terminalhire 0.42.22 → 0.42.23

package/dist/bin/jpi-claim.js

@@ -1893,11 +1893,11 @@ function parseGitHubRef(url) {
     kind: m[3] === "pull" ? "pull" : "issue"
   };
 }
-async function ghGraphQL(query, variables, token, signal, governor) {
+async function ghGraphQL(query2, variables, token, signal, governor) {
   const init = {
     method: "POST",
     headers: { ...ghHeaders(token), "Content-Type": "application/json" },
-    body: JSON.stringify({ query, variables }),
+    body: JSON.stringify({ query: query2, variables }),
     signal
   };
   if (governor) {
@@ -12408,8 +12408,8 @@ var init_stringify = __esm({
 });
 
 // ../../node_modules/@anthropic-ai/sdk/internal/utils/query.mjs
-function stringifyQuery(query) {
-  return stringify(query, { arrayFormat: "brackets" });
+function stringifyQuery(query2) {
+  return stringify(query2, { arrayFormat: "brackets" });
 }
 var init_query = __esm({
   "../../node_modules/@anthropic-ai/sdk/internal/utils/query.mjs"() {
@@ -14493,9 +14493,9 @@ var init_deployment_runs = __esm({
        * ```
        */
       list(params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList("/v1/deployment_runs?beta=true", PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "managed-agents-2026-04-01"].toString() },
@@ -14607,9 +14607,9 @@ var init_deployments = __esm({
        * ```
        */
       list(params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList("/v1/deployments?beta=true", PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "managed-agents-2026-04-01"].toString() },
@@ -14769,9 +14769,9 @@ var init_dreams = __esm({
        * ```
        */
       list(params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList("/v1/dreams?beta=true", PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "dreaming-2026-04-21"].toString() },
@@ -14902,9 +14902,9 @@ var init_files = __esm({
        * ```
        */
       list(params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList("/v1/files?beta=true", Page, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "files-api-2025-04-14"].toString() },
@@ -15052,9 +15052,9 @@ var init_models = __esm({
        * ```
        */
       list(params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList("/v1/models?beta=true", Page, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { ...betas?.toString() != null ? { "anthropic-beta": betas?.toString() } : void 0 },
@@ -15151,9 +15151,9 @@ var init_user_profiles = __esm({
        * ```
        */
       list(params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList("/v1/user_profiles?beta=true", PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "user-profiles-2026-03-24"].toString() },
@@ -16012,9 +16012,9 @@ var init_versions = __esm({
        * ```
        */
       list(agentID, params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList(path`/v1/agents/${agentID}/versions?beta=true`, PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "managed-agents-2026-04-01"].toString() },
@@ -16077,9 +16077,9 @@ var init_agents = __esm({
        * ```
        */
       retrieve(agentID, params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.get(path`/v1/agents/${agentID}?beta=true`, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "managed-agents-2026-04-01"].toString() },
@@ -16122,9 +16122,9 @@ var init_agents = __esm({
        * ```
        */
       list(params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList("/v1/agents?beta=true", PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "managed-agents-2026-04-01"].toString() },
@@ -18214,9 +18214,9 @@ var init_work = __esm({
        * ```
        */
       list(environmentID, params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList(path`/v1/environments/${environmentID}/work?beta=true`, PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "managed-agents-2026-04-01"].toString() },
@@ -18295,9 +18295,9 @@ var init_work = __esm({
        * ```
        */
       poll(environmentID, params = {}, options) {
-        const { betas, "Anthropic-Worker-ID": anthropicWorkerID, ...query } = params ?? {};
+        const { betas, "Anthropic-Worker-ID": anthropicWorkerID, ...query2 } = params ?? {};
         return this._client.get(path`/v1/environments/${environmentID}/work/poll?beta=true`, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             {
@@ -18494,9 +18494,9 @@ var init_environments = __esm({
        * ```
        */
       list(params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList("/v1/environments?beta=true", PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "managed-agents-2026-04-01"].toString() },
@@ -18599,9 +18599,9 @@ var init_memories = __esm({
        * ```
        */
       retrieve(memoryID, params, options) {
-        const { memory_store_id, betas, ...query } = params;
+        const { memory_store_id, betas, ...query2 } = params;
         return this._client.get(path`/v1/memory_stores/${memory_store_id}/memories/${memoryID}?beta=true`, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "agent-memory-2026-07-22"].toString() },
@@ -18647,9 +18647,9 @@ var init_memories = __esm({
        * ```
        */
       list(memoryStoreID, params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList(path`/v1/memory_stores/${memoryStoreID}/memories?beta=true`, PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "agent-memory-2026-07-22"].toString() },
@@ -18707,9 +18707,9 @@ var init_memory_versions = __esm({
        * ```
        */
       retrieve(memoryVersionID, params, options) {
-        const { memory_store_id, betas, ...query } = params;
+        const { memory_store_id, betas, ...query2 } = params;
         return this._client.get(path`/v1/memory_stores/${memory_store_id}/memory_versions/${memoryVersionID}?beta=true`, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "agent-memory-2026-07-22"].toString() },
@@ -18731,9 +18731,9 @@ var init_memory_versions = __esm({
        * ```
        */
       list(memoryStoreID, params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList(path`/v1/memory_stores/${memoryStoreID}/memory_versions?beta=true`, PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "agent-memory-2026-07-22"].toString() },
@@ -18859,9 +18859,9 @@ var init_memory_stores = __esm({
        * ```
        */
       list(params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList("/v1/memory_stores?beta=true", PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "agent-memory-2026-07-22"].toString() },
@@ -19059,9 +19059,9 @@ var init_batches = __esm({
        * ```
        */
       list(params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList("/v1/messages/batches?beta=true", Page, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "message-batches-2024-09-24"].toString() },
@@ -20734,9 +20734,9 @@ var init_events = __esm({
        * ```
        */
       list(sessionID, params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList(path`/v1/sessions/${sessionID}/events?beta=true`, PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "managed-agents-2026-04-01"].toString() },
@@ -20791,9 +20791,9 @@ var init_events = __esm({
        * ```
        */
       stream(sessionID, params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.get(path`/v1/sessions/${sessionID}/events/stream?beta=true`, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "managed-agents-2026-04-01"].toString() },
@@ -20901,9 +20901,9 @@ var init_resources = __esm({
        * ```
        */
       list(sessionID, params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList(path`/v1/sessions/${sessionID}/resources?beta=true`, PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "managed-agents-2026-04-01"].toString() },
@@ -20988,9 +20988,9 @@ var init_events2 = __esm({
        * ```
        */
       list(threadID, params, options) {
-        const { session_id, betas, ...query } = params;
+        const { session_id, betas, ...query2 } = params;
         return this._client.getAPIList(path`/v1/sessions/${session_id}/threads/${threadID}/events?beta=true`, PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "managed-agents-2026-04-01"].toString() },
@@ -21077,9 +21077,9 @@ var init_threads = __esm({
        * ```
        */
       list(sessionID, params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList(path`/v1/sessions/${sessionID}/threads?beta=true`, PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "managed-agents-2026-04-01"].toString() },
@@ -21214,9 +21214,9 @@ var init_sessions = __esm({
        * ```
        */
       list(params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList("/v1/sessions?beta=true", BidirectionalPageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "managed-agents-2026-04-01"].toString() },
@@ -21341,9 +21341,9 @@ var init_versions2 = __esm({
        * ```
        */
       list(skillID, params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList(path`/v1/skills/${skillID}/versions?beta=true`, PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "skills-2025-10-02"].toString() },
@@ -21472,9 +21472,9 @@ var init_skills2 = __esm({
        * ```
        */
       list(params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList("/v1/skills?beta=true", PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "skills-2025-10-02"].toString() },
@@ -21592,9 +21592,9 @@ var init_certificates = __esm({
        * ```
        */
       list(tunnelID, params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList(path`/v1/tunnels/${tunnelID}/certificates?beta=true`, PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "mcp-tunnels-2026-06-22"].toString() },
@@ -21721,9 +21721,9 @@ var init_tunnels = __esm({
        * ```
        */
       list(params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList("/v1/tunnels?beta=true", PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "mcp-tunnels-2026-06-22"].toString() },
@@ -21917,9 +21917,9 @@ var init_credentials2 = __esm({
        * ```
        */
       list(vaultID, params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList(path`/v1/vaults/${vaultID}/credentials?beta=true`, PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "managed-agents-2026-04-01"].toString() },
@@ -22090,9 +22090,9 @@ var init_vaults = __esm({
        * ```
        */
       list(params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList("/v1/vaults?beta=true", PageCursor, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { "anthropic-beta": [...betas ?? [], "managed-agents-2026-04-01"].toString() },
@@ -22978,8 +22978,8 @@ var init_batches2 = __esm({
        * }
        * ```
        */
-      list(query = {}, options) {
-        return this._client.getAPIList("/v1/messages/batches", Page, { query, ...options });
+      list(query2 = {}, options) {
+        return this._client.getAPIList("/v1/messages/batches", Page, { query: query2, ...options });
       }
       /**
        * Delete a Message Batch.
@@ -23235,9 +23235,9 @@ var init_models2 = __esm({
        * use in the API. More recently released models are listed first.
