token-goat 2.9.30 → 2.9.31

package/dist/{token-goat-chunk-7IN2MKDS.mjs → token-goat-chunk-7EZTZOMC.mjs}

@@ -2,7 +2,11 @@ import { createRequire as __cjsRequire } from 'node:module';
 const require = __cjsRequire(import.meta.url);
 import {
   KNOWN_HARNESS_NAMES
-} from "./token-goat-chunk-U4N3BN2W.mjs";
+} from "./token-goat-chunk-QYHO5CPH.mjs";
+import {
+  findProject,
+  shortFingerprint
+} from "./token-goat-chunk-4GBVPH3D.mjs";
 import {
   registerReset
 } from "./token-goat-chunk-YZAAZU2S.mjs";
@@ -17,269 +21,23 @@ import {
 import {
   atomicWriteText,
   decodeSource,
-  extractErrorMessage,
-  runGit
-} from "./token-goat-chunk-GOLEOXZP.mjs";
-import {
-  canonicalize,
-  foldPath
-} from "./token-goat-chunk-AM5V6GSX.mjs";
+  extractErrorMessage
+} from "./token-goat-chunk-HU4TORC5.mjs";
 import {
-  normalizeDarwinSystemAlias
-} from "./token-goat-chunk-FNFBKLRD.mjs";
+  echoedValue
+} from "./token-goat-chunk-GGGG7RWB.mjs";
 import {
   configPath,
   projectConfigPath
-} from "./token-goat-chunk-VES7EL7O.mjs";
+} from "./token-goat-chunk-CO3UYX6G.mjs";
 import {
   init_define_import_meta_env
 } from "./token-goat-chunk-A37V4PBF.mjs";
 
-// src/fingerprint.ts
+// src/config_project.ts
 init_define_import_meta_env();
-import { createHash } from "node:crypto";
 import * as fs from "node:fs";
-function fingerprintContent(content) {
-  const hash = createHash("sha256");
-  hash.update(typeof content === "string" ? Buffer.from(content, "utf-8") : content);
-  return hash.digest("hex");
-}
-function shortFingerprint(content) {
-  return fingerprintContent(content).slice(0, 16);
-}
-function indexedFileIsGone(filePath) {
-  try {
-    return !fs.statSync(filePath).isFile();
-  } catch (err) {
-    const code = err?.code;
-    return code === "ENOENT" || code === "ENOTDIR";
-  }
-}
-function fingerprintFile(filePath) {
-  let data;
-  try {
-    data = fs.readFileSync(filePath);
-  } catch {
-    return null;
-  }
-  return fingerprintContent(data);
-}
-function fileIsAbsent(filePath) {
-  try {
-    return fs.statSync(filePath, { throwIfNoEntry: false }) === void 0;
-  } catch {
-    return false;
-  }
-}
-
-// src/ocr_languages.ts
-init_define_import_meta_env();
-var DEFAULT_OCR_LANG = "eng";
-var SUPPORTED_OCR_LANG_CODES = [
-  "eng",
-  "fra",
-  "spa",
-  "deu",
-  "ita",
-  "por",
-  "nld",
-  "pol",
-  "rus",
-  "tur",
-  "swe",
-  "ara",
-  "chi_sim",
-  "chi_tra",
-  "jpn",
-  "kor"
-];
-var SUPPORTED_SET = new Set(SUPPORTED_OCR_LANG_CODES);
-function isSupportedOcrLang(lang) {
-  return SUPPORTED_SET.has(lang);
-}
-function resolveOcrLangs(input) {
-  const result = [DEFAULT_OCR_LANG];
-  if (!input) return result;
-  const tokens = input.split(/[+,;\s]+/).map((s) => s.trim().toLowerCase());
-  for (const token of tokens) {
-    if (token && isSupportedOcrLang(token) && !result.includes(token)) {
-      result.push(token);
-    }
-  }
-  return result;
-}
-
-// src/project.ts
-init_define_import_meta_env();
-import * as fs2 from "node:fs";
-import * as os from "node:os";
 import * as path from "node:path";
-var PROJECT_MARKERS = [
-  ".git",
-  "package.json",
-  "pyproject.toml",
-  "Cargo.toml",
-  "go.mod",
-  "shopify.app.toml",
-  "_config.yml",
-  "deno.json",
-  "deno.jsonc"
-];
-var REPO_CONTAINER_THRESHOLD = 3;
-function projectHash(canonicalRoot) {
-  return shortFingerprint(foldPath(canonicalRoot));
-}
-function makeProjectAt(root) {
-  let canonical;
-  try {
-    canonical = canonicalize(root);
-  } catch (exc) {
-    throw new Error(
-      `makeProjectAt: could not resolve path: ${extractErrorMessage(exc)}`,
-      { cause: exc }
-    );
-  }
-  try {
-    const stat = fs2.statSync(canonical);
-    if (!stat.isDirectory()) {
-      throw new Error(`makeProjectAt: path is not a directory: ${canonical}`);
-    }
-  } catch (exc) {
-    if (exc instanceof Error && exc.message.includes("ENOENT")) {
-      throw new Error(`makeProjectAt: path does not exist: ${canonical}`, { cause: exc });
-    }
-    throw exc;
-  }
-  const hash = projectHash(canonical);
-  return { root: canonical, hash, marker: "manual" };
-}
-function isRepoContainer(pathStr) {
-  let nestedRepos = 0;
-  try {
-    const entries = fs2.readdirSync(pathStr, { withFileTypes: true });
