truecourse 0.7.0-next.3 → 0.7.0-next.4

package/server.mjs

@@ -109,7 +109,7 @@ var require_package = __commonJS({
 // node_modules/.pnpm/dotenv@16.6.1/node_modules/dotenv/lib/main.js
 var require_main = __commonJS({
   "node_modules/.pnpm/dotenv@16.6.1/node_modules/dotenv/lib/main.js"(exports, module) {
-    var fs66 = __require("fs");
+    var fs67 = __require("fs");
     var path74 = __require("path");
     var os10 = __require("os");
     var crypto6 = __require("crypto");
@@ -218,7 +218,7 @@ var require_main = __commonJS({
       if (options && options.path && options.path.length > 0) {
         if (Array.isArray(options.path)) {
           for (const filepath of options.path) {
-            if (fs66.existsSync(filepath)) {
+            if (fs67.existsSync(filepath)) {
               possibleVaultPath = filepath.endsWith(".vault") ? filepath : `${filepath}.vault`;
             }
           }
@@ -228,7 +228,7 @@ var require_main = __commonJS({
       } else {
         possibleVaultPath = path74.resolve(process.cwd(), ".env.vault");
       }
-      if (fs66.existsSync(possibleVaultPath)) {
+      if (fs67.existsSync(possibleVaultPath)) {
         return possibleVaultPath;
       }
       return null;
@@ -277,7 +277,7 @@ var require_main = __commonJS({
       const parsedAll = {};
       for (const path75 of optionPaths) {
         try {
-          const parsed = DotenvModule.parse(fs66.readFileSync(path75, { encoding }));
+          const parsed = DotenvModule.parse(fs67.readFileSync(path75, { encoding }));
           DotenvModule.populate(parsedAll, parsed, options);
         } catch (e) {
           if (debug2) {
@@ -28079,7 +28079,7 @@ function parseBlockedOnCapabilities(reason) {
     return [];
   return m[1].split(",").map((s) => s.trim()).filter(Boolean);
 }
-var GuardWrittenScenarioSchema, GuardCoverageGapKindSchema, GuardCoverageGapSchema, GuardBirthFindingSchema, GuardGenerateErrorSchema, GuardEntryPreflightSchema, GuardExtractionFailureSchema, GuardOrphanedSectionSchema, GuardRecipeReportSchema, GuardGenerateUsageSchema, GuardGenerateReportSchema;
+var GuardWrittenScenarioSchema, GuardCoverageGapKindSchema, GuardCoverageGapSchema, GuardBirthFindingSchema, GuardGenerateErrorSchema, GuardReadyScenarioSchema, GuardHeldSectionSchema, GuardEntryPreflightSchema, GuardExtractionFailureSchema, GuardOrphanedDismissalSchema, GuardOrphanedSectionSchema, GuardRecipeReportSchema, GuardGenerateUsageSchema, GuardGenerateReportSchema;
 var init_report = __esm({
   "packages/shared/dist/guard/report.js"() {
     "use strict";
@@ -28097,7 +28097,8 @@ var init_report = __esm({
       "awaiting-driver",
       "untestable",
       "no-claim",
-      "blocked-on"
+      "blocked-on",
+      "dismissed"
     ]);
     GuardCoverageGapSchema = external_exports.object({
       doc: external_exports.string(),
@@ -28119,6 +28120,22 @@ var init_report = __esm({
       actual: external_exports.string(),
       /** Repo-relative pointer into `guard/evidence/`, when a transcript was written. */
       evidencePath: external_exports.string().optional(),
+      /**
+       * The failed candidate's authored YAML, serialized inline AT FINDING CREATION
+       * (same serialize-at-creation as heldSections' readyScenarios). The finding
+       * detail renders it in the scenario-source code block so the user can judge
+       * "defect or drift" with the exact commands the scenario ran on-screen.
+       * Optional so older `result.json` files keep parsing.
+       */
+      yaml: external_exports.string().optional(),
+      /**
+       * The EXTRACTED CLAIM's stable text — the claim identity a dismissal keys on
+       * (anchor + this). The finding detail's Dismiss action writes it into
+       * `scenarios/decisions.json`; generate then skips a matching claim before
+       * authoring. Distinct from `title` (the scenario title). Optional so older
+       * reports (and the internal retry-evidence findings) parse.
+       */
+      claim: external_exports.string().optional(),
       /**
        * The bound section's human heading, joined SERVER-SIDE at report read time
        * (never written to `result.json` — the enrichment is read-side). A finding's
@@ -28132,6 +28149,18 @@ var init_report = __esm({
       anchor: external_exports.string(),
       message: external_exports.string()
     }).strict();
+    GuardReadyScenarioSchema = external_exports.object({
+      id: external_exports.string(),
+      title: external_exports.string(),
+      /** The committed YAML the scenario would have been written as. */
+      yaml: external_exports.string()
+    }).strict();
+    GuardHeldSectionSchema = external_exports.object({
+      doc: external_exports.string(),
+      anchor: external_exports.string(),
+      headingText: external_exports.string().optional(),
+      readyScenarios: external_exports.array(GuardReadyScenarioSchema)
+    }).strict();
     GuardEntryPreflightSchema = external_exports.object({
       /** Display form of the entry argv, e.g. `node tools/cli/dist/index.js`. */
       entry: external_exports.string(),
@@ -28144,6 +28173,11 @@ var init_report = __esm({
       doc: external_exports.string(),
       reason: external_exports.string()
     }).strict();
+    GuardOrphanedDismissalSchema = external_exports.object({
+      doc: external_exports.string(),
+      anchor: external_exports.string(),
+      title: external_exports.string()
+    }).strict();
     GuardOrphanedSectionSchema = external_exports.object({
       doc: external_exports.string(),
       anchor: external_exports.string(),
@@ -28184,6 +28218,19 @@ var init_report = __esm({
        * `written.length` when a passing scenario's section didn't settle.
        */
       birthPassed: external_exports.number().int().nonnegative().optional(),
+      /**
+       * Unsettled sections whose birth-passed candidates were withheld — the
+       * ready-but-held scenarios, each carrying its authored YAML inline. Optional so
+       * older reports (written before this field existed) keep parsing; absent reads
+       * as "no held work".
+       */
+      heldSections: external_exports.array(GuardHeldSectionSchema).optional(),
+      /**
+       * Dismissals whose claim text matched nothing in a doc this run re-extracted —
+       * stale entries in `scenarios/decisions.json`, surfaced (never silently
+       * honored). Optional so older reports parse; absent reads as "none".
+       */
+      orphanedDismissals: external_exports.array(GuardOrphanedDismissalSchema).optional(),
       manifestPath: external_exports.string().optional(),
       usage: GuardGenerateUsageSchema.optional(),
       /**
@@ -28234,6 +28281,35 @@ var init_manifest = __esm({
   }
 });
 
+// packages/shared/dist/guard/decisions.js
+function dismissedClaimKey(doc, anchor, title) {
+  return `${doc}\0${anchor}\0${title}`;
+}
+var GuardDismissedClaimSchema, GuardDecisionsSchema, EMPTY_GUARD_DECISIONS;
+var init_decisions = __esm({
+  "packages/shared/dist/guard/decisions.js"() {
+    "use strict";
+    init_zod();
+    GuardDismissedClaimSchema = external_exports.object({
+      /** Repo-relative doc path the claim's section lives in. */
+      doc: external_exports.string().min(1),
+      /** The section anchor (slug) the claim was extracted under. */
+      anchor: external_exports.string().min(1),
+      /** The extracted claim's stable text — the identity, with `anchor`. */
+      title: external_exports.string().min(1),
+      /** ISO timestamp the dismissal was recorded. */
+      dismissedAt: external_exports.string(),
+      /** Optional free-text rationale ("flaky", "won't fix", …). */
+      note: external_exports.string().optional()
+    });
+    GuardDecisionsSchema = external_exports.object({
+      version: external_exports.literal(1),
+      dismissedClaims: external_exports.array(GuardDismissedClaimSchema).default([])
+    });
+    EMPTY_GUARD_DECISIONS = { version: 1, dismissedClaims: [] };
+  }
+});
+
 // packages/shared/dist/guard/dashboard.js
 var init_dashboard = __esm({
   "packages/shared/dist/guard/dashboard.js"() {
@@ -28284,6 +28360,11 @@ function summarizeGenerate(r) {
       }
     }
   }
+  const heldSections = r.heldSections ?? [];
+  const heldKeys = new Set(heldSections.map((h) => `${h.doc}\0${h.anchor}`));
+  const readyButHeld = heldSections.reduce((n, h) => n + h.readyScenarios.length, 0);
+  const heldByFindings = r.birthFindings.filter((f2) => heldKeys.has(`${f2.doc}\0${f2.anchor}`)).length;
+  const heldByErrors = r.errors.filter((e) => heldKeys.has(`${e.doc}\0${e.anchor}`)).length;
   return {
     generatedAt: r.generatedAt,
     status: r.status,
@@ -28294,6 +28375,9 @@ function summarizeGenerate(r) {
     blockedOnCapabilities,
     birthFindings: r.birthFindings.length,
     errors: r.errors.length,
+    readyButHeld,
+    heldByFindings,
+    heldByErrors,
     ...r.usage ? { usage: r.usage } : {}
   };
 }
@@ -28314,6 +28398,7 @@ var init_guard = __esm({
     init_result();
     init_report();
     init_manifest();
+    init_decisions();
     init_dashboard();
     init_summary();
   }
@@ -30177,8 +30262,8 @@ var require_node2 = __commonJS({
           }
           break;
         case "FILE":
-          var fs66 = __require("fs");
-          stream2 = new fs66.SyncWriteStream(fd2, { autoClose: false });
+          var fs67 = __require("fs");
+          stream2 = new fs67.SyncWriteStream(fd2, { autoClose: false });
           stream2._type = "fs";
           break;
         case "PIPE":
@@ -38666,7 +38751,7 @@ var require_view = __commonJS({
     "use strict";
     var debug2 = require_src2()("express:view");
     var path74 = __require("path");
-    var fs66 = __require("fs");
+    var fs67 = __require("fs");
     var dirname10 = path74.dirname;
     var basename2 = path74.basename;
     var extname = path74.extname;
@@ -38732,7 +38817,7 @@ var require_view = __commonJS({
     function tryStat(path75) {
       debug2('stat "%s"', path75);
       try {
-        return fs66.statSync(path75);
+        return fs67.statSync(path75);
       } catch (e) {
         return void 0;
       }
@@ -39087,7 +39172,7 @@ var require_types = __commonJS({
 var require_mime = __commonJS({
   "node_modules/.pnpm/mime@1.6.0/node_modules/mime/mime.js"(exports, module) {
     var path74 = __require("path");
-    var fs66 = __require("fs");
+    var fs67 = __require("fs");
     function Mime() {
       this.types = /* @__PURE__ */ Object.create(null);
       this.extensions = /* @__PURE__ */ Object.create(null);
@@ -39108,7 +39193,7 @@ var require_mime = __commonJS({
     };
     Mime.prototype.load = function(file) {
       this._loading = file;
-      var map2 = {}, content = fs66.readFileSync(file, "ascii"), lines = content.split(/[\r\n]+/);
+      var map2 = {}, content = fs67.readFileSync(file, "ascii"), lines = content.split(/[\r\n]+/);
       lines.forEach(function(line) {
         var fields = line.replace(/\s*#.*|^\s*|\s*$/g, "").split(/\s+/);
         map2[fields.shift()] = fields;
@@ -39230,7 +39315,7 @@ var require_send = __commonJS({
     var escapeHtml = require_escape_html();
     var etag = require_etag();
     var fresh = require_fresh();
-    var fs66 = __require("fs");
+    var fs67 = __require("fs");
     var mime = require_mime();
     var ms = require_ms();
     var onFinished = require_on_finished();
@@ -39563,7 +39648,7 @@ var require_send = __commonJS({
       var i = 0;
       var self2 = this;
       debug2('stat "%s"', path75);
-      fs66.stat(path75, function onstat(err, stat) {
+      fs67.stat(path75, function onstat(err, stat) {
         if (err && err.code === "ENOENT" && !extname(path75) && path75[path75.length - 1] !== sep3) {
           return next(err);
         }
@@ -39578,7 +39663,7 @@ var require_send = __commonJS({
         }
         var p = path75 + "." + self2._extensions[i++];
         debug2('stat "%s"', p);
-        fs66.stat(p, function(err2, stat) {
+        fs67.stat(p, function(err2, stat) {
           if (err2) return next(err2);
           if (stat.isDirectory()) return next();
           self2.emit("file", p, stat);
@@ -39596,7 +39681,7 @@ var require_send = __commonJS({
         }
         var p = join11(path75, self2._index[i]);
         debug2('stat "%s"', p);
-        fs66.stat(p, function(err2, stat) {
+        fs67.stat(p, function(err2, stat) {
           if (err2) return next(err2);
           if (stat.isDirectory()) return next();
           self2.emit("file", p, stat);
@@ -39608,7 +39693,7 @@ var require_send = __commonJS({
     SendStream.prototype.stream = function stream(path75, options) {
       var self2 = this;
       var res = this.res;
-      var stream2 = fs66.createReadStream(path75, options);
+      var stream2 = fs67.createReadStream(path75, options);
       this.emit("stream", stream2);
       stream2.pipe(res);
       function cleanup() {
@@ -43603,7 +43688,7 @@ var init_guardrail = __esm({
 // packages/shared/dist/llm/transport.js
 import { spawn as spawn4 } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
-import fs25 from "node:fs";
+import fs26 from "node:fs";
 import path24 from "node:path";
 import { StringDecoder } from "node:string_decoder";
 function resetStageUsage() {
@@ -44006,15 +44091,15 @@ function cliTransport(opts = {}) {
 function agentTransport(ioDir, opts = {}) {
   const reqDir = path24.join(ioDir, "requests");
   const resDir = path24.join(ioDir, "responses");
-  fs25.mkdirSync(reqDir, { recursive: true });
-  fs25.mkdirSync(resDir, { recursive: true });
+  fs26.mkdirSync(reqDir, { recursive: true });
+  fs26.mkdirSync(resDir, { recursive: true });
   const pollMs = opts.pollMs ?? 200;
   const defaultTimeout = opts.defaultTimeoutMs ?? 6e5;
   return async (req) => {
     const id = sanitizeId(req.id ?? deriveId(req));
     const reqPath = path24.join(reqDir, `${id}.json`);
     const resPath = path24.join(resDir, `${id}.json`);
-    if (!fs25.existsSync(resPath)) {
+    if (!fs26.existsSync(resPath)) {
       atomicWrite(reqPath, JSON.stringify({
         id,
         stage: req.stage,
@@ -44028,10 +44113,10 @@ function agentTransport(ioDir, opts = {}) {
     }
     const deadline = Date.now() + (req.timeoutMs ?? defaultTimeout) * resolveTimeoutScale();
     for (; ; ) {
-      if (fs25.existsSync(resPath)) {
+      if (fs26.existsSync(resPath)) {
         let parsed;
         try {
-          parsed = JSON.parse(fs25.readFileSync(resPath, "utf-8"));
+          parsed = JSON.parse(fs26.readFileSync(resPath, "utf-8"));
         } catch {
           await sleep(pollMs);
           continue;
@@ -44057,8 +44142,8 @@ function sanitizeId(id) {
 }
 function atomicWrite(filePath, data) {
   const tmp = `${filePath}.tmp-${randomUUID()}`;
-  fs25.writeFileSync(tmp, data);
-  fs25.renameSync(tmp, filePath);
+  fs26.writeFileSync(tmp, data);
+  fs26.renameSync(tmp, filePath);
 }
 function sleep(ms) {
   return new Promise((r) => setTimeout(r, ms));
@@ -44545,10 +44630,10 @@ import { Parser, Language } from "web-tree-sitter";
 import { createRequire as _createRequire } from "node:module";
 import { fileURLToPath } from "node:url";
 import path29 from "node:path";
-import fs32 from "node:fs";
+import fs33 from "node:fs";
 function resolveWasmPath(subpath) {
   const bundled = path29.join(BUNDLED_WASM_DIR, path29.basename(subpath));
-  if (fs32.existsSync(bundled))
+  if (fs33.existsSync(bundled))
     return bundled;
   return _require.resolve(subpath);
 }
@@ -172378,7 +172463,7 @@ var require_form_data = __commonJS({
     var http = __require("http");
     var https = __require("https");
     var parseUrl = __require("url").parse;
-    var fs66 = __require("fs");
+    var fs67 = __require("fs");
     var Stream = __require("stream").Stream;
     var crypto6 = __require("crypto");
     var mime = require_mime_types();
@@ -172445,7 +172530,7 @@ var require_form_data = __commonJS({
         if (value.end != void 0 && value.end != Infinity && value.start != void 0) {
           callback(null, value.end + 1 - (value.start ? value.start : 0));
         } else {
-          fs66.stat(value.path, function(err, stat) {
+          fs67.stat(value.path, function(err, stat) {
             if (err) {
               callback(err);
               return;
@@ -176758,7 +176843,7 @@ var require_windows = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/windows.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
-    var fs66 = __require("fs");
+    var fs67 = __require("fs");
     function checkPathExt(path74, options) {
       var pathext = options.pathExt !== void 0 ? options.pathExt : process.env.PATHEXT;
       if (!pathext) {
@@ -176783,12 +176868,12 @@ var require_windows = __commonJS({
       return checkPathExt(path74, options);
     }
     function isexe(path74, options, cb) {
-      fs66.stat(path74, function(er, stat) {
+      fs67.stat(path74, function(er, stat) {
         cb(er, er ? false : checkStat(stat, path74, options));
       });
     }
     function sync(path74, options) {
-      return checkStat(fs66.statSync(path74), path74, options);
+      return checkStat(fs67.statSync(path74), path74, options);
     }
   }
 });
@@ -176798,14 +176883,14 @@ var require_mode = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/mode.js"(exports, module) {
     module.exports = isexe;
     isexe.sync = sync;
-    var fs66 = __require("fs");
+    var fs67 = __require("fs");
     function isexe(path74, options, cb) {
-      fs66.stat(path74, function(er, stat) {
+      fs67.stat(path74, function(er, stat) {
         cb(er, er ? false : checkStat(stat, options));
       });
     }
     function sync(path74, options) {
-      return checkStat(fs66.statSync(path74), options);
+      return checkStat(fs67.statSync(path74), options);
     }
     function checkStat(stat, options) {
       return stat.isFile() && checkMode(stat, options);
@@ -176829,7 +176914,7 @@ var require_mode = __commonJS({
 // node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js
 var require_isexe = __commonJS({
   "node_modules/.pnpm/isexe@2.0.0/node_modules/isexe/index.js"(exports, module) {
-    var fs66 = __require("fs");
+    var fs67 = __require("fs");
     var core2;
     if (process.platform === "win32" || global.TESTING_WINDOWS) {
       core2 = require_windows();
@@ -177093,16 +177178,16 @@ var require_shebang_command = __commonJS({
 var require_readShebang = __commonJS({
   "node_modules/.pnpm/cross-spawn@7.0.6/node_modules/cross-spawn/lib/util/readShebang.js"(exports, module) {
     "use strict";
-    var fs66 = __require("fs");
+    var fs67 = __require("fs");
     var shebangCommand = require_shebang_command();
     function readShebang(command) {
       const size = 150;
       const buffer = Buffer.alloc(size);
       let fd;
       try {
-        fd = fs66.openSync(command, "r");
-        fs66.readSync(fd, buffer, 0, size, 0);
-        fs66.closeSync(fd);
+        fd = fs67.openSync(command, "r");
+        fs67.readSync(fd, buffer, 0, size, 0);
+        fs67.closeSync(fd);
       } catch (e) {
       }
       return shebangCommand(buffer.toString());
@@ -186683,7 +186768,7 @@ function getIO() {
 // apps/dashboard/server/src/app.ts
 var import_express16 = __toESM(require_express2(), 1);
 var import_cors = __toESM(require_lib(), 1);
-import fs65 from "node:fs";
+import fs66 from "node:fs";
 import { fileURLToPath as fileURLToPath6 } from "node:url";
 import path72 from "node:path";
 