        */
       list(params = {}, options) {
-        const { betas, ...query } = params ?? {};
+        const { betas, ...query2 } = params ?? {};
         return this._client.getAPIList("/v1/models", Page, {
-          query,
+          query: query2,
           ...options,
           headers: buildHeaders([
             { ...betas?.toString() != null ? { "anthropic-beta": betas?.toString() } : void 0 },
@@ -23586,8 +23586,8 @@ var init_client = __esm({
         }
         return buildHeaders([{ Authorization: `Bearer ${this.authToken}` }]);
       }
-      stringifyQuery(query) {
-        return stringifyQuery(query);
+      stringifyQuery(query2) {
+        return stringifyQuery(query2);
       }
       getUserAgent() {
         return `${this.constructor.name}/JS ${VERSION}`;
@@ -23598,16 +23598,16 @@ var init_client = __esm({
       makeStatusError(status, error, message, headers) {
         return APIError.generate(status, error, message, headers);
       }
-      buildURL(path5, query, defaultBaseURL) {
+      buildURL(path5, query2, defaultBaseURL) {
         const baseURL = !__classPrivateFieldGet(this, _BaseAnthropic_instances, "m", _BaseAnthropic_baseURLOverridden).call(this) && defaultBaseURL || this.baseURL;
         const url = isAbsoluteURL(path5) ? new URL(path5) : new URL(baseURL + (baseURL.endsWith("/") && path5.startsWith("/") ? path5.slice(1) : path5));
         const defaultQuery = this.defaultQuery();
         const pathQuery = Object.fromEntries(url.searchParams);
         if (!isEmptyObj(defaultQuery) || !isEmptyObj(pathQuery)) {
-          query = { ...pathQuery, ...defaultQuery, ...query };
+          query2 = { ...pathQuery, ...defaultQuery, ...query2 };
         }
-        if (typeof query === "object" && query && !Array.isArray(query)) {
-          url.search = this.stringifyQuery(query);
+        if (typeof query2 === "object" && query2 && !Array.isArray(query2)) {
+          url.search = this.stringifyQuery(query2);
         }
         return url.toString();
       }
@@ -23920,14 +23920,14 @@ var init_client = __esm({
       }
       async buildRequest(inputOptions, { retryCount = 0 } = {}) {
         const options = { ...inputOptions };
-        const { method, path: path5, query, defaultBaseURL } = options;
+        const { method, path: path5, query: query2, defaultBaseURL } = options;
         if (this._authState.resolution) {
           await this._authState.resolution;
         }
         if (!this._baseURLIsExplicit && this._authState.baseURL && this.baseURL !== this._authState.baseURL) {
           this.baseURL = this._authState.baseURL;
         }
-        const url = this.buildURL(path5, query, defaultBaseURL);
+        const url = this.buildURL(path5, query2, defaultBaseURL);
         if ("timeout" in options)
           validatePositiveInteger("timeout", options.timeout);
         options.timeout = options.timeout ?? this.timeout;
@@ -24045,8 +24045,8 @@ function stripFallbackBlocks(body) {
 function betaRefusalFallbackMiddleware(fallbacks, options = {}) {
   let warnedMissingState = false;
   return async (request, next, ctx) => {
-    const [path5, query] = (ctx.options?.path ?? "").split("?");
-    if (fallbacks.length === 0 || ctx.options?.method !== "post" || path5 !== "/v1/messages" || new URLSearchParams(query).get("beta") !== "true" || typeof ctx.options.body !== "object" || ctx.options.body == null) {
+    const [path5, query2] = (ctx.options?.path ?? "").split("?");
+    if (fallbacks.length === 0 || ctx.options?.method !== "post" || path5 !== "/v1/messages" || new URLSearchParams(query2).get("beta") !== "true" || typeof ctx.options.body !== "object" || ctx.options.body == null) {
       return next(request);
     }
     if (ctx.options.body.fallbacks != null) {
@@ -26058,6 +26058,22 @@ function isCommandUnavailable(facts, countsRead) {
     return false;
   return facts.stdout.trim().length === 0 && EXEC_FAILURE.test(facts.stderr);
 }
+function isOfflineBuildGap(facts, counts) {
+  if (facts.runtime !== "jvm")
+    return null;
+  if (counts !== null && counts.tests_failed > 0)
+    return null;
+  if (facts.exitCode === 0 || facts.exitCode === null)
+    return null;
+  const out = `${facts.stdout}
+${facts.stderr}`;
+  for (const pattern of OFFLINE_BUILD_GAP) {
+    const hit = pattern.exec(out);
+    if (hit)
+      return hit[0];
+  }
+  return null;
+}
 function classifyVerification(facts) {
   if (facts.timedOut) {
     return {
@@ -26082,6 +26098,14 @@ function classifyVerification(facts) {
       reason: `the test command could not be invoked (exit ${String(facts.exitCode)}). This is an environment failure on our side \u2014 a missing interpreter, a binary outside PATH, or a dependency installed somewhere the command cannot see it. The repo has not been judged.`
     };
   }
+  const gap = isOfflineBuildGap(facts, counts);
+  if (gap !== null) {
+    return {
+      outcome: "test-command-unavailable",
+      counts,
+      reason: `the build stopped on something our install step did not fetch (${gap}). The test step has no network, so this is a gap in our environment, not a failure in the repo. The repo has not been judged.`
+    };
+  }
   if (counts !== null) {
     if (counts.tests_failed > 0) {
       return {
@@ -26136,10 +26160,19 @@ function isGreen(outcome) {
 function isOurFault(outcome) {
   return outcome === "test-command-unavailable" || outcome === "counts-unparsed";
 }
-var int, withSuiteFailures, READERS, SUPPORTED_RUNNERS, COVERAGE_TABLE, EXEC_FAILURE, SUITE_REPORTED_FAILURE;
+var VERIFICATION_OUTCOMES, int, withSuiteFailures, READERS, SUPPORTED_RUNNERS, COVERAGE_TABLE, EXEC_FAILURE, SUITE_REPORTED_FAILURE, OFFLINE_BUILD_GAP;
 var init_classify2 = __esm({
   "../../packages/envrun/dist/classify.js"() {
     "use strict";
+    VERIFICATION_OUTCOMES = [
+      "completed",
+      "tests-failed",
+      "no-tests-observed",
+      "counts-unparsed",
+      "test-command-unavailable",
+      "environment-exhausted",
+      "budget-exceeded"
+    ];
     int = (m, i = 1) => m ? Number(m[i]) : 0;
     withSuiteFailures = (counts, suiteLine) => {
       if (counts.tests_failed > 0 || !suiteLine)
@@ -26239,6 +26272,51 @@ var init_classify2 = __esm({
           return { tests_passed: int(passed), tests_failed: int(failed) + int(errors) };
         }
       },
+      {
+        // Maven surefire's per-module summary (TERM-1122), measured against surefire
+        // 3.2.5 through `th run`:
+        //
+        //     [INFO] Tests run: 2, Failures: 0, Errors: 0, Skipped: 0
+        //
+        // The per-CLASS lines carry the same counts followed by `, Time elapsed: …`, so
+        // the end anchor after `Skipped` is what keeps them out; counting both would
+        // double every test. One summary prints per module, so they are SUMMED. An
+        // error is a test that could not run to an assertion, counted as failed so a
+        // green verdict is impossible while one is outstanding, as pytest's are.
+        runner: "maven surefire",
+        read: (out) => {
+          const lines = [
+            ...out.matchAll(/^(?:\[(?:INFO|WARNING|ERROR)\] )?Tests run: (\d+), Failures: (\d+), Errors: (\d+), Skipped: (\d+)(?:, Flakes: \d+)?\s*$/gm)
+          ];
+          if (lines.length === 0)
+            return null;
+          let passed = 0;
+          let failed = 0;
+          for (const m of lines) {
+            const [run2, failures, errors, skipped] = [m[1], m[2], m[3], m[4]].map(Number);
+            failed += failures + errors;
+            passed += Math.max(0, run2 - failures - errors - skipped);
+          }
+          return { tests_passed: passed, tests_failed: failed };
+        }
+      },
+      {
+        // Gradle prints no test counts when every test passes, so envrun installs an
+        // init script that prints one line per Test task (`gradleTestSummary.ts`,
+        // TERM-1122). The marker is ours; its format is fixed there.
+        runner: "gradle",
+        read: (out) => {
+          const lines = [
+            ...out.matchAll(/^terminalhire-gradle-tests: task=\S+ total=(\d+) passed=(\d+) failed=(\d+) skipped=(\d+)\s*$/gm)
+          ];
+          if (lines.length === 0)
+            return null;
+          return {
+            tests_passed: lines.reduce((sum, m) => sum + Number(m[2]), 0),
+            tests_failed: lines.reduce((sum, m) => sum + Number(m[3]), 0)
+          };
+        }
+      },
       {
         // mocha: `  440 passing (1s)` and `  2 failing`
         runner: "mocha",
@@ -26367,6 +26445,21 @@ var init_classify2 = __esm({
       "\\d+\\s+examples?,\\s+(?!0\\b)\\d+\\s+failures?"
       // rspec's summary line
     ].join("|"), "m");
+    OFFLINE_BUILD_GAP = [
+      // Maven, `-o`: `Cannot access central (…) in offline mode and the artifact … has
+      // not been downloaded from it before.`
+      /in offline mode and the artifact \S+ has not been downloaded from it before/,
+      // Maven without `-o`, as a CI-derived `mvn test` runs: it tries the network.
