truecourse 0.6.1 → 0.6.6-next.0

package/cli.mjs

@@ -973,7 +973,7 @@ var require_command = __commonJS({
     var EventEmitter2 = __require("node:events").EventEmitter;
     var childProcess = __require("node:child_process");
     var path60 = __require("node:path");
-    var fs50 = __require("node:fs");
+    var fs51 = __require("node:fs");
     var process2 = __require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -1906,10 +1906,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
           const localBin = path60.resolve(baseDir, baseName);
-          if (fs50.existsSync(localBin)) return localBin;
+          if (fs51.existsSync(localBin)) return localBin;
           if (sourceExt.includes(path60.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext2) => fs50.existsSync(`${localBin}${ext2}`)
+            (ext2) => fs51.existsSync(`${localBin}${ext2}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -1921,7 +1921,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs50.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs51.realpathSync(this._scriptPath);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
@@ -3492,7 +3492,9 @@ var require_src = __commonJS({
 
 // node_modules/.pnpm/@clack+core@1.2.0/node_modules/@clack/core/dist/index.mjs
 import { stdout as S, stdin as $ } from "node:process";
+import * as _ from "node:readline";
 import P from "node:readline";
+import { ReadStream as D } from "node:tty";
 function d(r, t2, e) {
   if (!e.some((o) => !o.disabled)) return r;
   const s = r + t2, i = Math.max(e.length - 1, 0), n = s < 0 ? i : s > i ? 0 : s;
@@ -3518,6 +3520,27 @@ function w(r, t2) {
   const e = r;
   e.isTTY && e.setRawMode(t2);
 }
+function z({ input: r = $, output: t2 = S, overwrite: e = true, hideCursor: s = true } = {}) {
+  const i = _.createInterface({ input: r, output: t2, prompt: "", tabSize: 1 });
+  _.emitKeypressEvents(r, i), r instanceof D && r.isTTY && r.setRawMode(true);
+  const n = (o, { name: a, sequence: h }) => {
+    const l = String(o);
+    if (V([l, a, h], "cancel")) {
+      s && t2.write(import_sisteransi.cursor.show), process.exit(0);
+      return;
+    }
+    if (!e) return;
+    const f2 = a === "return" ? 0 : -1, v = a === "return" ? -1 : 0;
+    _.moveCursor(t2, f2, v, () => {
+      _.clearLine(t2, 1, () => {
+        r.once("keypress", n);
+      });
+    });
+  };
+  return s && t2.write(import_sisteransi.cursor.hide), r.once("keypress", n), () => {
+    r.off("keypress", n), s && t2.write(import_sisteransi.cursor.show), r instanceof D && r.isTTY && !Y && r.setRawMode(false), i.terminal = false, i.close();
+  };
+}
 function R(r, t2, e, s = e) {
   const i = O(r ?? S);
   return wrapAnsi(t2, i - e.length, { hard: true, trim: false }).split(`
@@ -3711,7 +3734,7 @@ import P2 from "node:process";
 function Ze() {
   return P2.platform !== "win32" ? P2.env.TERM !== "linux" : !!P2.env.CI || !!P2.env.WT_SESSION || !!P2.env.TERMINUS_SUBLIME || P2.env.ConEmuTask === "{cmd::Cmder}" || P2.env.TERM_PROGRAM === "Terminus-Sublime" || P2.env.TERM_PROGRAM === "vscode" || P2.env.TERM === "xterm-256color" || P2.env.TERM === "alacritty" || P2.env.TERMINAL_EMULATOR === "JetBrains-JediTerm";
 }
-var import_sisteransi2, ee, w2, _e, oe, ue, F, le, d2, E2, Ie, Ee, z2, H2, te, U, J, xe, se, ce, Ge, $e, de, Oe, he, pe, me, ge, V2, ye, et2, Y2, ot2, O2, pt, mt, gt, Ve, re, _t, je;
+var import_sisteransi2, ee, ae, w2, _e, oe, ue, F, le, d2, E2, Ie, Ee, z2, H2, te, U, J, xe, se, ce, Ge, $e, de, Oe, he, pe, me, ge, V2, ye, et2, Y2, ot2, O2, pt, mt, gt, Ct, fe, Ve, re, _t, je;
 var init_dist4 = __esm({
   "node_modules/.pnpm/@clack+prompts@1.2.0/node_modules/@clack/prompts/dist/index.mjs"() {
     init_dist3();
@@ -3720,6 +3743,7 @@ var init_dist4 = __esm({
     init_dist2();
     import_sisteransi2 = __toESM(require_src(), 1);
     ee = Ze();
+    ae = () => process.env.CI === "true";
     w2 = (e, i) => ee ? e : i;
     _e = w2("\u25C6", "*");
     oe = w2("\u25A0", "x");
@@ -3796,7 +3820,7 @@ var init_dist4 = __esm({
       }
       if (f2 > $2) {
         let b = 0, x = 0, G2 = f2;
-        const M2 = e - v, R2 = (j2, D) => et2(h, G2, j2, D, $2);
+        const M2 = e - v, R2 = (j2, D2) => et2(h, G2, j2, D2, $2);
         m ? ({ lineCount: G2, removals: b } = R2(0, M2), G2 > $2 && ({ lineCount: G2, removals: x } = R2(M2 + 1, h.length))) : ({ lineCount: G2, removals: x } = R2(M2 + 1, h.length), G2 > $2 && ({ lineCount: G2, removals: b } = R2(0, M2))), b > 0 && (m = true, h.splice(0, b)), x > 0 && (g = true, h.splice(h.length - x, x));
       }
       const C3 = [];
@@ -3875,6 +3899,59 @@ ${t("gray", E2)}  ` : "";
 
 `);
     };
+    Ct = (e) => t("magenta", e);
+    fe = ({ indicator: e = "dots", onCancel: i, output: s = process.stdout, cancelMessage: r, errorMessage: u2, frames: n = ee ? ["\u25D2", "\u25D0", "\u25D3", "\u25D1"] : ["\u2022", "o", "O", "0"], delay: o = ee ? 80 : 120, signal: c2, ...a } = {}) => {
+      const l = ae();
+      let $2, y, p2 = false, m = false, g = "", S2, h = performance.now();
+      const f2 = O(s), v = a?.styleFrame ?? Ct, T = (_2) => {
+        const A2 = _2 > 1 ? u2 ?? u.messages.error : r ?? u.messages.cancel;
+        m = _2 === 1, p2 && (W(A2, _2), m && typeof i == "function" && i());
+      }, C3 = () => T(2), b = () => T(1), x = () => {
+        process.on("uncaughtExceptionMonitor", C3), process.on("unhandledRejection", C3), process.on("SIGINT", b), process.on("SIGTERM", b), process.on("exit", T), c2 && c2.addEventListener("abort", b);
+      }, G2 = () => {
+        process.removeListener("uncaughtExceptionMonitor", C3), process.removeListener("unhandledRejection", C3), process.removeListener("SIGINT", b), process.removeListener("SIGTERM", b), process.removeListener("exit", T), c2 && c2.removeEventListener("abort", b);
+      }, M2 = () => {
+        if (S2 === void 0) return;
+        l && s.write(`
+`);
+        const _2 = wrapAnsi(S2, f2, { hard: true, trim: false }).split(`
+`);
+        _2.length > 1 && s.write(import_sisteransi2.cursor.up(_2.length - 1)), s.write(import_sisteransi2.cursor.to(0)), s.write(import_sisteransi2.erase.down());
+      }, R2 = (_2) => _2.replace(/\.+$/, ""), j2 = (_2) => {
+        const A2 = (performance.now() - _2) / 1e3, k = Math.floor(A2 / 60), L = Math.floor(A2 % 60);
+        return k > 0 ? `[${k}m ${L}s]` : `[${L}s]`;
+      }, D2 = a.withGuide ?? u.withGuide, ie = (_2 = "") => {
+        p2 = true, $2 = z({ output: s }), g = R2(_2), h = performance.now(), D2 && s.write(`${t("gray", d2)}
+`);
+        let A2 = 0, k = 0;
+        x(), y = setInterval(() => {
+          if (l && g === S2) return;
+          M2(), S2 = g;
+          const L = v(n[A2]);
+          let Z;
+          if (l) Z = `${L}  ${g}...`;
+          else if (e === "timer") Z = `${L}  ${g} ${j2(h)}`;
+          else {
+            const Be = ".".repeat(Math.floor(k)).slice(0, 3);
+            Z = `${L}  ${g}${Be}`;
+          }
+          const Ne = wrapAnsi(Z, f2, { hard: true, trim: false });
+          s.write(Ne), A2 = A2 + 1 < n.length ? A2 + 1 : 0, k = k < 4 ? k + 0.125 : 0;
+        }, o);
+      }, W = (_2 = "", A2 = 0, k = false) => {
+        if (!p2) return;
+        p2 = false, clearInterval(y), M2();
+        const L = A2 === 0 ? t("green", F) : A2 === 1 ? t("red", oe) : t("red", ue);
+        g = _2 ?? g, k || (e === "timer" ? s.write(`${L}  ${g} ${j2(h)}
+`) : s.write(`${L}  ${g}
+`)), G2(), $2();
+      };
+      return { start: ie, stop: (_2 = "") => W(_2, 0), message: (_2 = "") => {
+        g = R2(_2 ?? g);
+      }, cancel: (_2 = "") => W(_2, 1), error: (_2 = "") => W(_2, 2), clear: () => W("", 0, true), get isCancelled() {
+        return m;
+      } };
+    };
     Ve = { light: w2("\u2500", "-"), heavy: w2("\u2501", "="), block: w2("\u2588", "#") };
     re = (e, i) => e.includes(`
 `) ? e.split(`
@@ -3976,7 +4053,20 @@ var init_paths = __esm({
   "packages/core/dist/config/paths.js"() {
     "use strict";
     TRUECOURSE_DIR = ".truecourse";
-    GITIGNORE_CONTENTS = "analyses/\nhistory.json\ndiff.json\nui-state.json\nlogs/\n.analyze.lock\n";
+    GITIGNORE_CONTENTS = [
+      "analyses/",
+      "history.json",
+      "diff.json",
+      "ui-state.json",
+      "logs/",
+      ".analyze.lock",
+      "contracts/",
+      "verifier/runs/",
+      "verifier/history.json",
+      "verifier/diff.json",
+      ".cache/",
+      ""
+    ].join("\n");
   }
 });
 
@@ -4566,6 +4656,16 @@ var init_helpers = __esm({
   }
 });
 
+// packages/shared/dist/claude-binary.js
+function resolveClaudeBinary() {
+  return process.env.CLAUDE_CODE_BINARY || process.env.CLAUDE_CODE_BIN || "claude";
+}
+var init_claude_binary = __esm({
+  "packages/shared/dist/claude-binary.js"() {
+    "use strict";
+  }
+});
+
 // packages/core/dist/lib/atomic-write.js
 import fs5 from "node:fs";
 import path5 from "node:path";
@@ -5411,7 +5511,7 @@ var require_node = __commonJS({
     exports.inspectOpts = Object.keys(process.env).filter((key2) => {
       return /^debug_/i.test(key2);
     }).reduce((obj, key2) => {
-      const prop = key2.substring(6).toLowerCase().replace(/_([a-z])/g, (_, k) => {
+      const prop = key2.substring(6).toLowerCase().replace(/_([a-z])/g, (_2, k) => {
         return k.toUpperCase();
       });
       let val = process.env[key2];
@@ -6887,7 +6987,7 @@ function deleteBranchTask(branch, forceDelete = false) {
     parser(stdOut, stdErr) {
       return parseBranchDeletions(stdOut, stdErr).branches[branch];
     },
-    onError({ exitCode, stdErr, stdOut }, error, _, fail4) {
+    onError({ exitCode, stdErr, stdOut }, error, _2, fail4) {
       if (!hasBranchDeletionError(String(error), exitCode)) {
         return fail4(error);
       }
@@ -10066,6 +10166,7 @@ var init_errors = __esm({
 });
 
 // packages/core/dist/lib/git.js
+import fs8 from "node:fs";
 async function isGitRepo(repoPath) {
   try {
     return await simpleGit(repoPath).checkIsRepo();
@@ -10081,31 +10182,74 @@ async function getGit(repoPath) {
   }
   return git;
 }
+async function runWithStash(repoRoot6, options, fn) {
+  let didStash = false;
+  let stashGit;
+  if (!options.skipStash) {
+    try {
+      stashGit = await getGit(repoRoot6);
+      const status = await stashGit.status();
+      if (!status.isClean()) {
+        const gitRoot = (await stashGit.revparse(["--show-toplevel"])).trim();
+        if (fs8.realpathSync(repoRoot6) === fs8.realpathSync(gitRoot)) {
+          options.onStashStart?.();
+          const res = await stashGit.stash([
+            "push",
+            "--include-untracked",
+            "-m",
+            options.message,
+            // Stash everything under the repo root EXCEPT `.truecourse/`, so the
+            // tool's own working dir (contracts, specs, baselines) survives.
+            "--",
+            ".",
+            `:(exclude,top)${TRUECOURSE_DIR}`
+          ]);
+          didStash = !res.includes("No local changes");
+        }
+      }
+    } catch (error) {
+      options.onStashError?.(error instanceof Error ? error : new Error(String(error)));
+    }
+  }
+  try {
+    return await fn();
+  } finally {
+    if (didStash && stashGit) {
+      options.onRestoreStart?.();
+      try {
+        await stashGit.stash(["pop"]);
+      } catch (error) {
+        options.onRestoreError?.(error instanceof Error ? error : new Error(String(error)));
+      }
+    }
+  }
+}
 var NOT_A_GIT_REPO_MESSAGE;
 var init_git = __esm({
   "packages/core/dist/lib/git.js"() {
     "use strict";
     init_esm();
     init_errors();
+    init_paths();
     NOT_A_GIT_REPO_MESSAGE = "The selected folder is not a git repository. Please select a folder that has been initialized with git.";
   }
 });
 
 // packages/core/dist/config/project-config.js
-import fs8 from "node:fs";
+import fs9 from "node:fs";
 function readProjectConfig(repoDir) {
   const file = getRepoConfigPath(repoDir);
-  if (!fs8.existsSync(file))
+  if (!fs9.existsSync(file))
     return { ...EMPTY };
   try {
-    return JSON.parse(fs8.readFileSync(file, "utf-8"));
+    return JSON.parse(fs9.readFileSync(file, "utf-8"));
   } catch {
     return { ...EMPTY };
   }
 }
 function writeProjectConfig(repoDir, config2) {
   ensureRepoTruecourseDir(repoDir);
-  fs8.writeFileSync(getRepoConfigPath(repoDir), JSON.stringify(config2, null, 2), "utf-8");
+  fs9.writeFileSync(getRepoConfigPath(repoDir), JSON.stringify(config2, null, 2), "utf-8");
 }
 function updateProjectConfig(repoDir, patch) {
   const current = readProjectConfig(repoDir);
@@ -10174,7 +10318,7 @@ var require_ignore = __commonJS({
         // (a ) -> (a)
         // (a \ ) -> (a  )
         /((?:\\\\)*?)(\\?\s+)$/,
-        (_, m1, m2) => m1 + (m2.indexOf("\\") === 0 ? SPACE : EMPTY2)
+        (_2, m1, m2) => m1 + (m2.indexOf("\\") === 0 ? SPACE : EMPTY2)
       ],
       // Replace (\ ) with ' '
       // (\ ) -> ' '
@@ -10182,7 +10326,7 @@ var require_ignore = __commonJS({
       // (\\\ ) -> '\\ '
       [
         /(\\+?)\s/g,
-        (_, m1) => {
+        (_2, m1) => {
           const { length } = m1;
           return m1.slice(0, length - length % 2) + SPACE;
         }
@@ -10253,7 +10397,7 @@ var require_ignore = __commonJS({
         // Zero, one or several directories
         // should not use '*', or it will be replaced by the next replacer
         // Check if it is not the last `'/**'`
-        (_, index, str2) => index + 6 < str2.length ? "(?:\\/[^\\/]+)*" : "\\/.+"
+        (_2, index, str2) => index + 6 < str2.length ? "(?:\\/[^\\/]+)*" : "\\/.+"
       ],
       // normal intermediate wildcards
       [
@@ -10265,7 +10409,7 @@ var require_ignore = __commonJS({
         /(^|[^\\]+)(\\\*)+(?=.+)/g,
         // '*.js' matches '.js'
         // '*.js' doesn't match 'abc'
-        (_, p1, p2) => {
+        (_2, p1, p2) => {
           const unescaped = p2.replace(/\\\*/g, "[^\\/]*");
           return p1 + unescaped;
         }
@@ -10312,11 +10456,11 @@ var require_ignore = __commonJS({
     var MODE_CHECK_IGNORE = "checkRegex";
     var UNDERSCORE = "_";
     var TRAILING_WILD_CARD_REPLACERS = {
-      [MODE_IGNORE](_, p1) {
+      [MODE_IGNORE](_2, p1) {
         const prefix = p1 ? `${p1}[^/]+` : "[^/]*";
         return `${prefix}(?=$|\\/$)`;
       },
-      [MODE_CHECK_IGNORE](_, p1) {
+      [MODE_CHECK_IGNORE](_2, p1) {
         const prefix = p1 ? `${p1}[^/]*` : "[^/]*";
         return `${prefix}(?=$|\\/$)`;
       }
@@ -10999,10 +11143,10 @@ import { Parser, Language } from "web-tree-sitter";
 import { createRequire as _createRequire } from "node:module";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 import path8 from "node:path";
-import fs9 from "node:fs";
+import fs10 from "node:fs";
 function resolveWasmPath(subpath) {
   const bundled = path8.join(BUNDLED_WASM_DIR, path8.basename(subpath));
-  if (fs9.existsSync(bundled))
+  if (fs10.existsSync(bundled))
     return bundled;
   return _require.resolve(subpath);
 }
@@ -15507,7 +15651,7 @@ var init_ast = __esm({
         if (!isExtglobAST(this)) {
           const noEmpty = this.isStart() && this.isEnd() && !this.#parts.some((s) => typeof s !== "string");
           const src = this.#parts.map((p2) => {
-            const [re2, _, hasMagic, uflag] = typeof p2 === "string" ? _a2.#parseGlob(p2, this.#hasMagic, noEmpty) : p2.toRegExpSource(allowDot);
+            const [re2, _2, hasMagic, uflag] = typeof p2 === "string" ? _a2.#parseGlob(p2, this.#hasMagic, noEmpty) : p2.toRegExpSource(allowDot);
             this.#hasMagic = this.#hasMagic || hasMagic;
             this.#uflag = this.#uflag || uflag;
             return re2;
@@ -15613,7 +15757,7 @@ var init_ast = __esm({
           if (typeof p2 === "string") {
             throw new Error("string type in extglob ast??");
           }
-          const [re2, _, _hasMagic, uflag] = p2.toRegExpSource(dot);
+          const [re2, _2, _hasMagic, uflag] = p2.toRegExpSource(dot);
           this.#uflag = this.#uflag || uflag;
           return re2;
         }).filter((p2) => !(this.isStart() && this.isEnd()) || !!p2).join("|");
@@ -15886,7 +16030,7 @@ var init_esm4 = __esm({
         }
         return false;
       }
-      debug(..._) {
+      debug(..._2) {
       }
       make() {
         const pattern = this.pattern;
@@ -15908,7 +16052,7 @@ var init_esm4 = __esm({
         const rawGlobParts = this.globSet.map((s) => this.slashSplit(s));
         this.globParts = this.preprocess(rawGlobParts);
         this.debug(this.pattern, this.globParts);
-        let set2 = this.globParts.map((s, _, __) => {
+        let set2 = this.globParts.map((s, _2, __) => {
           if (this.isWindows && this.windowsNoMagicRoot) {
             const isUNC = s[0] === "" && s[1] === "" && (s[2] === "?" || !globMagic.test(s[2])) && !globMagic.test(s[3]);
             const isDrive = /^[a-z]:/i.test(s[0]);
@@ -61925,7 +62069,7 @@ function pythonRegexToJs(pattern) {
       collectFlag(f2);
     pattern = pattern.slice(prefix[0].length);
   }
-  pattern = pattern.replace(/\(\?([aiLmsux]+):/g, (_, flagSet) => {
+  pattern = pattern.replace(/\(\?([aiLmsux]+):/g, (_2, flagSet) => {
     for (const f2 of flagSet)
       collectFlag(f2);
     return "(?:";
@@ -74612,8 +74756,8 @@ var init_test_empty_file = __esm({
       nodeTypes: ["program"],
       visit(node2, filePath, sourceCode) {
         const lowerPath = filePath.toLowerCase();
-        const isTestFile2 = lowerPath.includes(".test.") || lowerPath.includes(".spec.") || lowerPath.includes("__tests__");
-        if (!isTestFile2)
+        const isTestFile3 = lowerPath.includes(".test.") || lowerPath.includes(".spec.") || lowerPath.includes("__tests__");
+        if (!isTestFile3)
           return null;
         if (hasTestFunction(node2))
           return null;
@@ -88426,8 +88570,8 @@ var init_test_not_discoverable = __esm({
           return null;
         const className = classNameNode.text;
         const isTestClass = className.startsWith("Test") || className.endsWith("Test") || className.endsWith("Tests");
-        const isTestFile2 = isPythonTestFile(filePath);
-        if (!isTestClass && !isTestFile2)
+        const isTestFile3 = isPythonTestFile(filePath);
+        if (!isTestClass && !isTestFile3)
           return null;
         const body = node2.childForFieldName("body");
         if (!body)
@@ -90915,7 +91059,7 @@ var init_js_naming_convention = __esm({
           return null;
         }
         if (funcName.includes("_") && !funcName.startsWith("_")) {
-          return makeViolation(this.ruleKey, node2, filePath, "low", "Function uses snake_case naming", `Function '${funcName}' uses snake_case. JavaScript convention is camelCase.`, sourceCode, `Rename to camelCase: ${funcName.replace(/_([a-z])/g, (_, c2) => c2.toUpperCase())}.`);
+          return makeViolation(this.ruleKey, node2, filePath, "low", "Function uses snake_case naming", `Function '${funcName}' uses snake_case. JavaScript convention is camelCase.`, sourceCode, `Rename to camelCase: ${funcName.replace(/_([a-z])/g, (_2, c2) => c2.toUpperCase())}.`);
         }
         return null;
       }
@@ -99324,7 +99468,7 @@ var util, objectUtil, ZodParsedType, getParsedType;
 var init_util3 = __esm({
   "node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/helpers/util.js"() {
     (function(util2) {
-      util2.assertEqual = (_) => {
+      util2.assertEqual = (_2) => {
       };
       function assertIs(_arg) {
       }
@@ -99374,7 +99518,7 @@ var init_util3 = __esm({
         return array.map((val) => typeof val === "string" ? `'${val}'` : val).join(separator);
       }
       util2.joinValues = joinValues;
-      util2.jsonStringifyReplacer = (_, value) => {
+      util2.jsonStringifyReplacer = (_2, value) => {
         if (typeof value === "bigint") {
           return value.toString();
         }
@@ -104025,13 +104169,13 @@ var init_schemas = __esm({
 });
 
 // packages/shared/dist/fs/tcignore.js
-import fs10 from "node:fs";
+import fs11 from "node:fs";
 import path12 from "node:path";
 function findRepoRoot(startDir) {
   const start = path12.resolve(startDir);
   let dir = start;
   for (; ; ) {
-    if (ROOT_MARKERS.some((m) => fs10.existsSync(path12.join(dir, m))))
+    if (ROOT_MARKERS.some((m) => fs11.existsSync(path12.join(dir, m))))
       return dir;
     const parent = path12.dirname(dir);
     if (parent === dir)
@@ -104043,7 +104187,7 @@ function loadTcIgnore(startDir) {
   const root = findRepoRoot(startDir);
   const ig = (0, import_ignore2.default)();
   try {
-    ig.add(fs10.readFileSync(path12.join(root, ".truecourseignore"), "utf8"));
+    ig.add(fs11.readFileSync(path12.join(root, ".truecourseignore"), "utf8"));
   } catch {
   }
   return {
@@ -104072,6 +104216,7 @@ var init_dist7 = __esm({
     init_types3();
     init_schemas();
     init_tcignore();
+    init_claude_binary();
   }
 });
 