@@ -186893,7 +186978,7 @@ async function projectResolver(req, res, next) {
 // apps/dashboard/server/src/routes/repos.ts
 var import_express = __toESM(require_express2(), 1);
 init_dist();
-import * as fs59 from "fs";
+import * as fs60 from "fs";
 
 // packages/core/dist/lib/errors.js
 function createAppError(message, statusCode) {
@@ -194473,6 +194558,7 @@ var HISTORY_FILE2 = "history.json";
 var RESULT_FILE = "result.json";
 var RECIPE_FILE = "recipe.json";
 var MANIFEST_FILE = "manifest.json";
+var DECISIONS_FILE = "decisions.json";
 function guardDir(repoRoot) {
   return path11.join(repoRoot, TRUECOURSE_DIR3, GUARD_DIR);
 }
@@ -194500,6 +194586,9 @@ function recipePath(repoRoot) {
 function manifestPath(repoRoot) {
   return path11.join(scenariosDir(repoRoot), MANIFEST_FILE);
 }
+function guardDecisionsPath(repoRoot) {
+  return path11.join(scenariosDir(repoRoot), DECISIONS_FILE);
+}
 function evidenceRunDir(repoRoot, runId) {
   return path11.join(guardDir(repoRoot), EVIDENCE_DIR, runId);
 }
@@ -195232,6 +195321,14 @@ function writeFile(dir, name, content) {
 
 // packages/guard-runner/dist/run-scenario.js
 var ENV_PINS = DETERMINISM_PINS;
+var SANDBOX_SETUP_EXPECTED = "sandbox setup to succeed";
+var CAPABILITY_SETUP_EXPECTED = "setup capabilities to materialize";
+function isSetupDefectResult(result) {
+  if (result.outcome !== "error")
+    return false;
+  const expected = result.failure?.expected;
+  return expected === SANDBOX_SETUP_EXPECTED || expected === CAPABILITY_SETUP_EXPECTED;
+}
 async function runScenario(scenario, ctx) {
   const start = Date.now();
   const base = {
@@ -195252,7 +195349,7 @@ async function runScenario(scenario, ctx) {
       ...base,
       outcome: "error",
       durationMs: Date.now() - start,
-      failure: { step: 1, expected: "sandbox setup to succeed", actual: message }
+      failure: { step: 1, expected: SANDBOX_SETUP_EXPECTED, actual: message }
     };
   }
   const normCtx = { sandboxRoot: sandbox.root, repoRoot: ctx.repoRoot };
@@ -195267,7 +195364,7 @@ async function runScenario(scenario, ctx) {
         ...base,
         outcome: "error",
         durationMs: Date.now() - start,
-        failure: { step: 1, expected: "setup capabilities to materialize", actual: message }
+        failure: { step: 1, expected: CAPABILITY_SETUP_EXPECTED, actual: message }
       };
     }
     for (let i = 0; i < scenario.steps.length; i++) {
@@ -195747,8 +195844,47 @@ async function mapWithConcurrency(items, limit, fn) {
   return results;
 }
 
-// packages/core/dist/lib/spec-store.js
+// packages/guard-runner/dist/decisions.js
+init_dist();
 import fs21 from "node:fs";
+function readGuardDecisions(repoRoot) {
+  const file = guardDecisionsPath(repoRoot);
+  if (!fs21.existsSync(file))
+    return EMPTY_GUARD_DECISIONS;
+  try {
+    const parsed = GuardDecisionsSchema.safeParse(JSON.parse(fs21.readFileSync(file, "utf-8")));
+    return parsed.success ? parsed.data : EMPTY_GUARD_DECISIONS;
+  } catch {
+    return EMPTY_GUARD_DECISIONS;
+  }
+}
+function writeGuardDecisions(repoRoot, decisions) {
+  const target = guardDecisionsPath(repoRoot);
+  atomicWriteJson2(target, decisions);
+  return target;
+}
+function dismissGuardClaim(repoRoot, claim) {
+  const decisions = readGuardDecisions(repoRoot);
+  const key4 = dismissedClaimKey(claim.doc, claim.anchor, claim.title);
+  const dismissedClaims = decisions.dismissedClaims.filter((d) => dismissedClaimKey(d.doc, d.anchor, d.title) !== key4);
+  dismissedClaims.push(claim);
+  const next = { ...decisions, dismissedClaims };
+  writeGuardDecisions(repoRoot, next);
+  return next;
+}
+function undismissGuardClaim(repoRoot, identity) {
+  const decisions = readGuardDecisions(repoRoot);
+  const key4 = dismissedClaimKey(identity.doc, identity.anchor, identity.title);
+  const next = {
+    ...decisions,
+    dismissedClaims: decisions.dismissedClaims.filter((d) => dismissedClaimKey(d.doc, d.anchor, d.title) !== key4)
+  };
+  writeGuardDecisions(repoRoot, next);
+  return next;
+}
+
+// packages/core/dist/lib/spec-store.js
+import fs22 from "node:fs";
 import path20 from "node:path";
 function specPath(repoKey, artifact) {
   return path20.join(repoKey, ".truecourse", "specs", `${artifact}.json`);
@@ -195764,18 +195900,18 @@ var FileSpecStore = class {
       throw new Error(PR_DECISIONS_FILE_ERROR);
     }
     const file = specPath(ref.repoKey, artifact);
-    fs21.mkdirSync(path20.dirname(file), { recursive: true });
-    fs21.writeFileSync(file, JSON.stringify(json2, null, 2) + "\n", "utf-8");
+    fs22.mkdirSync(path20.dirname(file), { recursive: true });
+    fs22.writeFileSync(file, JSON.stringify(json2, null, 2) + "\n", "utf-8");
   }
   async loadSpec(ref, artifact) {
     if (artifact === "decisions" && isPrDecisionsRef(ref.commitSha)) {
       throw new Error(PR_DECISIONS_FILE_ERROR);
     }
     const file = specPath(ref.repoKey, artifact);
-    if (!fs21.existsSync(file))
+    if (!fs22.existsSync(file))
       return null;
     try {
-      return JSON.parse(fs21.readFileSync(file, "utf-8"));
+      return JSON.parse(fs22.readFileSync(file, "utf-8"));
     } catch {
       return null;
     }
@@ -195785,8 +195921,8 @@ var FileSpecStore = class {
       throw new Error(PR_DECISIONS_FILE_ERROR);
     }
     const file = specPath(ref.repoKey, artifact);
-    if (fs21.existsSync(file))
-      fs21.rmSync(file);
+    if (fs22.existsSync(file))
+      fs22.rmSync(file);
   }
   // The file impl is single-document-per-repo, so "latest" === read the file.
   async loadLatest(repoKey, artifact) {
@@ -195814,7 +195950,7 @@ var latestSpecCommit = (repoKey) => active6.latestCommit(repoKey);
 var specsMaterializeInPlace = () => active6.materializesInPlace;
 
 // packages/core/dist/lib/verify-store.js
-import fs22 from "node:fs";
+import fs23 from "node:fs";
 import path21 from "node:path";
 