+      /Could not transfer artifact \S+ from\/to /,
+      /Plugin \S+ or one of its dependencies could not be resolved/,
+      // Gradle, `--offline`.
+      /No cached version (?:listing )?(?:of|for) \S+ available for offline mode/,
+      // Gradle without `--offline`, and the wrapper fetching its own distribution.
+      /Could not GET 'https?:\/\//,
+      /^Downloading https:\/\/services\.gradle\.org\/distributions\//m,
+      /No matching toolchains found for requested specification/,
+      /Cannot find a Java installation on your machine matching/
+    ];
   }
 });
 
@@ -26432,6 +26525,8 @@ function scrubEnv(source, opts) {
   env["GOCACHE"] = join18(jailHome, ".cache", "go-build");
   env["GOFLAGS"] = "-modcacherw";
   env["CARGO_HOME"] = join18(jailHome, ".cargo");
+  env["MAVEN_OPTS"] = `-Dmaven.repo.local=${join18(jailHome, ".m2", "repository")}`;
+  env["GRADLE_USER_HOME"] = join18(jailHome, ".gradle");
   const bundle = join18(jailHome, ".bundle");
   env["GEM_HOME"] = bundle;
   env["BUNDLE_PATH"] = bundle;
@@ -26749,6 +26844,18 @@ var init_egressProxy = __esm({
       // NuGet; the coupling test refuses a mapped runtime whose registry is unreachable, and
       // it caught this one the moment the image landed.
       "api.nuget.org",
+      // TERM-1122, added with the `jvm` image mapping, each from a MEASURED denial
+      // through `th run` (the proxy's 403 in the build's own output), not a guess:
+      //   - Maven Central, where both `mvn` and Gradle's `mavenCentral()` resolve.
+      //   - `services.gradle.org`, where a Gradle wrapper fetches its distribution.
+      //   - `release-assets.githubusercontent.com`, where that fetch LANDS. Measured
+      //     chain: services.gradle.org 307 -> github.com 302 -> this host 200. The
+      //     `github.com` note below keeps `githubusercontent.com` denied until a real
+      //     install needs it; this is that install. Only this one host: raw blobs and
+      //     `objects.githubusercontent.com` stay denied.
+      "repo.maven.apache.org",
+      "services.gradle.org",
+      "release-assets.githubusercontent.com",
       // Git dependencies. Approved by Eric 2026-07-22 after a live run measured the
       // chokepoint working under load (20 events, 16 allowed / 4 denied by host).
       //
@@ -27040,6 +27147,9 @@ function containerArgs(spec, env, opts) {
       args.push(`--env=${k}=${url}`);
     }
     args.push("--env=NO_PROXY=", "--env=no_proxy=");
+    const host = opts.net.proxyHost;
+    const port = String(opts.net.proxyPort);
+    args.push(`--env=JAVA_TOOL_OPTIONS=-Dhttp.proxyHost=${host} -Dhttp.proxyPort=${port} -Dhttps.proxyHost=${host} -Dhttps.proxyPort=${port} -Daether.connector.http.useSystemProperties=true`);
   }
   args.push("--");
   args.push(validateImage(opts.image ?? DEFAULT_CONTAINER_IMAGE));
@@ -27372,7 +27482,10 @@ var init_container = __esm({
       "http_proxy",
       "https_proxy",
       "NO_PROXY",
-      "no_proxy"
+      "no_proxy",
+      // Carries the JVM's copy of the proxy (below), so an inherited value is dropped
+      // for the same reason as the rest.
+      "JAVA_TOOL_OPTIONS"
     ]);
     WINDOWS_DRIVE_ROOT = /^[A-Za-z]:[\\/]/;
     IMAGE_HOST = "(?:[a-zA-Z0-9-]+(?:\\.[a-zA-Z0-9-]+)+(?::[0-9]+)?|localhost(?::[0-9]+)?)";
@@ -27422,11 +27535,17 @@ var init_dist = __esm({
 function censusTotal(c) {
   return c.containers.length + c.volumes.length + c.networks.length;
 }
-function ids(docker3, args) {
+function query(docker3, args) {
   const res = docker3.sync([...args], { timeoutMs: 15e3 });
-  if (res.error || res.status !== 0)
-    return [];
-  return res.stdout.split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
+  if (res.error || res.status !== 0) {
+    const why = res.error?.message ?? (res.stderr.trim() || `exit ${String(res.status)}`);
+    return { ids: [], failure: `docker ${args.slice(0, 2).join(" ")}: ${why}` };
+  }
+  const ids2 = res.stdout.split("\n").map((s) => s.trim()).filter((s) => s.length > 0);
+  return { ids: ids2, failure: null };
+}
+function ids(docker3, args) {
+  return query(docker3, args).ids;
 }
 function census(docker3, label) {
   const filter = `label=${label}`;
@@ -27436,25 +27555,67 @@ function census(docker3, label) {
     networks: ids(docker3, ["network", "ls", "-q", "--filter", filter])
   };
 }
+function censusReport(docker3, label) {
+  const filter = `label=${label}`;
+  const failures = [];
+  const ask2 = (args) => {
+    const q = query(docker3, args);
+    if (q.failure !== null)
+      failures.push(q.failure);
+    return q.ids;
+  };
+  const taken = {
+    containers: ask2(["ps", "-aq", "--filter", filter]),
+    volumes: ask2(["volume", "ls", "-q", "--filter", filter]),
+    networks: ask2(["network", "ls", "-q", "--filter", filter])
+  };
+  return failures.length === 0 ? { observed: true, census: taken, unobservedReason: null } : { observed: false, census: taken, unobservedReason: failures.join("; ") };
+}
 function localCensus(label) {
   return census(localDockerClient(), label);
 }
-function judgeLeaks(peak, after) {
+function judgeLeaks(peak, after, observation) {
   const labelObserved = peak.containers.length > 0;
+  if (!observation.observed) {
+    return {
+      labelObserved,
+      reaped: false,
+      observed: false,
+      clean: false,
+      state: "unobserved",
+      peak,
+      after,
+      note: `UNOBSERVED, not clean: we could not look at what survived teardown (${observation.unobservedReason ?? "no reason given"}), so nothing is known about leaks on this run, in either direction.`
+    };
+  }
   const reaped = censusTotal(after) === 0;
   let note;
+  let state;
   if (!labelObserved && reaped) {
+    state = "inconclusive";
     note = "INCONCLUSIVE, not clean: nothing labelled was ever seen alive, so an empty final census is equally consistent with the label never being applied. The control failed, so the denial proves nothing.";
   } else if (!labelObserved) {
+    state = "leak";
     note = "no labelled container was observed alive AND objects remain \u2014 the label wiring is wrong.";
   } else if (!reaped) {
+    state = "leak";
     note = `LEAK: ${String(censusTotal(after))} labelled object(s) survived teardown (containers=${String(after.containers.length)} volumes=${String(after.volumes.length)} networks=${String(after.networks.length)}).`;
   } else {
+    state = "clean";
     note = `clean: peak ${String(peak.containers.length)} labelled container(s) observed alive, 0 labelled objects remain after teardown.`;
   }
-  return { labelObserved, reaped, clean: labelObserved && reaped, peak, after, note };
+  return {
+    labelObserved,
+    reaped,
+    observed: true,
+    clean: labelObserved && reaped,
+    state,
+    peak,
+    after,
+    note
+  };
 }
-var RUN_LABEL_KEY, LabelWatch;
+var RUN_LABEL_KEY, LabelWatch, LEAK_STATES;
 var init_labels = __esm({
   "../../packages/envrun/dist/labels.js"() {
     "use strict";
@@ -27509,6 +27670,7 @@ var init_labels = __esm({
         return this.#samples;
       }
     };
+    LEAK_STATES = ["clean", "leak", "inconclusive", "unobserved"];
   }
 });
 
@@ -27993,7 +28155,7 @@ function acquireLocalLease(runId) {
       observed: false,
       census: { containers: [], volumes: [], networks: [] },
       unobservedReason: RELEASED_LEASE_CENSUS_REASON
-    } : { observed: true, census: census(docker3, label), unobservedReason: null }),
+    } : censusReport(docker3, label)),
     publishPreview: (req) => startPreview({ ...req, docker: docker3 }),
     release: () => {
       if (released) {
@@ -28113,6 +28275,17 @@ caused by: ${frame}`;
   }
   return frames === 0 ? null : out;
 }
+function imageVariantFor(spec) {
+  if (spec.runtime !== "jvm")
+    return void 0;
+  const callsGradle = /(?:^|[\s;&|(])gradle(?=\s|$)/;
+  return [spec.installCommand, spec.testCommand].some((c) => c != null && callsGradle.test(c)) ? "gradle" : void 0;
+}
+function shapeFor(runtime, variant) {
+  if (runtime === "jvm" && variant === "gradle")
+    return JVM_GRADLE_IMAGE;
+  return RUNTIME_IMAGES[runtime];
+}
 function atLeast(a, b) {
   const left = a.split(".").map(Number);
   const right = b.split(".").map(Number);
@@ -28125,10 +28298,10 @@ function atLeast(a, b) {
   }
   return true;
 }
-function imageForRuntime(runtime, override, version) {
+function imageForRuntime(runtime, override, version, variant) {
   if (override)
     return override;
-  const shape = RUNTIME_IMAGES[runtime];
+  const shape = shapeFor(runtime, variant);
   if (!shape) {
     throw new RunRefusalError(`no container image is mapped for runtime ${JSON.stringify(runtime)}. Refusing to run it in the Node image: a bare "command not found" exits 127, which classifyVerification already owns as ours \u2014 but a test script that RUNS and fails inside on the missing tool exits with its own status and prints to stdout, and that falls through to tests-failed \u2014 a false red blamed on the repo.`);
   }
@@ -28137,7 +28310,7 @@ function imageForRuntime(runtime, override, version) {