@@ -104200,7 +104345,7 @@ var require_windows = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/windows.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
-    var fs50 = __require("fs");
+    var fs51 = __require("fs");
     function checkPathExt(path60, options) {
       var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
       if (!pathext) {
@@ -104225,12 +104370,12 @@ var require_windows = __commonJS({
       return checkPathExt(path60, options);
     }
     function isexe(path60, options, cb) {
-      fs50.stat(path60, function(er, stat) {
+      fs51.stat(path60, function(er, stat) {
         cb(er, er ? false : checkStat(stat, path60, options));
       });
     }
     function sync(path60, options) {
-      return checkStat(fs50.statSync(path60), path60, options);
+      return checkStat(fs51.statSync(path60), path60, options);
     }
   }
 });
@@ -104240,14 +104385,14 @@ var require_mode = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/mode.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
-    var fs50 = __require("fs");
+    var fs51 = __require("fs");
     function isexe(path60, options, cb) {
-      fs50.stat(path60, function(er, stat) {
+      fs51.stat(path60, function(er, stat) {
         cb(er, er ? false : checkStat(stat, options));
       });
     }
     function sync(path60, options) {
-      return checkStat(fs50.statSync(path60), options);
+      return checkStat(fs51.statSync(path60), options);
     }
     function checkStat(stat, options) {
       return stat.isFile() && checkMode(stat, options);
@@ -104271,7 +104416,7 @@ var require_mode = __commonJS({
 // node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js
 var require_isexe = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js"(exports, module) {
-    var fs50 = __require("fs");
+    var fs51 = __require("fs");
     var core2;
     if (process.platform === "win32" || global.TESTING_WINDOWS) {
       core2 = require_windows();
@@ -104535,16 +104680,16 @@ var require_shebang_command = __commonJS({
 var require_readShebang = __commonJS({
   "node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/readShebang.js"(exports, module) {
     "use strict";
-    var fs50 = __require("fs");
+    var fs51 = __require("fs");
     var shebangCommand = require_shebang_command();
     function readShebang(command) {
       const size = 150;
       const buffer = Buffer.alloc(size);
       let fd;
       try {
-        fd = fs50.openSync(command, "r");
-        fs50.readSync(fd, buffer, 0, size, 0);
-        fs50.closeSync(fd);
+        fd = fs51.openSync(command, "r");
+        fs51.readSync(fd, buffer, 0, size, 0);
+        fs51.closeSync(fd);
       } catch (e) {
       }
       return shebangCommand(buffer.toString());
@@ -104672,7 +104817,7 @@ var require_cross_spawn = __commonJS({
     var cp = __require("child_process");
     var parse2 = require_parse();
     var enoent = require_enoent();
-    function spawn6(command, args, options) {
+    function spawn7(command, args, options) {
       const parsed = parse2(command, args, options);
       const spawned = cp.spawn(parsed.command, parsed.args, parsed.options);
       enoent.hookChildProcess(spawned, parsed);
@@ -104684,8 +104829,8 @@ var require_cross_spawn = __commonJS({
       result.error = result.error || enoent.verifyENOENTSync(result.status, parsed);
       return result;
     }
-    module.exports = spawn6;
-    module.exports.spawn = spawn6;
+    module.exports = spawn7;
+    module.exports.spawn = spawn7;
     module.exports.sync = spawnSync2;
     module.exports._parse = parse2;
     module.exports._enoent = enoent;
@@ -105417,7 +105562,7 @@ function parseStringDef(def, refs) {
         case "trim":
           break;
         default:
-          /* @__PURE__ */ ((_) => {
+          /* @__PURE__ */ ((_2) => {
           })(check);
       }
     }
@@ -106265,7 +106410,7 @@ var init_selectParser = __esm({
         case ZodFirstPartyTypeKind.ZodSymbol:
           return void 0;
         default:
-          return /* @__PURE__ */ ((_) => void 0)(typeName);
+          return /* @__PURE__ */ ((_2) => void 0)(typeName);
       }
     };
   }
@@ -106528,7 +106673,7 @@ var require_package = __commonJS({
 // node_modules/.pnpm/dotenv@16.6.1/node_modules/dotenv/lib/main.js
 var require_main = __commonJS({
   "node_modules/.pnpm/dotenv@16.6.1/node_modules/dotenv/lib/main.js"(exports, module) {
-    var fs50 = __require("fs");
+    var fs51 = __require("fs");
     var path60 = __require("path");
     var os11 = __require("os");
     var crypto4 = __require("crypto");
@@ -106637,7 +106782,7 @@ var require_main = __commonJS({
       if (options && options.path && options.path.length > 0) {
         if (Array.isArray(options.path)) {
           for (const filepath of options.path) {
-            if (fs50.existsSync(filepath)) {
+            if (fs51.existsSync(filepath)) {
               possibleVaultPath = filepath.endsWith(".vault") ? filepath : `${filepath}.vault`;
             }
           }
@@ -106647,7 +106792,7 @@ var require_main = __commonJS({
       } else {
         possibleVaultPath = path60.resolve(process.cwd(), ".env.vault");
       }
-      if (fs50.existsSync(possibleVaultPath)) {
+      if (fs51.existsSync(possibleVaultPath)) {
         return possibleVaultPath;
       }
       return null;
@@ -106696,7 +106841,7 @@ var require_main = __commonJS({
       const parsedAll = {};
       for (const path61 of optionPaths) {
         try {
-          const parsed = DotenvModule.parse(fs50.readFileSync(path61, { encoding }));
+          const parsed = DotenvModule.parse(fs51.readFileSync(path61, { encoding }));
           DotenvModule.populate(parsedAll, parsed, options);
         } catch (e) {
           if (debug2) {
@@ -106818,11 +106963,11 @@ var require_main = __commonJS({
 // packages/core/dist/config/env.js
 import path13 from "node:path";
 import os3 from "node:os";
-import fs11 from "node:fs";
+import fs12 from "node:fs";
 function findRepoRootEnv() {
   let dir = process.cwd();
   for (let i = 0; i < 10; i++) {
-    if (fs11.existsSync(path13.join(dir, "pnpm-workspace.yaml"))) {
+    if (fs12.existsSync(path13.join(dir, "pnpm-workspace.yaml"))) {
       return path13.join(dir, ".env");
     }
     const parent = path13.dirname(dir);
@@ -106859,10 +107004,13 @@ var init_config2 = __esm({
   "packages/core/dist/config/index.js"() {
     "use strict";
     init_env();
+    init_dist7();
     config = {
       llmProvider: "claude-code",
-      // Claude Code CLI provider settings
-      claudeCodeBinary: process.env.CLAUDE_CODE_BINARY || "claude",
+      // Claude Code CLI provider settings. Binary resolution is centralized in
+      // `resolveClaudeBinary` (@truecourse/shared) so every command, the LLM
+      // provider, and the extraction runners agree on the same target.
+      claudeCodeBinary: resolveClaudeBinary(),
       claudeCodeModel: process.env.CLAUDE_CODE_MODEL || "",
       claudeCodeTimeoutMs: parseInt(process.env.CLAUDE_CODE_TIMEOUT_MS || "120000", 10),
       claudeCodeMaxRetries: parseInt(process.env.CLAUDE_CODE_MAX_RETRIES || "2", 10),
@@ -109100,7 +109248,7 @@ var init_violation_lifecycle_service = __esm({
 
 // packages/core/dist/services/violation-pipeline.service.js
 import { randomUUID as randomUUID6 } from "node:crypto";
-import fs12 from "node:fs";
+import fs13 from "node:fs";
 import path14 from "node:path";
 function throwIfAborted(signal) {
   if (signal?.aborted)
@@ -109218,9 +109366,9 @@ async function runViolationPipeline(input) {
       if (!lang)
         continue;
       const absPath = resolve9 ? path14.resolve(repoPath, filePath) : path14.isAbsolute(filePath) ? filePath : path14.join(repoPath, filePath);
-      if (!fs12.existsSync(absPath))
+      if (!fs13.existsSync(absPath))
         continue;
-      const content = fs12.readFileSync(absPath, "utf-8");
+      const content = fs13.readFileSync(absPath, "utf-8");
       const lineCount = content.split("\n").length;
       fileContents.set(changedFileSet ? absPath : filePath, { content, lineCount });
     } catch {
@@ -109359,10 +109507,10 @@ async function runViolationPipeline(input) {
   log.info(`[Pipeline] Code scan: ${allCodeViolations.length} violations from ${filesToScan.length} files (${enabledCodeRules.length} det rules, ${enabledLlmCodeRules.length} LLM rules)`);
   if (enabledCodeRules.some((r) => r.key === "bugs/deterministic/invalid-pyproject-toml")) {
     const pyprojectPath = path14.join(repoPath, "pyproject.toml");
-    if (fs12.existsSync(pyprojectPath)) {
+    if (fs13.existsSync(pyprojectPath)) {
       try {
         const { checkPyprojectToml: checkPyprojectToml2 } = await Promise.resolve().then(() => (init_dist6(), dist_exports2));
-        const content = fs12.readFileSync(pyprojectPath, "utf-8");
+        const content = fs13.readFileSync(pyprojectPath, "utf-8");
         const tomlViolations = checkPyprojectToml2(pyprojectPath, content);
         allCodeViolations.push(...tomlViolations);
       } catch {
@@ -110269,7 +110417,6 @@ var init_usage_service = __esm({
 
 // packages/core/dist/commands/analyze-core.js
 import { randomUUID as randomUUID7 } from "node:crypto";
-import path15 from "node:path";
 async function analyzeCore(project, options) {
   try {
     acquireAnalyzeLock(project.path);
@@ -110311,32 +110458,20 @@ async function analyzeCore(project, options) {
     const start = Date.now();
     const effectiveCategories = options.enabledCategoriesOverride?.length ? options.enabledCategoriesOverride : projectConfig.enabledCategories ?? void 0;
     const effectiveLlmRules = projectConfig.enableLlmRules ?? options.enableLlmRulesOverride ?? true;
-    let didStash = false;
-    let stashGit;
-    if (!isDiff && !skipGit && !options.skipStash) {
-      try {
-        stashGit = await getGit(project.path);
-        const status = await stashGit.status();
-        if (!status.isClean()) {
-          const gitRoot = (await stashGit.revparse(["--show-toplevel"])).trim();
-          const isSubdirectory = path15.resolve(project.path) !== path15.resolve(gitRoot);
-          if (!isSubdirectory) {
-            options.tracker?.detail("parse", "Stashing pending changes...");
-            options.onProgress?.({ detail: "Stashing pending changes to analyze committed state..." });
-            const stashResult = await stashGit.stash([
-              "push",
-              "--include-untracked",
-              "-m",
-              "truecourse-analysis-stash"
-            ]);
-            didStash = !stashResult.includes("No local changes");
-          }
-        }
-      } catch (error) {
-        log.warn(`[Analyzer] Failed to stash changes, analyzing current state: ${error instanceof Error ? error.message : String(error)}`);
-      }
-    }
-    try {
+    return await runWithStash(project.path, {
+      skipStash: isDiff || skipGit || (options.skipStash ?? false),
+      message: "truecourse-analysis-stash",
+      onStashStart: () => {
+        options.tracker?.detail("parse", "Stashing pending changes...");
+        options.onProgress?.({ detail: "Stashing pending changes to analyze committed state..." });
+      },
+      onRestoreStart: () => {
+        options.tracker?.detail("parse", "Restoring pending changes...");
+        options.onProgress?.({ detail: "Restoring pending changes..." });
+      },
+      onStashError: (error) => log.warn(`[Analyzer] Failed to stash changes, analyzing current state: ${error.message}`),
+      onRestoreError: (error) => log.error(`[Analyzer] Failed to restore stashed changes. Run "git stash pop" manually. ${error.message}`)
+    }, async () => {
       options.tracker?.start("parse", isDiff ? "Analyzing working tree..." : "Starting analysis...");
       const result = await runAnalysis(project.path, branch ?? void 0, (progress) => {
         options.tracker?.detail("parse", progress.detail ?? "Analyzing...");
@@ -110448,17 +110583,7 @@ async function analyzeCore(project, options) {
         previousAnalysisId,
         analysisResult: result
       };
-    } finally {
-      if (didStash && stashGit) {
-        options.tracker?.detail("parse", "Restoring pending changes...");
-        options.onProgress?.({ detail: "Restoring pending changes..." });
-        try {
-          await stashGit.stash(["pop"]);
-        } catch (error) {
-          log.error(`[Analyzer] Failed to restore stashed changes. Run "git stash pop" manually. ${error instanceof Error ? error.message : String(error)}`);
-        }
-      }
-    }
+    });
   } finally {
     releaseAnalyzeLock(project.path);
   }
@@ -110494,7 +110619,7 @@ var init_analyze_core = __esm({
 });
 
 // packages/core/dist/commands/analyze-persist.js
-import path16 from "node:path";
+import path15 from "node:path";
 function persistFullAnalysis(project, core2, startedAt) {
   const filename = buildAnalysisFilename(core2.analysisId, core2.now);
   const snapshot = {
@@ -110622,8 +110747,8 @@ function buildDiffSnapshot(repoPath, core2, baseline) {
   const newViolations = pipelineResult.added.map(denormalize);
   const latestById = new Map(baseline.violations.map((v) => [v.id, v]));
   const resolvedViolations = pipelineResult.resolvedRefs.map((r) => latestById.get(r.id)).filter((v) => !!v);
-  const changedAbs = new Set(changedFiles.map((c2) => path16.resolve(repoPath, c2.path)));
-  const matchesChanged = (p2) => !!p2 && (changedAbs.has(p2) || changedAbs.has(path16.resolve(repoPath, p2)));
+  const changedAbs = new Set(changedFiles.map((c2) => path15.resolve(repoPath, c2.path)));
+  const matchesChanged = (p2) => !!p2 && (changedAbs.has(p2) || changedAbs.has(path15.resolve(repoPath, p2)));
   const affectedModules = graph.modules.filter((m) => matchesChanged(m.filePath));
   const affectedModuleIdSet = new Set(affectedModules.map((m) => m.id));
   const serviceNameById = new Map(graph.services.map((s) => [s.id, s.name]));
@@ -119990,7 +120115,7 @@ var require_shams = __commonJS({
       }
       var symVal = 42;
       obj[sym] = symVal;
-      for (var _ in obj) {
+      for (var _2 in obj) {
         return false;
       }
       if (typeof Object.keys === "function" && Object.keys(obj).length !== 0) {
@@ -120658,7 +120783,7 @@ var require_form_data = __commonJS({
     var http = __require("http");
     var https = __require("https");
     var parseUrl = __require("url").parse;
-    var fs50 = __require("fs");
+    var fs51 = __require("fs");
     var Stream = __require("stream").Stream;
     var crypto4 = __require("crypto");
     var mime = require_mime_types();
@@ -120725,7 +120850,7 @@ var require_form_data = __commonJS({
         if (value.end != void 0 && value.end != Infinity && value.start != void 0) {
           callback(null, value.end + 1 - (value.start ? value.start : 0));
         } else {
-          fs50.stat(value.path, function(err, stat) {
+          fs51.stat(value.path, function(err, stat) {
             if (err) {
               callback(err);
               return;
@@ -121276,7 +121401,7 @@ var require_node2 = __commonJS({
     exports.inspectOpts = Object.keys(process.env).filter(function(key2) {
       return /^debug_/i.test(key2);
     }).reduce(function(obj, key2) {
-      var prop = key2.substring(6).toLowerCase().replace(/_([a-z])/g, function(_, k) {
+      var prop = key2.substring(6).toLowerCase().replace(/_([a-z])/g, function(_2, k) {
         return k.toUpperCase();
       });
       var val = process.env[key2];
@@ -121343,8 +121468,8 @@ var require_node2 = __commonJS({
           }
           break;
         case "FILE":
-          var fs50 = __require("fs");
-          stream2 = new fs50.SyncWriteStream(fd2, { autoClose: false });
+          var fs51 = __require("fs");
+          stream2 = new fs51.SyncWriteStream(fd2, { autoClose: false });
           stream2._type = "fs";
           break;
         case "PIPE":
@@ -122915,11 +123040,11 @@ var require_axios = __commonJS({
     function normalizeHeader(header) {
       return header && String(header).trim().toLowerCase();
     }
-    function normalizeValue(value) {
+    function normalizeValue2(value) {
       if (value === false || value == null) {
         return value;
       }
-      return utils$1.isArray(value) ? value.map(normalizeValue) : String(value).replace(/[\r\n]+$/, "");
+      return utils$1.isArray(value) ? value.map(normalizeValue2) : String(value).replace(/[\r\n]+$/, "");
     }
     function parseTokens(str2) {
       const tokens = /* @__PURE__ */ Object.create(null);
@@ -122975,7 +123100,7 @@ var require_axios = __commonJS({
           }
           const key2 = utils$1.findKey(self2, lHeader);
           if (!key2 || self2[key2] === void 0 || _rewrite === true || _rewrite === void 0 && self2[key2] !== false) {
-            self2[key2 || _header] = normalizeValue(_value);
+            self2[key2 || _header] = normalizeValue2(_value);
           }
         }
         const setHeaders = (headers, _rewrite) => utils$1.forEach(headers, (_value, _header) => setHeader(_value, _header, _rewrite));
@@ -123066,7 +123191,7 @@ var require_axios = __commonJS({
         utils$1.forEach(this, (value, header) => {
           const key2 = utils$1.findKey(headers, header);
           if (key2) {
-            self2[key2] = normalizeValue(value);
+            self2[key2] = normalizeValue2(value);
             delete self2[header];
             return;
           }
@@ -123074,7 +123199,7 @@ var require_axios = __commonJS({
           if (normalized !== header) {
             delete self2[header];
           }
-          self2[normalized] = normalizeValue(value);
+          self2[normalized] = normalizeValue2(value);
           headers[normalized] = true;
         });
         return this;
@@ -125460,7 +125585,7 @@ var require_axios = __commonJS({
 // node_modules/.pnpm/posthog-node@4.18.0/node_modules/posthog-node/lib/node/index.mjs
 import { posix, dirname as dirname8, sep as sep2 } from "path";
 import { createReadStream } from "node:fs";
-import { createInterface } from "node:readline";
+import { createInterface as createInterface2 } from "node:readline";
 function createEventProcessor(_posthog, {
   organization,
   projectId,
@@ -125880,7 +126005,7 @@ async function addSourceContext(frames) {
 function getContextLinesFromFile(path60, ranges, output) {
   return new Promise((resolve9) => {
     const stream = createReadStream(path60);
-    const lineReaded = createInterface({
+    const lineReaded = createInterface2({
       input: stream
     });
     function destroyStreamAndResolve() {
@@ -128247,7 +128372,7 @@ var init_node = __esm({
           }
         };
         return Promise.race([
-          new Promise((_, reject) => {
+          new Promise((_2, reject) => {
             safeSetTimeout(() => {
               this.logMsgIfDebug(() => console.error("Timed out while shutting down PostHog"));
               hasTimedOut = true;
@@ -129225,18 +129350,18 @@ var init_node = __esm({
 });
 
 // packages/core/dist/services/telemetry.service.js
-import fs13 from "node:fs";
-import path17 from "node:path";
+import fs14 from "node:fs";
+import path16 from "node:path";
 import os4 from "node:os";
 import crypto from "node:crypto";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 function getTelemetryConfigPath() {
-  return path17.join(os4.homedir(), ".truecourse", "telemetry.json");
+  return path16.join(os4.homedir(), ".truecourse", "telemetry.json");
 }
 function readTelemetryConfig() {
   const configPath = getTelemetryConfigPath();
   try {
-    const raw = fs13.readFileSync(configPath, "utf-8");
+    const raw = fs14.readFileSync(configPath, "utf-8");
     const parsed = JSON.parse(raw);
     const config2 = { ...DEFAULT_CONFIG2, ...parsed };
     if (!config2.anonymousId) {
@@ -129256,17 +129381,17 @@ function readTelemetryConfig() {
 }
 function writeTelemetryConfig(partial) {
   const configPath = getTelemetryConfigPath();
-  const dir = path17.dirname(configPath);
-  fs13.mkdirSync(dir, { recursive: true });
+  const dir = path16.dirname(configPath);
+  fs14.mkdirSync(dir, { recursive: true });
   let current;
   try {
-    const raw = fs13.readFileSync(configPath, "utf-8");
+    const raw = fs14.readFileSync(configPath, "utf-8");
     current = { ...DEFAULT_CONFIG2, ...JSON.parse(raw) };
   } catch {
     current = { ...DEFAULT_CONFIG2 };
   }
   const merged = { ...current, ...partial };
-  fs13.writeFileSync(configPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  fs14.writeFileSync(configPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
 }
 function isTelemetryEnabled() {
   if (!POSTHOG_API_KEY)
@@ -129312,7 +129437,7 @@ function detectLanguages(result) {
   const languages = /* @__PURE__ */ new Set();
   for (const service of result.services) {
     for (const filePath of service.files) {
-      const ext2 = path17.extname(filePath).toLowerCase();
+      const ext2 = path16.extname(filePath).toLowerCase();
       const lang = EXTENSION_TO_LANGUAGE[ext2];
       if (lang)
         languages.add(lang);
@@ -129324,13 +129449,13 @@ function readToolVersion() {
   if (cachedVersion)
     return cachedVersion;
   if (true) {
-    cachedVersion = "0.6.1";
+    cachedVersion = "0.6.6-next.0";
     return cachedVersion;
   }
   try {
     const here = fileURLToPath5(import.meta.url);
-    const pkgPath = path17.resolve(path17.dirname(here), "..", "..", "package.json");
-    const pkg = JSON.parse(fs13.readFileSync(pkgPath, "utf-8"));
+    const pkgPath = path16.resolve(path16.dirname(here), "..", "..", "package.json");
+    const pkg = JSON.parse(fs14.readFileSync(pkgPath, "utf-8"));
     cachedVersion = String(pkg.version ?? "0.0.0");
   } catch {
     cachedVersion = "0.0.0";
@@ -131224,7 +131349,7 @@ var init_forbidden_artifact = __esm({
 // packages/contract-verifier/dist/resolver/lifters/named-constant.js
 function liftNamedConstant(body) {
   let type2 = "string";
-  let expectedValue = "";
+  let expectedValue = void 0;
   for (const stmt of body) {
     const h = stmt.head;
     if (h.length === 0 || h[0].kind !== "ident")
@@ -131705,6 +131830,351 @@ var init_resolver = __esm({
   }
 });
 
