truecourse 0.7.0-next.3 → 0.7.0-next.4

package/cli.mjs

@@ -973,7 +973,7 @@ var require_command = __commonJS({
     var EventEmitter2 = __require("node:events").EventEmitter;
     var childProcess = __require("node:child_process");
     var path80 = __require("node:path");
-    var fs69 = __require("node:fs");
+    var fs70 = __require("node:fs");
     var process2 = __require("node:process");
     var { Argument: Argument2, humanReadableArgName } = require_argument();
     var { CommanderError: CommanderError2 } = require_error();
@@ -1906,10 +1906,10 @@ Expecting one of '${allowedValues.join("', '")}'`);
         const sourceExt = [".js", ".ts", ".tsx", ".mjs", ".cjs"];
         function findFile(baseDir, baseName) {
           const localBin = path80.resolve(baseDir, baseName);
-          if (fs69.existsSync(localBin)) return localBin;
+          if (fs70.existsSync(localBin)) return localBin;
           if (sourceExt.includes(path80.extname(baseName))) return void 0;
           const foundExt = sourceExt.find(
-            (ext2) => fs69.existsSync(`${localBin}${ext2}`)
+            (ext2) => fs70.existsSync(`${localBin}${ext2}`)
           );
           if (foundExt) return `${localBin}${foundExt}`;
           return void 0;
@@ -1921,7 +1921,7 @@ Expecting one of '${allowedValues.join("', '")}'`);
         if (this._scriptPath) {
           let resolvedScriptPath;
           try {
-            resolvedScriptPath = fs69.realpathSync(this._scriptPath);
+            resolvedScriptPath = fs70.realpathSync(this._scriptPath);
           } catch (err) {
             resolvedScriptPath = this._scriptPath;
           }
@@ -105218,7 +105218,7 @@ function parseBlockedOnCapabilities(reason) {
     return [];
   return m[1].split(",").map((s) => s.trim()).filter(Boolean);
 }
-var GuardWrittenScenarioSchema, GuardCoverageGapKindSchema, GuardCoverageGapSchema, GuardBirthFindingSchema, GuardGenerateErrorSchema, GuardEntryPreflightSchema, GuardExtractionFailureSchema, GuardOrphanedSectionSchema, GuardRecipeReportSchema, GuardGenerateUsageSchema, GuardGenerateReportSchema;
+var GuardWrittenScenarioSchema, GuardCoverageGapKindSchema, GuardCoverageGapSchema, GuardBirthFindingSchema, GuardGenerateErrorSchema, GuardReadyScenarioSchema, GuardHeldSectionSchema, GuardEntryPreflightSchema, GuardExtractionFailureSchema, GuardOrphanedDismissalSchema, GuardOrphanedSectionSchema, GuardRecipeReportSchema, GuardGenerateUsageSchema, GuardGenerateReportSchema;
 var init_report = __esm({
   "packages/shared/dist/guard/report.js"() {
     "use strict";
@@ -105236,7 +105236,8 @@ var init_report = __esm({
       "awaiting-driver",
       "untestable",
       "no-claim",
-      "blocked-on"
+      "blocked-on",
+      "dismissed"
     ]);
     GuardCoverageGapSchema = external_exports.object({
       doc: external_exports.string(),
@@ -105258,6 +105259,22 @@ var init_report = __esm({
       actual: external_exports.string(),
       /** Repo-relative pointer into `guard/evidence/`, when a transcript was written. */
       evidencePath: external_exports.string().optional(),
+      /**
+       * The failed candidate's authored YAML, serialized inline AT FINDING CREATION
+       * (same serialize-at-creation as heldSections' readyScenarios). The finding
+       * detail renders it in the scenario-source code block so the user can judge
+       * "defect or drift" with the exact commands the scenario ran on-screen.
+       * Optional so older `result.json` files keep parsing.
+       */
+      yaml: external_exports.string().optional(),
+      /**
+       * The EXTRACTED CLAIM's stable text — the claim identity a dismissal keys on
+       * (anchor + this). The finding detail's Dismiss action writes it into
+       * `scenarios/decisions.json`; generate then skips a matching claim before
+       * authoring. Distinct from `title` (the scenario title). Optional so older
+       * reports (and the internal retry-evidence findings) parse.
+       */
+      claim: external_exports.string().optional(),
       /**
        * The bound section's human heading, joined SERVER-SIDE at report read time
        * (never written to `result.json` — the enrichment is read-side). A finding's
@@ -105271,6 +105288,18 @@ var init_report = __esm({
       anchor: external_exports.string(),
       message: external_exports.string()
     }).strict();
+    GuardReadyScenarioSchema = external_exports.object({
+      id: external_exports.string(),
+      title: external_exports.string(),
+      /** The committed YAML the scenario would have been written as. */
+      yaml: external_exports.string()
+    }).strict();
+    GuardHeldSectionSchema = external_exports.object({
+      doc: external_exports.string(),
+      anchor: external_exports.string(),
+      headingText: external_exports.string().optional(),
+      readyScenarios: external_exports.array(GuardReadyScenarioSchema)
+    }).strict();
     GuardEntryPreflightSchema = external_exports.object({
       /** Display form of the entry argv, e.g. `node tools/cli/dist/index.js`. */
       entry: external_exports.string(),
@@ -105283,6 +105312,11 @@ var init_report = __esm({
       doc: external_exports.string(),
       reason: external_exports.string()
     }).strict();
+    GuardOrphanedDismissalSchema = external_exports.object({
+      doc: external_exports.string(),
+      anchor: external_exports.string(),
+      title: external_exports.string()
+    }).strict();
     GuardOrphanedSectionSchema = external_exports.object({
       doc: external_exports.string(),
       anchor: external_exports.string(),
@@ -105323,6 +105357,19 @@ var init_report = __esm({
        * `written.length` when a passing scenario's section didn't settle.
        */
       birthPassed: external_exports.number().int().nonnegative().optional(),
+      /**
+       * Unsettled sections whose birth-passed candidates were withheld — the
+       * ready-but-held scenarios, each carrying its authored YAML inline. Optional so
+       * older reports (written before this field existed) keep parsing; absent reads
+       * as "no held work".
+       */
+      heldSections: external_exports.array(GuardHeldSectionSchema).optional(),
+      /**
+       * Dismissals whose claim text matched nothing in a doc this run re-extracted —
+       * stale entries in `scenarios/decisions.json`, surfaced (never silently
+       * honored). Optional so older reports parse; absent reads as "none".
+       */
+      orphanedDismissals: external_exports.array(GuardOrphanedDismissalSchema).optional(),
       manifestPath: external_exports.string().optional(),
       usage: GuardGenerateUsageSchema.optional(),
       /**
@@ -105373,6 +105420,35 @@ var init_manifest = __esm({
   }
 });
 