 // packages/core/dist/types/verify-snapshot.js
@@ -195913,7 +196049,7 @@ var FileVerifyStore = class {
     const file = verifyLatestPath(repoPath);
     let mtime;
     try {
-      mtime = fs22.statSync(file).mtimeMs;
+      mtime = fs23.statSync(file).mtimeMs;
     } catch (err) {
       if (err.code === "ENOENT") {
         latestCache2.delete(repoPath);
@@ -195924,7 +196060,7 @@ var FileVerifyStore = class {
     const cached = latestCache2.get(repoPath);
     if (cached && cached.mtime === mtime)
       return cached.data;
-    const data = JSON.parse(fs22.readFileSync(file, "utf-8"));
+    const data = JSON.parse(fs23.readFileSync(file, "utf-8"));
     latestCache2.set(repoPath, { mtime, data });
     return data;
   }
@@ -195934,7 +196070,7 @@ var FileVerifyStore = class {
   }
   async deleteVerifyLatest(repoPath) {
     try {
-      fs22.unlinkSync(verifyLatestPath(repoPath));
+      fs23.unlinkSync(verifyLatestPath(repoPath));
     } catch (err) {
       if (err.code !== "ENOENT")
         throw err;
@@ -195948,21 +196084,21 @@ var FileVerifyStore = class {
   }
   async readVerifyRun(repoPath, filename) {
     const file = verifyRunPath(repoPath, filename);
-    if (!fs22.existsSync(file))
+    if (!fs23.existsSync(file))
       return null;
-    return JSON.parse(fs22.readFileSync(file, "utf-8"));
+    return JSON.parse(fs23.readFileSync(file, "utf-8"));
   }
   async listVerifyRuns(repoPath) {
     const dir = runsDir(repoPath);
-    if (!fs22.existsSync(dir))
+    if (!fs23.existsSync(dir))
       return [];
-    return fs22.readdirSync(dir).filter((n) => n.endsWith(".json")).sort();
+    return fs23.readdirSync(dir).filter((n) => n.endsWith(".json")).sort();
   }
   async readVerifyHistory(repoPath) {
     const file = verifyHistoryPath(repoPath);
-    if (!fs22.existsSync(file))
+    if (!fs23.existsSync(file))
       return { runs: [] };
-    return JSON.parse(fs22.readFileSync(file, "utf-8"));
+    return JSON.parse(fs23.readFileSync(file, "utf-8"));
   }
   async appendVerifyHistory(repoPath, entry) {
     const history = await this.readVerifyHistory(repoPath);
@@ -195975,7 +196111,7 @@ var FileVerifyStore = class {
     if (!entry)
       return false;
     try {
-      fs22.unlinkSync(verifyRunPath(repoPath, entry.filename));
+      fs23.unlinkSync(verifyRunPath(repoPath, entry.filename));
     } catch (err) {
       if (err.code !== "ENOENT")
         throw err;
@@ -195997,16 +196133,16 @@ var FileVerifyStore = class {
   }
   async readVerifyDiff(repoPath, scope) {
     const file = verifyDiffPath(repoPath, scope);
-    if (!fs22.existsSync(file))
+    if (!fs23.existsSync(file))
       return null;
-    return JSON.parse(fs22.readFileSync(file, "utf-8"));
+    return JSON.parse(fs23.readFileSync(file, "utf-8"));
   }
   async writeVerifyDiff(repoPath, diff, scope) {
     atomicWriteJson(verifyDiffPath(repoPath, scope), diff);
   }
   async deleteVerifyDiff(repoPath, scope) {
     try {
-      fs22.unlinkSync(verifyDiffPath(repoPath, scope));
+      fs23.unlinkSync(verifyDiffPath(repoPath, scope));
     } catch (err) {
       if (err.code !== "ENOENT")
         throw err;
@@ -196257,7 +196393,7 @@ var CuratedCorpusSchema = external_exports.object({
 });
 
 // packages/spec-consolidator/dist/corpus-store.js
-import fs23 from "node:fs";
+import fs24 from "node:fs";
 import path22 from "node:path";
 var CORPUS_FILE = "corpus.json";
 function corpusFilePath(repoRoot) {
@@ -196265,10 +196401,10 @@ function corpusFilePath(repoRoot) {
 }
 function readCorpus(repoRoot) {
   const file = corpusFilePath(repoRoot);
-  if (!fs23.existsSync(file))
+  if (!fs24.existsSync(file))
     return null;
   try {
-    const raw = JSON.parse(fs23.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs24.readFileSync(file, "utf-8"));
     return CuratedCorpusSchema.parse(raw);
   } catch {
     return null;
@@ -196276,7 +196412,7 @@ function readCorpus(repoRoot) {
 }
 function writeCorpus(repoRoot, input) {
   const file = corpusFilePath(repoRoot);
-  fs23.mkdirSync(path22.dirname(file), { recursive: true });
+  fs24.mkdirSync(path22.dirname(file), { recursive: true });
   const payload = {
     version: 3,
     // Caller may pass the timestamp it stamped on the in-memory corpus so the
@@ -196287,16 +196423,16 @@ function writeCorpus(repoRoot, input) {
     relations: input.relations,
     skippedDocs: input.skippedDocs ?? []
   };
-  fs23.writeFileSync(file, JSON.stringify(payload, null, 2) + "\n");
+  fs24.writeFileSync(file, JSON.stringify(payload, null, 2) + "\n");
 }
 
 // packages/spec-consolidator/dist/area-tagger.js
 init_zod();
 import { createHash as createHash2 } from "node:crypto";
-import fs26 from "node:fs";
+import fs27 from "node:fs";
 
 // packages/llm/dist/cache-store.js
-import fs24 from "node:fs";
+import fs25 from "node:fs";
 import path23 from "node:path";
 var FileKvCacheStore = class {
   file(scope, cacheName, key4) {
@@ -196304,18 +196440,18 @@ var FileKvCacheStore = class {
   }
   async get(scope, cacheName, key4) {
     const file = this.file(scope, cacheName, key4);
-    if (!fs24.existsSync(file))
+    if (!fs25.existsSync(file))
       return null;
     try {
-      return JSON.parse(fs24.readFileSync(file, "utf-8"));
+      return JSON.parse(fs25.readFileSync(file, "utf-8"));
     } catch {
       return null;
     }
   }
   async set(scope, cacheName, key4, value) {
     const file = this.file(scope, cacheName, key4);
-    fs24.mkdirSync(path23.dirname(file), { recursive: true });
-    fs24.writeFileSync(file, JSON.stringify(value, null, 2));
+    fs25.mkdirSync(path23.dirname(file), { recursive: true });
+    fs25.writeFileSync(file, JSON.stringify(value, null, 2));
   }
 };
 var active8 = new FileKvCacheStore();
@@ -196397,7 +196533,7 @@ function docBody(doc) {
     return doc.content;
   if (doc.absPath) {
     try {
-      return fs26.readFileSync(doc.absPath, "utf-8");
+      return fs27.readFileSync(doc.absPath, "utf-8");
     } catch {
     }
   }
@@ -197002,7 +197138,7 @@ function spawnRelationRunner(opts = {}) {
 // packages/spec-consolidator/dist/overlap-detector.js
 init_zod();
 import { createHash as createHash6 } from "node:crypto";
-import fs27 from "node:fs";
+import fs28 from "node:fs";
 init_transport();
 var DEFAULT_MAX_PAIRS_PER_AREA = 60;
 async function flagOverlaps(repoRoot, areas, docs, opts = {}) {
@@ -197183,7 +197319,7 @@ function docBody2(doc) {
     return doc.content;
   if (doc.absPath) {
     try {
-      return fs27.readFileSync(doc.absPath, "utf-8");
+      return fs28.readFileSync(doc.absPath, "utf-8");
     } catch {
     }
   }
@@ -197275,14 +197411,14 @@ async function writeCache3(scope, cacheKey, verdict) {
 
 // packages/spec-consolidator/dist/curate.js
 init_dist();
-import fs30 from "node:fs";
+import fs31 from "node:fs";
 import path27 from "node:path";
 
 // packages/spec-consolidator/dist/discovery.js
 init_dist();
 import { execFileSync } from "node:child_process";
 import { createHash as createHash7 } from "node:crypto";
-import fs28 from "node:fs";
+import fs29 from "node:fs";
 import path26 from "node:path";
 var SKIP_DIR_PROBE = "__tc_skipdir_probe__.md";
 var PREVIEW_LINE_LIMIT = 200;
@@ -197294,7 +197430,7 @@ function discoverDocs(rootDir, opts = {}) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs28.readdirSync(dir, { withFileTypes: true });
+      entries = fs29.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -197333,8 +197469,8 @@ function makeCandidate(absPath, rootDir, previewLines, opts) {
   let content;
   let stat;
   try {
-    content = fs28.readFileSync(absPath, "utf-8");
-    stat = fs28.statSync(absPath);
+    content = fs29.readFileSync(absPath, "utf-8");
+    stat = fs29.statSync(absPath);
   } catch {
     return null;
   }
@@ -197402,7 +197538,7 @@ function looksLikePrd(content) {
 // packages/spec-consolidator/dist/relevance-filter.js
 init_zod();
 import { createHash as createHash8 } from "node:crypto";
-import fs29 from "node:fs";
+import fs30 from "node:fs";
 init_transport();
 function prefilterDocs(docs, manualIncludes = []) {
   const manualSet = new Set(manualIncludes);
@@ -197526,7 +197662,7 @@ function docBody3(doc) {
     return doc.content;
   if (doc.absPath) {
     try {
-      return fs29.readFileSync(doc.absPath, "utf-8");
+      return fs30.readFileSync(doc.absPath, "utf-8");
     } catch {
     }
   }
@@ -197787,10 +197923,10 @@ var EMPTY_DECISIONS = {
 };
 function readCorpusDecisions(repoRoot) {
   const file = path27.join(repoRoot, ".truecourse", "specs", "decisions.json");
-  if (!fs30.existsSync(file))
+  if (!fs31.existsSync(file))
     return EMPTY_DECISIONS;
   try {
-    const raw = JSON.parse(fs30.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs31.readFileSync(file, "utf-8"));
     return DecisionsFileSchema.parse(raw);
   } catch {
     return EMPTY_DECISIONS;
@@ -197798,7 +197934,7 @@ function readCorpusDecisions(repoRoot) {
 }
 
 // packages/spec-consolidator/dist/orchestrator.js
-import fs31 from "node:fs";
+import fs32 from "node:fs";
 import path28 from "node:path";
 var EMPTY_DECISIONS2 = {
   version: 1,
@@ -197812,10 +197948,10 @@ function decisionsPath(repoRoot) {
 }
 function readDecisions(repoRoot) {
   const file = decisionsPath(repoRoot);
-  if (!fs31.existsSync(file))
+  if (!fs32.existsSync(file))
     return EMPTY_DECISIONS2;
   try {
-    const raw = JSON.parse(fs31.readFileSync(file, "utf-8"));
+    const raw = JSON.parse(fs32.readFileSync(file, "utf-8"));
     return DecisionsFileSchema.parse(raw);
   } catch {
     return EMPTY_DECISIONS2;
@@ -197823,8 +197959,8 @@ function readDecisions(repoRoot) {
 }
 function writeDecisions(repoRoot, decisions) {
   const file = decisionsPath(repoRoot);
-  fs31.mkdirSync(path28.dirname(file), { recursive: true });
-  fs31.writeFileSync(file, JSON.stringify(decisions, null, 2) + "\n");
+  fs32.mkdirSync(path28.dirname(file), { recursive: true });
+  fs32.writeFileSync(file, JSON.stringify(decisions, null, 2) + "\n");
 }
 
 // packages/contract-verifier/dist/parser-ohm/index.js
@@ -199986,13 +200122,13 @@ UnicodeChar.prototype.toFailure = function(grammar2) {
   return new Failure(this, "a Unicode [" + this.categoryOrProp + "] character", "description");
 };
 Alt.prototype.toFailure = function(grammar2) {
-  const fs66 = this.terms.map((t) => t.toFailure(grammar2));
-  const description = "(" + fs66.join(" or ") + ")";
+  const fs67 = this.terms.map((t) => t.toFailure(grammar2));
+  const description = "(" + fs67.join(" or ") + ")";
   return new Failure(this, description, "description");
 };
 Seq.prototype.toFailure = function(grammar2) {
-  const fs66 = this.factors.map((f2) => f2.toFailure(grammar2));
-  const description = "(" + fs66.join(" ") + ")";
+  const fs67 = this.factors.map((f2) => f2.toFailure(grammar2));
+  const description = "(" + fs67.join(" ") + ")";
   return new Failure(this, description, "description");
 };
 Iter.prototype.toFailure = function(grammar2) {
@@ -201711,9 +201847,9 @@ function buildGrammar2(match4, namespace, optOhmGrammarForTesting, options) {
         decl.withSuperGrammar(namespace[superGrammarName]);
       }
     },
-    Rule_define(n, fs66, d, _, b) {
+    Rule_define(n, fs67, d, _, b) {
       currentRuleName = n.visit();
-      currentRuleFormals = fs66.children.map((c) => c.visit())[0] || [];
+      currentRuleFormals = fs67.children.map((c) => c.visit())[0] || [];
       if (!decl.defaultStartRule && decl.ensureSuperGrammar() !== Grammar.ProtoBuiltInRules) {
         decl.withDefaultStartRule(currentRuleName);
       }
@@ -201722,9 +201858,9 @@ function buildGrammar2(match4, namespace, optOhmGrammarForTesting, options) {
       const source = this.source.trimmed();
       return decl.define(currentRuleName, currentRuleFormals, body, description, source);
     },
-    Rule_override(n, fs66, _, b) {
+    Rule_override(n, fs67, _, b) {
       currentRuleName = n.visit();
-      currentRuleFormals = fs66.children.map((c) => c.visit())[0] || [];
+      currentRuleFormals = fs67.children.map((c) => c.visit())[0] || [];
       const source = this.source.trimmed();
       decl.ensureSuperGrammarRuleForOverriding(currentRuleName, source);
       overriding = true;
@@ -201732,9 +201868,9 @@ function buildGrammar2(match4, namespace, optOhmGrammarForTesting, options) {
       overriding = false;
       return decl.override(currentRuleName, currentRuleFormals, body, null, source);
     },
-    Rule_extend(n, fs66, _, b) {
+    Rule_extend(n, fs67, _, b) {
       currentRuleName = n.visit();
-      currentRuleFormals = fs66.children.map((c) => c.visit())[0] || [];
+      currentRuleFormals = fs67.children.map((c) => c.visit())[0] || [];
       const body = b.visit();
       const source = this.source.trimmed();
       return decl.extend(currentRuleName, currentRuleFormals, body, null, source);
@@ -201761,8 +201897,8 @@ function buildGrammar2(match4, namespace, optOhmGrammarForTesting, options) {
         return builder.alt(...args).withSource(this.source);
       }
     },
-    Formals(opointy, fs66, cpointy) {
-      return fs66.visit();
+    Formals(opointy, fs67, cpointy) {
+      return fs67.visit();
     },
     Params(opointy, ps, cpointy) {
       return ps.visit();
@@ -201908,8 +202044,8 @@ function initPrototypeParser(grammar2) {
         formals: optFormals.children.map((c) => c.parse())[0] || []
       };
     },
-    Formals(oparen, fs66, cparen) {
-      return fs66.asIteration().children.map((c) => c.parse());
+    Formals(oparen, fs67, cparen) {
+      return fs67.asIteration().children.map((c) => c.parse());
     },
     name(first2, rest) {
       return this.sourceString;
@@ -205148,13 +205284,13 @@ function effectGroupRules(c, body) {
 // packages/contract-verifier/dist/extractor/index.js
 init_dist3();
 init_dist();
-import fs42 from "node:fs";
+import fs43 from "node:fs";
 import path44 from "node:path";
 