-    for (const entry of entries) {
-      if (entry.isDirectory()) {
-        const gitPath = path.join(pathStr, entry.name, ".git");
-        if (fs2.existsSync(gitPath)) {
-          let isGitDir = false;
-          try {
-            isGitDir = fs2.statSync(gitPath).isDirectory();
-          } catch {
-          }
-          if (isGitDir) {
-            nestedRepos++;
-            if (nestedRepos >= REPO_CONTAINER_THRESHOLD) {
-              return true;
-            }
-          }
-        }
-      }
-    }
-  } catch {
-    return false;
-  }
-  return false;
-}
-function markerExists(current, marker) {
-  const markerPath = path.join(current, marker);
-  try {
-    if (!fs2.existsSync(markerPath)) {
-      return false;
-    }
-    const stat = fs2.lstatSync(markerPath);
-    if (!stat.isSymbolicLink()) {
-      return true;
-    }
-    const resolved = fs2.realpathSync(markerPath);
-    const rel = path.relative(path.resolve(current), path.resolve(resolved));
-    return !rel.startsWith("..") && !path.isAbsolute(rel);
-  } catch {
-    return false;
-  }
-}
-function findProject(cwd) {
-  let p;
-  try {
-    p = canonicalize(cwd);
-  } catch {
-    return null;
-  }
-  let sysTemp = null;
-  try {
-    sysTemp = canonicalize(os.tmpdir());
-  } catch {
-  }
-  let current = p;
-  while (true) {
-    if (sysTemp && normalizeDarwinSystemAlias(foldPath(current)) === normalizeDarwinSystemAlias(foldPath(sysTemp))) {
-      break;
-    }
-    for (const marker of PROJECT_MARKERS) {
-      if (markerExists(current, marker)) {
-        if (!isRepoContainer(current)) {
-          return {
-            root: current,
-            hash: projectHash(current),
-            marker
-          };
-        }
-        break;
-      }
-    }
-    const parent = path.dirname(current);
-    if (parent === current) {
-      break;
-    }
-    current = parent;
-  }
-  return null;
-}
-var _displayRootCache = null;
-function getDisplayRoot(explicitRoot) {
-  if (explicitRoot !== void 0) return explicitRoot;
-  const cwd = process.cwd();
-  if (_displayRootCache !== null && _displayRootCache.cwd === cwd) return _displayRootCache.root;
-  const project = findProject(cwd);
-  const root = project !== null ? project.root : void 0;
-  _displayRootCache = { cwd, root };
-  return root;
-}
-registerReset(() => {
-  _displayRootCache = null;
-}, { perRequest: true });
-function isUnderSystemTemp(filePath) {
-  let sysTemp;
-  try {
-    sysTemp = canonicalize(os.tmpdir());
-  } catch {
-    return false;
-  }
-  let target;
-  try {
-    target = canonicalize(filePath);
-  } catch {
-    return false;
-  }
-  const foldedTemp = normalizeDarwinSystemAlias(foldPath(sysTemp));
-  const foldedTarget = normalizeDarwinSystemAlias(foldPath(target));
-  return foldedTarget === foldedTemp || foldedTarget.startsWith(`${foldedTemp}/`);
-}
-function resolveProjectRoot(opts) {
-  const base = opts?.project !== void 0 ? path.resolve(opts.project) : process.cwd();
-  const toplevel = runGit(["rev-parse", "--show-toplevel"], { cwd: base });
-  if (toplevel.exitCode === 0) {
-    const trimmed = toplevel.stdout.trim();
-    if (trimmed.length > 0) return canonicalize(trimmed);
-  }
-  const project = findProject(base);
-  if (project !== null) return project.root;
-  return canonicalize(base);
-}
-
-// src/config_project.ts
-init_define_import_meta_env();
-import * as fs3 from "node:fs";
-import * as path2 from "node:path";
 
 // node_modules/smol-toml/dist/index.js
 init_define_import_meta_env();
@@ -1261,6 +1019,9 @@ var PROJECT_LOCKED_KEYS = [
   "hints.outline_large_documents",
   // Same reasoning one file type over: a repository must not be able to decide, from its own checked-in config, how much of its source a reviewing agent is shown -- neither by turning the skeleton off to bury a declaration in a wall of bodies, nor by leaving it on to withhold the bodies themselves. The user's global config and TOKEN_GOAT_SKELETON_LARGE_SOURCES still set it freely.
   "hints.skeleton_large_sources",
+  // The symbol-aware first-read advice and its size: a repository must not be able to turn off, or turn into a refusal, what an agent is told when it first opens one of the repository's own large files.