+// packages/shared/dist/guard/decisions.js
+function dismissedClaimKey(doc, anchor, title) {
+  return `${doc}\0${anchor}\0${title}`;
+}
+var GuardDismissedClaimSchema, GuardDecisionsSchema, EMPTY_GUARD_DECISIONS;
+var init_decisions = __esm({
+  "packages/shared/dist/guard/decisions.js"() {
+    "use strict";
+    init_zod();
+    GuardDismissedClaimSchema = external_exports.object({
+      /** Repo-relative doc path the claim's section lives in. */
+      doc: external_exports.string().min(1),
+      /** The section anchor (slug) the claim was extracted under. */
+      anchor: external_exports.string().min(1),
+      /** The extracted claim's stable text — the identity, with `anchor`. */
+      title: external_exports.string().min(1),
+      /** ISO timestamp the dismissal was recorded. */
+      dismissedAt: external_exports.string(),
+      /** Optional free-text rationale ("flaky", "won't fix", …). */
+      note: external_exports.string().optional()
+    });
+    GuardDecisionsSchema = external_exports.object({
+      version: external_exports.literal(1),
+      dismissedClaims: external_exports.array(GuardDismissedClaimSchema).default([])
+    });
+    EMPTY_GUARD_DECISIONS = { version: 1, dismissedClaims: [] };
+  }
+});
+
 // packages/shared/dist/guard/dashboard.js
 var init_dashboard = __esm({
   "packages/shared/dist/guard/dashboard.js"() {
@@ -105423,6 +105499,11 @@ function summarizeGenerate(r) {
       }
     }
   }
+  const heldSections = r.heldSections ?? [];
+  const heldKeys = new Set(heldSections.map((h) => `${h.doc}\0${h.anchor}`));
+  const readyButHeld = heldSections.reduce((n, h) => n + h.readyScenarios.length, 0);
+  const heldByFindings = r.birthFindings.filter((f2) => heldKeys.has(`${f2.doc}\0${f2.anchor}`)).length;
+  const heldByErrors = r.errors.filter((e) => heldKeys.has(`${e.doc}\0${e.anchor}`)).length;
   return {
     generatedAt: r.generatedAt,
     status: r.status,
@@ -105433,6 +105514,9 @@ function summarizeGenerate(r) {
     blockedOnCapabilities,
     birthFindings: r.birthFindings.length,
     errors: r.errors.length,
+    readyButHeld,
+    heldByFindings,
+    heldByErrors,
     ...r.usage ? { usage: r.usage } : {}
   };
 }
@@ -105464,6 +105548,7 @@ var init_guard = __esm({
     init_result();
     init_report();
     init_manifest();
+    init_decisions();
     init_dashboard();
     init_summary();
   }
@@ -146609,7 +146694,7 @@ var require_windows = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/windows.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
-    var fs69 = __require("fs");
+    var fs70 = __require("fs");
     function checkPathExt(path80, options) {
       var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
       if (!pathext) {
@@ -146634,12 +146719,12 @@ var require_windows = __commonJS({
       return checkPathExt(path80, options);
     }
     function isexe(path80, options, cb) {
-      fs69.stat(path80, function(er, stat) {
+      fs70.stat(path80, function(er, stat) {
         cb(er, er ? false : checkStat(stat, path80, options));
       });
     }
     function sync(path80, options) {
-      return checkStat(fs69.statSync(path80), path80, options);
+      return checkStat(fs70.statSync(path80), path80, options);
     }
   }
 });
@@ -146649,14 +146734,14 @@ var require_mode = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/mode.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
-    var fs69 = __require("fs");
+    var fs70 = __require("fs");
     function isexe(path80, options, cb) {
-      fs69.stat(path80, function(er, stat) {
+      fs70.stat(path80, function(er, stat) {
         cb(er, er ? false : checkStat(stat, options));
       });
     }
     function sync(path80, options) {
-      return checkStat(fs69.statSync(path80), options);
+      return checkStat(fs70.statSync(path80), options);
     }
     function checkStat(stat, options) {
       return stat.isFile() && checkMode(stat, options);
@@ -146680,7 +146765,7 @@ var require_mode = __commonJS({
 // node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js
 var require_isexe = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js"(exports, module) {
-    var fs69 = __require("fs");
+    var fs70 = __require("fs");
     var core2;
     if (process.platform === "win32" || global.TESTING_WINDOWS) {
       core2 = require_windows();
@@ -146944,16 +147029,16 @@ var require_shebang_command = __commonJS({
 var require_readShebang = __commonJS({
   "node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/readShebang.js"(exports, module) {
     "use strict";
-    var fs69 = __require("fs");
+    var fs70 = __require("fs");
     var shebangCommand = require_shebang_command();
     function readShebang(command) {
       const size = 150;
       const buffer = Buffer.alloc(size);
       let fd;
       try {
-        fd = fs69.openSync(command, "r");
-        fs69.readSync(fd, buffer, 0, size, 0);
-        fs69.closeSync(fd);
+        fd = fs70.openSync(command, "r");
+        fs70.readSync(fd, buffer, 0, size, 0);
+        fs70.closeSync(fd);
       } catch (e) {
       }
       return shebangCommand(buffer.toString());
@@ -147357,7 +147442,7 @@ var require_package = __commonJS({
 // node_modules/.pnpm/dotenv@16.6.1/node_modules/dotenv/lib/main.js
 var require_main = __commonJS({
   "node_modules/.pnpm/dotenv@16.6.1/node_modules/dotenv/lib/main.js"(exports, module) {
-    var fs69 = __require("fs");
+    var fs70 = __require("fs");
     var path80 = __require("path");
     var os15 = __require("os");
     var crypto6 = __require("crypto");
@@ -147466,7 +147551,7 @@ var require_main = __commonJS({
       if (options && options.path && options.path.length > 0) {
         if (Array.isArray(options.path)) {
           for (const filepath of options.path) {
-            if (fs69.existsSync(filepath)) {
+            if (fs70.existsSync(filepath)) {
               possibleVaultPath = filepath.endsWith(".vault") ? filepath : `${filepath}.vault`;
             }
           }
@@ -147476,7 +147561,7 @@ var require_main = __commonJS({
       } else {
         possibleVaultPath = path80.resolve(process.cwd(), ".env.vault");
       }
-      if (fs69.existsSync(possibleVaultPath)) {
+      if (fs70.existsSync(possibleVaultPath)) {
         return possibleVaultPath;
       }
       return null;
@@ -147525,7 +147610,7 @@ var require_main = __commonJS({
       const parsedAll = {};
       for (const path81 of optionPaths) {
         try {
-          const parsed = DotenvModule.parse(fs69.readFileSync(path81, { encoding }));
+          const parsed = DotenvModule.parse(fs70.readFileSync(path81, { encoding }));
           DotenvModule.populate(parsedAll, parsed, options);
         } catch (e) {
           if (debug2) {
@@ -161618,7 +161703,7 @@ var require_form_data = __commonJS({
     var http = __require("http");
     var https = __require("https");
     var parseUrl = __require("url").parse;
-    var fs69 = __require("fs");
+    var fs70 = __require("fs");
     var Stream = __require("stream").Stream;
     var crypto6 = __require("crypto");
     var mime = require_mime_types();
@@ -161685,7 +161770,7 @@ var require_form_data = __commonJS({
         if (value.end != void 0 && value.end != Infinity && value.start != void 0) {
           callback(null, value.end + 1 - (value.start ? value.start : 0));
         } else {
-          fs69.stat(value.path, function(err, stat) {
+          fs70.stat(value.path, function(err, stat) {
             if (err) {
               callback(err);
               return;
@@ -162303,8 +162388,8 @@ var require_node2 = __commonJS({
           }
           break;
         case "FILE":
-          var fs69 = __require("fs");
-          stream2 = new fs69.SyncWriteStream(fd2, { autoClose: false });
+          var fs70 = __require("fs");
+          stream2 = new fs70.SyncWriteStream(fd2, { autoClose: false });
           stream2._type = "fs";
           break;
         case "PIPE":
@@ -170284,7 +170369,7 @@ function readToolVersion() {
   if (cachedVersion)
     return cachedVersion;
   if (true) {
-    cachedVersion = "0.7.0-next.3";
+    cachedVersion = "0.7.0-next.4";
     return cachedVersion;
   }
   try {
@@ -172690,13 +172775,13 @@ var init_pexprs_toFailure = __esm({
       return new Failure(this, "a Unicode [" + this.categoryOrProp + "] character", "description");
     };
     Alt.prototype.toFailure = function(grammar2) {
-      const fs69 = this.terms.map((t2) => t2.toFailure(grammar2));
-      const description = "(" + fs69.join(" or ") + ")";
+      const fs70 = this.terms.map((t2) => t2.toFailure(grammar2));
+      const description = "(" + fs70.join(" or ") + ")";
       return new Failure(this, description, "description");
     };
     Seq.prototype.toFailure = function(grammar2) {
-      const fs69 = this.factors.map((f2) => f2.toFailure(grammar2));
-      const description = "(" + fs69.join(" ") + ")";
+      const fs70 = this.factors.map((f2) => f2.toFailure(grammar2));
+      const description = "(" + fs70.join(" ") + ")";
       return new Failure(this, description, "description");
     };
     Iter.prototype.toFailure = function(grammar2) {
@@ -174533,9 +174618,9 @@ function buildGrammar2(match4, namespace, optOhmGrammarForTesting, options) {
         decl.withSuperGrammar(namespace[superGrammarName]);
       }
     },
-    Rule_define(n, fs69, d3, _2, b) {
+    Rule_define(n, fs70, d3, _2, b) {
       currentRuleName = n.visit();
-      currentRuleFormals = fs69.children.map((c2) => c2.visit())[0] || [];
+      currentRuleFormals = fs70.children.map((c2) => c2.visit())[0] || [];
       if (!decl.defaultStartRule && decl.ensureSuperGrammar() !== Grammar.ProtoBuiltInRules) {
         decl.withDefaultStartRule(currentRuleName);
       }
@@ -174544,9 +174629,9 @@ function buildGrammar2(match4, namespace, optOhmGrammarForTesting, options) {
       const source = this.source.trimmed();
       return decl.define(currentRuleName, currentRuleFormals, body, description, source);
     },
-    Rule_override(n, fs69, _2, b) {
+    Rule_override(n, fs70, _2, b) {
       currentRuleName = n.visit();
-      currentRuleFormals = fs69.children.map((c2) => c2.visit())[0] || [];
+      currentRuleFormals = fs70.children.map((c2) => c2.visit())[0] || [];
       const source = this.source.trimmed();
       decl.ensureSuperGrammarRuleForOverriding(currentRuleName, source);
       overriding = true;
@@ -174554,9 +174639,9 @@ function buildGrammar2(match4, namespace, optOhmGrammarForTesting, options) {
       overriding = false;
       return decl.override(currentRuleName, currentRuleFormals, body, null, source);
     },
-    Rule_extend(n, fs69, _2, b) {
+    Rule_extend(n, fs70, _2, b) {
       currentRuleName = n.visit();
-      currentRuleFormals = fs69.children.map((c2) => c2.visit())[0] || [];
+      currentRuleFormals = fs70.children.map((c2) => c2.visit())[0] || [];
       const body = b.visit();
       const source = this.source.trimmed();
       return decl.extend(currentRuleName, currentRuleFormals, body, null, source);
@@ -174583,8 +174668,8 @@ function buildGrammar2(match4, namespace, optOhmGrammarForTesting, options) {
         return builder.alt(...args).withSource(this.source);
       }
     },
-    Formals(opointy, fs69, cpointy) {
-      return fs69.visit();
+    Formals(opointy, fs70, cpointy) {
+      return fs70.visit();
     },
     Params(opointy, ps, cpointy) {
       return ps.visit();
@@ -174746,8 +174831,8 @@ function initPrototypeParser(grammar2) {
         formals: optFormals.children.map((c2) => c2.parse())[0] || []
       };
     },
-    Formals(oparen, fs69, cparen) {
-      return fs69.asIteration().children.map((c2) => c2.parse());
+    Formals(oparen, fs70, cparen) {
+      return fs70.asIteration().children.map((c2) => c2.parse());
     },
     name(first2, rest) {
       return this.sourceString;
@@ -196095,7 +196180,7 @@ async function runRulesReset({ ruleKey }) {
 