 // packages/contract-verifier/dist/extractor/source-walker.js
 init_dist3();
 init_dist();
-import fs33 from "node:fs";
+import fs34 from "node:fs";
 import path33 from "node:path";
 var EXT_TO_LANG = {
   ".ts": "typescript",
@@ -205203,7 +205339,7 @@ async function eachParsedSource(rootDir, visit) {
   const walk20 = (dir) => {
     let entries;
     try {
-      entries = fs33.readdirSync(dir, { withFileTypes: true });
+      entries = fs34.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -205226,7 +205362,7 @@ async function eachParsedSource(rootDir, visit) {
         continue;
       let source;
       try {
-        source = fs33.readFileSync(full, "utf-8");
+        source = fs34.readFileSync(full, "utf-8");
       } catch {
         continue;
       }
@@ -207237,7 +207373,7 @@ function walk2(node2, visit) {
 // packages/contract-verifier/dist/extractor/file-based-routes.js
 init_dist3();
 init_dist();
-import fs34 from "node:fs";
+import fs35 from "node:fs";
 import path34 from "node:path";
 var TS_EXT = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
 var HTTP_METHODS5 = /* @__PURE__ */ new Set(["get", "post", "put", "delete", "patch", "options", "head"]);
@@ -207269,7 +207405,7 @@ function findDirs(rootDir, wantedRel) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs34.readdirSync(dir, { withFileTypes: true });
+      entries = fs35.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -207295,7 +207431,7 @@ function findDirs(rootDir, wantedRel) {
 function walkRoot(rootAbs, root, out) {
   const tcIgnore = loadTcIgnore(rootAbs);
   const visit = (dir) => {
-    for (const entry of fs34.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs35.readdirSync(dir, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === ".git")
         continue;
       const full = path34.join(dir, entry.name);
@@ -207320,7 +207456,7 @@ function walkRoot(rootAbs, root, out) {
       const url = deriveUrl(relUnderRoot, root);
       if (url === null)
         continue;
-      const source = fs34.readFileSync(full, "utf-8");
+      const source = fs35.readFileSync(full, "utf-8");
       const lang = ext2 === ".tsx" ? "tsx" : ext2 === ".ts" ? "typescript" : "javascript";
       let tree;
       try {
@@ -207437,7 +207573,7 @@ function collectHttpMethodExports(root, source) {
 }
 
 // packages/contract-verifier/dist/extractor/mount-graph.js
-import fs35 from "node:fs";
+import fs36 from "node:fs";
 import path35 from "node:path";
 var ROUTER_FACTORIES = /* @__PURE__ */ new Set(["Router", "express"]);
 function analyzeRouterFile(filePath, source, tree) {
@@ -207589,7 +207725,7 @@ function resolveImportPath(fromFile, spec) {
   ];
   for (const c of candidates) {
     const abs = path35.resolve(baseDir, c);
-    if (fs35.existsSync(abs) && fs35.statSync(abs).isFile())
+    if (fs36.existsSync(abs) && fs36.statSync(abs).isFile())
       return abs;
   }
   return null;
@@ -207769,7 +207905,7 @@ function joinPath2(prefix, suffix) {
 // packages/contract-verifier/dist/extractor/auth-presence.js
 init_dist3();
 init_dist();
-import fs36 from "node:fs";
+import fs37 from "node:fs";
 import path36 from "node:path";
 var TS_EXT2 = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
 var AUTH_MIDDLEWARE_NAMES = /* @__PURE__ */ new Set([
@@ -207790,7 +207926,7 @@ async function detectAuthPresence(rootDir) {
   const scanned = [];
   const tcIgnore = loadTcIgnore(rootDir);
   const visit = (dir) => {
-    for (const entry of fs36.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs37.readdirSync(dir, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === ".git")
         continue;
       const full = path36.join(dir, entry.name);
@@ -207805,7 +207941,7 @@ async function detectAuthPresence(rootDir) {
       const ext2 = path36.extname(entry.name);
       if (!TS_EXT2.has(ext2))
         continue;
-      const source = fs36.readFileSync(full, "utf-8");
+      const source = fs37.readFileSync(full, "utf-8");
       const lang = ext2 === ".tsx" ? "tsx" : ext2 === ".ts" ? "typescript" : "javascript";
       let tree;
       try {
@@ -207898,7 +208034,7 @@ function resolveImportPath2(importingFile, sourceStr) {
       candidates.push(path36.join(baseRaw, `index${ext2}`));
   }
   for (const c of candidates) {
-    if (fs36.existsSync(c) && fs36.statSync(c).isFile())
+    if (fs37.existsSync(c) && fs37.statSync(c).isFile())
       return c;
   }
   return null;
@@ -207971,7 +208107,7 @@ function slice2(node2, source) {
 // packages/contract-verifier/dist/extractor/idempotency-presence.js
 init_dist3();
 init_dist();
-import fs37 from "node:fs";
+import fs38 from "node:fs";
 import path37 from "node:path";
 var TS_EXT3 = /* @__PURE__ */ new Set([".ts", ".tsx", ".js", ".jsx"]);
 var HTTP_METHODS6 = /* @__PURE__ */ new Set(["get", "post", "put", "delete", "patch"]);
@@ -207986,7 +208122,7 @@ async function detectIdempotencyPresence(rootDir, requestHeader) {
   const scanned = [];
   const tcIgnore = loadTcIgnore(rootDir);
   const visit = (dir) => {
-    for (const entry of fs37.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs38.readdirSync(dir, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === ".git")
         continue;
       const full = path37.join(dir, entry.name);
@@ -208001,7 +208137,7 @@ async function detectIdempotencyPresence(rootDir, requestHeader) {
       const ext2 = path37.extname(entry.name);
       if (!TS_EXT3.has(ext2))
         continue;
-      const source = fs37.readFileSync(full, "utf-8");
+      const source = fs38.readFileSync(full, "utf-8");
       const lang = ext2 === ".tsx" ? "tsx" : ext2 === ".ts" ? "typescript" : "javascript";
       let tree;
       try {
@@ -208232,7 +208368,7 @@ function resolveImportPath3(importingFile, sourceStr) {
       candidates.push(path37.join(baseRaw, `index${ext2}`));
   }
   for (const c of candidates) {
-    if (fs37.existsSync(c) && fs37.statSync(c).isFile())
+    if (fs38.existsSync(c) && fs38.statSync(c).isFile())
       return c;
   }
   return null;
@@ -211478,7 +211614,7 @@ async function extractEnumsFromDir(rootDir) {
 }
 
 // packages/contract-verifier/dist/extractor/forbidden/index.js
-import fs39 from "node:fs";
+import fs40 from "node:fs";
 import path40 from "node:path";
 
 // packages/contract-verifier/dist/comparator/minimatch.js
@@ -211503,7 +211639,7 @@ function minimatch2(input, pattern) {
 
 // packages/contract-verifier/dist/extractor/manifests.js
 init_dist();
-import fs38 from "node:fs";
+import fs39 from "node:fs";
 import path39 from "node:path";
 var SKIP_DIRS3 = /* @__PURE__ */ new Set([
   "node_modules",
@@ -211528,7 +211664,7 @@ function collectDependencies(rootDir) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs38.readdirSync(dir, { withFileTypes: true });
+      entries = fs39.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -211567,7 +211703,7 @@ var NPM_FIELDS = ["dependencies", "devDependencies", "peerDependencies", "option
 function readPackageJson(filePath) {
   let pkg;
   try {
-    pkg = JSON.parse(fs38.readFileSync(filePath, "utf-8"));
+    pkg = JSON.parse(fs39.readFileSync(filePath, "utf-8"));
   } catch {
     return [];
   }
@@ -211592,7 +211728,7 @@ function pyDistName(spec) {
 function readRequirements(filePath) {
   let text4;
   try {
-    text4 = fs38.readFileSync(filePath, "utf-8");
+    text4 = fs39.readFileSync(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -211607,7 +211743,7 @@ function readRequirements(filePath) {
 function readPyproject(filePath) {
   let text4;
   try {
-    text4 = fs38.readFileSync(filePath, "utf-8");
+    text4 = fs39.readFileSync(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -211632,7 +211768,7 @@ function readPyproject(filePath) {
 function readSetupPy(filePath) {
   let text4;
   try {
-    text4 = fs38.readFileSync(filePath, "utf-8");
+    text4 = fs39.readFileSync(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -211650,7 +211786,7 @@ function readSetupPy(filePath) {
 function readXmlPackageTags(filePath, tag, idAttr, versionAttr, field) {
   let text4;
   try {
-    text4 = fs38.readFileSync(filePath, "utf-8");
+    text4 = fs39.readFileSync(filePath, "utf-8");
   } catch {
     return [];
   }
@@ -211685,7 +211821,7 @@ function detectForbiddenFiles(rootDir, pattern) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs39.readdirSync(dir, { withFileTypes: true });
+      entries = fs40.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -211922,7 +212058,7 @@ function detectFlagInConfigFiles(rootDir, name) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs39.readdirSync(dir, { withFileTypes: true });
+      entries = fs40.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -211941,7 +212077,7 @@ function detectFlagInConfigFiles(rootDir, name) {
         continue;
       let source;
       try {
-        source = fs39.readFileSync(full, "utf-8");
+        source = fs40.readFileSync(full, "utf-8");
       } catch {
         continue;
       }
@@ -214857,7 +214993,7 @@ function extractEmissionFacts(ops) {
 
 // packages/contract-verifier/dist/extractor/entity-schema/index.js
 init_dist();
-import fs40 from "node:fs";
+import fs41 from "node:fs";
 import path41 from "node:path";
 var SKIP_DIRS5 = /* @__PURE__ */ new Set([
   "node_modules",
@@ -214878,7 +215014,7 @@ async function extractEntitiesFromDir(rootDir) {
   const walk20 = (dir) => {
     let entries;
     try {
-      entries = fs40.readdirSync(dir, { withFileTypes: true });
+      entries = fs41.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -214891,7 +215027,7 @@ async function extractEntitiesFromDir(rootDir) {
       if (e.isDirectory())
         walk20(full);
       else if (e.isFile() && e.name.endsWith(".prisma")) {
-        out.push(...parsePrismaModels(full, fs40.readFileSync(full, "utf-8")));
+        out.push(...parsePrismaModels(full, fs41.readFileSync(full, "utf-8")));
       }
     }
   };
@@ -216405,7 +216541,7 @@ function importsMatching(scan3, modules) {
 }
 
 // packages/contract-verifier/dist/extractor/architecture/shared/config-files.js
-import fs41 from "node:fs";
+import fs42 from "node:fs";
 import path42 from "node:path";
 init_dist();
 var SKIP_DIRS6 = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".next", "coverage", ".cache", ".truecourse"]);
@@ -216416,7 +216552,7 @@ function collectFileIndex(rootDir) {
   const visit = (dir) => {
     let entries;
     try {
-      entries = fs41.readdirSync(dir, { withFileTypes: true });
+      entries = fs42.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -216442,7 +216578,7 @@ function collectFileIndex(rootDir) {
         return cache3.get(relPath);
       let text4;
       try {
-        text4 = fs41.readFileSync(path42.join(rootDir, relPath), "utf-8");
+        text4 = fs42.readFileSync(path42.join(rootDir, relPath), "utf-8");
       } catch {
         text4 = null;
       }
@@ -216778,7 +216914,7 @@ async function extractOperationsFromDir(rootDir) {
   const fileAnalyses = [];
   const tcIgnore = loadTcIgnore(rootDir);
   const visit = (dir) => {
-    for (const entry of fs42.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs43.readdirSync(dir, { withFileTypes: true })) {
       if (entry.name === "node_modules" || entry.name === ".git")
         continue;
       const full = path44.join(dir, entry.name);
@@ -216795,7 +216931,7 @@ async function extractOperationsFromDir(rootDir) {
         continue;
       if (isTestFile3(full))
         continue;
-      const source = fs42.readFileSync(full, "utf-8");
+      const source = fs43.readFileSync(full, "utf-8");
       const lang = ext2 === ".ts" || ext2 === ".tsx" ? ext2 === ".tsx" ? "tsx" : "typescript" : "javascript";
       let tree;
       try {
@@ -218820,7 +218956,7 @@ function describeExposure(c) {
 }
 
 // packages/contract-verifier/dist/verify.js
-import fs43 from "node:fs";
+import fs44 from "node:fs";
 import path46 from "node:path";
 
 // packages/contract-verifier/dist/occurrence.js
@@ -219055,12 +219191,12 @@ function assignEnclosingSymbols(drifts, index) {
 async function verify(opts) {
   const specFiles = [];
   walkTcFiles(opts.contractsDir, (filePath) => {
-    specFiles.push({ path: filePath, source: fs43.readFileSync(filePath, "utf-8") });
+    specFiles.push({ path: filePath, source: fs44.readFileSync(filePath, "utf-8") });
   }, opts.includeInferred ?? false);
   const baseFiles = [];
-  if (opts.baseContractsDir && fs43.existsSync(opts.baseContractsDir)) {
+  if (opts.baseContractsDir && fs44.existsSync(opts.baseContractsDir)) {
     walkTcFiles(opts.baseContractsDir, (filePath) => {
-      const source = fs43.readFileSync(filePath, "utf-8");
+      const source = fs44.readFileSync(filePath, "utf-8");
       baseFiles.push(parseTcFile(filePath, source));
     }, opts.includeInferred ?? false);
   }
@@ -219450,7 +219586,7 @@ async function verify(opts) {
   };
 }
 function walkTcFiles(rootDir, visit, includeInferred) {
-  for (const entry of fs43.readdirSync(rootDir, { withFileTypes: true })) {
+  for (const entry of fs44.readdirSync(rootDir, { withFileTypes: true })) {
     const full = path46.join(rootDir, entry.name);
     if (entry.isDirectory()) {
       if (!includeInferred && entry.name === "_inferred")
@@ -219465,7 +219601,7 @@ function cryptoRandomId() {
 }
 
