terminalhire 0.42.21 → 0.42.23

package/dist/bin/jpi-run.js

@@ -45,7 +45,7 @@ ${facts.stderr}`))
   return null;
 }
 function isCommandUnavailable(facts, countsRead) {
-  if (facts.exitCode === 127 || facts.exitCode === 126)
+  if (facts.exitCode === 127 || facts.exitCode === 126 || facts.exitCode === 125)
     return true;
   if (countsRead)
     return false;
@@ -53,6 +53,22 @@ function isCommandUnavailable(facts, countsRead) {
     return false;
   return facts.stdout.trim().length === 0 && EXEC_FAILURE.test(facts.stderr);
 }
+function isOfflineBuildGap(facts, counts) {
+  if (facts.runtime !== "jvm")
+    return null;
+  if (counts !== null && counts.tests_failed > 0)
+    return null;
+  if (facts.exitCode === 0 || facts.exitCode === null)
+    return null;
+  const out = `${facts.stdout}
+${facts.stderr}`;
+  for (const pattern of OFFLINE_BUILD_GAP) {
+    const hit = pattern.exec(out);
+    if (hit)
+      return hit[0];
+  }
+  return null;
+}
 function classifyVerification(facts) {
   if (facts.timedOut) {
     return {
@@ -77,6 +93,14 @@ function classifyVerification(facts) {
       reason: `the test command could not be invoked (exit ${String(facts.exitCode)}). This is an environment failure on our side \u2014 a missing interpreter, a binary outside PATH, or a dependency installed somewhere the command cannot see it. The repo has not been judged.`
     };
   }
+  const gap = isOfflineBuildGap(facts, counts);
+  if (gap !== null) {
+    return {
+      outcome: "test-command-unavailable",
+      counts,
+      reason: `the build stopped on something our install step did not fetch (${gap}). The test step has no network, so this is a gap in our environment, not a failure in the repo. The repo has not been judged.`
+    };
+  }
   if (counts !== null) {
     if (counts.tests_failed > 0) {
       return {
@@ -131,10 +155,19 @@ function isGreen(outcome) {
 function isOurFault(outcome) {
   return outcome === "test-command-unavailable" || outcome === "counts-unparsed";
 }
-var int, withSuiteFailures, READERS, SUPPORTED_RUNNERS, COVERAGE_TABLE, EXEC_FAILURE, SUITE_REPORTED_FAILURE;
+var VERIFICATION_OUTCOMES, int, withSuiteFailures, READERS, SUPPORTED_RUNNERS, COVERAGE_TABLE, EXEC_FAILURE, SUITE_REPORTED_FAILURE, OFFLINE_BUILD_GAP;
 var init_classify = __esm({
   "../../packages/envrun/dist/classify.js"() {
     "use strict";
+    VERIFICATION_OUTCOMES = [
+      "completed",
+      "tests-failed",
+      "no-tests-observed",
+      "counts-unparsed",
+      "test-command-unavailable",
+      "environment-exhausted",
+      "budget-exceeded"
+    ];
     int = (m, i = 1) => m ? Number(m[i]) : 0;
     withSuiteFailures = (counts, suiteLine) => {
       if (counts.tests_failed > 0 || !suiteLine)
@@ -234,6 +267,51 @@ var init_classify = __esm({
           return { tests_passed: int(passed), tests_failed: int(failed) + int(errors) };
         }
       },
+      {
+        // Maven surefire's per-module summary (TERM-1122), measured against surefire
+        // 3.2.5 through `th run`:
+        //
+        //     [INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0
+        //
+        // The per-CLASS lines carry the same counts followed by `, Time elapsed: …`, so
+        // the end anchor after `Skipped` is what keeps them out; counting both would
+        // double every test. One summary prints per module, so they are SUMMED. An
+        // error is a test that could not run to an assertion, counted as failed so a
+        // green verdict is impossible while one is outstanding, as pytest's are.
+        runner: "maven surefire",
+        read: (out) => {
+          const lines = [
+            ...out.matchAll(/^(?:\[(?:INFO|WARNING|ERROR)\] )?Tests run: (\d+), Failures: (\d+), Errors: (\d+), Skipped: (\d+)(?:, Flakes: \d+)?\s*$/gm)
+          ];
+          if (lines.length === 0)
+            return null;
+          let passed = 0;
+          let failed = 0;
+          for (const m of lines) {
+            const [run2, failures, errors, skipped] = [m[1], m[2], m[3], m[4]].map(Number);
+            failed += failures + errors;
+            passed += Math.max(0, run2 - failures - errors - skipped);
+          }
+          return { tests_passed: passed, tests_failed: failed };
+        }
+      },
+      {
+        // Gradle prints no test counts when every test passes, so envrun installs an
+        // init script that prints one line per Test task (`gradleTestSummary.ts`,
+        // TERM-1122). The marker is ours; its format is fixed there.
+        runner: "gradle",
+        read: (out) => {
+          const lines = [
+            ...out.matchAll(/^terminalhire-gradle-tests: task=\S+ total=(\d+) passed=(\d+) failed=(\d+) skipped=(\d+)\s*$/gm)
+          ];
+          if (lines.length === 0)
+            return null;
+          return {
+            tests_passed: lines.reduce((sum, m) => sum + Number(m[2]), 0),
+            tests_failed: lines.reduce((sum, m) => sum + Number(m[3]), 0)
+          };
+        }
+      },
       {
         // mocha: `  440 passing (1s)` and `  2 failing`
         runner: "mocha",
@@ -268,6 +346,79 @@ var init_classify = __esm({
           const p = int(passed);
           return { tests_passed: p, tests_failed: Math.max(0, t - p) };
         }
+      },
+      {
+        /**
+         * BARE TAP — assertion lines with no plan and no summary comment (TERM-1138).
+         *
+         * LAST ON PURPOSE. It is the loosest reader here, so anything that a more specific
+         * one can read must reach that one first: `node --test` and node-tap both emit `ok`
+         * lines AND a closing summary, and their readers are ordered above for that reason.
+         * Moving this up would have it answer for both.
+         *
+         * A hand-rolled harness prints neither summary — it emits its assertions and stops.
+         * That is what morebetterltd/wheelhouse does: thirty `ok N - …` lines, exit 0, and
+         * before this every one of those runs reported `counts-unparsed`, which the claim
+         * page renders as "RESULT UNREADABLE — THE SUITE EXITED 0" over a suite that passed.
+         *
+         * ON THE MISSING PLAN LINE. TAP requires `1..N` so a reader can tell a finished
+         * stream from a truncated one, and there is none here, so this cannot prove the
+         * suite reached its end. That is a real limit and it is NOT a reason to refuse,
+         * because it holds this format to a standard no reader in this file meets — the
+         * jest reader greps a line out of stdout that a repository could `echo` without
+         * running anything. These are format adapters, not a trust boundary; the boundary
+         * is that the command is the repository's own or is refused a signature.
+         *
+         * CONTIGUOUS FROM 1, which buys self-consistency rather than security:
+         *
+         *   - starting at 1 rejects a TRUNCATION. `testOutputTail` keeps the last lines, so
+         *     a stream beginning `ok 47` is the middle of a longer run and counting it would
+         *     report three tests for a suite that ran fifty.
+         *   - no gaps rejects prose that happens to carry the word, and a stream interleaved
+         *     with another's.
+         *   - anchored with no leading space rejects TAP SUBTESTS, which indent. Counting
+         *     those would double them against their parent.
+         */
+        runner: "bare TAP",
+        read: (out) => {
+          let n = 0;
+          let failed = 0;
+          let passed = 0;
+          let plan = null;
+          for (const line of out.split("\n")) {
+            if (/^Bail out!/.test(line))
+              return null;
+            const p = /^(\d+)\.\.(\d+)\s*$/.exec(line);
+            if (p) {
+              const declared = Number(p[2]) - Number(p[1]) + 1;
+              if (plan !== null && plan !== declared)
+                return null;
+              plan = declared;
+              continue;
+            }
+            const m = /^(not )?ok (\d+)(?:\s|$)/.exec(line);
+            if (!m)
+              continue;
+            if (Number(m[2]) !== n + 1)
+              return null;
+            n += 1;
+            const directive = /#\s*(skip|todo)\b/i.exec(line);
+            const kind = directive?.[1]?.toLowerCase();
+            if (kind === "skip")
+              continue;
+            if (m[1] !== void 0) {
+              if (kind !== "todo")
+                failed += 1;
+              continue;
+            }
+            passed += 1;
+          }
+          if (n === 0)
+            return null;
+          if (plan !== null && plan !== n)
+            return null;
+          return { tests_passed: passed, tests_failed: failed };
+        }
       }
     ];
     SUPPORTED_RUNNERS = READERS.map((r) => r.runner);
@@ -289,6 +440,21 @@ var init_classify = __esm({
       "\\d+\\s+examples?,\\s+(?!0\\b)\\d+\\s+failures?"