 // tools/cli/src/commands/contracts.ts
 init_dist4();
-import fs66 from "node:fs";
+import fs67 from "node:fs";
 import path73 from "node:path";
 
 // packages/spec-consolidator/dist/types.js
@@ -204900,6 +204985,7 @@ var HISTORY_FILE2 = "history.json";
 var RESULT_FILE = "result.json";
 var RECIPE_FILE = "recipe.json";
 var MANIFEST_FILE = "manifest.json";
+var DECISIONS_FILE = "decisions.json";
 function guardDir(repoRoot5) {
   return path54.join(repoRoot5, TRUECOURSE_DIR3, GUARD_DIR);
 }
@@ -204927,6 +205013,9 @@ function recipePath(repoRoot5) {
 function manifestPath2(repoRoot5) {
   return path54.join(scenariosDir(repoRoot5), MANIFEST_FILE);
 }
+function guardDecisionsPath(repoRoot5) {
+  return path54.join(scenariosDir(repoRoot5), DECISIONS_FILE);
+}
 function evidenceRunDir(repoRoot5, runId) {
   return path54.join(guardDir(repoRoot5), EVIDENCE_DIR, runId);
 }
@@ -205659,6 +205748,14 @@ function writeFile(dir, name, content) {
 
 // packages/guard-runner/dist/run-scenario.js
 var ENV_PINS = DETERMINISM_PINS;
+var SANDBOX_SETUP_EXPECTED = "sandbox setup to succeed";
+var CAPABILITY_SETUP_EXPECTED = "setup capabilities to materialize";
+function isSetupDefectResult(result) {
+  if (result.outcome !== "error")
+    return false;
+  const expected = result.failure?.expected;
+  return expected === SANDBOX_SETUP_EXPECTED || expected === CAPABILITY_SETUP_EXPECTED;
+}
 async function runScenario(scenario, ctx) {
   const start = Date.now();
   const base2 = {
@@ -205679,7 +205776,7 @@ async function runScenario(scenario, ctx) {
       ...base2,
       outcome: "error",
       durationMs: Date.now() - start,
-      failure: { step: 1, expected: "sandbox setup to succeed", actual: message }
+      failure: { step: 1, expected: SANDBOX_SETUP_EXPECTED, actual: message }
     };
   }
   const normCtx = { sandboxRoot: sandbox.root, repoRoot: ctx.repoRoot };
@@ -205694,7 +205791,7 @@ async function runScenario(scenario, ctx) {
         ...base2,
         outcome: "error",
         durationMs: Date.now() - start,
-        failure: { step: 1, expected: "setup capabilities to materialize", actual: message }
+        failure: { step: 1, expected: CAPABILITY_SETUP_EXPECTED, actual: message }
       };
     }
     for (let i = 0; i < scenario.steps.length; i++) {
@@ -206174,12 +206271,27 @@ async function mapWithConcurrency(items, limit, fn) {
   return results;
 }
 
+// packages/guard-runner/dist/decisions.js
+init_dist5();
+import fs57 from "node:fs";
+function readGuardDecisions(repoRoot5) {
+  const file = guardDecisionsPath(repoRoot5);
+  if (!fs57.existsSync(file))
+    return EMPTY_GUARD_DECISIONS;
+  try {
+    const parsed = GuardDecisionsSchema.safeParse(JSON.parse(fs57.readFileSync(file, "utf-8")));
+    return parsed.success ? parsed.data : EMPTY_GUARD_DECISIONS;
+  } catch {
+    return EMPTY_GUARD_DECISIONS;
+  }
+}
+
 // packages/guard-generator/dist/generate.js
 init_dist5();
 
 // packages/guard-generator/dist/section-plan.js
 init_zod();
-import fs57 from "node:fs";
+import fs58 from "node:fs";
 import path63 from "node:path";
 import { createHash as createHash15 } from "node:crypto";
 init_dist5();
@@ -206497,10 +206609,10 @@ var CorpusShape2 = external_exports.object({
 function readCorpusAreaTags(repoRoot5) {
   const file = path63.join(repoRoot5, ".truecourse", "specs", "corpus.json");
   const map2 = /* @__PURE__ */ new Map();
-  if (!fs57.existsSync(file))
+  if (!fs58.existsSync(file))
     return map2;
   try {
-    const parsed = CorpusShape2.safeParse(JSON.parse(fs57.readFileSync(file, "utf-8")));
+    const parsed = CorpusShape2.safeParse(JSON.parse(fs58.readFileSync(file, "utf-8")));
     if (!parsed.success)
       return map2;
     for (const d3 of parsed.data.docs ?? [])
@@ -206519,17 +206631,17 @@ function generationInputsHash(fingerprint2, recipeFingerprint) {
   ].join("\0")).digest("hex");
 }
 function hasGuardUniverse(repoRoot5) {
-  return fs57.existsSync(path63.join(repoRoot5, ".truecourse", "specs", "corpus.json"));
+  return fs58.existsSync(path63.join(repoRoot5, ".truecourse", "specs", "corpus.json"));
 }
 function planGuardWork(repoRoot5, recipeFingerprint) {
   const recipeFp = recipeFingerprint ?? computeRecipeFingerprint(repoRoot5);
-  const recipeMissing = !fs57.existsSync(recipePath(repoRoot5));
+  const recipeMissing = !fs58.existsSync(recipePath(repoRoot5));
   const hasUniverse = hasGuardUniverse(repoRoot5);
   const { indexes } = indexRepoDocs(repoRoot5, []);
   const areaTags = readCorpusAreaTags(repoRoot5);
   const sections = [];
   for (const [doc, index] of indexes) {
-    const texts = extractSectionTexts(doc, fs57.readFileSync(path63.resolve(repoRoot5, doc), "utf-8"));
+    const texts = extractSectionTexts(doc, fs58.readFileSync(path63.resolve(repoRoot5, doc), "utf-8"));
     for (const s of index.sections) {
       const t2 = texts.get(s.anchor);
       sections.push({
@@ -206574,7 +206686,7 @@ function collectWorkDocs(repoRoot5, plan) {
   }
   return [...byDoc].map(([doc, sections]) => ({
     doc,
-    content: fs57.readFileSync(path63.resolve(repoRoot5, doc), "utf-8"),
+    content: fs58.readFileSync(path63.resolve(repoRoot5, doc), "utf-8"),
     sections
   }));
 }
@@ -206961,7 +207073,7 @@ function truncate3(text4) {
 }
 