 // packages/contract-verifier/dist/infer/index.js
-import fs44 from "node:fs";
+import fs45 from "node:fs";
 import path48 from "node:path";
 
 // packages/contract-verifier/dist/infer/serialize.js
@@ -219771,7 +219907,7 @@ async function infer(opts) {
 function loadAuthored(contractsDir) {
   const files = [];
   walkAuthoredTcFiles(contractsDir, (filePath) => {
-    files.push({ path: filePath, source: fs44.readFileSync(filePath, "utf-8") });
+    files.push({ path: filePath, source: fs45.readFileSync(filePath, "utf-8") });
   });
   return parseAndResolve(files).index;
 }
@@ -220470,21 +220606,21 @@ function writeInferred(contractsDir, decisions, options = {}) {
       proposed.push(filePath);
       continue;
     }
-    fs44.mkdirSync(path48.dirname(filePath), { recursive: true });
-    const existing = fs44.existsSync(filePath) ? fs44.readFileSync(filePath, "utf-8") : null;
+    fs45.mkdirSync(path48.dirname(filePath), { recursive: true });
+    const existing = fs45.existsSync(filePath) ? fs45.readFileSync(filePath, "utf-8") : null;
     if (existing === r.tcSource)
       continue;
-    fs44.writeFileSync(filePath, r.tcSource);
+    fs45.writeFileSync(filePath, r.tcSource);
     written.push(filePath);
   }
-  if (!options.dryRun && fs44.existsSync(root))
+  if (!options.dryRun && fs45.existsSync(root))
     pruneStale(root, live);
   return { written, proposed };
 }
 function walkAuthoredTcFiles(rootDir, visit) {
-  if (!fs44.existsSync(rootDir))
+  if (!fs45.existsSync(rootDir))
     return;
-  for (const entry of fs44.readdirSync(rootDir, { withFileTypes: true })) {
+  for (const entry of fs45.readdirSync(rootDir, { withFileTypes: true })) {
     if (entry.isDirectory()) {
       if (entry.name === INFERRED_DIR)
         continue;
@@ -220500,22 +220636,22 @@ function toRelCode(codeDir, fp) {
 }
 function pruneStale(root, live) {
   const visit = (dir) => {
-    if (!fs44.existsSync(dir))
+    if (!fs45.existsSync(dir))
       return false;
     let dirEmpty = true;
-    for (const entry of fs44.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs45.readdirSync(dir, { withFileTypes: true })) {
       const full = path48.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (visit(full)) {
           try {
-            fs44.rmdirSync(full);
+            fs45.rmdirSync(full);
           } catch {
           }
         } else {
           dirEmpty = false;
         }
       } else if (entry.isFile() && entry.name.endsWith(".tc") && !live.has(full)) {
-        fs44.unlinkSync(full);
+        fs45.unlinkSync(full);
       } else {
         dirEmpty = false;
       }
@@ -220670,7 +220806,7 @@ function validateMerged(artifacts) {
 }
 
 // packages/contract-extractor/dist/writer.js
-import fs45 from "node:fs";
+import fs46 from "node:fs";
 import path49 from "node:path";
 
 // packages/contract-extractor/dist/identity.js
@@ -220707,14 +220843,14 @@ function writeContracts(repoRoot, artifacts, options = {}) {
       proposed.push(req.filePath);
       continue;
     }
-    fs45.mkdirSync(path49.dirname(req.filePath), { recursive: true });
-    const existing = fs45.existsSync(req.filePath) ? fs45.readFileSync(req.filePath, "utf-8") : null;
+    fs46.mkdirSync(path49.dirname(req.filePath), { recursive: true });
+    const existing = fs46.existsSync(req.filePath) ? fs46.readFileSync(req.filePath, "utf-8") : null;
     if (existing === req.tcSource)
       continue;
-    fs45.writeFileSync(req.filePath, req.tcSource);
+    fs46.writeFileSync(req.filePath, req.tcSource);
     written.push(req.filePath);
   }
-  if (options.prune && !options.dryRun && fs45.existsSync(root)) {
+  if (options.prune && !options.dryRun && fs46.existsSync(root)) {
     const live = new Set(requests.map((r) => r.filePath));
     pruneStale2(root, live);
   }
@@ -220780,16 +220916,16 @@ function inferKindDomain2(artifact) {
 }
 function pruneStale2(root, live) {
   const visit = (dir) => {
-    if (!fs45.existsSync(dir))
+    if (!fs46.existsSync(dir))
       return false;
     let dirEmpty = true;
-    for (const entry of fs45.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs46.readdirSync(dir, { withFileTypes: true })) {
       const full = path49.join(dir, entry.name);
       if (entry.isDirectory()) {
         const childEmpty = visit(full);
         if (childEmpty) {
           try {
-            fs45.rmdirSync(full);
+            fs46.rmdirSync(full);
           } catch {
           }
         } else {
@@ -220797,7 +220933,7 @@ function pruneStale2(root, live) {
         }
       } else if (entry.isFile()) {
         if (entry.name.endsWith(".tc") && !live.has(full)) {
-          fs45.unlinkSync(full);
+          fs46.unlinkSync(full);
         } else {
           dirEmpty = false;
         }
@@ -223726,7 +223862,7 @@ async function assembleArtifacts(ranked, slices, opts = {}) {
 }
 
 // packages/contract-extractor/dist/corpus-reader.js
-import fs46 from "node:fs";
+import fs47 from "node:fs";
 import path50 from "node:path";
 function hasCorpusSpec(repoRoot) {
   return readCorpus(repoRoot) !== null;
@@ -223824,7 +223960,7 @@ function orderByPrecedence(docs, areaId, relations) {
 }
 function defaultResolveContent(repoRoot, ref) {
   try {
-    return fs46.readFileSync(path50.join(repoRoot, ref), "utf-8");
+    return fs47.readFileSync(path50.join(repoRoot, ref), "utf-8");
   } catch {
     return null;
   }
@@ -223964,7 +224100,7 @@ import { createHash as createHash12 } from "node:crypto";
 init_transport();
 
 // packages/contract-extractor/dist/manifest.js
-import fs47 from "node:fs";
+import fs48 from "node:fs";
 import path51 from "node:path";
 import { createHash as createHash11 } from "node:crypto";
 var MANIFEST_REL = path51.join(".truecourse", "contracts", "manifest.json");
@@ -223983,7 +224119,7 @@ function manifestPath2(repoRoot) {
 }
 function readManifest2(repoRoot) {
   try {
-    const raw = JSON.parse(fs47.readFileSync(manifestPath2(repoRoot), "utf-8"));
+    const raw = JSON.parse(fs48.readFileSync(manifestPath2(repoRoot), "utf-8"));
     if (raw && raw.version === 1 && raw.areas)
       return raw;
   } catch {
@@ -223992,8 +224128,8 @@ function readManifest2(repoRoot) {
 }
 function writeManifest2(repoRoot, manifest) {
   const file = manifestPath2(repoRoot);
-  fs47.mkdirSync(path51.dirname(file), { recursive: true });
-  fs47.writeFileSync(file, JSON.stringify(manifest, null, 2) + "\n");
+  fs48.mkdirSync(path51.dirname(file), { recursive: true });
+  fs48.writeFileSync(file, JSON.stringify(manifest, null, 2) + "\n");
 }
 function classifyAreas(areas, manifest) {
   const prev = manifest?.areas ?? {};
@@ -224451,7 +224587,7 @@ function spawnGenerateRunner(opts = {}) {
 }
 
 // packages/core/dist/config/llm-models.js
-import fs48 from "node:fs";
+import fs49 from "node:fs";
 var STAGE_DEFAULTS = {
   "spec.relevance": "haiku",
   // Area tagging is load-bearing (wrong tags → wrong generate inputs) and Haiku
@@ -224499,10 +224635,10 @@ function stageEnvVar(stageId) {
 }
 function readConfigSync(repoDir) {
   const file = getRepoConfigPath(repoDir);
-  if (!fs48.existsSync(file))
+  if (!fs49.existsSync(file))
     return {};
   try {
-    return JSON.parse(fs48.readFileSync(file, "utf-8"));
+    return JSON.parse(fs49.readFileSync(file, "utf-8"));
   } catch {
     return {};
   }
@@ -224539,7 +224675,7 @@ function resolveFallbackModel(repoDir = resolveRepoDir(process.cwd())) {
 init_transport();
 
 // packages/core/dist/lib/llm-call-log.js
-import fs49 from "node:fs";
+import fs50 from "node:fs";
 import path52 from "node:path";
 import { randomUUID as randomUUID20 } from "node:crypto";
 function truthyEnv(v) {
@@ -224561,20 +224697,20 @@ function createLlmCallLogger(repoRoot, label = "scan") {
   if (!log2 && !dump2)
     return null;
   const logDir = path52.join(repoRoot, ".truecourse", "logs");
-  fs49.mkdirSync(logDir, { recursive: true });
+  fs50.mkdirSync(logDir, { recursive: true });
   const runId = `${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}_${randomUUID20().slice(0, 8)}`;
   const callsPath = path52.join(logDir, `llm-${label}-${runId}.jsonl`);
   const summaryPath = path52.join(logDir, `llm-${label}-${runId}.summary.json`);
   const ioDir = dump2 ? path52.join(logDir, `llm-${label}-${runId}.io`) : null;
   if (ioDir)
-    fs49.mkdirSync(ioDir, { recursive: true });
+    fs50.mkdirSync(ioDir, { recursive: true });
   const createdAt = Date.now();
   const records = [];
   let seq2 = 0;
   let finished = false;
   let fd = null;
   try {
-    fd = fs49.openSync(callsPath, "a");
+    fd = fs50.openSync(callsPath, "a");
   } catch {
     fd = null;
   }
@@ -224584,14 +224720,14 @@ function createLlmCallLogger(repoRoot, label = "scan") {
     records.push(metrics);
     if (fd !== null) {
       try {
-        fs49.writeSync(fd, JSON.stringify(metrics) + "\n");
+        fs50.writeSync(fd, JSON.stringify(metrics) + "\n");
       } catch {
       }
     }
     if (ioDir) {
       const fname = `${String(seq2).padStart(5, "0")}-${sanitize3(rec.id) || rec.stage}.json`;
       try {
-        fs49.writeFileSync(path52.join(ioDir, fname), JSON.stringify({
+        fs50.writeFileSync(path52.join(ioDir, fname), JSON.stringify({
           stage: rec.stage,
           model: rec.model,
           ok: rec.ok,
@@ -224621,13 +224757,13 @@ function createLlmCallLogger(repoRoot, label = "scan") {
       process.removeListener(sig, h);
     if (fd !== null) {
       try {
-        fs49.closeSync(fd);
+        fs50.closeSync(fd);
       } catch {
       }
     }
     const summary = summarizeLlmCalls(records, elapsedMs);
     try {
-      fs49.writeFileSync(summaryPath, JSON.stringify(summary, null, 2));
+      fs50.writeFileSync(summaryPath, JSON.stringify(summary, null, 2));
     } catch {
     }
     printSummary(summary, callsPath, ioDir);
@@ -224753,7 +224889,7 @@ init_dist();
 
 // packages/guard-generator/dist/section-plan.js
 init_zod();
-import fs50 from "node:fs";
+import fs51 from "node:fs";
 import path53 from "node:path";
 import { createHash as createHash14 } from "node:crypto";
 init_dist();
@@ -225071,10 +225207,10 @@ var CorpusShape2 = external_exports.object({
 function readCorpusAreaTags(repoRoot) {
   const file = path53.join(repoRoot, ".truecourse", "specs", "corpus.json");
   const map2 = /* @__PURE__ */ new Map();
-  if (!fs50.existsSync(file))
+  if (!fs51.existsSync(file))
     return map2;
   try {
-    const parsed = CorpusShape2.safeParse(JSON.parse(fs50.readFileSync(file, "utf-8")));
+    const parsed = CorpusShape2.safeParse(JSON.parse(fs51.readFileSync(file, "utf-8")));
     if (!parsed.success)
       return map2;
     for (const d of parsed.data.docs ?? [])
@@ -225093,17 +225229,17 @@ function generationInputsHash(fingerprint2, recipeFingerprint) {
   ].join("\0")).digest("hex");
 }
 function hasGuardUniverse(repoRoot) {
-  return fs50.existsSync(path53.join(repoRoot, ".truecourse", "specs", "corpus.json"));
+  return fs51.existsSync(path53.join(repoRoot, ".truecourse", "specs", "corpus.json"));
 }
 function planGuardWork(repoRoot, recipeFingerprint) {
   const recipeFp = recipeFingerprint ?? computeRecipeFingerprint(repoRoot);
-  const recipeMissing = !fs50.existsSync(recipePath(repoRoot));
+  const recipeMissing = !fs51.existsSync(recipePath(repoRoot));
   const hasUniverse = hasGuardUniverse(repoRoot);
   const { indexes } = indexRepoDocs(repoRoot, []);
   const areaTags = readCorpusAreaTags(repoRoot);
   const sections = [];
   for (const [doc, index] of indexes) {
-    const texts = extractSectionTexts(doc, fs50.readFileSync(path53.resolve(repoRoot, doc), "utf-8"));
+    const texts = extractSectionTexts(doc, fs51.readFileSync(path53.resolve(repoRoot, doc), "utf-8"));
     for (const s of index.sections) {
       const t = texts.get(s.anchor);
       sections.push({
@@ -225148,7 +225284,7 @@ function collectWorkDocs(repoRoot, plan) {
   }
   return [...byDoc].map(([doc, sections]) => ({
     doc,
-    content: fs50.readFileSync(path53.resolve(repoRoot, doc), "utf-8"),
+    content: fs51.readFileSync(path53.resolve(repoRoot, doc), "utf-8"),
     sections
   }));
 }
@@ -225535,7 +225671,7 @@ function truncate2(text4) {
 }
 