+// packages/contract-verifier/dist/extractor/handler-facts.js
+function extractHandlerFacts(body, source) {
+  return {
+    emission: extractEmission(body, source),
+    ownershipCheckCandidates: extractOwnershipCandidates(body, source)
+  };
+}
+function emptyHandlerFacts() {
+  return {
+    emission: {
+      staticEvents: /* @__PURE__ */ new Set(),
+      hasDynamicEmit: false,
+      failureEmitSites: [],
+      branchEmits: /* @__PURE__ */ new Map()
+    },
+    ownershipCheckCandidates: []
+  };
+}
+function extractEmission(body, source) {
+  const callMap = collectEmitCalls(body, source);
+  const failureEmitSites = [];
+  for (const [event, calls] of callMap) {
+    for (const call of calls) {
+      if (emitIsInFailureBlock(call, source)) {
+        failureEmitSites.push({
+          event,
+          lineStart: call.startPosition.row + 1,
+          lineEnd: call.endPosition.row + 1
+        });
+      }
+    }
+  }
+  return {
+    staticEvents: new Set(callMap.keys()),
+    hasDynamicEmit: handlerHasDynamicEmit(body, source),
+    failureEmitSites,
+    branchEmits: collectBranchEmits(body, source)
+  };
+}
+function isCall(n) {
+  return n.type === "call_expression" || n.type === "call";
+}
+function isMember(n) {
+  return n?.type === "member_expression" || n?.type === "attribute";
+}
+function memberProp(n, source) {
+  const p2 = n.childForFieldName("property") ?? n.childForFieldName("attribute");
+  return p2 ? source.slice(p2.startIndex, p2.endIndex) : "";
+}
+function isBlock(n) {
+  return n.type === "statement_block" || n.type === "block";
+}
+function isFnBoundary(n) {
+  return n.type === "function_declaration" || n.type === "arrow_function" || n.type === "function_expression" || n.type === "function_definition";
+}
+function isControlFlow(n) {
+  return /^(if_statement|switch_statement|try_statement|for_statement|for_in_statement|while_statement|do_statement)$/.test(n.type);
+}
+function strVal(n, source) {
+  if (n.type !== "string")
+    return null;
+  const frag = n.namedChildren.find((c2) => c2.type === "string_fragment" || c2.type === "string_content");
+  return frag ? source.slice(frag.startIndex, frag.endIndex) : null;
+}
+function isEmitFn(fn, source) {
+  if (isMember(fn))
+    return memberProp(fn, source) === "emit";
+  if (fn.type === "identifier")
+    return /^emit/i.test(source.slice(fn.startIndex, fn.endIndex));
+  return false;
+}
+function collectEmitCalls(body, source) {
+  const out = /* @__PURE__ */ new Map();
+  const visit = (node2) => {
+    if (isCall(node2)) {
+      const fn = node2.childForFieldName("function");
+      const args = node2.childForFieldName("arguments");
+      if (fn && args && isEmitFn(fn, source)) {
+        const first2 = args.namedChild(0);
+        const eventName = first2 ? strVal(first2, source) : null;
+        if (eventName !== null) {
+          const arr = out.get(eventName) ?? [];
+          arr.push(node2);
+          out.set(eventName, arr);
+        }
+      }
+    }
+    for (const child of node2.namedChildren)
+      visit(child);
+  };
+  visit(body);
+  return out;
+}
+function handlerHasDynamicEmit(body, source) {
+  let dynamic = false;
+  const visit = (node2) => {
+    if (dynamic)
+      return;
+    if (isCall(node2)) {
+      const fn = node2.childForFieldName("function");
+      const args = node2.childForFieldName("arguments");
+      if (fn && args && isEmitFn(fn, source)) {
+        const first2 = args.namedChild(0);
+        if (first2 && first2.type !== "string") {
+          dynamic = true;
+          return;
+        }
+      }
+    }
+    for (const child of node2.namedChildren) {
+      visit(child);
+      if (dynamic)
+        return;
+    }
+  };
+  visit(body);
+  return dynamic;
+}
+function emitIsInFailureBlock(emitCall, source) {
+  let cur = emitCall.parent;
+  while (cur) {
+    if (isBlock(cur))
+      return blockContainsFailureStatusShallow(cur, source);
+    if (isFnBoundary(cur))
+      break;
+    cur = cur.parent;
+  }
+  return false;
+}
+function blockContainsFailureStatusShallow(block, source) {
+  for (const stmt of block.namedChildren) {
+    if (containsTopLevelFailureStatus(stmt, source))
+      return true;
+  }
+  return false;
+}
+function containsTopLevelFailureStatus(stmt, source) {
+  if (isControlFlow(stmt))
+    return false;
+  let found = false;
+  const visit = (node2) => {
+    if (found)
+      return;
+    if (isControlFlow(node2))
+      return;
+    if (isCall(node2) && callEmitsFailureStatus(node2, source)) {
+      found = true;
+      return;
+    }
+    for (const child of node2.namedChildren) {
+      visit(child);
+      if (found)
+        return;
+    }
+  };
+  visit(stmt);
+  return found;
+}
+function callEmitsFailureStatus(call, source) {
+  const fn = call.childForFieldName("function");
+  if (!fn)
+    return false;
+  const args = call.childForFieldName("arguments");
+  if (!args)
+    return false;
+  if (isMember(fn) && memberProp(fn, source) === "status") {
+    const arg = args.namedChild(0);
+    return !!arg && arg.type === "number" && /^[45]\d{2}$/.test(source.slice(arg.startIndex, arg.endIndex));
+  }
+  const fnName = fn.type === "identifier" ? source.slice(fn.startIndex, fn.endIndex) : isMember(fn) ? memberProp(fn, source) : "";
+  if (fnName === "JSONResponse" || fnName === "HTTPException" || fnName === "Response") {
+    for (let i = 0; i < args.namedChildCount; i++) {
+      const a = args.namedChild(i);
+      if (a?.type === "keyword_argument") {
+        const name = a.childForFieldName("name");
+        const value = a.childForFieldName("value");
+        if (name && value && source.slice(name.startIndex, name.endIndex) === "status_code" && value.type === "integer" && /^[45]\d{2}$/.test(source.slice(value.startIndex, value.endIndex))) {
+          return true;
+        }
+      }
+    }
+    const first2 = args.namedChild(0);
+    if (first2?.type === "integer" && /^[45]\d{2}$/.test(source.slice(first2.startIndex, first2.endIndex)))
+      return true;
+  }
+  return false;
+}
+function collectBranchEmits(body, source) {
+  const out = /* @__PURE__ */ new Map();
+  const visit = (node2) => {
+    if (node2.type === "if_statement") {
+      const cond = node2.childForFieldName("condition");
+      const consequent = node2.childForFieldName("consequence");
+      const alternative = node2.childForFieldName("alternative");
+      const literal = cond ? conditionLiteral(cond, source) : null;
+      if (literal !== null && consequent && !out.has(literal)) {
+        out.set(literal, {
+          consequentEmits: blockHasAnyEmit(consequent, source),
+          alternativeEmits: alternative ? blockHasAnyEmit(alternative, source) : false
+        });
+      }
+    }
+    for (const child of node2.namedChildren)
+      visit(child);
+  };
+  visit(body);
+  return out;
+}
+function conditionLiteral(node2, source) {
+  const u2 = unwrapParens(node2);
+  if (u2.type === "binary_expression") {
+    const opNode = u2.childForFieldName("operator");
+    const op = opNode ? source.slice(opNode.startIndex, opNode.endIndex) : "";
+    if (op !== "===" && op !== "==")
+      return null;
+    return litText(u2.childForFieldName("left"), source) ?? litText(u2.childForFieldName("right"), source);
+  }
+  if (u2.type === "comparison_operator") {
+    const a = u2.namedChild(0);
+    const b = u2.namedChild(1);
+    if (!a || !b || source.slice(a.endIndex, b.startIndex).trim() !== "==")
+      return null;
+    return litText(a, source) ?? litText(b, source);
+  }
+  return null;
+}
+function litText(node2, source) {
+  return node2 && node2.type === "string" ? strVal(node2, source) : null;
+}
+function unwrapParens(node2) {
+  let cur = node2;
+  while (cur.type === "parenthesized_expression") {
+    const child = cur.namedChildren[0];
+    if (!child)
+      break;
+    cur = child;
+  }
+  return cur;
+}
+function blockHasAnyEmit(block, source) {
+  let found = false;
+  const visit = (node2) => {
+    if (found)
+      return;
+    if (isCall(node2)) {
+      const fn = node2.childForFieldName("function");
+      if (fn && isEmitFn(fn, source)) {
+        found = true;
+        return;
+      }
+    }
+    for (const child of node2.namedChildren) {
+      visit(child);
+      if (found)
+        return;
+    }
+  };
+  visit(block);
+  return found;
+}
+function extractOwnershipCandidates(body, source) {
+  const out = [];
+  const tryEq = (left, right, line) => {
+    const leftAuth = matchesAuthSide(left, source);
+    const rightAuth = matchesAuthSide(right, source);
+    if (!leftAuth && !rightAuth)
+      return;
+    if (rightAuth) {
+      const field = terminalProperty(left, source);
+      if (field)
+        out.push({ resourceField: field, line });
+    }
+    if (leftAuth) {
+      const field = terminalProperty(right, source);
+      if (field)
+        out.push({ resourceField: field, line });
+    }
+  };
+  const visit = (node2) => {
+    if (node2.type === "binary_expression") {
+      const opNode = node2.childForFieldName("operator");
+      const op = opNode ? source.slice(opNode.startIndex, opNode.endIndex) : "";
+      if (op === "===" || op === "==" || op === "!==" || op === "!=") {
+        const left = node2.childForFieldName("left");
+        const right = node2.childForFieldName("right");
+        if (left && right)
+          tryEq(left, right, node2.startPosition.row + 1);
+      }
+    }
+    if (node2.type === "comparison_operator") {
+      const a = node2.namedChild(0);
+      const b = node2.namedChild(1);
+      if (a && b) {
+        const op = source.slice(a.endIndex, b.startIndex).trim();
+        if (op === "==" || op === "!=")
+          tryEq(a, b, node2.startPosition.row + 1);
+      }
+    }
+    for (const child of node2.namedChildren)
+      visit(child);
+  };
+  visit(body);
+  return out;
+}
+function terminalProperty(node2, source) {
+  if (node2.type !== "member_expression" && node2.type !== "attribute")
+    return null;
+  const prop = node2.childForFieldName("property") ?? node2.childForFieldName("attribute");
+  if (!prop)
+    return null;
+  return source.slice(prop.startIndex, prop.endIndex);
+}
+function matchesAuthSide(node2, source) {
+  if (node2.type === "attribute") {
+    return /\b(req|request)\.(auth|user)\b|\bcurrent_user\b/.test(source.slice(node2.startIndex, node2.endIndex));
+  }
+  let cur = node2;
+  while (cur) {
+    if (cur.type === "identifier") {
+      const text = source.slice(cur.startIndex, cur.endIndex);
+      if (text === "req" || text === "request")
+        return false;
+      return false;
+    }
+    if (cur.type === "member_expression") {
+      const text = source.slice(cur.startIndex, cur.endIndex);
+      if (/\b(req|request)\.auth\b|\b(req|request)\?\.auth\b/.test(text))
+        return true;
+      cur = cur.childForFieldName("object");
+      continue;
+    }
+    if (cur.type === "optional_chain_expression" || cur.type === "subscript_expression") {
+      cur = cur.childForFieldName("object");
+      continue;
+    }
+    return false;
+  }
+  return false;
+}
+var init_handler_facts = __esm({
+  "packages/contract-verifier/dist/extractor/handler-facts.js"() {
+    "use strict";
+  }
+});
+
 // packages/contract-verifier/dist/extractor/operation.js
 function extractOperationsFromFile(filePath, source, tree) {
   const fnIndex = buildFunctionIndex(tree.rootNode, source);
@@ -131788,6 +132258,7 @@ function tryExtractRouteCall(call, source, filePath, fnIndex) {
   const bodyToWalk = resolveDelegationTarget(handlerBody, source, fnIndex) ?? handlerBody;
   const responses = extractResponses(bodyToWalk, source);
   const observed = collectHandlerObservations(bodyToWalk, source);
+  const facts = extractHandlerFacts(bodyToWalk, source);
   return {
     identity: `${method.toUpperCase()} ${pathLit}`,
     contract: {
@@ -131801,8 +132272,8 @@ function tryExtractRouteCall(call, source, filePath, fnIndex) {
     declarationLine: call.startPosition.row + 1,
     routerName,
     observed,
-    handlerBody: bodyToWalk,
-    handlerSource: source
+    emission: facts.emission,
+    ownershipCheckCandidates: facts.ownershipCheckCandidates
   };
 }
 function collectHandlerObservationsFromBody(body, source) {
@@ -131980,7 +132451,7 @@ function describeResCall(call, source) {
 }
 function describeWebResponseNew(node2, source) {
   const ctor = node2.childForFieldName("constructor");
-  if (!ctor || ctor.type !== "identifier" || sliceText(ctor, source) !== "Response")
+  if (!ctor || ctor.type !== "identifier" || !WEB_RESPONSE_CTORS.has(sliceText(ctor, source)))
     return null;
   const args = node2.childForFieldName("arguments");
   const status = readStatusFromInit(args?.namedChild(1) ?? null, source) ?? "200";
@@ -132006,7 +132477,7 @@ function describeWebResponseCall(call, source) {
   if (obj.type !== "identifier")
     return null;
   const objName = sliceText(obj, source);
-  if (objName !== "Response" && objName !== "NextResponse")
+  if (objName !== "Response" && objName !== "NextResponse" && objName !== "HttpResponse")
     return null;
   const args = call.childForFieldName("arguments");
   const status = readStatusFromInit(args?.namedChild(1) ?? null, source) ?? "200";
@@ -132163,10 +132634,135 @@ function readStringLiteral(node2, source) {
   }
   return null;
 }
-var HTTP_METHODS3, RES_SEND_METHODS;
+function inferPluginMountPrefix(filePath) {
+  const normalized = filePath.replace(/\\/g, "/");
+  const m = normalized.match(/\/([^/]+)\/server(?:\/src)?\/routes\//);
+  if (!m)
+    return null;
+  return "/" + m[1];
+}
+function joinPluginPath(prefix, routePath) {
+  if (!routePath)
+    return prefix || "/";
+  const a = prefix.endsWith("/") ? prefix.slice(0, -1) : prefix;
+  const b = routePath.startsWith("/") ? routePath : "/" + routePath;
+  return a + b;
+}
+function tryReadPluginRouteDescriptor(obj, source) {
+  let method = null;
+  let routePath = null;
+  let authExempt = false;
+  for (const child of obj.namedChildren) {
+    if (child.type !== "pair")
+      continue;
+    const key2 = child.childForFieldName("key");
+    const val = child.childForFieldName("value");
+    if (!key2 || !val)
+      continue;
+    const keyName = key2.text.replace(/^['"]|['"]$/g, "");
+    if (keyName === "method") {
+      const v = readStringLiteral(val, source);
+      if (v && PLUGIN_ROUTE_METHODS.has(v.toUpperCase()))
+        method = v.toUpperCase();
+    } else if (keyName === "path") {
+      const v = readStringLiteral(val, source);
+      if (v !== null && v.startsWith("/"))
+        routePath = v;
+    } else if (keyName === "config" && val.type === "object") {
+      for (const cfgChild of val.namedChildren) {
+        if (cfgChild.type !== "pair")
+          continue;
+        const cfgKey = cfgChild.childForFieldName("key");
+        const cfgVal = cfgChild.childForFieldName("value");
+        if (!cfgKey || !cfgVal)
+          continue;
+        const cfgKeyName = cfgKey.text.replace(/^['"]|['"]$/g, "");
+        if (cfgKeyName === "auth" && cfgVal.type === "false") {
+          authExempt = true;
+        } else if (cfgKeyName === "policies" && cfgVal.type === "array" && cfgVal.namedChildCount > 0) {
+          authExempt = true;
+        }
+      }
+    }
+  }
+  if (!method || routePath === null)
+    return null;
+  return { method, path: routePath, line: obj.startPosition.row + 1, authExempt };
+}
+function collectPluginRouteDescriptors(node2, source) {
+  const out = [];
+  if (node2.type === "array") {
+    for (const el of node2.namedChildren) {
+      if (el.type === "object") {
+        const desc = tryReadPluginRouteDescriptor(el, source);
+        if (desc)
+          out.push(desc);
+      }
+    }
+    return out;
+  }
+  if (node2.type === "object") {
+    for (const child of node2.namedChildren) {
+      if (child.type !== "pair")
+        continue;
+      const key2 = child.childForFieldName("key");
+      const val = child.childForFieldName("value");
+      if (!key2 || !val)
+        continue;
+      const keyName = key2.text.replace(/^['"]|['"]$/g, "");
+      if (keyName === "routes" && val.type === "array") {
+        for (const el of val.namedChildren) {
+          if (el.type === "object") {
+            const desc = tryReadPluginRouteDescriptor(el, source);
+            if (desc)
+              out.push(desc);
+          }
+        }
+      }
+    }
+  }
+  return out;
+}
+function extractPluginStyleRoutesFromFile(filePath, source, tree) {
+  const prefix = inferPluginMountPrefix(filePath);
+  if (!prefix)
+    return [];
+  const out = [];
+  const visit = (node2) => {
+    if (node2.type === "export_statement") {
+      const value = node2.childForFieldName("value");
+      if (value) {
+        const descriptors = collectPluginRouteDescriptors(value, source);
+        for (const { method, path: routePath, line, authExempt } of descriptors) {
+          const fullPath = joinPluginPath(prefix, routePath);
+          out.push({
+            identity: `${method} ${fullPath}`,
+            contract: {
+              protocol: "http",
+              method,
+              path: fullPath,
+              tags: [],
+              responses: []
+            },
+            filePath,
+            declarationLine: line,
+            observed: { queryParams: [], numericClamps: [], hasClampCall: false },
+            ...authExempt ? { authExempt: true } : {}
+          });
+        }
+      }
+    }
+    for (const child of node2.namedChildren)
+      visit(child);
+  };
+  visit(tree.rootNode);
+  return out;
+}
+var HTTP_METHODS3, RES_SEND_METHODS, WEB_RESPONSE_CTORS, PLUGIN_ROUTE_METHODS;
 var init_operation2 = __esm({
   "packages/contract-verifier/dist/extractor/operation.js"() {
     "use strict";
+    init_handler_facts();
     HTTP_METHODS3 = /* @__PURE__ */ new Set(["get", "post", "put", "delete", "patch"]);
     RES_SEND_METHODS = /* @__PURE__ */ new Set([
       "json",
@@ -132176,12 +132772,15 @@ var init_operation2 = __esm({
       "sendFile",
       "render"
     ]);
+    WEB_RESPONSE_CTORS = /* @__PURE__ */ new Set(["Response", "HttpResponse"]);
+    PLUGIN_ROUTE_METHODS = /* @__PURE__ */ new Set(["GET", "POST", "PUT", "DELETE", "PATCH", "OPTIONS", "HEAD"]);
   }
 });
 
 // packages/contract-verifier/dist/extractor/operation-fastapi.js
 function extractFastApiOperationsFromFile(filePath, source, tree) {
   const routers = collectRouters(tree.rootNode, source);
+  const stringVars = collectStringVars(tree.rootNode, source);
   const out = [];
   walk(tree.rootNode, (node2) => {
     if (node2.type !== "decorated_definition")
@@ -132193,7 +132792,7 @@ function extractFastApiOperationsFromFile(filePath, source, tree) {
       const dec = node2.namedChild(i);
       if (dec?.type !== "decorator")
         continue;
-      const route = parseRouteDecorator(dec, source);
+      const route = parseRouteDecorator(dec, source, stringVars);
       if (!route)
         continue;
       const router = routers.get(route.routerVar) ?? { prefix: "", hasAuthDep: false };
@@ -132202,6 +132801,7 @@ function extractFastApiOperationsFromFile(filePath, source, tree) {
       const paramsNode = def.childForFieldName("parameters");
       const responses = extractResponses2(body, source, route.successStatus);
       const observed = collectObservations(paramsNode, body, source, fullPath);
+      const facts = body ? extractHandlerFacts(body, source) : emptyHandlerFacts();
       out.push({
         identity: `${route.method.toUpperCase()} ${fullPath}`,
         contract: {
@@ -132215,8 +132815,8 @@ function extractFastApiOperationsFromFile(filePath, source, tree) {
         declarationLine: node2.startPosition.row + 1,
         routerName: route.routerVar,
         observed,
-        handlerBody: body ?? void 0,
-        handlerSource: source
+        emission: facts.emission,
+        ownershipCheckCandidates: facts.ownershipCheckCandidates
       });
       break;
     }
@@ -132234,7 +132834,7 @@ function collectRouters(root, source) {
       return;
     const fn = right.childForFieldName("function");
     const fnName = fn ? source.slice(fn.startIndex, fn.endIndex) : "";
-    if (fnName !== "APIRouter" && fnName !== "FastAPI")
+    if (fnName !== "FastAPI" && !fnName.endsWith("Router"))
       return;
     const args = right.childForFieldName("arguments");
     let prefix = "";
@@ -132267,7 +132867,37 @@ function fastApiFileHasAuthRouter(source, tree) {
   }
   return false;
 }
-function parseRouteDecorator(dec, source) {
+function collectStringVars(root, source) {
+  const vars = /* @__PURE__ */ new Map();
+  walk(root, (node2) => {
+    if (node2.type === "assignment") {
+      const left = node2.childForFieldName("left");
+      const right = node2.childForFieldName("right");
+      if (left?.type === "identifier" && right?.type === "string") {
+        vars.set(source.slice(left.startIndex, left.endIndex), pyStr(right, source));
+      }
+    }
+    if (node2.type === "function_definition") {
+      const params = node2.childForFieldName("parameters");
+      if (params) {
+        for (let i = 0; i < params.namedChildCount; i++) {
+          const p2 = params.namedChild(i);
+          if (!p2)
+            continue;
+          if (p2.type === "typed_default_parameter" || p2.type === "default_parameter") {
+            const name = p2.childForFieldName("name");
+            const value = p2.childForFieldName("value");
+            if (name?.type === "identifier" && value?.type === "string") {
+              vars.set(source.slice(name.startIndex, name.endIndex), pyStr(value, source));
+            }
+          }
+        }
+      }
+    }
+  });
+  return vars;
+}
+function parseRouteDecorator(dec, source, stringVars) {
   const call = dec.namedChild(0);
   if (call?.type !== "call")
     return null;
@@ -132300,6 +132930,14 @@ function parseRouteDecorator(dec, source) {
       }
     }
   }
+  if (path60 === null) {
+    const firstArg = args.namedChild(0);
+    if (firstArg?.type === "identifier") {
+      const resolved = stringVars.get(source.slice(firstArg.startIndex, firstArg.endIndex));
+      if (resolved !== void 0)
+        path60 = resolved;
+    }
+  }
   if (path60 === null)
     return null;
   return { method, path: path60, routerVar, successStatus };
@@ -132510,28 +133148,29 @@ var HTTP_METHODS4, AUTH_DEP_NAMES;
 var init_operation_fastapi = __esm({
   "packages/contract-verifier/dist/extractor/operation-fastapi.js"() {
     "use strict";
+    init_handler_facts();
     HTTP_METHODS4 = /* @__PURE__ */ new Set(["get", "post", "put", "delete", "patch"]);
     AUTH_DEP_NAMES = /require_bearer|require_auth|authenticate|get_current_user|bearer|require_role|require_admin/i;
   }
 });
 