 // packages/guard-generator/dist/recipe-discovery.js
-import fs58 from "node:fs";
+import fs59 from "node:fs";
 import os13 from "node:os";
 import path65 from "node:path";
 import { createHash as createHash18 } from "node:crypto";
@@ -207017,8 +207129,8 @@ async function discoverRecipe(repoRoot5, runner) {
     ...proposal.env ? { env: proposal.env } : {}
   };
   const target = recipePath(repoRoot5);
-  fs58.mkdirSync(path65.dirname(target), { recursive: true });
-  fs58.writeFileSync(target, JSON.stringify(recipe, null, 2) + "\n");
+  fs59.mkdirSync(path65.dirname(target), { recursive: true });
+  fs59.writeFileSync(target, JSON.stringify(recipe, null, 2) + "\n");
   return {
     status: "discovered",
     recipe,
@@ -207049,13 +207161,13 @@ async function proposeRecipeWithReask(input, runner) {
 }
 function readDiscoveryInputs(repoRoot5) {
   const pkgPath = path65.join(repoRoot5, "package.json");
-  const packageJson = fs58.existsSync(pkgPath) ? fs58.readFileSync(pkgPath, "utf-8") : "(no package.json)";
-  const presentInputs = DISCOVERY_INPUTS.filter((f2) => fs58.existsSync(path65.join(repoRoot5, f2)));
+  const packageJson = fs59.existsSync(pkgPath) ? fs59.readFileSync(pkgPath, "utf-8") : "(no package.json)";
+  const presentInputs = DISCOVERY_INPUTS.filter((f2) => fs59.existsSync(path65.join(repoRoot5, f2)));
   return { packageJson, presentInputs };
 }
 async function probeEntry(repoRoot5, entry) {
   const resolved = resolveEntry(repoRoot5, entry);
-  const cwd = fs58.mkdtempSync(path65.join(os13.tmpdir(), "tc-guard-probe-"));
+  const cwd = fs59.mkdtempSync(path65.join(os13.tmpdir(), "tc-guard-probe-"));
   try {
     for (const args of [["--help"], []]) {
       const capture = await executeStep({
@@ -207072,7 +207184,7 @@ async function probeEntry(repoRoot5, entry) {
       reason: `entrypoint ${JSON.stringify(entry)} did not answer to \`--help\` or a bare invocation`
     };
   } finally {
-    fs58.rmSync(cwd, { recursive: true, force: true });
+    fs59.rmSync(cwd, { recursive: true, force: true });
   }
 }
 
@@ -207119,7 +207231,7 @@ async function birthValidate(repoRoot5, candidates, opts = {}) {
 }
 
 // packages/guard-generator/dist/serialize.js
-import fs59 from "node:fs";
+import fs60 from "node:fs";
 import path66 from "node:path";
 init_dist5();
 function anchorLeaf(anchor) {
@@ -207162,15 +207274,15 @@ function scenarioFileIndex(repoRoot5) {
   const root2 = scenariosDir(repoRoot5);
   const map2 = /* @__PURE__ */ new Map();
   const walk20 = (dir) => {
-    if (!fs59.existsSync(dir))
+    if (!fs60.existsSync(dir))
       return;
-    for (const entry of fs59.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs60.readdirSync(dir, { withFileTypes: true })) {
       const full = path66.join(dir, entry.name);
       if (entry.isDirectory())
         walk20(full);
       else if (entry.isFile() && /\.ya?ml$/i.test(entry.name)) {
         try {
-          const doc = jsYaml.load(fs59.readFileSync(full, "utf-8"));
+          const doc = jsYaml.load(fs60.readFileSync(full, "utf-8"));
           if (doc && typeof doc.id === "string")
             map2.set(doc.id, full);
         } catch {
@@ -207184,19 +207296,22 @@ function scenarioFileIndex(repoRoot5) {
 function existingScenarioIds(repoRoot5) {
   return new Set(loadScenarios(repoRoot5).scenarios.map((s) => s.id));
 }
+function serializeScenarioYaml(scenario) {
+  return jsYaml.dump(scenario, { lineWidth: -1, noRefs: true });
+}
 function writeScenarioFile(repoRoot5, slug2, scenario) {
   const dir = path66.join(scenariosDir(repoRoot5), slug2);
-  fs59.mkdirSync(dir, { recursive: true });
+  fs60.mkdirSync(dir, { recursive: true });
   const file = path66.join(dir, `${scenario.id}.yaml`);
-  fs59.writeFileSync(file, jsYaml.dump(scenario, { lineWidth: -1, noRefs: true }));
+  fs60.writeFileSync(file, serializeScenarioYaml(scenario));
   return path66.relative(repoRoot5, file);
 }
 function deleteScenarioFiles(repoRoot5, ids) {
   const index = scenarioFileIndex(repoRoot5);
   for (const id of ids) {
     const file = index.get(id);
-    if (file && fs59.existsSync(file))
-      fs59.rmSync(file);
+    if (file && fs60.existsSync(file))
+      fs60.rmSync(file);
   }
 }
 