 // packages/guard-generator/dist/recipe-discovery.js
-import fs51 from "node:fs";
+import fs52 from "node:fs";
 import os7 from "node:os";
 import path55 from "node:path";
 import { createHash as createHash17 } from "node:crypto";
@@ -225591,8 +225727,8 @@ async function discoverRecipe(repoRoot, runner2) {
     ...proposal.env ? { env: proposal.env } : {}
   };
   const target = recipePath(repoRoot);
-  fs51.mkdirSync(path55.dirname(target), { recursive: true });
-  fs51.writeFileSync(target, JSON.stringify(recipe, null, 2) + "\n");
+  fs52.mkdirSync(path55.dirname(target), { recursive: true });
+  fs52.writeFileSync(target, JSON.stringify(recipe, null, 2) + "\n");
   return {
     status: "discovered",
     recipe,
@@ -225623,13 +225759,13 @@ async function proposeRecipeWithReask(input, runner2) {
 }
 function readDiscoveryInputs(repoRoot) {
   const pkgPath = path55.join(repoRoot, "package.json");
-  const packageJson = fs51.existsSync(pkgPath) ? fs51.readFileSync(pkgPath, "utf-8") : "(no package.json)";
-  const presentInputs = DISCOVERY_INPUTS.filter((f2) => fs51.existsSync(path55.join(repoRoot, f2)));
+  const packageJson = fs52.existsSync(pkgPath) ? fs52.readFileSync(pkgPath, "utf-8") : "(no package.json)";
+  const presentInputs = DISCOVERY_INPUTS.filter((f2) => fs52.existsSync(path55.join(repoRoot, f2)));
   return { packageJson, presentInputs };
 }
 async function probeEntry(repoRoot, entry) {
   const resolved = resolveEntry(repoRoot, entry);
-  const cwd = fs51.mkdtempSync(path55.join(os7.tmpdir(), "tc-guard-probe-"));
+  const cwd = fs52.mkdtempSync(path55.join(os7.tmpdir(), "tc-guard-probe-"));
   try {
     for (const args of [["--help"], []]) {
       const capture = await executeStep({
@@ -225646,7 +225782,7 @@ async function probeEntry(repoRoot, entry) {
       reason: `entrypoint ${JSON.stringify(entry)} did not answer to \`--help\` or a bare invocation`
     };
   } finally {
-    fs51.rmSync(cwd, { recursive: true, force: true });
+    fs52.rmSync(cwd, { recursive: true, force: true });
   }
 }
 
@@ -225693,7 +225829,7 @@ async function birthValidate(repoRoot, candidates, opts = {}) {
 }
 
 // packages/guard-generator/dist/serialize.js
-import fs52 from "node:fs";
+import fs53 from "node:fs";
 import path56 from "node:path";
 init_dist();
 function anchorLeaf(anchor) {
@@ -225736,15 +225872,15 @@ function scenarioFileIndex(repoRoot) {
   const root = scenariosDir(repoRoot);
   const map2 = /* @__PURE__ */ new Map();
   const walk20 = (dir) => {
-    if (!fs52.existsSync(dir))
+    if (!fs53.existsSync(dir))
       return;
-    for (const entry of fs52.readdirSync(dir, { withFileTypes: true })) {
+    for (const entry of fs53.readdirSync(dir, { withFileTypes: true })) {
       const full = path56.join(dir, entry.name);
       if (entry.isDirectory())
         walk20(full);
       else if (entry.isFile() && /\.ya?ml$/i.test(entry.name)) {
         try {
-          const doc = jsYaml.load(fs52.readFileSync(full, "utf-8"));
+          const doc = jsYaml.load(fs53.readFileSync(full, "utf-8"));
           if (doc && typeof doc.id === "string")
             map2.set(doc.id, full);
         } catch {
@@ -225758,19 +225894,22 @@ function scenarioFileIndex(repoRoot) {
 function existingScenarioIds(repoRoot) {
   return new Set(loadScenarios(repoRoot).scenarios.map((s) => s.id));
 }
+function serializeScenarioYaml(scenario) {
+  return jsYaml.dump(scenario, { lineWidth: -1, noRefs: true });
+}
 function writeScenarioFile(repoRoot, slug2, scenario) {
   const dir = path56.join(scenariosDir(repoRoot), slug2);
-  fs52.mkdirSync(dir, { recursive: true });
+  fs53.mkdirSync(dir, { recursive: true });
   const file = path56.join(dir, `${scenario.id}.yaml`);
-  fs52.writeFileSync(file, jsYaml.dump(scenario, { lineWidth: -1, noRefs: true }));
+  fs53.writeFileSync(file, serializeScenarioYaml(scenario));
   return path56.relative(repoRoot, file);
 }
 function deleteScenarioFiles(repoRoot, ids) {
   const index = scenarioFileIndex(repoRoot);
   for (const id of ids) {
     const file = index.get(id);
-    if (file && fs52.existsSync(file))
-      fs52.rmSync(file);
+    if (file && fs53.existsSync(file))
+      fs53.rmSync(file);
   }
 }
 
@@ -225840,7 +225979,9 @@ async function generateGuards(options) {
       errors: [],
       extractionFailures: [],
       orphaned,
-      birthPassed: 0
+      birthPassed: 0,
+      heldSections: [],
+      orphanedDismissals: []
     };
   }
   const limit = pLimit(Math.max(1, options.concurrency ?? defaultConcurrency3()));
@@ -225855,6 +225996,10 @@ async function generateGuards(options) {
   const coverageGaps = [];
   const errors = [];
   const extractionFailures = [];
+  const decisions = readGuardDecisions(repoRoot);
+  const dismissalByKey = new Map(decisions.dismissedClaims.map((d) => [dismissedClaimKey(d.doc, d.anchor, d.title), d]));
+  const extractedClaimKeys = /* @__PURE__ */ new Set();
+  const extractedDocs = /* @__PURE__ */ new Set();
   const workDocs = collectWorkDocs(repoRoot, plan);
   const workKeys = new Set(plan.work.map(key2));
   const workDocByPath = new Map(workDocs.map((d) => [d.doc, d]));
@@ -225884,34 +226029,47 @@ async function generateGuards(options) {
         reason: `${result.failedViews} extraction view(s) failed \u2014 re-run to complete coverage for affected sections`
       });
     }
+    extractedDocs.add(doc.doc);
+    for (const c of result.data.claims) {
+      extractedClaimKeys.add(dismissedClaimKey(doc.doc, c.sectionAnchor, c.claim));
+    }
     const { claimsByAnchor, noteByAnchor } = groupExtraction(result.data);
     for (const s of doc.sections) {
       if (!workKeys.has(key2(s)))
         continue;
       const claims = claimsByAnchor.get(s.anchor) ?? [];
-      const cli = claims.filter((c) => isRunnableDriver(c.driver));
+      const cliAll = claims.filter((c) => isRunnableDriver(c.driver));
       const others = claims.filter((c) => !isRunnableDriver(c.driver));
       const note = noteByAnchor.get(s.anchor);
+      const cli = cliAll.filter((c) => !dismissalByKey.has(dismissedClaimKey(s.doc, s.anchor, c.claim)));
+      const dismissed = cliAll.filter((c) => dismissalByKey.has(dismissedClaimKey(s.doc, s.anchor, c.claim)));
+      for (const d of dismissed) {
+        const entry = dismissalByKey.get(dismissedClaimKey(s.doc, s.anchor, d.claim));
+        coverageGaps.push({ doc: s.doc, anchor: s.anchor, kind: "dismissed", reason: dismissedReason(d.claim, entry?.note) });
+      }
       for (const o of others) {
         coverageGaps.push({ doc: s.doc, anchor: s.anchor, kind: "awaiting-driver", driver: o.driver, reason: o.reason });
       }
       if (cli.length === 0 && others.length === 0) {
-        if (!result.complete && !note) {
-          extractFailedKeys.add(key2(s));
-          continue;
+        if (dismissed.length === 0) {
+          if (!result.complete && !note) {
+            extractFailedKeys.add(key2(s));
+            continue;
+          }
+          coverageGaps.push({
+            doc: s.doc,
+            anchor: s.anchor,
+            kind: note ? "untestable" : "no-claim",
+            reason: note?.reason ?? "the section states no CLI-assertable claim"
+          });
         }
-        coverageGaps.push({
-          doc: s.doc,
-          anchor: s.anchor,
-          kind: note ? "untestable" : "no-claim",
-          reason: note?.reason ?? "the section states no CLI-assertable claim"
-        });
       }
       classificationByKey.set(key2(s), deriveClassification(cli, others, note));
       for (const c of cli)
         authTasks.push({ ref: `c${refSeq++}`, section: s, claim: c });
     }
   }
+  const orphanedDismissals = decisions.dismissedClaims.filter((d) => extractedDocs.has(d.doc) && !extractedClaimKeys.has(dismissedClaimKey(d.doc, d.anchor, d.title))).map((d) => ({ doc: d.doc, anchor: d.anchor, title: d.title }));
   const buildPromise = runBuild(repoRoot, recipe.build, recipe.env);
   let buildAnnounced = false;
   const awaitBuild = async () => {
@@ -225980,6 +226138,7 @@ async function generateGuards(options) {
   };
   const written = [];
   const birthFindings = [];
+  const heldSections = [];
   let entryPreflightFailure = null;
   let birthTotal = 0;
   let birthSettled = 0;
@@ -226087,9 +226246,9 @@ async function generateGuards(options) {
           pushInto(r1ByRef, o.candidate.ref, o);
         const retryEntries = [];
         for (const [ref, outcomes] of r1ByRef) {
-          const fail = outcomes.find((o) => o.result.outcome === "fail");
-          if (fail) {
-            retryEntries.push({ task: taskByRef.get(ref), evidence: toFinding(fail) });
+          const retriable2 = outcomes.find((o) => o.result.outcome === "fail" || isSetupDefectResult(o.result));
+          if (retriable2) {
+            retryEntries.push({ task: taskByRef.get(ref), evidence: toFinding(retriable2) });
             continue;
           }
           for (const o of outcomes) {
@@ -226148,6 +226307,16 @@ async function generateGuards(options) {
         ids.push(c.scenario.id);
       }
       upsertSection(section, ids);
+    } else if (persistedHere.length > 0) {
+      heldSections.push({
+        doc: section.doc,
+        anchor: section.anchor,
+        readyScenarios: persistedHere.map((c) => ({
+          id: c.scenario.id,
+          title: c.scenario.title,
+          yaml: serializeScenarioYaml(c.scenario)
+        }))
+      });
     }
   }
   const authorTotal = authTasks.length;
@@ -226226,6 +226395,8 @@ async function generateGuards(options) {
     extractionFailures,
     orphaned,
     birthPassed,
+    heldSections,
+    orphanedDismissals,
     manifestPath: manifestPath(repoRoot),
     ...entryPreflightFailure ? { entryPreflight: entryPreflightFailure } : {}
   };
@@ -226272,7 +226443,9 @@ function emptyResult(status, extra) {
     errors: [],
     extractionFailures: [],
     orphaned: [],
-    birthPassed: 0
+    birthPassed: 0,
+    heldSections: [],
+    orphanedDismissals: []
   };
 }
 function readPriorManifest(repoRoot) {
@@ -226367,9 +226540,18 @@ function toFinding(o) {
     step: f2?.step ?? 1,
     expected: f2?.expected ?? "",
     actual: f2?.actual ?? "",
-    ...o.result.evidencePath ? { evidencePath: o.result.evidencePath } : {}
+    ...o.result.evidencePath ? { evidencePath: o.result.evidencePath } : {},
+    // Judge-on-one-screen (item 19): the failed candidate's exact YAML rides inline
+    // so the finding detail shows the commands it ran; `claim` is the dismissal
+    // identity (item 20) so the detail's Dismiss action can key on it.
+    yaml: serializeScenarioYaml(o.candidate.scenario),
+    claim: o.candidate.claim.claim
   };
 }
+function dismissedReason(claim, note) {
+  const base = `dismissed: ${oneLine(claim)}`;
+  return note ? `${base} \u2014 ${oneLine(note)}` : base;
+}
 function errorFrom(o) {
   return {
     doc: o.candidate.section.doc,
@@ -226854,7 +227036,7 @@ function routeContextInner(rules, fileAnalyses, fileContents) {
 }
 
 // packages/core/dist/services/llm/model-prices.js
-import fs53 from "node:fs";
+import fs54 from "node:fs";
 import path57 from "node:path";
 var OPENROUTER_URL = "https://openrouter.ai/api/v1/models";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
@@ -226875,7 +227057,7 @@ function cacheFilePath() {
 }
 function readCache7() {
   try {
-    const t = JSON.parse(fs53.readFileSync(cacheFilePath(), "utf-8"));
+    const t = JSON.parse(fs54.readFileSync(cacheFilePath(), "utf-8"));
     if (t && t.tiers && t.byId && typeof t.fetchedAt === "number")
       return t;
   } catch {
@@ -226884,8 +227066,8 @@ function readCache7() {
 }
 function writeCache7(t) {
   try {
-    fs53.mkdirSync(path57.dirname(cacheFilePath()), { recursive: true });
-    fs53.writeFileSync(cacheFilePath(), JSON.stringify(t));
+    fs54.mkdirSync(path57.dirname(cacheFilePath()), { recursive: true });
+    fs54.writeFileSync(cacheFilePath(), JSON.stringify(t));
   } catch {
   }
 }
@@ -227263,7 +227445,7 @@ function changedSubject(total, changed, noun) {
 }
 
 // packages/core/dist/commands/spec-in-process.js
-import fs58 from "node:fs";
+import fs59 from "node:fs";
 import path62 from "node:path";
 import { createHash as createHash19, randomUUID as randomUUID21 } from "node:crypto";
 
