14(process.env.HOME ?? "~", ".claude", "projects");
-  return join14(base, encodeProjectPath(cwd), id3, "subagents");
+  const base = projectsDir ?? join15(process.env.HOME ?? "~", ".claude", "projects");
+  return join15(base, encodeProjectPath(cwd), id3, "subagents");
 }, listClaudeSubagentSessionsInSandbox = async (cwd, id3, handle, sandboxProjectsDir) => {
   const dir = claudeSubagentsDirInSandbox(cwd, id3, sandboxProjectsDir);
   const result = await handle.exec(`find ${JSON.stringify(dir)} -type f -name ${JSON.stringify("agent-*.jsonl")} 2>/dev/null`);
@@ -54540,7 +54883,7 @@ Emit only a corrected <${error.tag}> block. Do not change files or run commands.
   return stdout.split(`
 `).filter((line) => line !== "");
 }, findClaudeSessionOnHost = async (id3, projectsDir) => {
-  const root = projectsDir ?? join14(process.env.HOME ?? "~", ".claude", "projects");
+  const root = projectsDir ?? join15(process.env.HOME ?? "~", ".claude", "projects");
   let entries;
   try {
     entries = await readdir2(root, { withFileTypes: true });
@@ -54550,7 +54893,7 @@ Emit only a corrected <${error.tag}> block. Do not change files or run commands.
   for (const entry of entries) {
     if (!entry.isDirectory())
       continue;
-    const candidate = join14(root, entry.name, `${id3}.jsonl`);
+    const candidate = join15(root, entry.name, `${id3}.jsonl`);
     if (await pathExists(candidate)) {
       return { path: candidate, searchedRoot: root };
     }
@@ -54586,7 +54929,7 @@ Emit only a corrected <${error.tag}> block. Do not change files or run commands.
       return;
     }
     for (const entry of entries) {
-      const child = join14(dir, entry.name);
+      const child = join15(dir, entry.name);
       if (entry.isFile() && isCodexSessionFilename(entry.name, id3)) {
         return child;
       }
@@ -54600,11 +54943,11 @@ Emit only a corrected <${error.tag}> block. Do not change files or run commands.
   };
   return visit(rootDir);
 }, findCodexSessionOnHost = async (id3, sessionsDir) => {
-  const root = sessionsDir ?? join14(process.env.HOME ?? "~", ".codex", "sessions");
+  const root = sessionsDir ?? join15(process.env.HOME ?? "~", ".codex", "sessions");
   const path2 = await findCodexSessionPath(root, id3);
   return { path: path2, searchedRoot: root };
 }, locateCodexHostSession = async (id3, sessionsDir) => {
-  const root = sessionsDir ?? join14(process.env.HOME ?? "~", ".codex", "sessions");
+  const root = sessionsDir ?? join15(process.env.HOME ?? "~", ".codex", "sessions");
   const path2 = await findCodexSessionPath(root, id3);
   if (!path2)
     throw new Error(`session ${id3} not found in ${root}`);
@@ -54680,7 +55023,7 @@ Emit only a corrected <${error.tag}> block. Do not change files or run commands.
   } catch {}
   return [];
 }, CURSOR_PRINT_PROMPT_MAX_BYTES, readSandboxFile = async (handle, sandboxPath, tag) => {
-  const tmpPath = join14(tmpdir4(), `sandcastle-${tag}-${Date.now()}-${Math.random().toString(36).slice(2)}.jsonl`);
+  const tmpPath = join15(tmpdir4(), `sandcastle-${tag}-${Date.now()}-${Math.random().toString(36).slice(2)}.jsonl`);
   await handle.copyFileOut(sandboxPath, tmpPath);
   try {
     return await readFile3(tmpPath, "utf-8");
@@ -54688,7 +55031,7 @@ Emit only a corrected <${error.tag}> block. Do not change files or run commands.
     await rm3(tmpPath, { force: true }).catch(() => {});
   }
 }, writeSandboxFile = async (handle, sandboxPath, content, tag) => {
-  const tmpPath = join14(tmpdir4(), `sandcastle-${tag}-${Date.now()}-${Math.random().toString(36).slice(2)}.jsonl`);
+  const tmpPath = join15(tmpdir4(), `sandcastle-${tag}-${Date.now()}-${Math.random().toString(36).slice(2)}.jsonl`);
   await writeFile3(tmpPath, content);
   try {
     await handle.exec(`mkdir -p ${JSON.stringify(posix4.dirname(sandboxPath))}`);
@@ -54738,7 +55081,7 @@ Emit only a corrected <${error.tag}> block. Do not change files or run commands.
             sourcePath: sandboxSubagentPath,
             fromCwd: sandboxCwd,
             toCwd: hostCwd,
-            destPath: join14(hostSubagentsDir, posix4.basename(sandboxSubagentPath)),
+            destPath: join15(hostSubagentsDir, posix4.basename(sandboxSubagentPath)),
             tag: "claude-sub"
           });
         } catch (err) {
@@ -54775,8 +55118,8 @@ Emit only a corrected <${error.tag}> block. Do not change files or run commands.
       const located = await locateCodexSandboxSession(sessionId, handle, sandboxSessionsDir);
       const jsonl = await readSandboxFile(handle, located.path, "codex-cap");
       const rewritten = transferCodexSession(jsonl, sandboxCwd, hostCwd);
-      const root = hostSessionsDir ?? join14(process.env.HOME ?? "~", ".codex", "sessions");
-      const target = join14(root, located.relativePath);
+      const root = hostSessionsDir ?? join15(process.env.HOME ?? "~", ".codex", "sessions");
+      const target = join15(root, located.relativePath);
       await mkdir3(dirname7(target), { recursive: true });
       await writeFile3(target, rewritten);
       capturedPaths.set(sessionId, target);
@@ -54937,6 +55280,7 @@ var init_dist = __esm(() => {
   init_chunk_BIWNFKGV();
   init_chunk_62WN33RK();
   init_chunk_NGBM7T3E();
+  init_chunk_NGBM7T3E();
   createRequire8(import.meta.url);
   AgentStreamEmitter = class extends Context_exports.Tag("AgentStreamEmitter")() {
   };
@@ -54982,7 +55326,7 @@ var init_dist = __esm(() => {
 });
 
 // src/services/settings.ts
-import { existsSync as existsSync14, mkdirSync as mkdirSync7, readFileSync as readFileSync6, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync15, mkdirSync as mkdirSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
 import { dirname as dirname8 } from "path";
 import * as z3 from "zod";
 import { eq as eq10 } from "drizzle-orm";
@@ -54990,10 +55334,10 @@ function hostDefaults(logicalCpus) {
   return { ...DEFAULTS, burnConcurrency: resolveDefaultBurnConcurrency(logicalCpus) };
 }
 function readRawConfig(configFile) {
-  if (!existsSync14(configFile))
+  if (!existsSync15(configFile))
     return {};
   try {
-    const parsed = JSON.parse(readFileSync6(configFile, "utf8"));
+    const parsed = JSON.parse(readFileSync7(configFile, "utf8"));
     if (typeof parsed !== "object" || parsed === null)
       return {};
     return foldLegacyModelConfig(parsed);
@@ -55020,6 +55364,7 @@ function projectOverrides(ctx, projectId) {
   const row = ctx.db.select({
     model: projects.model,
     sandbox: projects.sandbox,
+    sandboxImage: projects.sandboxImage,
     sessionBranch: projects.sessionBranch,
     devCommand: projects.devCommand,
     setupCommand: projects.setupCommand,
@@ -55033,6 +55378,7 @@ function projectOverrides(ctx, projectId) {
   return {
     model: row?.model ?? null,
     sandbox: row?.sandbox ?? null,
+    sandboxImage: row?.sandboxImage ?? null,
     sessionBranch: row?.sessionBranch ?? null,
     devCommand: row?.devCommand ?? null,
     setupCommand: row?.setupCommand ?? null,
@@ -55235,6 +55581,7 @@ var init_settings = __esm(() => {
       key: "sandboxImage",
       configKey: "sandboxImage",
       envVar: "RUNCASTLE_SANDBOX_IMAGE",
+      projectColumn: "sandboxImage",
       restartRequired: false,
       valueSchema: z3.string().min(1),
       parseEnv: idEnv
@@ -55362,9 +55709,8 @@ var init_settings = __esm(() => {
 });
 
 // src/services/setup.ts
-import { copyFileSync as copyFileSync2, existsSync as existsSync15, mkdirSync as mkdirSync8, readFileSync as readFileSync7, readdirSync as readdirSync4, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname9, join as join15 } from "path";
-import { fileURLToPath as fileURLToPath6 } from "url";
+import { copyFileSync as copyFileSync2, existsSync as existsSync16, mkdirSync as mkdirSync8, readFileSync as readFileSync8, readdirSync as readdirSync4, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname9, join as join16 } from "path";
 async function writeGitIdentity(exec3, identity4) {
   const name = identity4.name.trim();
   const email = identity4.email.trim();
@@ -55464,55 +55810,26 @@ async function resolveRuntime(exec3, preferred) {
     return other;
   return preferred;
 }
-function resolveSandcastleBin() {
-  try {
-    const mainUrl = import.meta.resolve("@ai-hero/sandcastle");
-    let dir = dirname9(fileURLToPath6(mainUrl));
-    for (let hops = 0;hops < 6; hops++) {
-      const manifestPath = join15(dir, "package.json");
-      if (existsSync15(manifestPath)) {
-        const manifest = JSON.parse(readFileSync7(manifestPath, "utf8"));
-        if (manifest.name === "@ai-hero/sandcastle" && manifest.bin?.sandcastle) {
-          return join15(dir, manifest.bin.sandcastle);
-        }
-      }
-      const parent = dirname9(dir);
-      if (parent === dir)
-        break;
-      dir = parent;
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-function terminalSpec(kind, opts) {
+function terminalSpec(kind) {
   if (kind === "setup-token")
     return { cmd: "claude", args: ["setup-token"] };
   for (const spec of Object.values(RUNTIME_SPECS)) {
     if (kind === LOGIN_TERMINAL_KIND[spec.runtime])
       return { cmd: spec.bin, args: spec.loginArgs };
   }
-  if (!opts.sandcastleBin) {
-    throw new NotFoundError("The bundled sandcastle CLI (@ai-hero/sandcastle) could not be located \u2014 reinstall runcastle.");
-  }
-  return {
-    cmd: "node",
-    args: [opts.sandcastleBin, opts.runtime, "build-image", "--image-name", opts.imageName]
-  };
+  throw new InvalidInputError(`no terminal command for ${kind}`);
 }
 function refreshSandcastleConfig(templateDir, targetDir) {
-  const dir = join15(targetDir, ".sandcastle");
+  const dir = join16(targetDir, ".sandcastle");
   mkdirSync8(dir, { recursive: true });
   for (const name of readdirSync4(templateDir)) {
-    copyFileSync2(join15(templateDir, name), join15(dir, name));
+    copyFileSync2(join16(templateDir, name), join16(dir, name));
   }
   return dir;
 }
 function prepareSandboxBuildContext(templateDir = sandcastleTemplateDir(), target = sandboxBuildDir()) {
   mkdirSync8(target, { recursive: true });
-  refreshSandcastleConfig(templateDir, target);
-  return target;
+  return refreshSandcastleConfig(templateDir, target);
 }
 function createCredentialVerifier(exec3, runtime5 = DEFAULT_RUNTIME) {
   const spec = RUNTIME_SPECS[runtime5];
@@ -55547,7 +55864,7 @@ function createCredentialVerifier(exec3, runtime5 = DEFAULT_RUNTIME) {
 function fileAfkTokenIo(exec3, runtime5 = DEFAULT_RUNTIME) {
   const path2 = envPath();
   return {
-    read: () => existsSync15(path2) ? readFileSync7(path2, "utf8") : "",
+    read: () => existsSync16(path2) ? readFileSync8(path2, "utf8") : "",
     write: (content) => {
       mkdirSync8(dirname9(path2), { recursive: true });
       writeFileSync6(path2, content, "utf8");
@@ -55791,13 +56108,13 @@ var init_no_sandbox = __esm(() => {
 });
 