 // packages/contract-verifier/dist/extractor/source-walker.js
-import fs32 from "node:fs";
-import path37 from "node:path";
+import fs33 from "node:fs";
+import path36 from "node:path";
 async function eachParsedSource(rootDir, visit) {
   await initParsers();
   const tcIgnore = loadTcIgnore(rootDir);
   const walk11 = (dir) => {
     let entries;
     try {
-      entries = fs32.readdirSync(dir, { withFileTypes: true });
+      entries = fs33.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const entry of entries) {
       if (SKIP_DIRS2.has(entry.name))
         continue;
-      const full = path37.join(dir, entry.name);
+      const full = path36.join(dir, entry.name);
       if (tcIgnore.ignores(full))
         continue;
       if (entry.isDirectory()) {
@@ -132540,19 +133179,22 @@ async function eachParsedSource(rootDir, visit) {
       }
       if (!entry.isFile())
         continue;
-      const lang = EXT_TO_LANG[path37.extname(entry.name)];
+      const lang = EXT_TO_LANG[path36.extname(entry.name)];
       if (!lang)
         continue;
       let source;
       try {
-        source = fs32.readFileSync(full, "utf-8");
+        source = fs33.readFileSync(full, "utf-8");
       } catch {
         continue;
       }
+      let tree;
       try {
-        const tree = parseFile(full, source, lang);
+        tree = parseFile(full, source, lang);
         visit({ filePath: full, source, tree, lang });
       } catch {
+      } finally {
+        tree?.delete();
       }
     }
   };
@@ -132608,8 +133250,8 @@ var init_source_walker = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/file-based-routes.js
-import fs33 from "node:fs";
-import path38 from "node:path";
+import fs34 from "node:fs";
+import path37 from "node:path";
 async function extractFileBasedRoutesFromDir(rootDir) {
   await initParsers();
   const out = [];
@@ -132627,7 +133269,7 @@ function findDirs(rootDir, wantedRel) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs33.readdirSync(dir, { withFileTypes: true });
+      entries = fs34.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -132636,11 +133278,11 @@ function findDirs(rootDir, wantedRel) {
         continue;
       if (!entry.isDirectory())
         continue;
-      const full = path38.join(dir, entry.name);
+      const full = path37.join(dir, entry.name);
       if (tcIgnore.ignores(full))
         continue;
-      const match4 = path38.join(...wantedSegments);
-      if (full.endsWith(path38.sep + match4) || full === match4) {
+      const match4 = path37.join(...wantedSegments);
+      if (full.endsWith(path37.sep + match4) || full === match4) {
         results.push(full);
         continue;
       }
@@ -132653,10 +133295,10 @@ function findDirs(rootDir, wantedRel) {
 function walkRoot(rootAbs, root, out) {
   const tcIgnore = loadTcIgnore(rootAbs);
   const visit = (dir) => {
-    for (const entry of fs33.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs34.readdirSync(dir, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === ".git")
         continue;
-      const full = path38.join(dir, entry.name);
+      const full = path37.join(dir, entry.name);
       if (tcIgnore.ignores(full))
         continue;
       if (entry.isDirectory()) {
@@ -132665,7 +133307,7 @@ function walkRoot(rootAbs, root, out) {
       }
       if (!entry.isFile())
         continue;
-      const ext2 = path38.extname(entry.name);
+      const ext2 = path37.extname(entry.name);
       if (!TS_EXT.has(ext2))
         continue;
       if (root.shape === "next-app" && entry.name !== "route.ts" && entry.name !== "route.js" && entry.name !== "route.tsx" && entry.name !== "route.jsx") {
@@ -132674,11 +133316,11 @@ function walkRoot(rootAbs, root, out) {
       if (root.shape === "sveltekit" && !/^\+server\.(t|j)sx?$/.test(entry.name)) {
         continue;
       }
-      const relUnderRoot = path38.relative(rootAbs, full);
+      const relUnderRoot = path37.relative(rootAbs, full);
       const url = deriveUrl(relUnderRoot, root);
       if (url === null)
         continue;
-      const source = fs33.readFileSync(full, "utf-8");
+      const source = fs34.readFileSync(full, "utf-8");
       const lang = ext2 === ".tsx" ? "tsx" : ext2 === ".ts" ? "typescript" : "javascript";
       let tree;
       try {
@@ -132686,24 +133328,29 @@ function walkRoot(rootAbs, root, out) {
       } catch {
         continue;
       }
-      const exports = collectHttpMethodExports(tree.rootNode, source);
-      for (const exp of exports) {
-        const contract = {
-          protocol: "http",
-          method: exp.method.toUpperCase(),
-          path: url,
-          tags: [],
-          responses: extractResponsesFromBody(exp.body, source)
-        };
-        out.push({
-          identity: `${exp.method.toUpperCase()} ${url}`,
-          contract,
-          filePath: full,
-          declarationLine: exp.line,
-          observed: collectHandlerObservationsFromBody(exp.body, source),
-          handlerBody: exp.body,
-          handlerSource: source
-        });
+      try {
+        const exports = collectHttpMethodExports(tree.rootNode, source);
+        for (const exp of exports) {
+          const contract = {
+            protocol: "http",
+            method: exp.method.toUpperCase(),
+            path: url,
+            tags: [],
+            responses: extractResponsesFromBody(exp.body, source)
+          };
+          const facts = extractHandlerFacts(exp.body, source);
+          out.push({
+            identity: `${exp.method.toUpperCase()} ${url}`,
+            contract,
+            filePath: full,
+            declarationLine: exp.line,
+            observed: collectHandlerObservationsFromBody(exp.body, source),
+            emission: facts.emission,
+            ownershipCheckCandidates: facts.ownershipCheckCandidates
+          });
+        }
+      } finally {
+        tree.delete();
       }
     }
   };
@@ -132711,7 +133358,7 @@ function walkRoot(rootAbs, root, out) {
 }
 function deriveUrl(relPath, root) {
   const noExt = relPath.replace(/\.(t|j)sx?$/, "");
-  const segments = noExt.split(path38.sep);
+  const segments = noExt.split(path37.sep);
   switch (root.shape) {
     case "next-pages":
       return "/api/" + segmentsToUrl(segments, { stripIndex: true });
@@ -132795,6 +133442,7 @@ var init_file_based_routes = __esm({
     init_dist6();
     init_dist7();
     init_operation2();
+    init_handler_facts();
     TS_EXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
     HTTP_METHODS5 = /* @__PURE__ */ new Set(["get", "post", "put", "delete", "patch", "options", "head"]);
     ROUTE_ROOTS = [
@@ -132812,8 +133460,8 @@ var init_file_based_routes = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/mount-graph.js
-import fs34 from "node:fs";
-import path39 from "node:path";
+import fs35 from "node:fs";
+import path38 from "node:path";
 function analyzeRouterFile(filePath, source, tree) {
   const declarations = [];
   const mounts = [];
@@ -132949,21 +133597,21 @@ function collectImports(node2, source, filePath, out) {
 function resolveImportPath(fromFile, spec) {
   if (!spec.startsWith("."))
     return null;
-  const baseDir = path39.dirname(fromFile);
+  const baseDir = path38.dirname(fromFile);
   const noExt = spec.replace(/\.(ts|tsx|js|jsx|mjs|cjs)$/, "");
   const candidates = [
     noExt + ".ts",
     noExt + ".tsx",
     noExt + ".js",
     noExt + ".jsx",
-    path39.join(noExt, "index.ts"),
-    path39.join(noExt, "index.tsx"),
-    path39.join(noExt, "index.js"),
-    path39.join(noExt, "index.jsx")
+    path38.join(noExt, "index.ts"),
+    path38.join(noExt, "index.tsx"),
+    path38.join(noExt, "index.js"),
+    path38.join(noExt, "index.jsx")
   ];
   for (const c2 of candidates) {
-    const abs = path39.resolve(baseDir, c2);
-    if (fs34.existsSync(abs) && fs34.statSync(abs).isFile())
+    const abs = path38.resolve(baseDir, c2);
+    if (fs35.existsSync(abs) && fs35.statSync(abs).isFile())
       return abs;
   }
   return null;
@@ -133148,8 +133796,8 @@ var init_mount_graph = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/auth-presence.js
-import fs35 from "node:fs";
-import path40 from "node:path";
+import fs36 from "node:fs";
+import path39 from "node:path";
 async function detectAuthPresence(rootDir) {
   await initParsers();
   const edges = [];
@@ -133159,10 +133807,10 @@ async function detectAuthPresence(rootDir) {
   const scanned = [];
   const tcIgnore = loadTcIgnore(rootDir);
   const visit = (dir) => {
-    for (const entry of fs35.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs36.readdirSync(dir, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === ".git")
         continue;
-      const full = path40.join(dir, entry.name);
+      const full = path39.join(dir, entry.name);
       if (tcIgnore.ignores(full))
         continue;
       if (entry.isDirectory()) {
@@ -133171,10 +133819,10 @@ async function detectAuthPresence(rootDir) {
       }
       if (!entry.isFile())
         continue;
-      const ext2 = path40.extname(entry.name);
+      const ext2 = path39.extname(entry.name);
       if (!TS_EXT2.has(ext2))
         continue;
-      const source = fs35.readFileSync(full, "utf-8");
+      const source = fs36.readFileSync(full, "utf-8");
       const lang = ext2 === ".tsx" ? "tsx" : ext2 === ".ts" ? "typescript" : "javascript";
       let tree;
       try {
@@ -133182,8 +133830,12 @@ async function detectAuthPresence(rootDir) {
       } catch {
         continue;
       }
-      scanned.push(full);
-      collectFromTree(tree, source, full, edges, fileDefaultExports, fileImports, routerVarsByFile);
+      try {
+        scanned.push(full);
+        collectFromTree(tree, source, full, edges, fileDefaultExports, fileImports, routerVarsByFile);
+      } finally {
+        tree.delete();
+      }
     }
   };
   visit(rootDir);
@@ -133238,7 +133890,7 @@ async function detectAuthPresence(rootDir) {
 function resolveImportPath2(importingFile, sourceStr) {
   if (!sourceStr.startsWith("."))
     return null;
-  const baseRaw = path40.resolve(path40.dirname(importingFile), sourceStr);
+  const baseRaw = path39.resolve(path39.dirname(importingFile), sourceStr);
   const candidates = [];
   candidates.push(baseRaw);
   if (baseRaw.endsWith(".js")) {
@@ -133249,14 +133901,14 @@ function resolveImportPath2(importingFile, sourceStr) {
     const stem = baseRaw.slice(0, -4);
     candidates.push(stem + ".tsx", stem + ".ts");
   }
-  if (!path40.extname(baseRaw)) {
+  if (!path39.extname(baseRaw)) {
     for (const ext2 of [".ts", ".tsx", ".js", ".jsx"])
       candidates.push(baseRaw + ext2);
     for (const ext2 of [".ts", ".tsx", ".js", ".jsx"])
-      candidates.push(path40.join(baseRaw, `index${ext2}`));
+      candidates.push(path39.join(baseRaw, `index${ext2}`));
   }
   for (const c2 of candidates) {
-    if (fs35.existsSync(c2) && fs35.statSync(c2).isFile())
+    if (fs36.existsSync(c2) && fs36.statSync(c2).isFile())
       return c2;
   }
   return null;
@@ -133347,8 +133999,8 @@ var init_auth_presence = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/idempotency-presence.js
-import fs36 from "node:fs";
-import path41 from "node:path";
+import fs37 from "node:fs";
+import path40 from "node:path";
 function routeKey(filePath, declarationLine) {
   return `${filePath}::${declarationLine}`;
 }
@@ -133356,14 +134008,14 @@ async function detectIdempotencyPresence(rootDir, requestHeader) {
   await initParsers();
   const headerLower = requestHeader.toLowerCase();
   const fileBindings = /* @__PURE__ */ new Map();
-  const fileTrees = /* @__PURE__ */ new Map();
+  const pendingByFile = /* @__PURE__ */ new Map();
   const scanned = [];
   const tcIgnore = loadTcIgnore(rootDir);
   const visit = (dir) => {
-    for (const entry of fs36.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs37.readdirSync(dir, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === ".git")
         continue;
-      const full = path41.join(dir, entry.name);
+      const full = path40.join(dir, entry.name);
       if (tcIgnore.ignores(full))
         continue;
       if (entry.isDirectory()) {
@@ -133372,10 +134024,10 @@ async function detectIdempotencyPresence(rootDir, requestHeader) {
       }
       if (!entry.isFile())
         continue;
-      const ext2 = path41.extname(entry.name);
+      const ext2 = path40.extname(entry.name);
       if (!TS_EXT3.has(ext2))
         continue;
-      const source = fs36.readFileSync(full, "utf-8");
+      const source = fs37.readFileSync(full, "utf-8");
       const lang = ext2 === ".tsx" ? "tsx" : ext2 === ".ts" ? "typescript" : "javascript";
       let tree;
       try {
@@ -133383,19 +134035,23 @@ async function detectIdempotencyPresence(rootDir, requestHeader) {
       } catch {
         continue;
       }
-      scanned.push(full);
-      fileTrees.set(full, { tree, source });
-      fileBindings.set(full, collectBindings(tree, source, full, headerLower));
+      try {
+        scanned.push(full);
+        fileBindings.set(full, collectBindings(tree, source, full, headerLower));
+        pendingByFile.set(full, collectPendingRoutes(tree, source, headerLower));
+      } finally {
+        tree.delete();
+      }
     }
   };
   visit(rootDir);
   const protectedRoutes = /* @__PURE__ */ new Set();
-  for (const [filePath, { tree, source }] of fileTrees) {
-    walkRoutes(tree.rootNode, source, (declarationLine, middlewareIdents, handlerBody) => {
-      if (anyIdentIsAware(middlewareIdents, filePath, fileBindings) || handlerBody && nodeReadsHeader(handlerBody, source, headerLower)) {
-        protectedRoutes.add(routeKey(filePath, declarationLine));
+  for (const [filePath, routes] of pendingByFile) {
+    for (const r of routes) {
+      if (r.handlerReadsHeader || anyIdentIsAware(r.middlewareIdents, filePath, fileBindings)) {
+        protectedRoutes.add(routeKey(filePath, r.declarationLine));
       }
-    });
+    }
   }
   return { protectedRoutes, scannedFiles: scanned };
 }
@@ -133465,6 +134121,17 @@ function collectBindings(tree, source, filePath, headerLower) {
   visit(tree.rootNode);
   return { imports, awareLocally, declaredFunctions };
 }
+function collectPendingRoutes(tree, source, headerLower) {
+  const out = [];
+  walkRoutes(tree.rootNode, source, (declarationLine, middlewareIdents, handlerBody) => {
+    out.push({
+      declarationLine,
+      middlewareIdents,
+      handlerReadsHeader: !!handlerBody && nodeReadsHeader(handlerBody, source, headerLower)
+    });
+  });
+  return out;
+}
 function nodeReadsHeader(node2, source, headerLower) {
   const target = headerLower;
   let found = false;
@@ -133573,7 +134240,7 @@ function anyIdentIsAware(idents, filePath, fileBindings) {
 function resolveImportPath3(importingFile, sourceStr) {
   if (!sourceStr.startsWith("."))
     return null;
-  const baseRaw = path41.resolve(path41.dirname(importingFile), sourceStr);
+  const baseRaw = path40.resolve(path40.dirname(importingFile), sourceStr);
   const candidates = [];
   candidates.push(baseRaw);
   if (baseRaw.endsWith(".js")) {
@@ -133584,14 +134251,14 @@ function resolveImportPath3(importingFile, sourceStr) {
     const stem = baseRaw.slice(0, -4);
     candidates.push(stem + ".tsx", stem + ".ts");
   }
-  if (!path41.extname(baseRaw)) {
+  if (!path40.extname(baseRaw)) {
     for (const ext2 of [".ts", ".tsx", ".js", ".jsx"])
       candidates.push(baseRaw + ext2);
     for (const ext2 of [".ts", ".tsx", ".js", ".jsx"])
-      candidates.push(path41.join(baseRaw, `index${ext2}`));
+      candidates.push(path40.join(baseRaw, `index${ext2}`));
   }
   for (const c2 of candidates) {
-    if (fs36.existsSync(c2) && fs36.statSync(c2).isFile())
+    if (fs37.existsSync(c2) && fs37.statSync(c2).isFile())
       return c2;
   }
   return null;
@@ -135661,6 +136328,51 @@ function walk6(node2, visit) {
       walk6(c2, visit);
   }
 }
+function extractIdLiteralFromExport(_filePath, _source, tree) {
+  for (let i = 0; i < tree.rootNode.namedChildCount; i++) {
+    const node2 = tree.rootNode.namedChild(i);
+    if (!node2 || node2.type !== "export_statement")
+      continue;
+    for (let j2 = 0; j2 < node2.namedChildCount; j2++) {
+      const child = node2.namedChild(j2);
+      if (!child)
+        continue;
+      const id = extractIdFromObjectLike(child);
+      if (id !== null)
+        return id;
+    }
+  }
+  return null;
+}
+function extractIdFromObjectLike(node2) {
+  if (node2.type === "object") {
+    return extractIdProperty(node2);
+  }
+  if (node2.type === "call_expression") {
+    for (const arg of collectArgs4(node2)) {
+      if (arg.type === "object") {
+        const id = extractIdProperty(arg);
+        if (id !== null)
+          return id;
+      }
+    }
+  }
+  return null;
+}
+function extractIdProperty(obj) {
+  for (let i = 0; i < obj.namedChildCount; i++) {
+    const pair = obj.namedChild(i);
+    if (pair?.type !== "pair")
+      continue;
+    const key2 = pair.childForFieldName("key");
+    if (key2?.text !== "id")
+      continue;
+    const value = pair.childForFieldName("value");
+    if (value?.type === "string")
+      return value.text.slice(1, -1);
+  }
+  return null;
+}
 var ENUM_CONVENTION_NAME, ENUM_CONVENTION_SUFFIX;
 var init_ts_enums = __esm({
   "packages/contract-verifier/dist/extractor/enum/ts-enums.js"() {
@@ -135695,7 +136407,10 @@ function extractEnumClass(node2, filePath, source) {
   if (!name)
     return null;
   const supers = node2.childForFieldName("superclasses");
-  if (!supers || !superclassesLookEnum(supers, source))
+  if (!supers)
+    return null;
+  const isAutoEnum = superclassesHaveAutoEnum(supers, source);
+  if (!superclassesLookEnum(supers, source) && !isAutoEnum)
     return null;
   const body = node2.childForFieldName("body");
   if (!body)
@@ -135708,17 +136423,31 @@ function extractEnumClass(node2, filePath, source) {
     const assign = stmt.namedChild(0);
     if (assign?.type !== "assignment")
       continue;
+    const left = assign.childForFieldName("left");
     const right = assign.childForFieldName("right");
     if (right?.type === "string") {
       const v = stringValue(right, source);
       if (v !== null)
         values.push(v);
+    } else if (isAutoEnum && right?.type === "call" && left?.type === "identifier") {
+      values.push(source.slice(left.startIndex, left.endIndex));
     }
   }
   if (values.length === 0)
     return null;
   return mkEnum2(name, values, "py-enum", node2, filePath);
 }
+function superclassesHaveAutoEnum(supers, source) {
+  for (let i = 0; i < supers.namedChildCount; i++) {
+    const c2 = supers.namedChild(i);
+    if (!c2)
+      continue;
+    const text = source.slice(c2.startIndex, c2.endIndex);
+    if (/(^|\.)AutoEnum$/.test(text))
+      return true;
+  }
+  return false;
+}
 function superclassesLookEnum(supers, source) {
   for (let i = 0; i < supers.namedChildCount; i++) {
     const c2 = supers.namedChild(i);
@@ -135835,13 +136564,35 @@ var init_py_enums = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/enum/index.js
+import path41 from "node:path";
 async function extractEnumsFromDir(rootDir) {
   const raw = [];
+  const siblingIds = /* @__PURE__ */ new Map();
   await eachParsedSource(rootDir, (s) => {
     const matcher = MATCHERS2[s.lang];
     if (matcher)
       raw.push(...matcher(s));
+    const base = path41.basename(s.filePath);
+    if ((base === "index.ts" || base === "index.js") && s.lang === "typescript") {
+      const idVal = extractIdLiteralFromExport(s.filePath, s.source, s.tree);
+      if (idVal !== null) {
+        const groupDir = path41.dirname(path41.dirname(s.filePath));
+        const list = siblingIds.get(groupDir) ?? [];
+        list.push({ value: idVal, filePath: s.filePath });
+        siblingIds.set(groupDir, list);
+      }
+    }
   });
+  for (const [groupDir, entries] of siblingIds) {
+    if (entries.length < 3)
+      continue;
+    raw.push({
+      name: path41.basename(groupDir),
+      values: [...new Set(entries.map((e) => e.value))].sort(),
+      shape: "sibling-id-literal",
+      source: { filePath: entries[0].filePath, lineStart: 1, lineEnd: 1 }
+    });
+  }
   const seen = /* @__PURE__ */ new Map();
   for (const e of raw) {
     const key2 = `${e.name}|${e.values.join(",")}`;
@@ -135890,7 +136641,7 @@ var init_minimatch = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/manifests.js
-import fs37 from "node:fs";
+import fs38 from "node:fs";
 import path42 from "node:path";
 function collectDependencies(rootDir) {
   const out = [];
@@ -135898,7 +136649,7 @@ function collectDependencies(rootDir) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs37.readdirSync(dir, { withFileTypes: true });
+      entries = fs38.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -135930,7 +136681,7 @@ function collectDependencies(rootDir) {
 function readPackageJson(filePath) {
   let pkg;
   try {
-    pkg = JSON.parse(fs37.readFileSync(filePath, "utf-8"));
+    pkg = JSON.parse(fs38.readFileSync(filePath, "utf-8"));
   } catch {
     return [];
   }
@@ -135955,7 +136706,7 @@ function pyDistName(spec) {
 function readRequirements(filePath) {
   let text;
   try {
-    text = fs37.readFileSync(filePath, "utf-8");
+    text = fs38.readFileSync(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -135970,7 +136721,7 @@ function readRequirements(filePath) {
 function readPyproject(filePath) {
   let text;
   try {
-    text = fs37.readFileSync(filePath, "utf-8");
+    text = fs38.readFileSync(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -135995,7 +136746,7 @@ function readPyproject(filePath) {
 function readSetupPy(filePath) {
   let text;
   try {
-    text = fs37.readFileSync(filePath, "utf-8");
+    text = fs38.readFileSync(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -136034,7 +136785,7 @@ var init_manifests = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/forbidden/index.js
-import fs38 from "node:fs";
+import fs39 from "node:fs";
 import path43 from "node:path";
 function detectForbiddenFiles(rootDir, pattern) {
   const out = [];
@@ -136042,7 +136793,7 @@ function detectForbiddenFiles(rootDir, pattern) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs38.readdirSync(dir, { withFileTypes: true });
+      entries = fs39.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -136220,7 +136971,7 @@ function detectFlagInConfigFiles(rootDir, name) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs38.readdirSync(dir, { withFileTypes: true });
+      entries = fs39.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -136239,7 +136990,7 @@ function detectFlagInConfigFiles(rootDir, name) {
         continue;
       let source;
       try {
-        source = fs38.readFileSync(full, "utf-8");
+        source = fs39.readFileSync(full, "utf-8");
       } catch {
         continue;
       }
@@ -136279,6 +137030,7 @@ var init_forbidden = __esm({
 // packages/contract-verifier/dist/extractor/constant/ts-constants.js
 function extractConstantsFromFile(filePath, source, tree) {
   const out = [];
+  const seenWindowGlobals = /* @__PURE__ */ new Set();
   walk9(tree.rootNode, (node2) => {
     if (node2.type === "variable_declarator") {
       const result = extractDeclarator(node2, filePath, source);
@@ -136291,6 +137043,22 @@ function extractConstantsFromFile(filePath, source, tree) {
         out.push(result);
       return true;
     }
+    if (node2.type === "member_expression") {
+      const objNode = node2.childForFieldName("object");
+      const propNode = node2.childForFieldName("property");
+      if (objNode?.text === "window" && propNode?.type === "property_identifier") {
+        const propName = propNode.text;
+        if (!seenWindowGlobals.has(propName)) {
+          seenWindowGlobals.add(propName);
+          out.push({
+            name: propName,
+            value: void 0,
+            shape: "window-global",
+            source: mkLoc(node2, filePath)
+          });
+        }
+      }
+    }
     return true;
   });
   return out;
@@ -136330,6 +137098,12 @@ function extractDeclarator(node2, filePath, source) {
         shape: "object-property",
         source: mkLoc(kNode, filePath)
       });
+      out.push({
+        name: `${name}.${k}`,
+        value: v,
+        shape: "object-property",
+        source: mkLoc(kNode, filePath)
+      });
     }
     return out;
   }
@@ -136665,13 +137439,13 @@ var init_constant = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/effect/index.js
-function isCall(n) {
+function isCall2(n) {
   return n.type === "call_expression" || n.type === "call";
 }
-function isMember(n) {
+function isMember2(n) {
   return n?.type === "member_expression" || n?.type === "attribute";
 }
-function memberProp(n, source) {
+function memberProp2(n, source) {
   const p2 = n.childForFieldName("property") ?? n.childForFieldName("attribute");
   return p2 ? source.slice(p2.startIndex, p2.endIndex) : "";
 }
@@ -136679,7 +137453,7 @@ function memberObject(n, source) {
   const o = n.childForFieldName("object");
   return o ? source.slice(o.startIndex, o.endIndex) : "";
 }
-function strVal(n, source) {
+function strVal2(n, source) {
   if (n.type !== "string")
     return null;
   const frag = n.namedChildren.find((c2) => c2.type === "string_fragment" || c2.type === "string_content");
@@ -136688,19 +137462,19 @@ function strVal(n, source) {
 function matchEffects(s) {
   const out = [];
   const visit = (node2) => {
-    if (isCall(node2)) {
+    if (isCall2(node2)) {
       const fn = node2.childForFieldName("function");
       const args = node2.childForFieldName("arguments");
       if (fn && args) {
         let channel = null;
-        if (isMember(fn) && memberProp(fn, s.source) === "emit") {
+        if (isMember2(fn) && memberProp2(fn, s.source) === "emit") {
           channel = memberObject(fn, s.source) || "event-bus";
         } else if (fn.type === "identifier" && /^emit/i.test(s.source.slice(fn.startIndex, fn.endIndex))) {
           channel = "event-bus";
         }
         if (channel !== null) {
           const first2 = args.namedChild(0);
-          const event = first2 ? strVal(first2, s.source) : null;
+          const event = first2 ? strVal2(first2, s.source) : null;
           if (event) {
             out.push({
               event,
@@ -136747,255 +137521,16 @@ var init_effect = __esm({
 function extractEmissionFacts(ops) {
   const facts = /* @__PURE__ */ new Map();
   for (const op of ops) {
-    if (!op.handlerBody || !op.handlerSource)
+    if (!op.emission)
       continue;
-    const body = op.handlerBody;
-    const source = op.handlerSource;
-    const callMap = collectEmitCalls(body, source);
-    const failureEmitSites = [];
-    for (const [event, calls] of callMap) {
-      for (const call of calls) {
-        if (emitIsInFailureBlock(call, source)) {
-          failureEmitSites.push({
-            event,
-            lineStart: call.startPosition.row + 1,
-            lineEnd: call.endPosition.row + 1
-          });
-        }
-      }
-    }
     facts.set(op.identity, {
       filePath: op.filePath,
       declarationLine: op.declarationLine,
-      staticEvents: new Set(callMap.keys()),
-      hasDynamicEmit: handlerHasDynamicEmit(body, source),
-      failureEmitSites,
-      branchEmits: collectBranchEmits(body, source)
+      ...op.emission
     });
   }
   return facts;
 }
-function isCall2(n) {
-  return n.type === "call_expression" || n.type === "call";
-}
-function isMember2(n) {
-  return n?.type === "member_expression" || n?.type === "attribute";
-}
-function memberProp2(n, source) {
-  const p2 = n.childForFieldName("property") ?? n.childForFieldName("attribute");
-  return p2 ? source.slice(p2.startIndex, p2.endIndex) : "";
-}
-function isBlock(n) {
-  return n.type === "statement_block" || n.type === "block";
-}
-function isFnBoundary(n) {
-  return n.type === "function_declaration" || n.type === "arrow_function" || n.type === "function_expression" || n.type === "function_definition";
-}
-function isControlFlow(n) {
-  return /^(if_statement|switch_statement|try_statement|for_statement|for_in_statement|while_statement|do_statement)$/.test(n.type);
-}
-function strVal2(n, source) {
-  if (n.type !== "string")
-    return null;
-  const frag = n.namedChildren.find((c2) => c2.type === "string_fragment" || c2.type === "string_content");
-  return frag ? source.slice(frag.startIndex, frag.endIndex) : null;
-}
-function isEmitFn(fn, source) {
-  if (isMember2(fn))
-    return memberProp2(fn, source) === "emit";
-  if (fn.type === "identifier")
-    return /^emit/i.test(source.slice(fn.startIndex, fn.endIndex));
-  return false;
-}
-function collectEmitCalls(body, source) {
-  const out = /* @__PURE__ */ new Map();
-  const visit = (node2) => {
-    if (isCall2(node2)) {
-      const fn = node2.childForFieldName("function");
-      const args = node2.childForFieldName("arguments");
-      if (fn && args && isEmitFn(fn, source)) {
-        const first2 = args.namedChild(0);
-        const eventName = first2 ? strVal2(first2, source) : null;
-        if (eventName !== null) {
-          const arr = out.get(eventName) ?? [];
-          arr.push(node2);
-          out.set(eventName, arr);
-        }
-      }
-    }
-    for (const child of node2.namedChildren)
-      visit(child);
-  };
-  visit(body);
-  return out;
-}
-function handlerHasDynamicEmit(body, source) {
-  let dynamic = false;
-  const visit = (node2) => {
-    if (dynamic)
-      return;
-    if (isCall2(node2)) {
-      const fn = node2.childForFieldName("function");
-      const args = node2.childForFieldName("arguments");
-      if (fn && args && isEmitFn(fn, source)) {
-        const first2 = args.namedChild(0);
-        if (first2 && first2.type !== "string") {
-          dynamic = true;
-          return;
-        }
-      }
-    }
-    for (const child of node2.namedChildren) {
-      visit(child);
-      if (dynamic)
-        return;
-    }
-  };
-  visit(body);
-  return dynamic;
-}
-function emitIsInFailureBlock(emitCall, source) {
-  let cur = emitCall.parent;
-  while (cur) {
-    if (isBlock(cur))
-      return blockContainsFailureStatusShallow(cur, source);
-    if (isFnBoundary(cur))
-      break;
-    cur = cur.parent;
-  }
-  return false;
-}
-function blockContainsFailureStatusShallow(block, source) {
-  for (const stmt of block.namedChildren) {
-    if (containsTopLevelFailureStatus(stmt, source))
-      return true;
-  }
-  return false;
-}
-function containsTopLevelFailureStatus(stmt, source) {
-  if (isControlFlow(stmt))
-    return false;
-  let found = false;
-  const visit = (node2) => {
-    if (found)
-      return;
-    if (isControlFlow(node2))
-      return;
-    if (isCall2(node2) && callEmitsFailureStatus(node2, source)) {
-      found = true;
-      return;
-    }
-    for (const child of node2.namedChildren) {
-      visit(child);
-      if (found)
-        return;
-    }
-  };
-  visit(stmt);
-  return found;
-}
-function callEmitsFailureStatus(call, source) {
-  const fn = call.childForFieldName("function");
-  if (!fn)
-    return false;
-  const args = call.childForFieldName("arguments");
-  if (!args)
-    return false;
-  if (isMember2(fn) && memberProp2(fn, source) === "status") {
-    const arg = args.namedChild(0);
-    return !!arg && arg.type === "number" && /^[45]\d{2}$/.test(source.slice(arg.startIndex, arg.endIndex));
-  }
-  const fnName = fn.type === "identifier" ? source.slice(fn.startIndex, fn.endIndex) : isMember2(fn) ? memberProp2(fn, source) : "";
-  if (fnName === "JSONResponse" || fnName === "HTTPException" || fnName === "Response") {
-    for (let i = 0; i < args.namedChildCount; i++) {
-      const a = args.namedChild(i);
-      if (a?.type === "keyword_argument") {
-        const name = a.childForFieldName("name");
-        const value = a.childForFieldName("value");
-        if (name && value && source.slice(name.startIndex, name.endIndex) === "status_code" && value.type === "integer" && /^[45]\d{2}$/.test(source.slice(value.startIndex, value.endIndex))) {
-          return true;
-        }
-      }
-    }
-    const first2 = args.namedChild(0);
-    if (first2?.type === "integer" && /^[45]\d{2}$/.test(source.slice(first2.startIndex, first2.endIndex)))
-      return true;
-  }
-  return false;
-}
-function collectBranchEmits(body, source) {
-  const out = /* @__PURE__ */ new Map();
-  const visit = (node2) => {
-    if (node2.type === "if_statement") {
-      const cond = node2.childForFieldName("condition");
-      const consequent = node2.childForFieldName("consequence");
-      const alternative = node2.childForFieldName("alternative");
-      const literal = cond ? conditionLiteral(cond, source) : null;
-      if (literal !== null && consequent && !out.has(literal)) {
-        out.set(literal, {
-          consequentEmits: blockHasAnyEmit(consequent, source),
-          alternativeEmits: alternative ? blockHasAnyEmit(alternative, source) : false
-        });
-      }
-    }
-    for (const child of node2.namedChildren)
-      visit(child);
-  };
-  visit(body);
-  return out;
-}
-function conditionLiteral(node2, source) {
-  const u2 = unwrapParens(node2);
-  if (u2.type === "binary_expression") {
-    const opNode = u2.childForFieldName("operator");
-    const op = opNode ? source.slice(opNode.startIndex, opNode.endIndex) : "";
-    if (op !== "===" && op !== "==")
-      return null;
-    return litText(u2.childForFieldName("left"), source) ?? litText(u2.childForFieldName("right"), source);
-  }
-  if (u2.type === "comparison_operator") {
-    const a = u2.namedChild(0);
-    const b = u2.namedChild(1);
-    if (!a || !b || source.slice(a.endIndex, b.startIndex).trim() !== "==")
-      return null;
-    return litText(a, source) ?? litText(b, source);
-  }
-  return null;
-}
-function litText(node2, source) {
-  return node2 && node2.type === "string" ? strVal2(node2, source) : null;
-}
-function unwrapParens(node2) {
-  let cur = node2;
-  while (cur.type === "parenthesized_expression") {
-    const child = cur.namedChildren[0];
-    if (!child)
-      break;
-    cur = child;
-  }
-  return cur;
-}
-function blockHasAnyEmit(block, source) {
-  let found = false;
-  const visit = (node2) => {
-    if (found)
-      return;
-    if (isCall2(node2)) {
-      const fn = node2.childForFieldName("function");
-      if (fn && isEmitFn(fn, source)) {
-        found = true;
-        return;
-      }
-    }
-    for (const child of node2.namedChildren) {
-      visit(child);
-      if (found)
-        return;
-    }
-  };
-  visit(block);
-  return found;
-}
 var init_emission_facts = __esm({
   "packages/contract-verifier/dist/extractor/effect/emission-facts.js"() {
     "use strict";
@@ -137003,7 +137538,7 @@ var init_emission_facts = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/entity-schema/index.js
-import fs39 from "node:fs";
+import fs40 from "node:fs";
 import path44 from "node:path";
 async function extractEntitiesFromDir(rootDir) {
   const tcIgnore = loadTcIgnore(rootDir);
@@ -137011,7 +137546,7 @@ async function extractEntitiesFromDir(rootDir) {
   const walk11 = (dir) => {
     let entries;
     try {
-      entries = fs39.readdirSync(dir, { withFileTypes: true });
+      entries = fs40.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -137024,7 +137559,7 @@ async function extractEntitiesFromDir(rootDir) {
       if (e.isDirectory())
         walk11(full);
       else if (e.isFile() && e.name.endsWith(".prisma")) {
-        out.push(...parsePrismaModels(full, fs39.readFileSync(full, "utf-8")));
+        out.push(...parsePrismaModels(full, fs40.readFileSync(full, "utf-8")));
       }
     }
   };
@@ -137568,7 +138103,7 @@ async function extractFormulaFacts(rootDir, targetField) {
   return result;
 }
 function candidateNames(fieldName) {
-  const camel = fieldName.replace(/_([a-z])/g, (_, c2) => c2.toUpperCase());
+  const camel = fieldName.replace(/_([a-z])/g, (_2, c2) => c2.toUpperCase());
   const snake = fieldName.replace(/[A-Z]/g, (c2) => `_${c2.toLowerCase()}`);
   const names = /* @__PURE__ */ new Set();
   for (const base of /* @__PURE__ */ new Set([fieldName, camel, snake])) {
@@ -138119,7 +138654,7 @@ var init_characteristic_imports = __esm({
 });
 