@@ -207266,7 +207381,9 @@ async function generateGuards(options) {
       errors: [],
       extractionFailures: [],
       orphaned,
-      birthPassed: 0
+      birthPassed: 0,
+      heldSections: [],
+      orphanedDismissals: []
     };
   }
   const limit = pLimit(Math.max(1, options.concurrency ?? defaultConcurrency3()));
@@ -207281,6 +207398,10 @@ async function generateGuards(options) {
   const coverageGaps = [];
   const errors = [];
   const extractionFailures = [];
+  const decisions = readGuardDecisions(repoRoot5);
+  const dismissalByKey = new Map(decisions.dismissedClaims.map((d3) => [dismissedClaimKey(d3.doc, d3.anchor, d3.title), d3]));
+  const extractedClaimKeys = /* @__PURE__ */ new Set();
+  const extractedDocs = /* @__PURE__ */ new Set();
   const workDocs = collectWorkDocs(repoRoot5, plan);
   const workKeys = new Set(plan.work.map(key2));
   const workDocByPath = new Map(workDocs.map((d3) => [d3.doc, d3]));
@@ -207310,34 +207431,47 @@ async function generateGuards(options) {
         reason: `${result.failedViews} extraction view(s) failed \u2014 re-run to complete coverage for affected sections`
       });
     }
+    extractedDocs.add(doc.doc);
+    for (const c2 of result.data.claims) {
+      extractedClaimKeys.add(dismissedClaimKey(doc.doc, c2.sectionAnchor, c2.claim));
+    }
     const { claimsByAnchor, noteByAnchor } = groupExtraction(result.data);
     for (const s of doc.sections) {
       if (!workKeys.has(key2(s)))
         continue;
       const claims = claimsByAnchor.get(s.anchor) ?? [];
-      const cli = claims.filter((c2) => isRunnableDriver(c2.driver));
+      const cliAll = claims.filter((c2) => isRunnableDriver(c2.driver));
       const others = claims.filter((c2) => !isRunnableDriver(c2.driver));
       const note = noteByAnchor.get(s.anchor);
+      const cli = cliAll.filter((c2) => !dismissalByKey.has(dismissedClaimKey(s.doc, s.anchor, c2.claim)));
+      const dismissed = cliAll.filter((c2) => dismissalByKey.has(dismissedClaimKey(s.doc, s.anchor, c2.claim)));
+      for (const d3 of dismissed) {
+        const entry = dismissalByKey.get(dismissedClaimKey(s.doc, s.anchor, d3.claim));
+        coverageGaps.push({ doc: s.doc, anchor: s.anchor, kind: "dismissed", reason: dismissedReason(d3.claim, entry?.note) });
+      }
       for (const o of others) {
         coverageGaps.push({ doc: s.doc, anchor: s.anchor, kind: "awaiting-driver", driver: o.driver, reason: o.reason });
       }
       if (cli.length === 0 && others.length === 0) {
-        if (!result.complete && !note) {
-          extractFailedKeys.add(key2(s));
-          continue;
+        if (dismissed.length === 0) {
+          if (!result.complete && !note) {
+            extractFailedKeys.add(key2(s));
+            continue;
+          }
+          coverageGaps.push({
+            doc: s.doc,
+            anchor: s.anchor,
+            kind: note ? "untestable" : "no-claim",
+            reason: note?.reason ?? "the section states no CLI-assertable claim"
+          });
         }
-        coverageGaps.push({
-          doc: s.doc,
-          anchor: s.anchor,
-          kind: note ? "untestable" : "no-claim",
-          reason: note?.reason ?? "the section states no CLI-assertable claim"
-        });
       }
       classificationByKey.set(key2(s), deriveClassification(cli, others, note));
       for (const c2 of cli)
         authTasks.push({ ref: `c${refSeq++}`, section: s, claim: c2 });
     }
   }
+  const orphanedDismissals = decisions.dismissedClaims.filter((d3) => extractedDocs.has(d3.doc) && !extractedClaimKeys.has(dismissedClaimKey(d3.doc, d3.anchor, d3.title))).map((d3) => ({ doc: d3.doc, anchor: d3.anchor, title: d3.title }));
   const buildPromise = runBuild(repoRoot5, recipe.build, recipe.env);
   let buildAnnounced = false;
   const awaitBuild = async () => {
@@ -207406,6 +207540,7 @@ async function generateGuards(options) {
   };
   const written = [];
   const birthFindings = [];
+  const heldSections = [];
   let entryPreflightFailure = null;
   let birthTotal = 0;
   let birthSettled = 0;
@@ -207513,9 +207648,9 @@ async function generateGuards(options) {
           pushInto(r1ByRef, o.candidate.ref, o);
         const retryEntries = [];
         for (const [ref, outcomes] of r1ByRef) {
-          const fail4 = outcomes.find((o) => o.result.outcome === "fail");
-          if (fail4) {
-            retryEntries.push({ task: taskByRef.get(ref), evidence: toFinding(fail4) });
+          const retriable2 = outcomes.find((o) => o.result.outcome === "fail" || isSetupDefectResult(o.result));
+          if (retriable2) {
+            retryEntries.push({ task: taskByRef.get(ref), evidence: toFinding(retriable2) });
             continue;
           }
           for (const o of outcomes) {
@@ -207574,6 +207709,16 @@ async function generateGuards(options) {
         ids.push(c2.scenario.id);
       }
       upsertSection(section, ids);
+    } else if (persistedHere.length > 0) {
+      heldSections.push({
+        doc: section.doc,
+        anchor: section.anchor,
+        readyScenarios: persistedHere.map((c2) => ({
+          id: c2.scenario.id,
+          title: c2.scenario.title,
+          yaml: serializeScenarioYaml(c2.scenario)
+        }))
+      });
     }
   }
   const authorTotal = authTasks.length;
@@ -207652,6 +207797,8 @@ async function generateGuards(options) {
     extractionFailures,
     orphaned,
     birthPassed,
+    heldSections,
+    orphanedDismissals,
     manifestPath: manifestPath2(repoRoot5),
     ...entryPreflightFailure ? { entryPreflight: entryPreflightFailure } : {}
   };
@@ -207698,7 +207845,9 @@ function emptyResult(status, extra) {
     errors: [],
     extractionFailures: [],
     orphaned: [],
-    birthPassed: 0
+    birthPassed: 0,
+    heldSections: [],
+    orphanedDismissals: []
   };
 }
 function readPriorManifest(repoRoot5) {
@@ -207793,9 +207942,18 @@ function toFinding(o) {
     step: f2?.step ?? 1,
     expected: f2?.expected ?? "",
     actual: f2?.actual ?? "",
-    ...o.result.evidencePath ? { evidencePath: o.result.evidencePath } : {}
+    ...o.result.evidencePath ? { evidencePath: o.result.evidencePath } : {},
+    // Judge-on-one-screen (item 19): the failed candidate's exact YAML rides inline
+    // so the finding detail shows the commands it ran; `claim` is the dismissal
+    // identity (item 20) so the detail's Dismiss action can key on it.
+    yaml: serializeScenarioYaml(o.candidate.scenario),
+    claim: o.candidate.claim.claim
   };
 }
+function dismissedReason(claim, note) {
+  const base2 = `dismissed: ${oneLine(claim)}`;
+  return note ? `${base2} \u2014 ${oneLine(note)}` : base2;
+}
 function errorFrom(o) {
   return {
     doc: o.candidate.section.doc,
@@ -207858,7 +208016,7 @@ init_context_router();
 
 // packages/core/dist/services/llm/model-prices.js
 init_paths();
-import fs60 from "node:fs";
+import fs61 from "node:fs";
 import path67 from "node:path";
 var OPENROUTER_URL = "https://openrouter.ai/api/v1/models";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -207879,7 +208037,7 @@ function cacheFilePath() {
 }
 function readCache7() {
   try {
-    const t2 = JSON.parse(fs60.readFileSync(cacheFilePath(), "utf-8"));
+    const t2 = JSON.parse(fs61.readFileSync(cacheFilePath(), "utf-8"));
     if (t2 && t2.tiers && t2.byId && typeof t2.fetchedAt === "number")
       return t2;
   } catch {
@@ -207888,8 +208046,8 @@ function readCache7() {
 }
 function writeCache7(t2) {
   try {
-    fs60.mkdirSync(path67.dirname(cacheFilePath()), { recursive: true });
-    fs60.writeFileSync(cacheFilePath(), JSON.stringify(t2));
+    fs61.mkdirSync(path67.dirname(cacheFilePath()), { recursive: true });
+    fs61.writeFileSync(cacheFilePath(), JSON.stringify(t2));
   } catch {
   }
 }
@@ -208268,7 +208426,7 @@ function changedSubject(total, changed, noun) {
 
 // packages/core/dist/commands/spec-in-process.js
 init_dist8();
-import fs65 from "node:fs";
+import fs66 from "node:fs";
 import path72 from "node:path";
 init_git();
 import { createHash as createHash20, randomUUID as randomUUID27 } from "node:crypto";
@@ -208276,7 +208434,7 @@ import { createHash as createHash20, randomUUID as randomUUID27 } from "node:cry
 // packages/core/dist/lib/verify-store.js
 init_atomic_write();
 init_analysis_store();
-import fs61 from "node:fs";
+import fs62 from "node:fs";
 import path68 from "node:path";
 