 // src/workflows/review-ticket.ts
-import { existsSync as existsSync16, mkdirSync as mkdirSync9, readFileSync as readFileSync8, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "fs";
-import { delimiter, join as join16 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, readFileSync as readFileSync9, rmSync as rmSync2, writeFileSync as writeFileSync7 } from "fs";
+import { delimiter, join as join17 } from "path";
 function reviewTemplatePath(ticket) {
   return burnerAssetPath(ticket?.passKind === "verification" ? "verify-fixes.md" : "review-ticket.md");
 }
 function renderReviewPrompt(templateOrTicket, values) {
-  const template = typeof templateOrTicket === "string" ? templateOrTicket : readFileSync8(reviewTemplatePath(templateOrTicket), "utf8");
+  const template = typeof templateOrTicket === "string" ? templateOrTicket : readFileSync9(reviewTemplatePath(templateOrTicket), "utf8");
   return renderTemplate(template, values);
 }
 function findOnPath(bin, env = process.env, platform = process.platform) {
@@ -55805,8 +56122,8 @@ function findOnPath(bin, env = process.env, platform = process.platform) {
   const suffixes = platform === "win32" ? (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(Boolean) : [""];
   for (const dir of dirs) {
     for (const suffix of suffixes) {
-      const candidate = join16(dir, `${bin}${suffix}`);
-      if (existsSync16(candidate))
+      const candidate = join17(dir, `${bin}${suffix}`);
+      if (existsSync17(candidate))
         return candidate;
     }
   }
@@ -55828,7 +56145,7 @@ function buildDriveAvailability(browserPath, devCommand, inheritedMode) {
   }
   return `A drive is **not** available: ${missing.join(", and ")}. So the mode is already decided \u2014 ` + "run Gates mode, whatever this lap touched, and do not call `review_drive`. This is not a " + "degraded review; it is the whole review this lap gets.";
 }
-function inheritedReviewMode(verifiedTicketId, fileExists2 = existsSync16) {
+function inheritedReviewMode(verifiedTicketId, fileExists2 = existsSync17) {
   return verifiedTicketId && fileExists2(reviewWalkthroughPath(verifiedTicketId)) ? "drive" : "gates";
 }
 function buildDriveInstructions(instructions) {
@@ -55867,18 +56184,18 @@ function writeReviewArtifacts(ticket, runId, config2) {
   const dir = reviewDir(ticket.id);
   rmSync2(dir, { recursive: true, force: true });
   mkdirSync9(dir, { recursive: true });
-  const mcpConfigPath = join16(dir, "mcp.json");
+  const mcpConfigPath = join17(dir, "mcp.json");
   const mcpConfig = renderRunMcpConfig(runId, config2);
   writeFileSync7(mcpConfigPath, JSON.stringify(mcpConfig, null, 2), "utf8");
   return {
     dir,
     mcp: { path: mcpConfigPath, config: mcpConfig },
-    digestPath: join16(dir, "DIGEST.md"),
-    blockedPath: join16(dir, "BLOCKED.md"),
+    digestPath: join17(dir, "DIGEST.md"),
+    blockedPath: join17(dir, "BLOCKED.md"),
     walkthroughPath: reviewWalkthroughPath(ticket.id)
   };
 }
-function shouldStopAfterDigest(iteration, digestPath, fileExists2 = existsSync16) {
+function shouldStopAfterDigest(iteration, digestPath, fileExists2 = existsSync17) {
   return iteration >= 2 && fileExists2(digestPath);
 }
 async function releaseDriveQuietly() {
@@ -55956,7 +56273,7 @@ async function reviewTicketOutcome(ctx, ticket, deps, timer) {
     maxIterations: deps.config.burnMaxIterations,
     logging: {
       type: "file",
-      path: join16(logsDir(), `review-${feature.id}-${ticket.seq}.log`),
+      path: join17(logsDir(), `review-${feature.id}-${ticket.seq}.log`),
       onAgentStreamEvent: onStreamEvent
     }
   };
@@ -56145,6 +56462,7 @@ var dockerExec = (args2) => Effect_exports.async((resume2) => {
       const unregisterShutdown = registerShutdown(removeContainerSync);
       const handle = {
         worktreePath,
+        maxOutputTailChars,
         exec: (command, opts) => {
           const effectiveCommand = opts?.sudo ? `sudo ${command}` : command;
           const args2 = ["exec"];
@@ -56405,6 +56723,7 @@ var podman = (options) => {
       const unregisterShutdown = registerShutdown(removeContainerSync);
       const handle = {
         worktreePath,
+        maxOutputTailChars,
         exec: (command, opts) => {
           const effectiveCommand = opts?.sudo ? `sudo ${command}` : command;
           const args2 = ["exec"];
@@ -56558,13 +56877,47 @@ var init_podman = __esm(() => {
 });
 