   if (!TAG_VERSION.test(version)) {
     throw new RunRefusalError(`runtime version ${JSON.stringify(version)} is not a bare version, so no image tag can be built from it. Refusing rather than booting the default: the repo asked for a version, and supplying a different one silently is what TERM-643 fixed.`);
   }
-  return `${shape.repository}:${version}${shape.suffix}`;
+  return `${shape.repository}:${shape.prefix ?? ""}${version}${shape.suffix}`;
 }
 function setManifestProbe(probe) {
   const previous = manifestProbe;
@@ -28150,10 +28323,10 @@ function imageDefinitelyAbsent(image) {
     return false;
   return /manifest unknown|no such manifest/i.test(res.output);
 }
-function resolvePublishedImage(image, runtime, version) {
+function resolvePublishedImage(image, runtime, version, variant) {
   if (!imageDefinitelyAbsent(image))
     return image;
-  const shape = RUNTIME_IMAGES[runtime];
+  const shape = shapeFor(runtime, variant);
   if (shape && shape.declaredIsFloor && atLeast(shape.defaultVersion, version)) {
     return unversionedImage(shape);
   }
@@ -28161,18 +28334,19 @@ function resolvePublishedImage(image, runtime, version) {
 }
 function resolveImageForSpec(spec, override) {
   const declared = spec.runtimeVersion;
-  const image = imageForRuntime(spec.runtime, override, declared);
+  const variant = imageVariantFor(spec);
+  const image = imageForRuntime(spec.runtime, override, declared, variant);
   const constructed = (() => {
     if (declared === null)
       return null;
     try {
-      return imageForRuntime(spec.runtime, void 0, declared);
+      return imageForRuntime(spec.runtime, void 0, declared, variant);
     } catch {
       return null;
     }
   })();
   if (constructed !== null && image === constructed && declared !== null) {
-    return resolvePublishedImage(image, spec.runtime, declared);
+    return resolvePublishedImage(image, spec.runtime, declared, variant);
   }
   return image;
 }
@@ -28199,12 +28373,22 @@ function assertVenueOwnerDeclared(lease) {
     return;
   throw new RunRefusalError("this venue did not say which account owns the tree it staged, so the guest would run under this machine's uid and could not write its own clone. We refuse rather than report that permission error as the repo's tests failing.");
 }
+function refuseUnbuildableSpec(spec) {
+  if (spec.runtime !== "jvm" || spec.installCommand !== null || spec.testCommand !== null)
+    return;
+  const why = spec.unresolved.find((r) => r.kind === "no-test-command")?.detail;
+  if (why === void 0) {
+    throw new EnvRunError("internal: a jvm spec with no test command carries no no-test-command reason");
+  }
+  throw new RunRefusalError(`refusing to run this repository: ${why}.`);
+}
 async function runEnvironmentSpec(req) {
   const startedAt = Date.now();
   const containment = req.lease.containment;
   if (containment.kind !== "container") {
     throw new EnvRunError(`phase 2 requires the container tier, got ${containment.kind}. Refusing: a container phase that silently ran under seatbelt would make every container claim vacuous.`);
   }
+  refuseUnbuildableSpec(req.spec);
   assertVenueOwnerDeclared(req.lease);
   const image = resolveImageForSpec(req.spec, req.image);
   const { jail, tmp } = req;
@@ -28247,9 +28431,10 @@ async function runEnvironmentSpec(req) {
         installOk: false
       };
     } else if (req.spec.testCommand === null) {
+      const why = req.spec.unresolved.find((r) => r.kind === "no-test-command")?.detail;
       result = {
         outcome: "no-tests-observed",
-        note: "the spec derived no test command, so nothing was executed: nothing failed and nothing ran. Certain, not inferred \u2014 no command was ever invoked.",
+        note: "the spec derived no test command, so nothing was executed: nothing failed and nothing ran. Certain, not inferred \u2014 no command was ever invoked." + (why === void 0 ? "" : ` Why: ${why}.`),
         installOk: true
       };
     } else {
@@ -28272,7 +28457,7 @@ async function runEnvironmentSpec(req) {
         labels,
         timeoutMs: req.testTimeoutMs ?? 9e5
       });
-      const verdict = classifyVerification(toExecution(test));
+      const verdict = classifyVerification({ ...toExecution(test), runtime: req.spec.runtime });
       result = { outcome: verdict.outcome, note: verdict.reason, installOk: true };
     }
   } finally {
@@ -28286,6 +28471,10 @@ async function runEnvironmentSpec(req) {
     volumes: [],
     networks: []
   };
+  const observation = afterReport ?? {
+    observed: false,
+    unobservedReason: "the run carried no label, so there was nothing to count by"
+  };
   return {
     outcome: result.outcome,
     tier: "container",
@@ -28294,7 +28483,7 @@ async function runEnvironmentSpec(req) {
     test,
     installOk: result.installOk,
     counts: test ? readCounts(test.stdout, test.stderr) : null,
-    leaks: judgeLeaks(peak, after),
+    leaks: judgeLeaks(peak, after, observation),
     note: result.note,
     wallMs: Date.now() - startedAt
   };
@@ -28344,7 +28533,7 @@ async function runStep(containment, r) {
     wallMs: Date.now() - startedAt
   };
 }
-var EnvRunError, RunRefusalError, MAX_CAUSE_FRAMES, CHAIN_UNREADABLE, CHAIN_TOO_DEEP, RUNTIME_IMAGES, unversionedImage, TAG_VERSION, dockerManifestProbe, manifestProbe, MISSING_IMAGE_SHAPE;
+var EnvRunError, RunRefusalError, MAX_CAUSE_FRAMES, CHAIN_UNREADABLE, CHAIN_TOO_DEEP, RUNTIME_IMAGES, JVM_GRADLE_IMAGE, unversionedImage, TAG_VERSION, dockerManifestProbe, manifestProbe, MISSING_IMAGE_SHAPE;
 var init_execute = __esm({
   "../../packages/envrun/dist/execute.js"() {
     "use strict";
@@ -28411,9 +28600,36 @@ var init_execute = __esm({
         suffix: "",
         defaultVersion: "8.0",
         declaredIsFloor: true
+      },
+      /**
+       * TERM-1122. Maven's image, and the one a Gradle WRAPPER repo gets too: the wrapper
+       * downloads its own Gradle, so it needs a JDK and nothing else. MEASURED
+       * 2026-09-18: `maven:3.9-eclipse-temurin-21` carries `git`, `mvn` and JDK 21 on
+       * Ubuntu 24.04, which is why this is not `eclipse-temurin` (no `git`, rejected
+       * under TERM-1139). The JDK sits AFTER maven's own version in the tag, hence
+       * `prefix`, and the major is all envspec derives (`javaMajor`).
+       *
+       * `declaredIsFloor`: a JDK builds for older `--release` targets, so a repo asking
+       * for 16, which has no image, runs on 21. A Gradle toolchain is stricter than a
+       * floor and asks for its exact JDK; Gradle's refusal on the wrong one reads as
+       * ours (`classify.ts`, `isOfflineBuildGap`), never as the repo's.
+       */
+      jvm: {
+        repository: "maven",
+        prefix: "3.9-eclipse-temurin-",
+        suffix: "",
+        defaultVersion: "21",
+        declaredIsFloor: true
       }
     };
-    unversionedImage = (shape) => `${shape.repository}:${shape.defaultVersion}${shape.suffix}`;
+    JVM_GRADLE_IMAGE = {
+      repository: "gradle",
+      prefix: "jdk",
+      suffix: "",
+      defaultVersion: "21",
+      declaredIsFloor: true
+    };
+    unversionedImage = (shape) => `${shape.repository}:${shape.prefix ?? ""}${shape.defaultVersion}${shape.suffix}`;
     TAG_VERSION = /^\d+(?:\.\d+){0,2}$/;
     dockerManifestProbe = (image) => {
       const res = spawnSync4("docker", ["manifest", "inspect", image], {
@@ -29105,7 +29321,14 @@ function answerDidItPass(r) {
   const passed = r.status === "verified" && r.outcome !== null && isGreen(r.outcome);
   return { passed, summary: renderVerdictLine(r), lookAt: r.preview?.url ?? null };
 }
-var RUN_TEST_COMMAND_SOURCES, RUN_IMAGE_SOURCES, RUN_RESULT_SCHEMA, RUN_RESULT_FIELDS, RENDER_NONE, FIELD_VIEWS;
+function exitCodeFor(r) {
+  if (r.status === "refused")
+    return 2;
+  if (r.outcome === null)
+    return 2;
+  return OUTCOME_EXIT_CODES[r.outcome];
+}
+var RUN_TEST_COMMAND_SOURCES, RUN_IMAGE_SOURCES, RUN_RESULT_SCHEMA, RUN_RESULT_FIELDS, RENDER_NONE, FIELD_VIEWS, OUTCOME_EXIT_CODES;
 var init_result = __esm({
   "../../packages/envrun/dist/result.js"() {
     "use strict";
@@ -29149,6 +29372,7 @@ var init_result = __esm({
       "containerImageDigest",
       "imageSource",
       "leaksClean",
+      "leakState",
       "venue"
     ];
     RENDER_NONE = null;
@@ -29183,12 +29407,39 @@ var init_result = __esm({
       // Shown only when a human chose the environment. `detected` is the ordinary case and
       // saying so on every run would train the reader to skip the line that matters.
       imageSource: (r) => r.imageSource === "detected" || r.imageSource === "none" ? null : `image source ${r.imageSource} (not signed)`,
-      leaksClean: (r) => r.leaksClean === null ? null : r.leaksClean ? null : "WARNING      labelled Docker objects survived teardown",
+      // Printed through `leakState` below, which knows WHY a false is false. Rendering both would
+      // print the leak warning on a run where we merely could not look (TERM-1144).