       // rspec's summary line
     ].join("|"), "m");
+    OFFLINE_BUILD_GAP = [
+      // Maven, `-o`: `Cannot access central (…) in offline mode and the artifact … has
+      // not been downloaded from it before.`
+      /in offline mode and the artifact \S+ has not been downloaded from it before/,
+      // Maven without `-o`, as a CI-derived `mvn test` runs: it tries the network.
+      /Could not transfer artifact \S+ from\/to /,
+      /Plugin \S+ or one of its dependencies could not be resolved/,
+      // Gradle, `--offline`.
+      /No cached version (?:listing )?(?:of|for) \S+ available for offline mode/,
+      // Gradle without `--offline`, and the wrapper fetching its own distribution.
+      /Could not GET 'https?:\/\//,
+      /^Downloading https:\/\/services\.gradle\.org\/distributions\//m,
+      /No matching toolchains found for requested specification/,
+      /Cannot find a Java installation on your machine matching/
+    ];
   }
 });
 
@@ -354,6 +520,12 @@ function scrubEnv(source, opts) {
   env["GOCACHE"] = join5(jailHome, ".cache", "go-build");
   env["GOFLAGS"] = "-modcacherw";
   env["CARGO_HOME"] = join5(jailHome, ".cargo");
+  env["MAVEN_OPTS"] = `-Dmaven.repo.local=${join5(jailHome, ".m2", "repository")}`;
+  env["GRADLE_USER_HOME"] = join5(jailHome, ".gradle");
+  const bundle = join5(jailHome, ".bundle");
+  env["GEM_HOME"] = bundle;
+  env["BUNDLE_PATH"] = bundle;
+  env["BUNDLE_APP_CONFIG"] = bundle;
   const proxy = opts.proxyUrl ?? DEAD_PROXY;
   env["HTTP_PROXY"] = proxy;
   env["HTTPS_PROXY"] = proxy;
@@ -654,6 +826,31 @@ var init_egressProxy = __esm({
       "static.crates.io",
       "index.crates.io",
       "crates.io",
+      // TERM-1139. `ruby` has had an image since the mapping existed and `bundle install`
+      // as its derived command, and this host was missing — so every ruby repo could start
+      // and could never install. Install is the ONLY step with a network grant at all, so a
+      // denial here is terminal, not a slow path.
+      //
+      // One entry, not two: `hostAllowed` is dot-anchored SUFFIX matching, so this covers
+      // `index.rubygems.org` as well. Listing that separately would advertise the grant as
+      // narrower than it is, which the `github.com` note below rejects for the same reason.
+      "rubygems.org",
+      // TERM-1139, added with the `dotnet` image mapping. `dotnet restore` fetches from
+      // NuGet; the coupling test refuses a mapped runtime whose registry is unreachable, and
+      // it caught this one the moment the image landed.
+      "api.nuget.org",
+      // TERM-1122, added with the `jvm` image mapping, each from a MEASURED denial
+      // through `th run` (the proxy's 403 in the build's own output), not a guess:
+      //   - Maven Central, where both `mvn` and Gradle's `mavenCentral()` resolve.
+      //   - `services.gradle.org`, where a Gradle wrapper fetches its distribution.
+      //   - `release-assets.githubusercontent.com`, where that fetch LANDS. Measured
+      //     chain: services.gradle.org 307 -> github.com 302 -> this host 200. The
+      //     `github.com` note below keeps `githubusercontent.com` denied until a real
+      //     install needs it; this is that install. Only this one host: raw blobs and
+      //     `objects.githubusercontent.com` stay denied.
+      "repo.maven.apache.org",
+      "services.gradle.org",
+      "release-assets.githubusercontent.com",
       // Git dependencies. Approved by Eric 2026-07-22 after a live run measured the
       // chokepoint working under load (20 events, 16 allowed / 4 denied by host).
       //
@@ -945,6 +1142,9 @@ function containerArgs(spec, env, opts) {
       args.push(`--env=${k}=${url}`);
     }
     args.push("--env=NO_PROXY=", "--env=no_proxy=");
+    const host = opts.net.proxyHost;
+    const port = String(opts.net.proxyPort);
+    args.push(`--env=JAVA_TOOL_OPTIONS=-Dhttp.proxyHost=${host} -Dhttp.proxyPort=${port} -Dhttps.proxyHost=${host} -Dhttps.proxyPort=${port} -Daether.connector.http.useSystemProperties=true`);
   }
   args.push("--");
   args.push(validateImage(opts.image ?? DEFAULT_CONTAINER_IMAGE));
@@ -1277,7 +1477,10 @@ var init_container = __esm({
       "http_proxy",
       "https_proxy",
       "NO_PROXY",
-      "no_proxy"
+      "no_proxy",
+      // Carries the JVM's copy of the proxy (below), so an inherited value is dropped
+      // for the same reason as the rest.
+      "JAVA_TOOL_OPTIONS"
     ]);
     WINDOWS_DRIVE_ROOT = /^[A-Za-z]:[\\/]/;
     IMAGE_HOST = "(?:[a-zA-Z0-9-]+(?:\\.[a-zA-Z0-9-]+)+(?::[0-9]+)?|localhost(?::[0-9]+)?)";
@@ -1327,11 +1530,17 @@ var init_dist = __esm({
 function censusTotal(c) {
   return c.containers.length + c.volumes.length + c.networks.length;
 }
-function ids(docker3, args) {
+function query(docker3, args) {
   const res = docker3.sync([...args], { timeoutMs: 15e3 });
-  if (res.error || res.status !== 0)
-    return [];
-  return res.stdout.split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
+  if (res.error || res.status !== 0) {
+    const why = res.error?.message ?? (res.stderr.trim() || `exit ${String(res.status)}`);
+    return { ids: [], failure: `docker ${args.slice(0, 2).join(" ")}: ${why}` };
+  }
+  const ids2 = res.stdout.split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
+  return { ids: ids2, failure: null };
+}
+function ids(docker3, args) {
+  return query(docker3, args).ids;
 }
 function census(docker3, label) {
   const filter = `label=${label}`;
@@ -1341,25 +1550,67 @@ function census(docker3, label) {
     networks: ids(docker3, ["network", "ls", "-q", "--filter", filter])
   };
 }
+function censusReport(docker3, label) {
+  const filter = `label=${label}`;
+  const failures = [];
+  const ask = (args) => {
+    const q = query(docker3, args);
+    if (q.failure !== null)
+      failures.push(q.failure);
+    return q.ids;
+  };
+  const taken = {
+    containers: ask(["ps", "-aq", "--filter", filter]),
+    volumes: ask(["volume", "ls", "-q", "--filter", filter]),
+    networks: ask(["network", "ls", "-q", "--filter", filter])
+  };
+  return failures.length === 0 ? { observed: true, census: taken, unobservedReason: null } : { observed: false, census: taken, unobservedReason: failures.join("; ") };
+}
 function localCensus(label) {
   return census(localDockerClient(), label);
 }
-function judgeLeaks(peak, after) {
+function judgeLeaks(peak, after, observation) {
   const labelObserved = peak.containers.length > 0;
+  if (!observation.observed) {
+    return {
+      labelObserved,
+      reaped: false,
+      observed: false,
+      clean: false,
+      state: "unobserved",
+      peak,
+      after,
+      note: `UNOBSERVED, not clean: we could not look at what survived teardown (${observation.unobservedReason ?? "no reason given"}), so nothing is known about leaks on this run, in either direction.`
+    };
+  }
   const reaped = censusTotal(after) === 0;
   let note;
+  let state;
   if (!labelObserved && reaped) {
+    state = "inconclusive";
     note = "INCONCLUSIVE, not clean: nothing labelled was ever seen alive, so an empty final census is equally consistent with the label never being applied. The control failed, so the denial proves nothing.";
   } else if (!labelObserved) {
+    state = "leak";
     note = "no labelled container was observed alive AND objects remain \u2014 the label wiring is wrong.";
   } else if (!reaped) {
+    state = "leak";
     note = `LEAK: ${String(censusTotal(after))} labelled object(s) survived teardown (containers=${String(after.containers.length)} volumes=${String(after.volumes.length)} networks=${String(after.networks.length)}).`;
   } else {
+    state = "clean";
     note = `clean: peak ${String(peak.containers.length)} labelled container(s) observed alive, 0 labelled objects remain after teardown.`;
   }
-  return { labelObserved, reaped, clean: labelObserved && reaped, peak, after, note };
+  return {
+    labelObserved,
+    reaped,
+    observed: true,
+    clean: labelObserved && reaped,
+    state,
+    peak,
+    after,
+    note
+  };
 }
-var RUN_LABEL_KEY, LabelWatch;
+var RUN_LABEL_KEY, LabelWatch, LEAK_STATES;
 var init_labels = __esm({
   "../../packages/envrun/dist/labels.js"() {
     "use strict";
@@ -1414,6 +1665,7 @@ var init_labels = __esm({
         return this.#samples;
       }
     };
+    LEAK_STATES = ["clean", "leak", "inconclusive", "unobserved"];
   }
 });
 
@@ -1898,7 +2150,7 @@ function acquireLocalLease(runId) {