 // src/workflows/ticket-burner.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync10, readFileSync as readFileSync9, readdirSync as readdirSync5, rmSync as rmSync3 } from "fs";
-import { dirname as dirname10, join as join17, posix as posixPath, win32 as winPath } from "path";
-import { fileURLToPath as fileURLToPath7 } from "url";
+import { existsSync as existsSync18, mkdirSync as mkdirSync10, readFileSync as readFileSync10, readdirSync as readdirSync5, rmSync as rmSync3 } from "fs";
+import { dirname as dirname10, join as join18, posix as posixPath, win32 as winPath } from "path";
+import { fileURLToPath as fileURLToPath6 } from "url";
 function missingImageRuntimeMessage(runtime5, image) {
   const binary = RUNTIME_BINARY[runtime5];
   return `${binary} is not installed in image ${image} \u2014 the image predates the burner Dockerfile. Rebuild it from Settings \u2192 Burns (Rebuild image).`;
 }
+function extractCommandNames(command) {
+  const names = [];
+  for (const segment of (command ?? "").split(COMMAND_SEPARATORS)) {
+    const words = segment.replace(/[(){}'"`]/g, " ").split(/\s+/).filter(Boolean);
+    const word = words.find((w) => !ASSIGNMENT_PREFIX.test(w)) ?? "";
+    if (!PLAIN_COMMAND_NAME.test(word) || NON_COMMAND_WORDS.has(word))
+      continue;
+    if (!names.includes(word))
+      names.push(word);
+  }
+  return names;
+}
+function preflightCommandNames(input) {
+  return [
+    ...new Set([
+      input.agentBinary,
+      ...extractCommandNames(input.setupCommand),
+      ...extractCommandNames(input.verifyCommands)
+    ])
+  ].sort();
+}
+function buildToolchainProbeArgs(image, names) {
+  const script = `for c in ${names.join(" ")}; do command -v "$c" >/dev/null 2>&1 || echo "$c"; done`;
+  return ["run", "--rm", "--entrypoint", "sh", image, "-c", script];
+}
+function parseMissingCommands(stdout, names) {
+  const absent = new Set(stdout.split(`
+`).map((line) => line.trim()));
+  return names.filter((name) => absent.has(name));
+}
+function missingToolchainMessage(names, image) {
+  const one = names.length === 1;
+  return `${names.join(", ")} ${one ? "is" : "are"} not installed in image ${image} \u2014 add ${one ? "it" : "them"} to .runcastle/sandbox/Dockerfile and rebuild.`;
+}
 function burnAuthReady(runtime5, token, loggedIn = codexLoggedIn) {
   if (token !== undefined)
     return true;
@@ -56580,6 +56933,9 @@ function verificationDue(tickets2, runTicketIds) {
   const verifies = [...reviews].reverse().find((ticket) => ticket.status === "done") ?? null;
   if (lastReview?.status === "failed")
     return { due: false, landed: [], verifies };
+  const failed = inRun.some((ticket) => !isReviewTicket(ticket) && ticket.status === "failed");
+  if (failed)
+    return { due: false, landed: [], verifies };
   const cutoff = verifies?.completedAt ?? Number.NEGATIVE_INFINITY;
   const landed = inRun.filter((ticket) => !isReviewTicket(ticket) && ticket.status === "done" && ticket.completedAt !== null && (ticket.completedAt > cutoff || ticket.completedAt === cutoff && verifies !== null && ticket.seq > verifies.seq));
   return { due: landed.length > 0, landed, verifies };
@@ -56721,10 +57077,10 @@ _(The "${DROPPED_MAP_SECTIONS.join('" and "')}" sections are omitted here: they
 }
 function buildProjectStandards(repoPath) {
   const present = [];
-  if (existsSync17(join17(repoPath, AGENT_CONVENTIONS_FILE))) {
+  if (existsSync18(join18(repoPath, AGENT_CONVENTIONS_FILE))) {
     present.push("`CLAUDE.md` \u2014 this repo's agent-facing conventions, and the highest authority on them");
   }
-  if (existsSync17(join17(repoPath, CHARTER_FILE))) {
+  if (existsSync18(join18(repoPath, CHARTER_FILE))) {
     present.push(`\`${CHARTER_FILE}\` \u2014 the project charter: what this codebase is for`);
   }
   const adrs = listLiveAdrs(repoPath).map((a) => a.relPath);
@@ -56755,7 +57111,7 @@ function buildDriveNotes(settings) {
   add5("stop", settings.driveStopCommand);
   add5("dev server", settings.devCommand);
   add5("db reset", settings.dbResetCommand);
-  const hasDir = existsSync17(join17(settings.repoPath, ".runcastle"));
+  const hasDir = existsSync18(join18(settings.repoPath, ".runcastle"));
   if (configured.length === 0 && !hasDir) {
     return [
       "This project has no test-drive machinery configured, so there is nothing here for you to keep in step \u2014 do not invent any.",
@@ -56975,10 +57331,10 @@ function parseSetupMarker(text3) {
   return { cold: m[1] === "1", syncMs: Number(m[2]), installMs: Number(m[3]) };
 }
 function takeSetupMarker(worktreePath) {
-  const file = join17(worktreePath, SETUP_MARKER_FILE);
+  const file = join18(worktreePath, SETUP_MARKER_FILE);
   let text3;
   try {
-    text3 = readFileSync9(file, "utf8");
+    text3 = readFileSync10(file, "utf8");
   } catch {
     return;
   }
@@ -57051,7 +57407,7 @@ function attachedNoteIds(context5) {
   return ids3;
 }
 function attachmentSources(context5) {
-  return attachedNoteIds(context5).map(annotationPath).filter((p) => existsSync17(p));
+  return attachedNoteIds(context5).map(annotationPath).filter((p) => existsSync18(p));
 }
 function buildAttachmentCopyCommands(sources, platform = process.platform) {
   if (sources.length === 0)
@@ -57071,7 +57427,7 @@ function buildAttachmentCopyCommands(sources, platform = process.platform) {
   ];
 }
 async function clearAttachments(workspacePath, repoPath) {
-  rmSync3(join17(workspacePath, ATTACHMENTS_DIR), { recursive: true, force: true });
+  rmSync3(join18(workspacePath, ATTACHMENTS_DIR), { recursive: true, force: true });
   await unexcludePath(repoPath, ATTACHMENTS_PREFIX);
 }
 function buildVerifyNotes(config2) {
@@ -57093,12 +57449,12 @@ function buildVerifyNotes(config2) {
 `);
 }
 function readRepoToolchain(repoPath) {
-  const pkgPath = join17(repoPath, "package.json");
-  const hasPackageJson = existsSync17(pkgPath);
+  const pkgPath = join18(repoPath, "package.json");
+  const hasPackageJson = existsSync18(pkgPath);
   let packageManagerField;
   if (hasPackageJson) {
     try {
-      const pkg = JSON.parse(readFileSync9(pkgPath, "utf8"));
+      const pkg = JSON.parse(readFileSync10(pkgPath, "utf8"));
       if (typeof pkg.packageManager === "string")
         packageManagerField = pkg.packageManager;
     } catch {}
@@ -57107,10 +57463,10 @@ function readRepoToolchain(repoPath) {
     hasPackageJson,
     ...packageManagerField !== undefined ? { packageManagerField } : {},
     lockfiles: {
-      bun: existsSync17(join17(repoPath, "bun.lock")) || existsSync17(join17(repoPath, "bun.lockb")),
-      pnpm: existsSync17(join17(repoPath, "pnpm-lock.yaml")),
-      yarn: existsSync17(join17(repoPath, "yarn.lock")),
-      npm: existsSync17(join17(repoPath, "package-lock.json"))
+      bun: existsSync18(join18(repoPath, "bun.lock")) || existsSync18(join18(repoPath, "bun.lockb")),
+      pnpm: existsSync18(join18(repoPath, "pnpm-lock.yaml")),
+      yarn: existsSync18(join18(repoPath, "yarn.lock")),
+      npm: existsSync18(join18(repoPath, "package-lock.json"))
     }
   };
 }
@@ -57246,19 +57602,36 @@ function isMergeConflictError(err) {
   const msg = err instanceof Error ? err.message : typeof err === "string" ? err : "";
   return /conflict/i.test(msg) || /git branch -D/i.test(msg) || /automatic merge failed/i.test(msg);
 }
+function refusalNamingCredential(refusal) {
+  return new RegExp(`(?:${refusal}[^\\n]*${CREDENTIAL_SUBJECT}|${CREDENTIAL_SUBJECT}[^\\n]*${refusal})`, "i");
+}
+function missingCommandRegex(name) {
+  const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`\\b${escaped}\\b[^\\n]*(?:exited with code 127|command not found|not found|no such file or directory)`, "i");
+}
 function missingAgentBinaryMessage(err, runtime5, image) {
   const msg = err instanceof Error ? err.message : typeof err === "string" ? err : String(err);
   const binary = AGENT_BINARY[runtime5];
-  const missing = new RegExp(`\\b${binary}\\b[^\\n]*(?:exited with code 127|command not found|not found|no such file or directory)`, "i");
-  if (!missing.test(msg))
+  if (!missingCommandRegex(binary).test(msg))
     return;
   return `${binary} is not installed in image ${image} \u2014 the image predates the burner Dockerfile. Rebuild it from Settings \u2192 Burns (Rebuild image).`;
 }
-function classifyTicketRunError(err, runtime5) {
+function missingSetupBinaryMessage(err, setupCommand, image) {
+  const msg = err instanceof Error ? err.message : typeof err === "string" ? err : String(err);
+  const missing = extractCommandNames(setupCommand).find((name) => missingCommandRegex(name).test(msg));
+  return missing ? missingToolchainMessage([missing], image) : undefined;
+}
+function classifyTicketRunError(err, runtime5, setupCommand) {
   const msg = err instanceof Error ? err.message : typeof err === "string" ? err : String(err);
   const runtimes = runtime5 ? [runtime5] : ["claude-code", "codex"];
   const forRuntimes = (table) => runtimes.flatMap((r) => table[r]);
   if (runtimes.some((r) => missingAgentBinaryMessage(msg, r, "image")))
+    return "run-fatal";
+  if ([...RUN_FATAL_ERROR_PATTERNS, ...forRuntimes(RUNTIME_RUN_FATAL_ERROR_PATTERNS)].some((p) => p.test(msg)))
+    return "run-fatal";
+  if (missingSetupBinaryMessage(msg, setupCommand, "image"))
+    return "fatal";
+  if (MISSING_COMMAND_PATTERNS.some((p) => p.test(msg)))
     return "fatal";
   if ([...FATAL_ERROR_PATTERNS, ...forRuntimes(RUNTIME_FATAL_ERROR_PATTERNS)].some((p) => p.test(msg)))
     return "fatal";
@@ -57300,11 +57673,20 @@ function delayUnlessAborted(ms, signal) {
     signal.addEventListener("abort", onAbort, { once: true });
   });
 }
-async function stopTicketRun(ticketId) {
+function stopTicketRun(ticketId) {
+  return abortTicketRun(ticketId, new Error("ticket stopped by user"));
+}
+function haltTicketRun(ticketId, headline) {
+  return abortTicketRun(ticketId, new RunHaltedAbort(headline));
+}
+function ticketStopReason(reason) {
+  return reason instanceof RunHaltedAbort ? `stopped: run halted (${reason.headline})` : "stopped by user";
+}
+async function abortTicketRun(ticketId, reason) {
   const controller = activeTicketAborts.get(ticketId);
   if (!controller)
     return { stopped: false, confirmed: true };
-  controller.abort(new Error("ticket stopped by user"));
+  controller.abort(reason);
   const { confirmed } = await killRegistry().killAndWait(ticketId);
   return { stopped: true, confirmed };
 }
@@ -57368,11 +57750,7 @@ function errorHeadline(s) {
   const causes = lines.filter((l) => /^(fatal|error):/i.test(l));
   return causes.at(-1) ?? lines[0] ?? "";
 }
-function failedBlockerNote(seqs) {
-  const list = [...seqs].sort((a, b) => a - b).join(", ");
-  return `> Reviewed with failed implementation ticket(s): ${list}.`;
-}
-async function burnTickets(ctx, tickets2, execute, concurrency = 1) {
+async function burnTickets(ctx, tickets2, execute, concurrency = 1, ticketRuntime) {
   const width = Math.max(1, Math.floor(concurrency));
   const scheduled = [...tickets2];
   const bySeq = indexBySeq(scheduled);
@@ -57380,10 +57758,23 @@ async function burnTickets(ctx, tickets2, execute, concurrency = 1) {
   const pending3 = new Set(scheduled.filter((t) => t.status === "pending").map((t) => t.seq));
   const inFlight = new Map;
   const digests = [];
+  const deferred = [];
+  const collapsed = [];
   let admitted = 0;
   let verificationChecked = false;
-  const satisfied = (t, s) => s === "done" || s === "cancelled" || isReviewTicket(t) && s === "failed";
+  let halted;
+  const satisfied = (s) => s === "done" || s === "cancelled";
   const implementationsSettled = () => scheduled.every((t) => isReviewTicket(t) || !pending3.has(t.seq) && !inFlight.has(t.seq));
+  const failedImplementations = () => scheduled.filter((t) => !isReviewTicket(t) && status3.get(t.seq) === "failed").map((t) => t.seq);
+  const reviewGate = () => {
+    if (!implementationsSettled())
+      return "wait";
+    if (failedImplementations().length > 0)
+      return "defer";
+    const implementations = scheduled.filter((t) => !isReviewTicket(t));
+    const landed = implementations.some((t) => status3.get(t.seq) === "done");
+    return implementations.length > 0 && !landed ? "collapsed" : "ready";
+  };
   const admitNewTickets = () => {
     const added = [];
     for (const t of ctx.listTickets?.() ?? []) {
@@ -57458,20 +57849,18 @@ async function burnTickets(ctx, tickets2, execute, concurrency = 1) {
     for (const b of t.blockedBy) {
       const present = bySeq.has(b);
       const bs = present ? status3.get(b) : undefined;
-      if (!present || bs === "failed" && !satisfied(t, bs))
+      if (!present)
+        return { blockedBy: b, present };
+      if (bs === "failed" && !isReviewTicket(t))
         return { blockedBy: b, present };
     }
-    if (isReviewTicket(t) && !implementationsSettled())
-      return "wait";
-    return t.blockedBy.every((b) => satisfied(t, status3.get(b))) ? "ready" : "wait";
+    if (isReviewTicket(t))
+      return reviewGate();
+    return t.blockedBy.every((b) => satisfied(status3.get(b))) ? "ready" : "wait";
   };
   const harvestDigest2 = (t, digest) => {
-    const failed = isReviewTicket(t) ? scheduled.filter((x) => !isReviewTicket(x) && status3.get(x.seq) === "failed").map((x) => x.seq) : [];
-    const body = [failed.length > 0 ? failedBlockerNote(failed) : undefined, digest].filter(Boolean).join(`
-
-`);
-    if (body)
-      digests.push({ seq: t.seq, title: t.title, digest: body });
+    if (digest)
+      digests.push({ seq: t.seq, title: t.title, digest });
   };
   const failTicket = (seq2, error, extra, digest) => {
     const t = bySeq.get(seq2);
@@ -57484,10 +57873,34 @@ async function burnTickets(ctx, tickets2, execute, concurrency = 1) {
     if (extra)
       ctx.emitEvent({ ...extra, ticketId: t.id });
   };
+  const haltRun = async (t, outcome) => {
+    const halt = {
+      runtime: outcome.runtime,
+      ticketSeq: t.seq,
+      headline: errorHeadline(outcome.error)
+    };
+    halted = halt;
+    ctx.emitEvent({
+      type: "run.halted",
+      message: `run halted: ${halt.headline}`,
+      ticketId: t.id,
+      data: { runtime: halt.runtime, ticketSeq: halt.ticketSeq }
+    });
+    const doomed = [...inFlight.keys()].filter((other) => other !== t.seq).map((other) => bySeq.get(other)).filter((x) => x !== undefined).filter((x) => ticketRuntime === undefined || ticketRuntime(x) === outcome.runtime);
+    await Promise.all(doomed.map((x) => haltTicketRun(x.id, halt.headline)));
+  };
+  const refreshedForLaunch = (t) => {
+    const fresh3 = ctx.listTickets?.().find((row) => row.id === t.id);
+    if (!fresh3)
+      return t;
+    bySeq.set(t.seq, fresh3);
+    return fresh3;
+  };
   const runOne = async (seq2) => {
-    const t = bySeq.get(seq2);
-    if (!t)
+    const snapshot = bySeq.get(seq2);
+    if (!snapshot)
       return;
+    const t = refreshedForLaunch(snapshot);
     status3.set(seq2, "burning");
     ctx.updateTicket(t.id, { status: "burning" });
     mirrorFinding(t, "fixing");
@@ -57530,35 +57943,67 @@ async function burnTickets(ctx, tickets2, execute, concurrency = 1) {
         ticketId: t.id,
         data: { error: outcome.error }
       });
+      if (outcome.runFatal && !halted) {
+        await haltRun(t, { error: outcome.error, runtime: outcome.runFatal.runtime });
+      }
     }
     if (isReviewTicket(t))
       admitNewTickets();
   };
   while (pending3.size > 0 || inFlight.size > 0 || !verificationChecked) {
     ctx.signal.throwIfAborted();
-    if (pending3.size === 0 && inFlight.size === 0) {
+    if (halted && inFlight.size === 0)
+      break;
+    if (!halted && pending3.size === 0 && inFlight.size === 0) {
       appendVerificationIfDue();
       if (pending3.size === 0)
         break;
     }
-    for (const seq2 of [...pending3]) {
+    for (const seq2 of halted ? [] : [...pending3]) {
       const st = readyState(seq2);
-      if (typeof st === "object") {
-        pending3.delete(seq2);
-        const t = bySeq.get(seq2);
-        const reason = st.present ? `blocked by failed ticket ${st.blockedBy}` : `blocked by missing ticket ${st.blockedBy}`;
-        failTicket(seq2, reason);
+      if (st === "ready" || st === "wait")
+        continue;
+      pending3.delete(seq2);
+      const t = bySeq.get(seq2);
+      if (st === "defer") {
+        deferred.push(seq2);
         if (t) {
+          const failed = failedImplementations();
           ctx.emitEvent({
-            type: "ticket.blocked",
-            message: `ticket ${t.seq} ${reason}`,
+            type: "ticket.deferred",
+            message: `ticket ${t.seq} deferred to the next burn: implementation ticket(s) ${failed.join(", ")} failed \u2014 retry or cancel them, then burn again`,
             ticketId: t.id,
-            data: { reason, blockedBy: st.blockedBy }
+            data: { failed }
           });
         }
+        continue;
+      }
+      if (st === "collapsed") {
+        collapsed.push(seq2);
+        status3.set(seq2, "cancelled");
+        if (t) {
+          ctx.updateTicket(t.id, { status: "cancelled", error: NOTHING_LANDED });
+          ctx.emitEvent({
+            type: "ticket.cancelled",
+            message: `ticket ${t.seq} cancelled: ${NOTHING_LANDED}`,
+            ticketId: t.id,
+            data: { reason: NOTHING_LANDED }
+          });
+        }
+        continue;
+      }
+      const reason = st.present ? `blocked by failed ticket ${st.blockedBy}` : `blocked by missing ticket ${st.blockedBy}`;
+      failTicket(seq2, reason);
+      if (t) {
+        ctx.emitEvent({
+          type: "ticket.blocked",
+          message: `ticket ${t.seq} ${reason}`,
+          ticketId: t.id,
+          data: { reason, blockedBy: st.blockedBy }
+        });
       }
     }
-    while (inFlight.size < width) {
+    while (!halted && inFlight.size < width) {
       const readySeq = [...pending3].find((seq2) => readyState(seq2) === "ready");
       if (readySeq === undefined)
         break;
@@ -57594,7 +58039,7 @@ async function burnTickets(ctx, tickets2, execute, concurrency = 1) {
   for (const s of status3.values())
     if (s === "done")
       done10 += 1;
-  return { done: done10, admitted, digests };
+  return { done: done10, admitted, digests, deferred, collapsed, ...halted ? { halted } : {} };
 }
 function composeRunDigest(entries) {
   if (entries.length === 0)
@@ -57627,18 +58072,18 @@ async function burnRun(ctx, deps) {
     return { status: "failed", summary: "burn aborted: auth token missing" };
   }
   if (deps.config.sandbox !== "noSandbox" && deps.exec) {
-    const image = resolveSandboxImage(deps.config);
+    const image = resolveSandboxImage(deps.config, ctx.project);
     const binary = RUNTIME_BINARY[deps.runtime];
-    const probe = await deps.exec(deps.config.sandbox, [
-      "run",
-      "--rm",
-      "--entrypoint",
-      binary,
-      image,
-      "--version"
-    ]);
-    if (!probe.ok || probe.code !== 0) {
-      const message = missingImageRuntimeMessage(deps.runtime, image);
+    const prepared = resolvePreparedSettings(deps.config, ctx.project);
+    const names = preflightCommandNames({
+      agentBinary: binary,
+      setupCommand: resolveSetupCommand(readRepoToolchain(ctx.project.repoPath), prepared.setupCommand),
+      verifyCommands: prepared.verifyCommands
+    });
+    const probe = await deps.exec(deps.config.sandbox, buildToolchainProbeArgs(image, names));
+    const missing = probe.ok && probe.code === 0 ? parseMissingCommands(probe.stdout, names) : [binary];
+    if (missing.length > 0) {
+      const message = missing.includes(binary) ? missingImageRuntimeMessage(deps.runtime, image) : missingToolchainMessage(missing, image);
       ctx.emitEvent({ type: IMAGE_RUNTIME_MISSING_EVENT, message });
       return { status: "failed", summary: message };
     }
@@ -57653,12 +58098,22 @@ async function burnRun(ctx, deps) {
     });
     return { status: "failed", summary: `dependency cycle: ${path2}` };
   }
-  const { done: done10, admitted, digests } = await burnTickets(ctx, tickets2, gateTicketAuth(deps), deps.concurrency);
-  const total = burnable.length + admitted;
-  const summary = cancelled > 0 ? `${done10}/${total} tickets done (${cancelled} cancelled)` : `${done10}/${total} tickets done`;
-  ctx.emitEvent({ type: "burn.summary", message: summary, data: { done: done10, total, cancelled } });
+  const { done: done10, admitted, digests, halted, deferred, collapsed } = await burnTickets(ctx, tickets2, gateTicketAuth(deps), deps.concurrency, deps.ticketRuntime);
+  const total = burnable.length + admitted - collapsed.length;
+  const cancelledCount = cancelled + collapsed.length;
+  const counts = cancelledCount > 0 ? `${done10}/${total} tickets done (${cancelledCount} cancelled)` : `${done10}/${total} tickets done`;
+  const summary = halted ? `run halted at ticket ${halted.ticketSeq}: ${halted.headline} \u2014 ${counts}` : deferred.length > 0 ? `${counts} \u2014 review deferred until the failed ticket(s) are retried or cancelled` : counts;
+  ctx.emitEvent({
+    type: "burn.summary",
+    message: summary,
+    data: { done: done10, total, cancelled: cancelledCount }
+  });
   const digest = composeRunDigest(digests);
-  return { status: done10 === total ? "succeeded" : "failed", summary, ...digest ? { digest } : {} };
+  return {
+    status: !halted && done10 === total ? "succeeded" : "failed",
+    summary,
+    ...digest ? { digest } : {}
+  };
 }
 function burnerTemplatePath() {
   return burnerAssetPath("implement-ticket.md");
@@ -57667,8 +58122,8 @@ function resolverTemplatePath() {
   return burnerAssetPath("resolve-conflict.md");
 }
 function burnerAssetPath(file) {
-  const here = dirname10(fileURLToPath7(import.meta.url));
-  return join17(resolveSkillsRoot(here), "burner", file);
+  const here = dirname10(fileURLToPath6(import.meta.url));
+  return join18(resolveSkillsRoot(here), "burner", file);
 }
 function listFeatureDocs(docsDir, prefix = "") {
   const out = [];
@@ -57677,7 +58132,7 @@ function listFeatureDocs(docsDir, prefix = "") {
     if (e.isFile() && e.name.endsWith(".md"))
       out.push(rel);
     else if (e.isDirectory() && !prefix)
-      out.push(...listFeatureDocs(join17(docsDir, e.name), rel));
+      out.push(...listFeatureDocs(join18(docsDir, e.name), rel));
   }
   return out;
 }
@@ -57691,11 +58146,11 @@ function readDocsDigest(projectId, slug) {
     ...missing ? { missing } : {}
   });
   const worktree = worktreeDir(projectId, slug);
-  if (!existsSync17(worktree)) {
+  if (!existsSync18(worktree)) {
     return done10("_No talk worktree on disk \u2014 docs digest skipped._", "no-worktree");
   }
-  const docsDir = join17(worktree, ...docsRel.split("/"));
-  if (!existsSync17(docsDir)) {
+  const docsDir = join18(worktree, ...docsRel.split("/"));
+  if (!existsSync18(docsDir)) {
     return done10("_No docs/features dir in the talk worktree \u2014 docs digest skipped._", "no-docs-dir");
   }
   const names = listFeatureDocs(docsDir).sort((a, b) => agentDigestDocOrder(a) - agentDigestDocOrder(b) || a.localeCompare(b));
@@ -57711,7 +58166,7 @@ function readDocsDigest(projectId, slug) {
     }
     let content;
     try {
-      content = readFileSync9(join17(docsDir, ...name.split("/")), "utf8");
+      content = readFileSync10(join18(docsDir, ...name.split("/")), "utf8");
     } catch {
       continue;
     }
@@ -57757,10 +58212,10 @@ function readAgentFile(dirs, file) {
   for (const dir of dirs) {
     if (!dir)
       continue;
-    const p = join17(dir, file);
-    if (existsSync17(p)) {
+    const p = join18(dir, file);
+    if (existsSync18(p)) {
       try {
-        return readFileSync9(p, "utf8");
+        return readFileSync10(p, "utf8");
       } catch {}
     }
   }
@@ -57828,8 +58283,8 @@ function buildAgentExtraArgs(runtime5, options) {
 function quoteArg(value) {
   return `"${value}"`;
 }
-function selectSandbox(config2, mounts = [], env = {}, kill = {}) {
-  const imageOpts = buildSandboxOptions(config2, mounts, env, kill.containerName);
+function selectSandbox(config2, project3, mounts = [], env = {}, kill = {}) {
+  const imageOpts = buildSandboxOptions(config2, project3, mounts, env, kill.containerName);
   switch (config2.sandbox) {
     case "docker":
       return docker(imageOpts);
@@ -57841,9 +58296,9 @@ function selectSandbox(config2, mounts = [], env = {}, kill = {}) {
       throw new Error(`no sandbox provider for sandbox "${config2.sandbox}" \u2014 refusing to run the agent unsandboxed`);
   }
 }
-function buildSandboxOptions(config2, mounts = [], env = {}, containerName) {
+function buildSandboxOptions(config2, project3, mounts = [], env = {}, containerName) {
   return {
-    imageName: resolveSandboxImage(config2),
+    imageName: resolveSandboxImage(config2, project3),
     ...mounts.length > 0 ? { mounts } : {},
     ...config2.burnCpus !== undefined ? { cpus: config2.burnCpus } : {},
     ...Object.keys(env).length > 0 ? { env } : {},
@@ -57904,7 +58359,7 @@ async function burnTicket(ctx, ticket, config2, token, model, land, ensureIsolat
   const guardInstalled = config2.burnGuard && config2.sandbox !== "noSandbox";
   const prepared = resolvePreparedSettings(config2, project3);
   const verifyNotes = buildVerifyNotes(prepared);
-  const basePrompt = renderTicketPrompt(readFileSync9(burnerTemplatePath(), "utf8"), {
+  const basePrompt = renderTicketPrompt(readFileSync10(burnerTemplatePath(), "utf8"), {
     WORKSPACE_NOTES: workspaceNotes,
     PROJECT_STANDARDS: blocks.projectStandards,
     FEATURE_BRIEF: featureBrief,
@@ -57932,10 +58387,10 @@ async function burnTicket(ctx, ticket, config2, token, model, land, ensureIsolat
   const guardInstall = guardInstalled ? buildGuardInstallCommand(model.runtime) : undefined;
   const withPrelude = (setup) => chainSetupCommands(codexAuthMount ? buildCodexAuthCopyCommand() : undefined, guardInstall, setup);
   const agentOptions = guardInstalled ? { bypassHookTrust: true } : {};
-  const slotStamp = buildSlotStamp(resolveSandboxImage(config2), toolchain.packageManagerField);
+  const slotStamp = buildSlotStamp(resolveSandboxImage(config2, project3), toolchain.packageManagerField);
   const setupHookFor = (branch) => withPrelude(slot !== undefined ? buildSlotSetupCommand(slot, branch, setupCommand, pm, slotStamp) : workspaceMode === "isolated" ? buildIsolatedSetupCommand(branch, setupCommand, pm) : setupCommand);
   mkdirSync10(logsDir(), { recursive: true });
-  const logFilePath = join17(logsDir(), `burn-${feature.id}-${ticket.seq}.log`);
+  const logFilePath = join18(logsDir(), `burn-${feature.id}-${ticket.seq}.log`);
   const throttle = createStreamThrottle((e) => ctx.emitEvent({ ...e, ticketId: ticket.id }));
   beginTranscript(ticket.id);
   const timer = createToolTimer();
@@ -58007,6 +58462,17 @@ async function burnTicket(ctx, ticket, config2, token, model, land, ensureIsolat
   const preserveChain = (branch) => {
     ctx.updateTicket(ticket.id, { attemptBranch: branch });
   };
+  const stoppedOutcome = (salvaged) => {
+    const reason = ticketStopReason(ticketAbort.signal.reason);
+    return {
+      status: "failed",
+      error: `${reason}${salvaged > 0 ? ` \u2014 ${salvaged} commit(s) preserved; retry to continue from them` : ""}`,
+      event: {
+        type: "ticket.stopped",
+        message: `ticket ${ticket.seq} ${reason}${salvaged > 0 ? ` \u2014 ${salvaged} commit(s) preserved for retry` : ""}`
+      }
+    };
+  };
   const discards = new Map;
   const discardWorktree = (branch) => {
     const pending3 = discards.get(branch) ?? cleanupBurnWorktree(project3.repoPath, branch);
@@ -58017,7 +58483,7 @@ async function burnTicket(ctx, ticket, config2, token, model, land, ensureIsolat
     const resolveBranch = ticketBranchName(feature.slug, ticket.seq, newId("r").slice(2, 10));
     const containerName = burnContainerName(ctx.runId, ticket.seq, "resolve");
     const otherSide = await commitSummaries(project3.repoPath, input.branch, feature.branch);
-    const prompt = renderTemplate(readFileSync9(resolverTemplatePath(), "utf8"), {
+    const prompt = renderTemplate(readFileSync10(resolverTemplatePath(), "utf8"), {
       TICKET_JSON: ticketJson,
       FEATURE_BRIEF: featureBrief,
       DOCS_DIGEST: docsDigest,
@@ -58046,7 +58512,7 @@ async function burnTicket(ctx, ticket, config2, token, model, land, ensureIsolat
       makeKillable(containerName);
       result = await run6({
         agent: buildBurnAgent(config2, token, model, agentOptions),
-        sandbox: selectSandbox(config2, mounts, sandboxEnv, killHandles(containerName)),
+        sandbox: selectSandbox(config2, project3, mounts, sandboxEnv, killHandles(containerName)),
         cwd: project3.repoPath,
         prompt,
         branchStrategy: { type: "branch", branch: resolveBranch, baseBranch: input.branch },
@@ -58179,7 +58645,7 @@ ${blocked3.trim()}`
       }
       const runOptions = {
         agent: buildBurnAgent(config2, token, model, agentOptions),
-        sandbox: selectSandbox(config2, mounts, sandboxEnv, killHandles(containerName)),
+        sandbox: selectSandbox(config2, project3, mounts, sandboxEnv, killHandles(containerName)),
         cwd: project3.repoPath,
         prompt: retryNotes ? `${basePrompt}
 