 // packages/contract-verifier/dist/extractor/architecture/shared/config-files.js
-import fs40 from "node:fs";
+import fs41 from "node:fs";
 import path45 from "node:path";
 function collectFileIndex(rootDir) {
   const files = [];
@@ -138128,7 +138663,7 @@ function collectFileIndex(rootDir) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs40.readdirSync(dir, { withFileTypes: true });
+      entries = fs41.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -138154,7 +138689,7 @@ function collectFileIndex(rootDir) {
         return cache2.get(relPath);
       let text;
       try {
-        text = fs40.readFileSync(path45.join(rootDir, relPath), "utf-8");
+        text = fs41.readFileSync(path45.join(rootDir, relPath), "utf-8");
       } catch {
         text = null;
       }
@@ -138607,15 +139142,24 @@ __export(extractor_exports, {
   extractStateMachineFacts: () => extractStateMachineFacts,
   getArchitectureDetector: () => getArchitectureDetector
 });
-import fs41 from "node:fs";
+import fs42 from "node:fs";
 import path47 from "node:path";
+function isTestFile2(filePath) {
+  const parts = filePath.replace(/\\/g, "/").split("/");
+  const fileName = parts[parts.length - 1];
+  if (/\.(test|spec)\.(t|j)sx?$/.test(fileName))
+    return true;
+  if (parts.includes("__tests__"))
+    return true;
+  return false;
+}
 async function extractOperationsFromDir(rootDir) {
   await initParsers();
   const rawOps = [];
   const fileAnalyses = [];
   const tcIgnore = loadTcIgnore(rootDir);
   const visit = (dir) => {
-    for (const entry of fs41.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs42.readdirSync(dir, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === ".git")
         continue;
       const full = path47.join(dir, entry.name);
@@ -138630,13 +139174,19 @@ async function extractOperationsFromDir(rootDir) {
       const ext2 = path47.extname(entry.name);
       if (!TS_EXT4.has(ext2))
         continue;
-      const source = fs41.readFileSync(full, "utf-8");
+      if (isTestFile2(full))
+        continue;
+      const source = fs42.readFileSync(full, "utf-8");
       const lang = ext2 === ".ts" || ext2 === ".tsx" ? ext2 === ".tsx" ? "tsx" : "typescript" : "javascript";
+      let tree;
       try {
-        const tree = parseFile(full, source, lang);
+        tree = parseFile(full, source, lang);
         rawOps.push(...extractOperationsFromFile(full, source, tree));
+        rawOps.push(...extractPluginStyleRoutesFromFile(full, source, tree));
         fileAnalyses.push(analyzeRouterFile(full, source, tree));
       } catch {
+      } finally {
+        tree?.delete();
       }
     }
   };
@@ -138702,6 +139252,8 @@ function compareOperation(input) {
   const codeByStatus = /* @__PURE__ */ new Map();
   for (const r of input.code.responses)
     codeByStatus.set(r.status, r);
+  if (input.code.responses.length === 0)
+    return out;
   for (const specResp of input.spec.responses) {
     if (specResp.inheritedFrom)
       continue;
@@ -139090,6 +139642,8 @@ function compareAuthRequirement(input) {
       continue;
     if (!matchesOperation2(input.contract.selector, op, specOp))
       continue;
+    if (op.authExempt)
+      continue;
     if (input.protectedFiles.has(op.filePath))
       continue;
     if (input.contract.except?.some((ex) => matchesOperation2(ex, op, specOp)))
@@ -139186,9 +139740,9 @@ function compareAuthorizationRule(input) {
   for (const op of input.recognizedOps) {
     if (!targets.has(op.identity))
       continue;
-    if (!op.handlerBody || !op.handlerSource)
+    if (!op.ownershipCheckCandidates)
       continue;
-    if (handlerHasOwnershipCheck(op.handlerBody, op.handlerSource, fieldName))
+    if (op.ownershipCheckCandidates.some((c2) => c2.resourceField === fieldName))
       continue;
     out.push({
       id: randomUUID13(),
@@ -139212,79 +139766,6 @@ function parseResourceField(predicate) {
     return m[1];
   return null;
 }
-function handlerHasOwnershipCheck(body, source, fieldName) {
-  let found = false;
-  const check = (left, right) => (matchesAuthSide(left, source) || matchesAuthSide(right, source)) && (matchesResourceField(left, source, fieldName) || matchesResourceField(right, source, fieldName));
-  const visit = (node2) => {
-    if (found)
-      return;
-    if (node2.type === "binary_expression") {
-      const opNode = node2.childForFieldName("operator");
-      const op = opNode ? source.slice(opNode.startIndex, opNode.endIndex) : "";
-      if (op === "===" || op === "==" || op === "!==" || op === "!=") {
-        const left = node2.childForFieldName("left");
-        const right = node2.childForFieldName("right");
-        if (left && right && check(left, right)) {
-          found = true;
-          return;
-        }
-      }
-    }
-    if (node2.type === "comparison_operator") {
-      const a = node2.namedChild(0);
-      const b = node2.namedChild(1);
-      if (a && b) {
-        const op = source.slice(a.endIndex, b.startIndex).trim();
-        if ((op === "==" || op === "!=") && check(a, b)) {
-          found = true;
-          return;
-        }
-      }
-    }
-    for (const child of node2.namedChildren) {
-      visit(child);
-      if (found)
-        return;
-    }
-  };
-  visit(body);
-  return found;
-}
-function matchesAuthSide(node2, source) {
-  if (node2.type === "attribute") {
-    return /\b(req|request)\.(auth|user)\b|\bcurrent_user\b/.test(source.slice(node2.startIndex, node2.endIndex));
-  }
-  let cur = node2;
-  while (cur) {
-    if (cur.type === "identifier") {
-      const text = source.slice(cur.startIndex, cur.endIndex);
-      if (text === "req" || text === "request")
-        return false;
-      return false;
-    }
-    if (cur.type === "member_expression") {
-      const text = source.slice(cur.startIndex, cur.endIndex);
-      if (/\b(req|request)\.auth\b|\b(req|request)\?\.auth\b/.test(text))
-        return true;
-      cur = cur.childForFieldName("object");
-      continue;
-    }
-    if (cur.type === "optional_chain_expression" || cur.type === "subscript_expression") {
-      cur = cur.childForFieldName("object");
-      continue;
-    }
-    return false;
-  }
-  return false;
-}
-function matchesResourceField(node2, source, fieldName) {
-  if (node2.type !== "member_expression" && node2.type !== "attribute")
-    return false;
-  const prop = node2.childForFieldName("property") ?? node2.childForFieldName("attribute");
-  if (!prop)
-    return false;
-  return source.slice(prop.startIndex, prop.endIndex) === fieldName;
-}
 var init_authorization_rule2 = __esm({
   "packages/contract-verifier/dist/comparator/authorization-rule.js"() {
     "use strict";
@@ -139972,10 +140453,10 @@ function compareEnum(input) {
     });
   } else {
     for (const m of nameMatches) {
-      const specSet = new Set(contract.values);
-      const codeSet = new Set(m.values);
-      const missing = contract.values.filter((v) => !codeSet.has(v));
-      const extra = m.values.filter((v) => !specSet.has(v));
+      const specNorm = new Map(contract.values.map((v) => [normalizeValue(v), v]));
+      const codeNorm = new Map(m.values.map((v) => [normalizeValue(v), v]));
+      const missing = contract.values.filter((v) => !codeNorm.has(normalizeValue(v)));
+      const extra = m.values.filter((v) => !specNorm.has(normalizeValue(v)));
       for (const v of missing) {
         drifts.push(mkValueDrift(ref, "missing-value", v, m, contract.values));
       }
@@ -140003,10 +140484,10 @@ function compareEnum(input) {
       continue;
     }
     for (const m of subsetMatches) {
-      const specSet = new Set(subset.values);
-      const codeSet = new Set(m.values);
-      const missing = subset.values.filter((v) => !codeSet.has(v));
-      const extra = m.values.filter((v) => !specSet.has(v));
+      const specNorm = new Map(subset.values.map((v) => [normalizeValue(v), v]));
+      const codeNorm = new Map(m.values.map((v) => [normalizeValue(v), v]));
+      const missing = subset.values.filter((v) => !codeNorm.has(normalizeValue(v)));
+      const extra = m.values.filter((v) => !specNorm.has(normalizeValue(v)));
       for (const v of missing) {
         drifts.push(mkSubsetDrift(ref, subset.name, "missing-value", v, m, subset.values));
       }
@@ -140036,6 +140517,12 @@ function matchByName(contract, codeEnums, specName) {
       continue;
     }
     if (codeName.includes(target) || target.includes(codeName)) {
+      if (!codeName.includes(target)) {
+        const qualifyingPrefix = target.slice(0, target.indexOf(codeName));
+        if (qualifyingPrefix.length > 5) {
+          continue;
+        }
+      }
       if (valueSetOverlap(contract.values, e.values) >= 0.5) {
         out.push(e);
         continue;
@@ -140048,13 +140535,22 @@ function matchByName(contract, codeEnums, specName) {
       if (overlap >= 0.6 && sizeDiff <= 2) {
         out.push(e);
       }
+    } else if (minLen >= 2) {
+      const overlap = valueSetOverlap(contract.values, e.values);
+      const sizeDiff = Math.abs(contract.values.length - e.values.length);
+      if (overlap === 1 && sizeDiff === 0) {
+        out.push(e);
+      }
     }
   }
   return out;
 }
+function normalizeValue(v) {
+  return v.replace(/[^A-Za-z0-9]/g, "").toLowerCase();
+}
 function valueSetOverlap(a, b) {
-  const aSet = new Set(a);
-  const bSet = new Set(b);
+  const aSet = new Set(a.map(normalizeValue));
+  const bSet = new Set(b.map(normalizeValue));
   const intersection = [...aSet].filter((v) => bSet.has(v)).length;
   const union = (/* @__PURE__ */ new Set([...aSet, ...bSet])).size;
   return union === 0 ? 0 : intersection / union;
@@ -140166,7 +140662,26 @@ import { randomUUID as randomUUID21 } from "node:crypto";
 function compareNamedConstant(input) {
   const { ref, contract, codeConstants } = input;
   const target = normalizeName2(ref.identity);
-  const matches = codeConstants.filter((c2) => normalizeName2(c2.name) === target);
+  let matches = codeConstants.filter((c2) => normalizeName2(c2.name) === target);
+  if (matches.length === 0 && ref.identity.includes(".")) {
+    const lastPart = ref.identity.split(".").pop();
+    const lastTarget = normalizeName2(lastPart);
+    matches = codeConstants.filter((c2) => {
+      if (normalizeName2(c2.name) !== lastTarget)
+        return false;
+      if (c2.shape === "window-global")
+        return true;
+      if (c2.shape === "const-literal") {
+        return contract.expectedValue === void 0 || deepEqual(
+          contract.expectedValue,
+          c2.value,
+          /*allowExtraCodeKeys*/
+          true
+        );
+      }
+      return false;
+    });
+  }
   if (matches.length === 0) {
     return [{
       id: randomUUID21(),
@@ -140177,11 +140692,14 @@ function compareNamedConstant(input) {
       filePath: ref.identity,
       lineStart: 0,
       lineEnd: 0,
-      message: `Spec declares constant \`${ref.identity}\` (expected ${formatValue2(contract.expectedValue)}), but no code-side constant matches by name.`,
+      message: `Spec declares constant \`${ref.identity}\` but no code-side constant matches by name.`,
       specSide: `expected: ${formatValue2(contract.expectedValue)}`,
       codeSide: "<no match>"
     }];
   }
+  if (contract.expectedValue === void 0) {
+    return [];
+  }
   const drifts = [];
   for (const m of matches) {
     if (deepEqual(
@@ -140272,6 +140790,8 @@ function compareArchitectureDecision(input) {
   const { ref, contract, detected, codeDir } = input;
   const { category, chosen, reason } = contract;
   const why = reason ? ` Rationale: ${reason}` : "";
+  if (!chosen)
+    return [];
   if (detected.confidence === "inconclusive") {
     return [
       mk(ref, `architecture.${category}.inconclusive`, "info", codeDir, 0, `Spec asserts ${category} = \`${chosen}\`, but no ${category} signals were found in the code \u2014 the claim is not testable from current signals.${why}`, `${category}: ${chosen}`, "<no signals>")
@@ -140375,12 +140895,12 @@ var init_types4 = __esm({
 });
 
 // packages/contract-verifier/dist/verify.js
-import fs42 from "node:fs";
+import fs43 from "node:fs";
 import path49 from "node:path";
 async function verify(opts) {
   const specFiles = [];
   walkTcFiles(opts.contractsDir, (filePath) => {
-    const source = fs42.readFileSync(filePath, "utf-8");
+    const source = fs43.readFileSync(filePath, "utf-8");
     specFiles.push(parseFile2(filePath, source));
   }, opts.includeInferred ?? false);
   const resolution = resolve8(specFiles);
@@ -140684,7 +141204,7 @@ async function verify(opts) {
   };
 }
 function walkTcFiles(rootDir, visit, includeInferred) {
-  for (const entry of fs42.readdirSync(rootDir, { withFileTypes: true })) {
+  for (const entry of fs43.readdirSync(rootDir, { withFileTypes: true })) {
     const full = path49.join(rootDir, entry.name);
     if (entry.isDirectory()) {
       if (!includeInferred && entry.name === "_inferred")
@@ -140930,7 +141450,7 @@ var init_serialize = __esm({
 });
 
 // packages/contract-verifier/dist/infer/index.js
-import fs43 from "node:fs";
+import fs44 from "node:fs";
 import path51 from "node:path";
 async function infer(opts) {
   const authored = loadAuthored(opts.contractsDir);
@@ -140954,7 +141474,7 @@ async function infer(opts) {
 function loadAuthored(contractsDir) {
   const files = [];
   walkAuthoredTcFiles(contractsDir, (filePath) => {
-    files.push(parseFile2(filePath, fs43.readFileSync(filePath, "utf-8")));
+    files.push(parseFile2(filePath, fs44.readFileSync(filePath, "utf-8")));
   });
   return resolve8(files).index;
 }
@@ -141494,21 +142014,21 @@ function writeInferred(contractsDir, decisions, options = {}) {
       proposed.push(filePath);
       continue;
     }
-    fs43.mkdirSync(path51.dirname(filePath), { recursive: true });
-    const existing = fs43.existsSync(filePath) ? fs43.readFileSync(filePath, "utf-8") : null;
+    fs44.mkdirSync(path51.dirname(filePath), { recursive: true });
+    const existing = fs44.existsSync(filePath) ? fs44.readFileSync(filePath, "utf-8") : null;
     if (existing === r.tcSource)
       continue;
-    fs43.writeFileSync(filePath, r.tcSource);
+    fs44.writeFileSync(filePath, r.tcSource);
     written.push(filePath);
   }
-  if (!options.dryRun && fs43.existsSync(root))
+  if (!options.dryRun && fs44.existsSync(root))
     pruneStale(root, live);
   return { written, proposed };
 }
 function walkAuthoredTcFiles(rootDir, visit) {
-  if (!fs43.existsSync(rootDir))
+  if (!fs44.existsSync(rootDir))
     return;
-  for (const entry of fs43.readdirSync(rootDir, { withFileTypes: true })) {
+  for (const entry of fs44.readdirSync(rootDir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
       if (entry.name === INFERRED_DIR)
         continue;
@@ -141524,22 +142044,22 @@ function toRelCode(codeDir, fp) {
 }
 function pruneStale(root, live) {
   const visit = (dir) => {
-    if (!fs43.existsSync(dir))
+    if (!fs44.existsSync(dir))
       return false;
     let dirEmpty = true;
-    for (const entry of fs43.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs44.readdirSync(dir, { withFileTypes: true })) {
       const full = path51.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (visit(full)) {
           try {
-            fs43.rmdirSync(full);
+            fs44.rmdirSync(full);
           } catch {
           }
         } else {
           dirEmpty = false;
         }
       } else if (entry.isFile() && entry.name.endsWith(".tc") && !live.has(full)) {
-        fs43.unlinkSync(full);
+        fs44.unlinkSync(full);
       } else {
         dirEmpty = false;
       }
@@ -141698,9 +142218,10 @@ async function runAdd(options = {}) {
 
 // tools/cli/src/commands/analyze.ts
 init_dist4();
-import path19 from "node:path";
+import path18 from "node:path";
 
 // packages/shared/dist/llm/transport.js
+init_claude_binary();
 import { spawn } from "node:child_process";
 import { createHash as createHash2, randomUUID } from "node:crypto";
 import fs4 from "node:fs";
@@ -141711,7 +142232,7 @@ function stripCodeFences(text) {
   return fence ? fence[1] : trimmed2;
 }
 function cliTransport(opts = {}) {
-  const bin = opts.bin ?? process.env.CLAUDE_CODE_BIN ?? "claude";
+  const bin = opts.bin ?? resolveClaudeBinary();
   return (req) => new Promise((resolve9, reject) => {
     const modelArgs = [];
     if (req.model)
@@ -141859,8 +142380,12 @@ init_project_config();
 init_git();
 init_logger();
 
+// tools/cli/src/lib/claude-preflight.ts
+init_dist4();
+
 // packages/core/dist/lib/cli-binary.js
 var import_cross_spawn2 = __toESM(require_cross_spawn(), 1);
+init_dist7();
 function isCliBinaryAvailable(binary2) {
   const result = (0, import_cross_spawn2.sync)(binary2, ["--version"], {
     stdio: "ignore",
@@ -141868,9 +142393,80 @@ function isCliBinaryAvailable(binary2) {
   });
   return result.status === 0;
 }
+function cleanClaudeEnv() {
+  const env = { ...process.env };
+  for (const key2 of Object.keys(env)) {
+    if (key2.startsWith("CLAUDE_CODE") || key2.startsWith("CLAUDE_INTERNAL")) {
+      delete env[key2];
+    }
+  }
+  return env;
+}
+function classifyClaudeProbe(code, output) {
+  if (code === 0)
+    return { ok: true };
+  return { ok: false, reason: "failed", code, output: output.trim() };
+}
+function checkClaudeAuth(binary2 = resolveClaudeBinary(), options = {}) {
+  if (!isCliBinaryAvailable(binary2)) {
+    return Promise.resolve({ ok: false, reason: "not-found" });
+  }
+  const timeoutMs = options.timeoutMs ?? 6e4;
+  return new Promise((resolve9) => {
+    const proc = (0, import_cross_spawn2.spawn)(binary2, ["-p", "Reply with the single word: ok"], {
+      stdio: ["ignore", "pipe", "pipe"],
+      env: cleanClaudeEnv()
+    });
+    const output = [];
+    let settled = false;
+    const finish = (r) => {
+      if (settled)
+        return;
+      settled = true;
+      clearTimeout(timer);
+      resolve9(r);
+    };
+    const timer = setTimeout(() => {
+      proc.kill("SIGKILL");
+      finish({ ok: true });
+    }, timeoutMs);
+    proc.stdout?.on("data", (b) => output.push(b));
+    proc.stderr?.on("data", (b) => output.push(b));
+    proc.on("error", () => finish({ ok: true }));
+    proc.on("close", (code) => finish(classifyClaudeProbe(code, Buffer.concat(output).toString("utf-8"))));
+  });
+}
+
+// tools/cli/src/lib/claude-preflight.ts
+async function preflightClaudeOrExit() {
+  const s = fe();
+  s.start("Checking the `claude` CLI is logged in");
+  const result = await checkClaudeAuth();
+  if (result.ok) {
+    s.stop("`claude` CLI ready");
+    return;
+  }
+  s.stop("`claude` CLI not ready");
+  const { title, hint } = describeClaudePreflightFailure(result);
+  O2.error(title);
+  O2.message(hint);
+  pt("Aborted \u2014 fix the `claude` CLI and retry.");
+  process.exit(1);
+}
+function describeClaudePreflightFailure(result) {
+  if (result.reason === "not-found") {
+    return {
+      title: "The `claude` CLI isn't installed or isn't on your PATH.",
+      hint: "Install Claude Code (https://docs.anthropic.com/en/docs/claude-code), or set CLAUDE_CODE_BINARY to its name/path, then retry."
+    };
+  }
+  return {
+    title: `The \`claude\` CLI failed (exit ${result.code ?? "null"}). Its output:`,
+    hint: result.output || "(no output)"
+  };
+}
 
 // tools/cli/src/commands/analyze.ts
-init_config2();
 init_helpers();
 
 // tools/cli/src/commands/llm-prompt.ts
@@ -141913,8 +142509,8 @@ function showFirstRunNotice() {
 // tools/cli/src/community-prompts.ts
 init_paths();
 init_helpers();
-import fs14 from "node:fs";
-import path18 from "node:path";
+import fs15 from "node:fs";
+import path17 from "node:path";
 var DISCORD_URL = "https://discord.gg/TanxB63arz";
 var GITHUB_URL = "https://github.com/truecourse-ai/truecourse";
 function link(url) {
@@ -141962,11 +142558,11 @@ var DEFAULT_CONFIG3 = {
   starShown: false
 };
 function getConfigPath2() {
-  return path18.join(getGlobalDir(), "community-prompts.json");
+  return path17.join(getGlobalDir(), "community-prompts.json");
 }
 function readConfig2() {
   try {
-    const raw = fs14.readFileSync(getConfigPath2(), "utf-8");
+    const raw = fs15.readFileSync(getConfigPath2(), "utf-8");
     return { ...DEFAULT_CONFIG3, ...JSON.parse(raw) };
   } catch {
     return { ...DEFAULT_CONFIG3 };
@@ -141974,8 +142570,8 @@ function readConfig2() {
 }
 function writeConfig2(config2) {
   const configPath = getConfigPath2();
-  fs14.mkdirSync(path18.dirname(configPath), { recursive: true });
-  fs14.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
+  fs15.mkdirSync(path17.dirname(configPath), { recursive: true });
+  fs15.writeFileSync(configPath, JSON.stringify(config2, null, 2) + "\n", "utf-8");
 }
 function recordAnalyzeAndMaybePrompt() {
   if (!isInteractive()) return;
@@ -142004,15 +142600,6 @@ ${link(GITHUB_URL)}`
 }
 
 // tools/cli/src/commands/analyze.ts
-function ensureClaudeCli() {
-  const binary2 = config.claudeCodeBinary;
-  if (isCliBinaryAvailable(binary2)) return;
-  O2.error(
-    `Claude Code CLI not found (tried \`${binary2}\`). TrueCourse requires the Claude Code binary to run analysis.
-Install it from https://docs.anthropic.com/en/docs/claude-code, or set CLAUDE_CODE_BINARY to its name or absolute path if it's installed elsewhere.`
-  );
-  process.exit(1);
-}
 function resolveOrInitProject() {
   const repoDir = resolveRepoDir(process.cwd()) ?? process.cwd();
   ensureRepoTruecourseDir(repoDir);
@@ -142139,18 +142726,18 @@ async function resolveStashDecision(options, repoPath) {
 }
 async function runAnalyze(options = {}) {
   mt("Analyzing repository");
-  ensureClaudeCli();
   showFirstRunNotice();
   const project = resolveOrInitProject();
   O2.step(`Repository: ${project.name}`);
   await promptInstallSkills(project.path, { install: options.installSkills });
   configureLogger({
-    filePath: path19.join(project.path, ".truecourse/logs/analyze.log")
+    filePath: path18.join(project.path, ".truecourse/logs/analyze.log")
   });
   const config2 = readProjectConfig(project.path);
   const enabledCategories = config2.enabledCategories ?? void 0;
   const llmDecision = resolveLlmDecision(options, config2.enableLlmRules ?? true);
   const enableLlmRules = llmDecision.enabled;
+  if (enableLlmRules) await preflightClaudeOrExit();
   const stashDecision = await resolveStashDecision(options, project.path);
   renderPhase = enableLlmRules ? "pre-llm" : "all";
   if (wipeLegacyPostgresData()) {
@@ -142217,18 +142804,18 @@ async function runAnalyzeDiff(options = {}) {
   const { diffInProcess: diffInProcess2 } = await Promise.resolve().then(() => (init_diff_in_process(), diff_in_process_exports));
   const { renderDiffResultsSummary: renderDiffResultsSummary2 } = await Promise.resolve().then(() => (init_helpers(), helpers_exports));
   mt("Running diff check");
-  ensureClaudeCli();
   showFirstRunNotice();
   const project = resolveOrInitProject();
   O2.step(`Repository: ${project.name}`);
   await promptInstallSkills(project.path, { install: options.installSkills });
   configureLogger({
-    filePath: path19.join(project.path, ".truecourse/logs/analyze.log")
+    filePath: path18.join(project.path, ".truecourse/logs/analyze.log")
   });
   const config2 = readProjectConfig(project.path);
   const enabledCategories = config2.enabledCategories ?? void 0;
   const llmDecision = resolveLlmDecision(options, config2.enableLlmRules ?? true);
   const enableLlmRules = llmDecision.enabled;
+  if (enableLlmRules) await preflightClaudeOrExit();
   renderPhase = enableLlmRules ? "pre-llm" : "all";
   const stepDefs = buildAnalysisSteps(enabledCategories, enableLlmRules);
   const tracker = new StepTracker((payload) => {
@@ -142292,25 +142879,25 @@ init_dist4();
 init_paths();
 init_registry();
 init_helpers();
-import { spawn as spawn5 } from "node:child_process";
-import fs19 from "node:fs";
-import path24 from "node:path";
+import { spawn as spawn6 } from "node:child_process";
+import fs20 from "node:fs";
+import path23 from "node:path";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 
 // tools/cli/src/commands/service/macos.ts
-import fs16 from "node:fs";
-import path20 from "node:path";
+import fs17 from "node:fs";
+import path19 from "node:path";
 import os5 from "node:os";
 import { execSync } from "node:child_process";
 
 // tools/cli/src/commands/service/env.ts
-import fs15 from "node:fs";
+import fs16 from "node:fs";
 function parseEnvFile(filePath) {
   const vars = {};
-  if (!fs15.existsSync(filePath)) {
+  if (!fs16.existsSync(filePath)) {
     return vars;
   }
-  const content = fs15.readFileSync(filePath, "utf-8");
+  const content = fs16.readFileSync(filePath, "utf-8");
   for (const line of content.split("\n")) {
     const trimmed2 = line.trim();
     if (!trimmed2 || trimmed2.startsWith("#")) continue;
@@ -142330,15 +142917,15 @@ function parseEnvFile(filePath) {
 