       observed: false,
       census: { containers: [], volumes: [], networks: [] },
       unobservedReason: RELEASED_LEASE_CENSUS_REASON
-    } : { observed: true, census: census(docker3, label), unobservedReason: null }),
+    } : censusReport(docker3, label)),
     publishPreview: (req) => startPreview({ ...req, docker: docker3 }),
     release: () => {
       if (released) {
@@ -2018,6 +2270,17 @@ caused by: ${frame}`;
   }
   return frames === 0 ? null : out;
 }
+function imageVariantFor(spec) {
+  if (spec.runtime !== "jvm")
+    return void 0;
+  const callsGradle = /(?:^|[\s;&|(])gradle(?=\s|$)/;
+  return [spec.installCommand, spec.testCommand].some((c) => c != null && callsGradle.test(c)) ? "gradle" : void 0;
+}
+function shapeFor(runtime, variant) {
+  if (runtime === "jvm" && variant === "gradle")
+    return JVM_GRADLE_IMAGE;
+  return RUNTIME_IMAGES[runtime];
+}
 function atLeast(a, b) {
   const left = a.split(".").map(Number);
   const right = b.split(".").map(Number);
@@ -2030,19 +2293,19 @@ function atLeast(a, b) {
   }
   return true;
 }
-function imageForRuntime(runtime, override, version) {
+function imageForRuntime(runtime, override, version, variant) {
   if (override)
     return override;
-  const shape = RUNTIME_IMAGES[runtime];
+  const shape = shapeFor(runtime, variant);
   if (!shape) {
-    throw new RunRefusalError(`no container image is mapped for runtime ${JSON.stringify(runtime)}. Refusing to run it in the Node image: a missing interpreter surfaces as "command not found", which the classifier reads as tests-failed \u2014 a false red blamed on the repo.`);
+    throw new RunRefusalError(`no container image is mapped for runtime ${JSON.stringify(runtime)}. Refusing to run it in the Node image: a bare "command not found" exits 127, which classifyVerification already owns as ours \u2014 but a test script that RUNS and fails inside on the missing tool exits with its own status and prints to stdout, and that falls through to tests-failed \u2014 a false red blamed on the repo.`);
   }
   if (version === void 0 || version === null)
     return unversionedImage(shape);
   if (!TAG_VERSION.test(version)) {
     throw new RunRefusalError(`runtime version ${JSON.stringify(version)} is not a bare version, so no image tag can be built from it. Refusing rather than booting the default: the repo asked for a version, and supplying a different one silently is what TERM-643 fixed.`);
   }
-  return `${shape.repository}:${version}${shape.suffix}`;
+  return `${shape.repository}:${shape.prefix ?? ""}${version}${shape.suffix}`;
 }
 function setManifestProbe(probe) {
   const previous = manifestProbe;
@@ -2055,10 +2318,10 @@ function imageDefinitelyAbsent(image) {
     return false;
   return /manifest unknown|no such manifest/i.test(res.output);
 }
-function resolvePublishedImage(image, runtime, version) {
+function resolvePublishedImage(image, runtime, version, variant) {
   if (!imageDefinitelyAbsent(image))
     return image;
-  const shape = RUNTIME_IMAGES[runtime];
+  const shape = shapeFor(runtime, variant);
   if (shape && shape.declaredIsFloor && atLeast(shape.defaultVersion, version)) {
     return unversionedImage(shape);
   }
@@ -2066,18 +2329,19 @@ function resolvePublishedImage(image, runtime, version) {
 }
 function resolveImageForSpec(spec, override) {
   const declared = spec.runtimeVersion;
-  const image = imageForRuntime(spec.runtime, override, declared);
+  const variant = imageVariantFor(spec);
+  const image = imageForRuntime(spec.runtime, override, declared, variant);
   const constructed = (() => {
     if (declared === null)
       return null;
     try {
-      return imageForRuntime(spec.runtime, void 0, declared);
+      return imageForRuntime(spec.runtime, void 0, declared, variant);
     } catch {
       return null;
     }
   })();
   if (constructed !== null && image === constructed && declared !== null) {
-    return resolvePublishedImage(image, spec.runtime, declared);
+    return resolvePublishedImage(image, spec.runtime, declared, variant);
   }
   return image;
 }
@@ -2104,12 +2368,22 @@ function assertVenueOwnerDeclared(lease) {
     return;
   throw new RunRefusalError("this venue did not say which account owns the tree it staged, so the guest would run under this machine's uid and could not write its own clone. We refuse rather than report that permission error as the repo's tests failing.");
 }
+function refuseUnbuildableSpec(spec) {
+  if (spec.runtime !== "jvm" || spec.installCommand !== null || spec.testCommand !== null)
+    return;
+  const why = spec.unresolved.find((r) => r.kind === "no-test-command")?.detail;
+  if (why === void 0) {
+    throw new EnvRunError("internal: a jvm spec with no test command carries no no-test-command reason");
+  }
+  throw new RunRefusalError(`refusing to run this repository: ${why}.`);
+}
 async function runEnvironmentSpec(req) {
   const startedAt = Date.now();
   const containment = req.lease.containment;
   if (containment.kind !== "container") {
     throw new EnvRunError(`phase 2 requires the container tier, got ${containment.kind}. Refusing: a container phase that silently ran under seatbelt would make every container claim vacuous.`);
   }
+  refuseUnbuildableSpec(req.spec);
   assertVenueOwnerDeclared(req.lease);
   const image = resolveImageForSpec(req.spec, req.image);
   const { jail, tmp } = req;
@@ -2152,9 +2426,10 @@ async function runEnvironmentSpec(req) {
         installOk: false
       };
     } else if (req.spec.testCommand === null) {
+      const why = req.spec.unresolved.find((r) => r.kind === "no-test-command")?.detail;
       result = {
         outcome: "no-tests-observed",
-        note: "the spec derived no test command, so nothing was executed: nothing failed and nothing ran. Certain, not inferred \u2014 no command was ever invoked.",
+        note: "the spec derived no test command, so nothing was executed: nothing failed and nothing ran. Certain, not inferred \u2014 no command was ever invoked." + (why === void 0 ? "" : ` Why: ${why}.`),
         installOk: true
       };
     } else {
@@ -2177,7 +2452,7 @@ async function runEnvironmentSpec(req) {
         labels,
         timeoutMs: req.testTimeoutMs ?? 9e5
       });
-      const verdict = classifyVerification(toExecution(test));
+      const verdict = classifyVerification({ ...toExecution(test), runtime: req.spec.runtime });
       result = { outcome: verdict.outcome, note: verdict.reason, installOk: true };
     }
   } finally {
@@ -2191,6 +2466,10 @@ async function runEnvironmentSpec(req) {
     volumes: [],
     networks: []
   };
+  const observation = afterReport ?? {
+    observed: false,
+    unobservedReason: "the run carried no label, so there was nothing to count by"
+  };
   return {
     outcome: result.outcome,
     tier: "container",
@@ -2199,7 +2478,7 @@ async function runEnvironmentSpec(req) {
     test,
     installOk: result.installOk,
     counts: test ? readCounts(test.stdout, test.stderr) : null,
-    leaks: judgeLeaks(peak, after),
+    leaks: judgeLeaks(peak, after, observation),
     note: result.note,
     wallMs: Date.now() - startedAt
   };
@@ -2249,7 +2528,7 @@ async function runStep(containment, r) {
     wallMs: Date.now() - startedAt
   };
 }
-var EnvRunError, RunRefusalError, MAX_CAUSE_FRAMES, CHAIN_UNREADABLE, CHAIN_TOO_DEEP, RUNTIME_IMAGES, unversionedImage, TAG_VERSION, dockerManifestProbe, manifestProbe, MISSING_IMAGE_SHAPE;
+var EnvRunError, RunRefusalError, MAX_CAUSE_FRAMES, CHAIN_UNREADABLE, CHAIN_TOO_DEEP, RUNTIME_IMAGES, JVM_GRADLE_IMAGE, unversionedImage, TAG_VERSION, dockerManifestProbe, manifestProbe, MISSING_IMAGE_SHAPE;
 var init_execute = __esm({
   "../../packages/envrun/dist/execute.js"() {
     "use strict";
@@ -2286,9 +2565,66 @@ var init_execute = __esm({
       },
       go: { repository: "golang", suffix: "-bookworm", defaultVersion: "1.23", declaredIsFloor: true },
       ruby: { repository: "ruby", suffix: "-bookworm", defaultVersion: "3.3", declaredIsFloor: false },
-      rust: { repository: "rust", suffix: "-bookworm", defaultVersion: "1", declaredIsFloor: true }
+      rust: { repository: "rust", suffix: "-bookworm", defaultVersion: "1", declaredIsFloor: true },
+      /**
+       * TERM-1139. `dotnet` was unmapped alongside `jvm`, and the recorded reason was that
+       * neither had "a single obvious base image (gradle vs maven, sdk vs runtime)". That
+       * reason holds for jvm and it does NOT hold here, which is why only this half moved.