+  "hints.first_read_symbol_bytes",
+  "hints.first_read_symbol_policy",
   // The widest blast radius of anything on this list. The fold keys above decide how much of a file an agent is shown; this decides how much of the whole session survives compaction. A checked-in `.token-goat.toml` setting it to a handful of characters would ask the summarizer to discard the session's accumulated state at every compaction boundary, and the loss is silent -- what comes back is a well-formed short summary, not an error. The user's own global config still sets it freely; only the project-supplied layer is refused.
   "compact_assist.summary_budget_chars",
   "image_shrink.max_image_pixels",
@@ -1342,7 +1103,7 @@ function flattenRawValues(raw) {
   return out;
 }
 function readConfigSource(p) {
-  return decodeSource(fs3.readFileSync(p));
+  return decodeSource(fs.readFileSync(p));
 }
 function readConfigToml(p) {
   try {
@@ -1392,8 +1153,8 @@ function configProjectRootFor(dir) {
   const own = findProject(dir);
   let project = own;
   while (project !== null) {
-    if (fs3.existsSync(projectConfigPath(project.root))) return project.root;
-    const parent = path2.dirname(project.root);
+    if (fs.existsSync(projectConfigPath(project.root))) return project.root;
+    const parent = path.dirname(project.root);
     project = parent === project.root ? null : findProject(parent);
   }
   return own?.root ?? dir;
@@ -1413,7 +1174,7 @@ registerReset(() => {
 function getProjectConfigInfo(projectRoot) {
   const root = projectRoot ?? resolveConfigProjectRoot();
   const p = projectConfigPath(root);
-  if (!fs3.existsSync(p)) return null;
+  if (!fs.existsSync(p)) return null;
   const { raw, parseError } = readConfigToml(p);
   if (parseError !== null) return { path: p, keys: [], values: {}, parseError };
   return { path: p, keys: flattenRawKeys(raw), values: flattenRawValues(raw), parseError };
@@ -1440,7 +1201,44 @@ function isAutoTriggerMultiplierExplicit() {
 
 // src/config.ts
 init_define_import_meta_env();
-import * as path3 from "node:path";
+import * as path2 from "node:path";
+
+// src/ocr_languages.ts
+init_define_import_meta_env();
+var DEFAULT_OCR_LANG = "eng";
+var SUPPORTED_OCR_LANG_CODES = [
+  "eng",
+  "fra",
+  "spa",
+  "deu",
+  "ita",
+  "por",
+  "nld",
+  "pol",
+  "rus",
+  "tur",
+  "swe",
+  "ara",
+  "chi_sim",
+  "chi_tra",
+  "jpn",
+  "kor"
+];
+var SUPPORTED_SET = new Set(SUPPORTED_OCR_LANG_CODES);
+function isSupportedOcrLang(lang) {
+  return SUPPORTED_SET.has(lang);
+}
+function resolveOcrLangs(input) {
+  const result = [DEFAULT_OCR_LANG];
+  if (!input) return result;
+  const tokens = input.split(/[+,;\s]+/).map((s) => s.trim().toLowerCase());
+  for (const token of tokens) {
+    if (token && isSupportedOcrLang(token) && !result.includes(token)) {
+      result.push(token);
+    }
+  }
+  return result;
+}
 
 // src/own_lookup.ts
 init_define_import_meta_env();
@@ -1454,6 +1252,7 @@ init_define_import_meta_env();
 
 // src/config_defaults.ts
 init_define_import_meta_env();
+var RETIRED_CONFIG_KEYS = /* @__PURE__ */ new Set(["stats.record_zero_savings", "image_shrink.ocr_enabled"]);
 var CONFIG_DEFAULTS = {
   compact_assist: {
     enabled: true,
@@ -1472,7 +1271,8 @@ var CONFIG_DEFAULTS = {
     cache_min_bytes: 512,
     cache_max_file_count: 4096,
     cache_max_bytes: 16 * 1024 * 1024,
-    cache_max_bytes_per_output: 50 * 1024 * 1024,
+    // A quarter of cache_max_bytes: the loader caps the per-output value at the total, so a larger default (it was 50 MiB against a 16 MiB total) was never in effect.
+    cache_max_bytes_per_output: 4 * 1024 * 1024,
     // Measured against the filter test-fixture corpus (424 apply() calls, 298 with bytesSaved > 0): net-of-marker savings (bytesSaved - ~70-79B marker cost) is <= 0 for 130/298 (44%) of "compressed" results and <= 100 for 170/298 (57%), while the real-win half sits at p75=393B / p90=952B net. 100 kills the marker-doesn't-even-pay-for-itself tier without touching genuine wins.
     min_net_savings_bytes: 100,
     // Extends the per-file already-served elision (which only reaches cat/head/tail/sed/awk-shaped reads) to every other Bash command's output -- npm test, git, rg, build runs -- matched against a session-wide served-output list instead of a per-file one. On by default: it goes through the same isRewriteWorthwhile net-benefit gate as every other rewrite here, so it never ships a notice that costs more than the lines it withholds.