+      leaksClean: RENDER_NONE,
+      // Silent when clean and when refused, as the boolean's line was. The two not-a-leak states
+      // get their own sentence, because "we could not check" read as "we found a leak" is the
+      // exact confusion this field exists to end.
+      leakState: (r) => {
+        switch (r.leakState) {
+          case null:
+          case "clean":
+            return null;
+          case "leak":
+            return "WARNING      labelled Docker objects survived teardown";
+          case "inconclusive":
+            return "leak check   inconclusive \u2014 no labelled container was seen while the run was live, so finding nothing afterwards proves nothing";
+          case "unobserved":
+            return "leak check   not taken \u2014 we could not check what was left after teardown";
+        }
+      },
       // Absent on most runs, so it prints only when there is something to say. Silence
       // here is the honest rendering of "no venue answered": a placeholder line would
       // invite a reader to treat an unanswered probe as a described venue.
       venue: (r) => r.venue === null ? null : renderVenueLine(r.venue)
     };
+    OUTCOME_EXIT_CODES = {
+      completed: 0,
+      "tests-failed": 1,
+      "no-tests-observed": 1,
+      "budget-exceeded": 1,
+      "counts-unparsed": 2,
+      "test-command-unavailable": 2,
+      "environment-exhausted": 2
+    };
   }
 });
 
@@ -31499,11 +31750,7 @@ function makeLease(p) {
       }
       try {
         check("counting what the run left behind");
-        return Promise.resolve({
-          observed: true,
-          census: census(p.docker, label),
-          unobservedReason: null
-        });
+        return Promise.resolve(censusReport(p.docker, label));
       } catch (err) {
         return Promise.resolve({
           observed: false,
@@ -31771,7 +32018,7 @@ function localDockerPlacement() {
     kind: "local-docker",
     refusal: null,
     venue: () => localVenue(),
-    imageFor: (runtime, override, version) => imageForRuntime(runtime, override, version)
+    imageFor: (runtime, override, version, variant) => imageForRuntime(runtime, override, version, variant)
   };
 }
 function hostedPoolPlacement() {
@@ -31779,7 +32026,7 @@ function hostedPoolPlacement() {
     kind: "hosted-pool",
     refusal: null,
     venue: () => hostedVenue(),
-    imageFor: (runtime, override, version) => imageForRuntime(runtime, override, version)
+    imageFor: (runtime, override, version, variant) => imageForRuntime(runtime, override, version, variant)
   };
 }
 function placementFor(kind) {
@@ -32344,6 +32591,9 @@ function detectRuntime(repo) {
   if (repo.listNames("").some((name) => /\.(?:csproj|fsproj|sln)$/.test(name))) {
     candidates.push("dotnet");
   }
+  if (candidates.length === 0 && repo.listFiles("").some((f) => f.endsWith(".java"))) {
+    candidates.push("jvm");
+  }
   return { runtime: candidates[0] ?? "unknown", candidates };
 }
 function readJsonObject(repo, path5) {
@@ -32491,6 +32741,11 @@ function basePythonInstallCommand(repo) {
   }
   return null;
 }
+function rehearse(command) {
+  const copy = '"$R/.terminalhire-rehearsal"';
+  const home = '"$R/.terminalhire-rehearsal-home"';
+  return `{ R="$HOME"; rm -rf ${copy} ${home}; mkdir -p ${home} && cp -R . ${copy} && (cd ${copy} && HOME=${home} GRADLE_USER_HOME="$R/.gradle" JAVA_TOOL_OPTIONS="$JAVA_TOOL_OPTIONS -Duser.home=$R/.terminalhire-rehearsal-home" ${command}); rm -rf ${copy} ${home}; true; }`;
+}
 function otherRuntimeCommands(repo, runtime) {
   switch (runtime) {
     case "go":
@@ -32518,10 +32773,21 @@ function otherRuntimeCommands(repo, runtime) {
     case "dotnet":
       return { install: "dotnet restore", test: "dotnet test" };
     case "jvm": {
-      if (repo.exists("pom.xml"))
-        return { install: "mvn -B dependency:go-offline", test: "mvn -B test" };
+      if (!JVM_BUILD_FILES.some((file) => repo.exists(file)))
+        return { install: null, test: null };
+      if (repo.exists("pom.xml")) {
+        return {
+          install: `mvn -B dependency:go-offline && ${rehearse('mvn -B test -Dmaven.test.failure.ignore=true -Dmaven.repo.local="$R/.m2/repository"')}`,
+          test: "mvn -B -o test"
+        };
+      }
       const wrapper = repo.exists("gradlew") ? "./gradlew" : "gradle";
-      return { install: `${wrapper} dependencies`, test: `${wrapper} test` };
+      return {
+        install: `${wrapper} dependencies && ${rehearse(`${wrapper} test --continue`)}`,
+        // `--no-build-cache`: the rehearsal above can fill Gradle's build cache, and a
+        // test task restored FROM-CACHE runs nothing and prints no count.
+        test: `${wrapper} test --offline --no-build-cache`
+      };
     }
     default:
       return { install: null, test: null };
@@ -32553,6 +32819,15 @@ function searchRuntimeVersion(repo, runtime) {
     push(".ruby-version", repo.readText(".ruby-version"));
   } else if (runtime === "dotnet") {
     push("global.json sdk.version", readStringField(readObjectField(readJsonObject(repo, "global.json"), "sdk"), "version"));
+  } else if (runtime === "jvm") {
+    const pom = repo.readText("pom.xml");
+    const gradle = repo.readText("build.gradle") ?? repo.readText("build.gradle.kts");
+    push("build.gradle toolchain languageVersion", javaMajor(matchFirst(gradle, /JavaLanguageVersion\.of\(\s*["']?(\d+)["']?\s*\)/) ?? matchFirst(gradle, /jvmToolchain\(\s*(\d+)\s*\)/)));
+    push(".java-version", javaMajor(repo.readText(".java-version")));
+    push("pom.xml maven.compiler.release", javaMajor(matchFirst(pom, /<maven\.compiler\.release>\s*([^<\s]+)\s*</)));
+    push("pom.xml java.version", javaMajor(matchFirst(pom, /<java\.version>\s*([^<\s]+)\s*</)));
+    push("pom.xml maven.compiler.source", javaMajor(matchFirst(pom, /<maven\.compiler\.source>\s*([^<\s]+)\s*</)));
+    push("build.gradle sourceCompatibility", javaMajor(matchFirst(gradle, /sourceCompatibility\s*=\s*JavaVersion\.VERSION_([\d_]+)/)?.replace("_", ".") ?? matchFirst(gradle, /sourceCompatibility\s*=\s*["']?([\d.]+)["']?/)));
   }
   let rangeFound = null;
   for (const source of sources) {
@@ -32566,13 +32841,21 @@ function searchRuntimeVersion(repo, runtime) {
   }
   return { version: null, searched: sources.map((s) => s.label), rangeFound };
 }
+function javaMajor(text) {
+  if (text === null)
+    return null;
+  const match2 = /^(?:1\.(\d+)|(\d+))(?:[._][\d_.]*)?$/.exec(text.trim());
+  if (match2 === null)
+    return null;
+  return match2[1] ?? match2[2] ?? null;
+}
 function matchFirst(text, pattern) {
   if (text === null)
     return null;
   const match2 = pattern.exec(text);
   return match2 === null ? null : match2[1];
 }
-var RUNTIME_MANIFESTS, MANIFEST_FILENAMES, NPM_PLACEHOLDER_TEST, REQUIREMENT_SPECIFIER, EXACT_VERSION;
+var RUNTIME_MANIFESTS, MANIFEST_FILENAMES, JVM_BUILD_FILES, NPM_PLACEHOLDER_TEST, REQUIREMENT_SPECIFIER, EXACT_VERSION;
 var init_manifest2 = __esm({
   "../../packages/envspec/dist/manifest.js"() {
     "use strict";
@@ -32586,6 +32869,7 @@ var init_manifest2 = __esm({
       { runtime: "dotnet", files: [] }
     ];
     MANIFEST_FILENAMES = RUNTIME_MANIFESTS.flatMap((m) => m.files).concat(["*.csproj", "*.fsproj", "*.sln"]).sort();
+    JVM_BUILD_FILES = ["build.gradle", "build.gradle.kts", "pom.xml"];
     NPM_PLACEHOLDER_TEST = /^echo\s+["']?Error:\s*no test specified["']?\s*&&\s*exit\s+1$/;
     REQUIREMENT_SPECIFIER = /^[A-Za-z0-9._-]+(\[[A-Za-z0-9._,-]+\])?([<>=!~]=?[A-Za-z0-9._*+-]+(,[<>=!~]=?[A-Za-z0-9._*+-]+)*)?$/;
     EXACT_VERSION = /^v?(\d+(?:\.\d+){0,2})$/;