@@ -58215,21 +58681,15 @@ ${retryNotes}` : basePrompt,
         if (ctx.signal.aborted)
           throw err;
         const msg = err instanceof Error ? err.message : String(err);
-        const missingBinary = missingAgentBinaryMessage(err, model.runtime, resolveSandboxImage(config2));
+        const sandboxImage = resolveSandboxImage(config2, project3);
+        const missingBinary = missingAgentBinaryMessage(err, model.runtime, sandboxImage) ?? missingSetupBinaryMessage(err, setupCommand, sandboxImage);
         const salvaged = await branchCommitsAhead(project3.repoPath, feature.branch, tempBranch);
         if (salvaged.length > 0)
           baseBranch = tempBranch;
         if (ticketAbort.signal.aborted) {
           if (salvaged.length > 0)
             preserveChain(tempBranch);
-          return {
-            status: "failed",
-            error: `stopped by user${salvaged.length > 0 ? ` \u2014 ${salvaged.length} commit(s) preserved; retry to continue from them` : ""}`,
-            event: {
-              type: "ticket.stopped",
-              message: `ticket ${ticket.seq} stopped by user${salvaged.length > 0 ? ` \u2014 ${salvaged.length} commit(s) preserved for retry` : ""}`
-            }
-          };
+          return stoppedOutcome(salvaged.length);
         }
         if (isWorktreeTeardownError(err)) {
           const removed = await discardWorktree(tempBranch);
@@ -58260,9 +58720,10 @@ ${retryNotes}` : basePrompt,
         if (missingBinary) {
           if (salvaged.length > 0)
             preserveChain(tempBranch);
-          return { status: "failed", error: missingBinary };
+          return { status: "failed", error: missingBinary, runFatal: { runtime: model.runtime } };
         }
-        if (classifyTicketRunError(err, model.runtime) === "retryable" && attempt < maxAttempts) {
+        const verdict = classifyTicketRunError(err, model.runtime, setupCommand);
+        if (verdict === "retryable" && attempt < maxAttempts) {
           const headline = errorHeadline(msg);
           retryNotes = buildRetryNotes({ error: headline, commitCount: salvaged.length });
           ctx.emitEvent({
@@ -58282,20 +58743,17 @@ ${retryNotes}` : basePrompt,
           if (ticketAbort.signal.aborted) {
             if (salvaged.length > 0)
               preserveChain(tempBranch);
-            return {
-              status: "failed",
-              error: `stopped by user${salvaged.length > 0 ? ` \u2014 ${salvaged.length} commit(s) preserved; retry to continue from them` : ""}`,
-              event: {
-                type: "ticket.stopped",
-                message: `ticket ${ticket.seq} stopped by user${salvaged.length > 0 ? ` \u2014 ${salvaged.length} commit(s) preserved for retry` : ""}`
-              }
-            };
+            return stoppedOutcome(salvaged.length);
           }
           continue;
         }
         if (salvaged.length > 0)
           preserveChain(tempBranch);
-        return { status: "failed", error: msg };
+        return {
+          status: "failed",
+          error: msg,
+          ...verdict === "run-fatal" ? { runFatal: { runtime: model.runtime } } : {}
+        };
       }
     }
     if (!result)
@@ -58339,7 +58797,7 @@ function resolveBurnDeps(ctx) {
   const exec3 = createSystemExec({ cwd: ctx.project.repoPath });
   const imageProbeCache = new Map;
   const cachedExec = (command, args2) => {
-    const key = `${resolveSandboxImage(config2)}\x00${model.runtime}`;
+    const key = [resolveSandboxImage(config2, ctx.project), model.runtime, command, ...args2].join("\x00");
     let result = imageProbeCache.get(key);
     if (!result) {
       result = exec3(command, args2);
@@ -58357,7 +58815,7 @@ function resolveBurnDeps(ctx) {
     const engine = config2.sandbox === "podman" ? "podman" : "docker";
     return cacheVolumeReady ??= ensureBurnCacheVolume({
       engine,
-      imageName: resolveSandboxImage(config2),
+      imageName: resolveSandboxImage(config2, ctx.project),
       projectId: ctx.project.id,
       exec: exec3
     });
@@ -58391,6 +58849,7 @@ function resolveBurnDeps(ctx) {
       const { model: ticketModel, token: ticketToken } = ticketCredentials(ticket);
       return burnAuthReady(ticketModel.runtime, ticketToken) ? undefined : ticketModel.runtime;
     },
+    ticketRuntime: (ticket) => ticketCredentials(ticket).model.runtime,
     concurrency: config2.burnConcurrency,
     executeTicketRun: (c, ticket, run7) => {
       const { model: ticketModel, token: ticketToken } = ticketCredentials(ticket);
@@ -58407,9 +58866,9 @@ function resolveBurnDeps(ctx) {
 function readTokenFromEnvFile(path2, runtime5) {
   const key = RUNTIME_AUTH_KEY[runtime5];
   let fromFile;
-  if (existsSync17(path2)) {
+  if (existsSync18(path2)) {
     try {
-      fromFile = parseEnvFile3(readFileSync9(path2, "utf8"))[key];
+      fromFile = parseEnvFile3(readFileSync10(path2, "utf8"))[key];
     } catch {
       fromFile = undefined;
     }
@@ -58417,7 +58876,7 @@ function readTokenFromEnvFile(path2, runtime5) {
   const token = fromFile && fromFile.length > 0 ? fromFile : process.env[key];
   return token && token.length > 0 ? token : undefined;
 }
-var ATTACHMENTS_PREFIX, AUTH_MISSING_EVENT = "auth.missing", IMAGE_RUNTIME_MISSING_EVENT = "burn.image_runtime_missing", RUNTIME_BINARY, DROPPED_MAP_SECTIONS, AGENT_CONVENTIONS_FILE = "CLAUDE.md", PACKAGE_MANAGERS, PM_CACHE_SANDBOX_PATHS, TOOLCHAIN_CACHE_SANDBOX_PATHS, CODEX_HOST_MOUNT_PATH = "/mnt/host-codex", SANDBOX_WORKSPACE_PATH = "/home/agent/workspace", ISOLATED_REPO_PATH = "/home/agent/repo", SETUP_MARKER_FILE = ".runcastle-setup", SETUP_MARKER = "RUNCASTLE_SETUP", RUN, BASH_PATTERNS, TOOL_NAME_CATEGORY, MAX_ATTRIBUTABLE_GAP_MS, BURN_WORKTREE_PATH, WORKTREE_REMOVAL_FAILURES, FATAL_ERROR_PATTERNS, RUNTIME_FATAL_ERROR_PATTERNS, RETRYABLE_ERROR_PATTERNS, RUNTIME_RETRYABLE_ERROR_PATTERNS, AGENT_BINARY, activeTicketAborts, SETUP_HOOK_TIMEOUT_MS, ticketBurner;
+var ATTACHMENTS_PREFIX, AUTH_MISSING_EVENT = "auth.missing", IMAGE_RUNTIME_MISSING_EVENT = "burn.image_runtime_missing", RUNTIME_BINARY, COMMAND_SEPARATORS, ASSIGNMENT_PREFIX, NON_COMMAND_WORDS, PLAIN_COMMAND_NAME, DROPPED_MAP_SECTIONS, AGENT_CONVENTIONS_FILE = "CLAUDE.md", PACKAGE_MANAGERS, PM_CACHE_SANDBOX_PATHS, TOOLCHAIN_CACHE_SANDBOX_PATHS, CODEX_HOST_MOUNT_PATH = "/mnt/host-codex", SANDBOX_WORKSPACE_PATH = "/home/agent/workspace", ISOLATED_REPO_PATH = "/home/agent/repo", SETUP_MARKER_FILE = ".runcastle-setup", SETUP_MARKER = "RUNCASTLE_SETUP", RUN, BASH_PATTERNS, TOOL_NAME_CATEGORY, MAX_ATTRIBUTABLE_GAP_MS, BURN_WORKTREE_PATH, WORKTREE_REMOVAL_FAILURES, REFUSAL_STATUS, DETACHED_FORBIDDEN, CREDENTIAL_SUBJECT, ACCOUNT_PERMISSION_DENIED, RUN_FATAL_ERROR_PATTERNS, REFUSED_CREDENTIAL_STATUS, RUNTIME_RUN_FATAL_ERROR_PATTERNS, FATAL_ERROR_PATTERNS, RUNTIME_FATAL_ERROR_PATTERNS, RETRYABLE_ERROR_PATTERNS, RUNTIME_RETRYABLE_ERROR_PATTERNS, AGENT_BINARY, MISSING_COMMAND_PATTERNS, activeTicketAborts, RunHaltedAbort, NOTHING_LANDED = "nothing landed \u2014 every implementation ticket in the run was cancelled", SETUP_HOOK_TIMEOUT_MS, ticketBurner;
 var init_ticket_burner = __esm(() => {
   init_src();
   init_config_load();
@@ -58442,6 +58901,26 @@ var init_ticket_burner = __esm(() => {
     "claude-code": "claude",
     codex: "codex"
   };
+  COMMAND_SEPARATORS = /&&|\|\||[;|\n]/;
+  ASSIGNMENT_PREFIX = /^[A-Za-z_][A-Za-z0-9_]*=/;
+  NON_COMMAND_WORDS = new Set([
+    "cd",
+    "export",
+    "set",
+    "unset",
+    "source",
+    ".",
+    "exec",
+    "env",
+    "eval",
+    "command",
+    "time",
+    "sudo",
+    "echo",
+    "true",
+    "false"
+  ]);
+  PLAIN_COMMAND_NAME = /^[A-Za-z0-9][A-Za-z0-9._+-]*$/;
   DROPPED_MAP_SECTIONS = ["Not yet specified", "Out of scope"];
   PACKAGE_MANAGERS = ["bun", "pnpm", "yarn", "npm"];
   PM_CACHE_SANDBOX_PATHS = {
@@ -58485,27 +58964,42 @@ var init_ticket_burner = __esm(() => {
     /is not a working tree/i,
     /resource busy|ebusy|eperm|eacces/i
   ];
-  FATAL_ERROR_PATTERNS = [
+  REFUSAL_STATUS = String.raw`\b(?:401|403)\b`;
+  DETACHED_FORBIDDEN = String.raw`(?<!${REFUSAL_STATUS}[\W_]*)forbidden(?![\W_]*${REFUSAL_STATUS})`;
+  CREDENTIAL_SUBJECT = String.raw`(?:api[ _-]?key|token|credential|login|auth(?:entic\w*|ori[sz]\w*|[nz])?\b|unauthorized|${DETACHED_FORBIDDEN}|account|organi[sz]ation|\borg\b)`;
+  ACCOUNT_PERMISSION_DENIED = refusalNamingCredential(String.raw`permission denied`);
+  RUN_FATAL_ERROR_PATTERNS = [
     /invalid (api key|x-api-key)/i,
-    /authentication|unauthorized|permission denied/i,
+    /authentication|unauthorized/i,
+    ACCOUNT_PERMISSION_DENIED,
     /credit balance|billing/i,
     /oauth token|setup-token/i,
-    /issue with the selected model|model not found|unknown model/i,
-    /does not support resumeSession|resumeSession .* not found/i
+    /usage limit/i
   ];
-  RUNTIME_FATAL_ERROR_PATTERNS = {
+  REFUSED_CREDENTIAL_STATUS = refusalNamingCredential(String.raw`(?:${REFUSAL_STATUS}|forbidden)`);
+  RUNTIME_RUN_FATAL_ERROR_PATTERNS = {
     "claude-code": [],
     codex: [
-      /invalid_api_key|invalid_request_error/i,
-      /\b401\b|\b403\b/,
+      /invalid_api_key/i,
+      REFUSED_CREDENTIAL_STATUS,
       /insufficient_quota|exceeded your current quota/i,
-      /model_not_found|does not exist or you do not have access/i,
       /CODEX_API_KEY/,
       /not logged in/i,
       /\bauth (failed|required)\b/i,
       /refresh token/i
     ]
   };
+  FATAL_ERROR_PATTERNS = [
+    /issue with the selected model|model not found|unknown model/i,
+    /does not support resumeSession|resumeSession .* not found/i
+  ];
+  RUNTIME_FATAL_ERROR_PATTERNS = {
+    "claude-code": [],
+    codex: [
+      /invalid_request_error/i,
+      /model_not_found|does not exist or you do not have access/i
+    ]
+  };
   RETRYABLE_ERROR_PATTERNS = [
     /exited with code \d+/i,
     /idle timeout|AgentIdleTimeout/i,
@@ -58524,7 +59018,19 @@ var init_ticket_burner = __esm(() => {
     "claude-code": "claude",
     codex: "codex"
   };
+  MISSING_COMMAND_PATTERNS = [
+    /\bexit(?:ed with)?(?: code)? 127\b/i,
+    /command not found/i
+  ];
   activeTicketAborts = new Map;
+  RunHaltedAbort = class RunHaltedAbort extends Error {
+    headline;
+    constructor(headline) {
+      super(`ticket stopped: run halted (${headline})`);
+      this.headline = headline;
+      this.name = "RunHaltedAbort";
+    }
+  };
   SETUP_HOOK_TIMEOUT_MS = 15 * 60000;
   ticketBurner = {
     id: "ticket-burner",
@@ -58533,9 +59039,9 @@ var init_ticket_burner = __esm(() => {
 });
 