@@ -1516,7 +1316,6 @@ var CONFIG_DEFAULTS = {
     // 16,000,000 used to reject a routine 24MP DSLR/phone photo outright -- the exact input this feature exists to shrink -- while the engine's own decode ceiling (MAX_DECODED_BYTES in image_engine.ts, 256MB at 4 bytes/pixel for a single frame) sits at 67,108,864px. 64,000,000 covers cameras well past 24MP (including 48MP phone sensors) with ~4.9% margin below that hard ceiling, which assertDecodableSize enforces independently of this value on every decode regardless of what this header check allows through. Measured on this engine (2026-09-17): a 24MP PNG decodes+shrinks in ~370ms, 60,000,516px in ~920ms, and 67,108,864px (the ceiling itself) in ~760ms -- all comfortably fast, so the new value is chosen for coverage headroom under the ceiling, not for decode-time cost. Decode time is not the cost that binds, though: memory is. This value is read off a header before anything is decoded, so what it really sets is how large a buffer a file's own declared dimensions may talk this hook into allocating -- at 4 bytes per pixel, raising it from 16,000,000 raised that peak from ~64MB to ~256MB, which is why it now sits flush against MAX_DECODED_BYTES rather than comfortably below it. And on the JPEG path there is no assertDecodableSize call at all: decodeJpeg hands the buffer to jpeg-js, so a JPEG decode is bounded by whatever maxResolutionInMP/maxMemoryUsageInMB that call passes -- a bound this codebase states only because decodeJpeg passes both explicitly rather than inheriting jpeg-js's own 100MP default, which is looser than the 67.1MP MAX_DECODED_BYTES allows.
     max_image_pixels: 64e6,
     screenshot_redirect: true,
-    ocr_enabled: true,
     // Confidence is Tesseract's own 0-100 mean-word-confidence score. 65 is a deliberately conservative floor: a real screenshot of terminal/code/prose text routinely scores 85+, while a photo with an incidental sign or logo in frame scores much lower and noisier -- padding the threshold below the terminal/code norm still comfortably excludes photographic false positives without needing a second heuristic.
     ocr_min_confidence: 65,
     ocr_lang: DEFAULT_OCR_LANG,
@@ -1535,9 +1334,6 @@ var CONFIG_DEFAULTS = {
     enabled: true,
     max_tokens: 25e3
   },
-  stats: {
-    record_zero_savings: false
-  },
   hints: {
     quiet_hours: "",
     json_sidecar: false,
@@ -1558,10 +1354,21 @@ var CONFIG_DEFAULTS = {
     git_hint_max_ms: 50,
     min_session_hint_savings_bytes: 512,
     pre_skill_advisory: true,
+    stop_verification_advisory: true,
+    agent_receipt: true,
     context_threshold_advisory: true,
     diff_hint_min_tokens_saved: 1e3,
     // Base for the pressure-scaled first-read deny gate in hooks_read.ts (large file, never read before). Matches that gate's long-tuned 500KB threshold at 'cool' context pressure; warm/hot/ critical scale it down from there so the same read gets redirected to a surgical read sooner once the context window is nearly full.
     large_read_redirect_bytes: 512e3,
+    // Smallest whole-file first read of an indexed file that draws the symbol-aware advice; 0 turns the check off.
+    first_read_symbol_bytes: 5e4,
+    // Advice, not refusal: `warn` notes the file's size and symbols, `deny` refuses the whole-file read, `off` says nothing.
+    first_read_symbol_policy: "warn",
+    // A refusal that costs one retry, against a file overwritten with a placeholder that costs a re-read, a re-write and a debugging loop.
+    write_blind_drop: "deny",
+    // A hint costs one sentence, against a whole file sent again as output and a second copy of every symbol in the index.
+    write_sibling_copy: true,
+    write_sibling_copy_allow: [],
     reread_deny: true,
     // Matches hooks_read.ts's previously-hardcoded REREAD_DENY_BYTES (50 * 1024) so wiring this key up as the real gate for that logic does not silently change default behavior for existing users -- see the reread_deny/reread_deny_min_bytes fix's commit message.