@@ -32982,7 +33266,7 @@ function deriveFromReader(repo) {
       searched: MANIFEST_FILENAMES,
       detail: `no ecosystem manifest was found at the repo root (looked for ${MANIFEST_FILENAMES.join(", ")}), so the language runtime could not be identified`
     });
-  } else {
+  } else if (runtime !== "jvm" || JVM_BUILD_FILES.some((file) => repo.exists(file))) {
     derivedFrom.add("manifest");
   }
   if (detection.candidates.length > 1) {
@@ -33146,12 +33430,13 @@ function deriveRuntimeVersion(repo, runtime, job) {
   const setup = SETUP_ACTIONS[runtime];
   const searched = [];
   let rangeFound = null;
+  const pin = (raw) => runtime === "jvm" ? javaMajor(raw) : exactVersion(raw);
   if (job !== null && setup !== void 0) {
     const direct = findActionInput(job, setup.action, setup.input);
     if (direct !== null) {
       searched.push(`${job.file} ${setup.action} ${setup.input}`);
       const reduced = reduceExpression(direct.command, job.singletons);
-      const exact = exactVersion(reduced);
+      const exact = pin(reduced);
       if (exact !== null)
         return { value: exact, searched, rangeFound: null };
       if (reduced !== null)
@@ -33160,7 +33445,7 @@ function deriveRuntimeVersion(repo, runtime, job) {
     const viaFile = findActionInput(job, setup.action, setup.fileInput);
     if (viaFile !== null) {
       searched.push(`${job.file} ${setup.action} ${setup.fileInput} -> ${viaFile.command}`);
-      const exact = exactVersion(repo.readText(viaFile.command));
+      const exact = pin(repo.readText(viaFile.command));
       if (exact !== null)
         return { value: exact, searched, rangeFound: null };
     }
@@ -33185,6 +33470,8 @@ function testSearchPaths(runtime, workflowFiles) {
     paths.push("**/*_test.go");
   if (runtime === "ruby")
     paths.push("Gemfile", "Rakefile");
+  if (runtime === "jvm")
+    paths.push(...JVM_BUILD_FILES);
   if (runtime === "unknown")
     paths.push(...MANIFEST_FILENAMES);
   return [...new Set(paths)].sort();
@@ -33202,6 +33489,9 @@ function describeTestSearch(repo, runtime, workflowFiles) {
   if (runtime === "python") {
     return `${ciPart}, and nothing in the repo names a test runner \u2014 no \`[tool.pytest.ini_options]\`, no \`pytest.ini\`, and no pytest dependency in \`pyproject.toml\` or a requirements file`;
   }
+  if (runtime === "jvm" && !JVM_BUILD_FILES.some((file) => repo.exists(file))) {
+    return `${ciPart}, and the repo has Java sources but no build file (${JVM_BUILD_FILES.join(", ")}), so there is no build to run tests with. Compiling the sources with \`javac\` alone would run no tests`;
+  }
   return `${ciPart}, and no ${runtime} test convention applies to this tree`;
 }
 function installSearchPaths(runtime, workflowFiles) {
@@ -33210,6 +33500,8 @@ function installSearchPaths(runtime, workflowFiles) {
     paths.push("package-lock.json", "pnpm-lock.yaml", "yarn.lock");
   if (runtime === "python")
     paths.push("poetry.lock", "pyproject.toml", "requirements.txt", "uv.lock");
+  if (runtime === "jvm")
+    paths.push(...JVM_BUILD_FILES);
   if (runtime === "unknown")
     paths.push(...MANIFEST_FILENAMES);
   return [...new Set(paths)].sort();
@@ -33288,12 +33580,41 @@ var init_dist3 = __esm({
   }
 });
 
+// ../../packages/envrun/dist/gradleTestSummary.js
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync14 } from "fs";
+import { join as join26 } from "path";
+function stageGradleTestSummary(jailHome) {
+  const dir = join26(jailHome, ".gradle", "init.d");
+  mkdirSync5(dir, { recursive: true });
+  writeFileSync14(join26(dir, "terminalhire-test-summary.gradle"), GRADLE_TEST_SUMMARY_INIT);
+}
+var GRADLE_TEST_MARKER, GRADLE_TEST_SUMMARY_INIT;
+var init_gradleTestSummary = __esm({
+  "../../packages/envrun/dist/gradleTestSummary.js"() {
+    "use strict";
+    GRADLE_TEST_MARKER = "terminalhire-gradle-tests:";
+    GRADLE_TEST_SUMMARY_INIT = `// Written by terminalhire (TERM-1122): prints each Test task's counts, because
+// Gradle prints none when every test passes.
+allprojects {
+  tasks.withType(Test).configureEach { task ->
+    def label = task.path
+    task.afterSuite { desc, result ->
+      if (desc.parent == null) {
+        println "${GRADLE_TEST_MARKER} task=\${label} total=\${result.testCount} passed=\${result.successfulTestCount} failed=\${result.failedTestCount} skipped=\${result.skippedTestCount}"
+      }
+    }
+  }
+}
+`;
+  }
+});
+
 // ../../packages/envrun/dist/thrun.js
 import { execFileSync, spawnSync as spawnSync6 } from "child_process";
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, mkdtempSync as mkdtempSync4, rmSync as rmSync9 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync6, mkdtempSync as mkdtempSync4, rmSync as rmSync9 } from "fs";
 import { randomUUID as randomUUID3 } from "crypto";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 function git(repoDir, args, allowNonZero = false) {
   const res = spawnSync6("git", [...args], {
     cwd: repoDir,
@@ -33308,7 +33629,7 @@ function git(repoDir, args, allowNonZero = false) {
   return res.stdout ?? "";
 }
 function collectWorkingDiff(repoDir, opts = {}) {
-  if (!existsSync12(join26(repoDir, ".git"))) {
+  if (!existsSync12(join27(repoDir, ".git"))) {
     throw new ThRunError(`${repoDir} is not a git checkout (no .git). \`th run\` ships the working diff, so it needs a repository to read one from.`);
   }
   const headSha = git(repoDir, ["rev-parse", "HEAD"]).trim();
@@ -33456,7 +33777,7 @@ function credentialFreeHome() {
     return credentialFreeHomeDir;
   let made;
   try {
-    made = mkdtempSync4(join26(tmpdir4(), "th-run-nohome-"));
+    made = mkdtempSync4(join27(tmpdir4(), "th-run-nohome-"));
   } catch (err) {
     throw new RunRefusalError("could not create the empty directory this clone uses as its home, so the clone would read the credentials on this machine instead. That is our environment failing, not your tests: check that the temp directory is writable.", { cause: err });
   }
@@ -33531,7 +33852,7 @@ function cloneTargetAtUnguarded(opts) {
   if (persisted !== null) {
     throw new RunRefusalError(`refusing to clone from a URL carrying ${persisted}: \`git remote add\` writes the source verbatim into .git/config, which is mounted where the repo\u2019s own test command runs. Fetch with the credential out of band so it is never written to disk \u2014 this runner takes one as an HTTP header, which is never persisted.`);
   }
-  mkdirSync5(opts.dest, { recursive: true });
+  mkdirSync6(opts.dest, { recursive: true });
   const runOut = (args) => execFileSync("git", [...gitConfigArgs(), ...args], {
     cwd: opts.dest,
     encoding: "utf8",
@@ -33570,7 +33891,7 @@ function cloneTargetAtUnguarded(opts) {
 }
 function scrubCloneSource(dest, run2) {
   run2(["remote", "remove", "origin"]);
-  rmSync9(join26(dest, ".git", "FETCH_HEAD"), { force: true });
+  rmSync9(join27(dest, ".git", "FETCH_HEAD"), { force: true });
 }
 function publishableTarget(url) {
   if (separatorInTarget(url) !== null)
@@ -33718,6 +34039,9 @@ function refusedRun(fields) {
     containerImage: null,
     containerImageDigest: null,
     leaksClean: null,
+    // Null for the same reason, and never `unobserved`: that word says we tried to take a
+    // census and could not, and here there was nothing to take one of (TERM-1144).
+    leakState: null,
     // A refused run never held a lease, so there is no venue to describe. Same
     // reasoning as `leaksClean` above: null because nothing happened, and it must
     // not read as a venue we looked at and could not name.