 // tools/cli/src/commands/service/macos.ts
 var SERVICE_LABEL = "com.truecourse.server";
-var PLIST_DIR = path20.join(os5.homedir(), "Library", "LaunchAgents");
-var PLIST_PATH = path20.join(PLIST_DIR, `${SERVICE_LABEL}.plist`);
+var PLIST_DIR = path19.join(os5.homedir(), "Library", "LaunchAgents");
+var PLIST_PATH = path19.join(PLIST_DIR, `${SERVICE_LABEL}.plist`);
 function escapeXml(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&apos;");
 }
 function buildPlist(serverPath, logPath, envVars) {
-  const logDir = path20.dirname(logPath);
-  const stdoutPath = path20.join(logDir, "dashboard.out.log");
-  const stderrPath = path20.join(logDir, "dashboard.err.log");
+  const logDir = path19.dirname(logPath);
+  const stdoutPath = path19.join(logDir, "dashboard.out.log");
+  const stderrPath = path19.join(logDir, "dashboard.err.log");
   let envSection = "";
   if (Object.keys(envVars).length > 0) {
     const entries = Object.entries(envVars).map(([k, v]) => `      <key>${escapeXml(k)}</key>
@@ -142374,17 +142961,17 @@ ${entries}
 }
 var MacOSService = class {
   async install(serverPath, logPath) {
-    const envFile = path20.join(os5.homedir(), ".truecourse", ".env");
+    const envFile = path19.join(os5.homedir(), ".truecourse", ".env");
     const envVars = parseEnvFile(envFile);
     if (process.env.PATH && !envVars.PATH) {
       envVars.PATH = process.env.PATH;
     }
-    envVars.TRUECOURSE_LOG_DIR = path20.dirname(logPath);
-    envVars.TRUECOURSE_HOME = path20.join(os5.homedir(), ".truecourse");
-    fs16.mkdirSync(PLIST_DIR, { recursive: true });
-    fs16.mkdirSync(path20.dirname(logPath), { recursive: true });
+    envVars.TRUECOURSE_LOG_DIR = path19.dirname(logPath);
+    envVars.TRUECOURSE_HOME = path19.join(os5.homedir(), ".truecourse");
+    fs17.mkdirSync(PLIST_DIR, { recursive: true });
+    fs17.mkdirSync(path19.dirname(logPath), { recursive: true });
     const plist = buildPlist(serverPath, logPath, envVars);
-    fs16.writeFileSync(PLIST_PATH, plist, "utf-8");
+    fs17.writeFileSync(PLIST_PATH, plist, "utf-8");
     execSync(`launchctl load -w "${PLIST_PATH}"`, { stdio: "pipe" });
   }
   async uninstall() {
@@ -142392,12 +142979,12 @@ var MacOSService = class {
       execSync(`launchctl unload "${PLIST_PATH}"`, { stdio: "pipe" });
     } catch {
     }
-    if (fs16.existsSync(PLIST_PATH)) {
-      fs16.unlinkSync(PLIST_PATH);
+    if (fs17.existsSync(PLIST_PATH)) {
+      fs17.unlinkSync(PLIST_PATH);
     }
   }
   async start() {
-    if (!fs16.existsSync(PLIST_PATH)) {
+    if (!fs17.existsSync(PLIST_PATH)) {
       throw new Error("Service is not installed. Run 'truecourse service install' first.");
     }
     execSync(`launchctl load -w "${PLIST_PATH}"`, { stdio: "pipe" });
@@ -142427,22 +143014,22 @@ var MacOSService = class {
     }
   }
   async isInstalled() {
-    return fs16.existsSync(PLIST_PATH);
+    return fs17.existsSync(PLIST_PATH);
   }
 };
 
 // tools/cli/src/commands/service/linux.ts
-import fs17 from "node:fs";
-import path21 from "node:path";
+import fs18 from "node:fs";
+import path20 from "node:path";
 import os6 from "node:os";
 import { execSync as execSync2 } from "node:child_process";
 var SERVICE_NAME = "truecourse";
-var UNIT_DIR = path21.join(os6.homedir(), ".config", "systemd", "user");
-var UNIT_PATH = path21.join(UNIT_DIR, `${SERVICE_NAME}.service`);
+var UNIT_DIR = path20.join(os6.homedir(), ".config", "systemd", "user");
+var UNIT_PATH = path20.join(UNIT_DIR, `${SERVICE_NAME}.service`);
 function buildUnitFile(serverPath, logPath) {
-  const truecourseHome = path21.join(os6.homedir(), ".truecourse");
-  const envFile = path21.join(truecourseHome, ".env");
-  const logDir = path21.dirname(logPath);
+  const truecourseHome = path20.join(os6.homedir(), ".truecourse");
+  const envFile = path20.join(truecourseHome, ".env");
+  const logDir = path20.dirname(logPath);
   return `[Unit]
 Description=TrueCourse Server
 After=network.target
@@ -142455,8 +143042,8 @@ RestartSec=5
 EnvironmentFile=${envFile}
 Environment=TRUECOURSE_HOME=${truecourseHome}
 Environment=TRUECOURSE_LOG_DIR=${logDir}
-StandardOutput=append:${path21.join(logDir, "dashboard.out.log")}
-StandardError=append:${path21.join(logDir, "dashboard.err.log")}
+StandardOutput=append:${path20.join(logDir, "dashboard.out.log")}
+StandardError=append:${path20.join(logDir, "dashboard.err.log")}
 
 [Install]
 WantedBy=default.target
@@ -142464,10 +143051,10 @@ WantedBy=default.target
 }
 var LinuxService = class {
   async install(serverPath, logPath) {
-    fs17.mkdirSync(UNIT_DIR, { recursive: true });
-    fs17.mkdirSync(path21.dirname(logPath), { recursive: true });
+    fs18.mkdirSync(UNIT_DIR, { recursive: true });
+    fs18.mkdirSync(path20.dirname(logPath), { recursive: true });
     const unit = buildUnitFile(serverPath, logPath);
-    fs17.writeFileSync(UNIT_PATH, unit, "utf-8");
+    fs18.writeFileSync(UNIT_PATH, unit, "utf-8");
     execSync2("systemctl --user daemon-reload", { stdio: "pipe" });
     execSync2(`systemctl --user enable ${SERVICE_NAME}`, { stdio: "pipe" });
   }
@@ -142480,8 +143067,8 @@ var LinuxService = class {
       execSync2(`systemctl --user disable ${SERVICE_NAME}`, { stdio: "pipe" });
     } catch {
     }
-    if (fs17.existsSync(UNIT_PATH)) {
-      fs17.unlinkSync(UNIT_PATH);
+    if (fs18.existsSync(UNIT_PATH)) {
+      fs18.unlinkSync(UNIT_PATH);
     }
     try {
       execSync2("systemctl --user daemon-reload", { stdio: "pipe" });
@@ -142510,14 +143097,14 @@ var LinuxService = class {
     }
   }
   async isInstalled() {
-    return fs17.existsSync(UNIT_PATH);
+    return fs18.existsSync(UNIT_PATH);
   }
 };
 
 // tools/cli/src/commands/service/windows.ts
 import { execSync as execSync3 } from "node:child_process";
 import os7 from "node:os";
-import path22 from "node:path";
+import path21 from "node:path";
 var SERVICE_DISPLAY_NAME = "TrueCourse";
 var SERVICE_SCM_NAME = "truecourse.exe";
 var WindowsService = class {
@@ -142533,8 +143120,8 @@ var WindowsService = class {
   async install(serverPath, logPath) {
     const nw = await this.getNodeWindows();
     const { Service } = nw;
-    const logDir = path22.dirname(logPath);
-    const truecourseHome = path22.join(os7.homedir(), ".truecourse");
+    const logDir = path21.dirname(logPath);
+    const truecourseHome = path21.join(os7.homedir(), ".truecourse");
     return new Promise((resolve9, reject) => {
       const svc = new Service({
         name: SERVICE_DISPLAY_NAME,
@@ -142620,8 +143207,8 @@ function getPlatform() {
 }
 
 // tools/cli/src/commands/service/logs.ts
-import fs18 from "node:fs";
-import path23 from "node:path";
+import fs19 from "node:fs";
+import path22 from "node:path";
 import os8 from "node:os";
 var MAX_LOG_SIZE2 = 10 * 1024 * 1024;
 var MAX_LOG_FILES2 = 5;
@@ -142632,38 +143219,38 @@ var ROTATABLE_LOG_NAMES = [
   "dashboard.log"
 ];
 function getLogDir() {
-  return path23.join(os8.homedir(), ".truecourse", "logs");
+  return path22.join(os8.homedir(), ".truecourse", "logs");
 }
 function getLogPath() {
-  return path23.join(getLogDir(), "dashboard.log");
+  return path22.join(getLogDir(), "dashboard.log");
 }
 function existingLogFiles(logDir) {
-  if (!fs18.existsSync(logDir)) return [];
-  return fs18.readdirSync(logDir).filter((name) => /\.log$/.test(name)).sort().map((name) => path23.join(logDir, name));
+  if (!fs19.existsSync(logDir)) return [];
+  return fs19.readdirSync(logDir).filter((name) => /\.log$/.test(name)).sort().map((name) => path22.join(logDir, name));
 }
 function rotateOne(logFile) {
-  if (!fs18.existsSync(logFile)) return;
-  if (fs18.statSync(logFile).size < MAX_LOG_SIZE2) return;
+  if (!fs19.existsSync(logFile)) return;
+  if (fs19.statSync(logFile).size < MAX_LOG_SIZE2) return;
   for (let i = MAX_LOG_FILES2; i >= 1; i--) {
     const older = `${logFile}.${i}`;
     if (i === MAX_LOG_FILES2) {
-      if (fs18.existsSync(older)) fs18.unlinkSync(older);
+      if (fs19.existsSync(older)) fs19.unlinkSync(older);
     } else {
       const newer = `${logFile}.${i + 1}`;
-      if (fs18.existsSync(older)) fs18.renameSync(older, newer);
+      if (fs19.existsSync(older)) fs19.renameSync(older, newer);
     }
   }
-  fs18.renameSync(logFile, `${logFile}.1`);
+  fs19.renameSync(logFile, `${logFile}.1`);
 }
 function rotateLogs(logDir) {
   for (const name of ROTATABLE_LOG_NAMES) {
-    rotateOne(path23.join(logDir, name));
+    rotateOne(path22.join(logDir, name));
   }
-  if (!fs18.existsSync(logDir)) return;
+  if (!fs19.existsSync(logDir)) return;
   for (const file of existingLogFiles(logDir)) rotateOne(file);
 }
 function readLastLines(filePath, maxLines) {
-  const content = fs18.readFileSync(filePath, "utf-8");
+  const content = fs19.readFileSync(filePath, "utf-8");
   const lines = content.split("\n");
   if (lines.length > 0 && lines[lines.length - 1] === "") lines.pop();
   return lines.slice(-maxLines).join("\n");
@@ -142674,7 +143261,7 @@ function dumpLogTails(logDir, linesPerFile = 50) {
   for (const file of files) {
     const tail = readLastLines(file, linesPerFile);
     process.stdout.write(`
------ ${path23.basename(file)} (last ${linesPerFile} lines) -----
+----- ${path22.basename(file)} (last ${linesPerFile} lines) -----
 `);
     process.stdout.write(tail);
     if (!tail.endsWith("\n")) process.stdout.write("\n");
@@ -142691,18 +143278,18 @@ function tailLogs() {
   }
   dumpLogTails(logDir);
   const sizes = /* @__PURE__ */ new Map();
-  for (const file of files) sizes.set(file, fs18.statSync(file).size);
+  for (const file of files) sizes.set(file, fs19.statSync(file).size);
   const watch = (file) => {
-    fs18.watchFile(file, { interval: POLL_INTERVAL_MS }, () => {
+    fs19.watchFile(file, { interval: POLL_INTERVAL_MS }, () => {
       try {
-        const newSize = fs18.statSync(file).size;
+        const newSize = fs19.statSync(file).size;
         const lastSize = sizes.get(file) ?? 0;
         if (newSize > lastSize) {
-          const fd = fs18.openSync(file, "r");
+          const fd = fs19.openSync(file, "r");
           const buf = Buffer.alloc(newSize - lastSize);
-          fs18.readSync(fd, buf, 0, buf.length, lastSize);
-          fs18.closeSync(fd);
-          const tag = `[${path23.basename(file)}] `;
+          fs19.readSync(fd, buf, 0, buf.length, lastSize);
+          fs19.closeSync(fd);
+          const tag = `[${path22.basename(file)}] `;
           const text = buf.toString("utf-8");
           const tagged = text.split("\n").map((line, i, arr) => i === arr.length - 1 && line === "" ? "" : tag + line).join("\n");
           process.stdout.write(tagged);
@@ -142716,7 +143303,7 @@ function tailLogs() {
   };
   for (const file of files) watch(file);
   const cleanup = () => {
-    for (const file of files) fs18.unwatchFile(file);
+    for (const file of files) fs19.unwatchFile(file);
     process.exit(0);
   };
   process.on("SIGINT", cleanup);
@@ -142724,15 +143311,15 @@ function tailLogs() {
 }
 
 // tools/cli/src/commands/dashboard.ts
-var __dirname2 = path24.dirname(fileURLToPath6(import.meta.url));
+var __dirname2 = path23.dirname(fileURLToPath6(import.meta.url));
 function resolveServerEntry() {
   const candidates = [
     // Packaged CLI: dist/cli.mjs next to dist/server.mjs
-    path24.join(__dirname2, "server.mjs"),
+    path23.join(__dirname2, "server.mjs"),
     // Source build output: tools/cli/dist → ../../../../dist/server.mjs
-    path24.resolve(__dirname2, "..", "..", "..", "..", "dist", "server.mjs")
+    path23.resolve(__dirname2, "..", "..", "..", "..", "dist", "server.mjs")
   ];
-  return candidates.find((p2) => fs19.existsSync(p2)) ?? null;
+  return candidates.find((p2) => fs20.existsSync(p2)) ?? null;
 }
 async function waitForHealth(url, timeoutMs = 3e4) {
   const start = Date.now();
@@ -142769,7 +143356,7 @@ async function promptRunMode() {
 async function runConsoleMode(serverEntry) {
   const url = getServerUrl();
   O2.step("Starting dashboard server...");
-  const serverProcess = spawn5(process.execPath, [serverEntry], {
+  const serverProcess = spawn6(process.execPath, [serverEntry], {
     stdio: "inherit",
     env: { ...process.env }
   });
@@ -142860,7 +143447,7 @@ async function runDashboard(options = {}) {
     );
     process.exit(1);
   }
-  const configured = fs19.existsSync(getConfigPath());
+  const configured = fs20.existsSync(getConfigPath());
   const needsDecision = !configured || options.reconfigure;
   let runMode;
   if (options.mode) {
@@ -143312,13 +143899,13 @@ async function runRulesReset({ ruleKey }) {
 
 // tools/cli/src/commands/contracts.ts
 init_dist4();
-import fs48 from "node:fs";
+import fs49 from "node:fs";
 import path55 from "node:path";
 
 // packages/contract-extractor/dist/cache.js
 import { createHash as createHash3 } from "node:crypto";
-import fs20 from "node:fs";
-import path25 from "node:path";
+import fs21 from "node:fs";
+import path24 from "node:path";
 
 // packages/contract-extractor/dist/types.js
 init_zod();
@@ -143896,14 +144483,20 @@ Use sensible defaults when the spec doesn't spell them out:
     on-violation {
       status 401
       error-code unauthenticated
-      body ErrorEnvelope:error.envelope.standard
     }
   }
 
-Default \`on-violation\` is **always** status 401, error-code \`unauthenticated\`,
-body \`ErrorEnvelope:error.envelope.standard\` when the spec doesn't specify
-otherwise. Default selector is \`path-glob "/api/**"\` when the spec says "all
-/api/* endpoints" without naming a more specific pattern.
+Default \`on-violation\` is status 401, error-code \`unauthenticated\`. Add a
+\`body ErrorEnvelope:error.envelope.standard\` line ONLY when the spec/corpus
+actually establishes a standard error envelope \u2014 a dedicated errors /
+error-response section, an error-code catalog, or another slice that describes
+the error body shape. When the spec is SILENT about the error response body
+(common for terse auth docs that only state the scheme), OMIT the \`body\` line:
+a \`body\` reference to an envelope nothing defines is a dangling cross-reference
+that fails the validation gate, while an omitted body is faithful. See
+"Error-envelope references must be grounded" below. Default selector is
+\`path-glob "/api/**"\` when the spec says "all /api/* endpoints" without naming a
+more specific pattern.
 
 When a spec describes role-based auth ("admin only", "moderators can \u2026"), produce
 a SEPARATE \`auth-requirement\` with \`required-role <role>\`, identity
@@ -143938,7 +144531,8 @@ is the correct fallback when the slice lacks operation context.
     on-violation {
       status 403
       error-code forbidden
-      body ErrorEnvelope:error.envelope.standard
+      // body ErrorEnvelope:error.envelope.standard only when that envelope is
+      // defined in the corpus \u2014 see "Error-envelope references must be grounded".
     }
   }
 
@@ -144485,6 +145079,37 @@ response as a literal:
 - Only declare a literal \`response 401/403 on \u2026\` when the spec describes the
   response as standalone, NOT delegated to a rule.
 
+# Error-envelope references must be grounded
+
+\`ErrorEnvelope:error.envelope.standard\` is a CROSS-REFERENCE, not a literal \u2014 it
+only resolves if a matching \`error-envelope error.envelope.standard { \u2026 }\`
+artifact exists somewhere in the corpus. Emitting the reference with nothing
+defining it produces a dangling cross-reference that fails the validation gate,
+exactly like referencing an undefined \`Enum:\`. This is the same prime-directive
+rule as enums ("never reference an enum without defining it"), applied to error
+bodies.
+
+The rule applies EVERYWHERE an envelope can appear:
+\`on-violation { \u2026 body ErrorEnvelope:\u2026 }\` on auth-requirements and
+authorization-rules, and \`response \u2026 { body envelope ErrorEnvelope:\u2026 { \u2026 } }\`
+on operations.
+
+- Reference \`ErrorEnvelope:error.envelope.standard\` ONLY when the spec actually
+  establishes a standard error envelope: a dedicated errors / error-response
+  section, an error-code catalog, or prose that names "the standard error
+  envelope". In a multi-doc corpus the defining section may live in ANOTHER
+  slice \u2014 that's fine, just like an \`Enum:\` defined in a sibling slice.
+- When you reference it AND the slice in front of you is the one that describes
+  the envelope, ALSO emit the \`error-envelope error.envelope.standard { \u2026 }\`
+  artifact \u2014 mirroring the described shape; never invent fields the spec does
+  not list.
+- When the spec is SILENT about the error response body \u2014 no error section, no
+  envelope, no error codes \u2014 do NOT emit the reference at all. Omit the \`body\`
+  line from \`on-violation\`; on an operation response use a plain \`body \u2026\` only
+  if the spec gives a shape, otherwise omit it. Faithful under-specification
+  beats a dangling reference: never conjure a standard envelope just to fill the
+  slot.
+
 # Naming conventions for artifact identities
 
 Use these canonical identity formats:
@@ -144529,29 +145154,29 @@ function buildUserPrompt(slice3) {
 }
 
 // packages/contract-extractor/dist/cache.js
-var CACHE_DIR = path25.join(".truecourse", ".cache", "extractor");
+var CACHE_DIR = path24.join(".truecourse", ".cache", "extractor");
 var SLICES_SUBDIR = "slices";
 var MANIFEST_FILE = "manifest.json";
 var EXTRACTION_PROMPT_FINGERPRINT = createHash3("sha256").update(SYSTEM_PROMPT).digest("hex").slice(0, 16);
 function cachePaths(repoRoot6) {
-  const cacheDir = path25.join(repoRoot6, CACHE_DIR);
+  const cacheDir = path24.join(repoRoot6, CACHE_DIR);
   return {
     cacheDir,
-    slicesDir: path25.join(cacheDir, SLICES_SUBDIR),
-    manifestPath: path25.join(cacheDir, MANIFEST_FILE)
+    slicesDir: path24.join(cacheDir, SLICES_SUBDIR),
+    manifestPath: path24.join(cacheDir, MANIFEST_FILE)
   };
 }
 function ensureCacheDirs(repoRoot6) {
   const paths = cachePaths(repoRoot6);
-  fs20.mkdirSync(paths.slicesDir, { recursive: true });
+  fs21.mkdirSync(paths.slicesDir, { recursive: true });
   return paths;
 }
 function readSliceEntry(repoRoot6, sliceId) {
-  const file = path25.join(cachePaths(repoRoot6).slicesDir, `${sliceId}.json`);
-  if (!fs20.existsSync(file))
+  const file = path24.join(cachePaths(repoRoot6).slicesDir, `${sliceId}.json`);
+  if (!fs21.existsSync(file))
     return null;
   try {
-    const raw = JSON.parse(fs20.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs21.readFileSync(file, "utf-8"));
     const entry = SliceCacheEntrySchema.parse(raw);
     if (entry.promptFingerprint !== EXTRACTION_PROMPT_FINGERPRINT)
       return null;
@@ -144571,16 +145196,16 @@ function writeSliceEntry(repoRoot6, slice3, result) {
     cachedAt: (/* @__PURE__ */ new Date()).toISOString(),
     promptFingerprint: EXTRACTION_PROMPT_FINGERPRINT
   };
-  const file = path25.join(cachePaths(repoRoot6).slicesDir, `${slice3.id}.json`);
-  fs20.writeFileSync(file, JSON.stringify(entry, null, 2));
+  const file = path24.join(cachePaths(repoRoot6).slicesDir, `${slice3.id}.json`);
+  fs21.writeFileSync(file, JSON.stringify(entry, null, 2));
   return entry;
 }
 function readManifest(repoRoot6) {
   const file = cachePaths(repoRoot6).manifestPath;
-  if (!fs20.existsSync(file))
+  if (!fs21.existsSync(file))
     return null;
   try {
-    const raw = JSON.parse(fs20.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs21.readFileSync(file, "utf-8"));
     return ManifestSchema.parse(raw);
   } catch {
     return null;
@@ -144589,11 +145214,11 @@ function readManifest(repoRoot6) {
 function writeManifest(repoRoot6, manifest) {
   ensureCacheDirs(repoRoot6);
   const file = cachePaths(repoRoot6).manifestPath;
-  fs20.writeFileSync(file, JSON.stringify(manifest, null, 2));
+  fs21.writeFileSync(file, JSON.stringify(manifest, null, 2));
 }
 function gcOrphanedSlices(repoRoot6, manifest) {
   const paths = cachePaths(repoRoot6);
-  if (!fs20.existsSync(paths.slicesDir))
+  if (!fs21.existsSync(paths.slicesDir))
     return 0;
   const live = /* @__PURE__ */ new Set();
   for (const spec of Object.values(manifest.specs)) {
@@ -144601,12 +145226,12 @@ function gcOrphanedSlices(repoRoot6, manifest) {
       live.add(s.sliceId);
   }
   let removed = 0;
-  for (const name of fs20.readdirSync(paths.slicesDir)) {
+  for (const name of fs21.readdirSync(paths.slicesDir)) {
     if (!name.endsWith(".json"))
       continue;
     const id = name.slice(0, -".json".length);
     if (!live.has(id)) {
-      fs20.unlinkSync(path25.join(paths.slicesDir, name));
+      fs21.unlinkSync(path24.join(paths.slicesDir, name));
       removed++;
     }
   }
@@ -144615,8 +145240,8 @@ function gcOrphanedSlices(repoRoot6, manifest) {
 
 // packages/contract-extractor/dist/claims-reader.js
 import crypto2 from "node:crypto";
-import fs31 from "node:fs";
-import path36 from "node:path";
+import fs32 from "node:fs";
+import path35 from "node:path";
 
 // packages/spec-consolidator/dist/types.js
 init_zod();
@@ -144826,8 +145451,8 @@ var ModuleManifestSchema = external_exports.object({
 init_dist7();
 import { execFileSync as execFileSync2 } from "node:child_process";
 import { createHash as createHash4 } from "node:crypto";
-import fs21 from "node:fs";
-import path26 from "node:path";
+import fs22 from "node:fs";
+import path25 from "node:path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   "node_modules",
   ".git",
@@ -144848,7 +145473,7 @@ function discoverDocs(rootDir, opts = {}) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs21.readdirSync(dir, { withFileTypes: true });
+      entries = fs22.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -144858,7 +145483,7 @@ function discoverDocs(rootDir, opts = {}) {
         continue;
       if (entry.name.startsWith(".") && entry.name !== ".")
         continue;
-      const full = path26.join(dir, entry.name);
+      const full = path25.join(dir, entry.name);
       if (tcIgnore.ignores(full))
         continue;
       if (entry.isDirectory()) {
@@ -144867,7 +145492,7 @@ function discoverDocs(rootDir, opts = {}) {
       }
       if (!entry.isFile())
         continue;
-      if (path26.extname(entry.name).toLowerCase() !== ".md")
+      if (path25.extname(entry.name).toLowerCase() !== ".md")
         continue;
       const candidate = makeCandidate(full, rootDir, previewLines, opts);
       if (candidate)
@@ -144881,12 +145506,12 @@ function makeCandidate(absPath, rootDir, previewLines, opts) {
   let content;
   let stat;
   try {
-    content = fs21.readFileSync(absPath, "utf-8");
-    stat = fs21.statSync(absPath);
+    content = fs22.readFileSync(absPath, "utf-8");
+    stat = fs22.statSync(absPath);
   } catch {
     return null;
   }
-  const rel = path26.relative(rootDir, absPath).split(path26.sep).join("/");
+  const rel = path25.relative(rootDir, absPath).split(path25.sep).join("/");
   const preview = content.split(/\r?\n/).slice(0, previewLines).join("\n");
   const contentHash = createHash4("sha256").update(content).digest("hex");
   const lastTouched = opts.skipGit ? stat.mtime.toISOString() : gitLastTouched(rootDir, rel) ?? stat.mtime.toISOString();
@@ -144914,8 +145539,8 @@ function gitLastTouched(rootDir, relPath) {
   }
 }
 function classifyDoc(relPath, content) {
-  const base = path26.basename(relPath).toLowerCase();
-  const dirParts = path26.dirname(relPath).split("/").map((p2) => p2.toLowerCase());
+  const base = path25.basename(relPath).toLowerCase();
+  const dirParts = path25.dirname(relPath).split("/").map((p2) => p2.toLowerCase());
   if (/^(specs?|specification|specs?-.*)\.md$/i.test(base))
     return "spec";
   if (/^adr[-_]?\d+/i.test(base) || dirParts.some((p2) => p2 === "adr" || p2 === "adrs")) {
@@ -145147,6 +145772,14 @@ You are given ONE block of markdown from a documentation file (a PRD, ADR, RFC,
 
 6. The faithfulness rule. Encode ONLY what the spec STATES. Never guess. Never default to common patterns. If the spec doesn't say what status code is returned, don't assume 200. If the spec doesn't say auth is required, don't add an auth claim.
 