 // packages/core/dist/types/verify-snapshot.js
@@ -208375,7 +208533,7 @@ var FileVerifyStore = class {
     const file = verifyLatestPath(repoPath);
     let mtime;
     try {
-      mtime = fs61.statSync(file).mtimeMs;
+      mtime = fs62.statSync(file).mtimeMs;
     } catch (err) {
       if (err.code === "ENOENT") {
         latestCache2.delete(repoPath);
@@ -208386,7 +208544,7 @@ var FileVerifyStore = class {
     const cached = latestCache2.get(repoPath);
     if (cached && cached.mtime === mtime)
       return cached.data;
-    const data = JSON.parse(fs61.readFileSync(file, "utf-8"));
+    const data = JSON.parse(fs62.readFileSync(file, "utf-8"));
     latestCache2.set(repoPath, { mtime, data });
     return data;
   }
@@ -208396,7 +208554,7 @@ var FileVerifyStore = class {
   }
   async deleteVerifyLatest(repoPath) {
     try {
-      fs61.unlinkSync(verifyLatestPath(repoPath));
+      fs62.unlinkSync(verifyLatestPath(repoPath));
     } catch (err) {
       if (err.code !== "ENOENT")
         throw err;
@@ -208410,21 +208568,21 @@ var FileVerifyStore = class {
   }
   async readVerifyRun(repoPath, filename) {
     const file = verifyRunPath(repoPath, filename);
-    if (!fs61.existsSync(file))
+    if (!fs62.existsSync(file))
       return null;
-    return JSON.parse(fs61.readFileSync(file, "utf-8"));
+    return JSON.parse(fs62.readFileSync(file, "utf-8"));
   }
   async listVerifyRuns(repoPath) {
     const dir = runsDir(repoPath);
-    if (!fs61.existsSync(dir))
+    if (!fs62.existsSync(dir))
       return [];
-    return fs61.readdirSync(dir).filter((n) => n.endsWith(".json")).sort();
+    return fs62.readdirSync(dir).filter((n) => n.endsWith(".json")).sort();
   }
   async readVerifyHistory(repoPath) {
     const file = verifyHistoryPath(repoPath);
-    if (!fs61.existsSync(file))
+    if (!fs62.existsSync(file))
       return { runs: [] };
-    return JSON.parse(fs61.readFileSync(file, "utf-8"));
+    return JSON.parse(fs62.readFileSync(file, "utf-8"));
   }
   async appendVerifyHistory(repoPath, entry) {
     const history = await this.readVerifyHistory(repoPath);
@@ -208437,7 +208595,7 @@ var FileVerifyStore = class {
     if (!entry)
       return false;
     try {
-      fs61.unlinkSync(verifyRunPath(repoPath, entry.filename));
+      fs62.unlinkSync(verifyRunPath(repoPath, entry.filename));
     } catch (err) {
       if (err.code !== "ENOENT")
         throw err;
@@ -208459,16 +208617,16 @@ var FileVerifyStore = class {
   }
   async readVerifyDiff(repoPath, scope) {
     const file = verifyDiffPath(repoPath, scope);
-    if (!fs61.existsSync(file))
+    if (!fs62.existsSync(file))
       return null;
-    return JSON.parse(fs61.readFileSync(file, "utf-8"));
+    return JSON.parse(fs62.readFileSync(file, "utf-8"));
   }
   async writeVerifyDiff(repoPath, diff, scope) {
     atomicWriteJson(verifyDiffPath(repoPath, scope), diff);
   }
   async deleteVerifyDiff(repoPath, scope) {
     try {
-      fs61.unlinkSync(verifyDiffPath(repoPath, scope));
+      fs62.unlinkSync(verifyDiffPath(repoPath, scope));
     } catch (err) {
       if (err.code !== "ENOENT")
         throw err;
@@ -208502,7 +208660,7 @@ async function repoRef(repoRoot5, commitOverride) {
 }
 
 // packages/core/dist/lib/contract-store.js
-import fs62 from "node:fs";
+import fs63 from "node:fs";
 import path69 from "node:path";
 var KIND_REL = {
   contracts: [".truecourse", "contracts"],
@@ -208513,7 +208671,7 @@ function countTcFiles(dir) {
   let n = 0;
   let entries;
   try {
-    entries = fs62.readdirSync(dir, { withFileTypes: true });
+    entries = fs63.readdirSync(dir, { withFileTypes: true });
   } catch {
     return 0;
   }
@@ -208530,7 +208688,7 @@ function walkTcRel(dir, excludeInferred) {
   const walk20 = (rel) => {
     let entries;
     try {
-      entries = fs62.readdirSync(path69.join(dir, rel), { withFileTypes: true });
+      entries = fs63.readdirSync(path69.join(dir, rel), { withFileTypes: true });
     } catch {
       return;
     }
@@ -208568,13 +208726,13 @@ var FileContractStore = class {
   }
   async loadContracts(ref, kind) {
     const dir = path69.join(ref.repoKey, ...KIND_REL[kind]);
-    if (!fs62.existsSync(dir))
+    if (!fs63.existsSync(dir))
       return null;
     return { dir, cleanup: async () => {
     } };
   }
   async hasContracts(ref, kind) {
-    return fs62.existsSync(path69.join(ref.repoKey, ...KIND_REL[kind]));
+    return fs63.existsSync(path69.join(ref.repoKey, ...KIND_REL[kind]));
   }
   // The file impl reads the live repo tree, which is whatever is checked out —
   // there is no per-commit history, so `commitSha` is ignored (OSS is latest).
@@ -208583,21 +208741,21 @@ var FileContractStore = class {
   }
   async readContractFile(repoKey, kind, relPath, _commitSha) {
     const dest = safeResolve(path69.join(repoKey, ...KIND_REL[kind]), relPath);
-    if (!dest || !fs62.existsSync(dest) || !fs62.statSync(dest).isFile())
+    if (!dest || !fs63.existsSync(dest) || !fs63.statSync(dest).isFile())
       return null;
-    return fs62.readFileSync(dest, "utf-8");
+    return fs63.readFileSync(dest, "utf-8");
   }
   async putContractFile(ref, kind, relPath, content) {
     const dest = safeResolve(path69.join(ref.repoKey, ...KIND_REL[kind]), relPath);
     if (!dest)
       throw new Error(`[contract-store] unsafe contract path: ${relPath}`);
-    fs62.mkdirSync(path69.dirname(dest), { recursive: true });
-    fs62.writeFileSync(dest, content);
+    fs63.mkdirSync(path69.dirname(dest), { recursive: true });
+    fs63.writeFileSync(dest, content);
   }
   async deleteContractFile(ref, kind, relPath) {
     const dest = safeResolve(path69.join(ref.repoKey, ...KIND_REL[kind]), relPath);
     if (dest)
-      fs62.rmSync(dest, { force: true });
+      fs63.rmSync(dest, { force: true });
   }
   // OSS/local has no workspace concept (mirrors the spec store). Writing throws
   // (fail loud — a caller that reached here is mis-wired); reads are empty so an
@@ -208624,7 +208782,7 @@ var loadWorkspaceContracts = (ref, kind) => active8.loadWorkspaceContracts(ref,
 var contractsMaterializeInPlace = () => active8.materializesInPlace;
 
 // packages/core/dist/lib/spec-store.js
-import fs63 from "node:fs";
+import fs64 from "node:fs";
 import path70 from "node:path";
 function specPath(repoKey, artifact) {
   return path70.join(repoKey, ".truecourse", "specs", `${artifact}.json`);
@@ -208640,18 +208798,18 @@ var FileSpecStore = class {
       throw new Error(PR_DECISIONS_FILE_ERROR);
     }
     const file = specPath(ref.repoKey, artifact);
-    fs63.mkdirSync(path70.dirname(file), { recursive: true });
-    fs63.writeFileSync(file, JSON.stringify(json2, null, 2) + "\n", "utf-8");
+    fs64.mkdirSync(path70.dirname(file), { recursive: true });
+    fs64.writeFileSync(file, JSON.stringify(json2, null, 2) + "\n", "utf-8");
   }
   async loadSpec(ref, artifact) {
     if (artifact === "decisions" && isPrDecisionsRef(ref.commitSha)) {
       throw new Error(PR_DECISIONS_FILE_ERROR);
     }
     const file = specPath(ref.repoKey, artifact);
-    if (!fs63.existsSync(file))
+    if (!fs64.existsSync(file))
       return null;
     try {
-      return JSON.parse(fs63.readFileSync(file, "utf-8"));
+      return JSON.parse(fs64.readFileSync(file, "utf-8"));
     } catch {
       return null;
     }
@@ -208661,8 +208819,8 @@ var FileSpecStore = class {
       throw new Error(PR_DECISIONS_FILE_ERROR);
     }
     const file = specPath(ref.repoKey, artifact);
-    if (fs63.existsSync(file))
-      fs63.rmSync(file);
+    if (fs64.existsSync(file))
+      fs64.rmSync(file);
   }
   // The file impl is single-document-per-repo, so "latest" === read the file.
   async loadLatest(repoKey, artifact) {
@@ -208689,7 +208847,7 @@ var loadLatestSpec = (repoKey, artifact) => active9.loadLatest(repoKey, artifact
 var specsMaterializeInPlace = () => active9.materializesInPlace;
 