     reread_deny_min_bytes: 51200,
@@ -1675,7 +1482,6 @@ function defaultConfig() {
     screenshot: getDefaultConfig("screenshot"),
     repomap: getDefaultConfig("repomap"),
     overflow_guard: getDefaultConfig("overflow_guard"),
-    stats: getDefaultConfig("stats"),
     hints: getDefaultConfig("hints"),
     hooks: getDefaultConfig("hooks"),
     webfetch: getDefaultConfig("webfetch"),
@@ -1711,6 +1517,12 @@ function validatedFloat(raw, def, min, max) {
 function validatedVisionTier(raw, def) {
   return raw === "standard" || raw === "high" ? raw : def;
 }
+function validatedEnum(key, raw, def) {
+  return typeof raw === "string" && (ENUM_FIELD_VALUES[key] ?? []).includes(raw) ? raw : def;
+}
+function envEnum(key, name, def) {
+  return validatedEnum(key, process.env[name], def);
+}
 function validatedNativeHooksMode(raw, def) {
   return raw === "auto" || raw === "off" ? raw : def;
 }
@@ -1787,6 +1599,7 @@ var NUMERIC_FIELD_BOUNDS = {
   "hints.min_session_hint_savings_bytes": { min: 0, max: 1e6 },
   "hints.diff_hint_min_tokens_saved": { min: 0, max: 1e5 },
   "hints.large_read_redirect_bytes": { min: 0, max: 1e8 },
+  "hints.first_read_symbol_bytes": { min: 0, max: 1e8 },
   "hints.reread_deny_min_bytes": { min: 0, max: 1e8 },
   "hints.truncated_read_min_lines": { min: 0, max: 1e6 },
   "hints.protect_recent_reads": { min: 0, max: 100 },
@@ -1815,7 +1628,7 @@ var NUMERIC_FIELD_BOUNDS = {
 };
 function boundsOf(key) {
   const b = ownGet(NUMERIC_FIELD_BOUNDS, key);
-  if (!b) throw new Error(`token-goat: no NUMERIC_FIELD_BOUNDS entry for '${key}'`);
+  if (!b) throw new Error(`token-goat: no NUMERIC_FIELD_BOUNDS entry for ${echoedValue(key)}`);
   return [b.min, b.max];
 }
 function walkGetNumeric(obj, parts) {
@@ -1845,7 +1658,9 @@ var ENUM_FIELD_VALUES = {
   "image_shrink.ocr_lang": [...SUPPORTED_OCR_LANG_CODES],
   // Deliberately has no entry above `normal`. This table is what `config set` checks; a hand-edited TOML bypasses it, which is why resolveWorkerPriority (process_priority.ts) maps an unrecognized value back to the default rather than trusting whatever the file said.
   "worker.priority": ["below_normal", "low", "normal"],
-  "hooks.native": ["auto", "off"]
+  "hooks.native": ["auto", "off"],
+  "hints.first_read_symbol_policy": ["warn", "deny", "off"],
+  "hints.write_blind_drop": ["deny", "warn", "off"]
 };
 function validateEnumField(fieldKey, value) {
   if (fieldKey === "image_shrink.ocr_lang") {
@@ -2011,6 +1826,15 @@ function resolveConfigKeyLayer(key, effectiveValue, cfg, projectInfo) {
   if (rawValueEquals(rawValue, effectiveValue)) return { layer: "project", path: projectInfo.path };
   return { layer: "project-invalid", path: projectInfo.path, rawValue, effectiveValue, reason: rejectionReason(key, rawValue, effectiveValue, cfg) };
 }
+function globalValueRejection(key, rawValue, persistedCfg) {
+  let eff = persistedCfg;
+  for (const part of key.split(".")) {
+    if (eff === null || typeof eff !== "object" || !Object.prototype.hasOwnProperty.call(eff, part)) return null;
+    eff = eff[part];
+  }
+  if (rawValueEquals(rawValue, eff)) return null;
+  return rejectionReason(key, rawValue, eff, persistedCfg);
+}
 function loadConfig(projectRoot) {
   const p = configPath();
   const root = projectRoot ?? resolveConfigProjectRoot();
@@ -2166,12 +1990,10 @@ function _buildConfig(raw, projectRaw = {}) {
   is_cfg.jpeg_quality = validatedInt(is_raw["jpeg_quality"], is_cfg.jpeg_quality, ...boundsOf("image_shrink.jpeg_quality"));
   is_cfg.max_image_pixels = validatedIntWithLegacySentinel(is_raw["max_image_pixels"], is_cfg.max_image_pixels, 16e6, ...boundsOf("image_shrink.max_image_pixels"));
   is_cfg.screenshot_redirect = validatedBool(is_raw["screenshot_redirect"], is_cfg.screenshot_redirect);
-  is_cfg.ocr_enabled = validatedBool(is_raw["ocr_enabled"], is_cfg.ocr_enabled);