+       *
+       * "sdk vs runtime" answers itself: the derived commands are `dotnet restore` and
+       * `dotnet test`, and neither exists on the runtime image. There is no second build
+       * tool competing for the slot the way maven and gradle compete for jvm's — and since
+       * no official image carries both of those, jvm genuinely cannot be served by one key.
+       *
+       * MEASURED, not chosen by tag: `mcr.microsoft.com/dotnet/sdk:8.0` carries `git` and
+       * `dotnet` (881MB). `git` is the property the whole `image-tooling-live` test exists
+       * for, and `eclipse-temurin:21-jdk` was rejected here for lacking it.
+       *
+       * The tag shape fits without touching the builder: the SDK publishes a tag per
+       * version, so `repository:VERSION` is a real image at every version envspec can
+       * derive, with no suffix. That is NOT true of the maven images, where the leading
+       * tag component is maven's version and Java's sits in the suffix.
+       *
+       * `declaredIsFloor` is true on the same reasoning as go and rust: an SDK builds
+       * older target frameworks, so booting 8.0 for a repo asking 6.0 is the supported
+       * case rather than a substitution. A repo asking for something NEWER than our
+       * default still refuses, which is where TERM-643 put that line.
+       */
+      dotnet: {
+        repository: "mcr.microsoft.com/dotnet/sdk",
+        suffix: "",
+        defaultVersion: "8.0",
+        declaredIsFloor: true
+      },
+      /**
+       * TERM-1122. Maven's image, and the one a Gradle WRAPPER repo gets too: the wrapper
+       * downloads its own Gradle, so it needs a JDK and nothing else. MEASURED
+       * 2026-09-18: `maven:3.9-eclipse-temurin-21` carries `git`, `mvn` and JDK 21 on
+       * Ubuntu 24.04, which is why this is not `eclipse-temurin` (no `git`, rejected
+       * under TERM-1139). The JDK sits AFTER maven's own version in the tag, hence
+       * `prefix`, and the major is all envspec derives (`javaMajor`).
+       *
+       * `declaredIsFloor`: a JDK builds for older `--release` targets, so a repo asking
+       * for 16, which has no image, runs on 21. A Gradle toolchain is stricter than a
+       * floor and asks for its exact JDK; Gradle's refusal on the wrong one reads as
+       * ours (`classify.ts`, `isOfflineBuildGap`), never as the repo's.
+       */
+      jvm: {
+        repository: "maven",
+        prefix: "3.9-eclipse-temurin-",
+        suffix: "",
+        defaultVersion: "21",
+        declaredIsFloor: true
+      }
+    };
+    JVM_GRADLE_IMAGE = {
+      repository: "gradle",
+      prefix: "jdk",
+      suffix: "",
+      defaultVersion: "21",
+      declaredIsFloor: true
     };
-    unversionedImage = (shape) => `${shape.repository}:${shape.defaultVersion}${shape.suffix}`;
+    unversionedImage = (shape) => `${shape.repository}:${shape.prefix ?? ""}${shape.defaultVersion}${shape.suffix}`;
     TAG_VERSION = /^\d+(?:\.\d+){0,2}$/;
     dockerManifestProbe = (image) => {
       const res = spawnSync4("docker", ["manifest", "inspect", image], {
@@ -2980,14 +3316,31 @@ function answerDidItPass(r) {
   const passed = r.status === "verified" && r.outcome !== null && isGreen(r.outcome);
   return { passed, summary: renderVerdictLine(r), lookAt: r.preview?.url ?? null };
 }
-var RUN_TEST_COMMAND_SOURCES, RUN_RESULT_SCHEMA, RUN_RESULT_FIELDS, RENDER_NONE, FIELD_VIEWS;
+function exitCodeFor(r) {
+  if (r.status === "refused")
+    return 2;
+  if (r.outcome === null)
+    return 2;
+  return OUTCOME_EXIT_CODES[r.outcome];
+}
+var RUN_TEST_COMMAND_SOURCES, RUN_IMAGE_SOURCES, RUN_RESULT_SCHEMA, RUN_RESULT_FIELDS, RENDER_NONE, FIELD_VIEWS, OUTCOME_EXIT_CODES;
 var init_result = __esm({
   "../../packages/envrun/dist/result.js"() {
     "use strict";
     init_dist2();
     init_classify();
     init_venueDescriptor();
-    RUN_TEST_COMMAND_SOURCES = [...TEST_COMMAND_SOURCES, "developer-declared"];
+    RUN_TEST_COMMAND_SOURCES = [
+      ...TEST_COMMAND_SOURCES,
+      "developer-declared",
+      "operator-declared"
+    ];
+    RUN_IMAGE_SOURCES = [
+      "detected",
+      "none",
+      "operator-declared",
+      "developer-declared"
+    ];
     RUN_RESULT_SCHEMA = "terminalhire.verification-run/1";
     RUN_RESULT_FIELDS = [
       "schema",
@@ -3012,7 +3365,9 @@ var init_result = __esm({
       "preview",
       "containerImage",
       "containerImageDigest",
+      "imageSource",
       "leaksClean",
+      "leakState",
       "venue"
     ];
     RENDER_NONE = null;
@@ -3044,12 +3399,42 @@ var init_result = __esm({
       preview: (r) => r.preview === null ? null : `preview      ${r.preview.url}`,
       containerImage: (r) => r.containerImage === null ? null : `image        ${r.containerImage}`,
       containerImageDigest: (r) => r.containerImageDigest === null ? null : `image digest ${r.containerImageDigest}`,
-      leaksClean: (r) => r.leaksClean === null ? null : r.leaksClean ? null : "WARNING      labelled Docker objects survived teardown",
+      // Shown only when a human chose the environment. `detected` is the ordinary case and
+      // saying so on every run would train the reader to skip the line that matters.
+      imageSource: (r) => r.imageSource === "detected" || r.imageSource === "none" ? null : `image source ${r.imageSource} (not signed)`,
+      // Printed through `leakState` below, which knows WHY a false is false. Rendering both would
+      // print the leak warning on a run where we merely could not look (TERM-1144).
+      leaksClean: RENDER_NONE,
+      // Silent when clean and when refused, as the boolean's line was. The two not-a-leak states
+      // get their own sentence, because "we could not check" read as "we found a leak" is the
+      // exact confusion this field exists to end.
+      leakState: (r) => {
+        switch (r.leakState) {
+          case null:
+          case "clean":
+            return null;
+          case "leak":
+            return "WARNING      labelled Docker objects survived teardown";
+          case "inconclusive":
+            return "leak check   inconclusive \u2014 no labelled container was seen while the run was live, so finding nothing afterwards proves nothing";
+          case "unobserved":
+            return "leak check   not taken \u2014 we could not check what was left after teardown";
+        }
+      },
       // Absent on most runs, so it prints only when there is something to say. Silence
       // here is the honest rendering of "no venue answered": a placeholder line would
       // invite a reader to treat an unanswered probe as a described venue.