 // src/workflows/research.ts
-import { mkdirSync as mkdirSync11, readFileSync as readFileSync10 } from "fs";
-import { dirname as dirname11, join as join18 } from "path";
-import { fileURLToPath as fileURLToPath8 } from "url";
+import { mkdirSync as mkdirSync11, readFileSync as readFileSync11 } from "fs";
+import { dirname as dirname11, join as join19 } from "path";
+import { fileURLToPath as fileURLToPath7 } from "url";
 function waypointSlug(waypoint) {
   const base = waypoint.title.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
   return `${waypoint.seq}-${base || "waypoint"}`;
@@ -58602,8 +59108,8 @@ function interpretResearchResult(result, docRelPath) {
   return { status: "failed", error: "agent produced no commits \u2014 no research summary landed" };
 }
 function researchTemplatePath() {
-  const here = dirname11(fileURLToPath8(import.meta.url));
-  return join18(resolveSkillsRoot(here), "burner", "research-waypoint.md");
+  const here = dirname11(fileURLToPath7(import.meta.url));
+  return join19(resolveSkillsRoot(here), "burner", "research-waypoint.md");
 }
 function researchContainerName(runId, seq2) {
   return `runcastle-${runId}-w${seq2}`;
@@ -58619,7 +59125,7 @@ async function realExecuteResearchRun(ctx, waypoint, config2, token, model) {
   const { project: project3, feature } = ctx;
   const docRelPath = researchDocRel(feature.slug, waypoint);
   const tempBranch = researchBranchName(feature.slug, waypoint.seq, newId("b").slice(2, 10));
-  const template = readFileSync10(researchTemplatePath(), "utf8");
+  const template = readFileSync11(researchTemplatePath(), "utf8");
   const prompt = renderResearchPrompt(template, {
     WAYPOINT_JSON: buildWaypointJson(waypoint),
     FEATURE_BRIEF: buildFeatureBrief(feature),
@@ -58627,12 +59133,12 @@ async function realExecuteResearchRun(ctx, waypoint, config2, token, model) {
     RESEARCH_DOC_PATH: docRelPath
   });
   mkdirSync11(logsDir(), { recursive: true });
-  const logFilePath = join18(logsDir(), `research-${feature.id}-${waypoint.seq}.log`);
+  const logFilePath = join19(logsDir(), `research-${feature.id}-${waypoint.seq}.log`);
   const throttle = createResearchStreamThrottle((e) => ctx.emitEvent(e));
   const codexAuthMount = codexAuthMountFor(model.runtime, config2.sandbox);
   const runOptions = {
     agent: buildBurnAgent(config2, token, model),
-    sandbox: selectSandbox(config2, codexAuthMount ? [codexAuthMount] : [], {}, registerResearchKill(config2, ctx.runId, waypoint.seq)),
+    sandbox: selectSandbox(config2, project3, codexAuthMount ? [codexAuthMount] : [], {}, registerResearchKill(config2, ctx.runId, waypoint.seq)),
     cwd: project3.repoPath,
     prompt,
     branchStrategy: { type: "branch", branch: tempBranch, baseBranch: feature.branch },
@@ -59233,16 +59739,30 @@ async function rethinkAndLaunch(ctx, featureId, launch3) {
 function errMsg2(e) {
   return e instanceof Error ? e.message : String(e);
 }
+function latestRunDeniedDirty(ctx, featureId) {
+  const latestRun = listRunsByFeature(ctx, featureId)[0];
+  if (!latestRun)
+    return false;
+  const deniedAt = latestEventTs(ctx, featureId, "reviewdrive.denied");
+  return deniedAt !== undefined && deniedAt >= latestRun.startedAt;
+}
 async function retryTicket(ctx, ticketId, opts = {}) {
   const ticket = getTicket(ctx, ticketId);
   const feature = getFeatureRow(ctx, ticket.featureId);
-  if (ticket.status !== "failed") {
+  const retryingDeniedReview = ticket.kind === "review" && ticket.status === "done" && latestRunDeniedDirty(ctx, feature.id);
+  if (ticket.status !== "failed" && !retryingDeniedReview) {
     throw new GateError(`only failed tickets can be retried \u2014 ticket ${ticket.seq} is ${ticket.status}`);
   }
   if (hasActiveRun(ctx, feature.id)) {
     throw new GateError("a run is live for this feature \u2014 retry after it finishes, or cancel it first");
   }
   const project3 = projectForFeature(ctx, feature);
+  if (retryingDeniedReview) {
+    const stillDirty = await driveBlockingPaths(project3.repoPath);
+    if (stillDirty.length > 0) {
+      throw new GateError(`the working tree is still dirty \u2014 the review drive would be denied again. Commit or ` + `discard ${stillDirty.length} file(s) first: ${truncatedFileList(stillDirty)}`);
+    }
+  }
   const all8 = listByFeature2(ctx, feature.id);
   const bySeq = new Map(all8.map((t) => [t.seq, t]));
   const toReset = new Map([[ticket.seq, ticket]]);
@@ -59424,7 +59944,7 @@ var init_features = __esm(() => {
 });
 