   is_cfg.ocr_min_confidence = validatedInt(is_raw["ocr_min_confidence"], is_cfg.ocr_min_confidence, ...boundsOf("image_shrink.ocr_min_confidence"));
   is_cfg.ocr_lang = validatedOcrLang(is_raw["ocr_lang"], is_cfg.ocr_lang);
   is_cfg.vision_tier = validatedVisionTier(is_raw["vision_tier"], is_cfg.vision_tier);
   is_cfg.max_image_pixels = envInt("TOKEN_GOAT_MAX_IMAGE_PIXELS", is_cfg.max_image_pixels, ...boundsOf("image_shrink.max_image_pixels"));
-  is_cfg.ocr_enabled = envBool("TOKEN_GOAT_OCR_ENABLED", is_cfg.ocr_enabled);
   is_cfg.ocr_lang = validatedOcrLang(process.env["TOKEN_GOAT_OCR_LANG"], is_cfg.ocr_lang);
   is_cfg.vision_tier = validatedVisionTier(process.env["TOKEN_GOAT_VISION_TIER"], is_cfg.vision_tier);
   const sc_raw = section(raw, "screenshot");
@@ -2191,9 +2013,6 @@ function _buildConfig(raw, projectRaw = {}) {
   og.max_tokens = validatedInt(og_raw["max_tokens"], og.max_tokens, ...boundsOf("overflow_guard.max_tokens"));
   og.enabled = envBool("TOKEN_GOAT_OVERFLOW_GUARD", og.enabled);
   og.max_tokens = envInt("TOKEN_GOAT_OVERFLOW_MAX_TOKENS", og.max_tokens, ...boundsOf("overflow_guard.max_tokens"));
-  const st_raw = section(raw, "stats");
-  const st = getDefaultConfig("stats");
-  st.record_zero_savings = validatedBool(st_raw["record_zero_savings"], st.record_zero_savings);
   const hi_raw = section(raw, "hints");
   const hi = getDefaultConfig("hints");
   hi.quiet_hours = validatedStr(hi_raw["quiet_hours"], hi.quiet_hours);
@@ -2219,9 +2038,16 @@ function _buildConfig(raw, projectRaw = {}) {
   hi.git_hint_max_ms = validatedInt(hi_raw["git_hint_max_ms"], hi.git_hint_max_ms, ...boundsOf("hints.git_hint_max_ms"));
   hi.min_session_hint_savings_bytes = validatedInt(hi_raw["min_session_hint_savings_bytes"], hi.min_session_hint_savings_bytes, ...boundsOf("hints.min_session_hint_savings_bytes"));
   hi.pre_skill_advisory = validatedBool(hi_raw["pre_skill_advisory"], hi.pre_skill_advisory);
+  hi.stop_verification_advisory = validatedBool(hi_raw["stop_verification_advisory"], hi.stop_verification_advisory);
+  hi.agent_receipt = validatedBool(hi_raw["agent_receipt"], hi.agent_receipt);
   hi.context_threshold_advisory = validatedBool(hi_raw["context_threshold_advisory"], hi.context_threshold_advisory);
   hi.diff_hint_min_tokens_saved = validatedInt(hi_raw["diff_hint_min_tokens_saved"], hi.diff_hint_min_tokens_saved, ...boundsOf("hints.diff_hint_min_tokens_saved"));
   hi.large_read_redirect_bytes = validatedIntWithLegacySentinel(hi_raw["large_read_redirect_bytes"], hi.large_read_redirect_bytes, 45e3, ...boundsOf("hints.large_read_redirect_bytes"));
+  hi.first_read_symbol_bytes = validatedInt(hi_raw["first_read_symbol_bytes"], hi.first_read_symbol_bytes, ...boundsOf("hints.first_read_symbol_bytes"));
+  hi.first_read_symbol_policy = validatedEnum("hints.first_read_symbol_policy", hi_raw["first_read_symbol_policy"], hi.first_read_symbol_policy);
+  hi.write_blind_drop = validatedEnum("hints.write_blind_drop", hi_raw["write_blind_drop"], hi.write_blind_drop);
+  hi.write_sibling_copy = validatedBool(hi_raw["write_sibling_copy"], hi.write_sibling_copy);
+  hi.write_sibling_copy_allow = validatedStrList(hi_raw["write_sibling_copy_allow"], hi.write_sibling_copy_allow);
   hi.reread_deny = validatedBool(hi_raw["reread_deny"], hi.reread_deny);
   hi.reread_deny_min_bytes = validatedIntWithLegacySentinel(hi_raw["reread_deny_min_bytes"], hi.reread_deny_min_bytes, 2048, ...boundsOf("hints.reread_deny_min_bytes"));
   hi.stable_doc_compacts = validatedBool(hi_raw["stable_doc_compacts"], hi.stable_doc_compacts);
@@ -2255,6 +2081,10 @@ function _buildConfig(raw, projectRaw = {}) {
   hi.min_session_hint_savings_bytes = envInt("TOKEN_GOAT_SESSION_HINT_MIN_BYTES", hi.min_session_hint_savings_bytes, ...boundsOf("hints.min_session_hint_savings_bytes"));