@@ -227284,7 +227466,7 @@ async function repoRef(repoRoot, commitOverride) {
 }
 
 // packages/core/dist/lib/contract-store.js
-import fs54 from "node:fs";
+import fs55 from "node:fs";
 import path58 from "node:path";
 var KIND_REL = {
   contracts: [".truecourse", "contracts"],
@@ -227295,7 +227477,7 @@ function countTcFiles(dir) {
   let n = 0;
   let entries;
   try {
-    entries = fs54.readdirSync(dir, { withFileTypes: true });
+    entries = fs55.readdirSync(dir, { withFileTypes: true });
   } catch {
     return 0;
   }
@@ -227312,7 +227494,7 @@ function walkTcRel(dir, excludeInferred) {
   const walk20 = (rel) => {
     let entries;
     try {
-      entries = fs54.readdirSync(path58.join(dir, rel), { withFileTypes: true });
+      entries = fs55.readdirSync(path58.join(dir, rel), { withFileTypes: true });
     } catch {
       return;
     }
@@ -227350,13 +227532,13 @@ var FileContractStore = class {
   }
   async loadContracts(ref, kind) {
     const dir = path58.join(ref.repoKey, ...KIND_REL[kind]);
-    if (!fs54.existsSync(dir))
+    if (!fs55.existsSync(dir))
       return null;
     return { dir, cleanup: async () => {
     } };
   }
   async hasContracts(ref, kind) {
-    return fs54.existsSync(path58.join(ref.repoKey, ...KIND_REL[kind]));
+    return fs55.existsSync(path58.join(ref.repoKey, ...KIND_REL[kind]));
   }
   // The file impl reads the live repo tree, which is whatever is checked out —
   // there is no per-commit history, so `commitSha` is ignored (OSS is latest).
@@ -227365,21 +227547,21 @@ var FileContractStore = class {
   }
   async readContractFile(repoKey, kind, relPath, _commitSha) {
     const dest = safeResolve(path58.join(repoKey, ...KIND_REL[kind]), relPath);
-    if (!dest || !fs54.existsSync(dest) || !fs54.statSync(dest).isFile())
+    if (!dest || !fs55.existsSync(dest) || !fs55.statSync(dest).isFile())
       return null;
-    return fs54.readFileSync(dest, "utf-8");
+    return fs55.readFileSync(dest, "utf-8");
   }
   async putContractFile(ref, kind, relPath, content) {
     const dest = safeResolve(path58.join(ref.repoKey, ...KIND_REL[kind]), relPath);
     if (!dest)
       throw new Error(`[contract-store] unsafe contract path: ${relPath}`);
-    fs54.mkdirSync(path58.dirname(dest), { recursive: true });
-    fs54.writeFileSync(dest, content);
+    fs55.mkdirSync(path58.dirname(dest), { recursive: true });
+    fs55.writeFileSync(dest, content);
   }
   async deleteContractFile(ref, kind, relPath) {
     const dest = safeResolve(path58.join(ref.repoKey, ...KIND_REL[kind]), relPath);
     if (dest)
-      fs54.rmSync(dest, { force: true });
+      fs55.rmSync(dest, { force: true });
   }
   // OSS/local has no workspace concept (mirrors the spec store). Writing throws
   // (fail loud — a caller that reached here is mis-wired); reads are empty so an
@@ -227409,16 +227591,16 @@ var readWorkspaceContractFile = (ref, kind, relPath) => active9.readWorkspaceCon
 var contractsMaterializeInPlace = () => active9.materializesInPlace;
 
 // packages/core/dist/lib/repo-doc-reader.js
-import fs55 from "node:fs";
+import fs56 from "node:fs";
 import path59 from "node:path";
 var fileRepoDocReader = async (repoKey, docPath) => {
   const root = path59.resolve(repoKey);
   const full = path59.resolve(root, docPath);
   if (full !== root && !full.startsWith(root + path59.sep))
     return null;
-  if (!fs55.existsSync(full) || !fs55.statSync(full).isFile())
+  if (!fs56.existsSync(full) || !fs56.statSync(full).isFile())
     return null;
-  return fs55.readFileSync(full, "utf-8");
+  return fs56.readFileSync(full, "utf-8");
 };
 var reader = fileRepoDocReader;
 function readRepoDoc(repoKey, docPath, opts) {
@@ -227426,7 +227608,7 @@ function readRepoDoc(repoKey, docPath, opts) {
 }
 
 // packages/core/dist/lib/inferred-action-store.js
-import fs56 from "node:fs";
+import fs57 from "node:fs";
 import path60 from "node:path";
 function actionsFile(repoKey) {
   return path60.join(repoKey, ".truecourse", "specs", "inferred-actions.json");
@@ -227434,15 +227616,15 @@ function actionsFile(repoKey) {
 var FileInferredActionStore = class {
   read(repoKey) {
     try {
-      return JSON.parse(fs56.readFileSync(actionsFile(repoKey), "utf-8"));
+      return JSON.parse(fs57.readFileSync(actionsFile(repoKey), "utf-8"));
     } catch {
       return [];
     }
   }
   write(repoKey, actions) {
     const file = actionsFile(repoKey);
-    fs56.mkdirSync(path60.dirname(file), { recursive: true });
-    fs56.writeFileSync(file, JSON.stringify(actions, null, 2) + "\n", "utf-8");
+    fs57.mkdirSync(path60.dirname(file), { recursive: true });
+    fs57.writeFileSync(file, JSON.stringify(actions, null, 2) + "\n", "utf-8");
   }
   async setAction(repoKey, action) {
     const next = this.read(repoKey).filter((a) => !(a.kind === action.kind && a.identity === action.identity));
@@ -227565,7 +227747,7 @@ async function reapplyPromoted(ref, decisions) {
 }
 
 // packages/core/dist/services/telemetry.service.js
-import fs57 from "node:fs";
+import fs58 from "node:fs";
 import path61 from "node:path";
 import os9 from "node:os";
 import crypto5 from "node:crypto";
@@ -231361,7 +231543,7 @@ function getTelemetryConfigPath() {
 function readTelemetryConfig() {
   const configPath = getTelemetryConfigPath();
   try {
-    const raw = fs57.readFileSync(configPath, "utf-8");
+    const raw = fs58.readFileSync(configPath, "utf-8");
     const parsed = JSON.parse(raw);
     const config2 = { ...DEFAULT_CONFIG, ...parsed };
     if (!config2.anonymousId) {
@@ -231382,16 +231564,16 @@ function readTelemetryConfig() {
 function writeTelemetryConfig(partial) {
   const configPath = getTelemetryConfigPath();
   const dir = path61.dirname(configPath);
-  fs57.mkdirSync(dir, { recursive: true });
+  fs58.mkdirSync(dir, { recursive: true });
   let current;
   try {
-    const raw = fs57.readFileSync(configPath, "utf-8");
+    const raw = fs58.readFileSync(configPath, "utf-8");
     current = { ...DEFAULT_CONFIG, ...JSON.parse(raw) };
   } catch {
     current = { ...DEFAULT_CONFIG };
   }
   const merged = { ...current, ...partial };
-  fs57.writeFileSync(configPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+  fs58.writeFileSync(configPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
 }
 var posthogClient = null;
 function isTelemetryEnabled() {
@@ -231463,13 +231645,13 @@ function readToolVersion() {
   if (cachedVersion)
     return cachedVersion;
   if (true) {
-    cachedVersion = "0.7.0-next.3";
+    cachedVersion = "0.7.0-next.4";
     return cachedVersion;
   }
   try {
     const here = fileURLToPath5(import.meta.url);
     const pkgPath = path61.resolve(path61.dirname(here), "..", "..", "package.json");
-    const pkg = JSON.parse(fs57.readFileSync(pkgPath, "utf-8"));
+    const pkg = JSON.parse(fs58.readFileSync(pkgPath, "utf-8"));
     cachedVersion = String(pkg.version ?? "0.0.0");
   } catch {
     cachedVersion = "0.0.0";
@@ -231615,7 +231797,7 @@ function generatedMarkerPath(repoRoot) {
 }
 function stampGeneratedMarker(repoRoot, summary) {
   const file = generatedMarkerPath(repoRoot);
-  fs58.mkdirSync(path62.dirname(file), { recursive: true });
+  fs59.mkdirSync(path62.dirname(file), { recursive: true });
   const body = {
     generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
     written: summary?.written ?? 0,
@@ -231623,11 +231805,11 @@ function stampGeneratedMarker(repoRoot, summary) {
     validationIssues: summary?.validationIssues ?? [],
     enumerateFailures: summary?.enumerateFailures ?? []
   };
-  fs58.writeFileSync(file, JSON.stringify(body, null, 2) + "\n");
+  fs59.writeFileSync(file, JSON.stringify(body, null, 2) + "\n");
 }
 function readGeneratedSummary(repoRoot) {
   try {
-    const raw = JSON.parse(fs58.readFileSync(generatedMarkerPath(repoRoot), "utf-8"));
+    const raw = JSON.parse(fs59.readFileSync(generatedMarkerPath(repoRoot), "utf-8"));
     return {
       generatedAt: typeof raw.generatedAt === "string" ? raw.generatedAt : "",
       written: typeof raw.written === "number" ? raw.written : 0,
@@ -231762,19 +231944,19 @@ async function curateInProcess(repoRoot, options = {}) {
 }
 function buildPriorContracts(repoRoot) {
   const dir = path62.join(repoRoot, ".truecourse", "contracts");
-  if (!fs58.existsSync(dir))
+  if (!fs59.existsSync(dir))
     return void 0;
   const targets = [];
   const bodyByKey = /* @__PURE__ */ new Map();
   const walk20 = (d) => {
-    for (const e of fs58.readdirSync(d, { withFileTypes: true })) {
+    for (const e of fs59.readdirSync(d, { withFileTypes: true })) {
       if (e.isDirectory()) {
         if (e.name === "_inferred")
           continue;
         walk20(path62.join(d, e.name));
       } else if (e.name.endsWith(".tc")) {
         const abs = path62.join(d, e.name);
-        const src = fs58.readFileSync(abs, "utf-8");
+        const src = fs59.readFileSync(abs, "utf-8");
         try {
           const file = parser_ohm_exports.parseTcFile(path62.relative(dir, abs), src);
           for (const key4 of resolver_exports.resolve([file]).index.keys()) {
@@ -231982,7 +232164,7 @@ async function withContracts(repoRoot, options, tracker, fn) {
   try {
     let recorded;
     if (options.contractsDir) {
-      if (!fs58.existsSync(options.contractsDir)) {
+      if (!fs59.existsSync(options.contractsDir)) {
         const err = new Error(`Contracts directory not found at ${options.contractsDir}. Run \`truecourse contracts generate\` first.`);
         tracker?.error("load", err.message);
         throw err;
@@ -232071,7 +232253,7 @@ async function verifyInProcess(repoRoot, options = {}) {
         bySeverity: summary.bySeverity
       });
       await deleteVerifyDiff(storeKey);
-      fs58.rmSync(legacyVerifyStatePath(repoRoot), { force: true });
+      fs59.rmSync(legacyVerifyStatePath(repoRoot), { force: true });
     }
     const state = {
       verifiedAt,
@@ -232297,7 +232479,7 @@ async function inferDiffInProcess(repoRoot, options = {}) {
 }
 function autodetectCodeDir(repoRoot) {
   const codeSubdir = path62.join(repoRoot, "code");
-  if (fs58.existsSync(codeSubdir) && fs58.statSync(codeSubdir).isDirectory()) {
+  if (fs59.existsSync(codeSubdir) && fs59.statSync(codeSubdir).isDirectory()) {
     return codeSubdir;
   }
   return repoRoot;
@@ -232652,10 +232834,10 @@ router.post("/", async (req, res, next) => {
       throw createAppError("Invalid request body: path is required", 400);
     }
     const repoPath = parsed.data.path;
-    if (!fs59.existsSync(repoPath)) {
+    if (!fs60.existsSync(repoPath)) {
       throw createAppError(`Path does not exist: ${repoPath}`, 400);
     }
-    if (!fs59.statSync(repoPath).isDirectory()) {
+    if (!fs60.statSync(repoPath).isDirectory()) {
       throw createAppError(`Path is not a directory: ${repoPath}`, 400);
     }
     const entry = await registerProject(repoPath);
@@ -232738,8 +232920,8 @@ router.delete("/:id", async (req, res, next) => {
       throw createAppError("Project not found", 404);
     }
     const tcDir = getRepoTruecourseDir(entry.path);
-    if (fs59.existsSync(tcDir)) {
-      fs59.rmSync(tcDir, { recursive: true, force: true });
+    if (fs60.existsSync(tcDir)) {
+      fs60.rmSync(tcDir, { recursive: true, force: true });
     }
     await unregisterProject(slug2);
     res.status(204).send();
@@ -233448,7 +233630,7 @@ async function enrichFlowWithLLM(repoPath, flowId) {
 // packages/core/dist/services/violation-pipeline.service.js
 init_dist3();
 import { randomUUID as randomUUID26 } from "node:crypto";
-import fs60 from "node:fs";
+import fs61 from "node:fs";
 import path63 from "node:path";
 init_provider();
 