       venue: (r) => r.venue === null ? null : renderVenueLine(r.venue)
     };
+    OUTCOME_EXIT_CODES = {
+      completed: 0,
+      "tests-failed": 1,
+      "no-tests-observed": 1,
+      "budget-exceeded": 1,
+      "counts-unparsed": 2,
+      "test-command-unavailable": 2,
+      "environment-exhausted": 2
+    };
   }
 });
 
@@ -3170,12 +3555,23 @@ function toAcceptancePredicate(pair, opts = {}) {
     if (why !== null)
       return refuse3("test-command-origin-unattested", `the ${side} run ${why}`);
   }
-  if (patched.testCommandSource === "developer-declared") {
-    return refuse3("test-command-origin-unattested", "the developer supplied the test command (unreachable \u2014 the source rules above cover it)");
+  if (patched.testCommandSource === "developer-declared" || patched.testCommandSource === "operator-declared") {
+    return refuse3("test-command-origin-unattested", `${patched.testCommandSource === "developer-declared" ? "the developer" : "an operator"} supplied the test command (unreachable \u2014 the source rules above cover it)`);
   }
   if (baseline.testCommandSource !== patched.testCommandSource) {
     return refuse3("test-command-origin-unattested", `the pair disagrees on where the command came from: baseline ${baseline.testCommandSource}, patched ${patched.testCommandSource}. One signed value cannot describe both.`);
   }
+  for (const [side, source, image] of [
+    ["patched", patched.imageSource, patched.containerImage],
+    ["baseline", baseline.imageSource, baseline.containerImage]
+  ]) {
+    const why = IMAGE_SOURCE_IS_SIGNABLE[source](image);
+    if (why !== null)
+      return refuse3("image-origin-unattested", `the ${side} run ${why}`);
+  }
+  if (baseline.imageSource !== patched.imageSource) {
+    return refuse3("image-origin-unattested", `the pair disagrees on where the image came from: baseline ${baseline.imageSource}, patched ${patched.imageSource}. The environment is part of what the statement says was held constant.`);
+  }
   if (baseline.containerImage !== patched.containerImage) {
     return refuse3("pair-disagrees-on-image", `baseline ran in ${String(baseline.containerImage)} and patched in ${String(patched.containerImage)}. The signed measurement names one image, so a pair from two environments would attribute to the patch whatever the image changed.`);
   }
@@ -3232,7 +3628,7 @@ function signRunStatement(predicate, privateKey, keyid) {
   const statement = createAcceptanceStatement(predicate);
   return { statement, envelope: signStatement(statement, privateKey, keyid) };
 }
-var OUTCOME_TO_BUDGET, BASELINE_IS_A_VERDICT, CONTRADICTS_COUNTS, SOURCE_IS_SIGNABLE, ATTEST_REFUSAL_REASONS, refuse3, LOCAL_MEASUREMENT_PREFIX, REFERENCE_DOMAIN_COMPONENT, REFERENCE_DOMAIN_NAME, REFERENCE_IPV6, REFERENCE_DOMAIN, REFERENCE_PATH_COMPONENT, REPO_DIGEST_RE;
+var OUTCOME_TO_BUDGET, BASELINE_IS_A_VERDICT, CONTRADICTS_COUNTS, SOURCE_IS_SIGNABLE, IMAGE_SOURCE_IS_SIGNABLE, ATTEST_REFUSAL_REASONS, refuse3, LOCAL_MEASUREMENT_PREFIX, REFERENCE_DOMAIN_COMPONENT, REFERENCE_DOMAIN_NAME, REFERENCE_IPV6, REFERENCE_DOMAIN, REFERENCE_PATH_COMPONENT, REPO_DIGEST_RE;
 var init_attestation2 = __esm({
   "../../packages/envrun/dist/attestation.js"() {
     "use strict";
@@ -3288,11 +3684,25 @@ var init_attestation2 = __esm({
       // The party under verification chose it, and no signed member can say so. Per ADR-005
       // Decision 2, emit nothing rather than pick the closest word.
       "developer-declared": () => "had its test command supplied by the developer whose work is under verification, and the signed vocabulary has no member for that. `founder-declared` would attribute the choice to the other party; `detected` would claim the repo chose it. Both are false.",
+      // US, out of band, per posting — the twin of `IMAGE_SOURCE_IS_SIGNABLE['operator-declared']`
+      // and refusing for the same reason. `founder-declared` is the nearest signed member and it
+      // is still false: the poster did not choose this, we did, and signing our own choice under
+      // the counterparty's name is the specific false attribution the `developer-declared` entry
+      // above exists to refuse. Decision 2 — emit nothing rather than pick the closest word.
+      "operator-declared": () => "had its test command chosen by an operator out of band, and the signed vocabulary has no member for that. Signing it would present a hand-picked command as one the repository chose for itself.",
       // `none` means nobody chose a command, so a command beside it is a contradiction. Shadowed
       // today — `thrun.ts` sets `none` only when the derived command is null, and `no-test-command`
       // fires first — but that coupling runs through `runEnvironmentSpec` and lives in no type.
       none: (command) => command === null ? null : `records its command source as \`none\` \u2014 nobody chose one \u2014 beside the command ${JSON.stringify(command)}`
     };
+    IMAGE_SOURCE_IS_SIGNABLE = {
+      detected: () => null,
+      "operator-declared": () => "had its container image chosen by an operator out of band, and the signed vocabulary has no member for that. Signing it would present a hand-picked environment as the one the runtime mapping selected.",
+      "developer-declared": () => "had its container image supplied by the developer whose work is under verification. A chosen interpreter turns a red suite green as surely as a chosen test command.",
+      // `none` means no image was booted, so an image name beside it is a contradiction — the
+      // `SOURCE_IS_SIGNABLE.none` argument, applied to the other field.
+      none: (image) => image === null ? null : `records its image source as \`none\` \u2014 nothing was booted \u2014 beside the image ${JSON.stringify(image)}`
+    };
     ATTEST_REFUSAL_REASONS = [
       "our-environment-failed",
       "run-was-refused",
@@ -3334,7 +3744,11 @@ var init_attestation2 = __esm({
       // The signed triple must be reproducible from what it names — see the guard.
       "patch-binding-incomplete",
       "outcome-contradicts-counts",
-      "test-command-origin-unattested"
+      "test-command-origin-unattested",
+      // The environment half of the pair above. `pair-disagrees-on-image` compares image NAMES;
+      // this one asks who CHOSE the name, which no comparison of the two halves can reveal when
+      // both were handed the same override.
+      "image-origin-unattested"
     ];
     refuse3 = (reason, detail) => ({
       ok: false,
@@ -3838,13 +4252,20 @@ function gcpBootArgv(p) {
     // steal". Attaching an account removes that, so the safety now rests on two things,
     // and this change MUST land together with proof #2 — never ahead of it:
     //
-    //   1. `--no-scopes` + ZERO project roles bound the BLAST RADIUS of a lifted token.
-    //      No scopes → the OAuth access-token endpoint serves nothing (measured,
-    //      TERM-706); zero roles → the token authorizes no GCP API. But it is NOT
-    //      valueless: it is the attestation evidence itself, so a lifted token still
-    //      authorizes a false claim about WHERE a run happened (the steal-a-true-token
-    //      attack in the item-2 spike). `--no-scopes` stays because it removes lateral
-    //      GCP access; it does not make losing the identity token cheap.
+    //   1. `--no-scopes` and a NARROW grant set bound the BLAST RADIUS of a lifted
+    //      token. No scopes → the OAuth access-token endpoint serves nothing
+    //      (measured, TERM-706). This said "ZERO project roles" until 2026-09-18, and
+    //      that was never true of the account we ship: measured live, `venue-identity@`
+    //      holds `roles/confidentialcomputing.workloadUser` on the project and
+    //      `roles/artifactregistry.reader` on the `venue-images` repository alone —
+    //      the same two grants the Confidential Space note below already named, so this
+    //      file contradicted itself. Neither reaches a second repository, a bucket or
+    //      another VM, which is the property "zero roles" was reaching for. But the
+    //      token is NOT valueless: it is the attestation evidence itself, so a lifted
+    //      token still authorizes a false claim about WHERE a run happened (the
+    //      steal-a-true-token attack in the item-2 spike). `--no-scopes` stays because
+    //      it removes lateral GCP access; it does not make losing the identity token
+    //      cheap.
     //   2. The untrusted code cannot reach the metadata server to lift the token at all.
     //      The test step runs `--network=none`; the install step runs on an `--internal`
     //      network whose only egress is a CONNECT-only, registry-allowlisted proxy that
@@ -5324,11 +5745,7 @@ function makeLease(p) {
       }
       try {
         check("counting what the run left behind");
-        return Promise.resolve({
-          observed: true,
-          census: census(p.docker, label),
-          unobservedReason: null
-        });
+        return Promise.resolve(censusReport(p.docker, label));
       } catch (err) {
         return Promise.resolve({
           observed: false,
@@ -5596,7 +6013,7 @@ function localDockerPlacement() {
     kind: "local-docker",
     refusal: null,
     venue: () => localVenue(),
-    imageFor: (runtime, override, version) => imageForRuntime(runtime, override, version)
+    imageFor: (runtime, override, version, variant) => imageForRuntime(runtime, override, version, variant)
   };
 }
 function hostedPoolPlacement() {
@@ -5604,7 +6021,7 @@ function hostedPoolPlacement() {
     kind: "hosted-pool",
     refusal: null,
     venue: () => hostedVenue(),
-    imageFor: (runtime, override, version) => imageForRuntime(runtime, override, version)
+    imageFor: (runtime, override, version, variant) => imageForRuntime(runtime, override, version, variant)
   };
 }
 function placementFor(kind) {
@@ -6169,6 +6586,9 @@ function detectRuntime(repo) {
   if (repo.listNames("").some((name) => /\.(?:csproj|fsproj|sln)$/.test(name))) {
     candidates.push("dotnet");
   }
+  if (candidates.length === 0 && repo.listFiles("").some((f) => f.endsWith(".java"))) {
+    candidates.push("jvm");
+  }
   return { runtime: candidates[0] ?? "unknown", candidates };
 }
 function readJsonObject(repo, path) {
@@ -6316,6 +6736,11 @@ function basePythonInstallCommand(repo) {
   }
   return null;
 }
+function rehearse(command) {
+  const copy = '"$R/.terminalhire-rehearsal"';
+  const home = '"$R/.terminalhire-rehearsal-home"';
+  return `{ R="$HOME"; rm -rf ${copy} ${home}; mkdir -p ${home} && cp -R . ${copy} && (cd ${copy} && HOME=${home} GRADLE_USER_HOME="$R/.gradle" JAVA_TOOL_OPTIONS="$JAVA_TOOL_OPTIONS -Duser.home=$R/.terminalhire-rehearsal-home" ${command}); rm -rf ${copy} ${home}; true; }`;
+}
 function otherRuntimeCommands(repo, runtime) {
   switch (runtime) {
     case "go":
@@ -6343,10 +6768,21 @@ function otherRuntimeCommands(repo, runtime) {
     case "dotnet":
       return { install: "dotnet restore", test: "dotnet test" };
     case "jvm": {
-      if (repo.exists("pom.xml"))
-        return { install: "mvn -B dependency:go-offline", test: "mvn -B test" };
+      if (!JVM_BUILD_FILES.some((file) => repo.exists(file)))
+        return { install: null, test: null };
+      if (repo.exists("pom.xml")) {
+        return {
+          install: `mvn -B dependency:go-offline && ${rehearse('mvn -B test -Dmaven.test.failure.ignore=true -Dmaven.repo.local="$R/.m2/repository"')}`,
+          test: "mvn -B -o test"
+        };
+      }
       const wrapper = repo.exists("gradlew") ? "./gradlew" : "gradle";
-      return { install: `${wrapper} dependencies`, test: `${wrapper} test` };
+      return {
+        install: `${wrapper} dependencies && ${rehearse(`${wrapper} test --continue`)}`,
+        // `--no-build-cache`: the rehearsal above can fill Gradle's build cache, and a
+        // test task restored FROM-CACHE runs nothing and prints no count.