   hi.reread_deny = envBool("TOKEN_GOAT_REREAD_DENY", hi.reread_deny);
   hi.reread_deny_min_bytes = envInt("TOKEN_GOAT_REREAD_DENY_MIN_BYTES", hi.reread_deny_min_bytes, ...boundsOf("hints.reread_deny_min_bytes"));
+  hi.first_read_symbol_bytes = envInt("TOKEN_GOAT_FIRST_READ_SYMBOL_BYTES", hi.first_read_symbol_bytes, ...boundsOf("hints.first_read_symbol_bytes"));
+  hi.first_read_symbol_policy = envEnum("hints.first_read_symbol_policy", "TOKEN_GOAT_FIRST_READ_SYMBOL_POLICY", hi.first_read_symbol_policy);
+  hi.write_blind_drop = envEnum("hints.write_blind_drop", "TOKEN_GOAT_WRITE_BLIND_DROP", hi.write_blind_drop);
+  hi.write_sibling_copy = envBool("TOKEN_GOAT_WRITE_SIBLING_COPY", hi.write_sibling_copy);
   hi.protect_recent_reads = envInt("TOKEN_GOAT_PROTECT_RECENT_READS", hi.protect_recent_reads, ...boundsOf("hints.protect_recent_reads"));
   hi.truncated_read_min_lines = envInt("TOKEN_GOAT_TRUNCATED_READ_MIN_LINES", hi.truncated_read_min_lines, ...boundsOf("hints.truncated_read_min_lines"));
   hi.diff_hint_min_tokens_saved = envInt("TOKEN_GOAT_DIFF_HINT_MIN_TOKENS_SAVED", hi.diff_hint_min_tokens_saved, ...boundsOf("hints.diff_hint_min_tokens_saved"));
@@ -2268,6 +2098,8 @@ function _buildConfig(raw, projectRaw = {}) {
   hi.skeleton_large_sources = envBool("TOKEN_GOAT_SKELETON_LARGE_SOURCES", hi.skeleton_large_sources);
   hi.context_threshold_advisory = envBool("TOKEN_GOAT_CONTEXT_THRESHOLD_ADVISORY", hi.context_threshold_advisory);
   hi.pre_skill_advisory = envBool("TOKEN_GOAT_PRE_SKILL_ADVISORY", hi.pre_skill_advisory);
+  hi.stop_verification_advisory = envBool("TOKEN_GOAT_STOP_VERIFICATION_ADVISORY", hi.stop_verification_advisory);
+  hi.agent_receipt = envBool("TOKEN_GOAT_AGENT_RECEIPT", hi.agent_receipt);
   hi.quiet_hours = envStr("TOKEN_GOAT_QUIET_HOURS", hi.quiet_hours);
   const triggers_raw = hi_raw["prompt_triggers"];
   if (Array.isArray(triggers_raw)) {
@@ -2354,7 +2186,7 @@ function _buildConfig(raw, projectRaw = {}) {
   mcp.confine_reads_to_project_root = validatedBool(mcp_raw["confine_reads_to_project_root"], mcp.confine_reads_to_project_root);
   mcp.confine_reads_to_project_root = envBool("TOKEN_GOAT_MCP_CONFINE_READS", mcp.confine_reads_to_project_root);
   mcp.allowed_roots = validatedStrList(mcp_raw["allowed_roots"], mcp.allowed_roots);
-  mcp.allowed_roots = envStrList("TOKEN_GOAT_MCP_ALLOWED_ROOTS", mcp.allowed_roots, path3.delimiter);
+  mcp.allowed_roots = envStrList("TOKEN_GOAT_MCP_ALLOWED_ROOTS", mcp.allowed_roots, path2.delimiter);
   const hs_raw = section(raw, "hint_stats");
   const hs = getDefaultConfig("hint_stats");
   hs.suppress_threshold_pct = validatedInt(hs_raw["suppress_threshold_pct"], hs.suppress_threshold_pct, ...boundsOf("hint_stats.suppress_threshold_pct"));
@@ -2380,7 +2212,6 @@ function _buildConfig(raw, projectRaw = {}) {
     screenshot: sc_cfg,
     repomap: rm,
     overflow_guard: og,
-    stats: st,
     hints: hi,
     hooks: hk,
     webfetch: wf,
@@ -2414,7 +2245,6 @@ var CONFIG_KEY_ENV_OVERRIDES = {
   "skill_preservation.pre_skill_enabled": ["TOKEN_GOAT_PRE_SKILL"],
   "skill_preservation.orphan_sweep_enabled": ["TOKEN_GOAT_ORPHAN_SWEEP"],
   "image_shrink.max_image_pixels": ["TOKEN_GOAT_MAX_IMAGE_PIXELS"],
-  "image_shrink.ocr_enabled": ["TOKEN_GOAT_OCR_ENABLED"],
   "image_shrink.ocr_lang": ["TOKEN_GOAT_OCR_LANG"],
   "image_shrink.vision_tier": ["TOKEN_GOAT_VISION_TIER"],
   "screenshot.block_private_targets": ["TOKEN_GOAT_SCREENSHOT_BLOCK_PRIVATE_TARGETS"],
@@ -2430,6 +2260,10 @@ var CONFIG_KEY_ENV_OVERRIDES = {
   "hints.write_rewrite_min_lines": ["TOKEN_GOAT_WRITE_REWRITE_MIN_LINES"],
   "hints.write_rewrite_unchanged_pct": ["TOKEN_GOAT_WRITE_REWRITE_UNCHANGED_PCT"],
   "hints.large_read_redirect_bytes": ["TOKEN_GOAT_LARGE_READ_BYTES"],
+  "hints.first_read_symbol_bytes": ["TOKEN_GOAT_FIRST_READ_SYMBOL_BYTES"],