 // packages/core/dist/lib/inferred-action-store.js
-import fs64 from "node:fs";
+import fs65 from "node:fs";
 import path71 from "node:path";
 function actionsFile(repoKey) {
   return path71.join(repoKey, ".truecourse", "specs", "inferred-actions.json");
@@ -208697,15 +208855,15 @@ function actionsFile(repoKey) {
 var FileInferredActionStore = class {
   read(repoKey) {
     try {
-      return JSON.parse(fs64.readFileSync(actionsFile(repoKey), "utf-8"));
+      return JSON.parse(fs65.readFileSync(actionsFile(repoKey), "utf-8"));
     } catch {
       return [];
     }
   }
   write(repoKey, actions) {
     const file = actionsFile(repoKey);
-    fs64.mkdirSync(path71.dirname(file), { recursive: true });
-    fs64.writeFileSync(file, JSON.stringify(actions, null, 2) + "\n", "utf-8");
+    fs65.mkdirSync(path71.dirname(file), { recursive: true });
+    fs65.writeFileSync(file, JSON.stringify(actions, null, 2) + "\n", "utf-8");
   }
   async setAction(repoKey, action) {
     const next = this.read(repoKey).filter((a) => !(a.kind === action.kind && a.identity === action.identity));
@@ -208840,7 +208998,7 @@ function generatedMarkerPath(repoRoot5) {
 }
 function stampGeneratedMarker(repoRoot5, summary) {
   const file = generatedMarkerPath(repoRoot5);
-  fs65.mkdirSync(path72.dirname(file), { recursive: true });
+  fs66.mkdirSync(path72.dirname(file), { recursive: true });
   const body = {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     written: summary?.written ?? 0,
@@ -208848,7 +209006,7 @@ function stampGeneratedMarker(repoRoot5, summary) {
     validationIssues: summary?.validationIssues ?? [],
     enumerateFailures: summary?.enumerateFailures ?? []
   };
-  fs65.writeFileSync(file, JSON.stringify(body, null, 2) + "\n");
+  fs66.writeFileSync(file, JSON.stringify(body, null, 2) + "\n");
 }
 function resolveCurateModels(repoRoot5) {
   return {
@@ -208973,19 +209131,19 @@ async function curateInProcess(repoRoot5, options = {}) {
 }
 function buildPriorContracts(repoRoot5) {
   const dir = path72.join(repoRoot5, ".truecourse", "contracts");
-  if (!fs65.existsSync(dir))
+  if (!fs66.existsSync(dir))
     return void 0;
   const targets = [];
   const bodyByKey = /* @__PURE__ */ new Map();
   const walk20 = (d3) => {
-    for (const e of fs65.readdirSync(d3, { withFileTypes: true })) {
+    for (const e of fs66.readdirSync(d3, { withFileTypes: true })) {
       if (e.isDirectory()) {
         if (e.name === "_inferred")
           continue;
         walk20(path72.join(d3, e.name));
       } else if (e.name.endsWith(".tc")) {
         const abs = path72.join(d3, e.name);
-        const src = fs65.readFileSync(abs, "utf-8");
+        const src = fs66.readFileSync(abs, "utf-8");
         try {
           const file = parser_ohm_exports.parseTcFile(path72.relative(dir, abs), src);
           for (const key4 of resolver_exports.resolve([file]).index.keys()) {
@@ -209158,7 +209316,7 @@ async function withContracts(repoRoot5, options, tracker, fn) {
   try {
     let recorded;
     if (options.contractsDir) {
-      if (!fs65.existsSync(options.contractsDir)) {
+      if (!fs66.existsSync(options.contractsDir)) {
         const err = new Error(`Contracts directory not found at ${options.contractsDir}. Run \`truecourse contracts generate\` first.`);
         tracker?.error("load", err.message);
         throw err;
@@ -209247,7 +209405,7 @@ async function verifyInProcess(repoRoot5, options = {}) {
         bySeverity: summary.bySeverity
       });
       await deleteVerifyDiff(storeKey);
-      fs65.rmSync(legacyVerifyStatePath(repoRoot5), { force: true });
+      fs66.rmSync(legacyVerifyStatePath(repoRoot5), { force: true });
     }
     const state = {
       verifiedAt,
@@ -209465,7 +209623,7 @@ async function persistInferred(repoRoot5, options, contractsDir, codeDir, starte
 }
 function autodetectCodeDir(repoRoot5) {
   const codeSubdir = path72.join(repoRoot5, "code");
-  if (fs65.existsSync(codeSubdir) && fs65.statSync(codeSubdir).isDirectory()) {
+  if (fs66.existsSync(codeSubdir) && fs66.statSync(codeSubdir).isDirectory()) {
     return codeSubdir;
   }
   return repoRoot5;
@@ -209786,7 +209944,7 @@ async function runContractsGenerate(options = {}) {
 async function runContractsList(options = {}) {
   const repoRoot5 = options.cwd ?? process.cwd();
   const contractsDir = path73.join(repoRoot5, ".truecourse", "contracts");
-  if (!fs66.existsSync(contractsDir)) {
+  if (!fs67.existsSync(contractsDir)) {
     O2.info("No contracts found. Run `truecourse contracts generate` first.");
     return;
   }
@@ -209794,12 +209952,12 @@ async function runContractsList(options = {}) {
   const fileNodes = [];
   let parseErrors = 0;
   const visit = (dir) => {
-    for (const entry of fs66.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs67.readdirSync(dir, { withFileTypes: true })) {
       const full = path73.join(dir, entry.name);
       if (entry.isDirectory()) visit(full);
       else if (entry.isFile() && entry.name.endsWith(".tc")) {
         try {
-          fileNodes.push(parserOhm.parseTcFile(full, fs66.readFileSync(full, "utf-8")));
+          fileNodes.push(parserOhm.parseTcFile(full, fs67.readFileSync(full, "utf-8")));
         } catch {
           parseErrors += 1;
         }
@@ -209839,7 +209997,7 @@ async function runContractsList(options = {}) {
 async function runContractsValidate(options = {}) {
   const repoRoot5 = options.cwd ?? process.cwd();
   const contractsDir = path73.join(repoRoot5, ".truecourse", "contracts");
-  if (!fs66.existsSync(contractsDir)) {
+  if (!fs67.existsSync(contractsDir)) {
     O2.error("No .truecourse/contracts/ directory found.");
     process.exit(1);
   }
@@ -209847,12 +210005,12 @@ async function runContractsValidate(options = {}) {
   const fileNodes = [];
   const issues = [];
   const visit = (dir) => {
-    for (const entry of fs66.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs67.readdirSync(dir, { withFileTypes: true })) {
       const full = path73.join(dir, entry.name);
       if (entry.isDirectory()) visit(full);
       else if (entry.isFile() && entry.name.endsWith(".tc")) {
         try {
-          fileNodes.push(parserOhm.parseTcFile(full, fs66.readFileSync(full, "utf-8")));
+          fileNodes.push(parserOhm.parseTcFile(full, fs67.readFileSync(full, "utf-8")));
         } catch (e) {
           issues.push(`${path73.relative(repoRoot5, full)}: parse error: ${e instanceof Error ? e.message : e}`);
         }
@@ -210095,7 +210253,7 @@ async function runInfer(opts = {}) {
 