@@ -33945,10 +34269,10 @@ async function runVerification(req, ctx) {
       venueIdentity: null
     };
   }
-  const stage = join26(req.scratchRoot, runId);
-  const cloneDir = join26(stage, "clone");
-  const scratch = join26(stage, "scratch");
-  mkdirSync5(scratch, { recursive: true });
+  const stage = join27(req.scratchRoot, runId);
+  const cloneDir = join27(stage, "clone");
+  const scratch = join27(stage, "scratch");
+  mkdirSync6(scratch, { recursive: true });
   assertSafeTargetSha(req.targetSha);
   progress("clone", `${publishableTarget(req.targetRepo)} @ ${req.targetSha.slice(0, 12)}`);
   cloneTargetAt({
@@ -33975,7 +34299,8 @@ async function runVerification(req, ctx) {
   const derived = deriveEnvironmentSpec(cloneDir);
   const spec = req.testCommandOverride === void 0 ? derived : { ...derived, testCommand: req.testCommandOverride };
   progress("derive", `runtime=${spec.runtime} install=${String(spec.installCommand)} test=${String(spec.testCommand)}`);
-  const image = placement.imageFor(spec.runtime, req.image, spec.runtimeVersion);
+  refuseUnbuildableSpec(spec);
+  const image = placement.imageFor(spec.runtime, req.image, spec.runtimeVersion, imageVariantFor(spec));
   const resolved = await resolveLease(placement, runId);
   if (!resolved.ok) {
     return {
@@ -34010,10 +34335,12 @@ async function runVerification(req, ctx) {
   const lease = resolved.lease;
   try {
     buildJail(scratch);
+    if (spec.runtime === "jvm")
+      stageGradleTestSummary(localJailPaths(scratch).jail);
     const venuePaths = await lease.stage({
       cloneDir,
       scratchRoot: scratch,
-      previewDir: join26(stage, "preview"),
+      previewDir: join27(stage, "preview"),
       // On a dispatched run the commit is the statement of what was tested, so
       // it rides with the tree and the venue seam refuses a tree that is not
       // that commit (design §6 item 4, TERM-892 — the guard lives in
@@ -34077,6 +34404,7 @@ async function runVerification(req, ctx) {
       // the operator would sign our name onto their choice.
       imageSource: req.image === void 0 ? "detected" : req.imageOrigin === "operator" ? "operator-declared" : "developer-declared",
       leaksClean: verdict.leaks.clean,
+      leakState: verdict.leaks.state,
       // Built from the LEASE, over the client that ran the steps — never from
       // `req.placement`, which is a request. `venueDescriptor.ts` carries the
       // reasoning and the #735 failure that makes the distinction load-bearing.
@@ -34134,6 +34462,7 @@ var init_thrun = __esm({
     init_execute();
     init_placement();
     init_venue();
+    init_gradleTestSummary();
     init_venueDescriptor();
     init_result();
     ThRunError = class extends Error {
@@ -34377,7 +34706,7 @@ var init_dbplan = __esm({
 // ../../packages/envrun/dist/dbstack.js
 import { spawnSync as spawnSync7 } from "child_process";
 import { randomBytes as randomBytes11 } from "crypto";
-import { mkdirSync as mkdirSync6 } from "fs";
+import { mkdirSync as mkdirSync7 } from "fs";
 function installCommandFor(runner) {
   switch (runner) {
     case "sql":
@@ -34608,7 +34937,7 @@ function startDatabase(req) {
     if (!ready.ok) {
       throw new DbStackError(`INFRASTRUCTURE/INCONCLUSIVE: Postgres never accepted queries at 127.0.0.1:${String(creds.port)} within the readiness window: ${ready.detail}`);
     }
-    const query = (sql) => {
+    const query2 = (sql) => {
       const res = docker2([
         "exec",
         `--env=PGPASSWORD=${creds.password}`,
@@ -34656,7 +34985,7 @@ function startDatabase(req) {
       credentials: creds,
       image,
       readyMs: ready.ms,
-      query,
+      query: query2,
       runOnNetwork,
       teardown
     };
@@ -34719,8 +35048,8 @@ async function installLocalMigrationTooling(opts) {
     };
   }
   const { jail, tmp } = buildJail(opts.scratchRoot);
-  mkdirSync6(jail, { recursive: true });
-  mkdirSync6(tmp, { recursive: true });
+  mkdirSync7(jail, { recursive: true });
+  mkdirSync7(tmp, { recursive: true });
   const spec = {
     profile: "install",
     clone: opts.repoDir,
@@ -35015,6 +35344,7 @@ __export(dist_exports, {
   GOOGLE_JWKS_URL: () => GOOGLE_JWKS_URL,
   HostedVenueError: () => HostedVenueError,
   JWKS_FETCH_TIMEOUT_MS: () => JWKS_FETCH_TIMEOUT_MS,
+  LEAK_STATES: () => LEAK_STATES,
   LOCAL_MEASUREMENT_PREFIX: () => LOCAL_MEASUREMENT_PREFIX,
   LabelWatch: () => LabelWatch,
   MIN_GIT_VERSION_FOR_END_OF_OPTIONS: () => MIN_GIT_VERSION_FOR_END_OF_OPTIONS,
@@ -35048,6 +35378,7 @@ __export(dist_exports, {
   VENUE_GCLOUD_CONFIG: () => VENUE_GCLOUD_CONFIG,
   VENUE_SSH_USER: () => VENUE_SSH_USER,
   VENV_DIR: () => VENV_DIR,
+  VERIFICATION_OUTCOMES: () => VERIFICATION_OUTCOMES,
   VenueRollbackError: () => VenueRollbackError,
   acquireTransactionally: () => acquireTransactionally,
   alembicChainPosition: () => alembicChainPosition,
@@ -35061,6 +35392,7 @@ __export(dist_exports, {
   assertVenueOwnerDeclared: () => assertVenueOwnerDeclared,
   bookkeepingFor: () => bookkeepingFor,
   census: () => census,
+  censusReport: () => censusReport,
   censusTotal: () => censusTotal,
   classifyBootFailure: () => classifyBootFailure,
   classifyProbeFailure: () => classifyProbeFailure,
@@ -35080,6 +35412,7 @@ __export(dist_exports, {
   detectRunner: () => detectRunner,
   endOfOptionsUnsupported: () => endOfOptionsUnsupported,
   ensureVenueServiceCredentials: () => ensureVenueServiceCredentials,
+  exitCodeFor: () => exitCodeFor,
   failureSourceOf: () => failureSourceOf,
   findRunRefusal: () => findRunRefusal,
   gcpBootArgv: () => gcpBootArgv,
@@ -35094,6 +35427,7 @@ __export(dist_exports, {
   identityProbeCommand: () => identityProbeCommand,
   imageForRuntime: () => imageForRuntime,
   imageRepo: () => imageRepo,
+  imageVariantFor: () => imageVariantFor,
   installCommandFor: () => installCommandFor,
   installLocalMigrationTooling: () => installLocalMigrationTooling,
   isBookkeepingTable: () => isBookkeepingTable,
@@ -35123,6 +35457,7 @@ __export(dist_exports, {
   readSchema: () => readSchema,
   recordedApplied: () => recordedApplied,
   refuseSshTransport: () => refuseSshTransport,
+  refuseUnbuildableSpec: () => refuseUnbuildableSpec,
   renderRunReport: () => renderRunReport,
   renderVenueLine: () => renderVenueLine,
   renderVerdictLine: () => renderVerdictLine,
@@ -35209,8 +35544,8 @@ __export(cache_store_exports, {
   updateIndexCache: () => updateIndexCache,
   writeIndexCache: () => writeIndexCache
 });
-import { readFileSync as readFileSync13, writeFileSync as writeFileSync14, renameSync as renameSync5 } from "fs";
-import { join as join27 } from "path";
+import { readFileSync as readFileSync13, writeFileSync as writeFileSync15, renameSync as renameSync5 } from "fs";
+import { join as join28 } from "path";
 import { homedir as homedir13 } from "os";
 function readCacheEntry() {
   try {
@@ -35229,7 +35564,7 @@ function updateIndexCache(patch) {
     ts: Date.now()
   };
   const tmp = `${INDEX_CACHE_FILE}.${process.pid}.${tmpCounter++}.tmp`;
-  writeFileSync14(tmp, JSON.stringify(entry), "utf8");
+  writeFileSync15(tmp, JSON.stringify(entry), "utf8");
   renameSync5(tmp, INDEX_CACHE_FILE);
   return entry;
 }
@@ -35241,8 +35576,8 @@ var init_cache_store = __esm({
   "bin/cache-store.js"() {
     "use strict";
     init_state_dir();
-    TERMINALHIRE_DIR10 = process.env.TERMINALHIRE_DIR || join27(homedir13(), ".terminalhire");
-    INDEX_CACHE_FILE = join27(TERMINALHIRE_DIR10, "index-cache.json");
+    TERMINALHIRE_DIR10 = process.env.TERMINALHIRE_DIR || join28(homedir13(), ".terminalhire");
+    INDEX_CACHE_FILE = join28(TERMINALHIRE_DIR10, "index-cache.json");
     SCHEMA_VERSION2 = 1;
     tmpCounter = 0;