@@ -233851,7 +234033,7 @@ function findCSharpProjectFiles(repoPath) {
       return;
     let entries;
     try {
-      entries = fs60.readdirSync(dir, { withFileTypes: true });
+      entries = fs61.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
@@ -233987,9 +234169,9 @@ async function runViolationPipeline(input) {
       if (!lang)
         continue;
       const absPath = resolve11 ? path63.resolve(repoPath, filePath) : path63.isAbsolute(filePath) ? filePath : path63.join(repoPath, filePath);
-      if (!fs60.existsSync(absPath))
+      if (!fs61.existsSync(absPath))
         continue;
-      const content = fs60.readFileSync(absPath, "utf-8");
+      const content = fs61.readFileSync(absPath, "utf-8");
       const lineCount = content.split("\n").length;
       fileContents.set(changedFileSet ? absPath : filePath, { content, lineCount });
     } catch {
@@ -234186,7 +234368,7 @@ async function runViolationPipeline(input) {
           let snippet2 = fileContents.get(fileKey)?.content.split("\n")[v.line - 1];
           if (snippet2 === void 0) {
             try {
-              snippet2 = fs60.readFileSync(v.path, "utf-8").split("\n")[v.line - 1];
+              snippet2 = fs61.readFileSync(v.path, "utf-8").split("\n")[v.line - 1];
             } catch {
               snippet2 = "";
             }
@@ -234210,10 +234392,10 @@ async function runViolationPipeline(input) {
   log.info(`[Pipeline] Code scan: ${allCodeViolations.length} violations from ${filesToScan.length} files (${enabledCodeRules.length} det rules, ${enabledLlmCodeRules.length} LLM rules)`);
   if (enabledCodeRules.some((r) => r.key === "bugs/deterministic/invalid-pyproject-toml")) {
     const pyprojectPath = path63.join(repoPath, "pyproject.toml");
-    if (fs60.existsSync(pyprojectPath)) {
+    if (fs61.existsSync(pyprojectPath)) {
       try {
         const { checkPyprojectToml: checkPyprojectToml2 } = await Promise.resolve().then(() => (init_dist3(), dist_exports));
-        const content = fs60.readFileSync(pyprojectPath, "utf-8");
+        const content = fs61.readFileSync(pyprojectPath, "utf-8");
         const tomlViolations = checkPyprojectToml2(pyprojectPath, content);
         allCodeViolations.push(...tomlViolations);
       } catch {
@@ -236117,7 +236299,7 @@ var analyses_default = router2;
 var import_express3 = __toESM(require_express2(), 1);
 
 // packages/core/dist/config/ui-state.js
-import fs61 from "node:fs";
+import fs62 from "node:fs";
 var EMPTY_STATE = { positions: {}, collapsed: {} };
 function scopeKey(branch, level) {
   return `${branch || "HEAD"}/${level}`;
@@ -236125,10 +236307,10 @@ function scopeKey(branch, level) {
 var FileUiStateStore = class {
   async readUiState(repoDir) {
     const file = getRepoUiStatePath(repoDir);
-    if (!fs61.existsSync(file))
+    if (!fs62.existsSync(file))
       return structuredClone(EMPTY_STATE);
     try {
-      const parsed = JSON.parse(fs61.readFileSync(file, "utf-8"));
+      const parsed = JSON.parse(fs62.readFileSync(file, "utf-8"));
       return {
         positions: parsed.positions ?? {},
         collapsed: parsed.collapsed ?? {}
@@ -236139,7 +236321,7 @@ var FileUiStateStore = class {
   }
   async writeUiState(repoDir, state) {
     ensureRepoTruecourseDir(repoDir);
-    fs61.writeFileSync(getRepoUiStatePath(repoDir), JSON.stringify(state, null, 2), "utf-8");
+    fs62.writeFileSync(getRepoUiStatePath(repoDir), JSON.stringify(state, null, 2), "utf-8");
   }
 };
 var active11 = new FileUiStateStore();
@@ -237022,7 +237204,7 @@ var graph_default = router3;
 
 // apps/dashboard/server/src/routes/files.ts
 var import_express4 = __toESM(require_express2(), 1);
-import fs62 from "node:fs";
+import fs63 from "node:fs";
 import path67 from "node:path";
 var router4 = (0, import_express4.Router)();
 router4.get("/:id/files", async (req, res, next) => {
@@ -237058,19 +237240,19 @@ router4.get("/:id/file-content", async (req, res, next) => {
     }
     let content;
     if (ref === "working-tree") {
-      if (!fs62.existsSync(resolved)) throw createAppError("File not found", 404);
-      const stat = fs62.statSync(resolved);
+      if (!fs63.existsSync(resolved)) throw createAppError("File not found", 404);
+      const stat = fs63.statSync(resolved);
       if (!stat.isFile()) throw createAppError("Path is not a file", 400);
-      content = fs62.readFileSync(resolved, "utf-8");
+      content = fs63.readFileSync(resolved, "utf-8");
     } else {
       const git = await getGit(repo.path);
       try {
         content = await git.show([`HEAD:${filePath}`]);
       } catch {
-        if (!fs62.existsSync(resolved)) throw createAppError("File not found", 404);
-        const stat = fs62.statSync(resolved);
+        if (!fs63.existsSync(resolved)) throw createAppError("File not found", 404);
+        const stat = fs63.statSync(resolved);
         if (!stat.isFile()) throw createAppError("Path is not a file", 400);
-        content = fs62.readFileSync(resolved, "utf-8");
+        content = fs63.readFileSync(resolved, "utf-8");
       }
     }
     const ext2 = path67.extname(resolved).slice(1).toLowerCase();
@@ -237573,7 +237755,7 @@ var analytics_default = router9;
 
 // apps/dashboard/server/src/routes/spec.ts
 var import_express10 = __toESM(require_express2(), 1);
-import fs63 from "node:fs";
+import fs64 from "node:fs";
 import path68 from "node:path";
 
 // packages/core/dist/lib/background-tasks.js
@@ -237979,7 +238161,7 @@ router10.get(
 );
 function mtimeIfExists(file) {
   try {
-    return fs63.statSync(file).mtimeMs;
+    return fs64.statSync(file).mtimeMs;
   } catch {
     return null;
   }
@@ -237988,7 +238170,7 @@ function hasPendingDecisions(repoPath) {
   const decisionsMtime = mtimeIfExists(decisionsPath(repoPath));
   if (decisionsMtime === null) return false;
   try {
-    const corpus = JSON.parse(fs63.readFileSync(corpusFilePath(repoPath), "utf8"));
+    const corpus = JSON.parse(fs64.readFileSync(corpusFilePath(repoPath), "utf8"));
     const generatedAt = Date.parse(corpus.generatedAt ?? "");
     if (Number.isNaN(generatedAt)) return false;
     return decisionsMtime > generatedAt;
@@ -238607,7 +238789,7 @@ import path71 from "node:path";
 init_dist();
 
 // packages/core/dist/commands/guard-read.js
-import fs64 from "node:fs";
+import fs65 from "node:fs";
 import path70 from "node:path";
 init_dist();
 function composeDocCoverage(doc, content, sources) {
@@ -238780,7 +238962,7 @@ function headingTextIndex(repoRoot, docs) {
       continue;
     let content;
     try {
-      content = fs64.readFileSync(path70.join(repoRoot, doc), "utf-8");
+      content = fs65.readFileSync(path70.join(repoRoot, doc), "utf-8");
     } catch {
       continue;
     }
@@ -238792,15 +238974,27 @@ function headingTextIndex(repoRoot, docs) {
 }
 function readGuardReport(repoRoot) {
   const report4 = readGuardResult(repoRoot);
-  if (!report4 || report4.birthFindings.length === 0)
+  if (!report4)
+    return report4;
+  const held = report4.heldSections ?? [];
+  if (report4.birthFindings.length === 0 && held.length === 0)
     return report4;
-  const headingByDocAnchor = headingTextIndex(repoRoot, report4.birthFindings.map((f2) => f2.doc));
+  const headingByDocAnchor = headingTextIndex(repoRoot, [
+    ...report4.birthFindings.map((f2) => f2.doc),
+    ...held.map((h) => h.doc)
+  ]);
   return {
     ...report4,
     birthFindings: report4.birthFindings.map((f2) => {
       const headingText = headingByDocAnchor.get(`${f2.doc}\0${f2.anchor}`);
       return { ...f2, ...headingText ? { headingText } : {} };
-    })
+    }),
+    ...held.length > 0 ? {
+      heldSections: held.map((h) => {
+        const headingText = headingByDocAnchor.get(`${h.doc}\0${h.anchor}`);
+        return { ...h, ...headingText ? { headingText } : {} };
+      })
+    } : {}
   };
 }
 function readGuardRecipeCard(repoRoot) {
@@ -238826,7 +239020,7 @@ function scenarioFilesById(repoRoot) {
   for (const file of collectYamlFiles(scenariosDir(repoRoot)).sort()) {
     let parsed;
     try {
-      parsed = jsYaml.load(fs64.readFileSync(file, "utf-8"));
+      parsed = jsYaml.load(fs65.readFileSync(file, "utf-8"));
     } catch {
       continue;
     }
@@ -238849,7 +239043,7 @@ function readGuardScenarioSource(repoRoot, id) {
   for (const file of collectYamlFiles(scenariosDir(repoRoot))) {
     let raw;
     try {
-      raw = fs64.readFileSync(file, "utf-8");
+      raw = fs65.readFileSync(file, "utf-8");
     } catch {
       continue;
     }
@@ -238872,9 +239066,23 @@ function readGuardEvidence(repoRoot, runId, scenarioId, file = "transcript.txt")
   const runDir = path70.resolve(evidenceRunDir(repoRoot, runId));
   if (full !== runDir && !full.startsWith(runDir + path70.sep))
     return null;
-  if (!fs64.existsSync(full) || !fs64.statSync(full).isFile())
+  if (!fs65.existsSync(full) || !fs65.statSync(full).isFile())
+    return null;
+  return fs65.readFileSync(full, "utf-8");
+}
+function readGuardEvidenceAt(repoRoot, evidenceDir, file = "transcript.txt") {
+  if (!SAFE_SEGMENT.test(file))
+    return null;
+  const evidenceRoot = path70.resolve(guardDir(repoRoot), "evidence");
+  const dir = path70.resolve(repoRoot, evidenceDir);
+  if (dir !== evidenceRoot && !dir.startsWith(evidenceRoot + path70.sep))
+    return null;
+  const full = path70.resolve(dir, file);
+  if (!full.startsWith(dir + path70.sep))
+    return null;
+  if (!fs65.existsSync(full) || !fs65.statSync(full).isFile())
     return null;
-  return fs64.readFileSync(full, "utf-8");
+  return fs65.readFileSync(full, "utf-8");
 }
 function computeGuardStaleness(repoRoot) {
   const corpusMtime = mtimeIfExists2(corpusFilePath(repoRoot));
@@ -238900,10 +239108,10 @@ function newestScenarioMtime(repoRoot) {
   return newest;
 }
 function collectYamlFiles(dir) {
-  if (!fs64.existsSync(dir))
+  if (!fs65.existsSync(dir))
     return [];
   const out = [];
-  for (const entry of fs64.readdirSync(dir, { withFileTypes: true })) {
+  for (const entry of fs65.readdirSync(dir, { withFileTypes: true })) {
     const full = path70.join(dir, entry.name);
     if (entry.isDirectory())
       out.push(...collectYamlFiles(full));
@@ -238914,16 +239122,16 @@ function collectYamlFiles(dir) {
 }
 function mtimeIfExists2(file) {
   try {
-    return fs64.statSync(file).mtimeMs;
+    return fs65.statSync(file).mtimeMs;
   } catch {
     return null;
   }
 }
 function readJson(file, map2) {
-  if (!fs64.existsSync(file))
+  if (!fs65.existsSync(file))
     return null;
   try {
-    return map2(JSON.parse(fs64.readFileSync(file, "utf-8")));
+    return map2(JSON.parse(fs65.readFileSync(file, "utf-8")));
   } catch {
     return null;
   }
@@ -239063,6 +239271,33 @@ router13.get("/:id/guard/evidence", async (req, res, next) => {
     next(e);
   }
 });
+router13.get("/:id/guard/finding-evidence", async (req, res, next) => {
+  try {
+    const repo = await resolveProjectForRequest(req.params.id);
+    const evidencePath = String(req.query.path ?? "");
+    if (!evidencePath) {
+      res.status(400).json({ error: "Missing ?path=<evidence dir>." });
+      return;
+    }
+    const file = req.query.file ? String(req.query.file) : void 0;
+    const content = readGuardEvidenceAt(repo.path, evidencePath, file);
+    if (content == null) {
+      res.status(404).json({ error: "Evidence not found." });
+      return;
+    }
+    res.type("text/plain").send(content);
+  } catch (e) {
+    next(e);
+  }
+});
+router13.get("/:id/guard/decisions", async (req, res, next) => {
+  try {
+    const repo = await resolveProjectForRequest(req.params.id);
+    res.json(readGuardDecisions(repo.path));
+  } catch (e) {
+    next(e);
+  }
+});
 router13.get("/:id/guard/staleness", async (req, res, next) => {
   try {
     const repo = await resolveProjectForRequest(req.params.id);
@@ -239396,6 +239631,40 @@ router14.post("/:id/guard/run", async (req, res, next) => {
     if (held) guardJobs.delete(repoId);
   }
 });
+router14.post("/:id/guard/dismiss", async (req, res, next) => {
+  try {
+    const repo = await resolveProjectForRequest(req.params.id);
+    const body = req.body ?? {};
+    if (!body.doc || !body.anchor || !body.title) {
+      res.status(400).json({ error: "dismiss requires { doc, anchor, title }." });
+      return;
+    }
+    const decisions = dismissGuardClaim(repo.path, {
+      doc: body.doc,
+      anchor: body.anchor,
+      title: body.title,
+      dismissedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      ...body.note ? { note: body.note } : {}
+    });
+    res.json(decisions);
+  } catch (e) {
+    next(e);
+  }
+});
+router14.post("/:id/guard/undismiss", async (req, res, next) => {
+  try {
+    const repo = await resolveProjectForRequest(req.params.id);
+    const body = req.body ?? {};
+    if (!body.doc || !body.anchor || !body.title) {
+      res.status(400).json({ error: "undismiss requires { doc, anchor, title }." });
+      return;
+    }
+    const decisions = undismissGuardClaim(repo.path, { doc: body.doc, anchor: body.anchor, title: body.title });
+    res.json(decisions);
+  } catch (e) {
+    next(e);
+  }
+});
 function runFailureMessage(result) {
   switch (result.status) {
     case "no-recipe":
@@ -239573,7 +239842,7 @@ function createApp(opts = {}) {
   app.use(errorHandler);
   if (opts.serveStatic !== false) {
     const staticDir = path72.join(__dirname3, "public");
-    if (fs65.existsSync(staticDir)) {
+    if (fs66.existsSync(staticDir)) {
       app.use(import_express16.default.static(staticDir));
       app.get("*", (_req, res) => {
         res.sendFile(path72.join(staticDir, "index.html"));