+  "hints.first_read_symbol_policy": ["TOKEN_GOAT_FIRST_READ_SYMBOL_POLICY"],
+  "hints.write_blind_drop": ["TOKEN_GOAT_WRITE_BLIND_DROP"],
+  "hints.write_sibling_copy": ["TOKEN_GOAT_WRITE_SIBLING_COPY"],
   "hints.warn_unbalanced_shell_quoting": ["TOKEN_GOAT_WARN_UNBALANCED_SHELL_QUOTING"],
   "hints.deny_bash_double_backslash": ["TOKEN_GOAT_DENY_BASH_DOUBLE_BACKSLASH"],
   "hints.serve_diff_on_reread": ["TOKEN_GOAT_SERVE_DIFF_ON_REREAD"],
@@ -2457,6 +2291,8 @@ var CONFIG_KEY_ENV_OVERRIDES = {
   "hints.skeleton_large_sources": ["TOKEN_GOAT_SKELETON_LARGE_SOURCES"],
   "hints.context_threshold_advisory": ["TOKEN_GOAT_CONTEXT_THRESHOLD_ADVISORY"],
   "hints.pre_skill_advisory": ["TOKEN_GOAT_PRE_SKILL_ADVISORY"],
+  "hints.stop_verification_advisory": ["TOKEN_GOAT_STOP_VERIFICATION_ADVISORY"],
+  "hints.agent_receipt": ["TOKEN_GOAT_AGENT_RECEIPT"],
   "hints.quiet_hours": ["TOKEN_GOAT_QUIET_HOURS"],
   "hooks.latency_budget_ms": ["TOKEN_GOAT_HOOK_LATENCY_BUDGET_MS"],
   "hooks.server": ["TOKEN_GOAT_HOOK_SERVER"],
@@ -2568,7 +2404,6 @@ function saveConfig(config, explicitKeys = []) {
       jpeg_quality: is_cfg.jpeg_quality,
       max_image_pixels: is_cfg.max_image_pixels,
       screenshot_redirect: is_cfg.screenshot_redirect,
-      ocr_enabled: is_cfg.ocr_enabled,
       ocr_min_confidence: is_cfg.ocr_min_confidence,
       ocr_lang: is_cfg.ocr_lang,
       vision_tier: is_cfg.vision_tier
@@ -2585,9 +2420,6 @@ function saveConfig(config, explicitKeys = []) {
       enabled: config.overflow_guard.enabled,
       max_tokens: config.overflow_guard.max_tokens
     },
-    stats: {
-      record_zero_savings: config.stats.record_zero_savings
-    },
     hints: {
       quiet_hours: config.hints.quiet_hours,
       json_sidecar: config.hints.json_sidecar,
@@ -2606,9 +2438,16 @@ function saveConfig(config, explicitKeys = []) {
       git_hint_max_ms: config.hints.git_hint_max_ms,
       min_session_hint_savings_bytes: config.hints.min_session_hint_savings_bytes,
       pre_skill_advisory: config.hints.pre_skill_advisory,
+      stop_verification_advisory: config.hints.stop_verification_advisory,
+      agent_receipt: config.hints.agent_receipt,
       context_threshold_advisory: config.hints.context_threshold_advisory,
       diff_hint_min_tokens_saved: config.hints.diff_hint_min_tokens_saved,
       large_read_redirect_bytes: config.hints.large_read_redirect_bytes,
+      first_read_symbol_bytes: config.hints.first_read_symbol_bytes,
+      first_read_symbol_policy: config.hints.first_read_symbol_policy,
+      write_blind_drop: config.hints.write_blind_drop,
+      write_sibling_copy: config.hints.write_sibling_copy,
+      write_sibling_copy_allow: config.hints.write_sibling_copy_allow,
       reread_deny: config.hints.reread_deny,
       reread_deny_min_bytes: config.hints.reread_deny_min_bytes,
       stable_doc_compacts: config.hints.stable_doc_compacts,
@@ -2701,27 +2540,18 @@ function saveConfig(config, explicitKeys = []) {
 export {
   parse,
   stringify,
-  fingerprintContent,
-  shortFingerprint,
-  indexedFileIsGone,
-  fingerprintFile,
-  fileIsAbsent,
   DEFAULT_OCR_LANG,
   SUPPORTED_OCR_LANG_CODES,
   isSupportedOcrLang,
   resolveOcrLangs,
   ownGet,
+  RETIRED_CONFIG_KEYS,
   defaultConfig,
-  projectHash,
-  makeProjectAt,
-  findProject,
-  getDisplayRoot,
-  isUnderSystemTemp,
-  resolveProjectRoot,
   PROJECT_LOCKED_SECTIONS,
   PROJECT_LOCKED_KEYS,
   lastProjectConfigLockedKeys,
   readConfigSource,
+  readConfigToml,
   withConfigProjectRoot,
   configProjectRootFor,
   getProjectConfigInfo,
@@ -2731,8 +2561,10 @@ export {
   getLastConfigParseError,
   getLastProjectConfigParseError,
   resolveConfigKeyLayer,
+  globalValueRejection,
   loadConfig,
   invalidateConfigCache,
+  buildPersistedConfig,
   loadPersistedConfig,
   hookServerEnabled,
   nativeHooksEnabled,