+7. The completeness rule (enumerations). When the spec presents an enumeration \u2014 a bulleted list, a numbered list, a markdown table column of values, or an inline comma-separated list \u2014 capture EVERY entry. Never summarize, never include a "representative subset", never drop entries because they look similar to ones you already captured. This applies regardless of how you structure the claim:
+
+   - If you emit ONE claim whose \`content.fields\` lists the entries (e.g. an entity's columns, an enum's value-to-description map), every enumerated value must be a key in \`fields\`. A 15-item bulleted list must produce 15 keys, not 8.
+   - If you emit ONE claim per entry (the forbidden-artifact pattern), emit exactly N claims for N enumerated items.
+   - If the spec lists values across multiple sections of the same doc, each section contributes its own claim; the merger handles the union downstream \u2014 don't pre-dedupe across sections.
+
+   Counting check before you return: if the source block contains a bulleted or numbered list under a heading like "Available <X>", "Supported <X> types", "Operation types", "Roles", "Statuses", or similar, count the bullets in that list, then count the entries you've emitted. The counts MUST match. If they don't, you've summarized \u2014 re-extract the missed entries before returning.
+
 # Content shapes per topic
 
 ## endpoints
@@ -145347,7 +145980,7 @@ async function runOne(transport, block, timeoutMs, model, fallbackModel) {
 
 // packages/spec-consolidator/dist/extractor.js
 import { createHash as createHash6 } from "node:crypto";
-import fs22 from "node:fs";
+import fs23 from "node:fs";
 async function extractClaims(rootDir, opts = {}) {
   const docs = opts.docs ?? discoverDocs(rootDir, opts);
   const allBlocks = [];
@@ -145424,7 +146057,7 @@ function shortQuote(text) {
   return [...lines.slice(0, 40), `\u2026 (+${lines.length - 40} more lines)`].join("\n");
 }
 function readFileSync10(absPath) {
-  return fs22.readFileSync(absPath, "utf-8");
+  return fs23.readFileSync(absPath, "utf-8");
 }
 
 // packages/spec-consolidator/dist/merger.js
@@ -145614,7 +146247,7 @@ function pickRichestSameFile(list) {
     }
   }
   const winner = list[winnerIdx];
-  const others = list.filter((_, i) => i !== winnerIdx);
+  const others = list.filter((_2, i) => i !== winnerIdx);
   return {
     ...winner,
     provenance: {
@@ -146271,21 +146904,21 @@ function uniqueSorted(arr) {
 // packages/spec-consolidator/dist/cache.js
 init_zod();
 import { createHash as createHash8 } from "node:crypto";
-import fs23 from "node:fs";
-import path27 from "node:path";
+import fs24 from "node:fs";
+import path26 from "node:path";
 var EXTRACTION_PROMPT_FINGERPRINT2 = createHash8("sha256").update(SYSTEM_PROMPT2).digest("hex").slice(0, 16);
-var CACHE_RELATIVE = path27.join(".truecourse", ".cache", "consolidator");
+var CACHE_RELATIVE = path26.join(".truecourse", ".cache", "consolidator");
 var BLOCKS_SUBDIR = "blocks";
 function cachePaths2(repoRoot6) {
-  const cacheDir = path27.join(repoRoot6, CACHE_RELATIVE);
+  const cacheDir = path26.join(repoRoot6, CACHE_RELATIVE);
   return {
     cacheDir,
-    blocksDir: path27.join(cacheDir, BLOCKS_SUBDIR)
+    blocksDir: path26.join(cacheDir, BLOCKS_SUBDIR)
   };
 }
 function ensureCacheDirs2(repoRoot6) {
   const paths = cachePaths2(repoRoot6);
-  fs23.mkdirSync(paths.blocksDir, { recursive: true });
+  fs24.mkdirSync(paths.blocksDir, { recursive: true });
   return paths;
 }
 var BlockCacheEntrySchema = external_exports.object({
@@ -146302,11 +146935,11 @@ var BlockCacheEntrySchema = external_exports.object({
   promptFingerprint: external_exports.string().optional()
 });
 function readBlockCache(repoRoot6, blockId) {
-  const file = path27.join(cachePaths2(repoRoot6).blocksDir, `${blockId}.json`);
-  if (!fs23.existsSync(file))
+  const file = path26.join(cachePaths2(repoRoot6).blocksDir, `${blockId}.json`);
+  if (!fs24.existsSync(file))
     return null;
   try {
-    const raw = JSON.parse(fs23.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs24.readFileSync(file, "utf-8"));
     const entry = BlockCacheEntrySchema.parse(raw);
     if (entry.promptFingerprint !== EXTRACTION_PROMPT_FINGERPRINT2)
       return null;
@@ -146323,19 +146956,19 @@ function writeBlockCache(repoRoot6, blockId, extraction) {
     cachedAt: (/* @__PURE__ */ new Date()).toISOString(),
     promptFingerprint: EXTRACTION_PROMPT_FINGERPRINT2
   };
-  const file = path27.join(cachePaths2(repoRoot6).blocksDir, `${blockId}.json`);
-  fs23.writeFileSync(file, JSON.stringify(entry, null, 2));
+  const file = path26.join(cachePaths2(repoRoot6).blocksDir, `${blockId}.json`);
+  fs24.writeFileSync(file, JSON.stringify(entry, null, 2));
 }
 var SCAN_STATE_FILE = "scan-state.json";
 function scanStatePath(repoRoot6) {
-  return path27.join(cachePaths2(repoRoot6).cacheDir, SCAN_STATE_FILE);
+  return path26.join(cachePaths2(repoRoot6).cacheDir, SCAN_STATE_FILE);
 }
 function readScanState(repoRoot6) {
   const file = scanStatePath(repoRoot6);
-  if (!fs23.existsSync(file))
+  if (!fs24.existsSync(file))
     return null;
   try {
-    const raw = JSON.parse(fs23.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs24.readFileSync(file, "utf-8"));
     if (typeof raw.scannedAt !== "string")
       return null;
     if (!Array.isArray(raw.openConflicts) || !Array.isArray(raw.decidedConflicts))
@@ -146348,16 +146981,16 @@ function readScanState(repoRoot6) {
 function writeScanState(repoRoot6, state) {
   ensureCacheDirs2(repoRoot6);
   const file = scanStatePath(repoRoot6);
-  fs23.writeFileSync(file, JSON.stringify(state, null, 2) + "\n");
+  fs24.writeFileSync(file, JSON.stringify(state, null, 2) + "\n");
 }
 
 // packages/spec-consolidator/dist/claims-store.js
 init_zod();
-import fs24 from "node:fs";
-import path28 from "node:path";
+import fs25 from "node:fs";
+import path27 from "node:path";
 var CLAIMS_FILE = "claims.json";
 function claimsFilePath(repoRoot6) {
-  return path28.join(repoRoot6, ".truecourse", "specs", CLAIMS_FILE);
+  return path27.join(repoRoot6, ".truecourse", "specs", CLAIMS_FILE);
 }
 var ClaimsFileModuleSchema = ModuleManifestSchema;
 var ClaimsFileEntrySchema = ClaimSchema.extend({
@@ -146378,10 +147011,10 @@ var ClaimsFileSchema = external_exports.object({
 });
 function readClaims(repoRoot6) {
   const file = claimsFilePath(repoRoot6);
-  if (!fs24.existsSync(file))
+  if (!fs25.existsSync(file))
     return null;
   try {
-    const raw = JSON.parse(fs24.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs25.readFileSync(file, "utf-8"));
     return ClaimsFileSchema.parse(raw);
   } catch {
     return null;
@@ -146389,26 +147022,26 @@ function readClaims(repoRoot6) {
 }
 function writeClaims(repoRoot6, input) {
   const file = claimsFilePath(repoRoot6);
-  fs24.mkdirSync(path28.dirname(file), { recursive: true });
+  fs25.mkdirSync(path27.dirname(file), { recursive: true });
   const payload = {
     version: 1,
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     modules: input.modules,
     claims: input.claims
   };
-  fs24.writeFileSync(file, JSON.stringify(payload, null, 2) + "\n");
+  fs25.writeFileSync(file, JSON.stringify(payload, null, 2) + "\n");
 }
 function entryFromClaim(claim, module, source = "extracted") {
   return { ...claim, module, source };
 }
 
 // packages/spec-consolidator/dist/orchestrator.js
-import fs30 from "node:fs";
-import path35 from "node:path";
+import fs31 from "node:fs";
+import path34 from "node:path";
 
 // packages/spec-consolidator/dist/version-chain.js
 import { createHash as createHash9 } from "node:crypto";
-import path29 from "node:path";
+import path28 from "node:path";
 function materializeManualChains(manualChains, docs) {
   const byPath = new Map(docs.map((d3) => [d3.path, d3]));
   const out = [];
@@ -146444,10 +147077,10 @@ function detectVersionChains(docs) {
 }
 var VERSION_SUFFIX_RE = /(.*?)(v\d+)(\.[^./]+)?$/i;
 function filenameVersionPair(a, b) {
-  if (path29.dirname(a.path) !== path29.dirname(b.path))
+  if (path28.dirname(a.path) !== path28.dirname(b.path))
     return null;
-  const aMatch = VERSION_SUFFIX_RE.exec(stripExt(path29.basename(a.path)));
-  const bMatch = VERSION_SUFFIX_RE.exec(stripExt(path29.basename(b.path)));
+  const aMatch = VERSION_SUFFIX_RE.exec(stripExt(path28.basename(a.path)));
+  const bMatch = VERSION_SUFFIX_RE.exec(stripExt(path28.basename(b.path)));
   if (!aMatch || !bMatch)
     return null;
   if (aMatch[1].toLowerCase() !== bMatch[1].toLowerCase())
@@ -146470,8 +147103,8 @@ function makeChain(docs, detectedFrom) {
 // packages/spec-consolidator/dist/chain-recheck.js
 init_zod();
 import { createHash as createHash10 } from "node:crypto";
-import fs25 from "node:fs";
-import path30 from "node:path";
+import fs26 from "node:fs";
+import path29 from "node:path";
 var CACHE_FILE = "chain-recheck.json";
 var FUNDAMENTAL_SUBJECTS = [
   /\bauth\b/i,
@@ -146564,7 +147197,7 @@ async function runChainRecheck(repoRoot6, pairs2, opts = {}) {
 }
 function readSafe(absPath) {
   try {
-    return fs25.readFileSync(absPath, "utf-8");
+    return fs26.readFileSync(absPath, "utf-8");
   } catch {
     return null;
   }
@@ -146658,14 +147291,14 @@ function computePairCacheKey(pair, olderContent, newerContent) {
   return createHash10("sha256").update(`${PROMPT_FINGERPRINT}::${pair.older.path}|${olderHash}::${pair.newer.path}|${newerHash}`).digest("hex");
 }
 function pairCacheFile(repoRoot6) {
-  return path30.join(cachePaths2(repoRoot6).cacheDir, CACHE_FILE);
+  return path29.join(cachePaths2(repoRoot6).cacheDir, CACHE_FILE);
 }
 function readPairCache(repoRoot6, cacheKey) {
   const file = pairCacheFile(repoRoot6);
-  if (!fs25.existsSync(file))
+  if (!fs26.existsSync(file))
     return null;
   try {
-    const raw = JSON.parse(fs25.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs26.readFileSync(file, "utf-8"));
     const entry = (raw.entries ?? []).find((e) => e.cacheKey === cacheKey);
     return entry ? ChainRecheckResultSchema.parse(entry.result) : null;
   } catch {
@@ -146676,9 +147309,9 @@ function writePairCache(repoRoot6, cacheKey, result) {
   ensureCacheDirs2(repoRoot6);
   const file = pairCacheFile(repoRoot6);
   let entries = [];
-  if (fs25.existsSync(file)) {
+  if (fs26.existsSync(file)) {
     try {
-      const raw = JSON.parse(fs25.readFileSync(file, "utf-8"));
+      const raw = JSON.parse(fs26.readFileSync(file, "utf-8"));
       entries = raw.entries ?? [];
     } catch {
       entries = [];
@@ -146686,14 +147319,14 @@ function writePairCache(repoRoot6, cacheKey, result) {
   }
   const filtered = entries.filter((e) => e.cacheKey !== cacheKey);
   filtered.push({ cacheKey, result, cachedAt: (/* @__PURE__ */ new Date()).toISOString() });
-  fs25.writeFileSync(file, JSON.stringify({ entries: filtered }, null, 2) + "\n");
+  fs26.writeFileSync(file, JSON.stringify({ entries: filtered }, null, 2) + "\n");
 }
 
 // packages/spec-consolidator/dist/conflict-explainer.js
 init_zod();
 import { createHash as createHash11 } from "node:crypto";
-import fs26 from "node:fs";
-import path31 from "node:path";
+import fs27 from "node:fs";
+import path30 from "node:path";
 var CACHE_FILE2 = "conflict-explanations.json";
 async function explainConflicts(repoRoot6, conflicts2, opts = {}) {
   if (opts.enabled === false)
@@ -146912,14 +147545,14 @@ function computeCacheKey(conflict) {
   return createHash11("sha256").update(`${fp}::${conflict.id}::${ids}`).digest("hex");
 }
 function cacheFile(repoRoot6) {
-  return path31.join(cachePaths2(repoRoot6).cacheDir, CACHE_FILE2);
+  return path30.join(cachePaths2(repoRoot6).cacheDir, CACHE_FILE2);
 }
 function readCache(repoRoot6, cacheKey) {
   const file = cacheFile(repoRoot6);
-  if (!fs26.existsSync(file))
+  if (!fs27.existsSync(file))
     return null;
   try {
-    const raw = ExplanationCacheFileSchema.parse(JSON.parse(fs26.readFileSync(file, "utf-8")));
+    const raw = ExplanationCacheFileSchema.parse(JSON.parse(fs27.readFileSync(file, "utf-8")));
     const entry = raw.entries.find((e) => e.cacheKey === cacheKey);
     return entry ? entry.explanation : null;
   } catch {
@@ -146930,23 +147563,23 @@ function writeCache(repoRoot6, cacheKey, explanation) {
   ensureCacheDirs2(repoRoot6);
   const file = cacheFile(repoRoot6);
   let entries = [];
-  if (fs26.existsSync(file)) {
+  if (fs27.existsSync(file)) {
     try {
-      entries = ExplanationCacheFileSchema.parse(JSON.parse(fs26.readFileSync(file, "utf-8"))).entries;
+      entries = ExplanationCacheFileSchema.parse(JSON.parse(fs27.readFileSync(file, "utf-8"))).entries;
     } catch {
       entries = [];
     }
   }
   const filtered = entries.filter((e) => e.cacheKey !== cacheKey);
   filtered.push({ cacheKey, explanation, cachedAt: (/* @__PURE__ */ new Date()).toISOString() });
-  fs26.writeFileSync(file, JSON.stringify({ entries: filtered }, null, 2) + "\n");
+  fs27.writeFileSync(file, JSON.stringify({ entries: filtered }, null, 2) + "\n");
 }
 
 // packages/spec-consolidator/dist/conflict-resolver.js
 init_zod();
 import { createHash as createHash12 } from "node:crypto";
-import fs27 from "node:fs";
-import path32 from "node:path";
+import fs28 from "node:fs";
+import path31 from "node:path";
 var CACHE_FILE3 = "conflict-resolutions.json";
 async function resolveConflicts(repoRoot6, conflicts2, opts = {}) {
   if (opts.enabled === false || conflicts2.length === 0)
@@ -147158,14 +147791,14 @@ function computeCacheKey2(conflict) {
   return createHash12("sha256").update(`${PROMPT_FINGERPRINT2}::${conflict.id}::${ids}`).digest("hex");
 }
 function cacheFile2(repoRoot6) {
-  return path32.join(cachePaths2(repoRoot6).cacheDir, CACHE_FILE3);
+  return path31.join(cachePaths2(repoRoot6).cacheDir, CACHE_FILE3);
 }
 function readCache2(repoRoot6, cacheKey) {
   const file = cacheFile2(repoRoot6);
-  if (!fs27.existsSync(file))
+  if (!fs28.existsSync(file))
     return null;
   try {
-    const raw = ResolutionCacheFileSchema.parse(JSON.parse(fs27.readFileSync(file, "utf-8")));
+    const raw = ResolutionCacheFileSchema.parse(JSON.parse(fs28.readFileSync(file, "utf-8")));
     const entry = raw.entries.find((e) => e.cacheKey === cacheKey);
     return entry ? entry.resolution : null;
   } catch {
@@ -147176,23 +147809,23 @@ function writeCache2(repoRoot6, cacheKey, resolution) {
   ensureCacheDirs2(repoRoot6);
   const file = cacheFile2(repoRoot6);
   let entries = [];
-  if (fs27.existsSync(file)) {
+  if (fs28.existsSync(file)) {
     try {
-      entries = ResolutionCacheFileSchema.parse(JSON.parse(fs27.readFileSync(file, "utf-8"))).entries;
+      entries = ResolutionCacheFileSchema.parse(JSON.parse(fs28.readFileSync(file, "utf-8"))).entries;
     } catch {
       entries = [];
     }
   }
   const filtered = entries.filter((e) => e.cacheKey !== cacheKey);
   filtered.push({ cacheKey, resolution, cachedAt: (/* @__PURE__ */ new Date()).toISOString() });
-  fs27.writeFileSync(file, JSON.stringify({ entries: filtered }, null, 2) + "\n");
+  fs28.writeFileSync(file, JSON.stringify({ entries: filtered }, null, 2) + "\n");
 }
 
 // packages/spec-consolidator/dist/relevance-filter.js
 init_zod();
 import { createHash as createHash13 } from "node:crypto";
-import fs28 from "node:fs";
-import path33 from "node:path";
+import fs29 from "node:fs";
+import path32 from "node:path";
 var CACHE_FILE4 = "relevance.json";
 async function filterByRelevance(repoRoot6, docs, opts = {}) {
   if (opts.enabled === false || docs.length === 0) {
@@ -147344,14 +147977,14 @@ function computeCacheKey3(doc) {
   return createHash13("sha256").update(`${PROMPT_FINGERPRINT3}::${doc.path}::${doc.contentHash}`).digest("hex");
 }
 function cacheFile3(repoRoot6) {
-  return path33.join(cachePaths2(repoRoot6).cacheDir, CACHE_FILE4);
+  return path32.join(cachePaths2(repoRoot6).cacheDir, CACHE_FILE4);
 }
 function readCache3(repoRoot6, cacheKey) {
   const file = cacheFile3(repoRoot6);
-  if (!fs28.existsSync(file))
+  if (!fs29.existsSync(file))
     return null;
   try {
-    const raw = RelevanceCacheFileSchema.parse(JSON.parse(fs28.readFileSync(file, "utf-8")));
+    const raw = RelevanceCacheFileSchema.parse(JSON.parse(fs29.readFileSync(file, "utf-8")));
     const entry = raw.entries.find((e) => e.cacheKey === cacheKey);
     return entry ? entry.verdict : null;
   } catch {
@@ -147362,23 +147995,23 @@ function writeCache3(repoRoot6, cacheKey, verdict) {
   ensureCacheDirs2(repoRoot6);
   const file = cacheFile3(repoRoot6);
   let entries = [];
-  if (fs28.existsSync(file)) {
+  if (fs29.existsSync(file)) {
     try {
-      entries = RelevanceCacheFileSchema.parse(JSON.parse(fs28.readFileSync(file, "utf-8"))).entries;
+      entries = RelevanceCacheFileSchema.parse(JSON.parse(fs29.readFileSync(file, "utf-8"))).entries;
     } catch {
       entries = [];
     }
   }
   const filtered = entries.filter((e) => e.cacheKey !== cacheKey);
   filtered.push({ cacheKey, verdict, cachedAt: (/* @__PURE__ */ new Date()).toISOString() });
-  fs28.writeFileSync(file, JSON.stringify({ entries: filtered }, null, 2) + "\n");
+  fs29.writeFileSync(file, JSON.stringify({ entries: filtered }, null, 2) + "\n");
 }
 
 // packages/spec-consolidator/dist/version-chain-llm.js
 init_zod();
 import { createHash as createHash14 } from "node:crypto";
-import fs29 from "node:fs";
-import path34 from "node:path";
+import fs30 from "node:fs";
+import path33 from "node:path";
 var CACHE_FILE5 = "chain-detection.json";
 var DetectedChainOutputSchema = external_exports.object({
   chains: external_exports.array(external_exports.object({
@@ -147481,11 +148114,11 @@ function computeCacheKey4(inputs) {
   return createHash14("sha256").update(`${PROMPT_FINGERPRINT4}::${material}`).digest("hex");
 }
 function readChainDetectionCache(repoRoot6, cacheKey) {
-  const file = path34.join(cachePaths2(repoRoot6).cacheDir, CACHE_FILE5);
-  if (!fs29.existsSync(file))
+  const file = path33.join(cachePaths2(repoRoot6).cacheDir, CACHE_FILE5);
+  if (!fs30.existsSync(file))
     return null;
   try {
-    const raw = JSON.parse(fs29.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs30.readFileSync(file, "utf-8"));
     if (raw.cacheKey !== cacheKey)
       return null;
     return DetectedChainOutputSchema.parse(raw.result);
@@ -147495,13 +148128,13 @@ function readChainDetectionCache(repoRoot6, cacheKey) {
 }
 function writeChainDetectionCache(repoRoot6, cacheKey, result) {
   ensureCacheDirs2(repoRoot6);
-  const file = path34.join(cachePaths2(repoRoot6).cacheDir, CACHE_FILE5);
+  const file = path33.join(cachePaths2(repoRoot6).cacheDir, CACHE_FILE5);
   const entry = {
     cacheKey,
     result,
     cachedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  fs29.writeFileSync(file, JSON.stringify(entry, null, 2) + "\n");
+  fs30.writeFileSync(file, JSON.stringify(entry, null, 2) + "\n");
 }
 function materializeChains(result, docs) {
   const byPath = new Map(docs.map((d3) => [d3.path, d3]));
@@ -147658,7 +148291,7 @@ function synthesizeChainConflict(chain) {
   return {
     id: chain.id,
     topic: "overview",
-    subject: `version chain: ${chain.docs.map((d3) => path35.basename(d3.path)).join(" \u2192 ")}`,
+    subject: `version chain: ${chain.docs.map((d3) => path34.basename(d3.path)).join(" \u2192 ")}`,
     candidates,
     defaultPick: candidates.length - 1
   };
@@ -147670,7 +148303,7 @@ function docToSyntheticClaim(doc, chain) {
   return {
     id: `version-chain:${chain.id}:${doc.path}`,
     topic: "overview",
-    subject: `version chain: ${chain.docs.map((d3) => path35.basename(d3.path)).join(" \u2192 ")}`,
+    subject: `version chain: ${chain.docs.map((d3) => path34.basename(d3.path)).join(" \u2192 ")}`,
     content: {
       file: doc.path,
       detectedFrom: chain.detectedFrom,
@@ -147845,14 +148478,14 @@ function stitchChainConflicts(merge2, chainConflicts, chains, decisions) {
 }
 var EMPTY_DECISIONS = { version: 1, decisions: [], manualChains: [], manualIncludes: [] };
 function decisionsPath(repoRoot6) {
-  return path35.join(repoRoot6, ".truecourse", "specs", "decisions.json");
+  return path34.join(repoRoot6, ".truecourse", "specs", "decisions.json");
 }
 function readDecisions(repoRoot6) {
   const file = decisionsPath(repoRoot6);
-  if (!fs30.existsSync(file))
+  if (!fs31.existsSync(file))
     return EMPTY_DECISIONS;
   try {
-    const raw = JSON.parse(fs30.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs31.readFileSync(file, "utf-8"));
     return DecisionsFileSchema.parse(raw);
   } catch {
     return EMPTY_DECISIONS;
@@ -147860,8 +148493,8 @@ function readDecisions(repoRoot6) {
 }
 function writeDecisions(repoRoot6, decisions) {
   const file = decisionsPath(repoRoot6);
-  fs30.mkdirSync(path35.dirname(file), { recursive: true });
-  fs30.writeFileSync(file, JSON.stringify(decisions, null, 2) + "\n");
+  fs31.mkdirSync(path34.dirname(file), { recursive: true });
+  fs31.writeFileSync(file, JSON.stringify(decisions, null, 2) + "\n");
 }
 function wrapBlockRunner(repoRoot6, inner, onBlockDone) {
   return async (blocks) => {
@@ -147973,11 +148606,11 @@ function synthesizeCustomClaim(conflict, content, resolvedAt) {
 
 // packages/contract-extractor/dist/claims-reader.js
 function canonicalSpecPath(repoRoot6) {
-  return path36.join(repoRoot6, ".truecourse", "specs", "claims.json");
+  return path35.join(repoRoot6, ".truecourse", "specs", "claims.json");
 }
 function hasCanonicalSpec(repoRoot6) {
   const file = canonicalSpecPath(repoRoot6);
-  if (!fs31.existsSync(file))
+  if (!fs32.existsSync(file))
     return false;
   const parsed = readClaims(repoRoot6);
   return parsed !== null;
@@ -148578,7 +149211,7 @@ function rulesFor(a) {
   }
   if (a.kind === "auth-requirement") {
     if (!/\bon-violation\s*\{/.test(src)) {
-      out.push("missing `on-violation { status ... error-code ... body ErrorEnvelope:... }`.");
+      out.push("missing `on-violation { status ... error-code ... }` (add `body ErrorEnvelope:error.envelope.standard` only when that envelope is defined in the corpus).");
     }
     if (/\brequired-role\b/.test(src)) {
       const hasBroadGlob = /selector\s+path-glob\s+"\/api\/(\*\*|\*)"/.test(src);
@@ -148851,7 +149484,7 @@ function validateMerged(artifacts) {
 }
 
 // packages/contract-extractor/dist/writer.js
-import fs44 from "node:fs";
+import fs45 from "node:fs";
 import path52 from "node:path";
 var CONTRACTS_DIR = path52.join(".truecourse", "contracts");
 var SHARED_KINDS2 = /* @__PURE__ */ new Set([
@@ -148871,14 +149504,14 @@ function writeContracts(repoRoot6, artifacts, options = {}) {
       proposed.push(req.filePath);
       continue;
     }
-    fs44.mkdirSync(path52.dirname(req.filePath), { recursive: true });
-    const existing = fs44.existsSync(req.filePath) ? fs44.readFileSync(req.filePath, "utf-8") : null;
+    fs45.mkdirSync(path52.dirname(req.filePath), { recursive: true });
+    const existing = fs45.existsSync(req.filePath) ? fs45.readFileSync(req.filePath, "utf-8") : null;
     if (existing === req.tcSource)
       continue;
-    fs44.writeFileSync(req.filePath, req.tcSource);
+    fs45.writeFileSync(req.filePath, req.tcSource);
     written.push(req.filePath);
   }
-  if (options.prune && !options.dryRun && fs44.existsSync(root)) {
+  if (options.prune && !options.dryRun && fs45.existsSync(root)) {
     const live = new Set(requests.map((r) => r.filePath));
     pruneStale2(root, live);
   }
@@ -148947,16 +149580,16 @@ function slugifyIdentity2(identity) {
 }
 function pruneStale2(root, live) {
   const visit = (dir) => {
-    if (!fs44.existsSync(dir))
+    if (!fs45.existsSync(dir))
       return false;
     let dirEmpty = true;
-    for (const entry of fs44.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs45.readdirSync(dir, { withFileTypes: true })) {
       const full = path52.join(dir, entry.name);
       if (entry.isDirectory()) {
         const childEmpty = visit(full);
         if (childEmpty) {
           try {
-            fs44.rmdirSync(full);
+            fs45.rmdirSync(full);
           } catch {
           }
         } else {
@@ -148964,7 +149597,7 @@ function pruneStale2(root, live) {
         }
       } else if (entry.isFile()) {
         if (entry.name.endsWith(".tc") && !live.has(full)) {
-          fs44.unlinkSync(full);
+          fs45.unlinkSync(full);
         } else {
           dirEmpty = false;
         }
@@ -149178,7 +149811,7 @@ function hashString(s) {
 