 // src/services/test-notes.ts
-import { existsSync as existsSync19, mkdirSync as mkdirSync12, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync20, mkdirSync as mkdirSync12, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname12 } from "path";
 import { and as and10, asc as asc5, eq as eq13, lt } from "drizzle-orm";
 function rowToNote(row) {
@@ -59439,7 +59959,7 @@ function rowToNote(row) {
     reviewTicketId: row.reviewTicketId ?? undefined,
     carriedLap: row.carriedLap ?? undefined,
     videoTimestamp: row.videoTimestamp ?? undefined,
-    screenshotUrl: existsSync19(annotationPath(row.id)) ? noteScreenshotUrl(row.id) : undefined,
+    screenshotUrl: existsSync20(annotationPath(row.id)) ? noteScreenshotUrl(row.id) : undefined,
     createdAt: row.createdAt,
     updatedAt: row.updatedAt
   });
@@ -59709,8 +60229,8 @@ var init_test_notes = __esm(() => {
 });
 
 // src/mcp/server.ts
-import { existsSync as existsSync20, readFileSync as readFileSync11 } from "fs";
-import { join as join19, relative as relative4, resolve as resolve10, sep as sep2 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync12 } from "fs";
+import { join as join20, relative as relative4, resolve as resolve10, sep as sep2 } from "path";
 import { StreamableHTTPTransport } from "@hono/mcp";
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { Hono } from "hono";
@@ -59795,6 +60315,7 @@ function featureContext(ctx, reader) {
     moreDocs,
     docsNote: DOCS_NOTE,
     openDefects: carried.openDefects,
+    carriedDefects: carried.carriedDefects,
     tickets: listByFeature2(ctx, feature.id).map(stripDigest),
     annotatedModels: annotatedModels(ctx)
   };
@@ -59851,7 +60372,13 @@ function toolEmitTickets(ctx, session, input) {
   const feature = getFeatureRow(ctx, requireFeatureId(session));
   refuseIfReadOnly(session, "emitting tickets");
   refuseMisKindedReview(input.tickets);
+  const linkedFindingIds = input.tickets.flatMap((t) => t.originFindingId ?? []);
+  requireLinkableFindings(ctx, feature.id, linkedFindingIds);
   const stored = storeTickets(ctx, feature.id, input.tickets);
+  for (const ticket of stored) {
+    if (ticket.originFindingId)
+      linkFixTicket(ctx, feature.id, ticket.originFindingId, ticket.id);
+  }
   return {
     stored: stored.length,
     tickets: stored.map((t) => ({ id: t.id, seq: t.seq, title: t.title }))
@@ -59876,6 +60403,13 @@ function toolCancelTicket(ctx, session, input) {
   refuseIfReadOnly(session, "cancelling a ticket");
   return { ok: true, ticket: cancelTicket(ctx, input.id, input.reason) };
 }
+function toolResolveFinding(ctx, session, input) {
+  const featureId = requireFeatureId(session);
+  refuseIfReadOnly(session, "resolving a finding");
+  const { findingId, disposition, note: note2 } = ResolveFindingInput.parse(input);
+  const finding = disposition === "carry" ? carryFinding(ctx, featureId, findingId, note2) : closeAsAddressed(ctx, featureId, findingId, note2 ?? "");
+  return { ok: true, finding };
+}
 function toolEscalateToMap(ctx, session, input) {
   return escalateToMap(ctx, requireFeatureId(session), input);
 }
@@ -60142,16 +60676,16 @@ function adrRef(adr) {
 }
 function toolReadAdr(ctx, session, input) {
   requireProject(ctx, session);
-  const root = resolve10(join19(session.worktreePath, ADR_DIR_REL));
+  const root = resolve10(join20(session.worktreePath, ADR_DIR_REL));
   const name = input.relPath.replace(/\\/g, "/").replace(/^\.?\/*docs\/adr\//i, "");
   const target = resolve10(root, name);
   const rel = relative4(root, target);
   if (rel === "" || rel.startsWith("..") || rel.split(sep2).includes("..")) {
     throw new InvalidInputError(`adr path escapes ${ADR_DIR_REL}: ${input.relPath}`);
   }
-  if (!existsSync20(target))
+  if (!existsSync21(target))
     throw new NotFoundError(`adr not found: ${input.relPath}`);
-  return { relPath: `${ADR_DIR_REL}/${name}`, content: readFileSync11(target, "utf8") };
+  return { relPath: `${ADR_DIR_REL}/${name}`, content: readFileSync12(target, "utf8") };
 }
 function featureIndexLine(feature) {
   if (feature.status === "shipped") {
@@ -60290,7 +60824,7 @@ function buildMcpServer(audience) {
   if (wants("review_drive")) {
     server.registerTool("review_drive", {
       title: "Drive the feature branch for review",
-      description: "Boot the integrated feature branch on the human's checkout, under your run's " + "identity, so you can review it. ALWAYS stop what you started, including when the " + "review goes wrong: the drive holds a machine-wide slot and the human cannot use their " + "own checkout until you release it. Refusals (a dirty tree, a drive the human is " + "already running) are final and never worth retrying \u2014 reporting one is the honest " + "outcome. Refused unless your call carries a live run identity.",
+      description: "Boot the integrated feature branch on the human's checkout, under your run's " + "identity, so you can review it. ALWAYS stop what you started, including when the " + "review goes wrong: the drive holds a machine-wide slot and the human cannot use their " + "own checkout until you release it. A refused `start` says which refusal it is: " + '`deniedCode: "slot_held"` (`retriable: true`) means somebody else \u2014 a drive or a ' + "preparation dry run \u2014 holds the machine-wide slot, which frees itself when they " + "finish, so call `start` again about ten times roughly thirty seconds apart before you " + 'give up on it. `deniedCode: "dirty"` (`retriable: false`) is final \u2014 the uncommitted ' + "files in `dirtyFiles` are the human's to clear and no wait will do it, so report it " + "and review without the app. Refused unless your call carries a live run identity.",
       inputSchema: {
         action: z4.enum(["start", "status", "stop"]).describe("`start` switches the checkout to the feature branch, renders driveEnv (per-branch " + "database), runs driveSetupCommand and spawns devCommand. `status` reports the " + "drive and hands back the localhost URL once the dev server has printed one \u2014 " + "poll it, the URL is not ready at start. `stop` tears the environment down and " + "puts the checkout back.")
       }
@@ -60510,6 +61044,18 @@ function buildMcpServer(audience) {
       return ok(result);
     });
   }
+  if (wants("resolve_finding")) {
+    server.registerTool("resolve_finding", {
+      title: "Resolve a review finding",
+      description: "Say what this lap did about a defect an earlier lap\u2019s review left open: `carry` it into " + "a later lap, or close it as `addressed` because this lap\u2019s work already answers it. To " + "link it instead, emit the ticket that fixes it with `originFindingId` set \u2014 the burn " + "then closes the finding itself when that ticket lands. Every earlier-lap open defect " + 'must be linked, carried or closed before `complete_phase("tickets")` will pass.',
+      inputSchema: ResolveFindingShape
+    }, async (args2, extra) => {
+      const rs = await resolveCtxSession(extra);
+      if (!rs)
+        return noSession();
+      return ok(toolResolveFinding(rs.ctx, rs.session, args2));
+    });
+  }
   if (wants("escalate_to_map")) {
     server.registerTool("escalate_to_map", {
       title: "Escalate to map",
@@ -60606,7 +61152,23 @@ async function resolveAudience(sessionId, runId) {
     return;
   }
 }
-var DOCS_NOTE, REVIEW_TITLE, DRAFTING_KINDS, ADRS_NOTE, FEATURE_KINDS, FEATURE_WRITE_KINDS, PROJECT_KINDS, ALL_AUDIENCES, TOOL_AUDIENCES, CompletablePhase, EventType, mcp, server_default;
+async function readMcpBody(c) {
+  if (c.req.method !== "POST")
+    return;
+  let text3;
+  try {
+    text3 = await c.req.text();
+  } catch (e) {
+    console.error(`[mcp] request body read failed after ${c.req.header("content-length") ?? "unknown"} ` + `declared bytes: ${e instanceof Error ? e.message : String(e)}`);
+    return;
+  }
+  try {
+    return JSON.parse(text3);
+  } catch {
+    return;
+  }
+}
+var DOCS_NOTE, REVIEW_TITLE, ResolveFindingShape, ResolveFindingInput, DRAFTING_KINDS, ADRS_NOTE, FEATURE_KINDS, FEATURE_WRITE_KINDS, PROJECT_KINDS, ALL_AUDIENCES, TOOL_AUDIENCES, CompletablePhase, EventType, mcp, server_default;
 var init_server = __esm(() => {
   init_src();
   init_paths();
@@ -60627,6 +61189,20 @@ var init_server = __esm(() => {
   init_waypoints();
   DOCS_NOTE = "docs[] holds this feature\u2019s canonical docs in full. moreDocs[] is everything else that " + "exists in docs/features/<slug>/ \u2014 not inlined, not gone: read any of them with " + "read_feature_doc({ relPath }). A `withheld` reason means it was left out on purpose; fetch " + "it anyway if a ticket points at it.";
   REVIEW_TITLE = /^review[: ]/i;
+  ResolveFindingShape = {
+    findingId: z4.string().min(1).describe("The finding id, from `get_feature_context`\u2019s openDefects or carriedDefects."),
+    disposition: z4.enum(["carry", "addressed"]).describe("`carry` parks it for a later lap \u2014 out of the open count, still visible, and the human can " + "reopen it. `addressed` closes it because this lap\u2019s work already answers it."),
+    note: z4.string().optional().describe('REQUIRED for `addressed`: what addressed it, e.g. "lap 2\u2019s ticket 7 rewrote the endpoint". ' + "Optional for `carry`, where it records why it was parked.")
+  };
+  ResolveFindingInput = z4.object(ResolveFindingShape).superRefine((input, refinement) => {
+    if (input.disposition === "addressed" && !input.note?.trim()) {
+      refinement.addIssue({
+        code: "custom",
+        path: ["note"],
+        message: "closing a defect as addressed requires a note saying what addressed it"
+      });
+    }
+  });
   DRAFTING_KINDS = ["ideation", "revisit", "waypoint", "converge"];
   ADRS_NOTE = "adrs[] is an index of the project\u2019s LIVE decisions (superseded ones are already omitted), not " + "their text. Read the ones your work touches with read_adr({ relPath }) \u2014 they bind you the " + "same either way. They are also plain files in this worktree at docs/adr/.";
   FEATURE_KINDS = [
@@ -60648,6 +61224,7 @@ var init_server = __esm(() => {
     update_ticket: FEATURE_WRITE_KINDS,
     cancel_ticket: FEATURE_WRITE_KINDS,
     complete_phase: FEATURE_WRITE_KINDS,
+    resolve_finding: FEATURE_WRITE_KINDS,
     escalate_to_map: FEATURE_KINDS,
     emit_waypoints: FEATURE_KINDS,
     resolve_waypoint: FEATURE_KINDS,
@@ -60673,11 +61250,12 @@ var init_server = __esm(() => {
     }
   });
   mcp.all("*", async (c) => {
+    const body = await readMcpBody(c);
     const audience = await resolveAudience(c.req.header("X-Runcastle-Session"), c.req.header(RUN_HEADER));
     const server = buildMcpServer(audience);
     const transport = new StreamableHTTPTransport({ enableJsonResponse: true });
     await server.connect(transport);
-    const res = await transport.handleRequest(c);
+    const res = await transport.handleRequest(c, body);
     return res ?? c.body(null, 202);
   });
   server_default = mcp;
@@ -61018,12 +61596,12 @@ var init_hooks = __esm(() => {
 });
 