+        test: `${wrapper} test --offline --no-build-cache`
+      };
     }
     default:
       return { install: null, test: null };
@@ -6378,6 +6814,15 @@ function searchRuntimeVersion(repo, runtime) {
     push(".ruby-version", repo.readText(".ruby-version"));
   } else if (runtime === "dotnet") {
     push("global.json sdk.version", readStringField(readObjectField(readJsonObject(repo, "global.json"), "sdk"), "version"));
+  } else if (runtime === "jvm") {
+    const pom = repo.readText("pom.xml");
+    const gradle = repo.readText("build.gradle") ?? repo.readText("build.gradle.kts");
+    push("build.gradle toolchain languageVersion", javaMajor(matchFirst(gradle, /JavaLanguageVersion\.of\(\s*["']?(\d+)["']?\s*\)/) ?? matchFirst(gradle, /jvmToolchain\(\s*(\d+)\s*\)/)));
+    push(".java-version", javaMajor(repo.readText(".java-version")));
+    push("pom.xml maven.compiler.release", javaMajor(matchFirst(pom, /<maven\.compiler\.release>\s*([^<\s]+)\s*</)));
+    push("pom.xml java.version", javaMajor(matchFirst(pom, /<java\.version>\s*([^<\s]+)\s*</)));
+    push("pom.xml maven.compiler.source", javaMajor(matchFirst(pom, /<maven\.compiler\.source>\s*([^<\s]+)\s*</)));
+    push("build.gradle sourceCompatibility", javaMajor(matchFirst(gradle, /sourceCompatibility\s*=\s*JavaVersion\.VERSION_([\d_]+)/)?.replace("_", ".") ?? matchFirst(gradle, /sourceCompatibility\s*=\s*["']?([\d.]+)["']?/)));
   }
   let rangeFound = null;
   for (const source of sources) {
@@ -6391,13 +6836,21 @@ function searchRuntimeVersion(repo, runtime) {
   }
   return { version: null, searched: sources.map((s) => s.label), rangeFound };
 }
+function javaMajor(text) {
+  if (text === null)
+    return null;
+  const match = /^(?:1\.(\d+)|(\d+))(?:[._][\d_.]*)?$/.exec(text.trim());
+  if (match === null)
+    return null;
+  return match[1] ?? match[2] ?? null;
+}
 function matchFirst(text, pattern) {
   if (text === null)
     return null;
   const match = pattern.exec(text);
   return match === null ? null : match[1];
 }
-var RUNTIME_MANIFESTS, MANIFEST_FILENAMES, NPM_PLACEHOLDER_TEST, REQUIREMENT_SPECIFIER, EXACT_VERSION;
+var RUNTIME_MANIFESTS, MANIFEST_FILENAMES, JVM_BUILD_FILES, NPM_PLACEHOLDER_TEST, REQUIREMENT_SPECIFIER, EXACT_VERSION;
 var init_manifest2 = __esm({
   "../../packages/envspec/dist/manifest.js"() {
     "use strict";
@@ -6411,6 +6864,7 @@ var init_manifest2 = __esm({
       { runtime: "dotnet", files: [] }
     ];
     MANIFEST_FILENAMES = RUNTIME_MANIFESTS.flatMap((m) => m.files).concat(["*.csproj", "*.fsproj", "*.sln"]).sort();
+    JVM_BUILD_FILES = ["build.gradle", "build.gradle.kts", "pom.xml"];
     NPM_PLACEHOLDER_TEST = /^echo\s+["']?Error:\s*no test specified["']?\s*&&\s*exit\s+1$/;
     REQUIREMENT_SPECIFIER = /^[A-Za-z0-9._-]+(\[[A-Za-z0-9._,-]+\])?([<>=!~]=?[A-Za-z0-9._*+-]+(,[<>=!~]=?[A-Za-z0-9._*+-]+)*)?$/;
     EXACT_VERSION = /^v?(\d+(?:\.\d+){0,2})$/;
@@ -6807,7 +7261,7 @@ function deriveFromReader(repo) {
       searched: MANIFEST_FILENAMES,
       detail: `no ecosystem manifest was found at the repo root (looked for ${MANIFEST_FILENAMES.join(", ")}), so the language runtime could not be identified`
     });
-  } else {
+  } else if (runtime !== "jvm" || JVM_BUILD_FILES.some((file) => repo.exists(file))) {
     derivedFrom.add("manifest");
   }
   if (detection.candidates.length > 1) {
@@ -6971,12 +7425,13 @@ function deriveRuntimeVersion(repo, runtime, job) {
   const setup = SETUP_ACTIONS[runtime];
   const searched = [];
   let rangeFound = null;
+  const pin = (raw) => runtime === "jvm" ? javaMajor(raw) : exactVersion(raw);
   if (job !== null && setup !== void 0) {
     const direct = findActionInput(job, setup.action, setup.input);
     if (direct !== null) {
       searched.push(`${job.file} ${setup.action} ${setup.input}`);
       const reduced = reduceExpression(direct.command, job.singletons);
-      const exact = exactVersion(reduced);
+      const exact = pin(reduced);
       if (exact !== null)
         return { value: exact, searched, rangeFound: null };
       if (reduced !== null)
@@ -6985,7 +7440,7 @@ function deriveRuntimeVersion(repo, runtime, job) {
     const viaFile = findActionInput(job, setup.action, setup.fileInput);
     if (viaFile !== null) {
       searched.push(`${job.file} ${setup.action} ${setup.fileInput} -> ${viaFile.command}`);
-      const exact = exactVersion(repo.readText(viaFile.command));
+      const exact = pin(repo.readText(viaFile.command));
       if (exact !== null)
         return { value: exact, searched, rangeFound: null };
     }
@@ -7010,6 +7465,8 @@ function testSearchPaths(runtime, workflowFiles) {
     paths.push("**/*_test.go");
   if (runtime === "ruby")
     paths.push("Gemfile", "Rakefile");
+  if (runtime === "jvm")
+    paths.push(...JVM_BUILD_FILES);
   if (runtime === "unknown")
     paths.push(...MANIFEST_FILENAMES);
   return [...new Set(paths)].sort();
@@ -7027,6 +7484,9 @@ function describeTestSearch(repo, runtime, workflowFiles) {
   if (runtime === "python") {
     return `${ciPart}, and nothing in the repo names a test runner \u2014 no \`[tool.pytest.ini_options]\`, no \`pytest.ini\`, and no pytest dependency in \`pyproject.toml\` or a requirements file`;
   }
+  if (runtime === "jvm" && !JVM_BUILD_FILES.some((file) => repo.exists(file))) {
+    return `${ciPart}, and the repo has Java sources but no build file (${JVM_BUILD_FILES.join(", ")}), so there is no build to run tests with. Compiling the sources with \`javac\` alone would run no tests`;
+  }
   return `${ciPart}, and no ${runtime} test convention applies to this tree`;
 }
 function installSearchPaths(runtime, workflowFiles) {
@@ -7035,6 +7495,8 @@ function installSearchPaths(runtime, workflowFiles) {
     paths.push("package-lock.json", "pnpm-lock.yaml", "yarn.lock");
   if (runtime === "python")
     paths.push("poetry.lock", "pyproject.toml", "requirements.txt", "uv.lock");
+  if (runtime === "jvm")
+    paths.push(...JVM_BUILD_FILES);
   if (runtime === "unknown")
     paths.push(...MANIFEST_FILENAMES);
   return [...new Set(paths)].sort();
@@ -7113,12 +7575,41 @@ var init_dist3 = __esm({
   }
 });
 
+// ../../packages/envrun/dist/gradleTestSummary.js
+import { mkdirSync as mkdirSync6, writeFileSync as writeFileSync7 } from "fs";
+import { join as join13 } from "path";
+function stageGradleTestSummary(jailHome) {
+  const dir = join13(jailHome, ".gradle", "init.d");
+  mkdirSync6(dir, { recursive: true });
+  writeFileSync7(join13(dir, "terminalhire-test-summary.gradle"), GRADLE_TEST_SUMMARY_INIT);
+}
+var GRADLE_TEST_MARKER, GRADLE_TEST_SUMMARY_INIT;
+var init_gradleTestSummary = __esm({
+  "../../packages/envrun/dist/gradleTestSummary.js"() {
+    "use strict";
+    GRADLE_TEST_MARKER = "terminalhire-gradle-tests:";
+    GRADLE_TEST_SUMMARY_INIT = `// Written by terminalhire (TERM-1122): prints each Test task's counts, because
+// Gradle prints none when every test passes.