   }
@@ -35442,8 +35777,8 @@ var init_audit2 = __esm({
 init_src();
 import {
   readFileSync as readFileSync14,
-  writeFileSync as writeFileSync15,
-  mkdirSync as mkdirSync7,
+  writeFileSync as writeFileSync16,
+  mkdirSync as mkdirSync8,
   mkdtempSync as mkdtempSync5,
   renameSync as renameSync6,
   existsSync as existsSync13,
@@ -35452,7 +35787,7 @@ import {
   rmSync as rmSync10,
   readdirSync as readdirSync3
 } from "fs";
-import { join as join28, dirname as dirname8, isAbsolute as isAbsolute4, resolve as pathResolve } from "path";
+import { join as join29, dirname as dirname8, isAbsolute as isAbsolute4, resolve as pathResolve } from "path";
 import { createHash as createHash10 } from "crypto";
 import { homedir as homedir14, hostname as osHostname } from "os";
 import { execFile as execFile3, execFileSync as execFileSync2, spawnSync as spawnSync8 } from "child_process";
@@ -35899,10 +36234,10 @@ async function syncFounderVerdicts({
 
 // bin/jpi-claim.js
 init_founder_note_sync();
-var TERMINALHIRE_DIR11 = process.env.TERMINALHIRE_DIR || join28(homedir14(), ".terminalhire");
-var INDEX_CACHE_FILE2 = join28(TERMINALHIRE_DIR11, "index-cache.json");
-var CLAIM_PUSH_MARKER = join28(TERMINALHIRE_DIR11, "claim-push.json");
-var REPO_CONTINUITY_NUDGE_MARKER = join28(TERMINALHIRE_DIR11, "repo-continuity-nudged.json");
+var TERMINALHIRE_DIR11 = process.env.TERMINALHIRE_DIR || join29(homedir14(), ".terminalhire");
+var INDEX_CACHE_FILE2 = join29(TERMINALHIRE_DIR11, "index-cache.json");
+var CLAIM_PUSH_MARKER = join29(TERMINALHIRE_DIR11, "claim-push.json");
+var REPO_CONTINUITY_NUDGE_MARKER = join29(TERMINALHIRE_DIR11, "repo-continuity-nudged.json");
 function readNudgedClaimIds() {
   try {
     const raw = JSON.parse(readFileSync14(REPO_CONTINUITY_NUDGE_MARKER, "utf8"));
@@ -35916,7 +36251,7 @@ function markClaimNudged(id) {
     const ids2 = readNudgedClaimIds();
     ids2.add(id);
     ensureStateDir(TERMINALHIRE_DIR11);
-    writeFileSync15(REPO_CONTINUITY_NUDGE_MARKER, JSON.stringify({ claimIds: [...ids2] }), "utf8");
+    writeFileSync16(REPO_CONTINUITY_NUDGE_MARKER, JSON.stringify({ claimIds: [...ids2] }), "utf8");
   } catch {
   }
 }
@@ -38249,7 +38584,7 @@ async function cmdAttach(id, worktree, branch) {
 function workDirFor(repoFullName, issueNumber) {
   const [owner, repo] = String(repoFullName).split("/");
   const suffix = issueNumber ? `-${issueNumber}` : "";
-  return join28(homedir14(), "terminalhire", "work", `${owner}-${repo}${suffix}`);
+  return join29(homedir14(), "terminalhire", "work", `${owner}-${repo}${suffix}`);
 }
 function startBranchFor(repoFullName, issueNumber) {
   const repo = String(repoFullName).split("/")[1] || "claim";
@@ -38505,7 +38840,7 @@ terminalhire claim: not started \u2014 starting forks ${claim.repoFullName} to y
     );
     process.exit(1);
   }
-  mkdirSync7(join28(homedir14(), "terminalhire", "work"), { recursive: true });
+  mkdirSync8(join29(homedir14(), "terminalhire", "work"), { recursive: true });
   const { createProgress: createProgress2, parseGitProgress: parseGitProgress2, splitProgressChunk: splitProgressChunk2, shStream: shStream2 } = await Promise.resolve().then(() => (init_progress(), progress_exports));
   const progress = createProgress2();
   let forkFullName;
@@ -38633,7 +38968,7 @@ function founderPostingIdOf(claim) {
 }
 function sliceWorkDirFor(claimLocalId) {
   const safe = String(claimLocalId).replace(/[^A-Za-z0-9._-]/g, "-");
-  return join28(homedir14(), "terminalhire", "work", `slice-${safe}`);
+  return join29(homedir14(), "terminalhire", "work", `slice-${safe}`);
 }
 function assertNoBooleanPath(dest, flagName) {
   const last = String(dest).split(/[\\/]/).filter(Boolean).pop();
@@ -38758,9 +39093,9 @@ function writeSliceFiles(destDir, files) {
   const unavailable = [];
   for (const f of files) {
     if (typeof f.content === "string") {
-      const abs = join28(destDir, f.path);
-      mkdirSync7(dirname8(abs), { recursive: true });
-      writeFileSync15(abs, f.content, "utf8");
+      const abs = join29(destDir, f.path);
+      mkdirSync8(dirname8(abs), { recursive: true });
+      writeFileSync16(abs, f.content, "utf8");
       written.push(f.path);
     } else {
       unavailable.push({ path: f.path, reason: f.unavailableReason || "(no reason given)" });
@@ -38794,7 +39129,7 @@ function writeDeliveredBrief(destDir, spec) {
 function ensureExcludedPackDir(destDir) {
   let occupant = null;
   try {
-    occupant = lstatSync3(join28(destDir, BRIEF_DIR));
+    occupant = lstatSync3(join29(destDir, BRIEF_DIR));
   } catch (err) {
     if (err?.code !== "ENOENT") {
       return {
@@ -38809,12 +39144,12 @@ function ensureExcludedPackDir(destDir) {
       reason: `${BRIEF_DIR}/ already exists in the delivered tree, and excluding it would hide that content from your patch`
     };
   }
-  const excludeFile = join28(destDir, ".git", "info", "exclude");
+  const excludeFile = join29(destDir, ".git", "info", "exclude");
   try {
     const existing = existsSync13(excludeFile) ? readFileSync14(excludeFile, "utf8") : "";
     if (!existing.split("\n").includes(BRIEF_EXCLUDE_LINE)) {
-      mkdirSync7(dirname8(excludeFile), { recursive: true });
-      writeFileSync15(
+      mkdirSync8(dirname8(excludeFile), { recursive: true });
+      writeFileSync16(
         excludeFile,
         `${existing}${existing === "" || existing.endsWith("\n") ? "" : "\n"}${BRIEF_EXCLUDE_LINE}
 `,
@@ -38828,9 +39163,9 @@ function ensureExcludedPackDir(destDir) {
 }
 function writePackFile(destDir, relPath, content, what) {
   try {
-    const abs = join28(destDir, relPath);
-    mkdirSync7(dirname8(abs), { recursive: true });
-    writeFileSync15(abs, content, { encoding: "utf8", flag: "wx" });
+    const abs = join29(destDir, relPath);
+    mkdirSync8(dirname8(abs), { recursive: true });
+    writeFileSync16(abs, content, { encoding: "utf8", flag: "wx" });
   } catch (err) {
     return { written: false, reason: `the ${what} could not be written (${err.message})` };
   }
@@ -39245,7 +39580,7 @@ async function cmdSliceFullTier(claims, id, local, fullTierBody, flags, cloneRep
   if (resolvedDir.suffixed) {
     console.log(`terminalhire claim: the usual directory has content \u2014 using ${dest}`);
   }
-  mkdirSync7(dest, { recursive: true });
+  mkdirSync8(dest, { recursive: true });
   const branch = `claim/${String(claim.id).replace(/[^A-Za-z0-9._-]/g, "-")}`;
   let engine;
   try {
@@ -39427,7 +39762,7 @@ async function attemptSliceDelivery(id, flags = {}) {
   if (resolvedDir.suffixed) {
     console.log(`terminalhire claim: the usual directory has content \u2014 using ${finalDest}`);
   }
-  mkdirSync7(dirname8(finalDest), { recursive: true });
+  mkdirSync8(dirname8(finalDest), { recursive: true });
   let dest = mkdtempSync5(`${finalDest}.tmp-`);
   const { written, unavailable } = writeSliceFiles(dest, body.files);
   const branch = `claim/${String(claim.id).replace(/[^A-Za-z0-9._-]/g, "-")}`;
@@ -39968,7 +40303,7 @@ async function cmdSubmit(id, flags = {}) {
   const head = `${ghUser}:${claim.branch}`;
   const title = flags.title || claim.title;
   const noBody = Boolean(flags["no-body"]);
-  const prBodyPath = join28(wt, "PR-BODY.md");
+  const prBodyPath = join29(wt, "PR-BODY.md");
   const bodySource = pickBodySource({
     bodyFileFlag: flags["body-file"],
     noBody,
@@ -40208,7 +40543,7 @@ function readClaimPushMarker() {
 }
 function writeClaimPushMarker(marker) {
   ensureStateDir(TERMINALHIRE_DIR11);
-  writeFileSync15(CLAIM_PUSH_MARKER, JSON.stringify(marker, null, 2) + "\n", "utf8");
+  writeFileSync16(CLAIM_PUSH_MARKER, JSON.stringify(marker, null, 2) + "\n", "utf8");
 }
 function clearClaimPushMarker() {
   try {