 // src/routes/reviews.ts
-import { createReadStream, statSync as statSync6 } from "fs";
+import { createReadStream, statSync as statSync5 } from "fs";
 import { Readable } from "stream";
 import { Hono as Hono3 } from "hono";
 function fileSize(path2) {
   try {
-    const stat3 = statSync6(path2);
+    const stat3 = statSync5(path2);
     return stat3.isFile() ? stat3.size : undefined;
   } catch {
     return;
@@ -61210,15 +61788,15 @@ var init_stream = __esm(() => {
 });
 
 // src/routes/web.ts
-import { existsSync as existsSync21, statSync as statSync7 } from "fs";
+import { existsSync as existsSync22, statSync as statSync6 } from "fs";
 import { readFile as readFile4 } from "fs/promises";
-import { extname, join as join20, normalize as normalize2, resolve as resolve11, sep as sep3 } from "path";
+import { extname, join as join21, normalize as normalize2, resolve as resolve11, sep as sep3 } from "path";
 function contentType(path2) {
   return MIME[extname(path2).toLowerCase()] ?? "application/octet-stream";
 }
 function isFile2(path2) {
   try {
-    return statSync7(path2).isFile();
+    return statSync6(path2).isFile();
   } catch {
     return false;
   }
@@ -61230,7 +61808,7 @@ function safeJoin(root, pathname) {
   } catch {
     return null;
   }
-  const joined = normalize2(join20(root, decoded));
+  const joined = normalize2(join21(root, decoded));
   if (joined !== root && !joined.startsWith(root + sep3))
     return null;
   return joined;
@@ -61243,7 +61821,7 @@ function resolveWebDist() {
 }
 function mountWebApp(app, distDir) {
   const root = resolve11(distDir);
-  const indexHtml = join20(root, "index.html");
+  const indexHtml = join21(root, "index.html");
   app.get("*", async (c, next4) => {
     const { pathname } = new URL(c.req.url);
     if (/^\/(api|mcp|ws|health)(\/|$)/.test(pathname))
@@ -61263,7 +61841,7 @@ function mountWebApp(app, distDir) {
 }
 function mountWebAppIfBuilt(app) {
   const dist = resolveWebDist();
-  if (existsSync21(join20(dist, "index.html")))
+  if (existsSync22(join21(dist, "index.html")))
     mountWebApp(app, dist);
 }
 var MIME;
@@ -61290,16 +61868,16 @@ var init_web = __esm(() => {
 });
 
 // src/version.ts
-import { readFileSync as readFileSync12 } from "fs";
-import { dirname as dirname13, join as join21 } from "path";
-import { fileURLToPath as fileURLToPath9 } from "url";
+import { readFileSync as readFileSync13 } from "fs";
+import { dirname as dirname13, join as join23 } from "path";
+import { fileURLToPath as fileURLToPath8 } from "url";
 function runcastleVersion() {
   if (cached4)
     return cached4;
-  const here = dirname13(fileURLToPath9(import.meta.url));
-  for (const pkgPath of [join21(here, "..", "package.json"), join21(here, "package.json")]) {
+  const here = dirname13(fileURLToPath8(import.meta.url));
+  for (const pkgPath of [join23(here, "..", "package.json"), join23(here, "package.json")]) {
     try {
-      const pkg = JSON.parse(readFileSync12(pkgPath, "utf8"));
+      const pkg = JSON.parse(readFileSync13(pkgPath, "utf8"));
       if (typeof pkg.version === "string") {
         cached4 = pkg.version;
         return cached4;
@@ -61314,13 +61892,13 @@ var init_version = () => {};
 
 // src/services/install-id.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { existsSync as existsSync22, mkdirSync as mkdirSync13, readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync13, readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
 import { dirname as dirname14 } from "path";
 function getInstallId() {
   const file = installIdPath();
   try {
-    if (existsSync22(file)) {
-      const existing = readFileSync13(file, "utf8").trim();
+    if (existsSync23(file)) {
+      const existing = readFileSync14(file, "utf8").trim();
       if (UUID_RE.test(existing))
         return existing;
     }
@@ -61519,8 +62097,8 @@ var init_events2 = __esm(() => {
 });
 
 // src/launcher/launcher.ts
-import { existsSync as existsSync23 } from "fs";
-import { join as join23 } from "path";
+import { existsSync as existsSync24 } from "fs";
+import { join as join25 } from "path";
 import { and as and12, eq as eq15 } from "drizzle-orm";
 function ptyExitMessage(exitCode) {
   const label = typeof exitCode === "number" ? String(exitCode) : "unknown";
@@ -61995,7 +62573,7 @@ async function buildPrepareBrief(ctx, project3) {
   };
 }
 function probePrepareHost(repoPath) {
-  const has4 = (rel) => existsSync23(join23(repoPath, rel));
+  const has4 = (rel) => existsSync24(join25(repoPath, rel));
   const lock = LOCKFILES.find(([file]) => has4(file));
   return {
     platform: process.platform,
@@ -62188,7 +62766,7 @@ var init_launcher = __esm(() => {
 
 // src/services/outcome.ts
 import { mkdirSync as mkdirSync14, writeFileSync as writeFileSync10 } from "fs";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 function digestHasSubstance(text3) {
   return text3.split(`
 `).some((line) => {
@@ -62288,9 +62866,9 @@ async function promoteOutcomeDoc(ctx, project3, feature, target, delta) {
       delta: { commits: delta.commits ?? 0, files: delta.files ?? 0 }
     });
     await onBranch(project3.repoPath, target, async () => {
-      const docsDir = join25(project3.repoPath, ...featureDocsRel(feature.slug).split("/"));
+      const docsDir = join26(project3.repoPath, ...featureDocsRel(feature.slug).split("/"));
       mkdirSync14(docsDir, { recursive: true });
-      writeFileSync10(join25(docsDir, "outcome.md"), doc, "utf8");
+      writeFileSync10(join26(docsDir, "outcome.md"), doc, "utf8");
       await commitDocs(project3.repoPath, `runcastle: outcome for ${feature.slug}`);
     });
   } catch (error) {
@@ -62417,9 +62995,9 @@ var init_feature = __esm(() => {
 });
 