+allprojects {
+  tasks.withType(Test).configureEach { task ->
+    def label = task.path
+    task.afterSuite { desc, result ->
+      if (desc.parent == null) {
+        println "${GRADLE_TEST_MARKER} task=\${label} total=\${result.testCount} passed=\${result.successfulTestCount} failed=\${result.failedTestCount} skipped=\${result.skippedTestCount}"
+      }
+    }
+  }
+}
+`;
+  }
+});
+
 // ../../packages/envrun/dist/thrun.js
 import { execFileSync as execFileSync2, spawnSync as spawnSync6 } from "child_process";
-import { existsSync as existsSync7, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync4, rmSync as rmSync5 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync7, mkdtempSync as mkdtempSync4, rmSync as rmSync5 } from "fs";
 import { randomUUID } from "crypto";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 function git(repoDir, args, allowNonZero = false) {
   const res = spawnSync6("git", [...args], {
     cwd: repoDir,
@@ -7133,7 +7624,7 @@ function git(repoDir, args, allowNonZero = false) {
   return res.stdout ?? "";
 }
 function collectWorkingDiff(repoDir, opts = {}) {
-  if (!existsSync7(join13(repoDir, ".git"))) {
+  if (!existsSync7(join14(repoDir, ".git"))) {
     throw new ThRunError(`${repoDir} is not a git checkout (no .git). \`th run\` ships the working diff, so it needs a repository to read one from.`);
   }
   const headSha = git(repoDir, ["rev-parse", "HEAD"]).trim();
@@ -7281,7 +7772,7 @@ function credentialFreeHome() {
     return credentialFreeHomeDir;
   let made;
   try {
-    made = mkdtempSync4(join13(tmpdir4(), "th-run-nohome-"));
+    made = mkdtempSync4(join14(tmpdir4(), "th-run-nohome-"));
   } catch (err) {
     throw new RunRefusalError("could not create the empty directory this clone uses as its home, so the clone would read the credentials on this machine instead. That is our environment failing, not your tests: check that the temp directory is writable.", { cause: err });
   }
@@ -7356,7 +7847,7 @@ function cloneTargetAtUnguarded(opts) {
   if (persisted !== null) {
     throw new RunRefusalError(`refusing to clone from a URL carrying ${persisted}: \`git remote add\` writes the source verbatim into .git/config, which is mounted where the repo\u2019s own test command runs. Fetch with the credential out of band so it is never written to disk \u2014 this runner takes one as an HTTP header, which is never persisted.`);
   }
-  mkdirSync6(opts.dest, { recursive: true });
+  mkdirSync7(opts.dest, { recursive: true });
   const runOut = (args) => execFileSync2("git", [...gitConfigArgs(), ...args], {
     cwd: opts.dest,
     encoding: "utf8",
@@ -7395,7 +7886,7 @@ function cloneTargetAtUnguarded(opts) {
 }
 function scrubCloneSource(dest, run2) {
   run2(["remote", "remove", "origin"]);
-  rmSync5(join13(dest, ".git", "FETCH_HEAD"), { force: true });
+  rmSync5(join14(dest, ".git", "FETCH_HEAD"), { force: true });
 }
 function publishableTarget(url) {
   if (separatorInTarget(url) !== null)
@@ -7534,12 +8025,18 @@ function refusedRun(fields) {
     treeDigest: null,
     baselinePatchSha256: null,
     testCommandSource: "none",
+    // Nothing was booted, so nobody chose an image. Same reasoning as `containerImage: null`
+    // below: it must not read as an image we picked and cannot name.
+    imageSource: "none",
     boundaryRefusals: fields.boundaryRefusals,
     touchedPaths: fields.touchedPaths,
     preview: null,
     containerImage: null,
     containerImageDigest: null,
     leaksClean: null,
+    // Null for the same reason, and never `unobserved`: that word says we tried to take a
+    // census and could not, and here there was nothing to take one of (TERM-1144).
+    leakState: null,
     // A refused run never held a lease, so there is no venue to describe. Same
     // reasoning as `leaksClean` above: null because nothing happened, and it must
     // not read as a venue we looked at and could not name.
@@ -7767,10 +8264,10 @@ async function runVerification(req, ctx) {
       venueIdentity: null
     };
   }
-  const stage = join13(req.scratchRoot, runId);
-  const cloneDir = join13(stage, "clone");
-  const scratch = join13(stage, "scratch");
-  mkdirSync6(scratch, { recursive: true });
+  const stage = join14(req.scratchRoot, runId);
+  const cloneDir = join14(stage, "clone");
+  const scratch = join14(stage, "scratch");
+  mkdirSync7(scratch, { recursive: true });
   assertSafeTargetSha(req.targetSha);
   progress("clone", `${publishableTarget(req.targetRepo)} @ ${req.targetSha.slice(0, 12)}`);
   cloneTargetAt({
@@ -7797,7 +8294,8 @@ async function runVerification(req, ctx) {
   const derived = deriveEnvironmentSpec(cloneDir);
   const spec = req.testCommandOverride === void 0 ? derived : { ...derived, testCommand: req.testCommandOverride };
   progress("derive", `runtime=${spec.runtime} install=${String(spec.installCommand)} test=${String(spec.testCommand)}`);
-  const image = placement.imageFor(spec.runtime, req.image, spec.runtimeVersion);
+  refuseUnbuildableSpec(spec);
+  const image = placement.imageFor(spec.runtime, req.image, spec.runtimeVersion, imageVariantFor(spec));
   const resolved = await resolveLease(placement, runId);
   if (!resolved.ok) {
     return {
@@ -7832,10 +8330,12 @@ async function runVerification(req, ctx) {
   const lease = resolved.lease;
   try {
     buildJail(scratch);
+    if (spec.runtime === "jvm")
+      stageGradleTestSummary(localJailPaths(scratch).jail);
     const venuePaths = await lease.stage({
       cloneDir,
       scratchRoot: scratch,
-      previewDir: join13(stage, "preview"),
+      previewDir: join14(stage, "preview"),
       // On a dispatched run the commit is the statement of what was tested, so
       // it rides with the tree and the venue seam refuses a tree that is not
       // that commit (design §6 item 4, TERM-892 — the guard lives in
@@ -7882,7 +8382,7 @@ async function runVerification(req, ctx) {
       // that `founder-declared` (as this did for one review round) signs the counterparty's
       // name onto the developer's choice, which is worse than laundering it as `detected`:
       // it is a specific false attribution inside a field a reviewer trusts.
-      testCommandSource: req.testCommandOverride !== void 0 ? req.testCommandOverrideOrigin === "founder" ? "founder-declared" : "developer-declared" : derived.testCommand === null ? "none" : "detected",
+      testCommandSource: req.testCommandOverride !== void 0 ? req.testCommandOverrideOrigin === "founder" ? "founder-declared" : req.testCommandOverrideOrigin === "operator" ? "operator-declared" : "developer-declared" : derived.testCommand === null ? "none" : "detected",
       boundaryRefusals: [],
       touchedPaths: pre.touchedPaths,
       preview: null,
@@ -7892,7 +8392,14 @@ async function runVerification(req, ctx) {
       // that measures one; a run without it is recordable but not attestable —
       // `toAcceptancePredicate` refuses `missing-image-digest` (TERM-893).
       containerImageDigest: null,
+      // The image half of the provenance pair above. `detected` means the runtime mapping
+      // chose the environment; an override names the human. Defaulting an unstated origin to
+      // `developer-declared` is deliberate and matches `testCommandSource`: `th run --image`
+      // runs on the developer's machine, judging the developer's work, so attributing it to
+      // the operator would sign our name onto their choice.
+      imageSource: req.image === void 0 ? "detected" : req.imageOrigin === "operator" ? "operator-declared" : "developer-declared",
       leaksClean: verdict.leaks.clean,
+      leakState: verdict.leaks.state,
       // Built from the LEASE, over the client that ran the steps — never from
       // `req.placement`, which is a request. `venueDescriptor.ts` carries the
       // reasoning and the #735 failure that makes the distinction load-bearing.