 // tools/cli/src/commands/spec-conflicts.ts
 init_dist4();
-import fs67 from "node:fs";
+import fs68 from "node:fs";
 import path75 from "node:path";
 var root = (opts) => opts.cwd ?? process.cwd();
 var base = (ref) => ref.split("/").pop() ?? ref;
@@ -210143,7 +210301,7 @@ async function runSpecConflictsList(opts = {}) {
 function excerpt(repoRoot5, ref, note, max = 20) {
   let text4;
   try {
-    text4 = fs67.readFileSync(path75.join(repoRoot5, ref), "utf-8");
+    text4 = fs68.readFileSync(path75.join(repoRoot5, ref), "utf-8");
   } catch {
     return `    (could not read ${ref})`;
   }
@@ -210855,6 +211013,11 @@ function printGuardGenerateSummary(report4, reportPath) {
   O2.step(`sections    ${report4.sectionsChanged} changed \xB7 ${settled} settled \xB7 ${unsettled.size} unsettled \xB7 ${report4.skippedUnchanged} unchanged`);
   const birth = g.birthPassed !== null ? ` \xB7 ${g.birthPassed} passed birth` : "";
   O2.step(`scenarios   ${g.written} written${birth}`);
+  if (g.readyButHeld > 0) {
+    O2.step(
+      `held        ${g.readyButHeld} ready but held (${g.heldByFindings} finding${g.heldByFindings === 1 ? "" : "s"} \xB7 ${g.heldByErrors} error${g.heldByErrors === 1 ? "" : "s"})`
+    );
+  }
   const gapTotal = Object.values(g.coverageGapsByKind).reduce((a, b) => a + b, 0);
   if (gapTotal > 0) {
     const kinds = Object.entries(g.coverageGapsByKind).filter(([, n]) => n > 0).map(([k, n]) => k === "blocked-on" ? `${n} blocked-on${blockedOnBreakdown(g.blockedOnCapabilities)}` : `${n} ${k}`);
@@ -210866,6 +211029,10 @@ function printGuardGenerateSummary(report4, reportPath) {
   if (report4.extractionFailures.length > 0) {
     O2.step(`extraction  ${report4.extractionFailures.length} document${report4.extractionFailures.length === 1 ? "" : "s"} failed \u2014 re-run to retry`);
   }
+  if (report4.orphanedDismissals && report4.orphanedDismissals.length > 0) {
+    const n = report4.orphanedDismissals.length;
+    O2.step(`dismissals  ${n} orphaned \u2014 the dismissed claim no longer exists; re-dismiss the new text or drop it from decisions.json`);
+  }
   if (g.birthFindings > 0) O2.step(`findings    ${g.birthFindings} birth finding${g.birthFindings === 1 ? "" : "s"}`);
   if (g.errors > 0) O2.step(`errors      ${g.errors} authoring error${g.errors === 1 ? "" : "s"}`);
   if (g.usage) O2.step(`cost        ${g.usage.calls} call${g.usage.calls === 1 ? "" : "s"} \xB7 $${g.usage.costUsd.toFixed(2)}`);
@@ -210945,6 +211112,7 @@ async function runGuardStatus(opts = {}) {
         const kinds = Object.entries(g.coverageGapsByKind).filter(([, n]) => n > 0).map(([k, n]) => k === "blocked-on" ? `${n} blocked-on${blockedOnBreakdown(g.blockedOnCapabilities)}` : `${n} ${k}`);
         detail.push(`${gapTotal} gap${gapTotal === 1 ? "" : "s"} (${kinds.join(", ")})`);
       }
+      if (g.readyButHeld > 0) detail.push(`${g.readyButHeld} ready but held`);
       if (g.birthFindings > 0) detail.push(`${g.birthFindings} birth finding${g.birthFindings === 1 ? "" : "s"}`);
       if (g.errors > 0) detail.push(`${g.errors} error${g.errors === 1 ? "" : "s"}`);
       if (detail.length > 0) O2.message(`    ${detail.join(" \xB7 ")}`);
@@ -211081,7 +211249,7 @@ async function runConfigLlmShow(options = {}) {
 
 // tools/cli/src/commands/hooks.ts
 import { execSync as execSync4 } from "node:child_process";
-import fs68 from "node:fs";
+import fs69 from "node:fs";
 import path79 from "node:path";
 init_dist4();
 init_paths();
@@ -211117,11 +211285,11 @@ function findGitDir(from) {
   let dir = from;
   while (true) {
     const gitPath = path79.join(dir, ".git");
-    if (fs68.existsSync(gitPath)) {
-      const stat = fs68.statSync(gitPath);
+    if (fs69.existsSync(gitPath)) {
+      const stat = fs69.statSync(gitPath);
       if (stat.isDirectory()) return gitPath;
       if (stat.isFile()) {
-        const content = fs68.readFileSync(gitPath, "utf-8").trim();
+        const content = fs69.readFileSync(gitPath, "utf-8").trim();
         const match4 = content.match(/^gitdir:\s*(.+)$/);
         if (match4) return path79.resolve(dir, match4[1]);
       }
@@ -211134,7 +211302,7 @@ function findGitDir(from) {
 function findProjectRoot(from) {
   let dir = from;
   while (true) {
-    if (fs68.existsSync(path79.join(dir, ".git"))) return dir;
+    if (fs69.existsSync(path79.join(dir, ".git"))) return dir;
     const parent = path79.dirname(dir);
     if (parent === dir) return null;
     dir = parent;
@@ -211142,10 +211310,10 @@ function findProjectRoot(from) {
 }
 function loadConfig(projectRoot) {
   const configPath = path79.join(projectRoot, ".truecourse", "hooks.yaml");
-  if (!fs68.existsSync(configPath)) return null;
+  if (!fs69.existsSync(configPath)) return null;
   let parsed;
   try {
-    const raw = fs68.readFileSync(configPath, "utf-8");
+    const raw = fs69.readFileSync(configPath, "utf-8");
     parsed = jsYaml.load(raw) || {};
   } catch (err) {
     console.error(`Error parsing ${configPath}: ${err.message}`);
@@ -211197,10 +211365,10 @@ async function runHooksInstall() {
     console.log(INSTALL_WARNING);
   }
   const hooksDir = path79.join(gitDir, "hooks");
-  fs68.mkdirSync(hooksDir, { recursive: true });
+  fs69.mkdirSync(hooksDir, { recursive: true });
   const hookPath = path79.join(hooksDir, "pre-commit");
-  if (fs68.existsSync(hookPath)) {
-    const existing = fs68.readFileSync(hookPath, "utf-8");
+  if (fs69.existsSync(hookPath)) {
+    const existing = fs69.readFileSync(hookPath, "utf-8");
     if (!existing.includes(HOOK_IDENTIFIER)) {
       console.error(
         "Error: A pre-commit hook already exists and was not installed by TrueCourse."
@@ -211210,16 +211378,16 @@ async function runHooksInstall() {
       process.exit(1);
     }
   }
-  fs68.writeFileSync(hookPath, HOOK_SCRIPT, { mode: 493 });
+  fs69.writeFileSync(hookPath, HOOK_SCRIPT, { mode: 493 });
   console.log("TrueCourse pre-commit hook installed.");
   console.log(`  ${hookPath}`);
   const projectRoot = findProjectRoot(process.cwd());
   if (projectRoot) {
     const cfgDir = path79.join(projectRoot, ".truecourse");
     const cfgPath = path79.join(cfgDir, "hooks.yaml");
-    if (!fs68.existsSync(cfgPath)) {
-      fs68.mkdirSync(cfgDir, { recursive: true });
-      fs68.writeFileSync(cfgPath, HOOKS_YAML_TEMPLATE);
+    if (!fs69.existsSync(cfgPath)) {
+      fs69.mkdirSync(cfgDir, { recursive: true });
+      fs69.writeFileSync(cfgPath, HOOKS_YAML_TEMPLATE);
       console.log(`  ${cfgPath} (starter config \u2014 edit to customize, commit to share with the team)`);
     }
   }
@@ -211231,16 +211399,16 @@ function runHooksUninstall() {
     process.exit(1);
   }
   const hookPath = path79.join(gitDir, "hooks", "pre-commit");
-  if (!fs68.existsSync(hookPath)) {
+  if (!fs69.existsSync(hookPath)) {
     console.log("No pre-commit hook installed.");
     return;
   }
-  const content = fs68.readFileSync(hookPath, "utf-8");
+  const content = fs69.readFileSync(hookPath, "utf-8");
   if (!content.includes(HOOK_IDENTIFIER)) {
     console.error("Error: The pre-commit hook was not installed by TrueCourse. Leaving it in place.");
     process.exit(1);
   }
-  fs68.unlinkSync(hookPath);
+  fs69.unlinkSync(hookPath);
   console.log("TrueCourse pre-commit hook removed.");
 }
 function runHooksStatus() {
@@ -211250,7 +211418,7 @@ function runHooksStatus() {
     process.exit(1);
   }
   const hookPath = path79.join(gitDir, "hooks", "pre-commit");
-  const installed = fs68.existsSync(hookPath) && fs68.readFileSync(hookPath, "utf-8").includes(HOOK_IDENTIFIER);
+  const installed = fs69.existsSync(hookPath) && fs69.readFileSync(hookPath, "utf-8").includes(HOOK_IDENTIFIER);
   if (installed) {
     console.log("TrueCourse pre-commit hook: installed");
     console.log(`  ${hookPath}`);
@@ -211359,7 +211527,7 @@ async function runHooksRun() {
 
 // tools/cli/src/index.ts
 var program2 = new Command();
-program2.name("truecourse").version("0.7.0-next.3").description("TrueCourse CLI \u2014 analyze your repository and open the dashboard");
+program2.name("truecourse").version("0.7.0-next.4").description("TrueCourse CLI \u2014 analyze your repository and open the dashboard");
 var dashboardCmd = program2.command("dashboard").description("Start the TrueCourse dashboard and open it in your browser").option("--reconfigure", "Re-prompt for console vs background service mode").option("--service", "Run as a background service (skips mode prompt)").option("--console", "Run in this terminal (skips mode prompt)").action(async (options) => {
   if (options.service && options.console) {
     console.error("error: --service and --console are mutually exclusive");