 // src/services/fsbrowse.ts
-import { existsSync as existsSync24, readdirSync as readdirSync6, statSync as statSync8 } from "fs";
+import { existsSync as existsSync25, readdirSync as readdirSync6, statSync as statSync7 } from "fs";
 import { homedir as homedir4 } from "os";
-import { basename as basename3, dirname as dirname15, isAbsolute as isAbsolute3, join as join26, resolve as resolve12, sep as sep4 } from "path";
+import { basename as basename3, dirname as dirname15, isAbsolute as isAbsolute3, join as join27, resolve as resolve12, sep as sep4 } from "path";
 function expandPath(input, home = homedir4()) {
   const trimmed = input.trim();
   if (trimmed === "")
@@ -62428,12 +63006,12 @@ function expandPath(input, home = homedir4()) {
   if (out === "~")
     out = home;
   else if (out.startsWith("~/") || out.startsWith("~\\"))
-    out = join26(home, out.slice(2));
+    out = join27(home, out.slice(2));
   return resolve12(out);
 }
 function looksLikeRepo(dir) {
   try {
-    return existsSync24(join26(dir, ".git"));
+    return existsSync25(join27(dir, ".git"));
   } catch {
     return false;
   }
@@ -62444,20 +63022,20 @@ function listRoots(home = homedir4()) {
     for (let code = 67;code <= 90; code++) {
       const drive = `${String.fromCharCode(code)}:${sep4}`;
       try {
-        if (existsSync24(drive))
+        if (existsSync25(drive))
           roots3.push({ label: drive.replace(/\\$/, ""), path: drive, kind: "drive" });
       } catch {}
     }
   } else {
     roots3.push({ label: "/", path: "/", kind: "drive" });
   }
-  if (existsSync24(home))
+  if (existsSync25(home))
     roots3.push({ label: "Home", path: home, kind: "home" });
   const seen = new Set(roots3.map(pathKey));
   for (const name of COMMON_DIRS) {
-    const candidate = join26(home, name);
+    const candidate = join27(home, name);
     const key = pathKey({ path: candidate });
-    if (seen.has(key) || !existsSync24(candidate))
+    if (seen.has(key) || !existsSync25(candidate))
       continue;
     seen.add(key);
     roots3.push({ label: name, path: candidate, kind: "common" });
@@ -62488,12 +63066,12 @@ function browseDir(input, showHidden = false, home = homedir4()) {
   if (!isAbsolute3(target)) {
     throw new InvalidInputError(`path is not absolute: ${target}`);
   }
-  if (!existsSync24(target)) {
+  if (!existsSync25(target)) {
     throw new InvalidInputError(`path does not exist: ${target}`);
   }
   let dir = target;
   try {
-    if (!statSync8(target).isDirectory())
+    if (!statSync7(target).isDirectory())
       dir = dirname15(target);
   } catch (e) {
     throw new InvalidInputError(`cannot read path: ${target} (${errMsg4(e)})`);
@@ -62516,14 +63094,14 @@ function browseDir(input, showHidden = false, home = homedir4()) {
       continue;
     if (!showHidden && name.startsWith("."))
       continue;
-    const path2 = join26(dir, name);
+    const path2 = join27(dir, name);
     const isSymlink = dirent.isSymbolicLink();
     if (isSymlink && !showHidden)
       continue;
     let isDirectory = dirent.isDirectory();
     if (isSymlink) {
       try {
-        isDirectory = statSync8(path2).isDirectory();
+        isDirectory = statSync7(path2).isDirectory();
       } catch {
         continue;
       }
@@ -62553,7 +63131,7 @@ var init_fsbrowse = __esm(() => {
 });
 
 // src/services/transcripts.ts
-import { readFileSync as readFileSync14 } from "fs";
+import { readFileSync as readFileSync15 } from "fs";
 function* entries(jsonl) {
   for (const line of jsonl.split(`
 `)) {
@@ -62634,7 +63212,7 @@ function readTranscript2(path2, runtime5) {
   if (!path2)
     return { status: "ok", turns: [] };
   try {
-    return parseTranscript(readFileSync14(path2, "utf8"), runtime5);
+    return parseTranscript(readFileSync15(path2, "utf8"), runtime5);
   } catch {
     return { status: "ok", turns: [] };
   }
@@ -62747,8 +63325,8 @@ var init_conversations = __esm(() => {
 });
 
 // src/services/projects.ts
-import { existsSync as existsSync25 } from "fs";
-import { basename as basename4, join as join27 } from "path";
+import { existsSync as existsSync26 } from "fs";
+import { basename as basename4, join as join28 } from "path";
 import { eq as eq16, isNull } from "drizzle-orm";
 function listProjects(ctx) {
   return ctx.db.select().from(projects).where(isNull(projects.closedAt)).all().map(rowToProject);
@@ -62827,7 +63405,7 @@ async function assertRepoTolerant(ctx, repoPath) {
   } catch (e) {
     if (!isNotImplemented(e))
       throw e;
-    if (!existsSync25(join27(repoPath, ".git"))) {
+    if (!existsSync26(join28(repoPath, ".git"))) {
       throw new InvalidInputError(`not a git repository: ${repoPath}`);
     }
   }
@@ -62892,6 +63470,7 @@ var init_review_findings2 = __esm(() => {
   reviewFindingsRouter = router({
     listByFeature: publicProcedure.input(z9.object({ featureId: z9.string() })).query(({ ctx, input }) => viewByFeature(ctx, input.featureId)),
     dismiss: publicProcedure.input(z9.object({ findingId: z9.string() })).mutation(({ ctx, input }) => dismiss(ctx, input.findingId)),
+    reopen: publicProcedure.input(z9.object({ findingId: z9.string() })).mutation(({ ctx, input }) => reopenFinding(ctx, input.findingId)),
     fixOpenDefects: publicProcedure.input(z9.object({ featureId: z9.string() })).mutation(async ({ ctx, input }) => {
       const promoted = promoteOpenDefects(ctx, input.featureId);
       const { runId } = await burn(ctx, input.featureId);
@@ -62977,13 +63556,13 @@ var init_settings2 = __esm(() => {
 });
 
 // src/doctor/afk-env.ts
-import { existsSync as existsSync26, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync16 } from "fs";
 function envWithAfkCredentials() {
   const merged = { ...process.env };
   try {
     const path2 = envPath();
-    if (existsSync26(path2)) {
-      const fromFile = parseEnvFile3(readFileSync15(path2, "utf8"));
+    if (existsSync27(path2)) {
+      const fromFile = parseEnvFile3(readFileSync16(path2, "utf8"));
       for (const runtime5 of AGENT_RUNTIMES) {
         const key = RUNTIME_SPECS[runtime5].afkKey;
         const value = fromFile[key];
@@ -63001,9 +63580,84 @@ var init_afk_env = __esm(() => {
   init_doctor();
 });
 
+// src/services/project-image.ts
+function adoptProjectImage(ctx, projectId, tag) {
+  if (!isOverwritable(ctx, projectId, "sandboxImage"))
+    return false;
+  recordFinding(ctx, projectId, {
+    key: "sandboxImage",
+    value: tag,
+    source: "build",
+    evidence: `Built from .runcastle/sandbox/Dockerfile as ${tag}.`
+  });
+  emitProject(ctx, projectId, {
+    type: "settings.updated",
+    message: `sandboxImage set to ${tag} by the image build`,
+    data: { key: "sandboxImage", scope: "project", value: tag }
+  });
+  return true;
+}
+function releaseProjectImage(ctx, projectId) {
+  if (!isOverwritable(ctx, projectId, "sandboxImage"))
+    return false;
+  recordFinding(ctx, projectId, { key: "sandboxImage", value: null, source: "build" });
+  emitProject(ctx, projectId, {
+    type: "settings.updated",
+    message: "sandboxImage cleared \u2014 .runcastle/sandbox/Dockerfile is gone",
+    data: { key: "sandboxImage", scope: "project", value: null }
+  });
+  return true;
+}
+var init_project_image = __esm(() => {
+  init_events();
+  init_findings();
+});
+
 // src/trpc/routers/setup.ts
+import { join as join29 } from "path";
 import { isNotNull as isNotNull4 } from "drizzle-orm";
 import * as z12 from "zod";
+function projectImageEnv(ctx, project3) {
+  return {
+    id: project3.id,
+    repoPath: project3.repoPath,
+    stored: project3.sandboxImage ?? null,
+    overwritable: isOverwritable(ctx, project3.id, "sandboxImage"),
+    clearStored: () => releaseProjectImage(ctx, project3.id)
+  };
+}
+async function buildImageTerminal(ctx, projectId) {
+  const exec3 = createSystemExec();
+  const runtime5 = await resolveRuntime(exec3, ctx.config.sandbox === "podman" ? "podman" : "docker");
+  const project3 = projectId ? requireProjectById(ctx, projectId) : null;
+  const stockContext = prepareSandboxBuildContext();
+  const stockHash = hashDockerfile(join29(stockContext, "Dockerfile"));
+  const plan = planImageBuild({
+    config: ctx.config,
+    project: project3 ? {
+      id: project3.id,
+      repoPath: project3.repoPath,
+      sandboxImage: project3.sandboxImage,
+      sandboxImageOverwritable: isOverwritable(ctx, project3.id, "sandboxImage")
+    } : null,
+    stockContext,
+    stockFresh: stockHash !== null && (await inspectBuiltImage(exec3, runtime5, DEFAULT_SANDBOX_IMAGE)).hash === stockHash,
+    buildArgs: stockBuildArgs(runtime5)
+  });
+  if (plan.kind === "refused")
+    throw new InvalidInputError(plan.reason);
+  const spec = imageBuildTerminal(runtime5, plan);
+  if (plan.kind !== "chain" || !project3)
+    return { spec };
+  const { projectTag } = plan;
+  return {
+    spec,
+    onExit: ({ exitCode }) => {
+      if (exitCode === 0)
+        adoptProjectImage(ctx, project3.id, projectTag);
+    }
+  };
+}
 var setupRouter;
 var init_setup2 = __esm(() => {
   init_src();
@@ -63011,41 +63665,48 @@ var init_setup2 = __esm(() => {
   init_afk_env();
   init_doctor();
   init_system_exec();
+  init_errors();
   init_asset_paths();
   init_registry();
+  init_findings();
+  init_project_image();
+  init_repo();
+  init_sandbox_image();
   init_setup();
   init_resolve_executable();
   init_context();
   setupRouter = router({
-    doctor: publicProcedure.query(({ ctx }) => {
+    doctor: publicProcedure.input(z12.object({
+      projectId: z12.string().optional()
+    }).optional()).query(({ ctx, input }) => {
       const projectModels = ctx.db.select({ model: projects.model }).from(projects).where(isNotNull4(projects.model)).all().map((p) => p.model);
+      const project3 = input?.projectId ? requireProjectById(ctx, input.projectId) : null;
       return runDoctor({
         exec: createSystemExec(),
         burnerDockerfile: burnerDockerfilePath(),
         env: envWithAfkCredentials(),
         runtimes: configuredRuntimes(ctx.config, projectModels),
-        ...ctx.config.sandboxImage ? { imageName: ctx.config.sandboxImage } : {}
+        imageName: resolveSandboxImage(ctx.config),
+        ...project3 ? { projectImage: projectImageEnv(ctx, project3) } : {}
       });
     }),
     runtimeGuide: publicProcedure.query(() => runtimeInstallGuide(process.platform)),
     gitIdentity: publicProcedure.input(z12.object({ name: z12.string(), email: z12.string() })).mutation(({ input }) => writeGitIdentity(createSystemExec(), input)),
     afkToken: publicProcedure.input(z12.object({ token: z12.string(), runtime: AgentRuntime.default("claude-code") })).mutation(({ input }) => saveAfkCredential(fileAfkTokenIo(createSystemExec(), input.runtime), input.token, input.runtime)),
     seedModelDefaults: publicProcedure.input(z12.object({ runtimes: z12.array(AgentRuntime) })).mutation(({ ctx, input }) => seedModelDefaults(ctx, input.runtimes)),
-    startTerminal: publicProcedure.input(z12.object({ kind: z12.enum(["setup-token", "build-image", "claude-login", "codex-login"]) })).mutation(async ({ ctx, input }) => {
-      const exec3 = createSystemExec();
-      const preferred = ctx.config.sandbox === "podman" ? "podman" : "docker";
-      const runtime5 = await resolveRuntime(exec3, preferred);
-      const imageName = resolveSandboxImage(ctx.config);
-      const sandcastleBin = input.kind === "build-image" ? resolveSandcastleBin() ?? undefined : undefined;
-      const spec = terminalSpec(input.kind, { runtime: runtime5, imageName, sandcastleBin });
+    startTerminal: publicProcedure.input(z12.object({
+      kind: z12.enum(["setup-token", "build-image", "claude-login", "codex-login"]),
+      projectId: z12.string().optional()
+    })).mutation(async ({ ctx, input }) => {
       const sessionId = newId("setup");
-      const cwd = input.kind === "build-image" ? prepareSandboxBuildContext() : process.cwd();
+      const { spec, onExit: onExit4 } = input.kind === "build-image" ? await buildImageTerminal(ctx, input.projectId) : { spec: { ...terminalSpec(input.kind), cwd: process.cwd() }, onExit: undefined };
       const { file, args: args2 } = resolveSpawnTarget(spec.cmd, spec.args);
       ptyRegistry().create({
         sessionId,
         cmd: file,
         args: args2,
-        opts: { cwd, env: process.env }
+        opts: { cwd: spec.cwd, env: process.env },
+        ...onExit4 ? { onExit: onExit4 } : {}
       });
       return { sessionId };
     })