 // packages/core/dist/config/llm-models.js
 init_paths();
-import fs45 from "node:fs";
+import fs46 from "node:fs";
 var STAGE_DEFAULTS = {
   "spec.chainDetect": "haiku",
   "spec.claimExtract": "sonnet",
@@ -149207,10 +149840,10 @@ function stageEnvVar(stageId) {
 }
 function readConfigSync(repoDir) {
   const file = getRepoConfigPath(repoDir);
-  if (!fs45.existsSync(file))
+  if (!fs46.existsSync(file))
     return {};
   try {
-    return JSON.parse(fs45.readFileSync(file, "utf-8"));
+    return JSON.parse(fs46.readFileSync(file, "utf-8"));
   } catch {
     return {};
   }
@@ -149282,14 +149915,14 @@ function describeStageResolutions(repoDir = resolveRepoDir(process.cwd())) {
 // packages/core/dist/commands/spec-in-process.js
 init_dist8();
 init_git();
-import fs47 from "node:fs";
+import fs48 from "node:fs";
 import path54 from "node:path";
 import { randomUUID as randomUUID23 } from "node:crypto";
 
 // packages/core/dist/lib/verify-store.js
 init_atomic_write();
 init_analysis_store();
-import fs46 from "node:fs";
+import fs47 from "node:fs";
 import path53 from "node:path";
 
 // packages/core/dist/types/verify-snapshot.js
@@ -149363,7 +149996,7 @@ function readVerifyLatest(repoPath) {
   const file = verifyLatestPath(repoPath);
   let mtime;
   try {
-    mtime = fs46.statSync(file).mtimeMs;
+    mtime = fs47.statSync(file).mtimeMs;
   } catch (err) {
     if (err.code === "ENOENT") {
       latestCache2.delete(repoPath);
@@ -149374,7 +150007,7 @@ function readVerifyLatest(repoPath) {
   const cached = latestCache2.get(repoPath);
   if (cached && cached.mtime === mtime)
     return cached.data;
-  const data = JSON.parse(fs46.readFileSync(file, "utf-8"));
+  const data = JSON.parse(fs47.readFileSync(file, "utf-8"));
   latestCache2.set(repoPath, { mtime, data });
   return data;
 }
@@ -149389,9 +150022,9 @@ function writeVerifyRun(repoPath, snapshot) {
 }
 function readVerifyHistory(repoPath) {
   const file = verifyHistoryPath(repoPath);
-  if (!fs46.existsSync(file))
+  if (!fs47.existsSync(file))
     return { runs: [] };
-  return JSON.parse(fs46.readFileSync(file, "utf-8"));
+  return JSON.parse(fs47.readFileSync(file, "utf-8"));
 }
 function appendVerifyHistory(repoPath, entry) {
   const history = readVerifyHistory(repoPath);
@@ -149403,7 +150036,7 @@ function writeVerifyDiff(repoPath, diff) {
 }
 function deleteVerifyDiff(repoPath) {
   try {
-    fs46.unlinkSync(verifyDiffPath(repoPath));
+    fs47.unlinkSync(verifyDiffPath(repoPath));
   } catch (err) {
     if (err.code !== "ENOENT")
       throw err;
@@ -149458,8 +150091,8 @@ function generatedMarkerPath(repoRoot6) {
 }
 function stampGeneratedMarker(repoRoot6) {
   const file = generatedMarkerPath(repoRoot6);
-  fs47.mkdirSync(path54.dirname(file), { recursive: true });
-  fs47.writeFileSync(file, JSON.stringify({ generatedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2) + "\n");
+  fs48.mkdirSync(path54.dirname(file), { recursive: true });
+  fs48.writeFileSync(file, JSON.stringify({ generatedAt: (/* @__PURE__ */ new Date()).toISOString() }, null, 2) + "\n");
 }
 function resolveConsolidateModels(repoRoot6) {
   return {
@@ -149728,7 +150361,7 @@ async function verifyInProcess(repoRoot6, options = {}) {
   const startedAt = Date.now();
   const contractsDir = options.contractsDir ?? path54.join(repoRoot6, ".truecourse", "contracts");
   const codeDir = options.codeDir ?? autodetectCodeDir(repoRoot6);
-  if (!fs47.existsSync(contractsDir)) {
+  if (!fs48.existsSync(contractsDir)) {
     const err = new Error(`Contracts directory not found at ${contractsDir}. Run \`truecourse contracts generate\` first.`);
     tracker?.error("load", err.message);
     throw err;
@@ -149736,7 +150369,16 @@ async function verifyInProcess(repoRoot6, options = {}) {
   tracker?.start("load");
   let result;
   try {
-    result = await runWithStash(repoRoot6, options.skipStash ?? false, tracker, () => verify({ contractsDir, codeDir }));
+    result = await runWithStash(repoRoot6, {
+      skipStash: options.skipStash ?? false,
+      message: "truecourse-verify-stash",
+      onStashStart: () => tracker?.detail?.("load", "Stashing pending changes..."),
+      onRestoreStart: () => tracker?.detail?.("load", "Restoring pending changes..."),
+      onRestoreError: (e) => (
+        // eslint-disable-next-line no-console
+        console.error(`[Verify] Failed to restore stashed changes. Run "git stash pop" manually. ${e.message}`)
+      )
+    }, () => verify({ contractsDir, codeDir }));
   } catch (e) {
     tracker?.error("load", e.message);
     throw e;
@@ -149786,7 +150428,7 @@ async function verifyInProcess(repoRoot6, options = {}) {
     bySeverity: summary.bySeverity
   });
   deleteVerifyDiff(repoRoot6);
-  fs47.rmSync(legacyVerifyStatePath(repoRoot6), { force: true });
+  fs48.rmSync(legacyVerifyStatePath(repoRoot6), { force: true });
   const state = {
     verifiedAt,
     contractsDir,
@@ -149819,37 +150461,6 @@ async function gitMeta(repoRoot6) {
     return { branch: null, commitHash: null };
   }
 }
-async function runWithStash(repoRoot6, skipStash, tracker, fn) {
-  let didStash = false;
-  let stashGit;
-  if (!skipStash) {
-    try {
-      stashGit = await getGit(repoRoot6);
-      const status = await stashGit.status();
-      if (!status.isClean()) {
-        const gitRoot = (await stashGit.revparse(["--show-toplevel"])).trim();
-        if (path54.resolve(repoRoot6) === path54.resolve(gitRoot)) {
-          tracker?.detail?.("load", "Stashing pending changes...");
-          const res = await stashGit.stash(["push", "--include-untracked", "-m", "truecourse-verify-stash"]);
-          didStash = !res.includes("No local changes");
-        }
-      }
-    } catch {
-    }
-  }
-  try {
-    return await fn();
-  } finally {
-    if (didStash && stashGit) {
-      tracker?.detail?.("load", "Restoring pending changes...");
-      try {
-        await stashGit.stash(["pop"]);
-      } catch (e) {
-        console.error(`[Verify] Failed to restore stashed changes. Run "git stash pop" manually. ${e.message}`);
-      }
-    }
-  }
-}
 async function gitChangedFiles(repoRoot6) {
   const out = [];
   try {
@@ -149886,7 +150497,7 @@ async function verifyDiffInProcess(repoRoot6, options = {}) {
     tracker?.error("load", err.message);
     throw err;
   }
-  if (!fs47.existsSync(contractsDir)) {
+  if (!fs48.existsSync(contractsDir)) {
     const err = new Error(`Contracts directory not found at ${contractsDir}. Run \`truecourse contracts generate\` first.`);
     tracker?.error("load", err.message);
     throw err;
@@ -149965,7 +150576,7 @@ async function inferInProcess(repoRoot6, options = {}) {
 }
 function autodetectCodeDir(repoRoot6) {
   const codeSubdir = path54.join(repoRoot6, "code");
-  if (fs47.existsSync(codeSubdir) && fs47.statSync(codeSubdir).isDirectory()) {
+  if (fs48.existsSync(codeSubdir) && fs48.statSync(codeSubdir).isDirectory()) {
     return codeSubdir;
   }
   return repoRoot6;
@@ -150089,6 +150700,7 @@ async function runContractsGenerate(options = {}) {
     gt("Aborted.");
     process.exit(1);
   }
+  await preflightClaudeOrExit();
   const concurrency = defaultConcurrency2();
   const extractModel = resolveModel("contract.extract", void 0, repoRoot6);
   const repairModel = resolveModel("contract.repair", void 0, repoRoot6);
@@ -150151,11 +150763,27 @@ async function runContractsGenerate(options = {}) {
       if (f2.run?.error) console.log(`    \u2192 ${f2.run.error}`);
     }
   }
-  if (result.validationIssues.length > 0) {
-    O2.error(`Validation gate failed (${result.validationIssues.length} issue${result.validationIssues.length === 1 ? "" : "s"}):`);
-    for (const issue of result.validationIssues) {
-      console.log(`  ${issue.artifactKey}: ${issue.message}`);
+  const hardIssues = result.validationIssues.filter((i) => i.severity === "hard");
+  const softIssues = result.validationIssues.filter((i) => i.severity === "soft");
+  if (softIssues.length > 0) {
+    const counts = /* @__PURE__ */ new Map();
+    for (const issue of softIssues) {
+      const line = `${issue.artifactKey}: ${issue.message}`;
+      counts.set(line, (counts.get(line) ?? 0) + 1);
     }
+    O2.warn(
+      `${counts.size} unresolved cross-reference${counts.size === 1 ? "" : "s"} (non-blocking \u2014 the referenced artifact wasn't generated; \`truecourse verify\` will flag any real drift):`
+    );
+    for (const [line, n] of counts) console.log(`  ${line}${n > 1 ? `  (\xD7${n})` : ""}`);
+  }
+  if (hardIssues.length > 0) {
+    O2.error(
+      `${hardIssues.length} artifact${hardIssues.length === 1 ? " was" : "s were"} dropped (invalid \`.tc\` \u2014 parse error or duplicate identity):`
+    );
+    for (const issue of hardIssues) console.log(`  ${issue.artifactKey}: ${issue.message}`);
+  }
+  const produced = options.diff ? result.write.proposed.length : result.write.written.length;
+  if (produced === 0 && result.validationIssues.length > 0) {
     gt("No contracts were written. Edit the spec or re-run after fixing.");
     process.exit(1);
   }
@@ -150197,7 +150825,7 @@ async function runContractsGenerate(options = {}) {
 async function runContractsList(options = {}) {
   const repoRoot6 = options.cwd ?? process.cwd();
   const contractsDir = path55.join(repoRoot6, ".truecourse", "contracts");
-  if (!fs48.existsSync(contractsDir)) {
+  if (!fs49.existsSync(contractsDir)) {
     O2.info("No contracts found. Run `truecourse contracts generate` first.");
     return;
   }
@@ -150205,12 +150833,12 @@ async function runContractsList(options = {}) {
   const fileNodes = [];
   let parseErrors = 0;
   const visit = (dir) => {
-    for (const entry of fs48.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs49.readdirSync(dir, { withFileTypes: true })) {
       const full = path55.join(dir, entry.name);
       if (entry.isDirectory()) visit(full);
       else if (entry.isFile() && entry.name.endsWith(".tc")) {
         try {
-          fileNodes.push(parser4.parseFile(full, fs48.readFileSync(full, "utf-8")));
+          fileNodes.push(parser4.parseFile(full, fs49.readFileSync(full, "utf-8")));
         } catch {
           parseErrors += 1;
         }
@@ -150250,7 +150878,7 @@ async function runContractsList(options = {}) {
 async function runContractsValidate(options = {}) {
   const repoRoot6 = options.cwd ?? process.cwd();
   const contractsDir = path55.join(repoRoot6, ".truecourse", "contracts");
-  if (!fs48.existsSync(contractsDir)) {
+  if (!fs49.existsSync(contractsDir)) {
     O2.error("No .truecourse/contracts/ directory found.");
     process.exit(1);
   }
@@ -150258,12 +150886,12 @@ async function runContractsValidate(options = {}) {
   const fileNodes = [];
   const issues = [];
   const visit = (dir) => {
-    for (const entry of fs48.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs49.readdirSync(dir, { withFileTypes: true })) {
       const full = path55.join(dir, entry.name);
       if (entry.isDirectory()) visit(full);
       else if (entry.isFile() && entry.name.endsWith(".tc")) {
         try {
-          fileNodes.push(parser4.parseFile(full, fs48.readFileSync(full, "utf-8")));
+          fileNodes.push(parser4.parseFile(full, fs49.readFileSync(full, "utf-8")));
         } catch (e) {
           issues.push(`${path55.relative(repoRoot6, full)}: parse error: ${e instanceof Error ? e.message : e}`);
         }
@@ -150375,42 +151003,88 @@ async function runSpecScan(opts = {}) {
   const root = repoRoot(opts);
   mt("Spec scan");
   await requireGitRepo(root);
+  await preflightClaudeOrExit();
   const { renderer, tracker } = withTracker(SCAN_STEPS);
-  try {
-    const { consolidate: consolidate2 } = await scanInProcess(root, { tracker, source: "cli", llm: opts.llm, io: opts.io });
-    renderer.dispose();
-    const { extract: extract4, merge: merge2 } = consolidate2;
-    O2.step(`docs        ${extract4.docsScanned}`);
-    O2.step(`blocks      ${extract4.blocksAttempted}  (${extract4.failures.length} failures)`);
-    O2.step(`claims      ${extract4.claims.length}`);
-    O2.step(`resolved    ${merge2.resolvedClaims.length}`);
-    O2.step(`decided     ${merge2.decidedConflicts.length}`);
-    O2.step(`open        ${merge2.openConflicts.length}`);
-    if (merge2.openConflicts.length > 0) {
-      O2.message("");
-      O2.message("Open conflicts:");
-      for (const c2 of merge2.openConflicts.slice(0, 10)) {
-        O2.message(`  \u2022 ${c2.subject}  (${c2.candidates.length} candidates, default: ${c2.candidates[c2.defaultPick].claim.provenance.file})`);
-        O2.message(`    id: ${c2.id}`);
-      }
-      if (merge2.openConflicts.length > 10) {
-        O2.message(`  \u2026 (+${merge2.openConflicts.length - 10} more \u2014 run \`truecourse spec conflicts list\`)`);
-      }
-      O2.message("");
-      O2.message("Resolve them:");
-      O2.message("  \u2022 dashboard:        truecourse dashboard            (Spec tab)");
-      O2.message("  \u2022 per conflict:     truecourse spec conflicts show <id>");
-      O2.message("                      truecourse spec conflicts pick <id> <candidateIndex>");
-      O2.message('                      truecourse spec conflicts custom <id> --text "\u2026"');
-      O2.message("  \u2022 accept defaults:  truecourse spec resolve --all-defaults");
-    }
-    gt(
-      merge2.openConflicts.length === 0 ? "No open conflicts \u2014 run `truecourse contracts generate`." : `${merge2.openConflicts.length} open.`
-    );
-  } catch (e) {
+  const { consolidate: consolidate2 } = await scanInProcess(root, {
+    tracker,
+    source: "cli",
+    llm: opts.llm,
+    io: opts.io
+  }).catch((e) => {
     renderer.dispose();
     pt(`Failed: ${e.message}`);
+    process.exit(1);
+  });
+  renderer.dispose();
+  const { extract: extract4, merge: merge2 } = consolidate2;
+  O2.step(`docs        ${extract4.docsScanned}`);
+  O2.step(`blocks      ${extract4.blocksAttempted}  (${extract4.failures.length} failures)`);
+  O2.step(`claims      ${extract4.claims.length}`);
+  O2.step(`resolved    ${merge2.resolvedClaims.length}`);
+  O2.step(`decided     ${merge2.decidedConflicts.length}`);
+  O2.step(`open        ${merge2.openConflicts.length}`);
+  const failures = summarizeExtractionFailures(extract4);
+  const outcome = decideScanOutcome({
+    blocksAttempted: extract4.blocksAttempted,
+    claims: extract4.claims.length,
+    openConflicts: merge2.openConflicts.length,
+    failures
+  });
+  if (failures.total > 0) {
+    O2.message("");
+    O2.warn(`${failures.total} block${failures.total === 1 ? "" : "s"} failed to extract:`);
+    for (const s of failures.samples) {
+      O2.message(`  \u2022 ${oneLine(s.message)}${s.count > 1 ? `  (\xD7${s.count})` : ""}`);
+    }
+  }
+  if (outcome.exitCode !== 0) {
+    gt(outcome.outro);
+    process.exit(outcome.exitCode);
+  }
+  if (merge2.openConflicts.length > 0) {
+    O2.message("");
+    O2.message("Open conflicts:");
+    for (const c2 of merge2.openConflicts.slice(0, 10)) {
+      O2.message(`  \u2022 ${c2.subject}  (${c2.candidates.length} candidates, default: ${c2.candidates[c2.defaultPick].claim.provenance.file})`);
+      O2.message(`    id: ${c2.id}`);
+    }
+    if (merge2.openConflicts.length > 10) {
+      O2.message(`  \u2026 (+${merge2.openConflicts.length - 10} more \u2014 run \`truecourse spec conflicts list\`)`);
+    }
+    O2.message("");
+    O2.message("Resolve them:");
+    O2.message("  \u2022 dashboard:        truecourse dashboard            (Spec tab)");
+    O2.message("  \u2022 per conflict:     truecourse spec conflicts show <id>");
+    O2.message("                      truecourse spec conflicts pick <id> <candidateIndex>");
+    O2.message('                      truecourse spec conflicts custom <id> --text "\u2026"');
+    O2.message("  \u2022 accept defaults:  truecourse spec resolve --all-defaults");
+  }
+  gt(outcome.outro);
+}
+function decideScanOutcome(input) {
+  const { failures } = input;
+  if (failures.allFailed) {
+    return {
+      exitCode: 1,
+      outro: `Aborted \u2014 all ${input.blocksAttempted} blocks failed, no claims extracted.`
+    };
+  }
+  const outro = input.openConflicts > 0 ? `${input.openConflicts} open.` : input.claims === 0 ? "No claims extracted \u2014 nothing to generate yet." : "No open conflicts \u2014 run `truecourse contracts generate`.";
+  return { exitCode: 0, outro };
+}
+function summarizeExtractionFailures(result, opts = {}) {
+  const { failures, blocksAttempted } = result;
+  const sampleLimit = opts.sampleLimit ?? 3;
+  const counts = /* @__PURE__ */ new Map();
+  for (const f2 of failures) {
+    counts.set(f2.error, (counts.get(f2.error) ?? 0) + 1);
   }
+  const samples = [...counts.entries()].sort((a, b) => b[1] - a[1]).slice(0, sampleLimit).map(([message, count]) => ({ message, count }));
+  return {
+    total: failures.length,
+    allFailed: blocksAttempted > 0 && failures.length === blocksAttempted,
+    samples
+  };
 }
 async function runSpecResolve(opts = {}) {
   const root = repoRoot(opts);
@@ -150423,6 +151097,7 @@ async function runSpecResolve(opts = {}) {
   }
   mt("Spec resolve \u2014 accepting all defaults");
   await requireGitRepo(root);
+  await preflightClaudeOrExit();
   const { renderer, tracker } = withTracker(RESOLVE_STEPS);
   try {
     const { additions } = await resolveAllDefaultsInProcess(root, { tracker, llm: opts.llm, io: opts.io });
@@ -150587,6 +151262,10 @@ function summarizeConflicts(label, conflicts2) {
 function decisionsRelPath(root) {
   return path56.join(root, ".truecourse", "specs", "decisions.json");
 }
+function oneLine(s, max = 200) {
+  const collapsed = s.replace(/\s+/g, " ").trim();
+  return collapsed.length <= max ? collapsed : `${collapsed.slice(0, max - 1)}\u2026`;
+}
 
 // tools/cli/src/commands/spec-conflicts.ts
 init_dist4();
@@ -151003,7 +151682,7 @@ async function runConfigLlmShow(options = {}) {
 
 // tools/cli/src/commands/hooks.ts
 import { execSync as execSync4 } from "node:child_process";
-import fs49 from "node:fs";
+import fs50 from "node:fs";
 import path59 from "node:path";
 
 // node_modules/.pnpm/js-yaml@4.1.1/node_modules/js-yaml/dist/js-yaml.mjs
@@ -153665,11 +154344,11 @@ function findGitDir(from) {
   let dir = from;
   while (true) {
     const gitPath = path59.join(dir, ".git");
-    if (fs49.existsSync(gitPath)) {
-      const stat = fs49.statSync(gitPath);
+    if (fs50.existsSync(gitPath)) {
+      const stat = fs50.statSync(gitPath);
       if (stat.isDirectory()) return gitPath;
       if (stat.isFile()) {
-        const content = fs49.readFileSync(gitPath, "utf-8").trim();
+        const content = fs50.readFileSync(gitPath, "utf-8").trim();
         const match4 = content.match(/^gitdir:\s*(.+)$/);
         if (match4) return path59.resolve(dir, match4[1]);
       }
@@ -153682,7 +154361,7 @@ function findGitDir(from) {
 function findProjectRoot(from) {
   let dir = from;
   while (true) {
-    if (fs49.existsSync(path59.join(dir, ".git"))) return dir;
+    if (fs50.existsSync(path59.join(dir, ".git"))) return dir;
     const parent = path59.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -153690,10 +154369,10 @@ function findProjectRoot(from) {
 }
 function loadConfig(projectRoot) {
   const configPath = path59.join(projectRoot, ".truecourse", "hooks.yaml");
-  if (!fs49.existsSync(configPath)) return null;
+  if (!fs50.existsSync(configPath)) return null;
   let parsed;
   try {
-    const raw = fs49.readFileSync(configPath, "utf-8");
+    const raw = fs50.readFileSync(configPath, "utf-8");
     parsed = jsYaml.load(raw) || {};
   } catch (err) {
     console.error(`Error parsing ${configPath}: ${err.message}`);
@@ -153745,10 +154424,10 @@ async function runHooksInstall() {
     console.log(INSTALL_WARNING);
   }
   const hooksDir = path59.join(gitDir, "hooks");
-  fs49.mkdirSync(hooksDir, { recursive: true });
+  fs50.mkdirSync(hooksDir, { recursive: true });
   const hookPath = path59.join(hooksDir, "pre-commit");
-  if (fs49.existsSync(hookPath)) {
-    const existing = fs49.readFileSync(hookPath, "utf-8");
+  if (fs50.existsSync(hookPath)) {
+    const existing = fs50.readFileSync(hookPath, "utf-8");
     if (!existing.includes(HOOK_IDENTIFIER)) {
       console.error(
         "Error: A pre-commit hook already exists and was not installed by TrueCourse."
@@ -153758,16 +154437,16 @@ async function runHooksInstall() {
       process.exit(1);
     }
   }
-  fs49.writeFileSync(hookPath, HOOK_SCRIPT, { mode: 493 });
+  fs50.writeFileSync(hookPath, HOOK_SCRIPT, { mode: 493 });
   console.log("TrueCourse pre-commit hook installed.");
   console.log(`  ${hookPath}`);
   const projectRoot = findProjectRoot(process.cwd());
   if (projectRoot) {
     const cfgDir = path59.join(projectRoot, ".truecourse");
     const cfgPath = path59.join(cfgDir, "hooks.yaml");
-    if (!fs49.existsSync(cfgPath)) {
-      fs49.mkdirSync(cfgDir, { recursive: true });
-      fs49.writeFileSync(cfgPath, HOOKS_YAML_TEMPLATE);
+    if (!fs50.existsSync(cfgPath)) {
+      fs50.mkdirSync(cfgDir, { recursive: true });
+      fs50.writeFileSync(cfgPath, HOOKS_YAML_TEMPLATE);
       console.log(`  ${cfgPath} (starter config \u2014 edit to customize, commit to share with the team)`);
     }
   }
@@ -153779,16 +154458,16 @@ function runHooksUninstall() {
     process.exit(1);
   }
   const hookPath = path59.join(gitDir, "hooks", "pre-commit");
-  if (!fs49.existsSync(hookPath)) {
+  if (!fs50.existsSync(hookPath)) {
     console.log("No pre-commit hook installed.");
     return;
   }
-  const content = fs49.readFileSync(hookPath, "utf-8");
+  const content = fs50.readFileSync(hookPath, "utf-8");
   if (!content.includes(HOOK_IDENTIFIER)) {
     console.error("Error: The pre-commit hook was not installed by TrueCourse. Leaving it in place.");
     process.exit(1);
   }
-  fs49.unlinkSync(hookPath);
+  fs50.unlinkSync(hookPath);
   console.log("TrueCourse pre-commit hook removed.");
 }
 function runHooksStatus() {
@@ -153798,7 +154477,7 @@ function runHooksStatus() {
     process.exit(1);
   }
   const hookPath = path59.join(gitDir, "hooks", "pre-commit");
-  const installed = fs49.existsSync(hookPath) && fs49.readFileSync(hookPath, "utf-8").includes(HOOK_IDENTIFIER);
+  const installed = fs50.existsSync(hookPath) && fs50.readFileSync(hookPath, "utf-8").includes(HOOK_IDENTIFIER);
   if (installed) {
     console.log("TrueCourse pre-commit hook: installed");
     console.log(`  ${hookPath}`);
@@ -153907,7 +154586,7 @@ async function runHooksRun() {
 
 // tools/cli/src/index.ts
 var program2 = new Command();
-program2.name("truecourse").version("0.6.1").description("TrueCourse CLI \u2014 analyze your repository and open the dashboard");
+program2.name("truecourse").version("0.6.6-next.0").description("TrueCourse CLI \u2014 analyze your repository and open the dashboard");
 var dashboardCmd = program2.command("dashboard").description("Start the TrueCourse dashboard and open it in your browser").option("--reconfigure", "Re-prompt for console vs background service mode").option("--service", "Run as a background service (skips mode prompt)").option("--console", "Run in this terminal (skips mode prompt)").action(async (options) => {
   if (options.service && options.console) {
     console.error("error: --service and --console are mutually exclusive");