@@ -7950,6 +8457,7 @@ var init_thrun = __esm({
     init_execute();
     init_placement();
     init_venue();
+    init_gradleTestSummary();
     init_venueDescriptor();
     init_result();
     ThRunError = class extends Error {
@@ -8193,7 +8701,7 @@ var init_dbplan = __esm({
 // ../../packages/envrun/dist/dbstack.js
 import { spawnSync as spawnSync7 } from "child_process";
 import { randomBytes as randomBytes6 } from "crypto";
-import { mkdirSync as mkdirSync7 } from "fs";
+import { mkdirSync as mkdirSync8 } from "fs";
 function installCommandFor(runner) {
   switch (runner) {
     case "sql":
@@ -8424,7 +8932,7 @@ function startDatabase(req) {
     if (!ready.ok) {
       throw new DbStackError(`INFRASTRUCTURE/INCONCLUSIVE: Postgres never accepted queries at 127.0.0.1:${String(creds.port)} within the readiness window: ${ready.detail}`);
     }
-    const query = (sql) => {
+    const query2 = (sql) => {
       const res = docker2([
         "exec",
         `--env=PGPASSWORD=${creds.password}`,
@@ -8472,7 +8980,7 @@ function startDatabase(req) {
       credentials: creds,
       image,
       readyMs: ready.ms,
-      query,
+      query: query2,
       runOnNetwork,
       teardown
     };
@@ -8535,8 +9043,8 @@ async function installLocalMigrationTooling(opts) {
     };
   }
   const { jail, tmp } = buildJail(opts.scratchRoot);
-  mkdirSync7(jail, { recursive: true });
-  mkdirSync7(tmp, { recursive: true });
+  mkdirSync8(jail, { recursive: true });
+  mkdirSync8(tmp, { recursive: true });
   const spec = {
     profile: "install",
     clone: opts.repoDir,
@@ -8831,6 +9339,7 @@ __export(dist_exports, {
   GOOGLE_JWKS_URL: () => GOOGLE_JWKS_URL,
   HostedVenueError: () => HostedVenueError,
   JWKS_FETCH_TIMEOUT_MS: () => JWKS_FETCH_TIMEOUT_MS,
+  LEAK_STATES: () => LEAK_STATES,
   LOCAL_MEASUREMENT_PREFIX: () => LOCAL_MEASUREMENT_PREFIX,
   LabelWatch: () => LabelWatch,
   MIN_GIT_VERSION_FOR_END_OF_OPTIONS: () => MIN_GIT_VERSION_FOR_END_OF_OPTIONS,
@@ -8847,6 +9356,7 @@ __export(dist_exports, {
   REDACTED_TARGET_SHA: () => REDACTED_TARGET_SHA,
   RELEASED_LEASE_CENSUS_REASON: () => RELEASED_LEASE_CENSUS_REASON,
   REPO_DIGEST_RE: () => REPO_DIGEST_RE,
+  RUN_IMAGE_SOURCES: () => RUN_IMAGE_SOURCES,
   RUN_LABEL_KEY: () => RUN_LABEL_KEY,
   RUN_RESULT_FIELDS: () => RUN_RESULT_FIELDS,
   RUN_RESULT_SCHEMA: () => RUN_RESULT_SCHEMA,
@@ -8863,6 +9373,7 @@ __export(dist_exports, {
   VENUE_GCLOUD_CONFIG: () => VENUE_GCLOUD_CONFIG,
   VENUE_SSH_USER: () => VENUE_SSH_USER,
   VENV_DIR: () => VENV_DIR,
+  VERIFICATION_OUTCOMES: () => VERIFICATION_OUTCOMES,
   VenueRollbackError: () => VenueRollbackError,
   acquireTransactionally: () => acquireTransactionally,
   alembicChainPosition: () => alembicChainPosition,
@@ -8876,6 +9387,7 @@ __export(dist_exports, {
   assertVenueOwnerDeclared: () => assertVenueOwnerDeclared,
   bookkeepingFor: () => bookkeepingFor,
   census: () => census,
+  censusReport: () => censusReport,
   censusTotal: () => censusTotal,
   classifyBootFailure: () => classifyBootFailure,
   classifyProbeFailure: () => classifyProbeFailure,
@@ -8895,6 +9407,7 @@ __export(dist_exports, {
   detectRunner: () => detectRunner,
   endOfOptionsUnsupported: () => endOfOptionsUnsupported,
   ensureVenueServiceCredentials: () => ensureVenueServiceCredentials,
+  exitCodeFor: () => exitCodeFor,
   failureSourceOf: () => failureSourceOf,
   findRunRefusal: () => findRunRefusal,
   gcpBootArgv: () => gcpBootArgv,
@@ -8909,6 +9422,7 @@ __export(dist_exports, {
   identityProbeCommand: () => identityProbeCommand,
   imageForRuntime: () => imageForRuntime,
   imageRepo: () => imageRepo,
+  imageVariantFor: () => imageVariantFor,
   installCommandFor: () => installCommandFor,
   installLocalMigrationTooling: () => installLocalMigrationTooling,
   isBookkeepingTable: () => isBookkeepingTable,
@@ -8938,6 +9452,7 @@ __export(dist_exports, {
   readSchema: () => readSchema,
   recordedApplied: () => recordedApplied,
   refuseSshTransport: () => refuseSshTransport,
+  refuseUnbuildableSpec: () => refuseUnbuildableSpec,
   renderRunReport: () => renderRunReport,
   renderVenueLine: () => renderVenueLine,
   renderVerdictLine: () => renderVerdictLine,
@@ -8985,7 +9500,7 @@ var init_dist4 = __esm({
 // bin/jpi-run.js
 import { existsSync as existsSync8, readFileSync as readFileSync6, realpathSync as realpathSync2 } from "fs";
 import { execFileSync as execFileSync3 } from "child_process";
-import { join as join14, resolve } from "path";
+import { join as join15, resolve } from "path";
 import { tmpdir as tmpdir5 } from "os";
 import { mkdtempSync as mkdtempSync5, rmSync as rmSync6 } from "fs";
 
@@ -9406,6 +9921,9 @@ Options:
   --keep <seconds>      Hold the preview open this long, at most ${String(KEEP_MAX_SECONDS)}
                         (default: until Ctrl-C).
   --test-command <cmd>  Disclosed override of the derived test command.
+  --image <ref>         Disclosed override of the container image. Use when no image is
+                        mapped for the repo's runtime. Recorded as developer-declared
+                        provenance, which the attestation refuses to sign.
   --help
 
 Defaults are read from .th-run.json in the local checkout when present, so a
@@ -9440,7 +9958,7 @@ function parseArgs(argv) {
 function runScratchRoot() {
   let root;
   try {
-    root = mkdtempSync5(join14(tmpdir5(), "th-run-"));
+    root = mkdtempSync5(join15(tmpdir5(), "th-run-"));
   } catch (err) {
     process.stderr.write(
       `terminalhire: could not create the temporary directory this run works in, so nothing was cloned and nothing was executed. That is our environment failing, not your tests: check that the temp directory is writable. (${String(err?.message ?? err)})
@@ -9477,7 +9995,7 @@ async function loadEngine() {
   }
 }
 function readConfig(localDir) {
-  const file = join14(localDir, ".th-run.json");
+  const file = join15(localDir, ".th-run.json");
   if (!existsSync8(file)) return {};
   try {
     const parsed = JSON.parse(readFileSync6(file, "utf8"));
@@ -9584,6 +10102,11 @@ async function once(engine, opts) {
     preview: opts.preview,
     ...opts.placement ? { placement: opts.placement } : {},
     ...opts.testCommand ? { testCommandOverride: opts.testCommand } : {},
+    // No `imageOrigin` beside it, deliberately. This flag runs on the DEVELOPER's machine,
+    // judging the developer's work, so it takes `thrun`'s default of `developer` — the same
+    // reasoning that makes `--test-command` developer-declared. An operator override is a
+    // server-side caller, not this flag.
+    ...opts.image ? { image: opts.image } : {},
     onProgress: (stage, detail) => {
       if (!opts.json) process.stderr.write(`  ${stage.padEnd(8)} ${detail}
 `);
@@ -9629,8 +10152,7 @@ Expiry and revocation are not built yet (TERM-350 phase 5); Ctrl-C is the only s
     process.stderr.write(`  total    ${String(Date.now() - started)}ms
 `);
   }
-  if (result.status === "refused") return 2;
-  return result.outcome === "completed" ? 0 : 1;
+  return engine.exitCodeFor(result);
 }
 async function run() {
   const argv = process.argv.slice(2);
@@ -9697,6 +10219,7 @@ async function run() {
     watch: parsed.bools.has("watch"),
     json: parsed.bools.has("json"),
     testCommand: pick("test-command") ?? null,
+    image: pick("image") ?? null,
     keepSeconds,
     scratch: runScratchRoot()
   };